|
|
| Line 17: |
Line 17: |
|
| |
|
| =Text= | | =Text= |
| {{#Wiki_filter:DONALD C. COOK NUCLEAR PLANT, UNIT 2 TECHNICAL SPECIFICATIONS BASES LIST OF EFFECTIVE PAGES Page Number Revision Number Revision Date Unit 2 Appendix A Technical Specifications Bases Table of Contents Page 1 of 3 48 01/23/15 Page 2 of 3 81 04/23/20 Page 3 of 3 0 06/01/05 B 2.0 SAFETY LIMITS (SLs) | | {{#Wiki_filter:}} |
| B 2.1.1 Reactor Core B 2.1.1-1 0 06/01/05 B 2.1.1-2 0 06/01/05 B 2.1.1-3 0 06/01/05 B 2.1.2 Reactor Coolant System (RCS) Pressure SL B 2.1.2-1 59 11/07/14 B 2.1.2-2 0 06/01/05 B 2.1.2-3 59 11/07/14 B 3.0 LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY B 3.0-1 69 04/26/18 B 3.0-2 73 01/29/20 B 3.0-3 73 01/29/20 B 3.0-4 69 04/26/18 B 3.0-5 69 04/26/18 B 3.0-6 69 04/26/18 B 3.0-7 69 04/26/18 B 3.0-8 69 04/26/18 B 3.0-9 69 04/26/18 B 3.0-10 69 04/26/18 B 3.0-11 69 04/26/18 B 3.0-12 69 04/26/18 B 3.0-13 69 04/26/18 B 3.0-14 69 04/26/18 B 3.0 SURVEILLANCE REQUIREMENT (SR) APPLICABILITY B 3.0-15 69 04/26/18 B 3.0-16 69 04/26/18 B 3.0-17 69 04/26/18 B 3.0-18 69 04/26/18 B 3.0-19 69 04/26/18 B 3.0-20 69 04/26/18 B 3.0-21 69 04/26/18 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.1 SHUTDOWN MARGIN (SDM)
| |
| B 3.1.1-1 0 06/01/05 B 3.1.1-2 0 06/01/05 B 3.1.1-3 59 11/07/14 B 3.1.1-4 0 06/01/05 B 3.1.1-5 60 10/12/15 Page 1 of 15 Issue/Effective: 9/8/21
| |
| | |
| DONALD C. COOK NUCLEAR PLANT, UNIT 2 TECHNICAL SPECIFICATIONS BASES LIST OF EFFECTIVE PAGES Page Number Revision Number Revision Date B 3.1.2 Core Reactivity B 3.1.2-1 0 06/01/05 B 3.1.2-2 0 06/01/05 B 3.1.2-3 1 07/25/05 B 3.1.2-4 0 06/01/05 B 3.1.2-5 60 10/12/15 B 3.1.3 Moderator Temperature Coefficient (MTC)
| |
| B 3.1.3-1 0 06/01/05 B 3.1.3-2 0 06/01/05 B 3.1.3-3 0 06/01/05 B 3.1.3-4 0 06/01/05 B 3.1.3-5 0 06/01/05 B 3.1.4 Rod Group Alignment Limits B 3.1.4-1 0 06/01/05 B 3.1.4-2 0 06/01/05 B 3.1.4-3 0 06/01/05 B 3.1.4-4 1 07/25/05 B 3.1.4-5 0 06/01/05 B 3.1.4-6 0 06/01/05 B 3.1.4-7 60 10/12/15 B 3.1.4-8 0 06/01/05 B 3.1.5 Shutdown Bank Insertion Limits B 3.1.5-1 1 07/18/05 B 3.1.5-2 0 06/01/05 B 3.1.5-3 0 06/01/05 B 3.1.5-4 60 10/12/15 B 3.1.6 Control Bank Insertion Limits B 3.1.6-1 0 06/01/05 B 3.1.6-2 0 06/01/05 B 3.1.6-3 0 06/01/05 B 3.1.6-4 0 06/01/05 B 3.1.6-5 60 10/12/15 B 3.1.7 Rod Position Indication B 3.1.7-1 0 06/01/05 B 3.1.7-2 0 06/01/05 B 3.1.7-3 0 06/01/05 B 3.1.7-4 0 06/01/05 B 3.1.7-5 0 06/01/05 B 3.1.7-6 0 06/01/05 B 3.1.8 PHYSICS TEST Exceptions - MODE 2 B 3.1.8-1 0 06/01/05 B 3.1.8-2 72 11/07/19 B 3.1.8-3 72 11/07/19 B 3.1.8-4 72 11/07/19 B 3.1.8-5 72 11/07/19 B 3.1.8-6 72 11/07/19 B 3.1.8-7 72 11/07/19 B 3.1.8-8 72 11/07/19 Page 2 of 15 Issue/Effective: 9/8/21
| |
| | |
| DONALD C. COOK NUCLEAR PLANT, UNIT 2 TECHNICAL SPECIFICATIONS BASES LIST OF EFFECTIVE PAGES Page Number Revision Number Revision Date B 3.2 POWER DISTRIBUTION LIMITS B 3.2.1 Heat Flux Hot Channel Factor B 3.2.1-1 0 06/01/05 B 3.2.1-2 0 06/01/05 B 3.2.1-3 0 06/01/05 B 3.2.1-4 0 06/01/05 B 3.2.1-5 0 06/01/05 B 3.2.1-6 60 10/12/15 B 3.2.1-7 74 02/12/20 B 3.2.1-8 74 02/12/20 B 3.2.2 Nuclear Enthalpy Rise Hot Channel Factor B 3.2.2-1 0 06/01/05 B 3.2.2-2 0 06/01/05 B 3.2.2-3 0 06/01/05 B 3.2.2-4 0 06/01/05 B 3.2.2-5 60 10/12/15 B 3.2.3 AXIAL FLUX DIFFERENCE (AFD)
| |
| B 3.2.3-1 1 07/25/05 B 3.2.3-2 0 06/01/05 B 3.2.3-3 0 06/01/05 B 3.2.3-4 0 06/01/05 B 3.2.3-5 0 06/01/05 B 3.2.3-6 60 10/12/15 B 3.2.4 QUADRANT POWER TILT RATIO (QPTR)
| |
| B 3.2.4-1 0 06/01/05 B 3.2.4-2 0 06/01/05 B 3.2.4-3 0 06/01/05 B 3.2.4-4 0 06/01/05 B 3.2.4-5 60 10/12/15 B 3.2.4-6 0 06/01/05 B 3.3 INSTRUMENTATION B 3.3.1 Reactor Trip System (RTS) Instrumentation B 3.3.1-1 0 06/01/05 B 3.3.1-2 0 06/01/05 B 3.3.1-3 59 11/07/14 B 3.3.1-4 0 06/01/05 B 3.3.1-5 0 06/01/05 B 3.3.1-6 0 06/01/05 B 3.3.1-7 0 06/01/05 B 3.3.1-8 0 06/01/05 B 3.3.1-9 0 06/01/05 B 3.3.1-10 0 06/01/05 B 3.3.1-11 5 03/06/06 B 3.3.1-12 5 03/06/06 B 3.3.1-13 5 03/06/06 B 3.3.1-14 5 03/06/06 B 3.3.1-15 16 09/19/07 B 3.3.1-16 5 03/06/06 B 3.3.1-17 5 03/06/06 B 3.3.1-18 5 03/06/06 Page 3 of 15 Issue/Effective: 9/8/21
| |
| | |
| DONALD C. COOK NUCLEAR PLANT, UNIT 2 TECHNICAL SPECIFICATIONS BASES LIST OF EFFECTIVE PAGES Page Number Revision Number Revision Date B 3.3.1-19 5 03/06/06 B 3.3.1-20 5 03/06/06 B 3.3.1-21 5 03/06/06 B 3.3.1-22 5 03/06/06 B 3.3.1-23 16 03/14/07 B 3.3.1-24 16 03/14/07 B 3.3.1-25 5 03/06/06 B 3.3.1-26 16 03/14/07 B 3.3.1-27 16 03/14/07 B 3.3.1-28 5 03/06/06 B 3.3.1-29 5 03/06/06 B 3.3.1-30 5 03/06/06 B 3.3.1-31 5 03/06/06 B 3.3.1-32 5 03/06/06 B 3.3.1-33 17 01/10/08 B 3.3.1-34 17 01/10/08 B 3.3.1-35 17 01/10/08 B 3.3.1-36 17 01/10/08 B 3.3.1-37 17 01/10/08 B 3.3.1-38 60 10/12/15 B 3.3.1-39 60 10/12/15 B 3.3.1-40 60 10/12/15 B 3.3.1-41 60 10/12/15 B 3.3.1-42 60 10/12/15 B 3.3.1-43 60 10/12/15 B 3.3.1-44 60 10/12/15 B 3.3.1-45 60 10/12/15 B 3.3.1-46 60 10/12/15 B 3.3.1-47 79 10/16/19 B 3.3.1-48 79 10/16/19 B 3.3.2 Engineered Safety Feature Actuation System (ESFAS) Instrumentation B 3.3.2-1 0 06/01/05 B 3.3.2-2 0 06/01/05 B 3.3.2-3 0 06/01/05 B 3.3.2-4 0 06/01/05 B 3.3.2-5 0 06/01/05 B 3.3.2-6 0 06/01/05 B 3.3.2-7 0 06/01/05 B 3.3.2-8 0 06/01/05 B 3.3.2-9 0 06/01/05 B 3.3.2-10 0 06/01/05 B 3.3.2-11 0 06/01/05 B 3.3.2-12 0 06/01/05 B 3.3.2-13 0 06/01/05 B 3.3.2-14 0 06/01/05 B 3.3.2-15 0 06/01/05 B 3.3.2-16 0 06/01/05 B 3.3.2-17 0 06/01/05 B 3.3.2-18 0 06/01/05 B 3.3.2-19 0 06/01/05 B 3.3.2-20 0 06/01/05 B 3.3.2-21 0 06/01/05 B 3.3.2-22 0 06/01/05 B 3.3.2-23 0 06/01/05 B 3.3.2-24 0 06/01/05 Page 4 of 15 Issue/Effective: 9/8/21
| |
| | |
| DONALD C. COOK NUCLEAR PLANT, UNIT 2 TECHNICAL SPECIFICATIONS BASES LIST OF EFFECTIVE PAGES Page Number Revision Number Revision Date B 3.3.2-25 0 06/01/05 B 3.3.2-26 0 06/01/05 B 3.3.2-27 0 06/01/05 B 3.3.2-28 0 06/01/05 B 3.3.2-29 0 06/01/05 B 3.3.2-30 0 06/01/05 B 3.3.2-31 58 10/12/15 B 3.3.2-32 58 10/12/15 B 3.3.2-33 0 06/01/05 B 3.3.2-34 17 01/10/08 B 3.3.2-35 58 10/12/15 B 3.3.2-36 58 10/12/15 B 3.3.2-37 60 10/12/15 B 3.3.2-38 60 10/12/15 B 3.3.2-39 60 10/12/15 B 3.3.2-40 60 10/12/15 B 3.3.2-41 58 10/12/15 B 3.3.2-42 79 10/16/19 B 3.3.2-43 79 10/16/19 B 3.3.3 Post Accident Monitoring (PAM) Instrumentation B 3.3.3-1 16 10/18/07 B 3.3.3-2 0 06/01/05 B 3.3.3-3 11 11/29/06 B 3.3.3-4 0 06/01/05 B 3.3.3-5 84 03/15/21 B 3.3.3-6 29 04/04/11 B 3.3.3-7 0 06/01/05 B 3.3.3-8 0 06/01/05 B 3.3.3-9 0 06/01/05 B 3.3.3-10 21 10/23/08 B 3.3.3-11 29 04/04/11 B 3.3.3-12 29 04/04/11 B 3.3.3-13 60 10/12/15 B 3.3.3-14 60 10/12/15 B 3.3.4 Remote Shutdown Monitoring Instrumentation B 3.3.4-1 0 06/01/05 B 3.3.4-2 0 06/01/05 B 3.3.4-3 60 10/12/15 B 3.3.4-4 60 10/12/15 B 3.3.4-5 0 06/01/05 B 3.3.5 Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation B 3.3.5-1 0 06/01/05 B 3.3.5-2 0 06/01/05 B 3.3.5-3 0 06/01/05 B 3.3.5-4 0 06/01/05 B 3.3.5-5 60 10/12/15 B 3.3.5-6 60 10/12/15 B 3.3.6 Containment Purge Supply and Exhaust System Isolation Instrumentation B 3.3.6-1 0 06/01/05 B 3.3.6-2 59 11/07/14 B 3.3.6-3 0 06/01/05 B 3.3.6-4 0 06/01/05 B 3.3.6-5 0 06/01/05 Page 5 of 15 Issue/Effective: 9/8/21
| |
| | |
| DONALD C. COOK NUCLEAR PLANT, UNIT 2 TECHNICAL SPECIFICATIONS BASES LIST OF EFFECTIVE PAGES Page Number Revision Number Revision Date B 3.3.6-6 60 10/12/15 B 3.3.6-7 60 10/12/15 B 3.3.6-8 60 10/12/15 B 3.3.7 Control Room Emergency Ventilation (CREV) System Actuation Instrumentation B 3.3.7-1 0 06/01/05 B 3.3.7-2 0 06/01/05 B 3.3.7-3 60 10/12/15 B 3.3.7-4 60 10/12/15 B 3.3.8 Boron Dilution Monitoring Instrumentation (BDMI)
| |
| B 3.3.8-1 0 06/01/05 B 3.3.8-2 0 06/01/05 B 3.3.8-3 60 10/12/15 B 3.3.8-4 60 10/12/15 B 3.4 REACTOR COOLANT SYSTEM (RCS)
| |
| B 3.4.1 RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB) Limits B 3.4.1-1 0 06/01/05 B 3.4.1-2 0 06/01/05 B 3.4.1-3 60 10/12/15 B 3.4.1-4 60 10/12/15 B 3.4.2 RCS Minimum Temperature for Criticality B 3.4.2-1 0 06/01/05 B 3.4.2-2 60 10/12/15 B 3.4.3 RCS Pressure and Temperature (P/T) Limits B 3.4.3-1 42 04/09/14 B 3.4.3-2 42 04/09/14 B 3.4.3-3 0 06/01/05 B 3.4.3-4 0 06/01/05 B 3.4.3-5 0 06/01/05 B 3.4.3-6 60 10/12/15 B 3.4.4 RCS Loops - MODES 1 and 2 B 3.4.4-1 0 06/01/05 B 3.4.4-2 12 05/04/07 B 3.4.4-3 60 10/12/15 B 3.4.5 RCS Loops - MODE 3 B 3.4.5-1 0 06/01/05 B 3.4.5-2 0 06/01/05 B 3.4.5-3 12 05/04/07 B 3.4.5-4 70 07/24/19 B 3.4.5-5 60 10/12/15 B 3.4.6 RCS Loops - MODE 4 B 3.4.6-1 0 06/01/05 B 3.4.6-2 57 01/27/16 B 3.4.6-3 0 06/01/05 B 3.4.6-4 60 10/12/15 B 3.4.6-5 57 01/27/16 B 3.4.6-6 60 10/12/15 B 3.4.7 RCS Loops - MODE 5, Loops Filled B 3.4.7-1 0 06/01/05 B 3.4.7-2 0 06/01/05 Page 6 of 15 Issue/Effective: 9/8/21
| |
| | |
| DONALD C. COOK NUCLEAR PLANT, UNIT 2 TECHNICAL SPECIFICATIONS BASES LIST OF EFFECTIVE PAGES Page Number Revision Number Revision Date B 3.4.7-3 57 01/27/16 B 3.4.7-4 60 10/12/15 B 3.4.7-5 60 10/12/15 B 3.4.7-6 60 10/12/15 B 3.4.8 RCS Loops - MODE 5, Loops Not Filled B 3.4.8-1 0 06/01/05 B 3.4.8-2 57 01/27/16 B 3.4.8-3 60 10/12/15 B 3.4.8-4 60 10/12/15 B 3.4.9 Pressurizer B 3.4.9-1 0 06/01/05 B 3.4.9-2 0 06/01/05 B 3.4.9-3 0 06/01/05 B 3.4.9-4 60 10/12/15 B 3.4.10 Pressurizer Safety Valves B 3.4.10-1 0 06/01/05 B 3.4.10-2 0 06/01/05 B 3.4.10-3 0 06/01/05 B 3.4.10-4 61 07/13/16 B 3.4.11 Pressurizer Power Operated Relief Valves (PORVs)
| |
| B 3.4.11-1 66 02/14/18 B 3.4.11-2 66 02/14/18 B 3.4.11-3 78 07/15/20 B 3.4.11-4 78 07/15/20 B 3.4.11-5 78 07/15/20 B 3.4.11-6 78 07/15/20 B 3.4.11-7 78 07/15/20 B 3.4.12 Low Temperature Overpressure Protection (LTOP) System B 3.4.12-1 0 06/01/05 B 3.4.12-2 0 06/01/05 B 3.4.12-3 0 06/01/05 B 3.4.12-4 0 06/01/05 B 3.4.12-5 0 06/01/05 B 3.4.12-6 0 06/01/05 B 3.4.12-7 0 06/01/05 B 3.4.12-8 0 06/01/05 B 3.4.12-9 0 06/01/05 B 3.4.12-10 0 06/01/05 B 3.4.12-11 60 10/12/15 B 3.4.12-12 60 10/12/15 B 3.4.12-13 60 10/12/15 B 3.4.13 RCS Operational LEAKAGE B 3.4.13-1 59 11/07/14 B 3.4.13-2 77 07/15/20 B 3.4.13-3 12 05/04/07 B 3.4.13-4 15 08/27/07 B 3.4.13-5 60 10/12/15 B 3.4.13-6 77 07/15/20 B 3.4.14 RCS Pressure Isolation Valve (PIV) Leakage B 3.4.14-1 0 06/01/05 B 3.4.14-2 0 06/01/05 B 3.4.14-3 0 06/01/05 Page 7 of 15 Issue/Effective: 9/8/21
| |
| | |
| DONALD C. COOK NUCLEAR PLANT, UNIT 2 TECHNICAL SPECIFICATIONS BASES LIST OF EFFECTIVE PAGES Page Number Revision Number Revision Date B 3.4.14-4 61 07/13/16 B 3.4.14-5 61 07/13/16 B 3.4.15 RCS Leakage Detection Instrumentation B 3.4.15-1 75 11/14/18 B 3.4.15-2 77 07/15/20 B 3.4.15-3 75 11/14/18 B 3.4.15-4 75 11/14/18 B 3.4.15-5 75 11/14/18 B 3.4.15-6 75 11/14/18 B 3.4.15-7 77 07/15/20 B 3.4.15-8 32 01/27/12 B 3.4.16 RCS Specific Activity B 3.4.16-1 59 11/07/14 B 3.4.16-2 59 11/07/14 B 3.4.16-3 59 11/07/14 B 3.4.16-4 60 10/12/15 B 3.4.17 Steam Generator (SG) Tube Integrity B 3.4.17-1 12 05/04/07 B 3.4.17-2 59 11/07/14 B 3.4.17-3 59 11/07/14 B 3.4.17-4 38 08/23/13 B 3.4.17-5 12 05/04/07 B 3.4.17-6 38 08/23/13 B 3.4.17-7 59 11/07/14 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)
| |
| B 3.5.1 Accumulators B 3.5.1-1 0 06/01/05 B 3.5.1-2 30 06/29/11 B 3.5.1-3 30 06/29/11 B 3.5.1-4 30 06/29/11 B 3.5.1-5 30 06/29/11 B 3.5.1-6 60 10/12/15 B 3.5.1-7 60 10/12/15 B 3.5.2 ECCS - Operating B 3.5.2-1 0 06/01/05 B 3.5.2-2 30 06/29/11 B 3.5.2-3 81 04/23/20 B 3.5.2-4 0 06/01/05 B 3.5.2-5 57 01/27/16 B 3.5.2-6 44 09/17/13 B 3.5.2-7 60 10/12/15 B 3.5.2-8 81 04/23/20 B 3.5.2-9 57 01/27/16 B 3.5.2-10 60 10/12/15 B 3.5.3 ECCS - Shutdown B 3.5.3-1 81 04/23/20 B 3.5.3-2 57 01/27/16 B 3.5.3-3 0 06/01/05 B 3.5.4 Refueling Water Storage Tank (RWST)
| |
| B 3.5.4-1 0 06/01/05 Page 8 of 15 Issue/Effective: 9/8/21
| |
| | |
| DONALD C. COOK NUCLEAR PLANT, UNIT 2 TECHNICAL SPECIFICATIONS BASES LIST OF EFFECTIVE PAGES Page Number Revision Number Revision Date B 3.5.4-2 0 06/01/05 B 3.5.4-3 0 06/01/05 B 3.5.4-4 0 06/01/05 B 3.5.4-5 60 10/12/15 B 3.5.5 Seal Injection Flow B 3.5.5-1 0 06/01/05 B 3.5.5-2 0 06/01/05 B 3.5.5-3 60 10/12/15 B 3.5.5-4 60 10/12/15 B 3.6 CONTAINMENT SYSTEMS B 3.6.1 Containment B 3.6.1-1 0 06/01/05 B 3.6.1-2 59 11/07/14 B 3.6.1-3 0 06/01/05 B 3.6.1-4 0 06/01/05 B 3.6.2 Containment Air Locks B 3.6.2-1 59 11/07/14 B 3.6.2-2 0 06/01/05 B 3.6.2-3 0 06/01/05 B 3.6.2-4 0 06/01/05 B 3.6.2-5 0 06/01/05 B 3.6.2-6 60 10/12/15 B 3.6.3 Containment Isolation Valves B 3.6.3-1 0 06/01/05 B 3.6.3-2 0 06/01/05 B 3.6.3-3 61 07/13/16 B 3.6.3-4 0 06/01/05 B 3.6.3-5 0 06/01/05 B 3.6.3-6 0 06/01/05 B 3.6.3-7 60 10/12/15 B 3.6.3-8 60 10/12/15 B 3.6.3-9 61 07/13/16 B 3.6.4 Containment Pressure B 3.6.4-1 54 06/15/16 B 3.6.4-2 0 06/01/05 B 3.6.4-3 60 10/12/15 B 3.6.5 Containment Air Temperature B 3.6.5-1 45 02/02/15 B 3.6.5-2 45 02/02/15 B 3.6.5-3 60 10/12/15 B 3.6.6 Containment Spray System B 3.6.6-1 0 06/01/05 B 3.6.6-2 0 06/01/05 B 3.6.6-3 54 06/15/16 B 3.6.6-4 57 01/27/16 B 3.6.6-5 60 10/12/15 B 3.6.6-6 61 07/13/16 B 3.6.6-7 57 01/27/16 B 3.6.6-8 60 10/12/15 Page 9 of 15 Issue/Effective: 9/8/21
| |
| | |
| DONALD C. COOK NUCLEAR PLANT, UNIT 2 TECHNICAL SPECIFICATIONS BASES LIST OF EFFECTIVE PAGES Page Number Revision Number Revision Date B 3.6.7 Spray Additive System B 3.6.7-1 26 02/15/10 B 3.6.7-2 0 06/01/05 B 3.6.7-3 60 10/12/15 B 3.6.7-4 60 10/12/15 B 3.6.8 DELETED B 3.6.8-1 29 04/04/11 B 3.6.8-2 29 04/04/11 B 3.6.9 Distributed Ignition System (DIS)
| |
| B 3.6.9-1 0 06/01/05 B 3.6.9-2 29 04/04/11 B 3.6.9-3 25 02/04/10 B 3.6.9-4 60 10/12/15 B 3.6.9-5 60 10/12/15 B 3.6.9-6 25 02/04/10 B 3.6.10 Containment Air Recirculation/Hydrogen Skimmer (CEQ) System B 3.6.10-1 0 06/01/05 B 3.6.10-2 0 06/01/05 B 3.6.10-3 60 10/12/15 B 3.6.10-4 60 10/12/15 B 3.6.10-5 0 06/01/05 B 3.6.11 Ice Bed B 3.6.11-1 0 06/01/05 B 3.6.11-2 0 06/01/05 B 3.6.11-3 0 06/01/05 B 3.6.11-4 60 10/12/15 B 3.6.11-5 0 06/01/05 B 3.6.11-6 60 10/12/15 B 3.6.11-7 82 03/15/21 B 3.6.11-8 60 10/12/15 B 3.6.11-9 60 10/12/15 B 3.6.11-10 82 03/15/21 B 3.6.12 Ice Condenser Doors B 3.6.12-1 0 06/01/05 B 3.6.12-2 0 06/01/05 B 3.6.12-3 0 06/01/05 B 3.6.12-4 0 06/01/05 B 3.6.12-5 60 10/12/15 B 3.6.12-6 60 10/12/15 B 3.6.12-7 60 10/12/15 B 3.6.12-8 60 10/12/15 B 3.6.13 Divider Barrier Integrity B 3.6.13-1 0 06/01/05 B 3.6.13-2 0 06/01/05 B 3.6.13-3 0 06/01/05 B 3.6.13-4 60 10/12/15 B 3.6.13-5 60 10/12/15 B 3.6.14 Containment Recirculation Drains B 3.6.14-1 19 04/16/08 B 3.6.14-2 16 10/18/07 B 3.6.14-3 16 10/18/07 Page 10 of 15 Issue/Effective: 9/8/21
| |
| | |
| DONALD C. COOK NUCLEAR PLANT, UNIT 2 TECHNICAL SPECIFICATIONS BASES LIST OF EFFECTIVE PAGES Page Number Revision Number Revision Date B 3.6.14-4 60 10/12/15 B 3.6.14-5 60 10/12/15 B 3.6.14-6 16 10/18/07 B 3.6.15-1 81 04/23/20 B 3.6.15-2 81 04/23/20 B 3.6.15-3 81 04/23/20 B 3.6.15-4 81 04/23/20 B 3.6.15-5 81 04/23/20 B 3.7 PLANT SYSTEMS B 3.7.1 Main Steam Safety Valves (MSSVs)
| |
| B 3.7.1-1 0 06/01/05 B 3.7.1-2 0 06/01/05 B 3.7.1-3 61 07/13/16 B 3.7.1-4 61 07/13/16 B 3.7.1-5 0 06/01/05 B 3.7.2 Steam Generator Stop Valves (SGSVs)
| |
| B 3.7.2-1 64 03/16/17 B 3.7.2-2 64 03/16/17 B 3.7.2-3 64 03/16/17 B 3.7.2-4 64 03/16/17 B 3.7.2-5 64 03/16/17 B 3.7.2-6 64 03/16/17 B 3.7.3 Main Feedwater Isolation Valves (MFIVs) and Main Feedwater Regulation Valves (MFRVs)
| |
| B 3.7.3-1 51 01/13/16 B 3.7.3-2 2 09/23/05 B 3.7.3-3 0 06/01/05 B 3.7.3-4 61 07/13/16 B 3.7.4 Steam Generator (SG) Power Operated Relief Valves (PORVs)
| |
| B 3.7.4-1 66 02/14/18 B 3.7.4-2 66 02/14/18 B 3.7.4-3 66 02/14/18 B 3.7.4-4 66 02/14/18 B 3.7.5 Auxiliary Feedwater (AFW) System B 3.7.5-1 0 06/01/05 B 3.7.5-2 0 06/01/05 B 3.7.5-3 0 06/01/05 B 3.7.5-4 0 06/01/05 B 3.7.5-5 80 03/25/20 B 3.7.5-6 80 03/25/20 B 3.7.5-7 80 03/25/20 B 3.7.5-8 80 03/25/20 B 3.7.5-9 80 03/25/20 B 3.7.5-10 80 03/25/20 B 3.7.6 Condensate Storage Tank (CST)
| |
| B 3.7.6-1 55 07/27/16 B 3.7.6-2 55 07/27/16 B 3.7.6-3 60 10/12/15 B 3.7.7 Component Cooling Water (CCW) System B 3.7.7-1 0 06/01/05 B 3.7.7-2 62 10/11/17 Page 11 of 15 Issue/Effective: 9/8/21
| |
| | |
| DONALD C. COOK NUCLEAR PLANT, UNIT 2 TECHNICAL SPECIFICATIONS BASES LIST OF EFFECTIVE PAGES Page Number Revision Number Revision Date B 3.7.7-3 60 10/12/15 B 3.7.7-4 60 10/12/15 B 3.7.8 Essential Service Water (ESW) System B 3.7.8-1 37 07/29/13 B 3.7.8-2 62 10/11/17 B 3.7.8-3 0 06/01/05 B 3.7.8-4 60 10/12/15 B 3.7.9 Ultimate Heat Sink (UHS)
| |
| B 3.7.9-1 0 06/01/05 B 3.7.9-2 62 10/11/17 B 3.7.9-3 60 10/12/15 B 3.7.10 Control Room Emergency Ventilation (CREV) System B 3.7.10-1 23 12/17/07 B 3.7.10-2 23 12/17/07 B 3.7.10-3 23 12/17/07 B 3.7.10-4 23 12/17/07 B 3.7.10-5 23 12/17/07 B 3.7.10-6 60 10/12/15 B 3.7.10-7 83 04/15/20 B 3.7.10-8 83 04/15/20 B 3.7.11 Control Room Air Conditioning (CRAC) System B 3.7.11-1 0 06/01/05 B 3.7.11-2 0 06/01/05 B 3.7.11-3 60 10/12/15 B 3.7.12 Engineered Safety Features (ESF) Ventilation System B 3.7.12-1 71 09/25/19 B 3.7.12-2 71 09/25/19 B 3.7.12-3 60 10/12/15 B 3.7.12-4 83 04/15/20 B 3.7.12-5 59 11/07/14 B 3.7.13 Fuel Handling Area Exhaust Ventilation (FHAEV) System B 3.7.13-1 0 06/01/05 B 3.7.13-2 59 11/07/14 B 3.7.13-3 60 10/12/15 B 3.7.13-4 83 04/15/20 B 3.7.13-5 83 04/15/20 B 3.7.14 Fuel Storage Pool Water Level B 3.7.14-1 59 11/07/14 B 3.7.14-2 60 10/12/15 B 3.7.15 Fuel Storage Pool Boron Concentration B 3.7.15-1 24 09/15/08 B 3.7.15-2 24 09/15/08 B 3.7.15-3 60 10/12/15 B 3.7.16 Spent Fuel Pool Storage B 3.7.16-1 24 09/15/08 B 3.7.16-2 24 09/15/08 B 3.7.17 Secondary Specific Activity B 3.7.17-1 59 11/07/14 B 3.7.17-2 59 11/07/14 B 3.7.17-3 60 10/12/15 Page 12 of 15 Issue/Effective: 9/8/21
| |
| | |
| DONALD C. COOK NUCLEAR PLANT, UNIT 2 TECHNICAL SPECIFICATIONS BASES LIST OF EFFECTIVE PAGES Page Number Revision Number Revision Date B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.1 AC Sources - Operating B 3.8.1-1 13 07/16/07 B 3.8.1-2 27 05/18/09 B 3.8.1-3 4 10/17/05 B 3.8.1-4 49 06/01/15 B 3.8.1-5 43 11/21/14 B 3.8.1-6 43 11/21/14 B 3.8.1-7 43 11/21/14 B 3.8.1-8 43 11/21/14 B 3.8.1-9 41 08/04/14 B 3.8.1-10 41 08/04/14 B 3.8.1-11 41 08/04/14 B 3.8.1-12 41 08/04/14 B 3.8.1-13 41 08/04/14 B 3.8.1-14 41 08/04/14 B 3.8.1-15 41 08/04/14 B 3.8.1-16 60 10/12/15 B 3.8.1-17 60 10/12/15 B 3.8.1-18 60 10/12/15 B 3.8.1-19 60 10/12/15 B 3.8.1-20 60 10/12/15 B 3.8.1-21 60 10/12/15 B 3.8.1-22 60 10/12/15 B 3.8.1-23 52 12/16/14 B 3.8.1-24 60 10/12/15 B 3.8.1-25 60 10/12/15 B 3.8.1-26 60 10/12/15 B 3.8.1-27 60 10/12/15 B 3.8.1-28 60 10/12/15 B 3.8.1-29 60 10/12/15 B 3.8.1-30 60 10/12/15 B 3.8.1-31 76 06/12/19 B 3.8.1-32 76 06/12/19 B 3.8.1-33 76 06/12/19 B 3.8.1-34 76 06/12/19 B 3.8.2 AC Sources - Shutdown B 3.8.2-1 0 06/01/05 B 3.8.2-2 0 06/01/05 B 3.8.2-3 49 06/01/15 B 3.8.2-4 43 11/21/14 B 3.8.2-5 43 11/21/14 B 3.8.2-6 76 06/12/19 B 3.8.3 Diesel Fuel Oil B 3.8.3-1 67 04/30/18 B 3.8.3-2 67 04/30/18 B 3.8.3-3 0 06/01/05 B 3.8.3-4 67 04/30/18 B 3.8.3-5 60 10/12/15 B 3.8.3-6 0 06/01/05 Page 13 of 15 Issue/Effective: 9/8/21
| |
| | |
| DONALD C. COOK NUCLEAR PLANT, UNIT 2 TECHNICAL SPECIFICATIONS BASES LIST OF EFFECTIVE PAGES Page Number Revision Number Revision Date B 3.8.4 DC Sources - Operating B 3.8.4-1 3 09/23/05 B 3.8.4-2 0 06/01/05 B 3.8.4-3 0 06/01/05 B 3.8.4-4 0 06/01/05 B 3.8.4-5 0 06/01/05 B 3.8.4-6 0 06/01/05 B 3.8.4-7 60 10/12/15 B 3.8.4-8 60 10/12/15 B 3.8.4-9 68 07/25/18 B 3.8.5 DC Sources - Shutdown B 3.8.5-1 0 06/01/05 B 3.8.5-2 0 06/01/05 B 3.8.5-3 0 06/01/05 B 3.8.5-4 0 06/01/05 B 3.8.6 Battery Parameters B 3.8.6-1 68 07/25/18 B 3.8.6-2 0 06/01/05 B 3.8.6-3 68 07/25/18 B 3.8.6-4 3 09/23/05 B 3.8.6-5 60 10/12/15 B 3.8.6-6 68 07/25/18 B 3.8.6-7 68 07/25/18 B 3.8.6-8 68 07/25/18 B 3.8.7 Inverters - Operating B 3.8.7-1 3 09/23/05 B 3.8.7-2 3 09/23/05 B 3.8.7-3 60 10/12/15 B 3.8.7-4 0 06/01/05 B 3.8.8 Inverters - Shutdown B 3.8.8-1 0 06/01/05 B 3.8.8-2 0 06/01/05 B 3.8.8-3 0 06/01/05 B 3.8.8-4 60 10/12/15 B 3.8.9 Distribution Systems - Operating B 3.8.9-1 3 09/23/05 B 3.8.9-2 0 06/01/05 B 3.8.9-3 3 09/23/05 B 3.8.9-4 0 06/01/05 B 3.8.9-5 0 06/01/05 B 3.8.9-6 3 09/23/05 B 3.8.9-7 3 09/23/05 B 3.8.9-8 0 06/01/05 B 3.8.9-9 0 06/01/05 B 3.8.9-10 60 10/12/15 B 3.8.9-11 0 06/01/05 B 3.8.10 Distribution Systems - Shutdown B 3.8.10-1 0 06/01/05 B 3.8.10-2 7 05/15/06 B 3.8.10-3 0 06/01/05 B 3.8.10-4 60 10/12/15 Page 14 of 15 Issue/Effective: 9/8/21
| |
| | |
| DONALD C. COOK NUCLEAR PLANT, UNIT 2 TECHNICAL SPECIFICATIONS BASES LIST OF EFFECTIVE PAGES Page Number Revision Number Revision Date B 3.9 REFUELING OPERATIONS B 3.9.1 Boron Concentration B 3.9.1-1 0 06/01/05 B 3.9.1-2 0 06/01/05 B 3.9.1-3 60 10/12/15 B 3.9.2 Nuclear Instrumentation B 3.9.2-1 56 12/07/16 B 3.9.2-2 56 12/07/16 B 3.9.2-3 60 10/12/15 B 3.9.2-4 60 10/12/15 B 3.9.3 Containment Penetrations B 3.9.3-1 59 11/07/14 B 3.9.3-2 59 11/07/14 B 3.9.3-3 63 11/23/16 B 3.9.3-4 60 10/12/15 B 3.9.4 Residual Heat Removal (RHR) and Coolant Circulation - High Water Level B 3.9.4-1 0 06/01/05 B 3.9.4-2 57 01/27/16 B 3.9.4-3 0 06/01/05 B 3.9.4-4 60 10/12/15 B 3.9.4-5 60 10/12/15 B 3.9.5 Residual Heat Removal (RHR) and Coolant Circulation - Low Water Level B 3.9.5-1 0 06/01/05 B 3.9.5-2 57 01/27/16 B 3.9.5-3 60 10/12/15 B 3.9.5-4 60 10/12/15 B 3.9.5-5 60 10/12/15 B 3.9.6 Refueling Cavity Water Level B 3.9.6-1 59 11/07/14 B 3.9.6-2 60 10/12/15 Page 15 of 15 Issue/Effective: 9/8/21
| |
| | |
| UNIT 2 APPENDIX A TECHNICAL SPECIFICATIONS BASES TABLE OF CONTENTS Chapter/Specification Page B 2.0 SAFETY LIMITS (SLs)
| |
| B 2.1 SLs....................................................................................................................................B 2.1.1-1 B 2.1.1 Reactor Core SLs........................................................................................................B 2.1.1-1 B 2.1.2 Reactor Coolant System Pressure SL .........................................................................B 2.1.2-1 B 3.0 LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY ..................................B 3.0-1 Figure B 3.0-1, Configuration of Trains and Systems................................................B 3.0-13 B 3.0 SURVEILLANCE REQUIREMENT (SR) APPLICABILITY.................................................B 3.0-14 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.1 SHUTDOWN MARGIN (SDM) .....................................................................................B 3.1.1-1 B 3.1.2 Core Reactivity ............................................................................................................B 3.1.2-1 B 3.1.3 Moderator Temperature Coefficient (MTC) ..................................................................B 3.1.3-1 B 3.1.4 Rod Group Alignment Limits........................................................................................B 3.1.4-1 B 3.1.5 Shutdown Bank Insertion Limits...................................................................................B 3.1.5-1 B 3.1.6 Control Bank Insertion Limits.......................................................................................B 3.1.6-1 B 3.1.7 Rod Position Indication................................................................................................B 3.1.7-1 B 3.1.8 PHYSICS TEST Exceptions - MODE 2........................................................................B 3.1.8-1 B 3.2 POWER DISTRIBUTION LIMITS B 3.2.1 Heat Flux Hot Channel Factor .....................................................................................B 3.2.1-1 B 3.2.2 Nuclear Enthalpy Rise Hot Channel Factor .................................................................B 3.2.2-1 B 3.2.3 AXIAL FLUX DIFFERENCE (AFD) ..............................................................................B 3.2.3-1 B 3.2.4 QUADRANT POWER TILT RATIO (QPTR).................................................................B 3.2.4-1 B 3.3 INSTRUMENTATION B 3.3.1 Reactor Trip System (RTS) Instrumentation ................................................................B 3.3.1-1 B 3.3.2 Engineered Safety Feature Actuation System (ESFAS) Instrumentation .....................B 3.3.2-1 B 3.3.3 Post Accident Monitoring (PAM) Instrumentation.........................................................B 3.3.3-1 B 3.3.4 Remote Shutdown Monitoring Instrumentation ............................................................B 3.3.4-1 Table B 3.3.4-1, Remote Shutdown Monitoring Instrumentation ...............................B 3.3.4-5 B 3.3.5 Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation .............................B 3.3.5-1 B 3.3.6 Containment Purge Supply and Exhaust System Isolation Instrumentation .................B 3.3.6-1 B 3.3.7 Control Room Emergency Ventilation (CREV) System Actuation Instrumentation .......B 3.3.7-1 B 3.3.8 Boron Dilution Monitoring Instrumentation (BDMI) .......................................................B 3.3.8-1 B 3.4 REACTOR COOLANT SYSTEM (RCS)
| |
| B 3.4.1 RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB)
| |
| Limits........................................................................................................................B 3.4.1-1 B 3.4.2 RCS Minimum Temperature for Criticality....................................................................B 3.4.2-1 B 3.4.3 RCS Pressure and Temperature (P/T) Limits ..............................................................B 3.4.3-1 Cook Nuclear Plant Unit 2 Page 1 of 3 Revision No. 48
| |
| | |
| UNIT 2 APPENDIX A TECHNICAL SPECIFICATIONS BASES TABLE OF CONTENTS Chapter/Specification Page B 3.4.4 RCS Loops - MODES 1 and 2 ..................................................................................... B 3.4.4-1 B 3.4.5 RCS Loops - MODE 3 ................................................................................................. B 3.4.5-1 B 3.4.6 RCS Loops - MODE 4 ................................................................................................. B 3.4.6-1 B 3.4.7 RCS Loops - MODE 5, Loops Filled ............................................................................ B 3.4.7-1 B 3.4.8 RCS Loops - MODE 5, Loops Not Filled ...................................................................... B 3.4.8-1 B 3.4.9 Pressurizer .................................................................................................................. B 3.4.9-1 B 3.4.10 Pressurizer Safety Valves............................................................................................ B 3.4.10-1 B 3.4.11 Pressurizer Power Operated Relief Valves (PORVs) ................................................... B 3.4.11-1 B 3.4.12 Low Temperature Overpressure Protection (LTOP) System ........................................ B 3.4.12-1 B 3.4.13 RCS Operational LEAKAGE ........................................................................................ B 3.4.13-1 B 3.4.14 RCS Pressure Isolation Valve (PIV) Leakage .............................................................. B 3.4.14-1 B 3.4.15 RCS Leakage Detection Instrumentation ..................................................................... B 3.4.15-1 B 3.4.16 RCS Specific Activity ................................................................................................... B 3.4.16-1 B 3.4.17 Steam Generator Tube Integrity .................................................................................. B 3.4.17-1 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)
| |
| B 3.5.1 Accumulators............................................................................................................... B 3.5.1-1 B 3.5.2 ECCS - Operating ....................................................................................................... B 3.5.2-1 B 3.5.3 ECCS - Shutdown ....................................................................................................... B 3.5.3-1 B 3.5.4 Refueling Water Storage Tank (RWST) ....................................................................... B 3.5.4-1 B 3.5.5 Seal Injection Flow ...................................................................................................... B 3.5.5-1 B 3.6 CONTAINMENT SYSTEMS B 3.6.1 Containment ................................................................................................................ B 3.6.1-1 B 3.6.2 Containment Air Locks ................................................................................................ B 3.6.2-1 B 3.6.3 Containment Isolation Valves ...................................................................................... B 3.6.3-1 B 3.6.4 Containment Pressure ................................................................................................. B 3.6.4-1 B 3.6.5 Containment Air Temperature ..................................................................................... B 3.6.5-1 B 3.6.6 Containment Spray System ......................................................................................... B 3.6.6-1 B 3.6.7 Spray Additive System ................................................................................................ B 3.6.7-1 B 3.6.8 Deleted ........................................................................................................................ B 3.6.8-1 B 3.6.9 Distributed Ignition System (DIS) ................................................................................. B 3.6.9-1 B 3.6.10 Containment Air Recirculation/Hydrogen Skimmer (CEQ) System .............................. B 3.6.10-1 B 3.6.11 Ice Bed ........................................................................................................................ B 3.6.11-1 B 3.6.12 Ice Condenser Doors................................................................................................... B 3.6.12-1 B 3.6.13 Divider Barrier Integrity ................................................................................................ B 3.6.13-1 B 3.6.14 Containment Recirculation Drains ............................................................................... B 3.6.14-1 B 3.6.15 Containment Recirculation Sump ................................................................................. B 3.6.15-1 B 3.7 PLANT SYSTEMS B 3.7.1 Main Steam Safety Valves (MSSVs) ........................................................................... B 3.7.1-1 B 3.7.2 Steam Generator Stop Valves (SGSVs) ...................................................................... B 3.7.2-1 Cook Nuclear Plant Unit 2 Page 2 of 3 Revision No. 81
| |
| | |
| UNIT 2 APPENDIX A TECHNICAL SPECIFICATIONS BASES TABLE OF CONTENTS Chapter/Specification Page B 3.7.3 Main Feedwater Isolation Valves (MFIVs) and Main Feedwater Regulation Valves (MFRVs) .................................................................................................................. B 3.7.3-1 B 3.7.4 Steam Generator (SG) Power Operated Relief Valves (PORVs).................................. B 3.7.4-1 B 3.7.5 Auxiliary Feedwater (AFW) System .............................................................................. B 3.7.5-1 B 3.7.6 Condensate Storage Tank (CST).................................................................................. B 3.7.6-1 B 3.7.7 Component Cooling Water (CCW) System ................................................................... B 3.7.7-1 B 3.7.8 Essential Service Water (ESW) System ....................................................................... B 3.7.8-1 B 3.7.9 Ultimate Heat Sink (UHS) ............................................................................................. B 3.7.9-1 B 3.7.10 Control Room Emergency Ventilation (CREV) System................................................. B 3.7.10-1 B 3.7.11 Control Room Air Conditioning (CRAC) System ........................................................... B 3.7.11-1 B 3.7.12 Engineered Safety Features (ESF) Ventilation System ................................................ B 3.7.12-1 B 3.7.13 Fuel Handling Area Exhaust Ventilation (FHAEV) System ........................................... B 3.7.13-1 B 3.7.14 Fuel Storage Pool Water Level ..................................................................................... B 3.7.14-1 B 3.7.15 Fuel Storage Pool Boron Concentration ....................................................................... B 3.7.15-1 B 3.7.16 Spent Fuel Pool Storage ............................................................................................... B 3.7.16-1 B 3.7.17 Secondary Specific Activity ........................................................................................... B 3.7.17-1 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.1 AC Sources - Operating ................................................................................................ B 3.8.1-1 B 3.8.2 AC Sources - Shutdown................................................................................................ B 3.8.2-1 B 3.8.3 Diesel Fuel Oil............................................................................................................... B 3.8.3-1 B 3.8.4 DC Sources - Operating................................................................................................ B 3.8.4-1 B 3.8.5 DC Sources - Shutdown................................................................................................ B 3.8.5-1 B 3.8.6 Battery Parameters ....................................................................................................... B 3.8.6-1 B 3.8.7 Inverters - Operating ..................................................................................................... B 3.8.7-1 B 3.8.8 Inverters - Shutdown ..................................................................................................... B 3.8.8-1 B 3.8.9 Distribution Systems - Operating .................................................................................. B 3.8.9-1 Table B 3.8.9-1, AC, DC, and 120 VAC Vital Bus Electrical Power Distribution Systems................................................................................................................... B 3.8.9-11 B 3.8.10 Distribution Systems - Shutdown .................................................................................. B 3.8.10-1 B 3.9 REFUELING OPERATIONS B 3.9.1 Boron Concentration ..................................................................................................... B 3.9.1-1 B 3.9.2 Nuclear Instrumentation ................................................................................................ B 3.9.2-1 B 3.9.3 Containment Penetrations............................................................................................. B 3.9.3-1 B 3.9.4 Residual Heat Removal (RHR) and Coolant Circulation - High Water Level ................ B 3.9.4-1 B 3.9.5 Residual Heat Removal (RHR) and Coolant Circulation - Low Water Level ................. B 3.9.5-1 B 3.9.6 Refueling Cavity Water Level........................................................................................ B 3.9.6-1 Cook Nuclear Plant Unit 2 Page 3 of 3 Revision No. 0
| |
| | |
| Reactor Core SLs B 2.1.1 B 2.0 SAFETY LIMITS (SLs)
| |
| B 2.1.1 Reactor Core BASES BACKGROUND Plant Specific Design Criterion (PSDC) 6 (Ref. 1) requires that specified acceptable fuel design limits are not exceeded during all expected conditions of normal operation, with appropriate margins for uncertainties and specified transient situations that can be anticipated. This is accomplished by having a departure from nucleate boiling (DNB) design basis, which corresponds to a 95% probability at a 95% confidence level (the 95/95 DNB criterion) that DNB will not occur and by requiring that fuel centerline temperature stays below the melting temperature (Ref. 2).
| |
| The restrictions of this SL prevent overheating of the fuel and cladding, as well as possible cladding perforation, that would result in the release of fission products to the reactor coolant. Overheating of the fuel is prevented by maintaining the steady state peak linear heat rate (LHR) below the level at which fuel centerline melting occurs. Overheating of the fuel cladding is prevented by restricting fuel operation to within the nucleate boiling regime, where the heat transfer coefficient is large and the cladding surface temperature is slightly above the coolant saturation temperature.
| |
| Fuel centerline melting occurs when the local LHR, or power peaking, in a region of the fuel is high enough to cause the fuel centerline temperature to reach the melting point of the fuel. Expansion of the pellet upon centerline melting may cause the pellet to stress the cladding to the point of failure, allowing an uncontrolled release of activity to the reactor coolant.
| |
| Operation above the boundary of the nucleate boiling regime could result in excessive cladding temperature because of the onset of DNB and the resultant sharp reduction in heat transfer coefficient. Inside the steam film, high cladding temperatures are reached, and a cladding water (zirconium water) reaction may take place. This chemical reaction results in oxidation of the fuel cladding to a structurally weaker form. This weaker form may lose its integrity, resulting in an uncontrolled release of activity to the reactor coolant.
| |
| The proper functioning of the Reactor Trip System (RTS) and main steam safety valves prevents violation of the reactor core SLs.
| |
| Cook Nuclear Plant Unit 2 B 2.1.1-1 Revision No. 0
| |
| | |
| Reactor Core SLs B 2.1.1 BASES APPLICABLE The fuel cladding must not sustain damage as a result of normal SAFETY operation and operational transients and transient conditions arising from ANALYSES faults of moderate frequency. The reactor core SLs are established to preclude violation of the following fuel design criteria:
| |
| : a. There must be at least 95% probability at a 95% confidence level (the 95/95 DNB criterion) that the hot fuel rod in the core does not experience DNB; and
| |
| : b. The hot fuel pellet in the core must not experience centerline fuel melting.
| |
| The RTS Allowable Values (Ref. 3), in combination with all the LCOs, are designed to prevent any anticipated combination of transient conditions for Reactor Coolant System (RCS) temperature, pressure, and flow, I, and THERMAL POWER level that would result in a departure from nucleate boiling ratio (DNBR) of less than the DNBR limit and preclude the existence of flow instabilities.
| |
| Automatic enforcement of these reactor core SLs is provided by the appropriate operation of the RTS and the main steam safety valves.
| |
| The SLs represent a design requirement for establishing the RTS Allowable Values identified previously (as indicated in the UFSAR, Ref. 3). LCO 3.4.1, "RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB) Limits," or the assumed initial conditions of the safety analyses provide more restrictive limits to ensure that the SLs are not exceeded.
| |
| SAFETY LIMITS The figure provided in the COLR shows the loci of points of THERMAL POWER, RCS pressure, and average temperature for which the minimum DNBR is not less than the safety analyses limit, that fuel centerline temperature remains below melting, that the average enthalpy in the hot leg is less than or equal to the enthalpy of saturated liquid, or that the exit quality is within the limits defined by the DNBR correlation.
| |
| The reactor core SLs are established to preclude violation of the following fuel design criteria:
| |
| : a. There must be at least a 95% probability at a 95% confidence level (the 95/95 DNB criterion) that the hot fuel rod in the core does not experience DNB; and
| |
| : b. There must be at least a 95% probability at a 95% confidence level that the hot fuel pellet in the core does not experience centerline fuel melting.
| |
| Cook Nuclear Plant Unit 2 B 2.1.1-2 Revision No. 0
| |
| | |
| Reactor Core SLs B 2.1.1 BASES SAFETY LIMITS (continued)
| |
| The reactor core SLs are used to define the various RTS Functions such that the above criteria are satisfied during normal operation and operational transients, and transient conditions arising from faults of moderate frequency. To ensure that the RTS precludes the violation of the above criteria, additional criteria are applied to the Overtemperature and Overpower T reactor trip functions. That is, it must be demonstrated that the average enthalpy in the hot leg is less than or equal to the saturation enthalpy and that the core exit quality is within the limits defined by the DNBR correlation. Appropriate functioning of the RTS ensures that for variations in the THERMAL POWER, RCS pressure, RCS average temperature, RCS flow rate, and I that the reactor core SLs will be satisfied during normal operation and operational transients, and transient conditions arising from faults of moderate frequency.
| |
| APPLICABILITY SL 2.1.1 only applies in MODES 1 and 2 because these are the only MODES in which the reactor is critical. Automatic protection functions are required to be OPERABLE during MODES 1 and 2 to ensure operation within the reactor core SLs. The main steam safety valves or automatic protection actions serve to prevent RCS heatup to the reactor core SL conditions or to initiate a reactor trip function, which forces the unit into MODE 3. Setpoints for the reactor trip functions are specified in LCO 3.3.1, "Reactor Trip System (RTS) Instrumentation." In MODES 3, 4, 5, and 6, Applicability is not required since the reactor is not generating significant THERMAL POWER.
| |
| SAFETY LIMIT The following SL violation responses are applicable to the reactor core VIOLATIONS SLs. If SL 2.1.1 is violated, the requirement to go to MODE 3 places the unit in a MODE in which this SL is not applicable.
| |
| The allowed Completion Time of 1 hour recognizes the importance of bringing the unit to a MODE of operation where this SL is not applicable, and reduces the probability of fuel damage.
| |
| REFERENCES 1. UFSAR, Section 1.4.2.
| |
| : 2. UFSAR, Section 3.4.1.
| |
| : 3. UFSAR, Section 7.2.
| |
| Cook Nuclear Plant Unit 2 B 2.1.1-3 Revision No. 0
| |
| | |
| RCS Pressure SL B 2.1.2 B 2.0 SAFETY LIMITS (SLs)
| |
| B 2.1.2 Reactor Coolant System (RCS) Pressure SL BASES BACKGROUND The SL on RCS pressure protects the integrity of the RCS against overpressurization. In the event of fuel cladding failure, fission products are released into the reactor coolant. The RCS then serves as the primary barrier in preventing the release of fission products into the atmosphere. By establishing an upper limit on RCS pressure, the continued integrity of the RCS is ensured. According to Plant Specific Design Criterion (PSDC) 9, "Reactor Coolant Pressure Boundary" (Ref. 1), the reactor coolant pressure boundary (RCPB) shall be designed, fabricated, and constructed so as to have an exceedingly low probability of gross rupture or significant uncontrolled leakage throughout its design lifetime. The RCS, in conjunction with its control and protective provisions, was designed to accommodate the system pressures and temperatures attained under the expected modes of plant operation or anticipated system interactions, and to maintain the stresses within allowable code stress limits. Also, in accordance with PSDC 33, "Reactor Coolant Pressure Boundary Capability" (Ref. 1), the reactor coolant pressure boundary shall be capable of accommodating without rupture the static and dynamic loads imposed on any boundary component as a result of an inadvertent and sudden release of energy to the coolant. As a design reference, this sudden release shall be taken as that which would result from a sudden reactivity insertion such as rod ejection (unless prevented by positive mechanical means), rod dropout, or cold water addition.
| |
| The design pressure of the RCS is 2485 psig. During normal operation and anticipated operational transients, RCS pressure is limited from exceeding the design pressure by more than 10%, in accordance with Section III of the ASME Code (Ref. 2). To ensure system integrity, all RCS components are hydrostatically tested at 125% of design pressure, according to the ASME Code requirements prior to initial operation when there is no fuel in the core. Following inception of unit operation, RCS components shall be pressure tested, in accordance with the requirements of ASME Code, Section XI (Ref. 3).
| |
| Overpressurization of the RCS could result in a breach of the RCPB. If such a breach occurs in conjunction with a fuel cladding failure, fission products could enter the containment atmosphere, raising concerns relative to limits on radioactive releases specified in 10 CFR 50.67, Accident Source Term (Ref. 4).
| |
| Cook Nuclear Plant Unit 2 B 2.1.2-1 Revision No. 59
| |
| | |
| RCS Pressure SL B 2.1.2 BASES APPLICABLE The RCS pressurizer safety valves, the main steam safety valves SAFETY (MSSVs), and the pressurizer high pressure trip have settings established ANALYSES to ensure that the RCS pressure SL will not be exceeded.
| |
| The RCS pressurizer safety valves are sized to prevent system pressure from exceeding the design pressure by more than 10%, as specified in Section III of the ASME Code for Nuclear Power Plant Components (Ref. 2). The transient that establishes the required relief capacity, and hence valve size requirements and lift settings, is a complete loss of external load without a direct reactor trip. During the transient, no control actions are assumed, except that the safety valves on the secondary plant are assumed to open when the steam pressure reaches the secondary plant safety valve settings, and nominal feedwater supply is maintained.
| |
| The Reactor Trip System Allowable Values (Ref. 5), together with the settings of the MSSVs, provide pressure protection for normal operation and anticipated operational transients. The pressurizer high pressure trip Allowable Value is specifically determined to provide protection against overpressurization (Ref. 5). The safety analyses for both the high pressure trip and the RCS pressurizer safety valves are performed using conservative assumptions relative to pressure control devices.
| |
| More specifically, no credit is taken for operation of any of the following:
| |
| : a. Pressurizer power operated relief valves (PORVs);
| |
| : b. Steam generator PORVs;
| |
| : c. Steam Dump System;
| |
| : d. Reactor Control System;
| |
| : e. Pressurizer Level Control System; or
| |
| : f. Pressurizer spray valves.
| |
| SAFETY LIMITS The maximum transient pressure allowed in the RCS pressure vessel under the ASME Code, Section III, is 110% of design pressure. The maximum transient pressure allowed in the RCS piping, valves, and fittings under USAS, Section B31.1 (Ref. 6) is 120% of design pressure.
| |
| The more limiting of these two allowances is the 110% of design pressure; therefore, the SL on maximum allowable RCS pressure is 2735 psig.
| |
| Cook Nuclear Plant Unit 2 B 2.1.2-2 Revision No. 0
| |
| | |
| RCS Pressure SL B 2.1.2 BASES APPLICABILITY SL 2.1.2 applies in MODES 1, 2, 3, 4, and 5 because this SL could be approached or exceeded in these MODES due to overpressurization events. The SL is not applicable in MODE 6 because the reactor vessel head closure bolts are not fully tightened, making it unlikely that the RCS can be pressurized.
| |
| SAFETY LIMIT If the RCS pressure SL is violated when the reactor is in MODE 1 VIOLATIONS or 2, the requirement is to restore compliance and be in MODE 3 within 1 hour.
| |
| Exceeding the RCS pressure SL may cause immediate RCS failure and create a potential for radioactive releases in excess of 10 CFR 50.67 limits (Ref. 4).
| |
| The allowable Completion Time of 1 hour recognizes the importance of reducing power level to a MODE of operation where the potential for challenges to safety systems is minimized.
| |
| If the RCS pressure SL is exceeded in MODE 3, 4, or 5, RCS pressure must be restored to within the SL value within 5 minutes. Exceeding the RCS pressure SL in MODE 3, 4, or 5 is more severe than exceeding this SL in MODE 1 or 2, since the reactor vessel temperature may be lower and the vessel material, consequently, less ductile. As such, pressure must be reduced to less than the SL within 5 minutes. The action does not require reducing MODES, since this would require reducing temperature, which would compound the problem by adding thermal gradient stresses to the existing pressure stress.
| |
| REFERENCES 1. UFSAR, Sections 1.4.2 and 1.4.6.
| |
| : 2. ASME, Boiler and Pressure Vessel Code, Section III, Article NB-7000.
| |
| : 3. ASME, Boiler and Pressure Vessel Code, Section XI, Article IWX-5000.
| |
| : 4. 10 CFR 50.67.
| |
| : 5. UFSAR, Section 7.2.
| |
| : 6. USAS B31.1, Standard Code for Pressure Piping, American Society of Mechanical Engineers, 1967.
| |
| Cook Nuclear Plant Unit 2 B 2.1.2-3 Revision No. 59
| |
| | |
| LCO Applicability B 3.0 B 3.0 LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY BASES LCOs LCO 3.0.1 through LCO 3.0.8 establish the general requirements applicable to all Specifications in Sections 3.1 through 3.9 and apply at all times, unless otherwise stated.
| |
| LCO 3.0.1 LCO 3.0.1 establishes the Applicability statement within each individual Specification as the requirement for when the LCO is required to be met (i.e., when the unit is in the MODES or other specified conditions of the Applicability statement of each Specification).
| |
| LCO 3.0.2 LCO 3.0.2 establishes that upon discovery of a failure to meet an LCO, the associated ACTIONS shall be met. The Completion Time of each Required Action for an ACTIONS Condition is applicable from the point in time that an ACTIONS Condition is entered, unless otherwise specified.
| |
| The Required Actions establish those remedial measures that must be taken within specified Completion Times when the requirements of an LCO are not met. This Specification establishes that:
| |
| : a. Completion of the Required Actions within the specified Completion Times constitutes compliance with a Specification; and
| |
| : b. Completion of the Required Actions is not required when an LCO is met within the specified Completion Time, unless otherwise specified.
| |
| There are two basic types of Required Actions. The first type of Required Action specifies a time limit in which the LCO must be met. This time limit is the Completion Time to restore an inoperable system or component to OPERABLE status or to restore variables to within specified limits. If this type of Required Action is not completed within the specified Completion Time, a shutdown may be required to place the unit in a MODE or condition in which the Specification is not applicable. (Whether stated as a Required Action or not, correction of the entered Condition is an action that may always be considered upon entering ACTIONS.) The second type of Required Action specifies the remedial measures that permit continued operation of the unit that is not further restricted by the Completion Time. In this case, compliance with the Required Actions provides an acceptable level of safety for continued operation.
| |
| Completing the Required Actions is not required when an LCO is met or is no longer applicable, unless otherwise stated in the individual Specifications.
| |
| The nature of some Required Actions of some Conditions necessitates that, once the Condition is entered, the Required Actions must be Cook Nuclear Plant Unit 2 B 3.0-1 Revision No. 69
| |
| | |
| LCO Applicability B 3.0 BASES LCO 3.0.2 (continued) completed even though the associated Conditions no longer exist. The individual LCO's ACTIONS specify the Required Actions where this is the case. An example of this is in LCO 3.4.3, "RCS Pressure and Temperature (P/T) Limits."
| |
| The Completion Times of the Required Actions are also applicable when a system or component is removed from service intentionally. The ACTIONS for not meeting a single LCO adequately manage any increase in plant risk, provided any unusual external conditions (e.g., severe weather, offsite power instability) are considered. In addition, the increased risk associated with simultaneous removal of multiple structures, systems, trains or components from service is assessed and managed in accordance with10 CFR 50.65(a)(4). Individual Specifications may specify a time limit for performing an SR when equipment is removed from service or bypassed for testing. In this case, the Completion Times of the Required Actions are applicable when this time limit expires, if the equipment remains removed from service or bypassed.
| |
| When a change in MODE or other specified condition is required to comply with Required Actions, the unit may enter a MODE or other specified condition in which another Specification becomes applicable. In this case, the Completion Times of the associated Required Actions would apply from the point in time that the new Specification becomes applicable, and the ACTIONS Condition(s) are entered.
| |
| LCO 3.0.3 LCO 3.0.3 establishes the actions that must be implemented when an LCO is not met and:
| |
| : a. An associated Required Action and Completion Time is not met and no other Condition applies; or
| |
| : b. The condition of the unit is not specifically addressed by the associated ACTIONS. This means that no combination of Conditions stated in the ACTIONS can be made that exactly corresponds to the actual condition of the unit. Sometimes, possible combinations of Conditions are such that entering LCO 3.0.3 is warranted; in such cases, the ACTIONS specifically state a Condition corresponding to such combinations and also that LCO 3.0.3 be entered immediately.
| |
| This Specification delineates the time limits for placing the unit in a safe MODE or other specified condition when operation cannot be maintained within the limits for safe operation as defined by the LCO and its Cook Nuclear Plant Unit 2 B 3.0-2 Revision No. 73
| |
| | |
| LCO Applicability B 3.0 BASES LCO 3.0.3 (continued)
| |
| ACTIONS. Planned entry into LCO 3.0.3 should be avoided. If it is not practicable to avoid planned entry into LCO 3.0.3, plant risk should be assessed and managed in accordance with 10 CFR 50.56(a)(4), and the planned entry into LCO 3.0.3 should have less effect on plant safety than other practicable alternatives.
| |
| Upon entering LCO 3.0.3, 1 hour is allowed to prepare for an orderly shutdown before initiating a change in unit operation. This includes time to permit the operator to coordinate the reduction in electrical generation with the load dispatcher to ensure the stability and availability of the electrical grid. The time limits specified to enter lower MODES of operation permit the shutdown to proceed in a controlled and orderly manner that is well within the specified maximum cooldown rate and within the capabilities of the unit, assuming that only the minimum required equipment is OPERABLE. This reduces thermal stresses on components of the Reactor Coolant System and the potential for a unit upset that could challenge safety systems under conditions to which this Specification applies. The use and interpretation of specified times to complete the actions of LCO 3.0.3 are consistent with the discussion of Section 1.3, Completion Times.
| |
| A unit shutdown required in accordance with LCO 3.0.3 may be terminated and LCO 3.0.3 exited if any of the following occurs:
| |
| : a. The LCO is now met;
| |
| : b. The LCO is no longer applicable;
| |
| : c. A Condition exists for which the Required Actions have now been performed; or
| |
| : d. ACTIONS exist that do not have expired Completion Times. These Completion Times are applicable from the point in time that the Condition is initially entered and not from the time LCO 3.0.3 is exited.
| |
| The time limits of LCO 3.0.3 allow 37 hours for the unit to be in MODE 5 when a shutdown is required during MODE 1 operation. If the unit is in a lower MODE of operation when a shutdown is required, the time limit for entering the next lower MODE applies. If a lower MODE is entered in less time than allowed, however, the total allowable time to enter MODE 5, or other applicable MODE, is not reduced. For example, if MODE 3 is entered in 2 hours, then the time allowed for entering MODE 4 is the next 11 hours, because the total time for entering Cook Nuclear Plant Unit 2 B 3.0-3 Revision No. 73
| |
| | |
| LCO Applicability B 3.0 BASES LCO 3.0.3 (continued)
| |
| MODE 4 is not reduced from the allowable limit of 13 hours. Therefore, if remedial measures are completed that would permit a return to MODE 1, a penalty is not incurred by having to enter a lower MODE of operation in less than the total time allowed.
| |
| In MODES 1, 2, 3, and 4, LCO 3.0.3 provides actions for Conditions not covered in other Specifications. The requirements of LCO 3.0.3 do not apply in MODES 5 and 6 because the unit is already in the most restrictive condition required by LCO 3.0.3. The requirements of LCO 3.0.3 do not apply in other specified conditions of the Applicability (unless in MODE 1, 2, 3, or 4) because the ACTIONS of individual Specifications sufficiently define the remedial measures to be taken.
| |
| Exceptions to LCO 3.0.3 are provided in instances where requiring a unit shutdown, in accordance with LCO 3.0.3, would not provide appropriate remedial measures for the associated condition of the unit. An example of this is in LCO 3.7.14, "Fuel Storage Pool Water Level." LCO 3.7.14 has an Applicability of "During movement of irradiated fuel assemblies in the fuel storage pool." Therefore, this LCO can be applicable in any or all MODES. If the LCO and the Required Actions of LCO 3.7.14 are not met while in MODE 1, 2, or 3, there is no safety benefit to be gained by placing the unit in a shutdown condition. The Required Action of LCO 3.7.14 to "Suspend movement of irradiated fuel assemblies in the fuel storage pool" is the appropriate Required Action to complete in lieu of the actions of LCO 3.0.3. These exceptions are addressed in the individual Specifications.
| |
| LCO 3.0.4 LCO 3.0.4 establishes limitations on changes in MODES or other specified conditions in the Applicability when an LCO is not met. It allows placing the unit in a MODE or other specified condition stated in that Applicability (e.g., the Applicability desired to be entered) when unit conditions are such that the requirements of the LCO would not be met, in accordance with either LCO 3.0.4.a, LCO 3.0.4.b, or LCO 3.0.4.c.
| |
| LCO 3.0.4.a allows entry into a MODE or other specified condition in the Applicability with the LCO not met when the associated ACTIONS to be entered following entry into the MODE or other specified condition in the Applicability will permit continued operation within the MODE or other specified condition for an unlimited period of time. Compliance with ACTIONS that permit continued operation of the unit for an unlimited period of time in a MODE or other specified condition provides an acceptable level of safety for continued operation. This is without regard to the status of the unit before or after the MODE change.
| |
| Cook Nuclear Plant Unit 2 B 3.0-4 Revision No. 69
| |
| | |
| LCO Applicability B 3.0 BASES LCO 3.0.4 (continued)
| |
| Therefore, in such cases, entry into a MODE or other specified condition in the Applicability may be made and the Required Actions followed after entry into the Applicability.
| |
| For example, LCO 3.0.4.a may be used when the Required Action to be entered states that an inoperable instrument channel must be placed in the trip condition within Completion Time. Transition into a MODE or other specified condition in the Applicability may be made in accordance with LCO 3.0.4 and the channel is subsequently placed in the tripped condition within the Completion Time, which begins when the Applicability is entered. If the instrument channel cannot be placed in the tripped condition and the subsequent default ACTION (Required Action and associated Completion Time not met) allows the OPERABLE train to be placed in operation, use of LCO 3.0.4.a is acceptable because the subsequent ACTIONS to be entered following entry into the MODE include ACTIONS (place the OPERABLE train in operation) that permit safe plant operation for an unlimited period of time in the MODE or other specified condition to be entered.
| |
| LCO 3.0.4.b allows entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering the MODE or other specified condition in the Applicability, and establishment of risk management actions, if appropriate.
| |
| The risk assessment may use quantitative, qualitative, or blended approaches, and the risk assessment will be conducted using the plant program, procedures, and criteria in place to implement 10 CFR 50.65(a)(4), which requires that risk impacts of maintenance activities to be assessed and managed. The risk assessment, for the purposes of LCO 3.0.4.b, must take into account all inoperable Technical Specification equipment regardless of whether the equipment is included in the normal 10 CFR 50.65(a)(4) risk assessment scope. The risk assessments will be conducted using the procedures and guidance endorsed by Regulatory Guide 1.182, "Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants." Regulatory Guide 1.182 endorses the guidance in Section 11 of NUMARC 93-01, "Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants." These documents address general guidance for conduct of the risk assessment, quantitative and qualitative guidelines for establishing risk management actions, and example risk management actions. These include actions to plan and conduct other activities in a manner that controls overall risk, increased risk awareness by shift and management personnel, actions to reduce the duration of the condition, actions to minimize the magnitude of risk increases (establishment of Cook Nuclear Plant Unit 2 B 3.0-5 Revision No. 69
| |
| | |
| LCO Applicability B 3.0 BASES LCO 3.0.4 (continued) backup success paths or compensatory measures), and determination that the proposed MODE change is acceptable. Consideration should also be given to the probability of completing restoration such that the requirements of the LCO would be met prior to the expiration of ACTIONS Completion Times that would require exiting the Applicability.
| |
| LCO 3.0.4.b may be used with single or multiple systems and components unavailable. NUMARC 93-01 provides guidance relative to consideration of simultaneous unavailability of multiple systems and components.
| |
| The results of the risk assessment shall be considered in determining the acceptability of entering the MODE or other specified condition in the Applicability, and any corresponding risk management actions. The LCO 3.0.4.b risk assessments do not have to be documented.
| |
| The Technical Specifications allow continued operation with equipment unavailable in MODE 1 for the duration of the Completion Time. Since this is allowable, and since in general the risk impact in that particular MODE bounds the risk of transitioning into and through the applicable MODES or other specified conditions in the Applicability of the LCO, the use of the LCO 3.0.4.b allowance should be generally acceptable, as long as the risk is assessed and managed as stated above. However, there is a small subset of systems and components that have been determined to be more important to risk and use of the LCO 3.0.4.b allowance is prohibited. The LCOs governing these systems and components contain Notes prohibiting the use of LCO 3.0.4.b by stating that LCO 3.0.4.b is not applicable.
| |
| LCO 3.0.4.c allows entry into a MODE or other specified condition in Applicability with the LCO not met based on a Note in the Specification which states LCO 3.0.4.c is applicable. These specific allowances permit entry into MODES or other specified conditions in the Applicability when the associated ACTIONS to be entered do not provide for continued operation for an unlimited period of time and a risk assessment has not been performed. This allowance may apply to all the ACTIONS or to a specific Required Action of a Specification. The risk assessments performed to justify the use of LCO 3.0.4.b usually only consider systems and components. For this reason, LCO 3.0.4.c is typically applied to Specifications which describe values and parameters (e.g., RCS Specific Activity), and may be applied to other Specifications based on NRC plant-specific approval.
| |
| The provisions of this Specification should not be interpreted as endorsing the failure to exercise the good practice of restoring systems or Cook Nuclear Plant Unit 2 B 3.0-6 Revision No. 69
| |
| | |
| LCO Applicability B 3.0 BASES LCO 3.0.4 (continued) components to OPERABLE status before entering an associated MODE or other specified condition in the Applicability.
| |
| The provisions of LCO 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS. In addition, the provisions of LCO 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that result from any unit shutdown. In this context, a unit shutdown is defined as a change in MODE or other specified condition in the Applicability associated with transitioning from MODE 1 to MODE 2, MODE 2 to MODE 3, MODE 3 to MODE 4, and MODE 4 to MODE 5.
| |
| Upon entry into a MODE or other specified condition in the Applicability with the LCO not met, LCO 3.0.1 and LCO 3.0.2 require entry into the applicable Conditions and Required Actions until the Condition is resolved, until the LCO is met, or until the unit is not within the Applicability of the Technical Specification.
| |
| Surveillances do not have to be performed on the associated inoperable equipment (or on variables outside the specified limits), as permitted by SR 3.0.1. Therefore, utilizing LCO 3.0.4 is not a violation of SR 3.0.1 or SR 3.0.4 for any Surveillances that have not been performed on inoperable equipment. However, SRs must be met to ensure OPERABILITY prior to declaring the associated equipment OPERABLE (or variable within limits) and restoring compliance with the affected LCO.
| |
| LCO 3.0.5 LCO 3.0.5 establishes the allowance for restoring equipment to service under administrative controls when it has been removed from service or declared inoperable to comply with ACTIONS. The sole purpose of this Specification is to provide an exception to LCO 3.0.2 (e.g., to not comply with the applicable Required Action(s)) to allow the performance of required testing to demonstrate:
| |
| : a. The OPERABILITY of the equipment being returned to service; or
| |
| : b. The OPERABILITY of other equipment.
| |
| The administrative controls ensure the time the equipment is returned to service in conflict with the requirements of the ACTIONS is limited to the time absolutely necessary to perform the required testing to demonstrate OPERABILITY. This Specification does not provide time to perform any other preventive or corrective maintenance. LCO 3.0.5 should not be used in lieu of other practicable alternatives that comply with Required Actions and that do not required changing the MODE or other specified conditions in the Applicability in order to demonstrate equipment is OPERABLE. LCO 3.0.5 is not intended to be used repeatedly.
| |
| Cook Nuclear Plant Unit 2 B 3.0-7 Revision No. 69
| |
| | |
| LCO Applicability B 3.0 BASES LCO 3.0.5 (continued)
| |
| An example of demonstrating equipment is OPERABLE with the Required Actions not met is opening a manual valve that was closed to comply with Required Actions to isolate a flowpath with excessive Reactor Coolant System (RCS) Pressure Isolation Valve (PIV) leakage in order to perform testing to demonstrate that RCS PIV leakage is now within limit.
| |
| An example of demonstrating the OPERABILITY of the equipment being returned to service is reopening a containment isolation valve that has been closed to comply with Required Actions and must be reopened to perform the required testing.
| |
| Examples of demonstrating equipment OPERABILITY include instances where it is necessary to take an inoperable channel or trip system out of a tripped condition that was directed by a Required Action, if there is no Required Action Note for this purpose. An example of verifying OPERABILITY of equipment removed from service is taking a tripped channel out of the tripped condition to permit the logic to function and indicate the appropriate response during performance of required testing on the inoperable channel. Examples of demonstrating the OPERABILITY of other equipment are taking an inoperable channel or trip system out of the tripped condition to 1) prevent the trip function from occurring during the performance of required testing on another channel in the other trip system, or 2) to permit the logic to function and indicate the appropriate response during the performance of required testing on another channel in the same trip system.
| |
| The administrative controls in LCO 3.0.5 apply in all cases to systems or components in Chapter 3 of the Technical Specifications, as long as the testing could not be conducted while complying with the Required Actions. This includes the realignment or repositioning of redundant or alternate equipment or trains previously manipulated to comply with ACTIONS, as well as equipment removed from service or declared inoperable to comply with ACTIONS.
| |
| BASES LCO 3.0.6 LCO 3.0.6 establishes an exception to LCO 3.0.2 for support systems that have an LCO specified in the Technical Specifications (TS). This exception is provided because LCO 3.0.2 would require that the Conditions and Required Actions of the associated inoperable supported system LCO be entered solely due to the inoperability of the support system. This exception is justified because the actions that are required to ensure the unit is maintained in a safe condition are specified in the support system LCO's Required Actions. These Required Actions may include entering the supported systems' Conditions and Required Actions or may specify other Required Actions.
| |
| Cook Nuclear Plant Unit 2 B 3.0-8 Revision No. 69
| |
| | |
| LCO Applicability B 3.0 BASES LCO 3.0.6 (continued)
| |
| When a support system is inoperable and there is an LCO specified for it in the TS, the supported system(s) are required to be declared inoperable if determined to be inoperable as a result of the support system inoperability. However, it is not necessary to enter into the supported systems' Conditions and Required Actions unless directed to do so by the support system's Required Actions. The potential confusion and inconsistency of requirements related to the entry into multiple support and supported systems' LCOs Conditions and Required Actions are eliminated by providing all the actions that are necessary to ensure the unit is maintained in a safe condition in the support system's Required Actions.
| |
| However, there are instances where a support system's Required Action may either direct a supported system to be declared inoperable or direct entry into Conditions and Required Actions for the supported system.
| |
| This may occur immediately or after some specified delay to perform some other Required Action. Regardless of whether it is immediate or after some delay, when a support system's Required Action directs a supported system to be declared inoperable or directs entry into Conditions and Required Actions for a supported system, the applicable Conditions and Required Actions shall be entered in accordance with LCO 3.0.2.
| |
| Specification 5.5.13, "Safety Function Determination Program (SFDP),"
| |
| ensures loss of safety function is detected and appropriate actions are taken. Upon entry into LCO 3.0.6, an evaluation shall be made to determine if loss of safety function exists. Additionally, other limitations, remedial actions, or compensatory actions may be identified as a result of the support system inoperability and corresponding exception to entering supported system Conditions and Required Actions. The SFDP implements the requirements of LCO 3.0.6.
| |
| Cross train checks to identify a loss of safety function for those support systems that support multiple and redundant safety systems are required.
| |
| The cross train check verifies that the supported systems of the redundant OPERABLE support system are OPERABLE, thereby ensuring safety function is retained. A loss of safety function may exist when a support system is inoperable, and:
| |
| : a. A required system redundant to system(s) supported by the inoperable support system is also inoperable (EXAMPLE B 3.0.6-1);
| |
| : b. A required system redundant to system(s) in turn supported by the inoperable supported system is also inoperable (EXAMPLE B 3.0.6-2); or Cook Nuclear Plant Unit 2 B 3.0-9 Revision No. 69
| |
| | |
| LCO Applicability B 3.0 BASES LCO 3.0.6 (continued)
| |
| : c. A required system redundant to support system(s) for the supported systems (a) and (b) above is also inoperable (EXAMPLE B 3.0.6-3).
| |
| EXAMPLE B 3.0.6-1 If System 2 of Train A is inoperable and System 5 of Train B is inoperable, a loss of safety function exists in supported System 5.
| |
| EXAMPLE B 3.0.6-2 If System 2 of Train A is inoperable, and System 11 of Train B is inoperable, a loss of safety function exists in System 11 which is in turn supported by System 5.
| |
| EXAMPLE B 3.0.6-3 If System 2 of Train A is inoperable, and System 1 of Train B is inoperable, a loss of safety function exists in Systems 2, 4, 5, 8, 9, 10, and 11.
| |
| If this evaluation determines that a loss of safety function exists, the appropriate Conditions and Required Actions of the LCO in which the loss of safety function exists are required to be entered.
| |
| This loss of safety function does not require the assumption of additional single failures or loss of offsite power. Since operations are being restricted in accordance with the ACTIONS of the support system, any resulting temporary loss of redundancy or single failure protection is taken into account. Similarly, the ACTIONS for inoperable offsite circuit(s) and inoperable diesel generator(s) provide the necessary restriction for cross train inoperabilities. This explicit cross train verification for inoperable AC electrical power sources also acknowledges that supported system(s) are not declared inoperable solely as a result of inoperability of a normal or emergency electrical power source (refer to the definition of OPERABILITY).
| |
| When loss of safety function is determined to exist, and the SFDP requires entry into the appropriate Conditions and Required Actions of the LCO in which the loss of safety function exists, consideration must be given to the specific type of function affected. Where a loss of function is solely due to a single Technical Specification support system (e.g., loss of automatic start due to inoperable instrumentation, or loss of pump suction source due to low tank level) the appropriate LCO is the LCO for the support system. The ACTIONS for a support system LCO adequately address the inoperabilities of that system without reliance on entering its supported system LCO. When the loss of function is the result of multiple Cook Nuclear Plant Unit 2 B 3.0-10 Revision No. 69
| |
| | |
| LCO Applicability B 3.0 BASES LCO 3.0.6 (continued) support systems, the appropriate LCO is the LCO for the supported system.
| |
| LCO 3.0.7 There are certain special tests and operations required to be performed at various times over the life of the unit. These special tests and operations are necessary to demonstrate select unit performance characteristics, to perform special maintenance activities, and to perform special evolutions.
| |
| Test Exception LCO 3.1.8, "PHYSICS TESTS Exceptions - MODE 2,"
| |
| allows specified Technical Specification (TS) requirements to be changed to permit performances of these special tests and operations, which otherwise could not be performed if required to comply with the requirements of these TS. Unless otherwise specified, all the other TS requirements remain unchanged. This will ensure all appropriate requirements of the MODE or other specified condition not directly associated with or required to be changed to perform the special test or operation will remain in effect.
| |
| The Applicability of a Test Exception LCO represents a condition not necessarily in compliance with the normal requirements of the TS.
| |
| Compliance with Test Exception LCOs is optional. A special operation may be performed either under the provisions of the appropriate Test Exception LCO or under the other applicable TS requirements. If it is desired to perform the special operation under the provisions of the Test Exception LCO, the requirements of the Test Exception LCO shall be followed.
| |
| LCO 3.0.8 LCO 3.0.8 establishes conditions under which systems described in the Technical Specifications are considered to remain OPERABLE when required barriers are not capable of providing their related support function(s).
| |
| Barriers are doors, walls, floor plugs, curbs, hatches, installed structures or components, or other devices, not explicitly described in Technical Specifications, that support the performance of the safety function of systems described in the Technical specifications. This LCO states that the supported system is not considered to be inoperable solely due to required barriers not capable of performing their related support function(s) under the described conditions. LCO 3.0.8 allows 30 days before declaring the supported system(s) inoperable and the LCO(s) associated with the supported system(s) not met. A maximum time is placed on each use of this allowance to ensure that as required barriers are found or are otherwise made unavailable, they are restored.
| |
| However, the allowable duration may be less than the specified maximum time based on the risk assessment.
| |
| Cook Nuclear Plant Unit 2 B 3.0-11 Revision No. 69
| |
| | |
| LCO Applicability B 3.0 BASES LCO 3.0.8 (continued)
| |
| If the allowed time expires and the barriers are unable to perform their related support function(s), the supported systems LCO(s) must be declared not met and the Conditions and Required Actions entered in accordance with LCO 3.0.2.
| |
| This provision does not apply to barriers which support ventilation systems or to fire barriers. The Technical Specifications for ventilation systems provide specific Conditions for inoperable barriers. Fire barriers are addressed by other regulatory requirements and associated plant programs. This provision does not apply to barriers which are not required to support system OPERABILITY (see NRC Regulatory Issue Summary 2001-09, Control of Hazard Barriers, dated April 2, 2001).
| |
| The provisions of LCO 3.0.8 are justified because of the low risk associated with required barriers not being capable of performing their related support function. This provision is based on consideration of the following initiating event categories:
| |
| Loss of coolant accidents; High energy line breaks; Feedwater line breaks; Internal flooding; External flooding; Turbine missile ejection; and Tornado or high wind.
| |
| The risk impact of the barriers which cannot perform their related support function(s) must be addressed pursuant to the risk assessment and management provisions of the Maintenance Rule, 10 CFR 50.65 (a)(4),
| |
| and the associated implementation guidance, Regulatory Guide 1.160, Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants. Regulatory Guide 1.160 endorses the guidance in Section 11 of NUMARC 93-01, Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants. This guidance provides for the consideration of dynamic plant configuration issues, emergent conditions, and other aspects pertinent to plant operation with the barriers unable to perform their related support function(s). These considerations may result in risk management and other compensatory actions being required during the period that barriers are unable to perform their related support function(s).
| |
| LCO 3.0.8 may be applied to one or more trains or subsystems of a system supported by barriers that cannot provide their related support function(s), provided that risk is assessed and managed (including Cook Nuclear Plant Unit 2 B 3.0-12 Revision No. 69
| |
| | |
| LCO Applicability B 3.0 BASES LCO 3.0.8 (continued) consideration of the effects on Large Early Release and from external events). If applied concurrently to more than one train or subsystem of a multiple train or subsystem supported system, the barriers supporting each of these trains or subsystems must provide their related support function(s) for different categories of initiating events. For example, LCO 3.0.8 may be applied for up to 30 days for more than one train of a multiple train supported system if the affected barrier for one train protects against internal flooding and the affected barrier for the other train protects against tornado missiles. In this example, the affected barrier may be the same physical barrier but serve different protection functions for each train.
| |
| If during the time that LCO 3.0.8 is being used, the required OPERABLE train or subsystem becomes inoperable, it must be restored to OPERABLE status with 24 hours. Otherwise, the train(s) or subsystem(s) supported by barriers that cannot perform their related support function(s) must be declared inoperable and the associated LCOs declared not met.
| |
| This 24 hour period provides time to respond to emergent conditions that would otherwise likely lead to entry into LCO 3.0.3 and a rapid plant shutdown, which is not justified given the low probability of an initiating event which would require the barrier(s) not capable of performing their related support function(s). During this 24 hour period, the plant risk associated with the existing conditions is assessed and managed in accordance with 10 CFR 50.65(a)(4).
| |
| Cook Nuclear Plant Unit 2 B 3.0-13 Revision No. 69
| |
| | |
| LCO Applicability B 3.0 Figure B 3.0-1 (page 1 of 1)
| |
| Configuration of Trains and Systems Cook Nuclear Plant Unit 2 B 3.0-14 Revision No. 69
| |
| | |
| SR Applicability B 3.0 B 3.0 SURVEILLANCE REQUIREMENT (SR) APPLICABILITY BASES SRs SR 3.0.1 through SR 3.0.4 establish the general requirements applicable to all Specifications in Sections 3.1 through 3.9 and apply at all times, unless otherwise stated. SR 3.0.2 and 3.0.3 apply in Chapter 5 only when invoked by a Chapter 5 Specification.
| |
| SR 3.0.1 SR 3.0.1 establishes the requirement that SRs must be met during the MODES or other specified conditions in the Applicability for which the requirements of the LCO apply, unless otherwise specified in the individual SRs. This Specification is to ensure that Surveillances are performed to verify the OPERABILITY of systems and components, and that variables are within specified limits. Failure to meet a Surveillance within the specified Frequency, in accordance with SR 3.0.2, constitutes a failure to meet an LCO. Surveillances may be performed by means of any series of sequential, overlapping, or total steps provided the entire Surveillance is performed within the specified Frequency. Additionally, the definitions related to instrument testing (e.g., CHANNEL CALIBRATION) specify that these tests are performed by means of any series of sequential, overlapping, or total steps.
| |
| Systems and components are assumed to be OPERABLE when the associated SRs have been met. Nothing in this Specification, however, is to be construed as implying that systems or components are OPERABLE when:
| |
| : a. The systems or components are known to be inoperable, although still meeting the SRs; or
| |
| : b. The requirements of the Surveillance(s) are known not to be met between required Surveillance performances.
| |
| Surveillances do not have to be performed when the unit is in a MODE or other specified condition for which the requirements of the associated LCO are not applicable, unless otherwise specified. The SRs associated with a test exception are only applicable when the test exception is used as an allowable exception to the requirements of a Specification.
| |
| Unplanned events may satisfy the requirements (including applicable acceptance criteria) for a given SR. In this case, the unplanned event may be credited as fulfilling the performance of the SR.
| |
| Surveillances, including Surveillances invoked by Required Actions, do not have to be performed on inoperable equipment because the ACTIONS define the remedial measures that apply. Surveillances have to be met and performed in accordance with SR 3.0.2, prior to returning equipment to OPERABLE status.
| |
| Cook Nuclear Plant Unit 2 B 3.0-15 Revision No. 69
| |
| | |
| SR Applicability B 3.0 BASES SR 3.0.1 (continued)
| |
| Upon completion of maintenance, appropriate post maintenance testing is required to declare equipment OPERABLE. This includes ensuring applicable Surveillances are not failed and their most recent performance is in accordance with SR 3.0.2. Post maintenance testing may not be possible in the current MODE or other specified conditions in the Applicability due to the necessary unit parameters not having been established. In these situations, the equipment may be considered OPERABLE provided testing has been satisfactorily completed to the extent possible and the equipment is not otherwise believed to be incapable of performing its function. This will allow operation to proceed to a MODE or other specified condition where other necessary post maintenance tests can be completed.
| |
| An example of this process is Auxiliary feedwater (AFW) pump turbine maintenance during refueling that requires testing at steam pressures 850 psig. However, if other appropriate testing is satisfactorily completed, the AFW System can be considered OPERABLE. This allows startup and other necessary testing to proceed until the plant reaches the steam pressure required to perform the testing.
| |
| SR 3.0.2 SR 3.0.2 establishes the requirements for meeting the specified Frequency for Surveillances and any Required Action with a Completion Time that requires the periodic performance of the Required Action on a "once per . . ." interval.
| |
| SR 3.0.2 permits a 25% extension of the interval specified in the Frequency. This extension facilitates Surveillance scheduling and considers plant operating conditions that may not be suitable for conducting the Surveillance (e.g., transient conditions or other ongoing Surveillance or maintenance activities).
| |
| When a Section 5.5, Programs and Manuals, specification states that the provisions of SR 3.0.2 are applicable, a 25% extension of the testing interval, whether stated in the specification or incorporated by reference, is permitted.
| |
| The 25% extension does not significantly degrade the reliability that results from performing the Surveillance at its specified Frequency. This is based on the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the SRs. The exceptions to SR 3.0.2 are those Surveillances for which the 25% extension of the interval specified in the Frequency does not apply.
| |
| These exceptions are stated in the individual Specifications. The requirements of regulations take precedence over the TS. Examples of where SR 3.0.2 does not apply are the Containment Leakage Rate Testing Program required by 10 CFR 50, Appendix J, and the inservice Cook Nuclear Plant Unit 2 B 3.0-16 Revision No. 69
| |
| | |
| SR Applicability B 3.0 BASES SR 3.0.2 (continued) testing of pumps and valves in accordance with applicable American Society of Mechanical Engineers Operation and Maintenance Codes, as required by 10 CFR 50.55a. These programs establish testing requirements and Frequencies in accordance with the requirements of regulations. The TS cannot, in and of themselves, extend a test interval specified in the regulations directly or by reference.
| |
| As stated in SR 3.0.2, the 25% extension also does not apply to the initial portion of a periodic Completion Time that requires performance on a "once per ..." basis. The 25% extension applies to each performance after the initial performance. The initial performance of the Required Action, whether it is a particular Surveillance or some other remedial action, is considered a single action with a single Completion Time. One reason for not allowing the 25% extension to this Completion Time is that such an action usually verifies that no loss of function has occurred by checking the status of redundant or diverse components or accomplishes the function of the inoperable equipment in an alternative manner.
| |
| The provisions of SR 3.0.2 are not intended to be used repeatedly to extend Surveillance intervals (other than those consistent with refueling intervals) or periodic Completion Time intervals beyond those specified.
| |
| SR 3.0.3 SR 3.0.3 establishes the flexibility to defer declaring affected equipment inoperable or an affected variable outside the specified limits when a Surveillance has not been performed within the specified Frequency. A delay period of up to 24 hours or up to the limit of the specified Frequency, whichever is greater, applies from the point in time that it is discovered that the Surveillance has not been performed in accordance with SR 3.0.2, and not at the time that the specified Frequency was not met.
| |
| When a Section 5.5, Programs and Manuals, specification states that the provisions of SR 3.0.3 are applicable, it permits the flexibility to defer declaring the testing requirement not met in accordance with SR 3.0.3 when the testing has not been completed within the testing interval (including the allowance of SR 3.0.2 if invoked by the Section 5.5 specification.)
| |
| This delay period provides adequate time to perform Surveillances that have been missed. This delay period permits the performance of a Surveillance before complying with Required Actions or other remedial measures that might preclude performance of the Surveillance.
| |
| The basis for this delay period includes consideration of unit conditions, adequate planning, availability of personnel, the time required to perform Cook Nuclear Plant Unit 2 B 3.0-17 Revision No. 69
| |
| | |
| SR Applicability B 3.0 BASES SR 3.0.3 (continued) the Surveillance, the safety significance of the delay in completing the required Surveillance, and the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the requirements. When a Surveillance with a Frequency based not on time intervals, but upon specified unit conditions, operating situations, or requirements of regulations (e.g., prior to entering MODE 1 after each fuel loading, or in accordance with 10 CFR 50, Appendix J, as modified by approved exemptions, etc.) is discovered to not have been performed when specified, SR 3.0.3 allows for the full delay period of up to the specified Frequency to perform the Surveillance.
| |
| However, since there is not a time interval specified, the missed Surveillance should be performed at the first reasonable opportunity.
| |
| SR 3.0.3 provides a time limit for, and allowances for the performance of, Surveillances that become applicable as a consequence of MODE changes imposed by Required Actions.
| |
| SR 3.0.3 is only applicable if there is a reasonable expectation the associated equipment is OPERABLE or that variables are within limits, and it is expected that the Surveillance will be met when performed.
| |
| Many factors should be considered, such as the period of time since the Surveillance was last performed, or whether the Surveillance, or a portion thereof, has ever been performed, and any other indications, tests, or activities that might support the expectation that the Surveillance will be met when performed. An example of the use of SR 3.0.3 would be a relay contact that was not tested as required in accordance with a particular SR, but previous successful performances of the SR included the relay contact; the adjacent, physically connected relay contacts were tested during the SR performance; the subject relay contact has been tested by another SR; or historical operation of the subject relay contact has been successful. It is not sufficient to infer the behavior of the associated equipment from the performance of similar equipment. The rigor of determining whether there is a reasonable expectation a Surveillance will be met when performed should increase based on the length of time since the last performance of the Surveillance. If the Surveillance has been performed recently, a review of the Surveillance history and equipment performance may be sufficient to support a reasonable expectation that the Surveillance will be met when performed.
| |
| For Surveillances that have not been performed for a long period or that have never been performed, a rigorous evaluation based on objective evidence should provide a high degree of confidence that the equipment is OPERABLE. The evaluation should be documented in sufficient detail to allow a knowledgeable individual to understand the basis for the determination.
| |
| Failure to comply with specified Frequencies for SRs is expected to be an infrequent occurrence. Use of the delay period established by SR 3.0.3 is Cook Nuclear Plant Unit 2 B 3.0-18 Revision No. 69
| |
| | |
| SR Applicability B 3.0 BASES SR 3.0.3 (continued) a flexibility which is not intended to be used repeatedly to extend Surveillance intervals. While up to 24 hours or the limit of the specified Frequency is provided to perform the missed Surveillance, it is expected that the missed Surveillance will be performed at the first reasonable opportunity. The determination of the first reasonable opportunity should include consideration of the impact on unit risk (from delaying the Surveillance as well as any unit configuration changes required or shutting the unit down to perform the Surveillance) and impact on any analysis assumptions, in addition to unit conditions, planning, availability of personnel, and the time required to perform the Surveillance. This risk impact should be managed through the program in place to implement 10 CFR 50.65(a)(4) and its implementation guidance, Regulatory Guide 1.182, "Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants." This Regulatory Guide addresses consideration of temporary and aggregate risk impacts, determination of risk management action thresholds, and risk management action up to and including unit shutdown. The missed Surveillance should be treated as an emergent condition as discussed in the Regulatory Guide. The risk evaluation may use quantitative, qualitative, or blended methods. The degree of depth and rigor of the evaluation should be commensurate with the importance of the component. Missed Surveillances for important components should be analyzed quantitatively. If the results of the risk evaluation determine the risk increase is significant, this evaluation should be used to determine the safest course of action. All missed Surveillances will be placed in the licensees Corrective Action Program.
| |
| If a Surveillance is not completed within the allowed delay period, then the equipment is considered inoperable or the variable is considered outside the specified limits and the Completion Times of the Required Actions for the applicable LCO Conditions begin immediately upon expiration of the delay period. If a Surveillance is failed within the delay period, then the equipment is inoperable, or the variable is outside the specified limits and the Completion Times of the Required Actions for the applicable LCO Conditions begin immediately upon the failure of the Surveillance.
| |
| Completion of the Surveillance within the delay period allowed by this Specification, or within the Completion Time of the ACTIONS, restores compliance with SR 3.0.1.
| |
| SR 3.0.4 SR 3.0.4 establishes the requirement that all applicable SRs must be met before entry into a MODE or other specified condition in the Applicability.
| |
| This Specification ensures that system and component OPERABILITY requirements and variable limits are met before entry into MODES or other specified conditions in the Applicability for which these systems and Cook Nuclear Plant Unit 2 B 3.0-19 Revision No. 69
| |
| | |
| SR Applicability B 3.0 BASES SR 3.0.4 (continued) components ensure safe operation of the unit. The provisions of this Specification should not be interpreted as endorsing the failure to exercise the good practice of restoring systems or component to OPERABLE status before entering an associated MODE or other specified condition in the Applicability.
| |
| A provision is included to allow entry into a MODE or other specified condition in the Applicability when an LCO is not met due to Surveillance not being met in accordance with LCO 3.0.4.
| |
| However, in certain circumstances, failing to meet an SR will not result in SR 3.0.4 restricting a MODE change or other specified condition change.
| |
| When a system, subsystem, division, component, device, or variable is inoperable or outside its specified limits, the associated SR(s) are not required to be performed, per SR 3.0.1, which states that Surveillances do not have to be performed on inoperable equipment. When equipment is inoperable, SR 3.0.4 does not apply to the associated SR(s) since the requirement for the SR(s) to be performed is removed. Therefore, failing to perform the Surveillance(s) within the specified Frequency does not result in an SR 3.0.4 restriction to changing MODES or other specified conditions of the Applicability. However, since the LCO is not met in this instance, LCO 3.0.4 will govern any restrictions that may (or may not) apply to MODE or other specified condition changes. SR 3.0.4 does not restrict changing MODES or other specified conditions of the Applicability when a Surveillance has not been performed within the specified Frequency, provided the requirement to declare the LCO not met has been delayed in accordance with SR 3.0.3.
| |
| The provisions of SR 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS. In addition, the provisions of SR 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that result from any unit shutdown. In this context, a unit shutdown is defined as a change in MODE or other specified condition in the Applicability associated with transitioning from MODE 1 to MODE 2, MODE 2 to MODE 3, MODE 3 to MODE 4, and MODE 4 to MODE 5.
| |
| The precise requirements for performance of SRs are specified such that exceptions to SR 3.0.4 are not necessary. The specific time frames and conditions necessary for meeting the SRs are specified in the Frequency, in the Surveillance, or both. This allows performance of Surveillances when the prerequisite condition(s) specified in a Surveillance procedure require entry into the MODE or other specified condition in the Applicability of the associated LCO prior to the performance or completion of a Surveillance. A Surveillance that could not be performed until after entering the LCO Applicability, would have its Frequency specified such Cook Nuclear Plant Unit 2 B 3.0-20 Revision No. 69
| |
| | |
| SR Applicability B 3.0 BASES SR 3.0.4 (continued) that it is not "due" until the specific conditions needed are met.
| |
| Alternately, the Surveillance may be stated in the form of a Note as not required (to be met or performed) until a particular event, condition, or time has been reached. Further discussion of the specific formats of SRs' annotation is found in Section 1.4, Frequency.
| |
| Cook Nuclear Plant Unit 2 B 3.0-21 Revision No. 69
| |
| | |
| SDM B 3.1.1 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.1 SHUTDOWN MARGIN (SDM)
| |
| BASES BACKGROUND According to Plant Specific Design Criterion (PSDC) 27 (Ref. 1), two independent reactivity control systems must be provided. According to PSDC 28 (Ref. 1), the reactivity controls must be capable of making and holding the reactor core subcritical from any hot standby or hot operating condition. According to PSDC 29 (Ref. 1), one of the reactivity control systems provided shall be capable of making the core subcritical under any anticipated operating condition (including anticipated operational transients) sufficiently fast enough to prevent exceeding acceptable fuel damage limits. SDM should assure subcriticality with the most reactive rod cluster control assembly fully withdrawn. According to PSDC 30 (Ref. 1), the reactivity control systems provided shall be capable of making the core subcritical under credible accident conditions with appropriate margins for contingencies, and shall be capable of limiting any subsequent return to power such that there will be no undue risk to the health and safety of the public. Maintenance of the SDM ensures that postulated reactivity events will not damage the fuel.
| |
| SDM requirements provide sufficient reactivity margin to ensure that acceptable fuel design limits will not be exceeded for normal shutdown and anticipated operational transients. As such, the SDM defines the degree of subcriticality that would be obtained immediately following the insertion or scram of all shutdown and control rods, assuming that the single rod cluster assembly of highest reactivity worth is fully withdrawn.
| |
| The system design requires that two independent reactivity control systems be provided, and that these systems be capable of making and holding the core subcritical. These requirements are provided by the use of movable control assemblies and soluble boric acid in the Reactor Coolant System (RCS). The Control Rod System can compensate for the reactivity effects of the fuel and water temperature changes accompanying power level changes over the range from full load to no load. In addition, the Control Rod System provides the SDM during power operation and is capable of making the core subcritical rapidly enough to prevent exceeding acceptable fuel damage limits, assuming that the rod of highest reactivity worth remains fully withdrawn. The soluble boron system can compensate for fuel depletion during operation and all xenon burnout reactivity changes and maintain the reactor subcritical along with the shutdown and control rods under cold conditions.
| |
| When the unit is in MODE 1 or MODE 2 with the reactor critical, SDM control is ensured by operating with the shutdown banks fully withdrawn Cook Nuclear Plant Unit 2 B 3.1.1-1 Revision No. 0
| |
| | |
| SDM B 3.1.1 BASES BACKGROUND (continued) and the control banks within the limits of LCO 3.1.6, "Control Bank Insertion Limits." When the unit is in MODE 2 with the reactor subcritical, SDM control is ensured by operating with the shutdown banks fully withdrawn and the control banks within the estimated critical control bank position. When the unit is in MODE 3, 4, 5, or 6, the SDM requirements are met by means of adjustments to the RCS boron concentration.
| |
| APPLICABLE The minimum required SDM is assumed as an initial condition in safety SAFETY analyses. The safety analysis (Ref. 2) establishes a SDM that ensures ANALYSES specified acceptable fuel design limits are not exceeded for normal operation and anticipated operational transients, with the assumption of the highest worth rod stuck out on scram. For MODE 5, the primary safety analysis that relies on the SDM limits is the boron dilution analysis.
| |
| The acceptance criteria for the SDM requirements are that specified acceptable fuel design limits are maintained. This is done by ensuring that:
| |
| : a. The reactor can be made subcritical from all operating conditions, transients, and Design Basis Events;
| |
| : b. The reactivity transients associated with postulated accident conditions are controllable within acceptable limits (departure from nucleate boiling ratio (DNBR), fuel centerline temperature limits for anticipated operational transients, and 200 cal/gm energy deposition for the rod ejection accident); and
| |
| : c. The reactor will be maintained sufficiently subcritical to preclude inadvertent criticality in the shutdown condition.
| |
| The most limiting accident for the SDM requirements is based on a main steam line break (MSLB), as described in the accident analysis (Ref. 3).
| |
| The increased steam flow resulting from a pipe break in the main steam system causes an increased energy removal from the affected steam generator (SG), and consequently the RCS. This results in a reduction of the reactor coolant temperature. The resultant coolant shrinkage causes a reduction in pressure. In the presence of a negative moderator temperature coefficient, this cooldown causes an increase in core reactivity. As RCS temperature decreases, the severity of an MSLB decreases until MODE 5 is reached. The most limiting MSLB, with respect to potential fuel damage before a reactor trip occurs, is a guillotine break of a main steam line inside containment initiated at the end of core life. The positive reactivity addition from the moderator temperature decrease will terminate when the affected SG boils dry, thus terminating RCS heat removal and cooldown. Following the MSLB, a Cook Nuclear Plant Unit 2 B 3.1.1-2 Revision No. 0
| |
| | |
| SDM B 3.1.1 BASES APPLICABLE SAFETY ANALYSES (continued) post trip return to power may occur; however, no fuel damage occurs as a result of the post trip return to power, and THERMAL POWER does not violate the Safety Limit (SL) requirement of SL 2.1.1.
| |
| In addition to the limiting MSLB transient, the SDM requirement must also protect against:
| |
| : a. Inadvertent boron dilution;
| |
| : b. An uncontrolled rod withdrawal from subcritical or low power condition; and
| |
| : c. Rod ejection.
| |
| Each of these events is discussed below.
| |
| The boron dilution analysis covers operation during shutdown, refueling, startup, and power operation. The purpose of the analysis is to show that, from initiation of the event, sufficient time is available to allow the operator to determine the cause of the dilution and to take corrective action before the SDM is lost.
| |
| Depending on the system initial conditions and reactivity insertion rate, the uncontrolled rod withdrawal transient is terminated by either a high power level, high pressurizer pressure, overtemperature T, overpower T, or pressurizer water level trip. In all cases, power level, RCS pressure, linear heat rate, and the DNBR do not exceed allowable limits.
| |
| The ejection of a control rod rapidly adds reactivity to the reactor core, causing both the core power level and heat flux to increase with corresponding increases in reactor coolant temperatures and pressure.
| |
| The ejection of a rod also produces a time dependent redistribution of core power.
| |
| SDM satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO SDM is a core design condition that can be ensured during operation through control rod positioning (control and shutdown banks) and through the soluble boron concentration.
| |
| The MSLB (Ref. 3) and the boron dilution (Ref. 4) analyses are the most limiting analyses that establish the SDM value of the LCO. For MSLB accidents, if the LCO is violated, there is a potential to exceed the DNBR limit and to exceed 10 CFR 50.67 limits (Ref. 5). For the boron dilution accident, if the LCO is violated, the time assumed for operator action to terminate dilution may no longer be applicable.
| |
| Cook Nuclear Plant Unit 2 B 3.1.1-3 Revision No. 59
| |
| | |
| SDM B 3.1.1 BASES APPLICABILITY In MODE 2 with keff < 1.0 and in MODES 3, 4, and 5, the SDM requirements are applicable to provide sufficient negative reactivity to meet the assumptions of the safety analyses discussed above. In MODE 6, the shutdown reactivity requirements are given in LCO 3.9.1, "Boron Concentration." In MODES 1 and 2 with keff 1.0, SDM is ensured by complying with LCO 3.1.5, "Shutdown Bank Insertion Limits,"
| |
| and LCO 3.1.6.
| |
| ACTIONS A.1 If the SDM requirements are not met, boration must be initiated promptly.
| |
| A Completion Time of 15 minutes is adequate for an operator to correctly align and start the required systems and components. It is assumed that boration will be continued until the SDM requirements are met.
| |
| In the determination of the required combination of boration flow rate and boron concentration, there is no unique requirement that must be satisfied. Since it is imperative to raise the boron concentration of the RCS as soon as possible, the boron concentration should be a highly concentrated solution, such as that normally found in the boric acid tank, or the refueling water storage tank. The operator should borate with the best source available for the unit conditions.
| |
| In determining the boration flow rate, the time in core life must be considered. For instance, the most difficult time in core life to increase the RCS boron concentration is at the beginning of cycle when the boron concentration may approach or exceed 2000 ppm. Assuming that a value of 1% k/k must be recovered and a boration flow rate of 34 gpm, it is possible to increase the boron concentration of the RCS by 100 ppm in approximately 44 minutes. If a boron worth of 10 pcm/ppm is assumed, this combination of parameters will increase the SDM by 1% k/k. These boration parameters of 34 gpm and 6550 ppm represent the current licensed values.
| |
| SURVEILLANCE SR 3.1.1.1 REQUIREMENTS In MODES 1 and 2 with keff 1.0, SDM is verified by observing that the requirements of LCO 3.1.5 and LCO 3.1.6 are met. In the event that a rod is known to be untrippable, however, SDM verification must account for the worth of the untrippable rod as well as another rod of maximum worth.
| |
| In MODE 2 with keff < 1.0, and MODES 3, 4, and 5, the SDM is verified by performing a reactivity balance calculation, considering the listed reactivity effects:
| |
| : a. RCS boron concentration; Cook Nuclear Plant Unit 2 B 3.1.1-4 Revision No. 0
| |
| | |
| SDM B 3.1.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| : b. Bank position;
| |
| : c. RCS average temperature;
| |
| : d. Fuel burnup based on gross thermal energy generation;
| |
| : e. Xenon concentration;
| |
| : f. Samarium concentration;
| |
| : g. Isothermal temperature coefficient (ITC); and
| |
| : h. Boron penalty (MODES 4 and 5 only).
| |
| Using the ITC accounts for Doppler reactivity in this calculation because the reactor is subcritical, and the fuel temperature will be changing at the same rate as the RCS. The boron penalty must be applied in MODES 4 and 5 since all reactor coolant pumps may be stopped in these MODES.
| |
| This extra amount of boron ensures that minimum response times are met for the operator to diagnose and mitigate an inadvertent boron dilution event prior to loss of SDM.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 1.4.5.
| |
| : 2. UFSAR, Chapter 14.
| |
| : 3. UFSAR, Section 14.2.5.
| |
| : 4. UFSAR, Section 14.1.5.
| |
| : 5. 10 CFR 50.67.
| |
| Cook Nuclear Plant Unit 2 B 3.1.1-5 Revision No. 60
| |
| | |
| Core Reactivity B 3.1.2 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.2 Core Reactivity BASES BACKGROUND According to Plant Specific Design Criterion (PSDC) 28 (Ref. 1), the reactivity controls provided shall be capable of making and holding the core subcritical from any hot standby or hot operating condition.
| |
| According to PSDC 29 (Ref. 1), one of the reactivity control systems provided shall be capable of making the core subcritical under any anticipated operating condition (including anticipated operational transients) sufficiently fast enough to prevent exceeding acceptable fuel damage limits. SDM should assure subcriticality with the most reactive rod cluster control assembly fully withdrawn. According to PSDC 30 (Ref. 1), the reactivity control systems provided shall be capable of making the core subcritical under credible accident conditions with appropriate margins for contingencies, and shall be capable of limiting any subsequent return to power such that there will be no undue risk to the health and safety of the public. Reactivity balance is used as a measure of the predicted versus measured core reactivity during power and startup operation. The periodic confirmation of core reactivity is necessary to ensure that Design Basis Accident (DBA) and transient safety analyses remain valid. A large reactivity difference could be the result of unanticipated changes in fuel, control rod worth, or operation at conditions not consistent with those assumed in the predictions of core reactivity, and could potentially result in a loss of SDM or violation of acceptable fuel design limits. Comparing predicted versus measured core reactivity validates the nuclear methods used in the safety analysis and supports the SDM demonstrations (LCO 3.1.1, "SHUTDOWN MARGIN (SDM)") in ensuring the reactor can be brought safely to cold, subcritical conditions.
| |
| When the reactor core is critical or in normal power operation, a reactivity balance exists and the net reactivity is zero. A comparison of predicted and measured reactivity is convenient under such a balance, since parameters are being maintained relatively stable under steady state power conditions. The positive reactivity inherent in the core design is balanced by the negative reactivity of the control components, thermal feedback, neutron leakage, and materials in the core that absorb neutrons, such as burnable absorbers producing zero net reactivity.
| |
| Excess reactivity can be inferred from the boron letdown curve (or critical boron curve), which provides an indication of the soluble boron concentration in the Reactor Coolant System (RCS) versus cycle burnup.
| |
| Periodic measurement of the RCS boron concentration for comparison with the predicted value with other variables fixed (such as rod height, temperature, pressure, and power), provides a convenient method of Cook Nuclear Plant Unit 2 B 3.1.2-1 Revision No. 0
| |
| | |
| Core Reactivity B 3.1.2 BASES BACKGROUND (continued) ensuring that core reactivity is within design expectations and that the calculational models used to generate the safety analysis are adequate.
| |
| In order to achieve the required fuel cycle energy output, the uranium enrichment, in the new fuel loading and in the fuel remaining from the previous cycle, provides excess positive reactivity beyond that required to sustain steady state operation throughout the cycle. When the reactor is critical at RTP and moderator temperature, the excess positive reactivity is compensated by burnable absorbers (if any), control rods, whatever neutron poisons (mainly xenon and samarium) are present in the fuel, and the RCS boron concentration.
| |
| When the core is producing THERMAL POWER, the fuel is being depleted and excess reactivity is decreasing. As the fuel depletes, the RCS boron concentration is adjusted to maintain constant THERMAL POWER. The boron letdown curve is based on steady state operation at RTP. Therefore, deviations from the predicted boron letdown curve may indicate deficiencies in the design analysis, deficiencies in the calculational models, or abnormal core conditions, and must be evaluated.
| |
| APPLICABLE The acceptance criteria for core reactivity are that the reactivity balance SAFETY limit ensures unit operation is maintained within the assumptions of ANALYSES the safety analyses.
| |
| Accurate prediction of core reactivity is either an explicit or implicit assumption in the accident analysis evaluations. Every accident evaluation (Ref. 2) is, therefore, dependent upon accurate evaluation of core reactivity. In particular, SDM and reactivity transients, such as control rod withdrawal accidents or rod ejection accidents, are very sensitive to accurate prediction of core reactivity. These accident analysis evaluations rely on computer codes that have been qualified against available test data, operating unit data, and analytical benchmarks. Monitoring reactivity balance additionally ensures that the nuclear methods provide an accurate representation of the core reactivity.
| |
| Design calculations and safety analyses are performed for each fuel cycle for the purpose of predetermining reactivity behavior and the RCS boron concentration requirements for reactivity control during fuel depletion.
| |
| The comparison between measured and predicted initial core reactivity provides a normalization for the calculational models used to predict core reactivity. If the measured and predicted RCS boron concentrations for identical core conditions at beginning of cycle (BOC) do not agree, then Cook Nuclear Plant Unit 2 B 3.1.2-2 Revision No. 0
| |
| | |
| Core Reactivity B 3.1.2 BASES APPLICABLE SAFETY ANALYSES (continued) the assumptions used in the reload cycle design analysis or the calculational models used to predict soluble boron requirements may not be accurate. If reasonable agreement between measured and predicted core reactivity exists at BOC, then the prediction may be normalized to the measured boron concentration. Thereafter, any significant deviations in the measured boron concentration from the predicted boron letdown curve that develop during fuel depletion may be an indication that the calculational model is not adequate for core burnups beyond BOC, or that an unexpected change in core conditions has occurred.
| |
| The normalization of predicted RCS boron concentration to the measured value is typically performed after reaching RTP following startup from a refueling outage, with the control rods in their normal positions for power operation. The normalization is performed at BOC conditions, so that core reactivity relative to predicted values can be continually monitored and evaluated as core conditions change during the cycle.
| |
| Core reactivity satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO Long term core reactivity behavior is a result of the core physics design and cannot be easily controlled once the core design is fixed. During operation, therefore, the LCO can only be ensured through measurement and tracking, and appropriate actions taken as necessary. Large differences between actual and predicted core reactivity may indicate that the assumptions of the DBA and transient analyses are no longer valid, or that the uncertainties in the Nuclear Design Methodology are larger than expected. A limit on the reactivity balance of +/- 1% k/k has been established based on engineering judgment. A 1% k/k deviation in reactivity from that predicted is larger than expected for normal operation and should therefore be evaluated.
| |
| When measured core reactivity is within 1% k/k of the predicted value at steady state thermal conditions, the core is considered to be operating within acceptable design limits. Since deviations from the limit are normally detected by comparing predicted and measured steady state RCS critical boron concentrations, the difference between measured and predicted values would be approximately 100 ppm (depending on the boron worth) before the limit is reached. These values are well within the uncertainty limits for analysis of boron concentration samples, so that spurious violations of the limit due to uncertainty in measuring the RCS boron concentration are unlikely.
| |
| APPLICABILITY The limits on core reactivity must be maintained during MODES 1 and 2 because a reactivity balance must exist when the reactor is critical or producing THERMAL POWER. As the fuel depletes, core conditions are Cook Nuclear Plant Unit 2 B 3.1.2-3 Revision No. 1
| |
| | |
| Core Reactivity B 3.1.2 BASES APPLICABILITY (continued) changing, and confirmation of the reactivity balance ensures the core is operating as designed. This Specification does not apply in MODES 3, 4, and 5 because the reactor is shut down and the reactivity balance is not changing.
| |
| In MODE 6, fuel loading results in a continually changing core reactivity.
| |
| Boron concentration requirements (LCO 3.9.1, "Boron Concentration")
| |
| ensure that fuel movements are performed within the bounds of the safety analysis. An SDM demonstration is required during the first startup following operations that could have altered core reactivity (e.g., fuel movement, control rod replacement, control rod shuffling).
| |
| ACTIONS A.1 and A.2 Should an anomaly develop between measured and predicted core reactivity, an evaluation of the core design and safety analysis must be performed. Core conditions are evaluated to determine their consistency with input to design calculations. Measured core and process parameters are evaluated to determine that they are within the bounds of the safety analysis, and safety analysis calculational models are reviewed to verify that they are adequate for representation of the core conditions. The required Completion Time of 7 days is based on the low probability of a DBA occurring during this period, and allows sufficient time to assess the physical condition of the reactor and complete the evaluation of the core design and safety analysis.
| |
| Following evaluations of the core design and safety analysis, the cause of the reactivity anomaly may be resolved. If the cause of the reactivity anomaly is a mismatch in core conditions at the time of RCS boron concentration sampling, then a recalculation of the RCS boron concentration requirements may be performed to demonstrate that core reactivity is behaving as expected. If an unexpected physical change in the condition of the core has occurred, it must be evaluated and corrected, if possible. If the cause of the reactivity anomaly is in the calculation technique, then the calculational models must be revised to provide more accurate predictions. If any of these results are demonstrated, and it is concluded that the reactor core is acceptable for continued operation, then the boron letdown curve may be renormalized and power operation may continue. If operational restriction or additional SRs are necessary to ensure the reactor core is acceptable for continued operation, then they must be defined.
| |
| The required Completion Time of 7 days is adequate for preparing whatever operating restrictions or Surveillances that may be required to allow continued reactor operation.
| |
| Cook Nuclear Plant Unit 2 B 3.1.2-4 Revision No. 0
| |
| | |
| Core Reactivity B 3.1.2 BASES ACTIONS (continued)
| |
| B.1 If any Required Action and associated Completion Time is not met, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours. If the SDM for MODE 3 is not met, then the boration required by SR 3.1.1.1 would occur. The allowed Completion Time is reasonable, based on operating experience, for reaching MODE 3 from full power conditions in an orderly manner and without challenging unit systems.
| |
| SURVEILLANCE SR 3.1.2.1 REQUIREMENTS Core reactivity is verified by periodic comparisons of measured and predicted RCS boron concentrations. The comparison is made, considering that other core conditions are fixed or stable, including RCS boron concentration, control rod position, RCS average temperature, fuel burnup based on gross thermal energy generation, xenon concentration, and samarium concentration. The Surveillance is performed prior to entering MODE 1 as an initial check on core conditions and design calculations at BOC. The SR is modified by a Note. The Note indicates that the normalization of predicted core reactivity to the measured value must take place within the first 60 effective full power days (EFPD) after each fuel loading. This allows sufficient time for core conditions to reach steady state, but prevents operation for a large fraction of the fuel cycle without establishing a benchmark for the design calculations. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 1.4.5.
| |
| : 2. UFSAR, Chapter 14.
| |
| Cook Nuclear Plant Unit 2 B 3.1.2-5 Revision No. 60
| |
| | |
| MTC B 3.1.3 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.3 Moderator Temperature Coefficient (MTC)
| |
| BASES BACKGROUND According to Reference 1, the reactor core and its interaction with the Reactor Coolant System (RCS) must be designed for inherently stable power operation, even in the possible event of an accident. In particular, the net reactivity feedback in the system must compensate for any unintended reactivity increases.
| |
| The MTC relates a change in core reactivity to a change in reactor coolant temperature (a positive MTC means that reactivity increases with increasing moderator temperature; conversely, a negative MTC means that reactivity decreases with increasing moderator temperature). The reactor is designed to operate with a negative MTC over the largest possible range of fuel cycle operation. Therefore, a coolant temperature increase will cause a reactivity decrease, so that the coolant temperature tends to return toward its initial value. Reactivity increases that cause a coolant temperature increase will thus be self limiting, and stable power operation will result.
| |
| MTC values are predicted at selected burnups during the safety evaluation analysis and are confirmed to be acceptable by measurements. The reload cores are designed so that the beginning of cycle (BOC) MTC is less than or equal to zero when THERMAL POWER is at RTP. The actual value of the MTC is dependent on core characteristics, such as fuel loading and reactor coolant soluble boron concentration. The core design may require additional fixed distributed poisons to yield an MTC at BOC within the range analyzed in the unit accident analysis. The end of cycle (EOC) MTC is also limited by the requirements of the accident analysis. Fuel cycles are evaluated to ensure that the MTC does not exceed the EOC limit.
| |
| The limitations on MTC are provided to ensure that the value of this coefficient remains within the limiting conditions assumed in the UFSAR accident and transient analyses.
| |
| If the LCO limits are not met, the unit response during transients may not be as predicted. The core could violate criteria that prohibit a return to criticality, or the departure from nucleate boiling ratio criteria of the approved correlation may be violated, which could lead to a loss of the fuel cladding integrity.
| |
| The SRs for measurement of the MTC at the beginning and near the end of the fuel cycle are adequate to confirm that the MTC remains within its Cook Nuclear Plant Unit 2 B 3.1.3-1 Revision No. 0
| |
| | |
| MTC B 3.1.3 BASES BACKGROUND (continued) limits, since this coefficient changes slowly, due principally to the reduction in RCS boron concentration associated with fuel burnup but also to a significant extent from the effects of buildup of plutonium and fission products.
| |
| APPLICABLE The acceptance criteria for the specified MTC are:
| |
| SAFETY ANALYSES a. The MTC values must remain within the bounds of those used in the accident analysis (Ref. 3); and
| |
| : b. The MTC must be such that inherently stable power operations result during normal operation and accidents, such as overheating and overcooling events.
| |
| The UFSAR, Chapter 14 (Ref. 3), contains analyses of accidents that result in both overheating and overcooling of the reactor core. MTC is one of the controlling parameters for core reactivity in these accidents.
| |
| Both the most positive value and most negative value of the MTC are important to safety, and both values must be bounded. Values used in the analyses consider worst case conditions to ensure that the accident results are bounding (Ref. 4).
| |
| The consequences of accidents that cause core overheating must be evaluated when the MTC is positive. Such accidents include the rod withdrawal transient from either zero or RTP, loss of normal feedwater flow, and loss of forced reactor coolant flow. The consequences of accidents that cause core overcooling must be evaluated when the MTC is negative. Such accidents include sudden feedwater flow increase and sudden decrease in feedwater temperature.
| |
| In order to ensure a bounding accident analysis, the MTC is assumed to be its most limiting value for the analysis conditions appropriate to each accident. The bounding value is determined by considering rodded and unrodded conditions, whether the reactor is at full or zero power, and whether it is the BOC or EOC life. The most conservative combination appropriate to the accident is then used for the analysis (Ref. 3).
| |
| MTC values are bounded in reload safety evaluations assuming steady state conditions at BOC and EOC. An EOC measurement is conducted at conditions when the RCS boron concentration reaches approximately 300 ppm. The measured value may be extrapolated to project the EOC value, in order to confirm reload design predictions.
| |
| MTC satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| Cook Nuclear Plant Unit 2 B 3.1.3-2 Revision No. 0
| |
| | |
| MTC B 3.1.3 BASES LCO LCO 3.1.3 requires the MTC to be within specified limits of the COLR to ensure that the core operates within the assumptions of the accident analysis. During the reload core safety evaluation, the MTC is analyzed to determine that its values remain within the bounds of the original accident analysis during operation.
| |
| Assumptions made in safety analyses require that the MTC be less positive than a given upper bound and more positive than a given lower bound. The MTC is most positive at BOC; this upper bound must not be exceeded. This maximum upper limit occurs near BOC, all rods out (ARO), hot zero power conditions. At EOC the MTC takes on its most negative value, when the lower bound becomes important. This LCO exists to ensure that both the upper and lower bounds are not exceeded.
| |
| During operation, therefore, the conditions of the LCO can only be ensured through measurement. The Surveillance checks at BOC and EOC on MTC provide confirmation that the MTC is behaving as anticipated so that the acceptance criteria are met.
| |
| The LCO establishes a maximum positive value that cannot be exceeded (Figure 3.1.3-1). The BOC positive (upper) limit and the EOC negative (lower) limit are established in the COLR to allow specifying limits for each particular cycle. This permits the unit to take advantage of improved fuel management and changes in unit operating schedule.
| |
| APPLICABILITY Technical Specifications place both LCO and SR values on MTC, based on the safety analysis assumptions described above.
| |
| In MODE 1, the limits on MTC must be maintained to ensure that any accident initiated from THERMAL POWER operation will not violate the design assumptions of the accident analysis. In MODE 2 with the reactor critical, the upper limit must also be maintained to ensure that startup and subcritical accidents (such as the uncontrolled control rod assembly or group withdrawal) will not violate the assumptions of the accident analysis. The lower MTC limit must be maintained in MODES 2 and 3, in addition to MODE 1, to ensure that cooldown accidents will not violate the assumptions of the accident analysis. In MODES 4, 5, and 6, this LCO is not applicable, since no Design Basis Accidents using the MTC as an analysis assumption are initiated from these MODES.
| |
| ACTIONS A.1 If the upper MTC limit is violated, administrative withdrawal limits for control banks must be established to maintain the MTC within its limits.
| |
| The MTC becomes more negative with control bank insertion and decreased boron concentration. A Completion Time of 24 hours provides enough time for evaluating the MTC measurement and computing the required bank withdrawal limits.
| |
| Cook Nuclear Plant Unit 2 B 3.1.3-3 Revision No. 0
| |
| | |
| MTC B 3.1.3 BASES ACTIONS (continued)
| |
| As cycle burnup is increased, the RCS boron concentration will be reduced. The reduced boron concentration causes the MTC to become more negative. Using physics calculations, the time in cycle life at which the calculated MTC will meet the LCO requirement can be determined.
| |
| At this point in core life Condition A no longer exists. The unit is no longer in the Required Action, so the administrative withdrawal limits are no longer in effect.
| |
| B.1 If the required administrative withdrawal limits at BOC are not established within 24 hours, the unit must be brought to MODE 2 with keff < 1.0 to prevent operation with an MTC that is more positive than that assumed in safety analyses.
| |
| The allowed Completion Time of 6 hours is reasonable, based on operating experience, for reaching the required MODE from full power conditions in an orderly manner and without challenging unit systems.
| |
| C.1 Exceeding the lower MTC limit means that the safety analysis assumptions for the EOC accidents that use a bounding negative MTC value may be invalid. If the lower MTC limit is exceeded, the unit must be brought to a MODE or condition in which the LCO requirements are not applicable. To achieve this status, the unit must be brought to at least MODE 4 within 12 hours.
| |
| The allowed Completion Time is reasonable, based on operating experience, for reaching the required MODE from full power conditions in an orderly manner and without challenging unit systems.
| |
| SURVEILLANCE SR 3.1.3.1 REQUIREMENTS This SR requires measurement of the MTC at BOC prior to entering MODE 1 in order to demonstrate compliance with the most positive MTC LCO. Meeting the limit prior to entering MODE 1 ensures that the limit will also be met at higher power levels.
| |
| The BOC MTC value for ARO will be inferred from isothermal temperature coefficient measurements obtained during the physics tests after refueling. The ARO value can be directly compared to the upper MTC limit of the LCO. If required, measurement results and predicted design values can be used to establish administrative withdrawal limits for control banks.
| |
| Cook Nuclear Plant Unit 2 B 3.1.3-4 Revision No. 0
| |
| | |
| MTC B 3.1.3 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.1.3.2 In similar fashion, the LCO demands that the MTC be less negative than the specified value for EOC full power conditions. This measurement may be performed at any THERMAL POWER, but its results must be extrapolated to the conditions of RTP and all banks withdrawn in order to make a proper comparison with the LCO value. Because the RTP MTC value will gradually become more negative with further core depletion and boron concentration reduction, a 300 ppm SR value of MTC should necessarily be less negative than the lower LCO limit. The 300 ppm SR value is sufficiently less negative than the lower LCO limit value to ensure that the LCO limit will be met when the 300 ppm Surveillance criterion is met.
| |
| Performing the Surveillance once each cycle within 7 effective full power days (EFPD) after reaching an equivalent of an equilibrium RTP all rods out (ARO) boron concentration of 300 ppm is soon enough after the performance of SR 3.1.3.1 to ensure the lower limit will not be exceeded since the MTC changes after initial performance are gradual with core depletion and boron concentration reduction.
| |
| The Frequency of 14 EFPD thereafter, if MTC is more negative than 300 ppm Surveillance limit (not LCO limit) specified in the COLR or until the MTC measured at the equivalent of equilibrium RTP-ARO boron concentration of 60 ppm is less negative than the 60 ppm Surveillance limit specified in the COLR, is adequate for monitoring the change in MTC with core burnup since changes to MTC are relatively slow. The Surveillance limit for MTC at a RTP-ARO boron concentration of 60 ppm is conservative. If the measured MTC at 60 ppm is more positive than the 60 ppm Surveillance limit, the lower limit will not be exceeded because of the gradual manner in which MTC changes with core burnup.
| |
| REFERENCES 1. UFSAR, Section 3.3.1.2.
| |
| : 2. UFSAR, Section 1.4.
| |
| : 3. UFSAR, Chapter 14.
| |
| : 4. WCAP 9272-NP-A, "Westinghouse Reload Safety Evaluation Methodology," March 1978.
| |
| Cook Nuclear Plant Unit 2 B 3.1.3-5 Revision No. 0
| |
| | |
| Rod Group Alignment Limits B 3.1.4 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.4 Rod Group Alignment Limits BASES BACKGROUND The OPERABILITY (i.e., trippability) of the shutdown and control rods is an initial assumption in all safety analyses that assume rod insertion upon reactor trip. Maximum rod misalignment is an initial assumption in the safety analysis that directly affects core power distributions and assumptions of available SDM.
| |
| The applicable criteria for these reactivity and power distribution design requirements are Plant Specific Design Criterion (PSDC) 6, "Reactor Core Design" (Ref. 1), PSDC 28, "Reactivity Hot Shutdown Capability" (Ref. 2), PSDC 29, "Reactivity Shutdown Capability" (Ref. 2), PSDC 30, "Reactivity Holddown Capability" (Ref. 2), and 10 CFR 50.46, "Acceptance Criteria for Emergency Core Cooling Systems for Light Water Nuclear Power Plants" (Ref. 3).
| |
| Mechanical or electrical failures may cause a control or shutdown rod to become inoperable or to become misaligned from its group. Rod inoperability or misalignment may cause increased power peaking, due to the asymmetric reactivity distribution and a reduction in the total available rod worth for reactor shutdown. Therefore, rod alignment and OPERABILITY are related to core operation in design power peaking limits and the core design requirement of a minimum SDM.
| |
| Limits on rod alignment have been established, and all rod positions are monitored and controlled during power operation to ensure that the power distribution and reactivity limits defined by the design power peaking and SDM limits are preserved.
| |
| Rod cluster control assemblies (RCCAs), or rods, are moved by their control rod drive mechanisms (CRDMs). Each CRDM moves its RCCA one step (approximately 5/8 inch) at a time, but at varying rates (steps per minute) depending on the signal output from the Rod Control System.
| |
| The RCCAs are divided among control banks and shutdown banks. Each bank may be further subdivided into two groups to provide for precise reactivity control. A group consists of two or more RCCAs that are electrically paralleled to step simultaneously. If a bank of RCCAs consists of two groups, the groups are moved in a staggered fashion, but always within one step of each other. There are four control banks and four shutdown banks.
| |
| Cook Nuclear Plant Unit 2 B 3.1.4-1 Revision No. 0
| |
| | |
| Rod Group Alignment Limits B 3.1.4 BASES BACKGROUND (continued)
| |
| The shutdown banks are maintained either in the fully inserted or fully withdrawn position. The control banks are moved in an overlap pattern, using the following withdrawal sequence: When control bank A reaches a predetermined height in the core, control bank B begins to move out with control bank A. Control bank A stops at the position of maximum withdrawal, and control bank B continues to move out. When control bank B reaches a predetermined height, control bank C begins to move out with control bank B. This sequence continues until control banks A, B, and C are at the fully withdrawn position, and control bank D is approximately halfway withdrawn. The insertion sequence is the opposite of the withdrawal sequence. The control rods are arranged in a radially symmetric pattern, so that control bank motion does not introduce radial asymmetries in the core power distributions.
| |
| The axial position of shutdown rods and control rods is indicated by two separate and independent systems, which are the Bank Demand Position Indication System (commonly called group step counters) and the Rod Position Indication (RPI) System.
| |
| The Bank Demand Position Indication System counts the pulses from the Rod Control System that moves the rods. There is one step counter for each group of rods. Individual rods in a group all receive the same signal to move and should, therefore, all be at the same position indicated by the group step counter for that group. The Bank Demand Position Indication System is considered highly precise (+/- 1 step or +/- 5/8 inch). If a rod does not move one step for each demand pulse, the step counter will still count the pulse and incorrectly reflect the position of the rod.
| |
| The RPI System provides a highly accurate indication of actual rod position, but at a lower precision than the step counters. This system is based on inductive analog signals from a series of coils spaced along a hollow tube. The RPI System is capable of monitoring rod position within at least +/- 12 steps.
| |
| APPLICABLE Control rod misalignment accidents are analyzed in the safety analysis SAFETY (Ref. 4). The acceptance criteria for addressing control rod inoperability ANALYSES or misalignment are that:
| |
| : a. There be no violations of:
| |
| : 1. Specified acceptable fuel design limits; or
| |
| : 2. Reactor Coolant System (RCS) pressure boundary integrity; and
| |
| : b. The core remains subcritical after accident transients.
| |
| Cook Nuclear Plant Unit 2 B 3.1.4-2 Revision No. 0
| |
| | |
| Rod Group Alignment Limits B 3.1.4 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| There are three RCCA misalignment accidents which are analyzed which include one or more dropped RCCAs, a dropped RCCA bank, and a statically misaligned RCCA (Ref. 4). A different type of misalignment occurs if one rod fails to insert upon a reactor trip and remains stuck fully withdrawn. This condition requires an evaluation to determine that sufficient reactivity worth is held in the control rods to meet the SDM requirement, with the maximum worth rod stuck fully withdrawn.
| |
| For the dropped RCCA(s) or dropped RCCA bank misalignment accidents a negative reactivity insertion will result. Power may be reestablished either by reactivity feedback or control bank withdrawal.
| |
| Following plant stabilization, normal rod retrieval or shutdown procedures are followed. For dropped RCCA events in the automatic rod control mode, the Rod Control System detects the drop in power and initiates control bank withdrawal. In all cases, the minimum departure from nucleate boiling ratio (DNBR) remains above the limit.
| |
| Two types of analysis are performed in regard to static rod misalignment (Ref. 4). With control banks at their insertion limits, one type of analysis considers the case when any one rod is completely inserted into the core.
| |
| The second type of analysis considers the case of a completely withdrawn single rod from Bank D and the remainder of the bank inserted.
| |
| Satisfying limits on DNBR in both of these cases bounds the situation when a rod is misaligned from its group within the limits specified in the LCO.
| |
| Another type of misalignment occurs if one RCCA fails to insert upon a reactor trip and remains stuck fully withdrawn. This condition is assumed in the evaluation to determine that the required SDM is met with the maximum worth RCCA also fully withdrawn (Ref. 5).
| |
| Shutdown and control rod OPERABILITY and alignment are directly related to power distributions and SDM, which are initial conditions assumed in safety analyses. Therefore they satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The limits on shutdown or control rod alignments ensure that the assumptions in the safety analysis will remain valid. The requirements on control rod OPERABILITY ensure that upon reactor trip, the assumed reactivity will be available and will be inserted. The control rod OPERABILITY requirements (i.e., trippability) are separate from the alignment requirements, which ensure that the RCCAs and banks maintain the correct power distribution and rod alignment. The rod OPERABILITY requirement is satisfied provided the rod will fully insert in Cook Nuclear Plant Unit 2 B 3.1.4-3 Revision No. 0
| |
| | |
| Rod Group Alignment Limits B 3.1.4 BASES LCO (continued) the required rod drop time assumed in the safety analysis. Rod control malfunctions that result in the inability to move a rod (e.g., rod lift coil failures), but that do not impact trippability, do not result in rod inoperability.
| |
| The requirement to maintain the rod alignment to within plus or minus 12 steps or as determined from Figure 3.1.4-1 with THERMAL POWER 85% or within 18 steps of their group step counter demand position when THERMAL POWER is < 85% RTP is conservative. The safety analysis assumes a misalignment of one or more RCCA(s) or an entire RCCA bank. A misalignment of 30 steps will not cause power distribution worse than the design limits. Power distribution evaluations for steady state and load following conditions with rod misalignment of 30 steps showed that the increase in peaking factors could be accommodated at or below 85% RTP. Evaluations also showed that above 85% RTP, a misalignment of 30 steps could be accommodated if the margin in (CFQ x K(Z))/FQW(Z) is at least 1.06 and margin in FNH is at least 4%. For lower (CFQ x K(Z))/FQW(Z) values the allowable misalignment is reduced.
| |
| Failure to meet the requirements of this LCO may produce unacceptable power peaking factors and LHRs, or unacceptable SDMs, all of which may constitute initial conditions inconsistent with the safety analysis.
| |
| APPLICABILITY The requirements on RCCA OPERABILITY and alignment are applicable in MODES 1 and 2 because these are the only MODES in which neutron (or fission) power is generated, and the OPERABILITY (i.e., trippability) and alignment of rods have the potential to affect the safety of the unit. In MODES 3, 4, 5, and 6, the alignment limits do not apply because the reactor is shut down and not producing fission power. In the shutdown MODES, the OPERABILITY of the shutdown and control rods has the potential to affect the required SDM, but this effect can be compensated for by an increase in the boron concentration of the RCS. See LCO 3.1.1, "SHUTDOWN MARGIN," for SDM in MODES 3, 4, and 5 and LCO 3.9.1, "Boron Concentration," for boron concentration requirements during refueling.
| |
| ACTIONS A.1.1 and A.1.2 When one or more rods are inoperable (i.e., untrippable), there is a possibility that the required SDM may be adversely affected. Under these conditions, it is important to determine the SDM, and if it is less than the required value, initiate boration until the required SDM is recovered. The Completion Time of 1 hour is adequate for determining SDM and, if necessary, for initiating emergency boration and restoring SDM.
| |
| Cook Nuclear Plant Unit 2 B 3.1.4-4 Revision No. 1
| |
| | |
| Rod Group Alignment Limits B 3.1.4 BASES ACTIONS (continued)
| |
| In this situation, SDM verification must include the worth of the untrippable rod, as well as a rod of maximum worth.
| |
| A.2 When one or more rods are inoperable, the unit must be brought to a MODE or condition in which the LCO requirements are not applicable. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours.
| |
| The allowed Completion Time is reasonable, based on operating experience, for reaching MODE 3 from full power conditions in an orderly manner and without challenging unit systems.
| |
| B.1.1 and B.1.2 With a misaligned rod, SDM must be verified to be within limit or boration must be initiated to restore SDM to within limit.
| |
| In many cases, realigning the remainder of the group to the misaligned rod may not be desirable. For example, realigning control bank B to a rod that is misaligned 15 steps from the top of the core would require a significant power reduction, since control bank D must be moved fully in and control bank C must be moved in by approximately 100 steps.
| |
| Power operation may continue with one RCCA OPERABLE but misaligned, provided that SDM is verified within 1 hour. The Completion Time of 1 hour represents the time necessary for determining the actual unit SDM and, if necessary, aligning and starting the necessary systems and components to initiate boration.
| |
| B.2, B.3, B.4, B.5, and B.6 For continued operation with a misaligned rod, power must be reduced, SDM must periodically be verified within limits, hot channel factors (FQ(Z) and FNH) must be verified within limits, and the safety analyses must be re-evaluated to confirm continued operation is permissible.
| |
| Reduction of power to 75% RTP ensures that local LHR increases due to a misaligned RCCA will not cause the core design criteria to be exceeded. The Completion Time of 2 hours gives the operator sufficient time to accomplish an orderly power reduction without challenging the Reactor Trip System.
| |
| Cook Nuclear Plant Unit 2 B 3.1.4-5 Revision No. 0
| |
| | |
| Rod Group Alignment Limits B 3.1.4 BASES ACTIONS (continued)
| |
| When a rod is known to be misaligned, there is a potential to impact the SDM. Since the core conditions can change with time, periodic verification of SDM is required. A Frequency of 12 hours is sufficient to ensure this requirement continues to be met.
| |
| Verifying that FQ(Z), as approximated by FQC(Z) and FQW(Z), and FNH are within the required limits ensures that current operation at 75% RTP with a rod misaligned is not resulting in power distributions that may invalidate safety analysis assumptions at full power. The Completion Time of 72 hours allows sufficient time to obtain flux maps of the core power distribution using the incore flux mapping system and to calculate FQ(Z) and FNH.
| |
| Once current conditions have been verified acceptable, time is available to perform evaluations of accident analysis to determine that core limits will not be exceeded during a Design Basis Event for the duration of operation under these conditions. The accident analyses presented in UFSAR Chapter 14 (Ref. 6) that may be adversely affected will be evaluated to ensure that the analysis results remain valid for the duration of continued operation under these conditions. A Completion Time of 5 days is sufficient time to obtain the required input data and to perform the analysis.
| |
| C.1 When any Required Action cannot be completed within the associated Completion Time, the unit must be brought to a MODE in which the LCO requirements are not applicable. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours, which obviates concerns about the development of undesirable xenon or power distributions. The allowed Completion Time of 6 hours is reasonable, based on operating experience, for reaching MODE 3 from full power conditions in an orderly manner and without challenging the unit systems.
| |
| D.1.1 and D.1.2 More than one control rod becoming misaligned from its group average position is not expected, and has the potential to reduce SDM. Therefore, SDM must be evaluated. One hour allows the operator adequate time to determine SDM. Restoration of the required SDM, if necessary, requires increasing the RCS boron concentration to provide negative reactivity, as described in the Bases of LCO 3.1.1. The required Completion Time of 1 hour for initiating boration is reasonable, based on the time required for potential xenon redistribution, the low probability of an accident occurring, Cook Nuclear Plant Unit 2 B 3.1.4-6 Revision No. 0
| |
| | |
| Rod Group Alignment Limits B 3.1.4 BASES ACTIONS (continued) and the steps required to complete the action. This allows the operator sufficient time to align the required valves and start the boric acid pumps.
| |
| Boration will continue until the required SDM is restored.
| |
| D.2 If more than one rod is found to be misaligned or becomes misaligned because of bank movement, the unit conditions fall outside of the accident analysis assumptions. Since automatic bank sequencing would continue to cause misalignment, the unit must be brought to a MODE in which the LCO requirements are not applicable. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours.
| |
| The allowed Completion Time is reasonable, based on operating experience, for reaching MODE 3 from full power conditions in an orderly manner and without challenging unit systems.
| |
| SURVEILLANCE SR 3.1.4.1 REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.1.4.2 Verifying each control rod is OPERABLE would require that each rod be tripped. However, in MODES 1 and 2, tripping each control rod would result in radial or axial power tilts, or oscillations. Exercising each individual control rod provides increased confidence that all rods continue to be OPERABLE without exceeding the alignment limit, even if they are not regularly tripped. Moving each control rod by 8 steps will not cause radial or axial power tilts, or oscillations, to occur. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. Between required performances of SR 3.1.4.2 (determination of control rod OPERABILITY by movement), if a control rod(s) is discovered to be immovable, but remains trippable the control rod(s) is considered to be OPERABLE. At any time, if a control rod(s) is immovable, a determination of the trippability (OPERABILITY) of the control rod(s) must be made, and appropriate action taken.
| |
| Cook Nuclear Plant Unit 2 B 3.1.4-7 Revision No. 60
| |
| | |
| Rod Group Alignment Limits B 3.1.4 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.1.4.3 Verification of rod drop times allows the operator to determine that the maximum rod drop time permitted is consistent with the assumed rod drop time used in the safety analysis. Measuring rod drop times prior to reactor criticality, after reactor vessel head removal, ensures that the reactor internals and rod drive mechanism will not interfere with rod motion or rod drop time, and that no degradation in these systems has occurred that would adversely affect control rod motion or drop time. This testing is performed with all RCPs operating and the average moderator temperature 500°F to simulate a reactor trip under actual conditions.
| |
| This Surveillance is performed during a unit outage, due to the plant conditions needed to perform the SR and the potential for an unplanned unit transient if the Surveillance were performed with the reactor at power.
| |
| REFERENCES 1. UFSAR, Section 1.4.2.
| |
| : 2. UFSAR, Section 1.4.5.
| |
| : 3. 10 CFR 50.46.
| |
| : 4. UFSAR, Section 14.1.3.
| |
| : 5. UFSAR, Section 14.2.6.
| |
| : 6. UFSAR, Chapter 14.
| |
| Cook Nuclear Plant Unit 2 B 3.1.4-8 Revision No. 0
| |
| | |
| Shutdown Bank Insertion Limits B 3.1.5 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.5 Shutdown Bank Insertion Limits BASES BACKGROUND The insertion limits of the shutdown and control rods are initial assumptions in all safety analyses that assume rod insertion upon reactor trip. The insertion limits directly affect core power and fuel burnup distributions and assumptions of available ejected rod worth, SDM and initial reactivity insertion rate.
| |
| The applicable criteria for these reactivity and power distribution design requirements are Plant Specific Design Criterion (PSDC) 6, "Reactor Core Design" (Ref. 1), PSDC 27, "Redundancy of Reactivity Control" (Ref. 2), PSDC 28, "Reactivity Hot Shutdown Capability" (Ref. 2),
| |
| PSDC 29, "Reactivity Shutdown Capability" (Ref. 2), PSDC 30, "Reactivity Holddown Capability" (Ref. 2), PSDC 33, "Reactor Coolant Pressure Boundary Capability" (Ref. 3), and 10 CFR 50.46, "Acceptance Criteria for Emergency Core Cooling Systems for Light Water Nuclear Power Reactors" (Ref. 4). Limits on control rod insertion have been established, and all rod positions are monitored and controlled during power operation to ensure that the power distribution and reactivity limits defined by the design power peaking and SDM limits are preserved.
| |
| The rod cluster control assemblies (RCCAs) are divided among control banks and shutdown banks. Each bank may be further subdivided into two groups to provide for precise reactivity control. A group consists of two or more RCCAs that are electrically paralleled to step simultaneously.
| |
| If a bank of RCCAs consists of two groups, the groups are moved in a staggered fashion, but always within one step of each other. There are four control banks and four shutdown banks. See LCO 3.1.4, "Rod Group Alignment Limits," for control and shutdown rod OPERABILITY and alignment requirements, and LCO 3.1.7, "Rod Position Indication," for position indication requirements.
| |
| The control banks are used for precise reactivity control of the reactor.
| |
| The positions of the control banks are normally automatically controlled by the Rod Control System, but they can also be manually controlled.
| |
| They are capable of adding negative reactivity very quickly (compared to borating). The control banks must be maintained above designed insertion limits and are typically near the fully withdrawn position during normal full power operations.
| |
| Hence, they are not capable of adding a large amount of positive reactivity. Boration or dilution of the Reactor Coolant System (RCS) compensates for the reactivity changes associated with large changes in RCS temperature. The design calculations are performed with the Cook Nuclear Plant Unit 2 B 3.1.5-1 Revision No. 1
| |
| | |
| Shutdown Bank Insertion Limits B 3.1.5 BASES BACKGROUND (continued) assumption that the shutdown banks are withdrawn first. The shutdown banks can be fully withdrawn without the core going critical. This provides available negative reactivity in the event of boration errors. The shutdown banks are controlled manually by the control room operator.
| |
| During normal unit operation, the shutdown banks are either fully withdrawn or fully inserted. The shutdown banks must be completely withdrawn from the core, prior to withdrawing any control banks during an approach to criticality. The shutdown banks are then left in this position until the reactor is shut down. They affect core power and burnup distribution, and add negative reactivity to shut down the reactor upon receipt of a reactor trip signal.
| |
| APPLICABLE On a reactor trip, all RCCAs (shutdown banks and control banks), except SAFETY the most reactive RCCA, are assumed to insert into the core. The ANALYSES shutdown banks shall be at or above their insertion limits and available to insert the maximum amount of negative reactivity on a reactor trip signal.
| |
| The control banks may be partially inserted in the core, as allowed by LCO 3.1.6, "Control Bank Insertion Limits." The shutdown bank and control bank insertion limits are established to ensure that a sufficient amount of negative reactivity is available to shut down the reactor and maintain the required SDM (see LCO 3.1.1, "SHUTDOWN MARGIN")
| |
| following a reactor trip from full power. The combination of control banks and shutdown banks (less the most reactive RCCA, which is assumed to be fully withdrawn) is sufficient to take the reactor from full power conditions at rated temperature to zero power, and to maintain the required SDM at rated no load temperature (Ref. 2). The shutdown bank insertion limit also limits the reactivity worth of an ejected shutdown rod.
| |
| The acceptance criteria for addressing shutdown and control rod bank insertion limits and inoperability or misalignment is that:
| |
| : a. There be no violations of:
| |
| : 1. Specified acceptable fuel design limits; or
| |
| : 2. RCS pressure boundary integrity; and
| |
| : b. The core remains subcritical after accident transients.
| |
| As such, the shutdown bank insertion limits affect safety analysis involving core reactivity and SDM (Ref. 5).
| |
| The shutdown bank insertion limits preserve an initial condition assumed in the safety analyses and, as such, satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| Cook Nuclear Plant Unit 2 B 3.1.5-2 Revision No. 0
| |
| | |
| Shutdown Bank Insertion Limits B 3.1.5 BASES LCO The shutdown banks must be within their insertion limits any time the reactor is critical or approaching criticality. This ensures that a sufficient amount of negative reactivity is available to shut down the reactor and maintain the required SDM following a reactor trip.
| |
| The shutdown bank insertion limits are defined in the COLR.
| |
| APPLICABILITY The shutdown banks must be within their insertion limits, with the reactor in MODES 1 and 2. This ensures that a sufficient amount of negative reactivity is available to shut down the reactor and maintain the required SDM following a reactor trip. The shutdown banks do not have to be within their insertion limits in MODE 3, unless an approach to criticality is being made. In MODE 3, 4, 5, or 6, the shutdown banks are fully inserted in the core and contribute to the SDM. Refer to LCO 3.1.1 for SDM requirements in MODES 3, 4, and 5. LCO 3.9.1, "Boron Concentration,"
| |
| ensures adequate SDM in MODE 6.
| |
| The Applicability requirements have been modified by a Note indicating the LCO requirement is suspended during SR 3.1.4.2. This SR verifies the freedom of the rods to move, and requires the shutdown bank to move below the LCO limits, which would normally violate the LCO.
| |
| ACTIONS A.1.1, A.1.2, and A.2 When one or more shutdown banks is not within insertion limits, 2 hours is allowed to restore the shutdown banks to within the insertion limits.
| |
| This is necessary because the available SDM may be significantly reduced, with one or more of the shutdown banks not within their insertion limits. Also, verification of SDM or initiation of boration within 1 hour is required, since the SDM in MODES 1 and 2 is ensured by adhering to the control and shutdown bank insertion limits (see LCO 3.1.1). If shutdown banks are not within their insertion limits, then SDM will be verified by performing a reactivity balance calculation, considering the effects listed in the Bases for SR 3.1.1.1.
| |
| The allowed Completion Time of 2 hours provides an acceptable time for evaluating and repairing minor problems without allowing the unit to remain in an unacceptable condition for an extended period of time.
| |
| B.1 If any Required Action and associated Completion Time is not met, the unit must be brought to a MODE where the LCO is not applicable. The allowed Completion Time of 6 hours is reasonable, based on operating experience, for reaching the required MODE from full power conditions in an orderly manner and without challenging unit systems.
| |
| Cook Nuclear Plant Unit 2 B 3.1.5-3 Revision No. 0
| |
| | |
| Shutdown Bank Insertion Limits B 3.1.5 BASES SURVEILLANCE SR 3.1.5.1 REQUIREMENTS Verification that the shutdown banks are within their insertion limits prior to an approach to criticality ensures that when the reactor is critical, or being taken critical, the shutdown banks will be available to shut down the reactor, and the required SDM will be maintained following a reactor trip.
| |
| This SR and Frequency ensure that the shutdown banks are withdrawn before the control banks are withdrawn during a unit startup.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 1.4.2.
| |
| : 2. UFSAR, Section 1.4.5.
| |
| : 3. UFSAR, Section 1.4.6.
| |
| : 4. 10 CFR 50.46.
| |
| : 5. UFSAR, Chapter 14.
| |
| Cook Nuclear Plant Unit 2 B 3.1.5-4 Revision No. 60
| |
| | |
| Control Bank Insertion Limits B 3.1.6 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.6 Control Bank Insertion Limits BASES BACKGROUND The insertion limits of the shutdown and control rods are initial assumptions in all safety analyses that assume rod insertion upon reactor trip. The insertion limits directly affect core power and fuel burnup distributions and assumptions of available SDM, and initial reactivity insertion rate.
| |
| The applicable criteria for these reactivity and power distribution design requirements are Plant Specific Design Criterion (PSDC) 6, "Reactor Core Design" (Ref. 1), PSDC 27, "Redundancy of Reactivity Control" (Ref. 2), PSDC 28, "Reactivity Hot Shutdown Capability" (Ref. 2),
| |
| PSDC 29, "Reactivity Shutdown Capability" (Ref. 2), PSDC 30, "Reactivity Holddown Capability" (Ref. 2), PSDC 33, "Reactor Coolant Pressure Boundary Capability" (Ref. 3), and 10 CFR 50.46, "Acceptance Criteria for Emergency Core Cooling Systems for Light Water Nuclear Power Reactors" (Ref. 4). Limits on control rod insertion have been established, and all rod positions are monitored and controlled during power operation to ensure that the power distribution and reactivity limits defined by the design power peaking and SDM limits are preserved.
| |
| The rod cluster control assemblies (RCCAs) are divided among control banks and shutdown banks. Each bank may be further subdivided into two groups to provide for precise reactivity control. A group consists of two or more RCCAs that are electrically paralleled to step simultaneously.
| |
| A bank of RCCAs consists of two groups that are moved in a staggered fashion, but always within one step of each other. There are four control banks and four shutdown banks. See LCO 3.1.4, "Rod Group Alignment Limits," for control and shutdown rod OPERABILITY and alignment requirements, and LCO 3.1.7, "Rod Position Indication," for position indication requirements.
| |
| The control bank insertion limits are specified in the COLR. The control banks are required to be at or above the insertion limit lines.
| |
| The control bank sequence and overlap limits are specified in the COLR.
| |
| Sequencing is the order in which the banks are moved. The control banks are moved in an overlap pattern as described in the Background section for Bases 3.1.4. Overlap is the distance travelled together by two control banks.
| |
| The control banks are used for precise reactivity control of the reactor.
| |
| The positions of the control banks are normally controlled automatically Cook Nuclear Plant Unit 2 B 3.1.6-1 Revision No. 0
| |
| | |
| Control Bank Insertion Limits B 3.1.6 BASES BACKGROUND (continued) by the Rod Control System, but can also be manually controlled. They are capable of adding negative reactivity very quickly (compared to borating or diluting).
| |
| The power density at any point in the core must be limited, so that the fuel design criteria are maintained. Together, LCO 3.1.4, LCO 3.1.5, "Shutdown Bank Insertion Limits," LCO 3.1.6, LCO 3.2.3, "AXIAL FLUX DIFFERENCE (AFD)," and LCO 3.2.4, "QUADRANT POWER TILT RATIO (QPTR)," provide limits on control component operation and on monitored process variables, which ensure that the core operates within the fuel design criteria.
| |
| The shutdown and control bank insertion and alignment limits, AFD, and QPTR are process variables that together characterize and control the three dimensional power distribution of the reactor core. Additionally, the control bank insertion limits control the reactivity that could be added in the event of a rod ejection accident, and the shutdown and control bank insertion limits ensure the required SDM is maintained.
| |
| Operation within the subject LCO limits will prevent fuel cladding failures that would breach the primary fission product barrier and release fission products to the reactor coolant in the event of a loss of coolant accident (LOCA), loss of flow, ejected rod, or other accident requiring termination by a Reactor Trip System (RTS) trip function.
| |
| APPLICABLE The shutdown and control bank insertion limits, AFD, and QPTR LCOs SAFETY are required to prevent power distributions that could result in fuel ANALYSES cladding failures in the event of a LOCA, loss of flow, ejected rod, or other accident requiring termination by an RTS trip function.
| |
| The acceptance criteria for addressing shutdown and control bank insertion limits and inoperability or misalignment are that:
| |
| : a. There be no violations of:
| |
| : 1. Specified acceptable fuel design limits; or
| |
| : 2. Reactor Coolant System pressure boundary integrity; and
| |
| : b. The core remains subcritical after accident transients.
| |
| As such, the shutdown and control bank insertion limits affect safety analysis involving core reactivity and power distributions (Ref. 5).
| |
| Cook Nuclear Plant Unit 2 B 3.1.6-2 Revision No. 0
| |
| | |
| Control Bank Insertion Limits B 3.1.6 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| The SDM requirement is ensured by limiting the control and shutdown bank insertion limits so that allowable inserted worth of the RCCAs is such that sufficient reactivity is available in the rods to shut down the reactor to hot zero power with a reactivity margin that assumes the maximum worth RCCA remains fully withdrawn upon trip (Ref. 2).
| |
| Operation at the insertion limits or AFD limits may approach the maximum allowable linear heat generation rate or peaking factor with the allowed QPTR present. Operation at the insertion limit may also indicate the maximum ejected RCCA worth could be equal to the limiting value in fuel cycles that have sufficiently high ejected RCCA worths.
| |
| The control and shutdown bank insertion limits ensure that safety analyses assumptions for SDM, ejected rod worth, and power distribution peaking factors are preserved (Ref. 5).
| |
| The control bank insertion limits satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii), in that they are initial conditions assumed in the safety analysis.
| |
| LCO The limits on control banks sequence, overlap, and physical insertion, as defined in the COLR, must be maintained because they serve the function of preserving power distribution, ensuring that the SDM is maintained, ensuring that ejected rod worth is maintained, and ensuring adequate negative reactivity insertion is available on trip. The overlap between control banks provides more uniform rates of reactivity insertion and withdrawal and is imposed to maintain acceptable power peaking during control bank motion.
| |
| APPLICABILITY The control bank sequence, overlap, and physical insertion limits shall be maintained with the reactor in MODES 1 and 2 with keff 1.0. These limits must be maintained, since they preserve the assumed power distribution, ejected rod worth, SDM, and reactivity rate insertion assumptions. Applicability in MODE 2 with keff < 1.0, and MODES 3, 4, and 5 is not required, since neither the power distribution nor ejected rod worth assumptions would be exceeded in these MODES.
| |
| The applicability requirements have been modified by a Note indicating the LCO requirements are suspended during the performance of SR 3.1.4.2. This SR verifies the freedom of the rods to move, and requires the control bank to move below the LCO limits, which would violate the LCO.
| |
| Cook Nuclear Plant Unit 2 B 3.1.6-3 Revision No. 0
| |
| | |
| Control Bank Insertion Limits B 3.1.6 BASES ACTIONS A.1.1, A.1.2, A.2, B.1.1, B.1.2, and B.2 When the control banks are outside the acceptable insertion limits, they must be restored to within those limits. This restoration can occur in two ways:
| |
| : a. Reducing power to be consistent with rod position; or
| |
| : b. Moving rods to be consistent with power.
| |
| Also, verification of SDM or initiation of boration to regain SDM is required within 1 hour, since the SDM in MODES 1 and 2 normally ensured by adhering to the control and shutdown bank insertion limits (see LCO 3.1.1, "SHUTDOWN MARGIN") has been upset. If control banks are not within their insertion limits, then SDM will be verified by performing a reactivity balance calculation, considering the effects listed in the BASES for SR 3.1.1.1.
| |
| Similarly, if the control banks are found to be out of sequence or in the wrong overlap configuration, they must be restored to meet the limits.
| |
| Operation beyond the LCO limits is allowed for a short time period in order to take conservative action because the simultaneous occurrence of either a LOCA, loss of flow accident, ejected rod accident, or other accident during this short time period, together with an inadequate power distribution or reactivity capability, has an acceptably low probability.
| |
| The allowed Completion Time of 2 hours for restoring the banks to within the insertion, sequence, and overlap limits provides an acceptable time for evaluating and repairing minor problems without allowing the unit to remain in an unacceptable condition for an extended period of time.
| |
| C.1 If any Required Action and associated Completion Time is not met, the unit must be brought to MODE 2 with keff < 1.0, where the LCO is not applicable. The allowed Completion Time of 6 hours is reasonable, based on operating experience, for reaching the required MODE from full power conditions in an orderly manner and without challenging unit systems.
| |
| Cook Nuclear Plant Unit 2 B 3.1.6-4 Revision No. 0
| |
| | |
| Control Bank Insertion Limits B 3.1.6 BASES SURVEILLANCE SR 3.1.6.1 REQUIREMENTS This Surveillance is required to ensure that the reactor does not achieve criticality with the control banks below their insertion limits.
| |
| The estimated critical position (ECP) depends upon a number of factors, one of which is xenon concentration. If the ECP was calculated long before criticality, xenon concentration could change to make the ECP substantially in error. Conversely, determining the ECP immediately before criticality could be an unnecessary burden. There are a number of unit parameters requiring operator attention at that point. Verifying the ECP calculation within 4 hours prior to criticality avoids a large error from changes in xenon concentration, but allows the operator some flexibility to schedule the ECP calculation with other startup activities.
| |
| SR 3.1.6.2 The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.1.6.3 When control banks are maintained within their insertion limits as checked by SR 3.1.6.2 above, it is unlikely that their sequence and overlap will not be in accordance with requirements provided in the COLR. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 1.4.2.
| |
| : 2. UFSAR, Section 1.4.5.
| |
| : 3. UFSAR, Section 1.4.6.
| |
| : 4. 10 CFR 50.46.
| |
| : 5. UFSAR, Chapter 14.
| |
| Cook Nuclear Plant Unit 2 B 3.1.6-5 Revision No. 60
| |
| | |
| Rod Position Indication B 3.1.7 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.7 Rod Position Indication BASES BACKGROUND According to Plant Specific Design Criterion (PSDC) 12 (Ref. 1),
| |
| instrumentation and controls shall be provided as required to monitor and maintain within prescribed operating ranges essential reactor operating variables. LCO 3.1.7 is required to ensure OPERABILITY of the rod position indicators to determine control rod positions and thereby ensure compliance with the control rod alignment and insertion limits.
| |
| The OPERABILITY, including position indication, of the shutdown and control rods is an initial assumption in all safety analyses that assume rod insertion upon reactor trip. Maximum rod misalignment is an initial assumption in the safety analysis that directly affects core power distributions and assumptions of available SDM. Rod position indication is required to assess OPERABILITY and misalignment.
| |
| Mechanical or electrical failures may cause a control rod to become inoperable or to become misaligned from its group. Control rod inoperability or misalignment may cause increased power peaking, due to the asymmetric reactivity distribution and a reduction in the total available rod worth for reactor shutdown. Therefore, control rod alignment and OPERABILITY are related to core operation in design power peaking limits and the core design requirement of a minimum SDM.
| |
| Limits on control rod alignment and OPERABILITY have been established, and all rod positions are monitored and controlled during power operation to ensure that the power distribution and reactivity limits defined by the design power peaking and SDM limits are preserved.
| |
| Rod cluster control assemblies (RCCAs), or rods, are moved out of the core (up or withdrawn) or into the core (down or inserted) by their control rod drive mechanisms. The RCCAs are divided among control banks and shutdown banks. Each bank may be further subdivided into two groups to provide for precise reactivity control.
| |
| The axial position of shutdown rods and control rods are determined by two separate and independent systems: the Bank Demand Position Indication System (commonly called group step counters) and the Rod Position Indication (RPI) System.
| |
| The Bank Demand Position Indication System counts the pulses from the Rod Control System that move the rods. There is one step counter for each group of rods. Individual rods in a group all receive the same signal Cook Nuclear Plant Unit 2 B 3.1.7-1 Revision No. 0
| |
| | |
| Rod Position Indication B 3.1.7 BASES BACKGROUND (continued) to move and should, therefore, all be at the same position indicated by the group step counter for that group. The Bank Demand Position Indication System is considered highly precise (+/- 1 step or +/- 5/8 inch). If a rod does not move one step for each demand pulse, the step counter will still count the pulse and incorrectly reflect the position of the rod.
| |
| The RPI System provides a highly accurate indication of actual control rod position, but at a lower precision than the step counters. This system is based on inductive analog signals from a series of coils spaced along a hollow tube. The RPI System is capable of monitoring rod position within at least +/- 12 steps. With an indicated deviation of up to 18 steps between the group step counter and RPI, the maximum deviation between actual rod position and the demand position could be 30 steps.
| |
| APPLICABLE Control and shutdown rod position accuracy is essential during power SAFETY operation. Power peaking, ejected rod worth, or SDM limits may be ANALYSES violated in the event of a Design Basis Accident (Ref. 2), with control or shutdown rods operating outside their limits undetected. Therefore, the acceptance criteria for rod position indication is that rod positions must be known with sufficient accuracy in order to verify the core is operating within the group sequence, overlap, design peaking limits, ejected rod worth, and with minimum SDM (LCO 3.1.5, "Shutdown Bank Insertion Limits," and LCO 3.1.6, "Control Bank Insertion Limits"). The rod positions must also be known in order to verify the alignment limits are preserved (LCO 3.1.4, "Rod Group Alignment Limits"). Control rod positions are continuously monitored to provide operators with information that ensures the plant is operating within the bounds of the accident analysis assumptions.
| |
| Rod Position Indication satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). The control rod position indicators monitor control rod position, which is an initial condition of the accident.
| |
| LCO LCO 3.1.7 specifies that the RPI System and the Bank Demand Position Indication System be OPERABLE. For the rod position indicators to be OPERABLE requires meeting the SR of the LCO and the following:
| |
| : a. For the RPI System there are no failed coils; and
| |
| : b. The Bank Demand Indication System has been calibrated either in the fully inserted position or to the RPI System.
| |
| These requirements ensure that rod position indication during power operation and PHYSICS TESTS is accurate, and that design assumptions are not challenged.
| |
| Cook Nuclear Plant Unit 2 B 3.1.7-2 Revision No. 0
| |
| | |
| Rod Position Indication B 3.1.7 BASES LCO (continued)
| |
| OPERABILITY of the position indicator channels ensures that inoperable, misaligned, or mispositioned control rods can be detected. Therefore, power peaking, ejected rod worth, and SDM can be controlled within acceptable limits.
| |
| APPLICABILITY The requirements on the RPI and step counters are only applicable in MODES 1 and 2 (consistent with LCO 3.1.4, LCO 3.1.5, and LCO 3.1.6),
| |
| because these are the only MODES in which power is generated, and the OPERABILITY and alignment of rods have the potential to affect the safety of the unit. In the shutdown MODES, the OPERABILITY of the shutdown and control banks has the potential to affect the required SDM, but this effect can be compensated for by an increase in the boron concentration of the Reactor Coolant System.
| |
| ACTIONS The ACTIONS Table is modified by a Note indicating that a separate Condition entry is allowed for each inoperable rod position indicator and each demand position indicator. This is acceptable because the Required Actions for each Condition provide appropriate compensatory actions for each inoperable position indicator.
| |
| A.1 When one RPI channel in a group fails, the position of the rod may still be determined indirectly by use of the movable incore detectors. The only exception is if the RPI for rod H-8 is inoperable, since rod H-8 is directly in the center of the core and its position cannot be determined indirectly by use of the movable incore detectors. In this condition, the Required Action of A.2 below is required. Based on experience, normal power operation does not require excessive movement of banks. Therefore, verification of RCCA position within the Completion Time of 8 hours is adequate for allowing continued full power operation, since the probability of simultaneously having a rod significantly out of position and an event sensitive to that rod position is small.
| |
| If a rod has been significantly moved (in excess of 24 steps in one direction, since the position was last determined), Required Action A.1 is still appropriate but must be initiated promptly to begin verifying that the rod is still properly positioned, relative to their group positions. The allowed Completion Time of 4 hours provides an acceptable period of time to verify the rod position with inoperable position indicator indirectly by using movable incore detectors. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage Cook Nuclear Plant Unit 2 B 3.1.7-3 Revision No. 0
| |
| | |
| Rod Position Indication B 3.1.7 BASES ACTIONS (continued) time "clock." In this Required Action, the Completion Time only begins on discovery that both:
| |
| : a. One RPI per group inoperable for one or more groups; and
| |
| : b. A rod with an inoperable position indicator has been moved in excess of 24 steps in one direction since the last determination of the rods position.
| |
| If at any time during the existence of Condition A (one RPI per group inoperable for one or more groups) a rod with an inoperable position indicator has been moved in excess of 24 steps in one direction since the last determination of the rods position, this Completion Time begins to be tracked.
| |
| A.2 Reduction of THERMAL POWER to 50% RTP puts the core into a condition where rod position is not significantly affecting core peaking factors (Ref. 2).
| |
| The allowed Completion Time of 8 hours is reasonable, based on operating experience, for reducing power to 50% RTP from full power conditions without challenging unit systems and allowing for rod position determination by Required Action A.1 above.
| |
| B.1, B.2, and B.3 When more than one RPI in a group fails, additional actions are necessary to ensure that acceptable power distribution limits are maintained, minimum SDM is maintained, and the potential effects of rod misalignment on associated accident analyses are limited. Placing the Rod Control System in manual assures unplanned rod motion will not occur. Together with the indirect position determination available via movable incore detectors will minimize the potential for rod misalignment.
| |
| The immediate Completion Time for placing the Rod Control System in manual reflects the urgency with which unplanned rod motion must be prevented while in this condition.
| |
| Monitoring and recording reactor coolant Tavg help assure that significant changes in power distribution and SDM are avoided. The once per hour Completion Time is acceptable because only minor fluctuations in RCS temperature are expected at steady state plant operating conditions.
| |
| Cook Nuclear Plant Unit 2 B 3.1.7-4 Revision No. 0
| |
| | |
| Rod Position Indication B 3.1.7 BASES ACTIONS (continued)
| |
| The position of the rods may be determined indirectly by use of the movable incore detectors (Required Action A.1). Verification of control rod position once per 8 hours and once within 4 hours after a rod with an inoperable position indicator has been moved in excess of 24 steps in one direction since the last determination of the rod's position is adequate for allowing continued full power operation for a limited, 24 hour period, since the probability of simultaneously having a rod significantly out of position and an event sensitive to that rod position is small. The 24 hour Completion Time provides sufficient time to troubleshoot and restore the RPI System to operation while avoiding the unit challenges associated with the shutdown without full rod position indication.
| |
| C.1.1 and C.1.2 With one demand position indicator per bank inoperable, the rod positions can be determined by the RPI System. Since normal power operation does not require excessive movement of rods, verification by administrative means that the rod position indicators are OPERABLE and the most withdrawn rod and the least withdrawn rod are within the required rod misalignment limits within the allowed Completion Time of once every 8 hours is adequate.
| |
| C.2 Reduction of THERMAL POWER to 50% RTP puts the core into a condition where rod position is not significantly affecting core peaking factor limits (Ref. 2). The allowed Completion Time of 8 hours provides an acceptable period of time to verify the rod positions per Required Actions C.1.1 and C.1.2 or reduce power to 50% RTP.
| |
| D.1 If any Required Action and associated Completion Time is not met, the unit must be brought to a MODE in which the requirement does not apply.
| |
| To achieve this status, the unit must be brought to at least MODE 3 within 6 hours. The allowed Completion Time is reasonable, based on operating experience, for reaching the required MODE from full power conditions in an orderly manner and without challenging unit systems.
| |
| Cook Nuclear Plant Unit 2 B 3.1.7-5 Revision No. 0
| |
| | |
| Rod Position Indication B 3.1.7 BASES SURVEILLANCE SR 3.1.7.1 REQUIREMENTS SR 3.1.7.1 is the performance of a CHANNEL CALIBRATION for each RPI channel.
| |
| The calibration verifies the accuracy of each RPI channel. The Frequency of once prior to criticality after each removal of the reactor head is based on operating experience and considers channel reliability.
| |
| The SR is modified by a Note stating that the sensors are excluded from the CHANNEL CALIBRATION. This is acceptable since the RPIs are adjusted as necessary to compensate for thermal effects.
| |
| REFERENCES 1. UFSAR, Section 1.4.3.
| |
| : 2. UFSAR, Chapter 14.
| |
| Cook Nuclear Plant Unit 2 B 3.1.7-6 Revision No. 0
| |
| | |
| PHYSICS TESTS Exceptions - MODE 2 B 3.1.8 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.8 PHYSICS TESTS Exceptions - MODE 2 BASES BACKGROUND The primary purpose of the MODE 2 PHYSICS TESTS exceptions is to permit relaxations of existing LCOs to allow certain PHYSICS TESTS to be performed.
| |
| Section XI of 10 CFR 50, Appendix B (Ref. 1), requires that a test program be established to ensure that structures, systems, and components will perform satisfactorily in service. All functions necessary to ensure that the specified design conditions are not exceeded during normal operation and anticipated operational occurrences must be tested.
| |
| This testing is an integral part of the design, construction, and operation of the unit. Requirements for notification of the NRC, for the purpose of conducting tests and experiments, are specified in 10 CFR 50.59 (Ref. 2).
| |
| The key objectives of a test program are to (Ref. 3):
| |
| : a. Ensure that the facility has been adequately designed;
| |
| : b. Validate the analytical models used in the design and analysis;
| |
| : c. Verify the assumptions used to predict unit response;
| |
| : d. Ensure that installation of equipment in the facility has been accomplished in accordance with the design; and
| |
| : e. Verify that the operating and emergency procedures are adequate.
| |
| To accomplish these objectives, testing is performed prior to initial criticality, during startup, during low power operations, during power ascension, at high power, and after each refueling. The PHYSICS TESTS requirements for reload fuel cycles ensure that the operating characteristics of the core are consistent with the design predictions and that the core can be operated as designed (Ref. 4).
| |
| PHYSICS TESTS procedures are written and approved in accordance with established formats. The procedures include all information necessary to permit a detailed execution of the testing required to ensure that the design intent is met. PHYSICS TESTS are performed in accordance with these procedures and test results are approved prior to continued power escalation and long term power operation.
| |
| Cook Nuclear Plant Unit 2 B 3.1.8-1 Revision No. 0
| |
| | |
| PHYSICS TESTS Exceptions - MODE 2 B 3.1.8 BASES BACKGROUND (continued)
| |
| PHYSICS TESTS requirements for reload fuel cycles are defined in ANSI/ANS 19.6.1 1997 (Ref. 4) with additional testing updates as follows:
| |
| : 1. Ref. 5 provides another method for the Control Rod Worth Test
| |
| : 2. If Control Rod Worth Testing is performed, Ref. 6 provides justification for when the initial flux map may be postponed from approximately 30% RTP to approximately 50% RTP.
| |
| : 3. Ref. 7 provides an alternative test method (called Subcritical Physics Testing) which may be used in lieu of performing the Control Rod Worth Test and the Critical Boron Concentration -
| |
| Control Rods Withdrawn Test.
| |
| : 4. If the alternative test method in Ref. 7 is performed, Ref. 8 provides justification for when the initial flux map may be postponed from approximately 30% RTP to approximately 50%
| |
| RTP.
| |
| The PHYSICS TESTS described by Ref. 4, Ref. 5, Ref. 7, and other supplementary tests may be required to calibrate the nuclear instrumentation or to diagnose operational problems. These tests may cause the operating controls and process variables to deviate from their LCO requirements during their performance. Specific PHYSICS TESTS include the following:
| |
| : a. The Critical Boron Concentration - Control Rods Withdrawn Test measures the critical boron concentration at hot zero power (HZP).
| |
| With all rods out, the lead control bank is at or near its fully withdrawn position. HZP is where the core is critical (keff = 1.0), and the Reactor Coolant System (RCS) is at design temperature and pressure for zero power. Performance of this test should not violate any of the referenced LCOs.
| |
| : b. The Control Rod Worth Test (i.e., Rod Bank Worth Test) is used to measure the reactivity worth of selected banks. This test is performed at HZP and has three alternative methods of performance.
| |
| The first method, the Boron Exchange Method, varies the reactor coolant boron concentration and moves the selected bank in response to the changing boron concentration. The reactivity changes are measured with a reactivity computer. This sequence is repeated for the remaining banks. The second method, the Rod Swap Method, measures the worth of a predetermined reference bank using the Boron Exchange Method above. The reference bank is then nearly fully inserted into the core. The selected bank is then inserted into the core as the reference bank is withdrawn. The HZP Cook Nuclear Plant Unit 2 B 3.1.8-2 Revision No. 72
| |
| | |
| PHYSICS TESTS Exceptions - MODE 2 B 3.1.8 BASES BACKGROUND (continued) critical conditions are then determined with the selected bank fully inserted into the core. The worth of the selected bank is inferred, based on the position of the reference bank with respect to the selected bank. This sequence is repeated as necessary for the remaining control banks. The third method, the Dynamic Rod Worth Measurement Method (Ref. 5), moves the selected control bank over its entire length of travel. The worth of the bank is inferred from the change in the flux level upon insertion of the bank. This sequence is repeated for the remaining banks. Performance of this test could violate LCO 3.1.4, LCO 3.1.5, or LCO 3.1.6.
| |
| : c. The ITC Test measures the ITC of the reactor. This test is performed at HZP and has two methods of performance. The first method, the Slope Method, varies RCS temperature in a slow and continuous manner. The reactivity change is measured with a reactivity computer as a function of the temperature change. The ITC is the slope of the reactivity versus the temperature plot. The test is repeated by reversing the direction of the temperature change, and the final ITC is the average of the two calculated ITCs. The second method, the Endpoint Method, changes the RCS temperature and measures the reactivity at the beginning and end of the temperature change. The ITC is the total reactivity change divided by the total temperature change. The test is repeated by reversing the direction of the temperature change, and the final ITC is the average of the two calculated ITCs. Performance of this test could violate LCO 3.4.2, "RCS Minimum Temperature for Criticality."
| |
| : d. The Flux Symmetry Test measures the degree of azimuthal symmetry of the neutron flux. This test can be performed at HZP (Control Rod Worth Symmetry Method) or at 50% RTP (Flux Distribution Method). The Control Rod Worth Symmetry Method inserts a control bank, which can then be withdrawn to compensate for the insertion of a single control rod from a symmetric set. The symmetric rods of each set are then tested to evaluate the symmetry of the control rod worth and neutron flux (power distribution). A reactivity computer is used to measure the control rod worths.
| |
| Performance of this test could violate LCO 3.1.4, LCO 3.1.5, or LCO 3.1.6. The Flux Distribution Method uses the incore flux detectors to measure the azimuthal flux distribution at selected locations with the core at 50% RTP.
| |
| : e. Subcritical Physics Testing (SPT) is an alternative approach (Ref. 7) to traditional low power physics testing that effectively replaces Control Rod Worth Testing. The SPT results can also be used to support completion of SR 3.1.2.1 prior to entering MODE 1 in lieu of Cook Nuclear Plant Unit 2 B 3.1.8-3 Revision No. 72
| |
| | |
| PHYSICS TESTS Exceptions - MODE 2 B 3.1.8 BASES BACKGROUND (continued) performing the Critical Boron Concentration - Control Rods Withdrawn Test. The SPT approach primarily consists of performing steady-state measured-to-predicted comparisons of inverse count rate ratio (ICRR) over a variety of subcritical core configurations and conditions beginning during MODE 3 operation (the testing activities not being subject to LCO 3.1.8) and continuing at MODE 2, k eff < 1.0 conditions. The SPT activities that occur during MODE 2 are accomplished mainly via control rod bank withdrawal in compliance with LCO 3.1.4, LCO 3.1.5, and LCO 3.1.6. After reaching criticality, the boron concentration is determined by chemical analysis and is used to compare the actual critical conditions versus design prediction. The ITC Test and Flux Symmetry Test are outside the SPT Scope.
| |
| APPLICABLE The fuel is protected by LCOs that preserve the initial conditions of the SAFETY core assumed during the safety analyses. The purpose of the LCOs that ANALYSES are excepted by this LCO are described in the Bases for the individual LCOs. The above mentioned PHYSICS TESTS may require the operating control or process variables to deviate from their LCO limitations.
| |
| The UFSAR defines requirements for initial testing of the facility, including PHYSICS TESTS. Table 13.3-1 summarizes the zero, low power, and power tests. Requirements for reload fuel cycle PHYSICS TESTS are defined in ANSI/ANS-19.6.1-1997 (Ref. 4), WCAP-13360-P-A, Revision 1 (Ref. 5), PA-OSC-0061 (Ref. 6), WCAP-16260-P-A, Revision 2 (Ref. 7),
| |
| and NF-AE-19-075 (Ref. 8). Although these PHYSICS TESTS are generally accomplished within the limits for all LCOs, conditions may occur when one or more LCOs must be suspended to make completion of PHYSICS TESTS possible or practical. This is acceptable as long as the fuel design criteria are not violated. When one or more of the requirements specified in LCO 3.1.3, "Moderator Temperature Coefficient (MTC)," LCO 3.1.4, LCO 3.1.5, LCO 3.1.6, and LCO 3.4.2 are suspended for PHYSICS TESTS, the fuel design criteria are preserved as long as the power level is limited to 5% RTP, the reactor coolant temperature is kept 531°F, and SDM is within the limits for MODE 2 with keff < 1.0 provided in LCO 3.1.1, "SHUTDOWN MARGIN (SDM)."
| |
| The PHYSICS TESTS include measurement of core nuclear parameters or the exercise of control components that affect process variables.
| |
| Among the process variables involved are AFD and QPTR, which represent initial conditions of the unit safety analyses. Also involved are the movable control components (control and shutdown rods), which are required to shut down the reactor. The limits for these variables are specified for each fuel cycle in the COLR.
| |
| Cook Nuclear Plant Unit 2 B 3.1.8-4 Revision No. 72
| |
| | |
| PHYSICS TESTS Exceptions - MODE 2 B 3.1.8 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| As described in LCO 3.0.7, compliance with Test Exception LCOs is optional, and therefore no criteria of 10 CFR 50.36(c)(2)(ii) apply. Test Exception LCOs provide flexibility to perform certain operations by appropriately modifying requirements of other LCOs. A discussion of the criteria satisfied for the other LCOs is provided in their respective Bases.
| |
| Reference 5 allows special test exceptions (STEs) to be included as part of the LCO that they affect. It was decided, however, to retain this STE as a separate LCO because it was less cumbersome and provided additional clarity.
| |
| LCO This LCO allows the reactor parameters of MTC and minimum temperature for criticality to be outside their specified limits. In addition, it allows selected control and shutdown banks to be positioned outside of their specified alignment and insertion limits. Operation beyond specified limits is permitted for the purpose of performing PHYSICS TESTS and poses no threat to fuel integrity, provided the SRs are met.
| |
| The requirements of LCO 3.1.3, LCO 3.1.4, LCO 3.1.5, LCO 3.1.6, and LCO 3.4.2 may be suspended and the number of required channels for LCO 3.3.1, "RTS Instrumentation," Functions 2, 3, 6, and 18.d may be reduced to 3 during the performance of PHYSICS TESTS provided:
| |
| : a. RCS lowest loop average temperature is 531°F;
| |
| : b. SDM is within the limits for MODE 2 with k eff < 1.0 provided in LCO 3.1.1; and
| |
| : c. THERMAL POWER is 5% RTP.
| |
| APPLICABILITY This LCO is applicable when performing low power PHYSICS TESTS.
| |
| The Applicability is stated as "During PHYSICS TESTS initiated in MODE 2" to ensure that the 5% RTP maximum power level is not exceeded. Should the THERMAL POWER exceed 5% RTP, and consequently the unit enter MODE 1, this Applicability statement prevents exiting this Specification and its Required Actions.
| |
| ACTIONS A.1 and A.2 If the SDM requirement is not met, boration must be initiated promptly. A Completion Time of 15 minutes is adequate for an operator to correctly align and start the required systems and components. The operator should begin boration with the best source available for the unit conditions. Boration will be continued until SDM is within limit.
| |
| Cook Nuclear Plant Unit 2 B 3.1.8-5 Revision No. 72
| |
| | |
| PHYSICS TESTS Exceptions - MODE 2 B 3.1.8 BASES ACTIONS (continued)
| |
| In addition, the PHYSICS TEST exception must be suspended within 1 hour. Suspension of PHYSICS TESTS exceptions requires restoration of each of the applicable LCOs to within specification.
| |
| B.1 When THERMAL POWER is 5% RTP, the only acceptable action is to open the reactor trip breakers (RTBs) to prevent operation of the reactor beyond its design limits. Immediately opening the RTBs will shut down the reactor and prevent operation of the reactor outside of its design limits.
| |
| C.1 When the RCS lowest Tavg is < 531°F, the appropriate action is to restore Tavg to within its specified limit. The allowed Completion Time of 15 minutes provides time for restoring Tavg to within limits without allowing the unit to remain in an unacceptable condition for an extended period of time. Operation with the reactor critical and with temperature below 531°F could violate the assumptions for accidents analyzed in the safety analyses.
| |
| D.1 If the Required Action and associated Completion Time of Condition C is not met, the unit must be brought to a MODE in which the requirement does not apply. To achieve this status, the unit must be brought to at least MODE 3 within an additional 15 minutes. The Completion Time of 15 additional minutes is reasonable, based on operating experience, for reaching MODE 3 in an orderly manner and without challenging unit systems.
| |
| SURVEILLANCE SR 3.1.8.1 REQUIREMENTS Verification that the RCS lowest loop T avg is 531°F will ensure that the unit is not operating in a condition that could invalidate the safety analyses. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.1.8.2 Verification that the THERMAL POWER is 5% RTP will ensure that the unit is not operating in a condition that could invalidate the safety analyses. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Cook Nuclear Plant Unit 2 B 3.1.8-6 Revision No. 72
| |
| | |
| PHYSICS TESTS Exceptions - MODE 2 B 3.1.8 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.1.8.3 The SDM is verified by performing a reactivity balance calculation, considering the following reactivity effects:
| |
| : a. RCS boron concentration;
| |
| : b. Bank position;
| |
| : c. RCS average temperature;
| |
| : d. Fuel burnup based on gross thermal energy generation;
| |
| : e. Xenon concentration;
| |
| : f. Samarium concentration;
| |
| : g. Isothermal temperature coefficient (ITC), when below the point of adding heat (POAH);
| |
| : h. Moderator Temperature Defect, when above the POAH; and
| |
| : i. Doppler Defect, when above the POAH.
| |
| Using the ITC accounts for Doppler reactivity in this calculation when the reactor is subcritical or critical but below the POAH, and the fuel temperature will be changing at the same rate as the RCS.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. 10 CFR 50, Appendix B, Section XI.
| |
| : 2. 10 CFR 50.59.
| |
| : 3. Regulatory Guide 1.68, Revision 2, August, 1978.
| |
| : 4. ANSI/ANS-19.6.1-1997, August 22, 1997.
| |
| : 5. WCAP-13360-P-A, "Westinghouse Dynamic Rod Worth Measurement Technique," Revision 1, October 1998.
| |
| : 6. PA-OSC-0061, Westinghouse Position Paper on Power Distribution Measurement Requirements for Reload Startup Programs, February 2005.
| |
| Cook Nuclear Plant Unit 2 B 3.1.8-7 Revision No. 72
| |
| | |
| PHYSICS TESTS Exceptions - MODE 2 B 3.1.8 BASES REFERENCES (continued)
| |
| : 7. WCAP-16260-P-A, Revision 2, The Spatially Corrected Inverse Count Rate (SCICR) Method for Subcritical Reactivity Measurement, May 2019.
| |
| : 8. NF-AE-19-075, Revision 0, 10 CFR 50.59 Applicability Determination & Screen for Subcritical Physics Testing (SPT)-Based Flux Map Deferral for Donald C. Cook Units 1 and 2, October 2019.
| |
| Cook Nuclear Plant Unit 2 B 3.1.8-8 Revision No. 72
| |
| | |
| FQ(Z)
| |
| B 3.2.1 B 3.2 POWER DISTRIBUTION LIMITS B 3.2.1 Heat Flux Hot Channel Factor (FQ(Z))
| |
| BASES BACKGROUND The purpose of the limits on the values of FQ(Z) is to limit the local (i.e., pellet) peak power density. The value of FQ(Z) varies along the axial height (Z) of the core.
| |
| FQ(Z) is defined as the maximum local fuel rod linear power density divided by the average fuel rod linear power density, assuming nominal fuel pellet and fuel rod dimensions. Therefore, FQ(Z) is a measure of the peak fuel pellet power within the reactor core.
| |
| During power operation, the global power distribution is limited by LCO 3.2.3, "AXIAL FLUX DIFFERENCE (AFD)," and LCO 3.2.4, "QUADRANT POWER TILT RATIO (QPTR)," which are directly and continuously measured process variables. These LCOs, along with LCO 3.1.6, "Control Bank Insertion Limits," maintain the core limits on power distributions on a continuous basis.
| |
| FQ(Z) varies with fuel loading patterns, control bank insertion, fuel burnup, and changes in axial power distribution.
| |
| FQ(Z) is measured periodically using the incore detector system. These measurements are generally taken with the core at or near equilibrium conditions.
| |
| Using the measured three dimensional power distributions, it is possible to derive a measured value for FQ(Z). However, because this value represents a equilibrium condition, it does not include the variations in the value of FQ(Z) which are present during non-equilibrium situations such as load following or power ascension.
| |
| To account for these possible variations, the equilibrium value of FQ(Z) is adjusted as FQW(Z) by an elevation dependent factor that accounts for the calculated worst case transient conditions.
| |
| Core monitoring and control under non-equilibrium conditions are accomplished by operating the core within the limits of the appropriate LCOs, including the limits on AFD, QPTR, and control rod insertion.
| |
| APPLICABLE This LCO precludes core power distributions that violate the following SAFETY fuel design criteria:
| |
| ANALYSES
| |
| : a. During a large break loss of coolant accident (LOCA), the peak cladding temperature must not exceed 2200°F (Ref. 1);
| |
| Cook Nuclear Plant Unit 2 B 3.2.1-1 Revision No. 0
| |
| | |
| FQ(Z)
| |
| B 3.2.1 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| : b. There must be at least 95% probability at the 95% confidence level (the 95/95 DNB criterion) that the hot fuel rod in the core does not experience a departure from nucleate boiling (DNB) condition;
| |
| : c. During an ejected rod accident, the average fuel pellet enthalpy at hot spot is below 200 cal/gm for irradiated and unirradiated fuel (Ref. 2); and
| |
| : d. One of the reactivity control systems provided shall be capable of making the core subcritical under any anticipated operating condition (including anticipated operational transients) sufficiently fast enough to prevent exceeding acceptable fuel damage limits. SDM should assure subcriticality with the most restrictive RCCA fully withdrawn (Ref. 3).
| |
| Limits on FQ(Z) ensure that the value of the initial total peaking factor assumed in the accident analyses remains valid. Other criteria must also be met (e.g., maximum cladding oxidation, maximum hydrogen generation, coolable geometry, and long term cooling). However, the peak cladding temperature is typically most limiting.
| |
| FQ(Z) limits assumed in the LOCA analysis are typically limiting relative to (i.e., lower than) the FQ(Z) limit assumed in safety analyses for other postulated accidents. Therefore, this LCO provides conservative limits for other postulated accidents.
| |
| FQ(Z) satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The Heat Flux Hot Channel Factor, FQ(Z), shall be limited by the following relationships:
| |
| FQ(Z) ( CFQ/P ) K(Z) for P > 0.5; and FQ(Z) ( CFQ/0.5 ) K(Z) for P 0.5, Where: CFQ is the FQ(Z) limit at RTP provided in the COLR; K(Z) is the normalized FQ(Z) as a function of core height provided in the COLR; and P = THERMAL POWER/RTP.
| |
| For Constant Axial Offset Control operation, FQ(Z) is approximated by FQC(Z) and FQW(Z). Thus, both FQC(Z) and FQW(Z) must meet the preceding limits on FQ(Z).
| |
| Cook Nuclear Plant Unit 2 B 3.2.1-2 Revision No. 0
| |
| | |
| FQ(Z)
| |
| B 3.2.1 BASES LCO (continued)
| |
| An FQC(Z) evaluation requires obtaining an incore flux map in MODE 1.
| |
| From the incore flux map results we obtain the measured value (FQM(Z)) of FQ(Z). Then, FQC(Z) = FQM(Z) 1.0815 where 1.0815 is a factor that accounts for fuel manufacturing tolerances (3%) and flux map measurement uncertainty (5%) (Ref. 4).
| |
| FQC(Z) is an approximation for FQ(Z) when the reactor is at the steady state power at which the incore flux map was taken.
| |
| The expression for FQW(Z) is:
| |
| FQW(Z) = FQC(Z) W(Z) where W(Z) is a cycle dependent function that accounts for power distribution transients encountered during normal operation. W(Z) is included in the COLR. The FQC(Z) is calculated at equilibrium conditions.
| |
| The FQ(Z) limits define limiting values for core power peaking that precludes peak cladding temperatures above 2200°F during either a large or small break LOCA.
| |
| This LCO requires operation within the bounds assumed in the safety analyses. Calculations are performed in the core design process to confirm that the core can be controlled in such a manner during operation that it can stay within the LOCA FQ(Z) limits. If FQC(Z) cannot be maintained within the LCO limits, reduction of the core power is required.
| |
| Violating the LCO limits for FQ(Z) produces unacceptable consequences if a design basis event occurs while FQ(Z) is outside its specified limits.
| |
| APPLICABILITY The FQ(Z) limits must be maintained in MODE 1 to prevent core power distributions from exceeding the limits assumed in the safety analyses.
| |
| Applicability in other MODES is not required because there is either insufficient stored energy in the fuel or insufficient energy being transferred to the reactor coolant to require a limit on the distribution of core power.
| |
| ACTIONS A.1 Reducing THERMAL POWER by 1% RTP for each 1% by which FQC(Z) exceeds its limit, maintains an acceptable absolute power density. The Cook Nuclear Plant Unit 2 B 3.2.1-3 Revision No. 0
| |
| | |
| FQ(Z)
| |
| B 3.2.1 BASES ACTIONS (continued)
| |
| Completion Time of 15 minutes provides an acceptable time to reduce power in an orderly manner and without allowing the plant to remain in an unacceptable condition for an extended period of time.
| |
| A.2 A reduction of the Power Range Neutron Flux - High trip setpoints by 1% for each 1% by which FQC(Z) exceeds its limit, is a conservative action for protection against the consequences of severe transients with unanalyzed power distributions. The Completion Time of 72 hours is sufficient considering the small likelihood of a severe transient in this time period and the preceding prompt reduction in THERMAL POWER in accordance with Required Action A.1.
| |
| A.3 Reduction in the Overpower T trip setpoints (value of K4) by 1% for each 1% by which FQC(Z) exceeds its limit, is a conservative action for protection against the consequences of severe transients with unanalyzed power distributions. The Completion Time of 72 hours is sufficient considering the small likelihood of a severe transient in this time period, and the preceding prompt reduction in THERMAL POWER in accordance with Required Action A.1.
| |
| A.4 Verification that FQC(Z) has been restored to within its limit, by performing SR 3.2.1.1 and SR 3.2.1.2 prior to increasing THERMAL POWER above the limit imposed by Required Action A.1, ensures that core conditions during operation at higher power levels and future operation are consistent with safety analyses assumptions.
| |
| Condition A is modified by a Note that requires Required Action A.4 to be performed whenever the Condition is entered. This ensures that SR 3.2.1.1 and SR 3.2.1.2 will be performed prior to increasing THERMAL POWER above the limit of Required Action A.1, even when Condition A is exited prior to performing Required Action A.4.
| |
| Performance of SR 3.2.1.1 and SR 3.2.1.2 are necessary to assure FQ(Z) is properly evaluated prior to increasing THERMAL POWER.
| |
| B.1 If it is found that the maximum calculated value of FQ(Z) that can occur during normal maneuvers, FQW(Z), exceeds its specified limit, there exists Cook Nuclear Plant Unit 2 B 3.2.1-4 Revision No. 0
| |
| | |
| FQ(Z)
| |
| B 3.2.1 BASES ACTIONS (continued) a potential for FQC(Z) to become excessively high if a normal operational transient occurs. Reducing the THERMAL POWER by 1% RTP for each 1% by which FQW(Z) exceeds its limit within the allowed Completion Time of 4 hours, maintains an acceptable absolute power density such that even if a transient occurred, core peaking factors are not exceeded.
| |
| B.2 A reduction of the Power Range Neutron Flux - High trip setpoints by 1% for each 1% by which FQW(Z) exceeds its limit, is a conservative action for protection against the consequences of severe transients with unanalyzed power distributions. The Completion Time of 72 hours is sufficient considering the small likelihood of a severe transient in this time period and the preceding prompt reduction in THERMAL POWER in accordance with Required Action B.1.
| |
| B.3 Reduction in the Overpower T trip setpoints value of K4 by 1% for each 1% by which FQW(Z) exceeds its limit, is a conservative action for protection against the consequences of severe transients with unanalyzed power distributions. The Completion Time of 72 hours is sufficient considering the small likelihood of a severe transient in this time period, and the preceding prompt reduction in THERMAL POWER in accordance with Required Action B.1.
| |
| B.4 Verification that FQW(Z) has been restored to within its limit, by performing SR 3.2.1.1 and SR 3.2.1.2 prior to increasing THERMAL POWER above the limit imposed by Required Action B.1 ensures that core conditions during operation at higher power levels and future operation are consistent with safety analyses assumptions.
| |
| Condition B is modified by a Note that requires Required Action B.4 to be performed whenever the Condition is entered. This ensures that SR 3.2.1.1 and SR 3.2.1.2 will be performed prior to increasing THERMAL POWER above the limit of Required Action B.1, even when Condition A is exited prior to performing Required Action B.4.
| |
| Performance of SR 3.2.1.1 and SR 3.2.1.2 are necessary to assure FQ(Z) is properly evaluated prior to increasing THERMAL POWER.
| |
| Cook Nuclear Plant Unit 2 B 3.2.1-5 Revision No. 0
| |
| | |
| FQ(Z)
| |
| B 3.2.1 BASES ACTIONS (continued)
| |
| C.1 If any Required Action and associated Completion Time is not met, the unit must be placed in a MODE or condition in which the LCO requirements are not applicable. This is done by placing the unit in at least MODE 2 within 6 hours.
| |
| This allowed Completion Time is reasonable based on operating experience regarding the amount of time it takes to reach MODE 2 from full power operation in an orderly manner and without challenging unit systems.
| |
| SURVEILLANCE SR 3.2.1.1 REQUIREMENTS Verification that FQC(Z) is within its specified limits involves increasing FQM(Z) to allow for manufacturing tolerance and measurement uncertainties in order to obtain FQC(Z). FQC(Z) is then compared to its specified limits.
| |
| If THERMAL POWER has been increased by 10% RTP since the last determination of FQC(Z), another evaluation of this factor is required 24 hours after achieving equilibrium conditions at this higher power level (to ensure that FQC(Z) values are being reduced sufficiently with power increase to stay within the LCO limits). The Frequency condition is not intended to require verification of these parameters after every 10% increase in power level above the last verification. It only requires verification after a power level is achieved for extended operation that is 10% higher than that power at which FQ(Z) was last measured.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.2.1.1 is modified by a Note, which applies during power escalation after a refueling. The Note states that the Surveillance is not required to be performed until 24 hours after equilibrium conditions at a power level for extended operation are achieved. This Note allows the unit to startup from a refueling outage and reach the power level for extended operation (normally 100% RTP) prior to requiring performance of the SR. Within 24 hours after equilibrium conditions are reached at the power level for extended operation, the SR must be performed.
| |
| Cook Nuclear Plant Unit 2 B 3.2.1-6 Revision No. 60
| |
| | |
| FQ(Z)
| |
| B 3.2.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.2.1.2 The nuclear design process includes calculations performed to determine that the core can be operated within the FQ(Z) limits. Because flux maps are taken in steady state conditions, the variations in power distribution resulting from normal operational maneuvers are not present in the flux map data. These variations are, however, conservatively calculated by considering a wide range of unit maneuvers in normal operation. The maximum peaking factor increase over steady state values, calculated as a function of core elevation, Z, is called W(Z). Multiplying the measured total peaking factor, FQC(Z), by W(Z) gives the maximum FQ(Z) calculated to occur in normal operation, FQW(Z).
| |
| The W(Z) data is provided in the COLR for discrete core elevations. Flux map data are typically taken for 30 to 75 core elevations. FQW(Z) evaluations are not applicable for the following axial core regions, measured in percent of core height:
| |
| : a. Lower core region, from 0% to no more than 10% inclusive; and
| |
| : b. Upper core region, from no less than 90% to 100% inclusive.
| |
| The lower and upper axial core regions are excluded from the evaluation because of the low probability that these regions would be more limiting in the safety analyses and because of the difficulty of making a precise measurement in these regions. The regions excluded from the surveillance are identified in the W(Z) table in the COLR.
| |
| This Surveillance has been modified by a Note (Note 2) that may require that more frequent Surveillances be performed. An evaluation of the expression below is required to account for any increase to F QW(Z) that may occur and cause the FQ(Z) limit to be exceeded before the next required FQC(Z) evaluation.
| |
| If measurements indicate that the maximum over Z (FQC(Z)/K(Z)) has increased since its previous evaluation or that the maximum over Z (FQC(Z)*W(Z)/K(Z)) has increased since its previous evaluation or is expected to increase prior to its next evaluation, then it is required to increase FQW(Z) by the greater of 1.02 or an appropriate factor specified in the COLR (Ref. 5) and reverify that FQW(Z) is within its limit; or SR 3.2.1.2 must be repeated once per 7 EFPD until either FQW(Z), increased by the above factor, is within its limit or two successive flux maps indicate that neither the maximum over Z (FQC(Z)/K(Z)) nor the maximum over Z (FQC(Z)*W(Z)/K(Z)) has increased. These requirements prevent FQ(Z) from exceeding its limit without detection.
| |
| Cook Nuclear Plant Unit 2 B 3.2.1-7 Revision No. 74
| |
| | |
| FQ(Z)
| |
| B 3.2.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| FQ(Z) is verified at power levels 10% RTP above the THERMAL POWER of its last verification, 24 hours after achieving equilibrium conditions to ensure that FQ(Z) is within its limit at higher power levels.
| |
| The Frequency condition is not intended to require verification of these parameters after every 10% increase in power level above the last verification. It only requires verification after a power level is achieved for extended operation that is 10% higher than that power at which FQ(Z) was last measured.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.2.1.2 is modified by Note 1, which applies during power escalation after a refueling. The Note states that the Surveillance is not required to be performed until 24 hours after equilibrium conditions at a power level for extended operation are achieved. This Note allows the unit to startup from a refueling outage and reach the power level for extended operation (normally 100% RTP) prior to requiring performance of the SR. Within 24 hours after equilibrium conditions are reached at the power level for extended operation, the SR must be performed.
| |
| REFERENCES 1. 10 CFR 50.46.
| |
| : 2. UFSAR, Section 14.2.6.1.2.
| |
| : 3. UFSAR, Section 1.4.5.
| |
| : 4. WCAP-7308-L-P-A, "Evaluation of Nuclear Hot Channel Factor Uncertainties," June 1988.
| |
| : 5. WCAP-10216-P-A, Rev. 1A, "Relaxation of Constant Axial Offset Control (and) FQ Surveillance Technical Specification,"
| |
| February 1994.
| |
| Cook Nuclear Plant Unit 2 B 3.2.1-8 Revision No. 74
| |
| | |
| FNH B 3.2.2 B 3.2 POWER DISTRIBUTION LIMITS B 3.2.2 Nuclear Enthalpy Rise Hot Channel Factor (FNH)
| |
| BASES BACKGROUND The purpose of this LCO is to establish limits on the power density at any point in the core so that the fuel design criteria are not exceeded and the accident analysis assumptions remain valid. The design limits on local (pellet) and integrated fuel rod peak power density are expressed in terms of hot channel factors. Control of the core power distribution with respect to these factors ensures that local conditions in the fuel rods and coolant channels do not challenge core integrity at any location during either normal operation or a postulated accident analyzed in the safety analyses.
| |
| FNH is defined as the ratio of the integral of the linear power along the fuel rod with the highest integrated power to the average integrated fuel rod power. Therefore, FNH is a measure of the maximum total power produced in a fuel rod.
| |
| FNH is sensitive to fuel loading patterns, bank insertion, and fuel burnup.
| |
| FNH typically increases with control bank insertion and typically decreases with fuel burnup.
| |
| FNH is not directly measurable but is inferred from a power distribution map obtained with the movable incore detector system. Specifically, the results of the three dimensional power distribution map are analyzed by a computer to determine FNH. This factor is calculated at least every 31 EFPD. However, during power operation, the global power distribution is monitored by LCO 3.2.3, "AXIAL FLUX DIFFERENCE (AFD)," and LCO 3.2.4, "QUADRANT POWER TILT RATIO (QPTR)," which address directly and continuously measured process variables.
| |
| The COLR provides peaking factor limits that ensure that the design basis value of the departure from nucleate boiling (DNB) is met for normal operation, operational transients, and any transient condition arising from events of moderate frequency. The DNB design basis precludes DNB and is met by limiting the minimum local DNB heat flux ratio to a value greater than the design limits. All DNB limited transient events are assumed to begin with an FNH value that satisfies the LCO requirements.
| |
| Operation outside the LCO limits may produce unacceptable consequences if a DNB limiting event occurs. The DNB design basis ensures that there is no overheating of the fuel that results in possible cladding perforation with the release of fission products to the reactor coolant.
| |
| Cook Nuclear Plant Unit 2 B 3.2.2-1 Revision No. 0
| |
| | |
| FNH B 3.2.2 BASES APPLICABLE Limits on FNH preclude core power distributions that exceed the following SAFETY fuel design limits:
| |
| ANALYSES
| |
| : a. There must be at least 95% probability at the 95% confidence level (the 95/95 DNB criterion) that the hottest fuel rod in the core does not experience a DNB condition;
| |
| : b. During a large break loss of coolant accident (LOCA), peak cladding temperature (PCT) must not exceed 2200°F;
| |
| : c. During an ejected rod accident, the average fuel pellet enthalpy at hot spot is below 200 cal/gm for irradiated and unirradiated fuel (Ref. 1);
| |
| : d. One of the reactivity control systems provided shall be capable of making the core subcritical under any anticipated operating condition (including anticipated operational transients) sufficiently fast enough to prevent exceeding acceptable fuel damage limits. SDM should assure subcriticality with the most restrictive rod cluster control assembly fully withdrawn (Ref. 2).
| |
| For transients that may be DNB limited, the Reactor Coolant System flow and FNH are the core parameters of most importance. The limits on FNH ensure that the DNB design basis is met for normal operation, operational transients, and any transients arising from events of moderate frequency.
| |
| The DNB design basis is met by limiting the minimum DNBR to a value that provides a high degree of assurance that the hottest fuel rod in the core does not experience a DNB.
| |
| The allowable FNH limit increases with decreasing power level. This functionality in FNH is included in the analyses that provide the Reactor Core Safety Limits (SLs) of SL 2.1.1. Therefore, any DNB events in which the calculation of the core limits is modeled implicitly use this variable value of FNH in the analyses. Likewise, all transients that may be DNB limited are assumed to begin with an initial FNH as a function of power level defined by the COLR limit equation.
| |
| The LOCA safety analysis indirectly models FNH as an input parameter.
| |
| The Nuclear Heat Flux Hot Channel Factor (FQ(Z)) and the axial peaking factors are inserted directly into the LOCA safety analyses that verify the acceptability of the resulting peak cladding temperature (Ref. 3).
| |
| The fuel is protected in part by Technical Specifications, which ensure that the initial conditions assumed in the safety and accident analyses remain valid. The following LCOs ensure this: LCO 3.2.3, "AXIAL FLUX DIFFERENCE (AFD)," LCO 3.2.4, "QUADRANT POWER TILT RATIO (QPTR)," LCO 3.1.6, "Control Bank Insertion Limits," LCO 3.2.2, "Nuclear Cook Nuclear Plant Unit 2 B 3.2.2-2 Revision No. 0
| |
| | |
| FNH B 3.2.2 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| Enthalpy Rise Hot Channel Factor (FNH)," and LCO 3.2.1, "Heat Flux Hot Channel Factor (FQ(Z))."
| |
| FNH and FQ(Z) are measured periodically using the movable incore detector system. Measurements are generally taken with the core at, or near, steady state conditions. Core monitoring and control under transient conditions (Condition 1 events) are accomplished by operating the core within the limits of the LCOs on AFD, QPTR, and Bank Insertion Limits.
| |
| FNH satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO FNH shall be maintained within the limits of the relationship provided in the COLR.
| |
| The FNH limit identifies the coolant flow channel with the maximum enthalpy rise. This channel has the least heat removal capability and thus the highest probability for a DNB.
| |
| The limiting value of FNH, described by the equation contained in the COLR, is the design radial peaking factor used in the unit safety analyses.
| |
| A power multiplication factor in this equation includes an additional margin for higher radial peaking from reduced thermal feedback and greater control rod insertion at low power levels.
| |
| APPLICABILITY The FNH limits must be maintained in MODE 1 to preclude core power distributions from exceeding the fuel design limits for DNBR and PCT.
| |
| Applicability in other modes is not required because there is either insufficient stored energy in the fuel or insufficient energy being transferred to the coolant to require a limit on the distribution of core power. Specifically, the design bases events that are sensitive to FNH in other modes (MODES 2 through 5) have significant margin to DNB, and therefore, there is no need to restrict FNH in these modes.
| |
| ACTIONS A.1 and A.2 Condition A is modified by a Note that requires that Required Actions A.2 and A.4 must be completed whenever Condition A is entered. Thus, even if FNH is restored to within limits, Required Action A.2 nevertheless requires another measurement and calculation of FNH within 24 hours in accordance with SR 3.2.2.1.
| |
| Cook Nuclear Plant Unit 2 B 3.2.2-3 Revision No. 0
| |
| | |
| FNH B 3.2.2 BASES ACTIONS (continued)
| |
| However, if power is reduced below 50% RTP, Required Action A.4 requires that another determination of FNH must be done prior to exceeding 50% RTP, prior to exceeding 75% RTP, and within 24 hours after reaching or exceeding 95% RTP. In addition, Required Action A.2 is performed if power ascension is delayed past 24 hours.
| |
| If the value of FNH is not restored to within its specified limit either by adjusting a misaligned rod or by reducing THERMAL POWER, the alternative option is to reduce THERMAL POWER to < 50% RTP in accordance with Required Action A.1. Reducing RTP to < 50% RTP increases the DNB margin and does not likely cause the DNBR limit to be violated in steady state operation. The allowed Completion Time of 4 hours for Required Action A.1 provides an acceptable time to reach the required power level from full power operation without allowing the unit to remain in an unacceptable condition for an extended period of time.
| |
| Once the power level has been reduced to < 50% RTP per Required Action A.1, an incore flux map (SR 3.2.2.1) must be obtained and the measured value of FNH verified not to exceed the allowed limit at the lower power level. The unit is provided 20 additional hours to perform this task over and above the 4 hours allowed by Required Action A.1. The Completion Time of 24 hours is acceptable because of the increase in the DNB margin, which is obtained at lower power levels, and the low probability of having a DNB limiting event within this 24 hour period.
| |
| Additionally, operating experience has indicated that this Completion Time is sufficient to obtain the incore flux map, perform the required calculations, and evaluate FNH.
| |
| A.3 If FNH continues to be not within limits, the Power Range Neutron Flux - High trip setpoints must be reduced to 55% RTP per Required Action A.3. The reduction in trip setpoints ensures that continuing operation remains at an acceptable low power level with adequate DNBR margin.
| |
| The allowed Completion Time of 72 hours to reset the trip setpoints per Required Action A.3 recognizes that, once power is reduced, the safety analysis assumptions are satisfied and there is no urgent need to reduce the trip setpoints. This is a sensitive operation that may inadvertently trip the Reactor Trip System.
| |
| Cook Nuclear Plant Unit 2 B 3.2.2-4 Revision No. 0
| |
| | |
| FNH B 3.2.2 BASES ACTIONS (continued)
| |
| A.4 Verification that FNH is within its specified limits after an out of limit occurrence ensures that the cause that led to the FNH exceeding its limit is corrected, and that subsequent operation proceeds within the LCO limit. This Action demonstrates that the FNH limit is within the LCO limits prior to exceeding 50% RTP, again prior to exceeding 75% RTP, and within 24 hours after THERMAL POWER is 95% RTP.
| |
| This Required Action is modified by a Note that states that THERMAL POWER does not have to be reduced prior to performing this Action.
| |
| B.1 When any Required Action and associated Completion Time is not met, the unit must be placed in a MODE in which the LCO requirements are not applicable. This is done by placing the unit in at least MODE 2 within 6 hours. The allowed Completion Time of 6 hours is reasonable, based on operating experience regarding the time required to reach MODE 2 from full power conditions in an orderly manner and without challenging unit systems.
| |
| SURVEILLANCE SR 3.2.2.1 REQUIREMENTS The value of FNH is determined by using the movable incore detector system to obtain a flux distribution map. A data reduction computer program then calculates the maximum value of FNH from the measured flux distributions. The measured value of FNH must be multiplied by 1.04 to account for measurement uncertainty before making comparisons to the FNH limit.
| |
| After each refueling, FNH must be determined in MODE 1 prior to exceeding 75% RTP. This requirement ensures that FNH limits are met at the beginning of each fuel cycle.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 14.2.6.1.2.
| |
| : 2. UFSAR, Section 1.4.5.
| |
| : 3. 10 CFR 50.46.
| |
| Cook Nuclear Plant Unit 2 B 3.2.2-5 Revision No. 60
| |
| | |
| AFD B 3.2.3 B 3.2 POWER DISTRIBUTION LIMITS B 3.2.3 AXIAL FLUX DIFFERENCE (AFD)
| |
| BASES BACKGROUND The purpose of this LCO is to establish limits on the values of the AFD in order to limit the axial power distribution skewing to either the top or bottom of the core. By limiting the amount of power distribution skewing, core peaking factors are consistent with the assumptions used in the safety analyses. Limiting power distribution skewing over time also minimizes the xenon distribution skewing, which is a significant factor in axial power distribution control.
| |
| The operating scheme used to control the axial power distribution, Constant Axial Offset Control (CAOC), involves maintaining the AFD within a tolerance band around a burnup dependent target, known as the target flux difference, to minimize the variation of the axial peaking factor and axial xenon distribution during unit maneuvers.
| |
| The target flux difference is determined at equilibrium xenon conditions.
| |
| The control banks must be positioned within the core in accordance with their insertion limits and Control Bank D should be inserted near its normal position (i.e., 210 steps withdrawn) for steady state operation at high power levels. The power level should be as near RTP as practical.
| |
| The value of the target flux difference obtained under these conditions divided by the Fraction of RTP is the target flux difference at RTP for the associated core burnup conditions. Target flux differences for other THERMAL POWER levels are obtained by multiplying the RTP value by the appropriate fractional THERMAL POWER level.
| |
| The AFD is monitored on an automatic basis using the plant process computer that has an AFD monitor alarm. The computer determines the 1 minute average of each of the OPERABLE excore detector outputs and provides an alarm message immediately if the AFDs for two or more OPERABLE excore channels are outside the target band and the THERMAL POWER is greater than or equal to the upper limit specified in the COLR (normally 90% RTP). During operation at THERMAL POWER levels less than the upper limit specified in the COLR but 50% RTP, and at THERMAL POWER levels < 50% RTP but > 15% RTP, the computer sends an alarm message when the cumulative penalty deviation time is
| |
| > 1 hour (clock time) and > 2 hours (clock time), respectively, in the previous 24 hours.
| |
| Periodic updating of the target flux difference value is necessary to follow the change of the flux difference at steady state conditions with burnup.
| |
| The Nuclear Enthalpy Rise Hot Channel Factor (FNH) and QPTR LCOs limit the radial component of the peaking factors.
| |
| Cook Nuclear Plant Unit 2 B 3.2.3-1 Revision No. 1
| |
| | |
| AFD B 3.2.3 BASES APPLICABLE The AFD is a measure of axial power distribution skewing to the top or SAFETY bottom half of the core. The AFD is sensitive to many core related ANALYSES parameters such as control bank positions, core power level, axial burnup, axial xenon distribution and, to a lesser extent, reactor coolant temperature and boron concentrations. The allowed range of the AFD is used in the nuclear design process to confirm that operation within these limits produces core peaking factors and axial power distributions that meet safety analysis requirements.
| |
| The CAOC methodology (Ref. 1) entails:
| |
| : a. Establishing an envelope of allowed power shapes and power densities;
| |
| : b. Devising an operating strategy for the cycle that maximizes unit flexibility (maneuvering) and minimizes axial power shape changes;
| |
| : c. Demonstrating that this strategy does not result in core conditions that violate the envelope of permissible core power characteristics; and
| |
| : d. Demonstrating that this power distribution control scheme can be effectively supervised with excore detectors.
| |
| The limits on the AFD ensure that the Heat Flux Hot Channel Factor (FQ(Z)) is not exceeded during either normal operation or in the event of xenon redistribution following power changes. The limits on the AFD also limit the range of power distributions that are assumed as initial conditions in analyzing Condition 2, 3, and 4 events. This ensures that fuel cladding integrity is maintained for these postulated accidents. The most important Condition 4 event is the loss of coolant accident. The most significant Condition 3 event is the loss of flow accident. The most significant Condition 2 events are uncontrolled rod withdrawal and boration or dilution accidents. Condition 2 accidents, assumed to begin from within the AFD limits, are used to confirm the adequacy of Overpower T and Overtemperature T trip setpoints.
| |
| The AFD satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The shape of the power profile in the axial (i.e., the vertical) direction is largely under the control of the operator, through either the manual operation of the control banks, or automatic motion of control banks responding to temperature deviations resulting from either manual operation of the Chemical and Volume Control System to change boron concentration, or from power level changes.
| |
| Cook Nuclear Plant Unit 2 B 3.2.3-2 Revision No. 0
| |
| | |
| AFD B 3.2.3 BASES LCO (continued)
| |
| Signals are available to the operator from the Nuclear Instrumentation System (NIS) excore neutron detectors (Ref. 2). Separate signals are taken from the top and bottom detectors. The AFD is defined as the difference in normalized flux signals between the top and bottom excore detector in each detector well. For convenience, this flux difference is converted to provide flux difference units expressed as a percentage and labeled as % flux or %I.
| |
| The required target band varies with axial burnup distribution, which in turn varies with the core average accumulated burnup. The target band defined in the COLR may provide one target band for the entire cycle or more than one band, each to be followed for a specific range of cycle burnup. With THERMAL POWER greater than or equal to the upper limit specified in the COLR (normally 90% RTP), the AFD must be kept within the target band. With the AFD outside the target band with THERMAL POWER greater than or equal to the upper limit specified in the COLR, the assumptions of the accident analyses may be violated.
| |
| The frequency of monitoring the AFD by the plant computer is once per minute providing an essentially continuous accumulation of penalty deviation time that allows the operator to accurately assess the status of the penalty deviation time.
| |
| Violating the LCO on the AFD could produce unacceptable consequences if a Condition 2, 3, or 4 event occurs while the AFD is outside its limits.
| |
| The LCO is modified by four Notes. Note 1 states the conditions necessary for declaring the AFD outside of the target band. Notes 2 and 3 describe how the cumulative penalty deviation time is calculated. It is intended that the unit is operated with the AFD within the target band about the target flux difference. However, during rapid THERMAL POWER reductions, control bank motion may cause the AFD to deviate outside of the target band at reduced THERMAL POWER levels. This deviation does not affect the xenon distribution sufficiently to change the envelope of peaking factors that may be reached on a subsequent return to RTP with the AFD within the target band, provided the time duration of the deviation is limited. Accordingly, while THERMAL POWER is 50% RTP and less than the upper limit specified in the COLR (i.e., Part b of this LCO), a 1 hour cumulative penalty deviation time limit, cumulative during the preceding 24 hours, is allowed during which the unit may be operated outside of the target band but within the acceptable operation limits provided in the COLR (Note 2). This penalty time is accumulated at the rate of 1 minute for each 1 minute of operating time within the power range of Part b of this LCO (i.e., THERMAL POWER 50% RTP). The cumulative penalty time is the sum of penalty times from Parts b and c of this LCO.
| |
| Cook Nuclear Plant Unit 2 B 3.2.3-3 Revision No. 0
| |
| | |
| AFD B 3.2.3 BASES LCO (continued)
| |
| For THERMAL POWER levels > 15% RTP and < 50% RTP (i.e., Part c of this LCO), deviations of the AFD outside of the target band are less significant. Note 3 allows the accumulation of 1/2 minute penalty deviation time per 1 minute of actual time outside the target band and reflects this reduced significance. With THERMAL POWER < 15% RTP, AFD is not a significant parameter in the assumptions used in the safety analysis and, therefore, requires no limits. Because the xenon distribution produced at THERMAL POWER levels less than RTP does affect the power distribution as power is increased, unanalyzed xenon and power distribution is prevented by limiting the accumulated penalty deviation time.
| |
| For Surveillance of the power range channels performed according to SR 3.3.1.7, Note 4 allows deviation outside the target band for 16 hours and no penalty deviation time accumulated. Some deviation in the AFD may be required for doing the NIS calibration with the incore detector system.
| |
| APPLICABILITY AFD requirements are applicable in MODE 1 above 15% RTP. Above 50% RTP, the combination of THERMAL POWER and core peaking factors are the core parameters of primary importance in safety analyses (Ref. 1).
| |
| Between 15% RTP and the upper limit specified in the COLR, this LCO is applicable to ensure that the distributions of xenon are consistent with safety analysis assumptions.
| |
| At or below 15% RTP and for lower operating MODES, the stored energy in the fuel and the energy being transferred to the reactor coolant are low.
| |
| The value of the AFD in these conditions does not affect the consequences of the design basis events.
| |
| Low signal levels in the excore channels may preclude obtaining valid AFD signals below 15% RTP.
| |
| ACTIONS A.1 With the AFD outside the target band and THERMAL POWER greater than or equal to the upper limit specified in the COLR, the assumptions used in the accident analyses may be violated with respect to the maximum heat generation. Therefore, a Completion Time of 15 minutes is allowed to restore the AFD to within the target band because xenon distributions change little in this relatively short time.
| |
| Cook Nuclear Plant Unit 2 B 3.2.3-4 Revision No. 0
| |
| | |
| AFD B 3.2.3 BASES ACTIONS (continued)
| |
| B.1 If the AFD cannot be restored within the target band, then reducing THERMAL POWER to less than the upper limit specified in the COLR places the core in a condition that has been analyzed and found to be acceptable, provided that the AFD is within the acceptable operation limits provided in the COLR.
| |
| The allowed Completion Time of 15 minutes provides an acceptable time to reduce power to less than the upper limit specified in the COLR without allowing the plant to remain in an unanalyzed condition for an extended period of time.
| |
| C.1 With THERMAL POWER less than the upper limit specified in the COLR but 50% RTP, operation with the AFD outside the target band is allowed for up to 1 hour if the AFD is within the acceptable operation limits provided in the COLR. With the AFD within these limits, the resulting axial power distribution is acceptable as an initial condition for accident analyses assuming the then existing xenon distributions. The 1 hour cumulative penalty deviation time restricts the extent of xenon redistribution. Without this limitation, unanalyzed xenon axial distributions may result from a different pattern of xenon buildup and decay. The reduction to a power level < 50% RTP puts the reactor at a THERMAL POWER level at which the AFD is not a significant accident analysis parameter.
| |
| If the indicated AFD is outside the target band and outside the acceptable operation limits provided in the COLR, the peaking factors assumed in accident analysis may be exceeded with the existing xenon condition.
| |
| (Any AFD within the target band is acceptable regardless of its relationship to the acceptable operation limits.) The Completion Time of 30 minutes allows for a prompt, yet orderly, reduction in power.
| |
| Condition C is modified by a Note that requires that Required Action C.1 must be completed whenever this Condition is entered.
| |
| Cook Nuclear Plant Unit 2 B 3.2.3-5 Revision No. 0
| |
| | |
| AFD B 3.2.3 BASES SURVEILLANCE SR 3.2.3.1 REQUIREMENTS This Surveillance verifies that the AFD as indicated by the NIS excore channels is within the target band. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.2.3.2 The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.2.3.3 Measurement of the target flux difference is accomplished by taking a flux map when the core is at equilibrium xenon conditions, preferably at high power levels with the control banks nearly withdrawn. This flux map provides the equilibrium xenon axial power distribution from which the target value can be determined. The target flux difference varies slowly with core burnup.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| A Note modifies this SR to allow the predicted beginning of cycle AFD from the cycle nuclear design to be used to determine the initial target flux difference after each refueling.
| |
| REFERENCES 1. WCAP-8385 (Westinghouse proprietary) and WCAP-8403 (nonproprietary), "Power Distribution Control and Load Following Procedures," Westinghouse Electric Corporation, September 1974.
| |
| : 2. UFSAR, Section 7.4.
| |
| Cook Nuclear Plant Unit 2 B 3.2.3-6 Revision No. 60
| |
| | |
| QPTR B 3.2.4 B 3.2 POWER DISTRIBUTION LIMITS B 3.2.4 QUADRANT POWER TILT RATIO (QPTR)
| |
| BASES BACKGROUND The QPTR limit ensures that the gross radial power distribution remains consistent with the design values used in the safety analyses. Precise radial power distribution measurements are made during startup testing, after refueling, and periodically during power operation.
| |
| The power density at any point in the core must be limited so that the fuel design criteria are maintained. Together, LCO 3.2.3, "AXIAL FLUX DIFFERENCE (AFD)," LCO 3.2.4, and LCO 3.1.6, "Control Rod Insertion Limits," provide limits on process variables that characterize and control the three dimensional power distribution of the reactor core. Control of these variables ensures that the core operates within the fuel design criteria and that the power distribution remains within the bounds used in the safety analyses.
| |
| APPLICABLE This LCO precludes core power distributions that violate the following fuel SAFETY design criteria:
| |
| ANALYSES
| |
| : a. During a large break loss of coolant accident, the peak cladding temperature must not exceed 2200°F (Ref. 1);
| |
| : b. During a loss of forced reactor coolant flow accident, there must be at least 95% probability at the 95% confidence level (the 95/95 departure from nucleate boiling (DNB) criterion) that the hot fuel rod in the core does not experience a DNB condition;
| |
| : c. During an ejected rod accident, the average fuel pellet enthalpy at hot spot is below 200 cal/gm for irradiated and unirradiated fuel (Ref. 2); and
| |
| : d. One of the reactivity control systems provided shall be capable of making the core subcritical under any anticipated operating condition (including anticipated operational transients) sufficiently fast enough to prevent exceeding acceptable fuel damage limits. SDM should assure subcriticality with the most restrictive rod cluster control assembly fully withdrawn (Ref. 3).
| |
| The LCO limits on the AFD, the QPTR, the Heat Flux Hot Channel Factor (FQ(Z)), the Nuclear Enthalpy Rise Hot Channel Factor (FNH), and control bank insertion are established to preclude core power distributions that exceed the safety analyses limits.
| |
| Cook Nuclear Plant Unit 2 B 3.2.4-1 Revision No. 0
| |
| | |
| QPTR B 3.2.4 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| The QPTR limits ensure that FNH and FQ(Z) remain below their limiting values by preventing an undetected change in the gross radial power distribution.
| |
| The QPTR satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The QPTR limit of 1.02, at which corrective action is required, provides a margin of protection for both the DNB ratio and linear heat generation rate contributing to excessive power peaks resulting from X-Y plane power tilts. A limiting QPTR of 1.02 can be tolerated before the margin for uncertainty in FQ(Z) and FNH is possibly challenged.
| |
| APPLICABILITY The QPTR limit must be maintained in MODE 1 with THERMAL POWER
| |
| > 50% RTP to prevent core power distributions from exceeding the design limits.
| |
| Applicability in MODE 1 50% RTP and in other MODES is not required because there is either insufficient stored energy in the fuel or insufficient energy being transferred to the reactor coolant to require the implementation of a QPTR limit on the distribution of core power. The QPTR limit in these conditions is, therefore, not important. Note that the FNH and FQ(Z) LCOs still apply, but allow progressively higher peaking factors at 50% RTP or lower.
| |
| ACTIONS A.1 With the QPTR exceeding its limit, a power level reduction of 3% from RTP for each 1% by which the QPTR exceeds 1.00 is a conservative tradeoff of total core power with peak linear power. The Completion Time of 2 hours allows sufficient time to identify the cause and correct the tilt.
| |
| Note that the power reduction itself may cause a change in the tilted condition.
| |
| The maximum allowable power level initially determined by Required Action A.1 may be affected by subsequent determinations of QPTR.
| |
| Increases in QPTR would require power reduction within 2 hours of QPTR determination, if necessary to comply with the decreased maximum allowable power level and increasing power up to this revised limit.
| |
| A.2 After completion of Required Action A.1, the QPTR alarm may still be in its alarmed state. As such, any additional changes in the QPTR are detected by requiring a check of the QPTR once per 12 hours thereafter.
| |
| Cook Nuclear Plant Unit 2 B 3.2.4-2 Revision No. 0
| |
| | |
| QPTR B 3.2.4 BASES ACTIONS (continued)
| |
| A 12 hour Completion Time is sufficient because any additional change in QPTR would be relatively slow.
| |
| A.3 The peaking factors FQ(Z) and FNH are of primary importance in ensuring that the power distribution remains consistent with the initial conditions used in the safety analyses. Performing SRs on FNH and FQ(Z) within the Completion Time of 24 hours after achieving equilibrium conditions from a THERMAL POWER reduction per Required Action A.1 ensures that these primary indicators of power distribution are within their respective limits.
| |
| Equilibrium conditions are achieved when the core is sufficiently stable at intended operating conditions to support flux mapping. A Completion Time of 24 hours after achieving equilibrium conditions from a THERMAL POWER reduction per Required Action A.1 takes into consideration the rate at which peaking factors are likely to change, and the time required to stabilize the unit and perform a flux map. If these peaking factors are not within their limits, the Required Actions of applicable LCOs provide an appropriate response for the abnormal condition. If the QPTR remains above its specified limit, the peaking factor Surveillances are required each 7 days thereafter to evaluate FNH and FQ(Z) with changes in power distribution. Relatively small changes are expected due to either burnup and xenon redistribution or correction of the cause for exceeding the QPTR limit.
| |
| A.4 Although FNH and FQ(Z) are of primary importance as initial conditions in the safety analyses, other changes in the power distribution may occur as the QPTR limit is exceeded and may have an impact on the validity of the safety analysis. A change in the power distribution can affect such reactor parameters as bank worths and peaking factors for rod malfunction accidents. When the QPTR exceeds its limit, it does not necessarily mean a safety concern exists. It does mean that there is an indication of a change in the gross radial power distribution that requires an investigation and evaluation that is accomplished by examining the incore power distribution. Specifically, the core peaking factors and the quadrant tilt must be evaluated because they are the factors that best characterize the core power distribution. This re-evaluation is required to ensure that, before increasing THERMAL POWER to above the limit of Required Action A.1, the reactor core conditions are consistent with the assumptions in the safety analyses.
| |
| Cook Nuclear Plant Unit 2 B 3.2.4-3 Revision No. 0
| |
| | |
| QPTR B 3.2.4 BASES ACTIONS (continued)
| |
| A.5 If the QPTR is still exceeding the 1.02 limit but a re-evaluation of the safety analysis is completed and shows that safety requirements are met, the excore detectors can be normalized to restore QPTR to within limits.
| |
| Any normalization must be performed prior to increasing THERMAL POWER to above the limit of Required Action A.1. Normalization is accomplished in such a manner that the indicated QPTR following normalization is near 1.00. This is done to detect any subsequent significant changes in QPTR.
| |
| Required Action A.5 is modified by two Notes. Note 1 states that the QPTR cannot be restored to within limits via normalization of the excore detectors until after the re-evaluation of the safety analysis has determined that core conditions at RTP are within the safety analysis assumptions (i.e., Required Action A.4). Note 2 states that if Required Action A.5 is performed, then Required Action A.6 shall be performed.
| |
| Required Action A.5 normalizes the excore detectors to restore QPTR to within limits, which restores compliance with LCO 3.2.4. Thus, Note 2 prevents exiting the ACTIONS prior to completing flux mapping to verify peaking factors, per Required Action A.6. These Notes are intended to prevent any ambiguity about the required sequence of actions.
| |
| A.6 Once QPTR is restored to within limits via normalization of the excore detectors (i.e., Required Action A.5 is performed), it is acceptable to return to full power operation. However, as an added check that the core power distribution is consistent with the safety analysis assumptions, Required Action A.6 requires verification that FQ(Z) and FNH are within their specified limits by performing SR 3.2.1.1, SR 3.2.1.2, and SR 3.2.2.1 within 24 hours of achieving equilibrium conditions at RTP. As an added precaution, if the core power does not reach equilibrium conditions at RTP within 24 hours, but is increased slowly, then the peaking factor Surveillances must be performed within 48 hours after increasing THERMAL POWER above the limit of Required Action A.1. These Completion Times are intended to allow adequate time to increase THERMAL POWER to above the limit of Required Action A.1, while not permitting the core to remain with unconfirmed power distributions for extended periods of time.
| |
| Required Action A.6 is modified by a Note that states that the peaking factor Surveillances may only be done after the excore detectors have been normalized to restore QPTR to within limits (i.e., Required Cook Nuclear Plant Unit 2 B 3.2.4-4 Revision No. 0
| |
| | |
| QPTR B 3.2.4 BASES ACTIONS (continued)
| |
| Action A.5). The intent of this Note is to have the peaking factor Surveillances performed at operating power levels, which can only be accomplished after the excore detectors are normalized to restore QPTR to within limits and the core returned to power.
| |
| B.1 If any Required Action and associated Completion Time is not met, the unit must be brought to a MODE or other specified condition in which the requirements do not apply. To achieve this status, THERMAL POWER must be reduced to < 50% RTP within 4 hours. The allowed Completion Time of 4 hours is reasonable, based on operating experience regarding the amount of time required to reach the reduced power level without challenging unit systems.
| |
| SURVEILLANCE SR 3.2.4.1 REQUIREMENTS SR 3.2.4.1 is modified by two Notes. Note 1 allows QPTR to be calculated with three power range channels if THERMAL POWER is 75% RTP and the input from one Power Range Neutron Flux channel is inoperable. Note 2 allows performance of SR 3.2.4.2 in lieu of SR 3.2.4.1.
| |
| This Surveillance verifies that the QPTR, as indicated by the Nuclear Instrumentation System (NIS) excore channels, is within its limits. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| For those causes of QPT that occur quickly (e.g., a dropped rod), there typically are other indications of abnormality that prompt a verification of core power tilt.
| |
| SR 3.2.4.2 This Surveillance is modified by a Note, which states that it is not required until 12 hours after the input from one or more Power Range Neutron Flux channels are inoperable and the THERMAL POWER is > 75% RTP.
| |
| With an NIS power range channel inoperable, tilt monitoring for a portion of the reactor core becomes degraded. Large tilts are likely detected with the remaining channels, but the capability for detection of small power tilts in some quadrants is decreased. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Cook Nuclear Plant Unit 2 B 3.2.4-5 Revision No. 60
| |
| | |
| QPTR B 3.2.4 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| For purposes of monitoring the QPTR when one power range channel is inoperable, the moveable incore detectors are used to confirm that the normalized symmetric power distribution is consistent with the indicated QPTR and any previous data indicating a tilt. The incore detector monitoring is performed with a full incore flux map or two sets of four thimble locations with quarter core symmetry. The two sets of four symmetric thimbles is a set of eight unique detector locations. These locations are C-8, E-5, E-11, H-3, H-13, L-5, L-11, and N-8.
| |
| The symmetric thimble flux map can be used to generate symmetric thimble "tilt." This can be compared to a reference symmetric thimble tilt, from the most recent full core flux map, to generate an incore QPTR.
| |
| Therefore, incore monitoring of QPTR can be used to confirm that QPTR is within limits.
| |
| With one NIS channel inoperable, the indicated tilt may be changed from the value indicated with all four channels OPERABLE. To confirm that no change in tilt has actually occurred, which might cause the QPTR limit to be exceeded, the incore result may be compared against previous flux maps either using the symmetric thimbles as described above or a complete flux map. Nominally, quadrant tilt from the Surveillance should be within 2% of the tilt shown by the most recent flux map data.
| |
| REFERENCES 1. 10 CFR 50.46.
| |
| : 2. UFSAR, Section 14.2.6.1.2.
| |
| : 3. UFSAR, Section 1.4.5.
| |
| Cook Nuclear Plant Unit 2 B 3.2.4-6 Revision No. 0
| |
| | |
| RTS Instrumentation B 3.3.1 B 3.3 INSTRUMENTATION B 3.3.1 Reactor Trip System (RTS) Instrumentation BASES BACKGROUND The RTS initiates a unit shutdown, based on the values of selected unit parameters, to protect against violating the core fuel design limits and Reactor Coolant System (RCS) pressure boundary during anticipated operational transients and to assist the Engineered Safety Features (ESF) Systems in mitigating accidents.
| |
| The protection and monitoring systems have been designed to assure safe operation of the reactor. This is achieved by specifying limiting safety system settings (LSSS) in terms of parameters directly monitored by the RTS, as well as specifying LCOs on other reactor system parameters and equipment performance.
| |
| Technical Specifications are required by 10 CFR 50.36 to contain LSSS defined by the regulation as "...settings for automatic protective devices...so chosen that automatic protective action will correct the abnormal situation before a Safety Limit (SL) is exceeded." The Analytic Limit is the limit of the process variable at which a safety action is initiated, as established by the safety analysis, to ensure that a SL is not exceeded. Any automatic protection action that occurs on reaching the Analytic Limit therefore ensures that the SL is not exceeded. However, in practice, the actual settings for automatic protective devices must be chosen to be more conservative than the Analytic Limit to account for instrument loop uncertainties related to the setting at which the automatic protective action would actually occur.
| |
| The trip setpoint is a predetermined setting for a protective device chosen to ensure automatic actuation prior to the process variable reaching the Analytic Limit and thus ensuring that the SL would not be exceeded. As such, the trip setpoint accounts for uncertainties in setting the device (e.g., calibration), uncertainties in how the device might actually perform (e.g., repeatability), changes in the point of action of the device over time (e.g., drift during surveillance intervals), and any other factors which may influence its actual performance (e.g., harsh accident environments). In this manner, the trip setpoint plays an important role in ensuring that SLs are not exceeded. As such, the trip setpoint meets the definition of an LSSS (Ref. 1) and could be used to meet the requirement that they be contained in the Technical Specifications.
| |
| Technical Specifications contain values related to the OPERABILITY of equipment required for safe operation of the facility. OPERABLE is Cook Nuclear Plant Unit 2 B 3.3.1-1 Revision No. 0
| |
| | |
| RTS Instrumentation B 3.3.1 BASES BACKGROUND (continued) defined in Technical Specifications as "...being capable of performing its safety functions(s)." For automatic protective devices, the required safety function is to ensure that a SL is not exceeded and therefore the LSSS as defined by 10 CFR 50.36 is the same as the OPERABILITY limit for these devices. However, use of the trip setpoint to define OPERABILITY in Technical Specifications and its corresponding designation as the LSSS required by 10 CFR 50.36 would be an overly restrictive requirement if it were applied as an OPERABILITY limit for the "as found" value of a protective device setting during a surveillance. This would result in Technical Specification compliance problems, as well as reports and corrective actions required by the rule which are not necessary to ensure safety. For example, an automatic protective device with a setting that has been found to be different from the trip setpoint due to some drift of the setting may still be OPERABLE since drift is to be expected. This expected drift would have been specifically accounted for in the setpoint methodology for calculating the trip setpoint and thus the automatic protective action would still have ensured that the SL would not be exceeded with the "as found" setting of the protective device. Therefore, the device would still be OPERABLE since it would have performed its safety function and the only corrective action required would be to reset the device to the trip setpoint to account for further drift during the next surveillance interval.
| |
| Use of the trip setpoint to define "as found" OPERABILITY and its designation as the LSSS under the expected circumstances described above would result in actions required by both the rule and Technical Specifications that are clearly not warranted. However, there is also some point beyond which the device would have not been able to perform its function due, for example, to greater than expected drift. This value needs to be specified in the Technical Specifications in order to define OPERABILITY of the devices and is designated as the Allowable Value which, as stated above, is the same as the LSSS.
| |
| The Allowable Value specified in Table 3.3.1-1 serves as the LSSS such that a channel is OPERABLE if the trip setpoint is found not to exceed the Allowable Value during the CHANNEL OPERATIONAL TEST (COT). As such, the Allowable Value differs from the trip setpoint by an amount primarily equal to the expected instrument loop uncertainties, such as drift, during the surveillance interval. In this manner, the actual setting of the device will still meet the LSSS definition and ensure that a Safety Limit is not exceeded at any given point of time as long as the device has not drifted beyond that expected during the surveillance interval. Note that, although the channel is "OPERABLE" under these circumstances, Cook Nuclear Plant Unit 2 B 3.3.1-2 Revision No. 0
| |
| | |
| RTS Instrumentation B 3.3.1 BASES BACKGROUND (continued) the trip setpoint should be left adjusted to a value within the established trip setpoint calibration tolerance band, in accordance with uncertainty assumptions stated in the referenced setpoint methodology (as-left criteria), and confirmed to be operating within the statistical allowances of the uncertainty terms assigned. If the actual setting of the device is found to have exceeded the Allowable Value the device would be considered inoperable from a Technical Specification perspective. This requires corrective action including those actions required by 10 CFR 50.36 when automatic protective devices do not function as required.
| |
| During anticipated operational transients, which are those events expected to occur one or more times during the unit life, the acceptable limits are:
| |
| : 1. The Departure from Nucleate Boiling Ratio (DNBR) shall be maintained above the Safety Limit (SL) value to prevent departure from nucleate boiling (DNB);
| |
| : 2. Fuel centerline melt shall not occur; and
| |
| : 3. The RCS pressure SL of 2750 psia shall not be exceeded.
| |
| Operation within the SLs of Specification 2.0, "Safety Limits (SLs)," also maintains the above values and assures that offsite dose will be within the 10 CFR 50 criteria during anticipated operational transients.
| |
| Accidents are events that are analyzed even though they are not expected to occur during the unit life. The acceptable limit during accidents is that offsite dose shall be maintained within an acceptable fraction of 10 CFR 50.67 limits. Different accident categories are allowed a different fraction of these limits, based on probability of occurrence.
| |
| Meeting the acceptable dose limit for an accident category is considered having acceptable consequences for that event.
| |
| The RTS instrumentation is segmented into four distinct but interconnected modules as described in UFSAR, Chapter 7 (Ref. 2), and as identified below:
| |
| : 1. Field transmitters or process sensors: provide a measurable electronic signal based upon the physical characteristics of the parameter being measured; Cook Nuclear Plant Unit 2 B 3.3.1-3 Revision No. 59
| |
| | |
| RTS Instrumentation B 3.3.1 BASES BACKGROUND (continued)
| |
| : 2. Signal Process Control and Protection System, including Analog/Digital Protection System, Nuclear Instrumentation System (NIS), field contacts, and protection channel sets: provides signal conditioning, bistable setpoint comparison, process algorithm actuation, compatible electrical signal output to protection system devices, and control board/control room/miscellaneous indications;
| |
| : 3. Solid State Protection System (SSPS), including input, logic, and output bays: initiates proper unit shutdown and/or ESF actuation in accordance with the defined logic, which is based on the bistable outputs from the signal process control and protection system; and
| |
| : 4. Reactor trip switchgear, including reactor trip breakers (RTBs) and bypass breakers: provides the means to interrupt power to the control rod drive mechanisms (CRDMs) and allows the rod cluster control assemblies (RCCAs), or "rods," to fall into the core and shut down the reactor. The bypass breakers allow testing of the RTBs at power.
| |
| Field Transmitters or Sensors To meet the design demands for redundancy and reliability, more than one, and often as many as four, field transmitters or sensors are used to measure unit parameters. To account for the calibration tolerances and instrument drift, which are assumed to occur between calibrations, statistical allowances are provided in the trip setpoint and Allowable Values. The OPERABILITY of each transmitter or sensor is determined by either "as-found" calibration data evaluated during the CHANNEL CALIBRATION or by qualitative assessment of field transmitter or sensor as related to the channel behavior observed during performance of the CHANNEL CHECK.
| |
| Signal Process Control and Protection System Generally, three or four channels of process control equipment are used for the signal processing of unit parameters measured by the field instruments. The process control equipment provides signal conditioning, comparable output signals for instruments located on the main control board, and comparison of measured input signals with setpoints established by safety analyses. These setpoints are defined in the Technical Requirements Manual (Ref. 3). If the measured value of a unit parameter exceeds the predetermined setpoint, an output from a bistable is forwarded to the SSPS for decision evaluation. Channel separation is Cook Nuclear Plant Unit 2 B 3.3.1-4 Revision No. 0
| |
| | |
| RTS Instrumentation B 3.3.1 BASES BACKGROUND (continued) maintained up to and through the input bays. However, not all unit parameters require four channels of sensor measurement and signal processing. Some unit parameters provide input only to the SSPS, while others provide input to the SSPS, the main control board, the unit computer, and one or more control systems.
| |
| Generally, if a parameter is used only for input to the protection circuits, three channels with a two-out-of-three logic are sufficient to provide the required reliability and redundancy. If one channel fails in a direction that would not result in a partial Function trip, the Function is still OPERABLE with a two-out-of-two logic. If one channel fails, such that a partial Function trip occurs, a trip will not occur and the Function is still OPERABLE with a one-out-of-two logic.
| |
| Generally, if a parameter is used for input to the SSPS and a control function, four channels with a two-out-of-four logic are sufficient to provide the required reliability and redundancy. Where a unit condition that requires protective action can be brought on by a failure or malfunction of the control system, and the same failure or malfunction prevents proper action of a protection system channel or channels designed to protect against the resultant unsafe condition, the remaining portions of the protection system shall be independently capable of withstanding a single failure and automatically initiating appropriate protective action. This is described in Reference 4. The protection system is designed to be independent of the status of the control system. However, the control system does derive signals from the protection systems through isolation amplifiers, which are part of the protection system. The isolation amplifiers prevent perturbation of the protection signal (input) due to disturbances of the isolated signal (output) which could occur near any termination of the output wiring external to the protection and safeguards racks. As such, other acceptable logic designs (e.g., two-out-of-three logic) exist for parameters that are used as inputs to SSPS and a control function. The actual number of channels required for each unit parameter is specified in Reference 5.
| |
| Two logic channels are required to ensure no single random failure of a logic channel will disable the RTS. The logic channels are designed such that testing required while the reactor is at power may be accomplished without causing trip. Provisions to allow removing logic channels from service during maintenance are unnecessary because of the logic system's designed reliability.
| |
| Cook Nuclear Plant Unit 2 B 3.3.1-5 Revision No. 0
| |
| | |
| RTS Instrumentation B 3.3.1 BASES BACKGROUND (continued)
| |
| Allowable Values and RTS Setpoints The trip setpoints used in the bistables are based on the analytical limits stated in Reference 6 or design limits. The selection of these trip setpoints is such that adequate protection is provided when all sensor and processing time delays are taken into account. To allow for calibration tolerances, instrumentation uncertainties, instrument drift, and severe environment errors for those RTS channels that must function in harsh environments as defined by 10 CFR 50.49 (Ref. 7), the Allowable Values specified in Table 3.3.1-1 in the accompanying LCO are conservative with respect to the analytical limits or design limits. A detailed description of the methodology used to calculate the Allowable Values and trip setpoints, including their explicit uncertainties, is provided in the "RTS/ESFAS Setpoint Methodology Study" (Ref. 8) which incorporates all of the known uncertainties applicable to each channel.
| |
| The magnitudes of these uncertainties are factored into the determination of each trip setpoint and corresponding Allowable Value. The trip setpoint entered into the bistable is more conservative than that specified by the Allowable Value (LSSS) to account for measurement errors detectable by the COT. The Allowable Value serves as the Technical Specification OPERABILITY limit for the purpose of the COT. One example of such a change in measurement error is drift during the surveillance interval. If the measured setpoint does not exceed the Allowable Value, the bistable is considered OPERABLE.
| |
| The trip setpoint is the value at which the bistable is set and is the expected value to be achieved during calibration. The trip setpoint value ensures the LSSS and the safety analysis limits are met for surveillance interval selected when a channel is adjusted based on stated channel uncertainties. Any bistable is considered to be properly adjusted when the "as left" setpoint value is within the band for CHANNEL CALIBRATION uncertainty allowance (i.e., +/- rack calibration +
| |
| comparator setting uncertainties). The trip setpoint value is therefore considered a "nominal" value (i.e., expressed as a value without inequalities) for the purposes of COT and CHANNEL CALIBRATION.
| |
| Trip setpoints consistent with the requirements of the Allowable Value ensure that SLs are not violated during anticipated operational transients (and that the consequences of DBAs will be acceptable, providing the unit is operated from within the LCOs at the onset of the anticipated operational transient or DBA and the equipment functions as designed).
| |
| Cook Nuclear Plant Unit 2 B 3.3.1-6 Revision No. 0
| |
| | |
| RTS Instrumentation B 3.3.1 BASES BACKGROUND (continued)
| |
| Each channel of the process control equipment can be tested on line to verify that the signal or setpoint accuracy is within the specified allowance requirements of Reference 8. Once a designated channel is taken out of service for testing, a simulated signal is injected in place of the field instrument signal. The process equipment for the channel in test is then tested, verified, and calibrated. SRs for the channels are specified in the SRs section.
| |
| Solid State Protection System The SSPS equipment is used for the decision logic processing of outputs from the signal processing equipment bistables. To meet the redundancy requirements, two trains of SSPS, each performing the same functions, are provided. If one train is taken out of service for maintenance or test purposes, the second train will provide reactor trip and/or ESF actuation for the unit. If both trains are taken out of service or placed in test, a reactor trip will result. Each train is packaged in its own set of cabinets for physical and electrical separation to satisfy separation and independence requirements. The system has been designed to trip in the event of a loss of power, directing the unit to a safe shutdown condition.
| |
| The SSPS performs the decision logic for actuating a reactor trip or ESF actuation, generates the electrical output signal that will initiate the required trip or actuation, and provides the status, permissive, and annunciator output signals to the main control room of the unit.
| |
| The bistable outputs from the signal processing equipment are sensed by the SSPS equipment and combined into logic matrices that represent combinations indicative of various unit upset and accident transients. If a required logic matrix combination is completed, the system will initiate a reactor trip or send actuation signals via master and slave relays to those components whose aggregate Function best serves to alleviate the condition and restore the unit to a safe condition.
| |
| Reactor Trip Switchgear The RTBs are in the electrical power supply line from the control rod drive motor generator set power supply to the CRDMs. Opening of the RTBs interrupts power to the CRDMs, which allows the shutdown rods and control rods to fall into the core by gravity. Each RTB is equipped with a bypass breaker to allow testing of the RTB while the unit is at power.
| |
| Cook Nuclear Plant Unit 2 B 3.3.1-7 Revision No. 0
| |
| | |
| RTS Instrumentation B 3.3.1 BASES BACKGROUND (continued)
| |
| During normal operation the output from the SSPS is a voltage signal that energizes the undervoltage coils in the RTBs and bypass breakers, if in use. When the required logic matrix combination is completed, the SSPS output voltage signal is removed, the undervoltage coils are de-energized, the breaker trip lever is actuated by the de-energized undervoltage coil, and the RTBs and bypass breakers are tripped open.
| |
| This allows the shutdown rods and control rods to fall into the core. In addition to the de-energization of the undervoltage coils, each breaker is also equipped with a shunt trip device that is energized to trip the breaker open upon receipt of a reactor trip signal from the SSPS. Either the undervoltage coil or the shunt trip mechanism is sufficient by itself, thus providing a diverse trip mechanism.
| |
| The decision logic matrix Functions are described in Reference 2. In addition to the reactor trip or ESF, the various "permissive interlocks" that are associated with unit conditions are also described. Each train has a built in testing device that can automatically test the decision logic matrix Functions and the actuation devices while the unit is at power. When any one train is taken out of service for testing, the other train is capable of providing unit monitoring and protection until the testing has been completed. The testing device is semiautomatic to minimize testing time.
| |
| APPLICABLE The RTS functions to maintain the SLs during all anticipated operational SAFETY transients and mitigates the consequences of DBAs in all MODES in ANALYSES, LCO, which the Rod Control System is capable of rod withdrawal or one or and APPLICABILITY more rods are not fully inserted.
| |
| Each of the analyzed accidents and transients can be detected by one or more RTS Functions. The accident analysis described in Reference 9 takes credit for most RTS trip Functions. RTS trip Functions not specifically credited in the accident analysis are qualitatively credited in the safety analysis and the NRC staff approved licensing basis for the unit. These RTS trip Functions may provide protection for conditions that do not require dynamic transient analysis to demonstrate Function performance. They may also serve as backups to RTS trip Functions that were credited in the accident analysis.
| |
| The LCO requires all instrumentation performing an RTS Function, listed in Table 3.3.1-1 in the accompanying LCO, to be OPERABLE. A channel is OPERABLE with a trip setpoint value outside its calibration tolerance band provided the trip setpoint "as-found" value does not exceed its associated Allowable Value and provided the trip setpoint "as-left" value is adjusted to a value within the "as-left" calibration tolerance band of the Cook Nuclear Plant Unit 2 B 3.3.1-8 Revision No. 0
| |
| | |
| RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| Nominal Trip Setpoint. A trip setpoint may be set more conservative than the Nominal Trip Setpoint as necessary in response to unit conditions.
| |
| Failure of any instrument renders the affected channel(s) inoperable and reduces the reliability of the affected Functions.
| |
| The LCO generally requires OPERABILITY of four or three channels in each instrumentation Function, two channels of Manual Reactor Trip in each logic Function, and two trains in each Automatic Trip Logic Function.
| |
| Functions with four instrumentation channels are arranged in a two-out-of-four configuration. Functions with three instrumentation channels are arranged in a two-out-of-three configuration. The two-out-of-three and two-out-of-four configurations allow one channel to be tripped during maintenance or testing without causing a reactor trip.
| |
| Specific exceptions to the above general philosophy exist and are discussed below.
| |
| Reactor Trip System Functions The safety analyses and OPERABILITY requirements applicable to each RTS Function are discussed below:
| |
| : 1. Manual Reactor Trip The Manual Reactor Trip ensures that the control room operator can initiate a reactor trip at any time by using either of two reactor trip switches in the control room. A Manual Reactor Trip accomplishes the same results as any one of the automatic trip Functions. It is used by the reactor operator to shut down the reactor whenever any parameter is rapidly trending toward its Trip Setpoint.
| |
| There are two Manual Reactor Trip channels arranged in a one-out-of-two logic. The LCO requires two Manual Reactor Trip channels to be OPERABLE. Each channel is controlled by a manual reactor trip switch. Each channel activates the reactor trip breaker in both trains. Two independent channels are required to be OPERABLE so that no single random failure will disable the Manual Reactor Trip Function.
| |
| In MODE 1 or 2, manual initiation of a reactor trip must be OPERABLE. These are the MODES in which the shutdown rods and/or control rods are partially or fully withdrawn from the core. In MODE 3, 4, or 5, the manual initiation Function must also be OPERABLE if one or more shutdown rods or control rods are withdrawn or the Rod Control System is capable of withdrawing the Cook Nuclear Plant Unit 2 B 3.3.1-9 Revision No. 0
| |
| | |
| RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) shutdown rods or the control rods (e.g., RTBs in the closed position).
| |
| In this condition, inadvertent control rod withdrawal is possible. In MODE 3, 4, or 5, manual initiation of a reactor trip does not have to be OPERABLE if the Rod Control System is not capable of withdrawing the shutdown rods or control rods and if all rods are fully inserted. If the rods cannot be withdrawn from the core, and all of the rods are inserted, there is no need to be able to trip the reactor. In MODE 6, neither the shutdown rods nor the control rods are permitted to be withdrawn and the CRDMs are disconnected from the control rods and shutdown rods. Therefore, the manual initiation Function is not required.
| |
| : 2. Power Range Neutron Flux The NIS power range detectors are located external to the reactor vessel and measure neutrons leaking from the core. In addition, while not required for OPERABILITY of the Power Range Neutron Flux Function, this Function also provides a signal to prevent automatic and manual rod withdrawal prior to initiating a reactor trip.
| |
| Limiting further rod withdrawal may terminate the transient and eliminate the need to trip the reactor.
| |
| : a. Power Range Neutron Flux - High The Power Range Neutron Flux - High trip Function ensures that protection is provided, from all power levels, against a positive reactivity excursion leading to DNB during power operations.
| |
| These can be caused by rod withdrawal or reductions in RCS temperature.
| |
| There are four Power Range Neutron Flux - High channels arranged in a two-out-of-four logic. The LCO requires all four of the Power Range Neutron Flux - High channels to be OPERABLE.
| |
| In MODE 1 or 2, when a positive reactivity excursion could occur, the Power Range Neutron Flux - High trip must be OPERABLE. This Function will terminate the reactivity excursion and shut down the reactor prior to reaching a power level that could damage the fuel. In MODE 3, 4, 5, or 6, the NIS power range detectors cannot detect neutron levels in this range. In these MODES, the Power Range Neutron Flux - High does not Cook Nuclear Plant Unit 2 B 3.3.1-10 Revision No. 0
| |
| | |
| RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) have to be OPERABLE because the reactor is shut down and reactivity excursions into the power range are extremely unlikely.
| |
| Other RTS Functions and administrative controls provide protection against reactivity additions when in MODE 3, 4, 5, or 6.
| |
| : b. Power Range Neutron Flux - Low The LCO requirement for the Power Range Neutron Flux - Low trip Function ensures that protection is provided against a positive reactivity excursion from low power or subcritical conditions.
| |
| There are four Power Range Neutron Flux - Low channels arranged in a two-out-of-four logic. The LCO requires all four of the Power Range Neutron Flux - Low channels to be OPERABLE.
| |
| In MODE 1, below the Power Range Neutron Flux (P-10 setpoint), and in MODE 2, the Power Range Neutron Flux - Low trip must be OPERABLE. This Function may be manually blocked by the operator when two out of four power range channels are greater than approximately 10% RTP (P-10 setpoint). This Function is automatically unblocked when three out of four power range channels are below the P-10 setpoint.
| |
| Above the P-10 setpoint, positive reactivity additions are mitigated by the Power Range Neutron Flux - High trip Function.
| |
| In MODE 3, 4, 5, or 6, the Power Range Neutron Flux - Low trip Function does not have to be OPERABLE because the reactor is shut down and the NIS power range detectors cannot detect neutron levels in this range. Oth`er RTS trip Functions and administrative controls provide protection against positive reactivity additions or power excursions in MODE 3, 4, 5, or 6.
| |
| : 3. Power Range Neutron Flux Rate - High Positive Rate The Power Range Neutron Flux - High Positive Rate trip uses the same channels as discussed for Function 2 above.
| |
| The Power Range Neutron Flux - High Positive Rate trip Function ensures that protection is provided against rapid increases in neutron flux that are characteristic of an RCCA drive rod housing rupture and the accompanying ejection of the RCCA. This Function compliments the Power Range Neutron Flux - High and Low Setpoint trip Cook Nuclear Plant Unit 2 B 3.3.1-11 Revision No. 5
| |
| | |
| RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| Functions to ensure that the criteria are met for a rod ejection from the power range.
| |
| There are four Power Range Neutron Flux - High Positive Rate channels arranged in a two-out-of-four logic. The LCO requires all four of the Power Range Neutron Flux - High Positive Rate channels to be OPERABLE.
| |
| In MODE 1 or 2, when there is a potential to add a large amount of positive reactivity from a rod ejection accident (REA), the Power Range Neutron Flux - High Positive Rate trip must be OPERABLE.
| |
| In MODE 3, 4, 5, or 6, the Power Range Neutron Flux - High Positive Rate trip Function does not have to be OPERABLE because other RTS trip Functions and administrative controls will provide protection against positive reactivity additions. In MODE 6, no rods are withdrawn and the SDM is increased during refueling operations.
| |
| The reactor vessel head is also removed or the closure bolts are detensioned preventing any pressure buildup. In addition, the NIS power range detectors cannot detect neutron levels present in this mode.
| |
| : 4. Intermediate Range Neutron Flux The Intermediate Range Neutron Flux trip Function ensures that protection is provided against an uncontrolled RCCA bank rod withdrawal accident from a subcritical condition during startup. This trip Function provides redundant protection to the Power Range Neutron Flux - Low Setpoint trip Function. The NIS intermediate range detectors are located external to the reactor vessel and measure neutrons leaking from the core. In addition, while not required for OPERABILITY of the Intermediate Range Neutron Flux Function, this Function also provides a signal to prevent automatic and manual rod withdrawal prior to initiating a reactor trip. Limiting further rod withdrawal may terminate the transient and eliminate the need to trip the reactor.
| |
| There are two Intermediate Range Neutron Flux channels arranged in a one-out-of-two logic. The LCO requires all (two) channels of Intermediate Range Neutron Flux to be OPERABLE. Two OPERABLE channels are sufficient to ensure no single random failure will disable this trip Function.
| |
| Because this trip Function is important only during startup, there is generally no need to disable channels for testing while the Function is required to be OPERABLE. Therefore, a third channel is unnecessary.
| |
| Cook Nuclear Plant Unit 2 B 3.3.1-12 Revision No. 5
| |
| | |
| RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| In MODE 1 below the P-10 setpoint, and in MODE 2 above the P-6 setpoint, when there is a potential for an uncontrolled RCCA bank rod withdrawal accident during reactor startup, the Intermediate Range Neutron Flux trip must be OPERABLE. Above the P-10 setpoint, the Power Range Neutron Flux - High Setpoint trip and the Power Range Neutron Flux - High Positive Rate trip provide core protection for a rod withdrawal accident. In MODE 2 below the P-6 setpoint, the Source Range Neutron Flux Trip provides the core protection for reactivity accidents. In MODE 3, 4, or 5, the Intermediate Range Neutron Flux trip does not have to be OPERABLE because other RTS trip Functions and administrative controls will provide protection against positive reactivity additions. The core also has the required SDM to mitigate the consequences of a positive reactivity addition accident. In MODE 6, all rods are fully inserted and the core has a required increased SDM. Also, the NIS intermediate range detectors cannot detect neutron levels present in this MODE.
| |
| : 5. Source Range Neutron Flux The LCO requirement for the Source Range Neutron Flux trip Function ensures that protection is provided against an uncontrolled RCCA bank rod withdrawal accident from a subcritical condition during startup. In MODE 2, this trip Function provides redundant protection to the Power Range Neutron Flux - Low and Intermediate Range Neutron Flux trip Functions. In MODES 3, 4, and 5, administrative controls also prevent the uncontrolled withdrawal of rods. The NIS source range detectors are located external to the reactor vessel and measure neutrons leaking from the core. The source range trip is the only RTS automatic protection function required in MODES 3, 4, and 5 when rods are capable of withdrawal or one or more rods are not fully inserted (e.g., RTBs in the closed position). Therefore, the functional capability at the specified Allowable Value is assumed to be available.
| |
| The Source Range Neutron Flux Function provides protection for control rod withdrawal from subcritical, boron dilution and control rod ejection events.
| |
| In MODE 2 when below the P-6 setpoint and in MODES 3, 4, and 5 when there is a potential for an uncontrolled RCCA bank rod withdrawal accident, the Source Range Neutron Flux trip must be OPERABLE. There are two Source Range Neutron Flux channels arranged in a one-out-of-two logic. The LCO requires all (two) channels of Source Range Neutron Flux to be OPERABLE. Two Cook Nuclear Plant Unit 2 B 3.3.1-13 Revision No. 5
| |
| | |
| RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| OPERABLE channels are sufficient to ensure no single random failure will disable this trip Function. Above the P-6 setpoint, the Intermediate Range Neutron Flux, Power Range Neutron Flux - Low, and Power Range Neutron Flux - High trips will provide core protection for reactivity accidents. Above the P-6 setpoint, high voltage to the NIS source range detectors may be de-energized.
| |
| In MODES 3, 4, and 5 with all rods fully inserted and the Rod Control System not capable of rod withdrawal, and in MODE 6, the outputs of the Function to RTS logic are not required OPERABLE. The requirements for the NIS source range detectors to monitor core neutron levels and provide indication of reactivity changes that may occur as a result of events like a boron dilution are addressed in LCO 3.3.8, "Boron Dilution Monitoring Instrumentation (BDMI)," for MODE 3, 4, or 5 and LCO 3.9.2, "Nuclear Instrumentation," for MODE 6.
| |
| : 6. Overtemperature T The Overtemperature T trip Function is provided to ensure that the design limit DNBR is met. The inputs to the Overtemperature T trip include pressure, coolant temperature, axial power distribution, and reactor power as indicated by loop T assuming full reactor coolant flow. Protection from violating the DNBR limit is assured for those transients that are slow because of delays from the core to the measurement system. The Function monitors both variation in power and flow since a decrease in flow has the same effect on T as a power increase. The Overtemperature T trip Function uses each loop's T as a measure of reactor power and is compared with a setpoint that is automatically varied with the following parameters:
| |
| * reactor coolant average temperature - the Allowable Value is varied to correct for changes in coolant density and specific heat capacity with changes in coolant temperature;
| |
| * pressurizer pressure - the Allowable Value is varied to correct for changes in system pressure; and
| |
| * axial power distribution - f(I), the Allowable Value is varied to account for imbalances in the axial power distribution as detected by the NIS upper and lower power range detectors. If axial peaks are greater than the design limit, as indicated by the difference between the upper and lower NIS power range detectors, the Allowable Value is reduced in accordance with Note 1 of Table 3.3.1-1.
| |
| Cook Nuclear Plant Unit 2 B 3.3.1-14 Revision No. 5
| |
| | |
| RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| The Overtemperature T trip Function is calculated for each loop as described in Note 1 of Table 3.3.1-1. Trip occurs if Overtemperature T is indicated in two loops. In addition, while not required for OPERABILITY of the Overtemperature T Function, this Function also provides a signal to generate a turbine runback prior to reaching the Trip Setpoint. A turbine runback will reduce turbine power and reactor power. A reduction in power will normally alleviate the Overtemperature T condition and may prevent a reactor trip.
| |
| There are four Overtemperature T channels arranged in a two-out-of-four logic. The LCO requires all four channels of the Overtemperature T trip Function to be OPERABLE. Note that the Overtemperature T Function receives input from channels shared with other RTS Functions. Failures that affect multiple Functions require entry into the Conditions applicable to all affected Functions.
| |
| In MODE 1 or 2, the Overtemperature T trip must be OPERABLE to prevent DNB. In MODE 3, 4, 5, or 6, this trip Function does not have to be OPERABLE because the reactor is not operating and there is insufficient heat production to be concerned about DNB.
| |
| : 7. Overpower T The Overpower T trip Function ensures that protection is provided against excessive power (fuel rod rating protection). The Overpower T trip Function ensures that the allowable heat generation rate (kW/ft) of the fuel is not exceeded. It uses the T of each loop as a measure of reactor power with a setpoint that is automatically varied with the following parameters:
| |
| * reactor coolant average temperature - the Allowable Value is varied to correct for changes in coolant density and specific heat capacity with changes in coolant temperature; and
| |
| * rate of change of reactor coolant average temperature.
| |
| Cook Nuclear Plant Unit 2 B 3.3.1-15 Revision No. 16
| |
| | |
| RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| The Overpower T trip Function is calculated for each loop as per Note 2 of Table 3.3.1-1. Trip occurs if Overpower T is indicated in two loops. In addition, while not required for OPERABILITY of the Overpower T Function, this Function also provides a signal to generate a turbine runback prior to reaching the Allowable Value. A turbine runback will reduce turbine power and reactor power. A reduction in power will normally alleviate the Overpower T condition and may prevent a reactor trip.
| |
| There are four Overpower T channels arranged in a two-out-of-four logic. The LCO requires all four channels of the Overpower T trip Function to be OPERABLE. Note that the Overpower T trip Function receives input from channels shared with other RTS Functions. Failures that affect multiple Functions require entry into the Conditions applicable to all affected Functions.
| |
| In MODE 1 or 2, the Overpower T trip Function must be OPERABLE. These are the only times that enough heat is generated in the fuel to be concerned about the heat generation rates and overheating of the fuel. In MODE 3, 4, 5, or 6, this trip Function does not have to be OPERABLE because the reactor is not operating and there is insufficient heat production to be concerned about fuel overheating and fuel damage.
| |
| : 8. Pressurizer Pressure The same sensors provide input to the Pressurizer Pressure - High and - Low trips and the Overtemperature T trip.
| |
| : a. Pressurizer Pressure - Low The Pressurizer Pressure - Low trip Function ensures that protection is provided against violating the DNBR limit due to low pressure.
| |
| There are four Pressurizer Pressure - Low channels arranged in a two-out-of-four logic. The LCO requires all four channels of Pressurizer Pressure - Low to be OPERABLE.
| |
| In MODE 1, when DNB is a major concern, the Pressurizer Pressure - Low trip must be OPERABLE. This trip Function is automatically enabled on increasing power by the P-7 interlock (NIS power range P-10 or turbine first stage pressure greater than approximately 10% of full power equivalent (P-13)). On Cook Nuclear Plant Unit 2 B 3.3.1-16 Revision No. 5
| |
| | |
| RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) decreasing power, this trip Function is automatically blocked below P-7. Below the P-7 setpoint, no conceivable power distributions can occur that would cause DNB concerns.
| |
| : b. Pressurizer Pressure - High The Pressurizer Pressure - High trip Function ensures that protection is provided against overpressurizing the RCS. This trip Function operates in conjunction with the pressurizer power operated relief valves (PORVs) and safety valves to prevent RCS overpressure conditions.
| |
| There are four Pressurizer Pressure - High channels arranged in a two-out-of-four logic. The LCO requires all four channels of the Pressurizer Pressure - High to be OPERABLE.
| |
| The Pressurizer Pressure - High LSSS is selected to be below the pressurizer safety valve actuation pressure and above the power operated relief valve (PORV) setting. This setting minimizes challenges to safety valves while avoiding unnecessary reactor trip for those pressure increases that can be controlled by the PORVs.
| |
| In MODE 1 or 2, the Pressurizer Pressure - High trip must be OPERABLE to help prevent RCS overpressurization and minimize challenges to the PORVs and safety valves. In MODE 3, 4, 5, or 6, the Pressurizer Pressure - High trip Function does not have to be OPERABLE because transients that could cause an overpressure condition will be slow to occur.
| |
| Therefore, the operator will have sufficient time to evaluate unit conditions and take corrective actions. Additionally, low temperature overpressure protection systems provide overpressure protection in MODES 4, 5, and 6.
| |
| : 9. Pressurizer Water Level - High The Pressurizer Water Level - High trip Function provides a backup signal for the Pressurizer Pressure - High trip and also provides protection against water relief through the pressurizer safety valves.
| |
| Water relief could be damaging to the pressurizer safety valves, relief piping, and pressurizer relief tank. A reactor trip is actuated prior to the pressurizer becoming water solid. There are three Pressurizer Water Level - High channels arranged in a two-out-of-three logic.
| |
| The LCO requires all three channels of Pressurizer Water Cook Nuclear Plant Unit 2 B 3.3.1-17 Revision No. 5
| |
| | |
| RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| Level - High to be OPERABLE. In addition, while not required for OPERABILITY of the Pressurizer Water Level - High Function, the pressurizer level channels are used as input to the Pressurizer Level Control System.
| |
| In MODE 1, when there is a potential for overfilling the pressurizer, the Pressurizer Water Level - High trip must be OPERABLE. This trip Function is automatically enabled on increasing power by the P-7 interlock. On decreasing power, this trip Function is automatically blocked below P-7. Below the P-7 setpoint, transients that could raise the pressurizer water level will be slow and the operator will have sufficient time to evaluate unit conditions and take corrective actions.
| |
| : 10. Reactor Coolant Flow - Low (per loop)
| |
| The Reactor Coolant Flow - Low trip Function ensures that protection is provided against violating the DNBR limit due to low flow in one or more RCS loops, while avoiding reactor trips due to normal variations in loop flow. Above the P-7 setpoint, the logic is such that the reactor trip on low flow in two or more RCS loops is automatically enabled.
| |
| Above the P-8 setpoint, which is approximately 31% RTP, the logic is such that low flow in any one RCS loop will actuate a reactor trip.
| |
| Each RCS loop has three flow detectors to monitor flow. Any two of the detectors in each loop must trip for a low flow signal in the RCS loop.
| |
| The LCO requires three Reactor Coolant Flow - Low channels per loop to be OPERABLE in MODE 1 above P-7. Each loop is treated separately and each loop is considered a separate Function.
| |
| Therefore, separate Condition entry is allowed for each loop. This is acceptable since each loop has three flow detectors (with two out of the three necessary for a low flow signal), and the flow detectors of one loop are independent from the flow detectors of the other loops.
| |
| In MODE 1 above the P-8 setpoint, a loss of flow in one RCS loop could result in DNB conditions in the core because of the higher power level. In MODE 1 below the P-8 setpoint and above the P-7 setpoint, a loss of flow in two or more loops is required to actuate a reactor trip because of the lower power level and the greater margin to the design limit DNBR. Below the P-7 setpoint, all reactor trips on low flow are automatically blocked since there is insufficient heat production to generate DNB conditions.
| |
| Cook Nuclear Plant Unit 2 B 3.3.1-18 Revision No. 5
| |
| | |
| RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| : 11. Reactor Coolant Pump (RCP) Breaker Position The RCP Breaker Position trip Function ensures that protection is provided against violating the DNBR limit due to a loss of flow in two or more RCS loops. This Function anticipates the Reactor Coolant Flow - Low trip to avoid RCS heatup that would occur before the low flow trip actuates. The position of each RCP breaker is monitored by a set of auxiliary contacts. Above the P-7 setpoint, a loss of flow in two or more loops will initiate a reactor trip. This trip Function will generate a reactor trip before the Reactor Coolant Flow - Low Function.
| |
| There is one RCP Breaker Position channel per RCP breaker (i.e.,
| |
| 4 channels) arranged in a two-out-of-four logic. The LCO requires one RCP Breaker Position channel per RCP to be OPERABLE. One OPERABLE channel is sufficient for this Function because the RCS Flow - Low trip alone provides sufficient protection of unit SLs for loss of flow events. The RCP Breaker Position trip serves only to anticipate the low flow trip, minimizing the thermal transient associated with loss of an RCP.
| |
| This Function measures only the discrete position (open or closed) of the RCP breaker, using a position switch. Therefore, the Function has no adjustable trip setpoint with which to associate an LSSS.
| |
| In MODE 1 above the P-7 setpoint, the RCP Breaker Position trip must be OPERABLE. Below the P-7 setpoint, all reactor trips on loss of flow are automatically blocked since no conceivable power distributions could occur that would cause a DNB concern at this low power level. Above the P-7 setpoint, the reactor trip on loss of flow in two RCS loops is automatically enabled.
| |
| : 12. Undervoltage Reactor Coolant Pumps The Undervoltage RCPs reactor trip Function ensures that protection is provided against violating the DNBR limit due to a loss of flow in two or more RCS loops. The voltage to each RCP bus is monitored.
| |
| A bus undervoltage signal is generated by one-out-of-two undervoltage relays per reactor coolant pump bus, and two-out-of-four bus undervoltage signals will generate a reactor trip.
| |
| Above the P-7 setpoint, a loss of voltage detected on two or more RCP buses will initiate a reactor trip. This trip Function will generate a reactor trip before the Reactor Coolant Flow - Low Function. Time delays are incorporated into the Undervoltage RCPs channels to Cook Nuclear Plant Unit 2 B 3.3.1-19 Revision No. 5
| |
| | |
| RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) prevent reactor trips due to momentary electrical power transients.
| |
| The settings for the time delays are verified to be within limits during the performance of SR 3.3.1.19.
| |
| While there are two Undervoltage RCPs channels per bus, the LCO requires only one Undervoltage RCPs channel per bus to be OPERABLE, since either of the two channels can generate the necessary trip signal for the bus.
| |
| In MODE 1 above the P-7 setpoint, the Undervoltage RCPs trip must be OPERABLE. Below the P-7 setpoint, all reactor trips on loss of flow are automatically blocked since no conceivable power distributions could occur that would cause a DNB concern at this low power level. Above the P-7 setpoint, the reactor trip on loss of flow in two or more RCS loops is automatically enabled. This Function uses the same undervoltage relays as the ESFAS Function 6.f, Undervoltage Reactor Coolant Pump start of the turbine driven auxiliary feedwater (AFW) pump.
| |
| : 13. Underfrequency Reactor Coolant Pumps The Underfrequency RCPs reactor trip Function ensures that protection is provided against violating the DNBR limit due to a loss of flow in two or more RCS loops from a major network frequency disturbance. An underfrequency condition will slow down the pumps, thereby reducing their coastdown time following a pump trip. The proper coastdown time is required so that reactor heat can be removed immediately after reactor trip. The frequency of each RCP bus is monitored. A bus underfrequency signal is generated by one-out-of-two underfrequency relays per reactor coolant pump bus, and two-out-of-four bus underfrequency signals will generate a reactor trip. Above the P-7 setpoint, a loss of frequency detected on two or more RCP buses will initiate a reactor trip. This trip Function will generate a reactor trip before the Reactor Coolant Flow - Low Function. Time delays are incorporated into the Underfrequency RCPs channels to prevent reactor trips due to momentary electrical power transients. The settings for the time delays are verified to be within limits during the performance of SR 3.3.1.19.
| |
| While there are two Underfrequency RCPs channels per bus, the LCO requires only one Underfrequency RCPs channel per bus to be OPERABLE, since either of the two channels can generate the necessary trip signal for the bus.
| |
| Cook Nuclear Plant Unit 2 B 3.3.1-20 Revision No. 5
| |
| | |
| RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| In MODE 1 above the P-7 setpoint, the Underfrequency RCPs trip must be OPERABLE. Below the P-7 setpoint, all reactor trips on loss of flow are automatically blocked since no conceivable power distributions could occur that would cause a DNB concern at this low power level. Above the P-7 setpoint, the reactor trip on loss of flow in two or more RCS loops is automatically enabled.
| |
| : 14. Steam Generator Water Level - Low Low (per SG)
| |
| The SG Water Level - Low Low trip Function ensures that protection is provided against a loss of heat sink and actuates the AFW System prior to uncovering the SG tubes. The SGs are the heat sink for the reactor. In order to act as a heat sink, the SGs must contain a minimum amount of water. A narrow range low low level in any SG is indicative of a loss of heat sink for the reactor. There are three SG Water Level - Low Low channels per SG. The logic is arranged such that any two channels on the same SG will actuate a reactor trip. In addition, while not required for OPERABILITY of the Steam Generator Water Level - Low Low Function, the level transmitters provide input to the SG level Control System. This Function also performs ESFAS Function 6.c, SG Water Level - Low Low start of the AFW pumps.
| |
| The LCO requires three channels of SG Water Level - Low Low per SG to be OPERABLE. Each SG is treated separately and each SG is considered a separate Function. Therefore, separate Condition entry is allowed for each SG. This is acceptable since each SG has three level channels (with two out of the three necessary for a low SG water level signal), and the level channels of one SG are independent from the level channels of the other SGs.
| |
| In MODE 1 or 2, when the reactor requires a heat sink, the SG Water Level - Low Low trip must be OPERABLE. The normal source of water for the SGs is the Main Feedwater (MFW) System (not safety related). The MFW System is only in operation in MODE 1 or 2. The AFW System is the safety related backup source of water to ensure that the SGs remain the heat sink for the reactor. During normal startups and shutdowns, the AFW System provides feedwater to maintain SG level. In MODE 3, 4, 5, or 6, the SG Water Level - Low Low Function does not have to be OPERABLE because the MFW System is not in operation and the reactor is not operating or even critical. Decay heat removal is accomplished by the AFW System in MODE 3, by any combination of the AFW System and Residual Heat Removal (RHR) System in MODE 4, and by the RHR System in MODE 5 or 6.
| |
| Cook Nuclear Plant Unit 2 B 3.3.1-21 Revision No. 5
| |
| | |
| RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| : 15. Steam Generator Water Level - Low, Coincident with Steam Flow/Feedwater Flow Mismatch (per SG)
| |
| SG Water Level - Low, in conjunction with the Steam Flow/Feedwater Flow Mismatch, ensures that protection is provided against a loss of heat sink. In addition to a decreasing water level in the SG, the difference between feedwater flow and steam flow is evaluated to determine if feedwater flow is significantly less than steam flow. With less feedwater flow than steam flow, SG level will decrease at a rate dependent upon the magnitude of the difference in flow rates. There are two SG level channels and two Steam Flow/Feedwater Flow Mismatch channels per SG. The logic is arranged such that one narrow range level channel sensing a low level coincident with one Steam Flow/Feedwater Flow Mismatch channel sensing flow mismatch (steam flow greater than feed flow) in the same SG will actuate a reactor trip.
| |
| The LCO requires two channels of SG Water Level - Low per SG and two channels of Steam Flow/Feedwater Flow Mismatch per SG to be OPERABLE. Each SG is treated separately and each SG is considered a separate Function. Therefore, separate Condition entry is allowed for each SG. This is acceptable since each SG has two level channels and two mismatch channels (with one out of the two channels per type necessary for a low SG level coincident with steam flow/feedwater flow mismatch signal), and the channels of one SG are independent from the channels of the other SGs.
| |
| In MODE 1 or 2, when the reactor requires a heat sink, the SG Water Level - Low coincident with Steam Flow/Feedwater Flow Mismatch trip must be OPERABLE. The normal source of water for the SGs is the MFW System (not safety related). The MFW System is only in operation in MODE 1 or 2. The AFW System is the safety related backup source of water to ensure that the SGs remain the heat sink for the reactor. During normal startups and shutdowns, the AFW System provides feedwater to maintain SG level. In MODE 3, 4, 5, or 6, the SG Water Level - Low coincident with Steam Flow/Feedwater Flow Mismatch Function does not have to be OPERABLE because the MFW System is not in operation and the reactor is not operating or even critical. Decay heat removal is accomplished by the AFW System in MODE 3, by any combination of the AFW System and RHR System in MODE 4, and by the RHR System in MODE 5 or 6. The MFW System is in operation only in MODE 1 or 2 and, therefore, this trip Function need only be OPERABLE in these MODES.
| |
| Cook Nuclear Plant Unit 2 B 3.3.1-22 Revision No. 5
| |
| | |
| RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| : 16. Turbine Trip
| |
| : a. Turbine Trip - Low Fluid Oil Pressure The Turbine Trip - Low Fluid Oil Pressure trip Function anticipates the loss of heat removal capabilities of the secondary system following a turbine trip. This trip Function acts to minimize the pressure/temperature transient on the reactor. Any turbine trip from a power level below the P-8 setpoint, approximately 31% power, will not actuate a reactor trip. Three pressure switches monitor the emergency trip fluid oil pressure in the Turbine Electrohydraulic Control System. A low pressure condition sensed by two-out-of-three pressure switches will actuate a reactor trip. The unit is designed to withstand a complete loss of load and not sustain core damage or challenge the RCS pressure limitations. Core protection is provided by the Pressurizer Pressure - High trip Function and RCS integrity is ensured by the pressurizer safety valves.
| |
| The LCO requires three channels of Turbine Trip - Low Fluid Oil Pressure to be OPERABLE in MODE 1 above P-8.
| |
| Below the P-8 setpoint, a turbine trip does not actuate a reactor trip. In MODE 2, 3, 4, 5, or 6, there is no potential for a turbine trip, and the Turbine Trip - Low Fluid Oil Pressure trip Function does not need to be OPERABLE.
| |
| : b. Turbine Trip - Turbine Stop Valve Closure (per train)
| |
| The Turbine Trip - Turbine Stop Valve Closure trip Function anticipates the loss of heat removal capabilities of the secondary system following a turbine trip from a power level above the P-8 setpoint, approximately 31% power. This action will actuate a reactor trip. The trip Function anticipates the loss of secondary heat removal capability that occurs when the stop valves close.
| |
| Tripping the reactor in anticipation of loss of secondary heat removal acts to minimize the pressure and temperature transient on the reactor. This trip Function will not and is not required to operate in the presence of a single channel failure. The unit is designed to withstand a complete loss of load and not sustain core damage or challenge the RCS pressure limitations. Core protection is provided by the Pressurizer Pressure - High trip Function, and RCS integrity is ensured by the pressurizer safety valves. This trip Function is diverse to the Turbine Trip - Low Cook Nuclear Plant Unit 2 B 3.3.1-23 Revision No. 16
| |
| | |
| RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| Fluid Oil Pressure trip Function. Each turbine stop valve is equipped with one limit switch that inputs to the RTS. If all four limit switches indicate that the stop valves are all closed, a reactor trip is initiated.
| |
| The LSSS for this Function is set to assure channel trip occurs when the associated stop valve is completely closed.
| |
| The LCO requires four Turbine Trip - Turbine Stop Valve Closure channels per train to be OPERABLE in MODE 1 above P-8.
| |
| Each turbine stop valve includes two limit switches. One limit switch provides input to Train A while the other limit switch provides input to Train B. Each limit switch is considered to be a channel. All four channels associated with a train must trip to cause reactor trip. Each train is treated separately and each train is considered a separate Function. Therefore, separate Condition entry is allowed for each train. This is acceptable since either train can generate a reactor trip signal and the logic is independent between trains.
| |
| Below the P-8 setpoint, a load rejection can be accommodated by the Steam Dump System, the Rod Control System, and the Pressurizer Pressure Control System. In MODE 2, 3, 4, 5, or 6, there is no potential for a load rejection, and the Turbine Trip - Stop Valve Closure trip Function does not need to be OPERABLE.
| |
| : 17. Safety Injection Input from Engineered Safety Feature Actuation System The SI Input from ESFAS ensures that if a reactor trip has not already been generated by the RTS, the ESFAS automatic actuation logic will initiate a reactor trip upon any signal that initiates SI. This is a condition of acceptability for the LOCA. However, other transients and accidents take credit for varying levels of ESF performance and rely upon rod insertion, except for the most reactive rod that is assumed to be fully withdrawn, to ensure reactor shutdown.
| |
| Therefore, a reactor trip is initiated every time an SI signal is present.
| |
| Allowable Values are not applicable to this Function. The SI Input from ESFAS signal directly inputs to the RTS. Therefore, there is no measurement signal with which to associate an LSSS.
| |
| There are two trains of SI Input from ESFAS arranged in a one-out-of-two logic. The LCO requires two trains of SI Input from ESFAS to be OPERABLE in MODE 1 or 2.
| |
| Cook Nuclear Plant Unit 2 B 3.3.1-24 Revision No. 16
| |
| | |
| RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| A reactor trip is initiated every time an SI signal is present.
| |
| Therefore, this trip Function must be OPERABLE in MODE 1 or 2, when the reactor is critical and must be shut down in the event of an accident. In MODE 3, 4, 5, or 6, the reactor is not critical, and this trip Function does not need to be OPERABLE.
| |
| : 18. Reactor Trip System Interlocks Reactor protection interlocks are provided to ensure reactor trips are in the correct configuration for the current unit status. They back up operator actions to ensure protection system Functions are not bypassed during unit conditions under which the safety analysis assumes the Functions are not bypassed. Therefore, the interlock Functions do not need to be OPERABLE when the associated reactor trip functions are outside the applicable MODES. The interlocks are:
| |
| : a. Intermediate Range Neutron Flux, P-6 The Intermediate Range Neutron Flux, P-6 interlock is actuated when any NIS intermediate range channel goes approximately one decade above the minimum channel reading. If both channels drop below the reset point, the permissive will automatically be defeated. The LCO requirement for the P-6 interlock ensures that the following Functions are performed:
| |
| * on increasing power, the P-6 interlock allows the manual block of the NIS Source Range Neutron Flux reactor trip.
| |
| This prevents a premature block of the source range trip and allows the operator to ensure that the intermediate range is OPERABLE prior to leaving the source range. When the source range trip is blocked, the high voltage to the detectors is also removed; and
| |
| * on decreasing power, the P-6 interlock automatically energizes the NIS source range detectors and enables the NIS Source Range Neutron Flux reactor trip (i.e., defeats the manual block).
| |
| The LCO requires two channels of Intermediate Range Neutron Flux, P-6 interlock to be OPERABLE in MODE 2 when below the P-6 interlock setpoint and in MODE 3, 4, and 5 with Rod Control System capable of rod withdrawal or one or more rods not fully inserted.
| |
| Cook Nuclear Plant Unit 2 B 3.3.1-25 Revision No. 5
| |
| | |
| RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| Above the P-6 interlock setpoint, the NIS Source Range Neutron Flux reactor trip will be blocked, and this Function will no longer be necessary.
| |
| : b. Low Power Reactor Trips Block, P-7 The Low Power Reactor Trips Block, P-7 interlock is actuated by input from either the Power Range Neutron Flux, P-10, or the Turbine First Stage Pressure, P-13 interlock. The LCO requirement for the P-7 interlock ensures that the following Functions are performed:
| |
| (1) on increasing power, the P-7 interlock automatically enables reactor trips on the following Functions:
| |
| * Pressurizer Pressure - Low;
| |
| * Pressurizer Water Level - High;
| |
| * Reactor Coolant Flow - Low;
| |
| * RCPs Breaker Open;
| |
| * Undervoltage RCPs; and
| |
| * Underfrequency RCPs.
| |
| These reactor trips are only required when operating above the P-7 setpoint (approximately 10% RTP). The reactor trips provide protection against violating the DNBR limit.
| |
| Below the P-7 setpoint, the RCS is capable of providing sufficient natural circulation without any RCP running.
| |
| (2) on decreasing power, the P-7 interlock automatically blocks reactor trips on the following Functions:
| |
| * Pressurizer Pressure - Low;
| |
| * Pressurizer Water Level - High;
| |
| * Reactor Coolant Flow - Low; Cook Nuclear Plant Unit 2 B 3.3.1-26 Revision No. 16
| |
| | |
| RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| * RCP Breaker Position;
| |
| * Undervoltage RCPs; and
| |
| * Underfrequency RCPs.
| |
| An Allowable Value is not applicable to the P-7 interlock because it is a logic Function and thus has no parameter with which to associate an LSSS.
| |
| The P-7 interlock is a logic Function with train and not channel identity. Therefore, the LCO requires one channel per train of Low Power Reactor Trips Block, P-7 interlock to be OPERABLE in MODE 1.
| |
| The associated trips are blocked below the P-7 setpoint and unblocked above the P-7 setpoint. In MODE 2, 3, 4, 5, or 6, this Function does not have to be OPERABLE because the interlock performs its Function at approximately 10% power, which is in MODE 1.
| |
| : c. Power Range Neutron Flux, P-8 The Power Range Neutron Flux, P-8 interlock is actuated at approximately 31% power as determined by two-out-of-four NIS power range detectors. The P-8 interlock automatically enables the Reactor Coolant Flow - Low reactor trip on low flow in one or more RCS loops on increasing power. The LCO requirement for this trip Function ensures that protection is provided against a loss of flow in any RCS loop that could result in DNB conditions in the core when greater than approximately 31% power. The P-8 Interlock also automatically enables the reactor trip on Turbine Trip (Low Fluid Oil Pressure and Turbine Stop Valve Closure) on increasing power. On decreasing power, the reactor trip on low flow in any loop and on turbine trip is automatically blocked.
| |
| The LCO requires four channels of Power Range Neutron Flux, P-8 interlock to be OPERABLE in MODE 1.
| |
| In MODE 1, a loss of flow in one RCS loop could result in DNB conditions, so the Power Range Neutron Flux, P-8 interlock must be OPERABLE. In MODE 2, 3, 4, 5, or 6, this Function does not have to be OPERABLE because the core is not producing sufficient power to be concerned about DNB conditions.
| |
| Cook Nuclear Plant Unit 2 B 3.3.1-27 Revision No. 16
| |
| | |
| RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| : d. Power Range Neutron Flux, P-10 The Power Range Neutron Flux, P-10 interlock is actuated at approximately 10% power, as determined by two-out-of-four NIS power range detectors. If power level falls below approximately 10% RTP on 3 of 4 channels, the nuclear instrument trips will be automatically unblocked. The LCO requirement for the P-10 interlock ensures that the following Functions are performed:
| |
| * on increasing power, the P-10 interlock allows the operator to manually block the Intermediate Range Neutron Flux reactor trip. Note that blocking the reactor trip also blocks the signal to prevent automatic and manual rod withdrawal;
| |
| * on increasing power, the P-10 interlock allows the operator to manually block the Power Range Neutron Flux - Low reactor trip;
| |
| * on increasing power, the P-10 interlock automatically provides a signal to block the Source Range Neutron Flux reactor trip;
| |
| * the P-10 interlock provides one of the two inputs to the P-7 interlock; and
| |
| * on decreasing power, the P-10 interlock automatically enables the Power Range Neutron Flux - Low reactor trip and the Intermediate Range Neutron Flux reactor trip (and rod stop).
| |
| The LCO requires four channels of Power Range Neutron Flux, P-10 interlock to be OPERABLE in MODE 1 or 2.
| |
| OPERABILITY in MODE 1 ensures the Function is available to perform its decreasing power Functions in the event of a reactor shutdown. This Function must be OPERABLE in MODE 2 to ensure that core protection is provided during a startup or shutdown by the Power Range Neutron Flux - Low and Intermediate Range Neutron Flux reactor trips. In MODE 3, 4, 5, or 6, this Function does not have to be OPERABLE because the reactor is not at power and the Source Range Neutron Flux reactor trip provides core protection.
| |
| Cook Nuclear Plant Unit 2 B 3.3.1-28 Revision No. 5
| |
| | |
| RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| : e. Turbine First Stage Pressure, P-13 The Turbine First Stage Pressure, P-13 interlock is actuated when the pressure in the first stage of the high pressure turbine is greater than the setpoint. This is determined by one-out-of-two pressure detectors. The LCO requirement for this Function ensures that one of the inputs to the P-7 interlock is available.
| |
| The LCO requires two channels of Turbine First Stage Pressure, P-13 interlock to be OPERABLE in MODE 1.
| |
| The Turbine First Stage Pressure, P-13 interlock must be OPERABLE when the turbine generator is operating. The interlock Function is not required OPERABLE in MODE 2, 3, 4, 5, or 6 because the turbine generator is not operating.
| |
| : 19. Reactor Trip Breakers This trip Function applies to the RTBs exclusive of individual trip mechanisms. There are two Reactor Trip Breaker trains arranged in a one-out-of-two logic. The LCO requires two OPERABLE trains of trip breakers. A trip breaker train consists of all trip breakers associated with a single RTS logic train that are racked in, closed, and capable of supplying power to the Rod Control System. Thus, the train may consist of the main breaker, bypass breaker, or main breaker and bypass breaker, depending upon the system configuration. Two OPERABLE trains ensure no single random failure can disable the RTS trip capability.
| |
| These trip Functions must be OPERABLE in MODE 1 or 2 when the reactor is critical. In MODE 3, 4, or 5, these RTS trip Functions must be OPERABLE when the Rod Control System is capable of rod withdrawal or one or more rods are not fully inserted.
| |
| : 20. Reactor Trip Breaker Undervoltage and Shunt Trip Mechanisms The LCO requires both the Undervoltage and Shunt Trip Mechanisms to be OPERABLE for each RTB that is in service.
| |
| Either trip mechanism is capable of opening the associated RTB on receipt of a trip signal. The trip mechanisms are not required to be OPERABLE for trip breakers that are open, racked out, incapable of supplying power to the Rod Control System, or declared inoperable under Function 19 above. OPERABILITY of both trip mechanisms on each breaker ensures that no single trip mechanism failure will prevent opening any breaker on a valid signal.
| |
| Cook Nuclear Plant Unit 2 B 3.3.1-29 Revision No. 5
| |
| | |
| RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| These trip Functions must be OPERABLE in MODE 1 or 2 when the reactor is critical. In MODE 3, 4, or 5, these RTS trip Functions must be OPERABLE when the Rod Control System is capable of rod withdrawal or one or more rods are not fully inserted.
| |
| : 21. Automatic Trip Logic The LCO requirement for the RTBs (Functions 19 and 20) and Automatic Trip Logic (Function 21) ensures that means are provided to interrupt the power to allow the rods to fall into the reactor core.
| |
| Each RTB is equipped with an undervoltage coil and a shunt trip coil to trip the breaker open when needed. Each RTB is equipped with a bypass breaker to allow testing of the trip breaker while the unit is at power. The reactor trip signals generated by the RTS Automatic Trip Logic cause the RTBs and associated bypass breakers to open and shut down the reactor.
| |
| There are two RTS Automatic Trip Logic trains arranged in a one-out-of-two logic. The LCO requires two trains of RTS Automatic Trip Logic to be OPERABLE. Having two OPERABLE channels ensures that random failure of a single logic channel will not prevent reactor trip.
| |
| These trip Functions must be OPERABLE in MODE 1 or 2 when the reactor is critical. In MODE 3, 4, or 5, these RTS trip Functions must be OPERABLE when the Rod Control System is capable of rod withdrawal or one or more rods are not fully inserted.
| |
| The RTS instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| ACTIONS A Note has been added to the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed in Table 3.3.1-1. The Completion Time(s) of the inoperable channel(s) of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.
| |
| In the event a channel's trip setpoint is found nonconservative with respect to the Allowable Value, or the transmitter, instrument loop, signal processing electronics, or bistable is found inoperable, then all affected Functions provided by that channel must be declared inoperable and the LCO Condition(s) entered for the protection Function(s) affected.
| |
| When the number of inoperable channels in a trip Function exceed those specified in one or other related Conditions associated with a trip Cook Nuclear Plant Unit 2 B 3.3.1-30 Revision No. 5
| |
| | |
| RTS Instrumentation B 3.3.1 BASES ACTIONS (continued)
| |
| Function, then the unit is outside the safety analysis. Therefore, LCO 3.0.3 must be immediately entered if applicable in the current MODE of operation.
| |
| A.1 Condition A applies to all RTS protection Functions. Condition A addresses the situation where one or more required channels or trains for one or more Functions are inoperable at the same time. The Required Action is to refer to Table 3.3.1-1 and to take the Required Actions for the protection functions affected. The Completion Times are those from the referenced Conditions and Required Actions.
| |
| B.1 Condition B applies to the Manual Reactor Trip, RTBs, RTB Undervoltage and Shunt Trip Mechanisms, and Automatic Trip Logic. This action addresses the train orientation of the SSPS for these Functions. With one channel or train inoperable, the inoperable channel or train must be restored to OPERABLE status within 48 hours. In this condition, the remaining OPERABLE channel is adequate to perform the safety function.
| |
| The Completion Time of 48 hours is reasonable considering that in this condition, the remaining OPERABLE channel or train is adequate to perform the safety function, and the low probability of an event occurring during this interval.
| |
| C.1 and C.2 Condition C applies to the Power Range Neutron Flux - High Function.
| |
| The NIS power range detectors provide input to the Rod Control System and, therefore, have a two-out-of-four trip logic. A known inoperable channel must be placed in the tripped condition. This results in a partial trip condition requiring only one-out-of-three logic for actuation. The 6 hours allowed to place the inoperable channel in the tripped condition is justified in WCAP-10271-P-A (Ref. 10).
| |
| With one of the NIS power range detectors inoperable, 1/4 of the radial power distribution monitoring capability is lost. Therefore, SR 3.2.4.2 must be performed (Required Action C.2) 12 hours from discovery of THERMAL POWER > 75% RTP and once per 12 hours thereafter.
| |
| Calculating QPTR every 12 hours compensates for the lost monitoring capability due to the inoperable NIS power range channel and allows Cook Nuclear Plant Unit 2 B 3.3.1-31 Revision No. 5
| |
| | |
| RTS Instrumentation B 3.3.1 BASES ACTIONS (continued) continued unit operation at power levels > 75% RTP. At power levels less than or equal to 75% RTP, operation of the core with radial power distributions beyond the design limits, at a power level where DNB conditions may exist, is prevented. The 12 hour Completion Time is consistent with the Surveillance Requirement Frequency in LCO 3.2.4, "QUADRANT POWER TILT RATIO (QPTR)." Required Action C.2 has been modified by a Note which only requires SR 3.2.4.2 to be performed if the Power Range Neutron Flux input to QPTR becomes inoperable.
| |
| Failure of a component in the Power Range Neutron Flux Channel which renders the High Flux Trip Function inoperable may not affect the capability to monitor QPTR. As such, determining QPTR using movable incore detectors may not be necessary.
| |
| The Required Actions have been modified by a Note that allows placing the inoperable channel in the bypass condition for up to 4 hours while performing routine surveillance testing of other channels. The Note also allows placing the inoperable channel in the bypass condition to allow setpoint adjustments of other channels when required to reduce the setpoint in accordance with other Technical Specifications. The 4 hour time limit is justified in Reference 10.
| |
| D.1 Condition D applies to the following reactor trip Functions:
| |
| * Power Range Neutron Flux - Low;
| |
| * Overtemperature T;
| |
| * Overpower T;
| |
| * Power Range Neutron Flux - High Positive Rate;
| |
| * Pressurizer Pressure - Low;
| |
| * Pressurizer Pressure - High;
| |
| * Pressurizer Water Level - High;
| |
| * Reactor Coolant Flow - Low;
| |
| * Reactor Coolant Pump (RCP) Breaker Position;
| |
| * Undervoltage RCPs;
| |
| * Underfrequency RCPs; Cook Nuclear Plant Unit 2 B 3.3.1-32 Revision No. 5
| |
| | |
| RTS Instrumentation B 3.3.1 BASES ACTIONS (continued)
| |
| * SG Water Level - Low Low;
| |
| * SG Water Level - Low coincident with Steam Flow/Feedwater Flow Mismatch;
| |
| * Turbine Trip - Low Fluid Oil Pressure; and
| |
| * Turbine Trip - Turbine Stop Valve Closure.
| |
| A known inoperable channel must be placed in the tripped condition within 6 hours. Placing the channel in the tripped condition results in a partial trip condition requiring only one-out-of-two logic for actuation of the two-out-of-three trips and one-out-of-three logic for actuation of the two-out-of-four trips. The 6 hours allowed to place the inoperable channel in the tripped condition is justified in Reference 10.
| |
| The Required Actions have been modified by two Notes. Note 1, which is applicable to TS Functions with installed bypass test capability, allows placing one channel in bypass for 4 hours while performing routine surveillance testing, and setpoint adjustments when a setpoint reduction is required by another Technical Specification. Note 2, which is applicable to TS Functions without installed bypass test capability, allows placing the inoperable channel, except Function 11 channels, in the bypassed condition for up to 4 hours while performing routine surveillance testing of the other channels. The 4 hour time limit is justified in Reference 10.
| |
| These Notes provide an exception to entering LCO 3.0.3 with a single channel inoperable within a TS Function to perform surveillance testing on another channel within the same Function.
| |
| E.1 and E.2 Condition E applies to the Intermediate Range Neutron Flux trip when THERMAL POWER is above the P-6 setpoint and below the P-10 setpoint and one channel is inoperable. Above the P-6 setpoint and below the P-10 setpoint, the NIS intermediate range detector performs the monitoring Functions. If THERMAL POWER is greater than the P-6 setpoint but less than the P-10 setpoint, 24 hours is allowed to reduce THERMAL POWER below the P-6 setpoint or increase to THERMAL POWER above the P-10 setpoint. The NIS Intermediate Range Neutron Flux channels must be OPERABLE when the power level is above the capability of the source range, P-6, and below the capability of the power range, P-10. If THERMAL POWER is greater than the P-10 setpoint, the NIS power range detectors perform the monitoring and protection functions and the intermediate range is not required. The Completion Times allow for a slow and controlled power adjustment above P-10 or below P-6 and take into account the redundant capability afforded by the Cook Nuclear Plant Unit 2 B 3.3.1-33 Revision No. 17
| |
| | |
| RTS Instrumentation B 3.3.1 BASES ACTIONS (continued) redundant OPERABLE channel, and the low probability of its failure during this period. This action does not require the inoperable channel to be tripped because the Function uses one-out-of-two logic. Tripping one channel would trip the reactor. Thus, the Required Actions specified in this Condition are only applicable when channel failure does not result in reactor trip.
| |
| F.1 and F.2 Condition F applies to two inoperable Intermediate Range Neutron Flux trip channels in MODE 2 when THERMAL POWER is above the P-6 setpoint and below the P-10 setpoint. Required Actions specified in this Condition are only applicable when channel failures do not result in reactor trip. Above the P-6 setpoint and below the P-10 setpoint, the NIS intermediate range detector performs the monitoring Functions. With no intermediate range channels OPERABLE, the Required Actions are to suspend operations involving positive reactivity additions immediately.
| |
| This will preclude any power level increase since there are no OPERABLE Intermediate Range Neutron Flux channels. The operator must also reduce THERMAL POWER below the P-6 setpoint within two hours. Below P-6, the Source Range Neutron Flux channels will be able to monitor the core power level. The Completion Time of 2 hours will allow a slow and controlled power reduction to less than the P-6 setpoint and takes into account the low probability of occurrence of an event during this period that may require the protection afforded by the NIS Intermediate Range Neutron Flux trip.
| |
| Required Action F.1 is modified by a Note to indicate that normal plant control operations that individually add limited positive reactivity (e.g.,
| |
| temperature or boron fluctuations associated with RCS inventory management or temperature control) are not precluded by this Action, provided they are accounted for in the calculated SDM.
| |
| G.1 Condition G applies to one inoperable Source Range Neutron Flux trip channel when in MODE 2, below the P-6 setpoint, and performing a reactor startup. With the unit in this condition, below P-6, the NIS source range performs the monitoring and protection functions. With one of the two channels inoperable, operations involving positive reactivity additions shall be suspended immediately.
| |
| This will preclude any power escalation. With only one source range channel OPERABLE, core protection is severely reduced and any actions that add positive reactivity to the core must be suspended immediately.
| |
| Cook Nuclear Plant Unit 2 B 3.3.1-34 Revision No. 17
| |
| | |
| RTS Instrumentation B 3.3.1 BASES ACTIONS (continued)
| |
| Required Action G.1 is modified by a Note to indicate that normal plant control operations that individually add limited positive reactivity (e.g.,
| |
| temperature or boron fluctuations associated with RCS inventory management or temperature control) are not precluded by this Action, provided they are accounted for in the calculated SDM.
| |
| H.1 Condition H applies to two inoperable Source Range Neutron Flux trip channels when in MODE 2, below the P-6 setpoint, and in MODE 3, 4, or 5 with the Rod Control System capable of rod withdrawal or one or more rods not fully inserted. With the unit in this condition, below P-6, the NIS source range performs the monitoring and protection functions. With both source range channels inoperable, the RTBs must be opened immediately. With the RTBs open, the core is in a more stable condition.
| |
| I.1 Condition I applies to one inoperable source range channel in MODE 3, 4, or 5 with the Rod Control System capable of rod withdrawal or one or more rods not fully inserted. With the unit in this condition, below P-6, the NIS source range performs the monitoring and protection functions. With one of the source range channels inoperable, 48 hours is allowed to restore it to an OPERABLE status. The allowance of 48 hours to restore the channel to OPERABLE status is acceptable given the capability of the remaining OPERABLE source range channel.
| |
| J.1 Condition J applies to the SI Input from ESFAS reactor trip and the RTS Automatic Trip Logic in MODES 1 and 2. These actions address the train orientation of the RTS for these Functions. With one train inoperable, 6 hours are allowed to restore the train to OPERABLE status (Required Action J.1). The Completion Time of 6 hours (Required Action J.1) is reasonable considering that in this condition, the remaining OPERABLE train is adequate to perform the safety function and given the low probability of an event during this interval.
| |
| The Required Actions have been modified by a Note that allows bypassing one train up to 4 hours for surveillance testing, provided the other train is OPERABLE.
| |
| K.1 Condition K applies to the RTBs in MODES 1 and 2. The action addresses the train orientation of the RTS for the RTBs. With one train Cook Nuclear Plant Unit 2 B 3.3.1-35 Revision No. 17
| |
| | |
| RTS Instrumentation B 3.3.1 BASES ACTIONS (continued) inoperable, 24 hours is allowed for train corrective maintenance to restore the train to OPERABLE status. The 24 hour Completion Time is justified in Reference 11.
| |
| The Required Actions have been modified by a Note. The Note allows one train to be bypassed for up to 4 hours for surveillance testing, provided the other train is OPERABLE.
| |
| L.1 Condition L applies to the P-6, P-7, P-8, P-10, and P-13 interlocks. With one or more channels inoperable, the associated interlock must be verified to be in its required state for the existing unit condition within 1 hour. Verifying the interlock status manually accomplishes the interlock's Function. The Completion Time of 1 hour is based on operating experience and the minimum amount of time allowed for manual operator actions.
| |
| M.1 Condition M applies to the RTB Undervoltage and Shunt Trip Mechanisms (i.e., the diverse trip features) in MODES 1 and 2. With one of the diverse trip features inoperable, it must be restored to an OPERABLE status within 48 hours.
| |
| The Completion Time of 48 hours for Required Action M.1 is reasonable considering that in this Condition there is one remaining diverse feature for the affected RTB, and one OPERABLE RTB capable of performing the safety function and given the low probability of an event occurring during this interval.
| |
| N.1 If any Required Action and associated Completion Time cannot be met, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to MODE 1 below the P-7 interlock within 6 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| O.1 If any Required Action and associated Completion Time cannot be met, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to MODE 1 below the P-8 Cook Nuclear Plant Unit 2 B 3.3.1-36 Revision No. 17
| |
| | |
| RTS Instrumentation B 3.3.1 BASES ACTIONS (continued) interlock within 6 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| P.1 If any Required Action and associated Completion Time cannot be met, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to MODE 2 within 6 hours.
| |
| The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| Q.1 If any Required Action and associated Completion Time cannot be met, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to MODE 3 within 6 hours.
| |
| The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| R.1 and R.2 If any Required Action and associated Completion Time cannot be met, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must immediately initiate action to fully insert all rods and place the Rod Control System incapable of rod withdrawal within 1 hour. The additional hour provides sufficient time to accomplish the action in an orderly manner. With rods fully inserted and the Rod Control System incapable of rod withdrawal, these Functions are no longer required.
| |
| SURVEILLANCE The SRs for each RTS Function are identified by the SRs column of REQUIREMENTS Table 3.3.1-1 for that Function.
| |
| A Note has been added to the SR Table stating that Table 3.3.1-1 determines which SRs apply to which RTS Functions.
| |
| Note that each channel of process protection supplies both trains of the RTS. When testing Channel I, Train A and Train B must be examined.
| |
| Similarly, Train A and Train B must be examined when testing Channel II, Channel III, and Channel IV (if applicable). The CHANNEL CALIBRATION and COTs are performed in a manner that is consistent with the assumptions used in analytically calculating the required channel accuracies.
| |
| Cook Nuclear Plant Unit 2 B 3.3.1-37 Revision No. 17
| |
| | |
| RTS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.3.1.1 Performance of the CHANNEL CHECK ensures that gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
| |
| Agreement criteria are determined by the unit staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.1.2 SR 3.3.1.2 compares the calorimetric heat balance calculation to the NIS channel output. If the calorimetric exceeds the NIS channel output by
| |
| > 2% RTP, the NIS is not declared inoperable, but must be adjusted. If the NIS channel output cannot be properly adjusted, the channel is declared inoperable.
| |
| Two Notes modify SR 3.3.1.2. The first Note indicates that the NIS channel output shall be adjusted consistent with the calorimetric results if the absolute difference between the NIS channel output and the calorimetric is > 2% RTP. The second Note clarifies that this Surveillance is required only if reactor power is 15% RTP and that 12 hours is allowed for performing the first Surveillance after reaching 15% RTP. At lower power levels, calorimetric data are inaccurate.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Cook Nuclear Plant Unit 2 B 3.3.1-38 Revision No. 60
| |
| | |
| RTS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.3.1.3 SR 3.3.1.3 compares the incore system to the NIS channel output. If the absolute difference is 3%, the NIS channel is still OPERABLE, but must be readjusted.
| |
| If the NIS channel cannot be properly readjusted, the channel is declared inoperable. This Surveillance is performed to verify the f(I) input to the Overtemperature T Function.
| |
| Two Notes modify SR 3.3.1.3. Note 1 indicates that the excore NIS channel shall be adjusted if the absolute difference between the incore and excore AFD is 3%. Note 2 clarifies that the Surveillance is required only if reactor power is 15% RTP and that 24 hours is allowed for performing the first Surveillance after reaching 15% RTP.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.1.4 SR 3.3.1.4 is the performance of a TADOT. This test shall verify OPERABILITY by actuation of the end devices. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable TADOT of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.
| |
| The RTB test shall include separate verification of the undervoltage and shunt trip mechanisms. Independent verification of RTB undervoltage and shunt trip Function is not required for the bypass breakers. No capability is provided for performing such a test at power. The independent test for bypass breakers is included in SR 3.3.1.17. The bypass breaker test shall include a local shunt trip. A Note has been added to indicate that this test must be performed on the bypass breaker prior to placing it in service.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program Cook Nuclear Plant Unit 2 B 3.3.1-39 Revision No. 60
| |
| | |
| RTS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.3.1.5 SR 3.3.1.5 is the performance of an ACTUATION LOGIC TEST. The SSPS is tested, using the semiautomatic tester. The train being tested is placed in the bypass condition, thus preventing inadvertent actuation.
| |
| Through the semiautomatic tester, all possible logic combinations, with and without applicable permissives, are tested for each protection function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.1.6 SR 3.3.1.6 is the performance of a TADOT. This test applies to the SI Input from ESFAS Function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable TADOT of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.1.7 SR 3.3.1.7 is a calibration of the excore channels to the incore channels.
| |
| If the measurements do not agree, the excore channels are not declared inoperable but must be calibrated to agree with the incore detector measurements. If the excore channels cannot be adjusted, the channels are declared inoperable. This Surveillance is performed to verify the f(I) input to the Overtemperature T Function.
| |
| A Note modifies SR 3.3.1.7. The Note states that this Surveillance is required only if reactor power is > 50% RTP and that 24 hours is allowed for performing the first surveillance after reaching 50% RTP.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Cook Nuclear Plant Unit 2 B 3.3.1-40 Revision No. 60
| |
| | |
| RTS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.3.1.8 A COT is performed on each required channel to ensure the entire channel will perform the intended Function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable COT of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.
| |
| Setpoints must be within the Allowable Values specified in Table 3.3.1-1.
| |
| The difference between the current "as found" values and the previous test "as left" values must be consistent with the drift allowance used in the setpoint methodology. The setpoint shall be left set consistent with the assumptions of the current unit specific setpoint methodology.
| |
| The "as found" and "as left" values must also be recorded and reviewed for consistency with the assumptions of Reference 8.
| |
| SR 3.3.1.8 is modified by a Note that provides a 12 hour delay in the requirement to perform this Surveillance for Function 2.b channels after reducing THERMAL POWER below the P-10 interlock. The Frequency of 12 hours after reducing power below P-10 allows a normal shutdown to be completed and the unit removed from the MODE of Applicability for this Surveillance without a delay to perform the testing required by this Surveillance.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.1.9 CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy.
| |
| CHANNEL CALIBRATIONS must be performed consistent with the assumptions of the unit specific setpoint methodology. The difference between the current "as found" values and the previous test "as left" values must be consistent with the drift allowance used in the setpoint methodology.
| |
| Cook Nuclear Plant Unit 2 B 3.3.1-41 Revision No. 60
| |
| | |
| RTS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by a Note that states that neutron detectors are excluded from the CHANNEL CALIBRATION. Changes in power range neutron detector sensitivity are compensated for by normalization of the channel output based on a power calorimetric and flux map performed above 15% RTP (SR 3.3.1.2).
| |
| SR 3.3.1.10 SR 3.3.1.10 is the performance of a TADOT. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable TADOT of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.
| |
| The SR is modified by a Note that excludes verification of relay setpoints from the TADOT. Since this SR applies to RCP undervoltage and underfrequency relays, setpoint verification requires elaborate bench calibration and is accomplished during the CHANNEL CALIBRATION.
| |
| SR 3.3.1.11 SR 3.3.1.11 is the performance of a COT. A COT is performed on each required channel to ensure the entire channel will perform the intended Function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable COT of a relay.
| |
| This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. Setpoints must be within the Allowable Values specified in Table 3.3.1-1.
| |
| The difference between the current "as found" values and the previous test "as left" values must be consistent with the drift allowance used in the setpoint methodology. The setpoint shall be left set consistent with the assumptions of the current unit specific setpoint methodology.
| |
| Cook Nuclear Plant Unit 2 B 3.3.1-42 Revision No. 60
| |
| | |
| RTS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| The "as found" and "as left" values must also be recorded and reviewed for consistency with the assumptions of Reference 8.
| |
| The Frequency is modified by two Notes. Note 1 provides a 12 hour delay in the requirement to perform this Surveillance for intermediate range instrumentation after reducing THERMAL POWER below the P-10 interlock. The Frequency of 12 hours after reducing power below P-10 allows a normal shutdown to be completed and the unit removed from the MODE of Applicability for this Surveillance without a delay to perform the testing required by this Surveillance. Note 2 provides a 4 hour delay in the requirement to perform this Surveillance for source range instrumentation after THERMAL POWER is reduced below the P-6 interlock. This Note allows a normal shutdown to proceed without a delay for testing in MODE 2 and for a short time in MODE 3 until the RTBs are open and SR 3.3.1.11 is no longer required to be performed. If the unit is to be in MODE 3 with the RTBs closed for > 4 hours this Surveillance must be performed prior to 4 hours after THERMAL POWER is reduced below the P-6 interlock.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.1.12 CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy.
| |
| CHANNEL CALIBRATIONS must be performed consistent with the assumptions of the unit specific setpoint methodology. The difference between the current "as found" values and the previous test "as left" values must be consistent with the drift allowance used in the setpoint methodology.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.1.13 CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy.
| |
| Cook Nuclear Plant Unit 2 B 3.3.1-43 Revision No. 60
| |
| | |
| RTS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| CHANNEL CALIBRATIONS must be performed consistent with the assumptions of the unit specific setpoint methodology. The difference between the current "as found" values and the previous test "as left" values must be consistent with the drift allowance used in the setpoint methodology.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.1.14 SR 3.3.1.14 is the performance of a CHANNEL CALIBRATION.
| |
| CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The CHANNEL CALIBRATION for the source range neutron detectors also includes obtaining the detector plateau or preamp discriminator curves, evaluating those curves, and comparing the curves to the manufacturer's data. This SR is modified by a Note stating that neutron detectors are excluded from the CHANNEL CALIBRATION.
| |
| Changes in power range neutron detector sensitivity are compensated for by normalization of the channel output based on a power calorimetric and flux map performed above 15% RTP (SR 3.3.1.2). Changes in intermediate range neutron flux detector sensitivity are compensated for by periodically evaluating the compensating voltage setting and making adjustments as necessary. Changes in source range neutron detector sensitivity are compensated for by periodically obtaining the detector plateau or preamp discriminator curves, evaluating those curves, comparing the curves to the manufacturers data, and adjusting the channel output as necessary.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.1.15 SR 3.3.1.15 is the performance of a CHANNEL CALIBRATION, as described in SR 3.3.1.13. Whenever a sensing element is replaced, the next required CHANNEL CALIBRATION of the resistance temperature detectors (RTD) sensors is accomplished by an inplace cross calibration that compares the other sensing elements with the recently installed sensing element.
| |
| Cook Nuclear Plant Unit 2 B 3.3.1-44 Revision No. 60
| |
| | |
| RTS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by a Note that provides a 72 hour delay in the requirement to perform a normalization of the T channels after THERMAL POWER is 98% RTP. The intent of this Note is to maintain reactor power at a nominal 97% RTP to 98% RTP level until the T normalization is complete before increasing reactor power to 100% RTP.
| |
| SR 3.3.1.16 SR 3.3.1.16 is the performance of a COT of RTS interlocks. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable COT of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.1.17 SR 3.3.1.17 is the performance of a TADOT of the Manual Reactor Trip (including reactor trip bypass breakers) and RCP Breaker Position. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable TADOT of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. The test shall independently verify the OPERABILITY of the undervoltage and shunt trip mechanisms for the Manual Reactor Trip Function for the Reactor Trip Breakers and Reactor Trip Bypass Breakers. The Reactor Trip Bypass Breaker test shall include testing of the automatic undervoltage trip.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Cook Nuclear Plant Unit 2 B 3.3.1-45 Revision No. 60
| |
| | |
| RTS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.3.1.18 SR 3.3.1.18 is the performance of a TADOT of Turbine Trip Functions. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable TADOT of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. This TADOT is as described in SR 3.3.1.4, except that this test is performed prior to exceeding the P-8 interlock whenever the unit has been in MODE 3. This Surveillance is not required if it has been performed within the previous 31 days. Verification of the Trip Setpoint does not have to be performed for this Surveillance. Performance of this test will ensure that the turbine trip Function is OPERABLE prior to exceeding the P-8 interlock.
| |
| SR 3.3.1.19 SR 3.3.1.19 verifies that the individual channel/train actuation response times are less than or equal to the maximum values assumed in the accident analysis. Response time testing acceptance criteria are included in UFSAR, Table 7.2-6 (Ref. 12). Individual component response times are not modeled in the analyses.
| |
| The analyses model the overall or total elapsed time, from the point at which the parameter exceeds the trip setpoint value at the sensor to the point at which the equipment reaches the required functional state (i.e.,
| |
| control and shutdown rods fully inserted in the reactor core).
| |
| For channels that include dynamic transfer Functions (e.g., lag, lead/lag, rate/lag, etc.), the response time test may be performed with the transfer Function set to one, with the resulting measured response time compared to the appropriate UFSAR response time. Alternately, the response time test can be performed with the time constants set to their nominal value, provided the required response time is analytically calculated assuming the time constants are set at their nominal values. The response time may be measured by a series of overlapping tests such that the entire response time is measured.
| |
| Cook Nuclear Plant Unit 2 B 3.3.1-46 Revision No. 60
| |
| | |
| RTS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| Response time may be verified by actual response time tests in any series of sequential, overlapping or total channel measurements, or by the summation of allocated sensor, signal processing and actuation logic response times with actual response time tests on the remainder of the channel. Allocations for sensor response times may be obtained from:
| |
| (1) historical records based on acceptable response time tests (hydraulic, noise, or power interrupt tests), (2) in place, onsite, or offsite (e.g.,
| |
| vendor) test measurements, or (3) utilizing vendor engineering specifications. WCAP-13632-P-A, Revision 2, "Elimination of Pressure Sensor Response Time Testing Requirements," (Ref. 13) provides the basis and methodology for using allocated sensor response times in the overall verification of the channel response time for specific sensors identified in the WCAP. Response time verification for other sensor types must be demonstrated by test.
| |
| WCAP-14036-P, Revision 1, "Elimination of Periodic Protection Channel Response Time Tests," (Ref. 14) provides the basis and methodology for using allocated signal processing and actuation logic response times in the overall verification of the protection system channel response time.
| |
| The allocations for sensor, signal conditioning, and actuation logic response times must be verified prior to placing the component in operational service and re-verified following maintenance that may adversely affect response time. In general, electrical repair work does not impact response time provided the parts used for repair are of the same type and value. Specific components identified in the WCAP may be replaced without verification testing. One example where response time could be affected is replacing the sensing assembly of a transmitter.
| |
| The response time may be verified for components that replace the components that were previously evaluated in Ref. 13 and Ref. 14, provided that the components have been evaluated in accordance with the NRC approved methodology as discussed in Attachment 1 to TSTF-569, "Methodology to Eliminate Pressure Sensor and Protection Channel Response Time Testing," (Ref. 15).
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.1.19 is modified by a Note stating that neutron detectors are excluded from RTS RESPONSE TIME testing. This Note is necessary because of the difficulty in generating an appropriate detector input signal. Excluding the detectors is acceptable because the principles of detector operation ensure a virtually instantaneous response.
| |
| The response time testing of the neutron flux signal portion of the channel shall be measured from either the detector output or the input of the first electronic component in the channel.
| |
| Cook Nuclear Plant Unit 2 B 3.3.1-47 Revision No. 79
| |
| | |
| RTS Instrumentation B 3.3.1 BASES REFERENCES 1. Regulatory Guide 1.105, Revision 3, "Setpoints for Safety Related Instrumentation."
| |
| : 2. UFSAR, Chapter 7.
| |
| : 3. Technical Requirements Manual.
| |
| : 4. IEEE-279, "Proposed Criteria for Nuclear Power Plant Protection Systems," August 1968.
| |
| : 5. UFSAR, Table 7.2-1.
| |
| : 6. UFSAR, Table 14.1.0-4.
| |
| : 7. 10 CFR 50.49.
| |
| : 8. WCAP-12741, "Westinghouse Menu Driven Setpoint Calculation Program (STEPIT)," as approved in Unit 1 and Unit 2 License Amendments 175 and 160, dated May 13, 1994.
| |
| : 9. UFSAR, Chapter 14.
| |
| : 10. WCAP-10271-P-A, "Evaluation of Surveillance Frequencies and Out of Service Times for the Reactor Protection Instrumentation System,"
| |
| including Supplement 1, May 1986, and Supplement 2, Rev. 1, June 1990.
| |
| : 11. WCAP-15376, "Risk-Informed Assessment of the RTS and ESFAS Surveillance Test Intervals and Reactor Trip Breaker Test and Completion Times," October 2000.
| |
| : 12. UFSAR, Table 7.2-6.
| |
| : 13. WCAP-13632-P-A, Revision 2, "Elimination of Pressure Sensor Response Time Testing Requirements," January 1996.
| |
| : 14. WCAP-14036-P, Revision 1, "Elimination of Periodic Protection Channel Response Time Tests," December 1995.
| |
| : 15. Attachment 1 to TSTF-569, "Methodology to Eliminate Pressure Sensor and Protection Channel Response Time Testing."
| |
| Cook Nuclear Plant Unit 2 B 3.3.1-48 Revision No. 79
| |
| | |
| ESFAS Instrumentation B 3.3.2 B 3.3 INSTRUMENTATION B 3.3.2 Engineered Safety Feature Actuation System (ESFAS) Instrumentation BASES BACKGROUND The ESFAS initiates necessary safety systems, based on the values of selected unit parameters, to protect against violating core design limits and the Reactor Coolant System (RCS) pressure boundary, and to mitigate accidents.
| |
| The ESFAS instrumentation is segmented into three distinct but interconnected modules as identified below:
| |
| * Field transmitters or process sensors and instrumentation: provide a measurable electronic signal based on the physical characteristics of the parameter being measured;
| |
| * Signal Process Control and Protection System, including analog/digital protection system, field contacts, and protection channel sets: provide signal conditioning, bistable setpoint comparison, process algorithm actuation, compatible electrical signal output to protection system devices, and control board/control room/miscellaneous indications; and
| |
| * Solid State Protection System (SSPS) including input, logic, and output bays: initiates the proper unit shutdown or engineered safety feature (ESF) actuation in accordance with the defined logic and based on the bistable outputs from the signal process control and protection system.
| |
| The Allowable Value in conjunction with the trip setpoint and LCO establishes the threshold for ESFAS action to prevent exceeding acceptable limits such that the consequences of Design Basis Accidents (DBAs) will be acceptable. The Allowable Value is considered a limiting value such that a channel is OPERABLE if the setpoint is found not to exceed the Allowable Value during the CHANNEL OPERATIONAL TEST (COT). Note that, although a channel is "OPERABLE" under these circumstances, the ESFAS setpoint must be left adjusted to within the established calibration tolerance band of the ESFAS setpoint in accordance with the uncertainty assumptions stated in the referenced setpoint methodology, (as-left criteria) and confirmed to be operating within the statistical allowances of the uncertainty terms assigned.
| |
| Cook Nuclear Plant Unit 2 B 3.3.2-1 Revision No. 0
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES BACKGROUND (continued)
| |
| Field Transmitters or Sensors To meet the design demands for redundancy and reliability, more than one, and often as many as four, field transmitters or sensors are used to measure unit parameters. In many cases, field transmitters or sensors that input to the ESFAS are shared with the Reactor Trip System (RTS).
| |
| In some cases, the same channels also provide control system inputs.
| |
| To account for calibration tolerances and instrument drift, which are assumed to occur between calibrations, statistical allowances are provided in the trip setpoint and Allowable Values. The OPERABILITY of each transmitter or sensor is determined by either "as-found" calibration data evaluated during the CHANNEL CALIBRATION or by qualitative assessment of field transmitter or sensor, as related to the channel behavior observed during performance of the CHANNEL CHECK.
| |
| Signal Process Control and Protection System Generally, three or four channels of process control equipment are used for the signal processing of unit parameters measured by the field instruments. The process control equipment provides signal conditioning, comparable output signals for instruments located on the main control board, and comparison of measured input signals with setpoints established by safety analyses. These setpoints are defined in the Technical Requirements Manual (Ref. 1). If the measured value of a unit parameter exceeds the predetermined setpoint, an output from a bistable is forwarded to the SSPS for decision evaluation. Channel separation is maintained up to and through the input bays. However, not all unit parameters require four channels of sensor measurement and signal processing. Some unit parameters provide input only to the SSPS, while others provide input to the SSPS, the main control board, the unit computer, and one or more control systems.
| |
| Generally, if a parameter is used only for input to the protection circuits, three channels with a two-out-of-three logic are sufficient to provide the required reliability and redundancy. If one channel fails in a direction that would not result in a partial Function trip, the Function is still OPERABLE with a two-out-of-two logic. If one channel fails such that a partial Function trip occurs, a trip will not occur and the Function is still OPERABLE with a one-out-of-two logic.
| |
| Generally, if a parameter is used for input to the SSPS and a control function, four channels with a two-out-of-four logic are sufficient to provide the required reliability and redundancy. As described in Reference 2, Cook Nuclear Plant Unit 2 B 3.3.2-2 Revision No. 0
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES BACKGROUND (continued) where a unit condition that requires protective action can be brought on by a failure or malfunction of the control system, and the same failure or malfunction prevents proper action of a protection system channel or channels designed to protect against the resultant unsafe condition, the remaining portions of the protection system shall be independently capable of withstanding a single failure and automatically initiating appropriate protective action. For CNP, the protection system is designed to be independent of the status of the control system. However, the control system does derive signals from the protection systems through isolation amplifiers, which are part of the protection system. The isolation amplifiers prevent perturbation of the protection signal (input) due to disturbances of the isolated signal (output) which could occur near any termination of the output wiring external to the protection and safeguards racks. As such, other acceptable logic designs (e.g.,
| |
| two-out-of-three logic) exist for parameters that are used as inputs to SSPS and a control function. Also, additional redundancy is warranted for those Functions whose channels energize to trip, even if they are not used as a control function. The actual number of channels required for each unit parameter is specified in Reference 3.
| |
| Allowable Values and ESFAS Setpoints The trip setpoints used in the bistables are based on the analytical limits stated in Reference 4 or design limits. The selection of these trip setpoints is such that adequate protection is provided when all sensor and processing time delays are taken into account. To allow for calibration tolerances, instrumentation uncertainties, instrument drift, and severe environment errors for those ESFAS channels that must function in harsh environments as defined by 10 CFR 50.49 (Ref. 5), the Allowable Values specified in Table 3.3.2-1 in the accompanying LCO are conservative with respect to the analytical limits or design limits. A detailed description of the methodology used to calculate the Allowable Values and ESFAS setpoints including their explicit uncertainties, is provided in the plant specific setpoint methodology study (Ref. 6) which incorporates all of the known uncertainties applicable to each channel.
| |
| The magnitudes of these uncertainties are factored into the determination of each ESFAS setpoint and corresponding Allowable Value. The nominal ESFAS setpoint entered into the bistable is more conservative than that specified by the Allowable Value to account for measurement errors detectable by the COT. The Allowable Value serves as the Technical Specification OPERABILITY limit for the purpose of the COT.
| |
| One example of such a change in measurement error is drift during the surveillance interval. If the measured setpoint does not exceed the Allowable Value, the bistable is considered OPERABLE.
| |
| Cook Nuclear Plant Unit 2 B 3.3.2-3 Revision No. 0
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES BACKGROUND (continued)
| |
| The ESFAS setpoints are the values at which the bistables are set and are the expected value to be achieved during calibration. The ESFAS setpoint value ensures the safety analysis limits are met for the surveillance interval selected when a channel is adjusted based on stated channel uncertainties. Any bistable is considered to be properly adjusted when the "as-left" setpoint value is within the band for CHANNEL CALIBRATION uncertainty allowance (i.e., calibration tolerance uncertainties). The ESFAS setpoint value is therefore considered a "nominal value" (i.e., expressed as a value without inequalities) for the purposes of the COT and CHANNEL CALIBRATION.
| |
| Setpoints adjusted consistent with the requirements of the Allowable Value ensure that the consequences of Design Basis Accidents (DBAs) will be acceptable, providing the unit is operated from within the LCOs at the onset of the DBA and the equipment functions as designed.
| |
| Each channel can be tested on line to verify that the signal processing equipment and setpoint accuracy is within the specified allowance requirements of Reference 6. Once a designated channel is taken out of service for testing, a simulated signal is injected in place of the field instrument signal. The process equipment for the channel in test is then tested, verified, and calibrated. SRs for the channels are specified in the SR section.
| |
| Solid State Protection System The SSPS equipment is used for the decision logic processing of outputs from the signal processing equipment bistables. To meet the redundancy requirements, two trains of SSPS, each performing the same functions, are provided. If one train is taken out of service for maintenance or test purposes, the second train will provide ESF actuation for the unit. If both trains are taken out of service or placed in test, a reactor trip will result.
| |
| Each train is packaged in its own set of cabinets for physical and electrical separation to satisfy separation and independence requirements.
| |
| The SSPS performs the decision logic for most ESF equipment actuation; generates the electrical output signals that initiate the required actuation; and provides the status, permissive, and annunciator output signals to the main control room of the unit.
| |
| The bistable outputs from the signal processing equipment are sensed by the SSPS equipment and combined into logic matrices that represent combinations indicative of various transients. If a required logic matrix Cook Nuclear Plant Unit 2 B 3.3.2-4 Revision No. 0
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES BACKGROUND (continued) combination is completed, the system will send actuation signals via master and slave relays to those components whose aggregate Function best serves to alleviate the condition and restore the unit to a safe condition. Examples are given in the Applicable Safety Analyses, LCO, and Applicability sections of this Bases.
| |
| Each SSPS train has a built in testing device that can automatically test the decision logic matrix functions and the actuation devices while the unit is at power. When any one train is taken out of service for testing, the other train is capable of providing unit monitoring and protection until the testing has been completed. The testing device is semiautomatic to minimize testing time.
| |
| The actuation of ESF components is accomplished through master and slave relays. The SSPS energizes the master relays appropriate for the condition of the unit. Each master relay then energizes one or more slave relays, which then cause actuation of the end devices. The master and slave relays are routinely tested to ensure proper operation.
| |
| APPLICABLE Each of the analyzed accidents can be detected by one or more ESFAS SAFETY Functions. One of the ESFAS Functions is the primary actuation signal ANALYSES, LCO, for that accident. An ESFAS Function may be the primary actuation and APPLICABILITY signal for more than one type of accident. An ESFAS Function may also be a secondary, or backup, actuation signal for one or more other accidents. Functions such as manual initiation, not specifically credited in the accident safety analysis, are qualitatively credited in the safety analysis and the NRC staff approved licensing basis for the unit. These Functions may provide protection for conditions that do not require dynamic transient analysis to demonstrate Function performance. These Functions may also serve as backups to Functions that were credited in the accident analysis (Ref. 7).
| |
| The LCO requires all instrumentation performing an ESFAS Function listed in Table 3.3.2-1 to be OPERABLE. A channel is OPERABLE with a trip setpoint value outside its calibration tolerance band provided the trip setpoint "as-found" value does not exceed its associated Allowable Value and provided the trip setpoint "as-left" value is adjusted to a value within the calibration tolerance band of the Nominal Trip Setpoint. A trip setpoint may be set more conservative than the Nominal Trip Setpoint as necessary in response to unit conditions. Failure of any instrument renders the affected channel(s) inoperable and reduces the reliability of the affected Functions.
| |
| Cook Nuclear Plant Unit 2 B 3.3.2-5 Revision No. 0
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| The LCO generally requires OPERABILITY of four or three channels in each instrumentation function and two channels in each logic and manual initiation function. The two-out-of-three and the two-out-of-four configurations allow one channel to be tripped during maintenance or testing without causing an ESFAS initiation. Normally, two logic or manual initiation channels are required to ensure no single random failure disables the ESFAS.
| |
| The required channels of ESFAS instrumentation provide unit protection in the event of any of the analyzed accidents. ESFAS protection functions are as follows:
| |
| : 1. Safety Injection Safety Injection (SI) provides two primary functions:
| |
| : 1. Primary side water addition to ensure maintenance or recovery of reactor vessel water level (coverage of the active fuel for heat removal, clad integrity, and for limiting peak clad temperature to
| |
| < 2200°F); and
| |
| : 2. Boration to ensure recovery and maintenance of SDM (keff < 1.0).
| |
| These functions are necessary to mitigate the effects of DBAs both inside and outside of containment. The SI signal is also used to initiate other Functions such as:
| |
| * Phase A Containment Isolation;
| |
| * Containment Purge Supply and Exhaust System Isolation;
| |
| * Reactor Trip;
| |
| * Turbine Trip;
| |
| * Feedwater Isolation;
| |
| * Start of motor driven auxiliary feedwater (AFW) pumps;
| |
| * Actuation of Control Room Emergency Ventilation (CREV)
| |
| System for Units 1 and 2;
| |
| * Trip of main feedwater pumps; Cook Nuclear Plant Unit 2 B 3.3.2-6 Revision No. 0
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| * Actuation of Essential Service Water (ESW) System for Units 1 and 2;
| |
| * Actuation of Component Cooling Water (CCW) System; and
| |
| * Actuation of Engineered Safety Features (ESF) Ventilation System.
| |
| These other functions ensure:
| |
| * Isolation of nonessential systems through containment penetrations;
| |
| * Trip of the turbine and reactor to limit power generation;
| |
| * Isolation of main feedwater (MFW) to limit secondary side mass losses;
| |
| * Start of AFW to ensure secondary side cooling capability; and
| |
| * Isolation of the control room to ensure habitability.
| |
| : a. Safety Injection - Manual Initiation The Safety Injection Manual Initiation Function is designed with two manual panel switches in each train. One switch (channel) in a train must be placed in the actuate position for the associated components in the train to receive an SI initiation signal. The LCO requires one channel per train to be OPERABLE. The operator can initiate SI at any time by using any of four panel switches in the control room. This action will cause actuation of all components of a train in the same manner as any of the automatic actuation signals.
| |
| The LCO for the Manual Initiation Function ensures the proper amount of redundancy is maintained in the manual ESFAS actuation circuitry to ensure the operator has manual ESFAS initiation capability.
| |
| Each channel consists of one panel switch and the interconnecting wiring to the actuation logic cabinet. This configuration does not allow testing at power.
| |
| Cook Nuclear Plant Unit 2 B 3.3.2-7 Revision No. 0
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| : b. Safety Injection - Automatic Actuation Logic and Actuation Relays The Safety Injection Automatic Actuation Logic and Actuation Relays Function includes two trains. The actuation of the logic in any train will actuate the associated components in the same train. This LCO requires two trains to be OPERABLE. Actuation logic consists of all circuitry housed within the actuation subsystems, including the initiating relay contacts responsible for actuating the ESF equipment.
| |
| Manual and automatic initiation of SI must be OPERABLE in MODES 1, 2, and 3. In these MODES, there is sufficient energy in the primary and secondary systems to warrant automatic initiation of ESF systems. Manual Initiation is also required in MODE 4 even though automatic actuation is not required. In this MODE, adequate time is available to manually actuate required components in the event of a DBA, but because of the large number of components actuated on a SI, actuation is simplified by the use of the manual initiation panel switches. Automatic actuation logic and actuation relays must be OPERABLE in MODE 4 to support system level manual initiation for those required OPERABLE Emergency Core Cooling System (ECCS) components in standby readiness.
| |
| These Functions are not required to be OPERABLE in MODES 5 and 6 because the ECCS Function is not required to be OPERABLE.
| |
| : c. Safety Injection - Containment Pressure - High This signal provides protection against the following accidents:
| |
| * SLB inside containment;
| |
| * LOCA; and
| |
| * Feed line break inside containment.
| |
| The Safety Injection Containment Pressure - High Function design includes three channels. This LCO requires three channels to be OPERABLE. Three OPERABLE channels are sufficient to satisfy protective requirements with a two-out-of-three logic. The transmitters (d/p cells) and electronics are located outside of containment with the sensing line located inside containment.
| |
| Cook Nuclear Plant Unit 2 B 3.3.2-8 Revision No. 0
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| Thus, the Containment Pressure - High Function components will not experience any adverse environmental conditions and the trip setpoint reflects only steady state instrument uncertainties.
| |
| Containment Pressure - High must be OPERABLE in MODES 1, 2, and 3 when there is sufficient energy in the primary and secondary systems to pressurize the containment following a pipe break. In MODE 4, the ECCS equipment (LCO 3.5.3, "ECCS Shutdown") is not required to operate on an automatic actuation signal and in MODES 5 and 6, there is insufficient energy in the primary or secondary systems to pressurize the containment.
| |
| : d. Safety Injection - Pressurizer Pressure - Low This signal provides protection against the following accidents:
| |
| * Inadvertent opening of a steam generator (SG) relief or safety valve;
| |
| * SLB;
| |
| * LOCAs; and
| |
| * SG Tube Rupture.
| |
| The Safety Injection Pressurizer Pressure - Low Function design includes three channels arranged in a two-out-of-three logic.
| |
| This LCO requires three channels to be OPERABLE.
| |
| The transmitters are located inside containment, with the taps in the vapor space region of the pressurizer, and thus possibly experiencing adverse environmental conditions (LOCA, SLB inside containment). Therefore, the trip setpoint reflects the inclusion of both steady state and adverse environmental instrument uncertainties.
| |
| This Function must be OPERABLE in MODES 1, 2, and 3 (above P-11) to mitigate the consequences of an accident previously described. This signal may be manually blocked by the operator below the P-11 setpoint. Automatic SI actuation below this pressure setpoint is then performed by the Containment Pressure - High signal.
| |
| Cook Nuclear Plant Unit 2 B 3.3.2-9 Revision No. 0
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| This Function is not required to be OPERABLE in MODE 3 below the P-11 setpoint. Other ESF functions are used to detect accident conditions and actuate the ESF systems in this MODE.
| |
| In MODES 4, 5, and 6, this Function is not needed for accident detection and mitigation.
| |
| : e. Safety Injection - Steam Line Pressure (1) Steam Line Pressure - Low Steam Line Pressure - Low provides protection against the following accidents:
| |
| * SLB;
| |
| * Feed line break; and
| |
| * Inadvertent opening of a SG power operated relief or a main steam safety valve.
| |
| The Safety Injection Steam Line Pressure - Low Function design includes four channels (one on each steam line) arranged in a two-out-of-four logic. The LCO requires one channel per steam line for a total of four channels to be OPERABLE.
| |
| With the transmitters located inside the auxiliary building, it is not possible for them to experience adverse environmental conditions during a secondary side break.
| |
| Therefore, the trip setpoint only reflects steady state environmental instrument uncertainties.
| |
| This Function is anticipatory in nature and has a typical lead/lag ratio of 50/5.
| |
| Steam Line Pressure - Low must be OPERABLE in MODES 1, 2, and 3 (above P-12) when a secondary side break or stuck open valve could result in the rapid depressurization of the steam lines. This signal may be manually blocked by the operator below the P-12 setpoint.
| |
| Below P-12, feed line break is not a concern. A steam line rupture occurring inside containment will be terminated by automatic SI actuation via Containment Pressure - High.
| |
| Cook Nuclear Plant Unit 2 B 3.3.2-10 Revision No. 0
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| This Function is not required to be OPERABLE in MODE 3 below P-12, and MODE 4, 5, or 6 because there is insufficient energy in the secondary side of the unit to cause an accident.
| |
| (2) Steam Line Pressure - High Differential Pressure Between Steam Lines (per steam line)
| |
| Steam Line Pressure - High Differential Pressure Between Steam Lines provides protection against the following accidents:
| |
| * SLB;
| |
| * Feed line break; and
| |
| * Inadvertent opening of an SG power operated relief or a main steam safety valve.
| |
| The Steam Line Pressure - High Differential Pressure Between Steam Lines Function design includes three channels for each steam line with a two-out-of-three logic for each steam line. The pressure associated with a steam line is compared to the pressure in the three other steam lines.
| |
| If two channels associated with any given steam line indicate high differential pressure, an SI signal is generated.
| |
| This LCO requires three channels per steam line to be OPERABLE. Each steam line is treated separately and each steam line is considered a separate Function.
| |
| Therefore, separate Condition entry is allowed for each steam line. This is acceptable since each steam line has three channels (with two out of three necessary for a high differential pressure between steam lines signal), and the channels of one steam line are independent from the channels of the other steam lines.
| |
| With the transmitters located inside the auxiliary building, it is not possible for them to experience adverse environmental conditions during an SLB event. Therefore, the trip setpoint only reflects steady state environmental instrument uncertainties. Steam line high differential pressure must be OPERABLE in MODES 1, 2, and 3 (above P-12) when a secondary side break or stuck open valve could result in the rapid depressurization of the steam Cook Nuclear Plant Unit 2 B 3.3.2-11 Revision No. 0
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) line(s). This Function is not required to be OPERABLE in MODE 3 below P-12, and MODE 4, 5, or 6 because there is not sufficient energy in the secondary side of the unit to cause an accident.
| |
| : 2. Containment Spray Containment Spray provides three primary functions:
| |
| : 1. Lowers containment pressure and temperature after an accident in containment;
| |
| : 2. Reduces the amount of radioactive iodine in the containment atmosphere; and
| |
| : 3. Adjusts the pH of the water in the containment recirculation sump after a large break LOCA.
| |
| These functions are necessary to:
| |
| * Ensure the pressure boundary integrity of the containment structure;
| |
| * Limit the release of radioactive iodine to the environment in the event of a failure of the containment structure; and
| |
| * Minimize corrosion of the components and systems inside containment following a LOCA.
| |
| The containment spray actuation signal starts the containment spray pumps (via the Phase B isolation signal), aligns the discharge of the pumps to the containment spray nozzle headers in the upper levels of containment and aligns the valves associated with the Spray Additive System. Water is initially drawn from the RWST by the containment spray pumps and mixed with a sodium hydroxide solution from the spray additive tank. When the RWST reaches a level indicating a sufficient volume has been transferred to containment, the operator aligns the spray pump suctions to the containment recirculation sump if continued containment spray is required. Containment spray is actuated automatically by Containment Pressure - High High.
| |
| Cook Nuclear Plant Unit 2 B 3.3.2-12 Revision No. 0
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| : a. Containment Spray - Manual Initiation The operator can initiate containment spray at any time from the control room by turning the containment spray actuation switch for either train. There are two switches in the control room.
| |
| Turning a switch will actuate containment spray in the associated train. Two Manual Initiation switches are required to be OPERABLE to ensure no single failure disables the Manual Initiation Function. Note that Manual Initiation of containment spray also actuates Phase B containment isolation.
| |
| : b. Containment Spray - Automatic Actuation Logic and Actuation Relays The Containment Spray Automatic Actuation Logic and Actuation Relays design includes two trains. The actuation of a train will actuate the associated containment spray train. This LCO requires two trains to be OPERABLE. Actuation logic consists of all circuitry housed within the actuation subsystems, including the initiating relay contacts responsible for actuating the Containment Spray System.
| |
| Manual and automatic initiation of containment spray must be OPERABLE in MODES 1, 2, and 3 when there is a potential for an accident to occur, and sufficient energy in the primary or secondary systems to pose a threat to containment integrity due to overpressure conditions. Manual initiation is also required in MODE 4, even though automatic actuation is not required. In this MODE, adequate time is available to manually actuate required components in the event of a DBA. However, because of the large number of components actuated on a containment spray, actuation is simplified by the use of the manual actuation switches. Automatic actuation logic and actuation relays must be OPERABLE in MODE 4 to support system level manual initiation. In MODES 5 and 6, there is insufficient energy in the primary and secondary systems to result in containment overpressure.
| |
| : c. Containment Spray - Containment Pressure - High High This signal provides protection against a LOCA or an SLB inside containment. The transmitters (d/p cells) are located outside of containment with the sensing line (high pressure side of the transmitter) located inside containment. The transmitters and Cook Nuclear Plant Unit 2 B 3.3.2-13 Revision No. 0
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) electronics are located outside of containment. Thus, they will not experience any adverse environmental conditions and the trip setpoint reflects only steady state instrument uncertainties.
| |
| This is one of the only Functions that requires the bistable output to energize to perform its required action. It is not desirable to have a loss of power actuate containment spray, since the consequences of an inadvertent actuation of containment spray could be serious. Note that this Function also has the inoperable channel placed in bypass rather than trip to decrease the probability of an inadvertent actuation.
| |
| The Containment Spray Containment Pressure - High High Function design includes four channels. This LCO requires all four channels to be OPERABLE. The four channels are arranged in a two-out-of-four logic configuration. Containment Pressure - High High must be OPERABLE in MODES 1, 2, and 3 when there is sufficient energy in the primary and secondary sides to pressurize the containment following a pipe break. In MODE 4, the Manual Initiation Function provides the required method for initiating the Containment Spray System. In MODES 5 and 6, there is insufficient energy in the primary and secondary sides to pressurize the containment and reach the Containment Pressure - High High setpoint.
| |
| : 3. Containment Isolation Containment Isolation provides isolation of the containment atmosphere, and all process systems that penetrate containment, from the environment. This Function is necessary to prevent or limit the release of radioactivity to the environment in the event of a large break LOCA.
| |
| There are two separate Containment Isolation signals, Phase A and Phase B. Phase A isolation isolates all automatically isolable process lines that penetrate containment, except component cooling water (CCW) to the reactor coolant pumps and non-essential service water (NESW) to the ventilation units, at a relatively low containment pressure indicative of primary or secondary system leaks. For these types of events, forced circulation cooling using the reactor coolant pumps (RCPs) and SGs is the preferred (but not required) method of decay heat removal. Since CCW is required to support RCP operation, not isolating CCW on the low pressure Phase A signal enhances unit safety by allowing operators to use forced RCS Cook Nuclear Plant Unit 2 B 3.3.2-14 Revision No. 0
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) circulation to cool the unit. Isolating CCW on the low pressure signal may force the use of feed and bleed cooling, which could prove more difficult to control. The NESW System supplies cooling water to the containment ventilation units. Since the NESW System is normally available to support containment cooling, not isolating NESW on the low pressure Phase A signal enhances unit safety by allowing operators to use the containment ventilation units to remove heat from the containment instead of using the Containment Spray System.
| |
| Phase A containment isolation is actuated automatically by SI, or manually via the automatic actuation logic. All automatically isolable process lines penetrating containment, with the exception of CCW to the reactor coolant pumps and NESW to the ventilation units, are isolated. CCW is not isolated at this time to permit continued operation of the RCPs with cooling water flow to the thermal barrier heat exchangers and oil coolers. The NESW System is not isolated at this time to permit continued operation of the containment ventilation units. All process lines not equipped with remote operated isolation valves are manually closed, or otherwise isolated, prior to reaching MODE 4.
| |
| Manual Phase A Containment Isolation is accomplished by either of two switches in the control room. One switch isolates one train while the other switch isolates the other train. Note that manual actuation of Phase A Containment Isolation also actuates Containment Purge and Exhaust Isolation.
| |
| The Phase B signal isolates CCW and NESW. This occurs at a relatively high containment pressure that is indicative of a large break LOCA or an SLB. For these events, forced circulation using the RCPs is no longer desirable. In addition, containment cooling via the containment ventilation units is no longer desirable. Isolating the CCW at the higher pressure does not pose a challenge to the containment boundary because the CCW System is a closed loop inside containment. Isolating the NESW at the higher pressure does not pose a challenge to the containment boundary since under maximum containment heat load conditions during a DBA LOCA, the Phase A and Phase B isolation signals will occur in a short time and therefore release of the containment atmosphere to the site boundary is precluded. The system is continuously pressurized to a pressure greater than the Phase B setpoint. Thus, routine operation demonstrates the integrity of the system pressure boundary for pressures exceeding the Phase B setpoint. Furthermore, because Cook Nuclear Plant Unit 2 B 3.3.2-15 Revision No. 0
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) system pressure exceeds the Phase B setpoint, any system leakage prior to initiation of Phase B isolation would be into containment.
| |
| Therefore, the combination of CCW and NESW System design and Phase B isolation ensures the CCW System and the NESW System is not a potential path for radioactive release from containment.
| |
| Phase B containment isolation is actuated by Containment Pressure - High High, or manually, via the automatic actuation logic.
| |
| For containment pressure to reach a value high enough to actuate Containment Pressure - High High, a LOCA or SLB must have occurred and containment spray must have been actuated. RCP operation will no longer be required and CCW to the RCPs is, therefore, no longer necessary. The RCPs can be operated with seal injection flow alone and without CCW flow to the thermal barrier heat exchanger. Containment ventilation operation will no longer be required since the Containment Spray System will be able to remove the containment heat load.
| |
| Manual Phase B Containment Isolation is accomplished by the same switches that actuate Containment Spray. When the switch in either train is turned, Phase B Containment Isolation, Containment Spray, and Containment Purge Supply and Exhaust System isolation will be actuated in the associated train. A Phase B Containment Isolation signal will isolate Phase B containment isolation valves and actuates the Containment Spray System pumps.
| |
| In addition, the charcoal filter bypasses associated with the Engineered Safety Features Ventilation System filter trains are automatically closed and the air is directed through the charcoal filters in addition to the roughing and high efficiency particulate air filters, as described in the Bases for ITS 3.7.12.
| |
| : a. Containment Isolation - Phase A Isolation (1) Phase A Isolation - Manual Initiation Manual Phase A Containment Isolation is actuated by either of two switches (one per train) in the control room. Each switch actuates a train. Note that manual initiation of Phase A Containment Isolation also actuates Containment Purge Supply and Exhaust System Isolation.
| |
| Cook Nuclear Plant Unit 2 B 3.3.2-16 Revision No. 0
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| (2) Phase A Isolation - Automatic Actuation Logic and Actuation Relays Automatic Actuation Logic and Actuation Relays consist of the same features and operate in the same manner as described for ESFAS Function 1.b.
| |
| Manual and automatic initiation of Phase A Containment Isolation must be OPERABLE in MODES 1, 2, and 3, when there is a potential for an accident to occur. Manual initiation is also required in MODE 4 even though automatic actuation is not required. In this MODE, adequate time is available to manually actuate required components in the event of a DBA, but because of the large number of components actuated on a Phase A Containment Isolation, actuation is simplified by the use of the manual switches.
| |
| Automatic actuation logic and actuation relays must be OPERABLE in MODE 4 to support system level manual initiation. In MODES 5 and 6, there is insufficient energy in the primary or secondary systems to pressurize the containment to require Phase A Containment Isolation.
| |
| (3) Phase A Isolation - SI Input from ESFAS Phase A Containment Isolation is also initiated by all Functions that initiate SI. The Phase A Containment Isolation requirements for these Functions are the same as the requirements for their SI Functions, with the exception of the Applicability. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all initiating Functions and requirements, with the exception of the Applicability.
| |
| : b. Containment Isolation - Phase B Isolation Phase B Containment Isolation is accomplished by Manual Initiation, Automatic Actuation Logic and Actuation Relays, and by Containment Pressure - High High channels (the same channels that actuate Containment Spray, Function 2.c). The Containment Pressure trip of Phase B Containment Isolation is energized to trip in order to minimize the potential of spurious trips that may damage the RCPs.
| |
| Cook Nuclear Plant Unit 2 B 3.3.2-17 Revision No. 0
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| (1) Phase B Isolation - Manual Initiation (2) Phase B Isolation - Automatic Actuation Logic and Actuation Relays Manual and automatic initiation of Phase B containment isolation must be OPERABLE in MODES 1, 2, and 3, when there is a potential for an accident to occur. Manual initiation is also required in MODE 4 even though automatic actuation is not required. In this MODE, adequate time is available to manually actuate required components in the event of a DBA. However, because of the large number of components actuated on a Phase B containment isolation, actuation is simplified by the use of the manual switches.
| |
| Automatic actuation logic and actuation relays must be OPERABLE in MODE 4 to support system level manual initiation. In MODES 5 and 6, there is insufficient energy in the primary or secondary systems to pressurize the containment to require Phase B containment isolation.
| |
| (3) Phase B Isolation - Containment Pressure - High High Containment Pressure - High High must be OPERABLE in MODES 1, 2, and 3 when there is sufficient energy in the primary and secondary sides to pressurize the containment following a pipe break. In MODE 4, the Manual Initiation Function provides the required method for initiating containment isolation. In MODES 5 and 6, there is insufficient energy in the primary and secondary sides to pressurize the containment and reach the Containment Pressure - High High setpoint.
| |
| : 4. Steam Line Isolation Isolation of the main steam lines provides protection in the event of an SLB inside or outside containment. Rapid isolation of the steam lines will limit the steam break accident to the blowdown from one SG, at most. For an SLB upstream of the steam generator stop valves (SGSVs), closure of the SGSVs limits the accident to the blowdown from only the affected SG. For an SLB downstream of the SGSVs, closure of the SGSVs terminates the accident. Steam Line Isolation also mitigates the effects of a feed line break and ensures a source of steam for the turbine driven AFW pump during a feed line break.
| |
| Cook Nuclear Plant Unit 2 B 3.3.2-18 Revision No. 0
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| : a. Steam Line Isolation - Manual Initiation (per steam line)
| |
| Manual initiation of Steam Line Isolation can be accomplished from the control room. There are two switches per steam line (one per train) in the control room and either switch can initiate action to immediately close the associated SGSV. The LCO requires two channels per steam line to be OPERABLE. Each steam line is treated separately and each steam line is considered a separate Function. Therefore, separate Condition entry is allowed for each steam line. This is acceptable since each steam line has two channels (with one out of two necessary for a manual initiation signal), and the channels of one steam line are independent from the channels of the other steam lines.
| |
| : b. Steam Line Isolation - Automatic Actuation Logic and Actuation Relays Automatic actuation logic and actuation relays consist of the same features and operate in the same manner as described for ESFAS Function 1.b.
| |
| Manual and automatic initiation of steam line isolation must be OPERABLE in MODES 1, 2, and 3 when there is sufficient energy in the RCS and SGs to have an SLB or other accident. This could result in the release of significant quantities of energy and cause a cooldown of the primary system. The Steam Line Isolation Function is required in MODES 2 and 3 unless all SGSVs are closed. In MODES 4, 5, and 6, there is insufficient energy in the RCS and SGs to experience a rupture of a steam line or other accident releasing significant quantities of energy.
| |
| : c. Steam Line Isolation - Containment Pressure - High High This Function actuates closure of the SGSVs in the event of an SLB inside containment to maintain at least three unfaulted SGs as a heat sink for the reactor, and to limit the mass and energy release to containment. The transmitters (d/p cells) are located outside containment with the sensing line (high pressure side of the transmitter) located inside containment. The Steam Line Isolation Containment Pressure - High High Function design includes four channels arranged in a two-out-of-four logic configuration, and are energized to trip. This LCO requires all four channels to be OPERABLE. The transmitters and electronics are located outside of containment. Thus, they will not experience any adverse environmental conditions, and the trip setpoint reflects only steady state instrument uncertainties.
| |
| Cook Nuclear Plant Unit 2 B 3.3.2-19 Revision No. 0
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| Containment Pressure - High High must be OPERABLE in MODES 1, 2, and 3, when there is sufficient energy in the primary and secondary side to pressurize the containment following a pipe break. This would cause a significant increase in the containment pressure, thus allowing detection and closure of the SGSVs. The Steam Line Isolation Function must be OPERABLE in MODES 2 and 3 unless all SGSVs are closed. In MODES 4, 5, and 6, there is not enough energy in the primary and secondary sides to pressurize the containment to the Containment Pressure - High High setpoint.
| |
| : d. Steam Line Isolation - Steam Line Pressure (1) Steam Line Pressure - Low Steam Line Pressure - Low provides closure of the SGSVs in the event of an SLB to maintain at least three unfaulted SGs as a heat sink for the reactor, and to limit the mass and energy release to containment. This Function provides closure of the SGSVs in the event of a feed line break to ensure a supply of steam for the turbine driven AFW pump.
| |
| Steam Line Pressure - Low was discussed previously under ESFAS Function 1.e.(1).
| |
| Steam Line Pressure - Low Function must be OPERABLE in MODE 1, and MODES 2 and 3 (above P-12) except when all SGSVs are closed, when a secondary side break or stuck open valve could result in the rapid depressurization of the steam lines. This signal may be manually blocked by the operator below the P-12 setpoint. Below P-12, an inside containment SLB will be terminated by automatic actuation via Containment Pressure - High High. The Steam Line Isolation Function is required in MODES 2 and 3 unless all SGSVs are closed. This Function is not required to be OPERABLE in MODE 3 below P-12, and MODES 4, 5, and 6 because there is insufficient energy in the secondary side of the unit to have an accident.
| |
| : e. Steam Line Isolation - High Steam Flow in Two Steam Lines (per steam line) Coincident with Tavg - Low Low This Function provides closure of the SGSVs during an SLB or inadvertent opening of an SG power operated relief or a main steam safety valve, to maintain three unfaulted SGs as a heat sink for the reactor and to limit the mass and energy release to containment.
| |
| Cook Nuclear Plant Unit 2 B 3.3.2-20 Revision No. 0
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| High Steam Flow in Two Steam Lines Function design includes two steam flow channels per steam line arranged in a one-out-of-two logic configuration per steam line. Tavg - Low Low Function design includes one channel per loop for a total of four channels arranged in a two-out-of-four logic configuration. Logic actuation will occur when two steam lines indicate high flow coincident with Tavg - Low Low exceeding its trip setpoint (two of the four channels). Two steam line flow channels per steam line and one Tavg - Low Low channel per loop are required to be OPERABLE to ensure no single failure will disable this Function.
| |
| In Mode 3 above P-12, it is possible to operate with one RCP out of service. In this condition, the Tavg - Low Low channel associated with the non-operating RCP loop is considered inoperable. For the High Steam Flow in Two Steam Lines portion of the Function, each steam line is treated separately and each steam line is considered a separate Function. Therefore, separate Condition entry is allowed for each steam line. This is acceptable since each steam line has two channels (with one out of two necessary for a high steam flow signal), and the channels of one steam line are independent from the channels of the other steam lines.
| |
| The one-out-of-two logic configuration allows online testing because trip of one high steam flow channel is not sufficient to cause initiation. High steam flow in two steam lines is acceptable in the case of a single steam line fault due to the fact that the remaining intact steam lines will pick up the full turbine load. The increased steam flow in the remaining intact lines will actuate the required second high steam flow trip.
| |
| The Allowable Value for high steam flow is a linear function that varies with power level. The high steam flow and Tavg transmitters are located inside containment thus, it is not possible for them to experience adverse environmental conditions during a rupture of a steam line. Therefore, the trip setpoint only reflects steady state environmental instrument uncertainties.
| |
| This Function must be OPERABLE in MODE 1 and MODES 2 and MODE 3 above P-12, when a secondary side break or stuck open valve could result in the rapid depressurization of the steam lines unless all SGSVs are closed. This Function is not required to be OPERABLE in MODE 3 below P-12, and MODES 4, 5, and 6 because there is insufficient energy in the secondary side of the unit to have an accident.
| |
| Cook Nuclear Plant Unit 2 B 3.3.2-21 Revision No. 0
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| : 5. Turbine Trip and Feedwater Isolation The primary functions of the Turbine Trip and Feedwater Isolation signals are to prevent damage to the turbine due to water in the steam lines, and to stop the excessive flow of feedwater into the SGs. These Functions are necessary to mitigate the effects of a high water level in the SGs, which could result in carryover of water into the steam lines and excessive cooldown of the primary system. The SG high water level is due to excessive feedwater flows.
| |
| The Function is actuated when the level in any SG exceeds the high high setpoint, and performs the following functions:
| |
| * Trips the main turbine;
| |
| * Trips the MFW pumps; and
| |
| * Initiates MFW isolation (main feedwater regulating valves (MFRVs) and main feedwater isolation valves (MFIVs)).
| |
| This Function is actuated by SG Water Level - High High, or by an SI signal. In the event of SI, the unit is taken off line and the turbine generator must be tripped. The MFW System is also taken out of operation and the AFW System is automatically started. The SI signal was discussed previously.
| |
| : a. Turbine Trip and Feedwater Isolation - Automatic Actuation Logic and Actuation Relays The Turbine Trip and Feedwater Isolation Automatic Actuation Logic and Actuation Relays Function includes two trains. The actuation of the logic in any train will isolate the MFRVs and trip the turbine. The actuation of the logic in Train A will isolate the MFIVs for SG-1 and SG-4, and the actuation of the logic in Train B will isolate the MFIVs for SG-2 and SG-3. Automatic Actuation Logic and Actuation Relays consist of the same features and operate in the same manner as described for ESFAS Function 1.b.
| |
| : b. Turbine Trip and Feedwater Isolation - Steam Generator Water Level - High High (per SG)
| |
| This signal provides protection against excessive feedwater flow.
| |
| The ESFAS SG water level instruments provide input to the SG Cook Nuclear Plant Unit 2 B 3.3.2-22 Revision No. 0
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| Water Level Control System. The Function is monitored by three channels on each steam generator arranged in a two-out-of-three logic arrangement for each steam generator. A SG Water Level - High High actuation signal will be generated when two of three channels associated with any one SG exceeds the trip setpoint. This LCO requires all three Steam Generator Water Level - High High channels on each SG to be OPERABLE. Each SG is treated separately and each SG is considered a separate Function. Therefore, separate Condition entry is allowed for each SG. This is acceptable since each SG has three level channels (with two out of the three necessary for a high high SG water level signal), and the channels of one SG are independent from the channels of the other SGs.
| |
| The transmitters (d/p cells) are located inside containment.
| |
| However, the events that this Function protects against cannot cause a severe environment in containment. Therefore, the trip setpoint reflects only steady state instrument uncertainties.
| |
| : c. Turbine Trip and Feedwater Isolation - SI Input from ESFAS Turbine Trip and Feedwater Isolation is also initiated by all Functions that initiate SI. The Feedwater Isolation Function requirements for these Functions are the same as the requirements for their SI function, with the exception of the Applicability. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all initiating functions and requirements, with the exception of the Applicability.
| |
| Turbine Trip and Feedwater Isolation Functions must be OPERABLE in MODE 1, and MODES 2 and 3 except when all MFIVs or MFRVs are closed and de-activated or isolated by a closed manual valve.
| |
| This is when the MFW System is in operation and the turbine generator may be in operation. In MODE 3 when all MFIVs or MFRVs are closed and de-activated or isolated by a closed manual valve and in MODES 4, 5, and 6, the MFW System and the turbine generator are not in service and this Function is not required to be OPERABLE.
| |
| : 6. Auxiliary Feedwater The AFW System is designed to provide a secondary side heat sink for the reactor in the event that the MFW System is not available.
| |
| The system has two motor driven pumps and a turbine driven pump, Cook Nuclear Plant Unit 2 B 3.3.2-23 Revision No. 0
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) making it available during normal unit operation, during a loss of AC power, a loss of MFW, and during a Feedwater System pipe break.
| |
| The normal source of water for the AFW System is the condensate storage tank (CST). An emergency water source is provided from the Essential Service Water System. Transfer is accomplished by a remotely operated, motor-operated valve and a manual valve. The AFW System is aligned so that upon a pump start, flow is initiated to the associated SG(s) immediately.
| |
| : a. Auxiliary Feedwater - Automatic Actuation Logic and Actuation Relays (Solid State Protection System)
| |
| The Auxiliary Feedwater - Automatic Actuation Logic and Actuation Relays (Solid State Protection System) Function design includes two trains. The actuation of the logic in any train will actuate the turbine driven AFW pump and valves or the associated motor driven AFW pump and valves, as applicable.
| |
| Each AFW Function, except the Loss of Voltage and Trip of all Main Feedwater Functions, input into this logic arrangement.
| |
| Automatic actuation logic and actuation relays consist of the same features and operate in the same manner as described for ESFAS Function 1.b.
| |
| : b. Auxiliary Feedwater - Automatic Actuation Logic and Actuation Relays (Balance of Plant ESFAS)
| |
| The Auxiliary Feedwater - Automatic Actuation Logic and Actuation Relays (Balance of Plant ESFAS) Function design includes two trains. The actuation of the logic in any train will actuate the associated motor driven AFW pump and valves. The Loss of Voltage and Trip of All Main Feedwater Pumps Functions input into this logic arrangement. Automatic actuation logic and actuation relays consist of the same features and operate in the same manner as described for ESFAS Function 1.b.
| |
| : c. Auxiliary Feedwater - Steam Generator Water Level - Low Low (per SG)
| |
| SG Water Level - Low Low provides protection against a loss of heat sink. A loss of MFW and a feed line break, inside or outside of containment, would result in a loss of SG water level. SG Water Level - Low Low provides input to the SG Level Control System. The Function is monitored by three channels on each SG arranged in a two-out-of-three logic arrangement for each SG. A SG Water Level - Low Low motor driven AFW actuation Cook Nuclear Plant Unit 2 B 3.3.2-24 Revision No. 0
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) signal will be generated when two of three channels associated with any one SG exceeds the trip setpoint. A SG Water Level - Low Low turbine driven AFW actuation signal will be generated when two of three channels associated with any two SGs exceeds the trip setpoint. This LCO requires all three SG Water Level - Low Low channels on each SG to be OPERABLE.
| |
| Each SG is treated separately and each SG is considered a separate Function. Therefore, separate Condition entry is allowed for each SG. This is acceptable since each SG has three level channels (with two out of the three necessary for a low low SG water level signal), and the level channels of one SG are independent from the level channels of the other SGs.
| |
| With the transmitter (d/p cells) located inside containment and thus possible experiencing adverse environmental conditions (feed line break), the trip setpoint reflects the inclusion of both steady state and adverse environmental instrument uncertainties.
| |
| : d. Auxiliary Feedwater - SI Input from ESFAS An SI signal starts the motor driven AFW pumps. The AFW initiation functions are the same as the requirements for their SI function, with the exception of the Applicability. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all initiating functions and requirements, with the exception of the Applicability.
| |
| : e. Auxiliary Feedwater - Loss of Voltage (per bus)
| |
| A loss of voltage to the 4.16 kV emergency buses could be accompanied by a loss of reactor coolant pumping power (since the RCP buses are powered from the offsite sources that also provide power to the 4.16 kV emergency buses) and the subsequent need for some method of decay heat removal. The loss of voltage is detected by a voltage drop on each 4.16 kV emergency bus. Three undervoltage relays with time delays are provided for each 4.16 kV emergency bus to detect a loss of bus voltage. The relays are combined in a two-out-of-three logic to generate a loss of voltage signal (i.e., the required number of channels required to trip to generate a loss of voltage signal is two per bus). A Loss of Voltage signal on T21A (Train B) or T21D (Train A) will start the associated motor driven feedwater pump. A Loss of Voltage signal on T21A and T21B (Train B) or T21C and T21D (Train A) will actuate the valves associated with Cook Nuclear Plant Unit 2 B 3.3.2-25 Revision No. 0
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) the motor driven feedwater pumps on both trains. This LCO requires all three Loss of Voltage channels on each bus to be OPERABLE. Each bus is treated separately and each bus is considered a separate Function. Therefore, separate Condition entry is allowed for each bus. This is acceptable since each bus has three loss of voltage channels (with two out of the three necessary for a loss of voltage signal), and the channels of one bus are independent from the channels of the other buses. The Loss of Voltage Function will ensure adequate feedwater flow for reactor decay heat and sensible heat removal following the reactor trip.
| |
| Functions 6.a through 6.e must be OPERABLE in MODES 1, 2, and 3 to ensure that the SGs remain the heat sink for the reactor.
| |
| These Functions do not have to be OPERABLE in MODES 5 and 6 because there is not enough heat being generated in the reactor to require the SGs as a heat sink. In MODE 4, AFW automatic actuation does not need to be OPERABLE because either AFW or residual heat removal (RHR) will already be in operation to remove decay heat or sufficient time is available to manually place either system in operation.
| |
| : f. Auxiliary Feedwater - Undervoltage Reactor Coolant Pump A loss of power on the buses that provide power to the RCPs provides indication of a pending loss of RCP forced flow in the RCS. The Undervoltage RCP Function senses the voltage on the RCP bus. A bus undervoltage signal is generated by one out of two undervoltage relays (channels) per reactor coolant pump bus, however the LCO requires only one per bus to be OPERABLE. While not assumed in the accident analysis, a loss of voltage on two or more RCPs will start the turbine driven AFW pump to ensure adequate feedwater flow for reactor decay heat and sensible heat removal following the reactor trip.
| |
| : g. Auxiliary Feedwater - Trip of All Main Feedwater Pumps A trip of all MFW pumps is an indication of a loss of MFW and the subsequent need for some method of decay heat and sensible heat removal to bring the reactor back to no load temperature and pressure. Each turbine driven MFW pump is equipped with a steam stop valve. The stop valve contains a Cook Nuclear Plant Unit 2 B 3.3.2-26 Revision No. 0
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) limit switch (i.e., channel), which actuates when the stop valve is closed. Since the unit includes two turbine driven MFW pumps both channels (one per pump) must trip to start the motor driven auxiliary feedwater pumps (i.e., a two-out-of-two logic configuration). The LCO requires one channel per pump to be OPERABLE. This Function does not meet the single failure criteria, however this is acceptable since the SG Water Level - Low Low Function is credited to start the AFW System in the design basis accidents and transients that result in a loss of MFW. A trip of all MFW pumps starts the motor driven AFW pumps. However, the signal is not credited in the safety analysis.
| |
| Functions 6.f and 6.g must be OPERABLE in MODES 1 and 2 since the reactor coolant pumps and MFW pumps are in operation. This ensures the SGs are provided with water to serve as the heat sink to remove reactor decay heat and sensible heat in the event of an accident. In MODES 3, 4, and 5, the RCPs and MFW pumps may be normally shut down, and thus neither pump trip is indicative of a condition requiring automatic AFW initiation.
| |
| : 7. Containment Air Recirculation/Hydrogen Skimmer (CEQ) System The CEQ System functions to assist in cooling the containment atmosphere and limiting pressure and temperature in containment to less than design values. Limiting pressure and temperature reduces the release of fission product radioactivity from the containment to the environment in the event of a DBA.
| |
| CEQ Actuation is accomplished by Manual Initiation, Automatic Actuation Logic and Actuation Relays, and by Containment Pressure - High channels (the same channels that actuate ESFAS Function 1.c).
| |
| : a. CEQ - Manual Initiation The CEQ Manual Initiation Function is designed with one manual switch in each train. One switch (channel) in a train must be placed in the actuate position for the associated components in the train to receive an CEQ initiation signal. The LCO requires one channel per train to be OPERABLE. The operator can initiate CEQ at any time by using either of two switches in the control room. This action will cause actuation of components in the same manner as any of the automatic actuation signals.
| |
| Cook Nuclear Plant Unit 2 B 3.3.2-27 Revision No. 0
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| The LCO for the Manual Initiation Function ensures the proper amount of redundancy is maintained to ensure the operator has manual CEQ System initiation capability.
| |
| : b. CEQ - Automatic Actuation Logic and Actuation Relays The CEQ Automatic Actuation Logic and Actuation Relays Function includes two trains. The actuation of the logic in any train will actuate the associated components in the same train.
| |
| This LCO requires two trains to be OPERABLE. Actuation logic consists of all circuitry housed within the actuation subsystems, including the initiating relay contacts responsible for actuating the CEQ System.
| |
| : c. CEQ - Containment Pressure - High This signal provides protection against the following accidents:
| |
| * SLB inside containment; and
| |
| * LOCA.
| |
| The CEQ Containment Pressure - High Function design includes three channels. This LCO requires three channels to be OPERABLE. Three OPERABLE channels are sufficient to satisfy protective requirements with a two-out-of-three logic.
| |
| The transmitters (d/p cells) and electronics are located outside of containment with the sensing line (high pressure side of the transmitter) located inside containment. Thus, the high pressure Function will not experience any adverse environmental conditions and the trip setpoint reflects only steady state instrument uncertainties.
| |
| These Functions must be OPERABLE in MODES 1, 2, and 3. In these MODES, a DBA could cause an increase in containment pressure and temperature requiring the operation of the CEQ System. In MODE 4, only the Manual Initiation Function is required.
| |
| These Functions are not required to be OPERABLE in MODES 5 and 6 because the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, the CEQ System instrumentation is not required to be OPERABLE in these MODES.
| |
| Cook Nuclear Plant Unit 2 B 3.3.2-28 Revision No. 0
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| : 8. Engineered Safety Feature Actuation System Interlocks To allow some flexibility in unit operations, several interlocks are included as part of the ESFAS. These interlocks permit the operator to block some signals, automatically enable other signals, prevent some actions from occurring, and cause other actions to occur. The interlock Functions back up manual actions to ensure bypassable functions are in operation under the conditions assumed in the safety analyses.
| |
| : a. Engineered Safety Feature Actuation System Interlocks - Reactor Trip, P-4 There are two Reactor Trip, P-4 interlock trains. The P-4 interlock is enabled when a reactor trip breaker (RTB) and its associated bypass breaker are open. Once the P-4 interlock is enabled, automatic SI initiation is allowed to be manually blocked after an approximate 1 minute time delay after the SI signal is received. This Function allows operators to take manual control of SI systems after the initial phase of injection is complete.
| |
| Once SI is blocked, automatic actuation of SI cannot occur until the RTBs have been manually closed. Additional functions of the P-4 interlock are:
| |
| * Trip the main turbine;
| |
| * Isolate MFW with coincident low Tavg; and
| |
| * Actuate MFW pump trip.
| |
| However, none of these additional Functions are assumed in the safety analysis, thus they are not required for OPERABILITY of the P-4 interlock.
| |
| The RTB position switches that provide input to the P-4 interlock only function to energize or de-energize or open or close contacts. Therefore, this Function has no adjustable trip setpoint with which to associate a trip setpoint and Allowable Value.
| |
| This Function must be OPERABLE in MODES 1, 2, and 3 when the reactor may be critical or approaching criticality. This Function does not have to be OPERABLE in MODE 4, 5, or 6 because automatic SI initiation is not required.
| |
| Cook Nuclear Plant Unit 2 B 3.3.2-29 Revision No. 0
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| : b. Engineered Safety Feature Actuation System Interlocks - Pressurizer Pressure, P-11 The P-11 interlock permits a normal unit cooldown and depressurization without actuation of SI. With two-out-of-three pressurizer pressure channels (discussed previously) less than the P-11 setpoint, the operator can manually block the Pressurizer Pressure - Low SI signal. With two-out-of-three pressurizer pressure channels above the P-11 setpoint, the Pressurizer Pressure - Low signal is automatically enabled. The operator can also enable these trips by use of the respective manual reset switches.
| |
| This Function must be OPERABLE in MODES 1, 2, and 3 to automatically reinstate SI during normal unit startup and to allow an orderly cooldown and depressurization of the unit without the actuation of SI. This Function does not have to be OPERABLE in MODE 4, 5, or 6 because the Pressurizer Pressure - Low Function is not required in MODE 4, 5, or 6.
| |
| : c. Engineered Safety Feature Actuation System Interlocks - Tavg - Low Low, P-12 On increasing reactor coolant temperature and with three of four Tavg - Low Low channels above the reset point, the P-12 interlock prevents or defeats the manual block of SI on Steam Line Pressure - Low and provides an arming signal to the Steam Dump System. In addition, the interlock will prevent or defeat a steam line isolation from occurring if steam line flow reaches the trip setpoint associated with Steam Line Flow - High. On decreasing reactor coolant temperature and with two of four Tavg - Low Low channels below the Allowable Value, the P-12 interlock allows the operator to manually block SI on Steam Line Pressure - Low and will cause a Main Steam Line Isolation on Steam Line Flow - High. On a decreasing temperature, the P-12 interlock also removes the arming signal to the Steam Dump System to prevent an excessive cooldown of the RCS due to a malfunctioning Steam Dump System.
| |
| Since Tavg is used as an indication of bulk RCS temperature, this Function meets redundancy requirements with one OPERABLE or tripped channel in each loop.
| |
| Cook Nuclear Plant Unit 2 B 3.3.2-30 Revision No. 0
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| This Function must be OPERABLE in MODES 1, 2, and 3 (above P-12) when a secondary side break or stuck open valve could result in the rapid depressurization of the steam lines. This Function does not have to be OPERABLE in MODE 3 below P-12, and MODE 4, 5, or 6 because there is insufficient energy in the secondary side of the unit to have an accident.
| |
| The ESFAS instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| ACTIONS A Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed on Table 3.3.2-1.
| |
| In the event a channel's trip setpoint is found nonconservative with respect to the Allowable Value, or the transmitter, instrument loop, signal processing electronics, or bistable is found inoperable, then all affected Functions provided by that channel must be declared inoperable and the LCO Condition(s) entered for the protection Function(s) affected.
| |
| When the number of inoperable channels in a trip function exceed those specified in one or other related Conditions associated with a trip function, then the unit is outside the safety analysis. Therefore, LCO 3.0.3 should be immediately entered if applicable in the current MODE of operation.
| |
| A.1 Condition A applies to all ESFAS protection functions.
| |
| Condition A addresses the situation where one or more channels or trains for one or more Functions are inoperable at the same time. The Required Action is to refer to Table 3.3.2-1 and to take the Required Actions for the protection functions affected. The Completion Times are those from the referenced Conditions and Required Actions.
| |
| B.1 Condition B applies to Manual Initiation and the Reactor Trip P-4 interlock Functions.
| |
| The affected Manual Initiation Functions include:
| |
| SI; Containment Spray; Cook Nuclear Plant Unit 2 B 3.3.2-31 Revision No. 58
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued)
| |
| Phase A Isolation; Phase B Isolation; Steam Line Isolation; and CEQ System.
| |
| If a required channel or train is inoperable, 48 hours is allowed to return it to an OPERABLE status. For the Manual Initiation and the Reactor Trip P-4 interlock Functions, the specified Completion Time is reasonable considering that there are two automatic actuation trains and another manual initiation train OPERABLE for each Function, and the low probability of an event occurring during this interval. The specified Completion Time is reasonable considering that there are two automatic actuation trains and another manual initiation train OPERABLE for each manual Function and the low probability of an event occurring during this interval.
| |
| C.1 Condition C applies to the automatic actuation logic and actuation relays for the following functions:
| |
| SI; Containment Spray; Phase A Isolation; Phase B Isolation; Steam Line Isolation; Turbine Trip and Feedwater Isolation; Auxiliary Feedwater; and CEQ System.
| |
| Cook Nuclear Plant Unit 2 B 3.3.2-32 Revision No. 58
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued)
| |
| If one train is inoperable, 6 hours are allowed to restore the train to OPERABLE status. The 6 hours allowed for restoring the inoperable train to OPERABLE status is justified in Reference 9. The specified Completion Time is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this interval.
| |
| The Required Actions are modified by a Note that allows one train to be bypassed for up to 4 hours for surveillance testing, provided the other train is OPERABLE. This allowance is based on the reliability analysis assumptions of WCAP-1027-P-A (Ref. 9) that 4 hours is the average time required to perform train surveillance.
| |
| D.1 Condition D applies to:
| |
| Containment Pressure - High; Pressurizer Pressure - Low; Steam Line Pressure - Low; High Differential Pressure Between Steam Lines; High Steam Flow in Two Steam Lines Coincident With Tavg - Low Low; SG Water Level - Low Low; SG Water Level - High High; Undervoltage Reactor Coolant Pump; and Tavg - Low Low, P-12.
| |
| If one channel is inoperable, 6 hours are allowed to place it in the tripped condition. Generally this Condition applies to functions that operate on two-out-of-three logic. Therefore, failure of one channel places the Function in a two-out-of-two configuration. One channel must be tripped to place the Function in a one-out-of-two configuration that satisfies redundancy requirements.
| |
| Cook Nuclear Plant Unit 2 B 3.3.2-33 Revision No. 0
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued)
| |
| The Required Actions are modified by two Notes. Note 1, which is applicable to TS Functions with installed bypass test capability, allows placing one channel in bypass for 4 hours while performing routine surveillance testing. Note 2, which is applicable to TS Functions without installed bypass test capability, allows the inoperable channel to be bypassed for up to 4 hours for surveillance testing of other channels. The 6 hours allowed to place the inoperable channel in the tripped condition, and the 4 hours allowed for testing, are justified in References 8 and 9.
| |
| These Notes provide an exception to entering LCO 3.0.3 with a single channel inoperable within a TS Function to perform surveillance testing on another channel within the same Function.
| |
| E.1 Condition E applies to:
| |
| Containment Spray Containment Pressure - High High; Containment Phase B Isolation Containment Pressure - High High; and Steam Line Isolation Containment Pressure - High High.
| |
| None of these signals has input to a control function. Thus, two-out-of-three logic is necessary to meet acceptable protective requirements. However, a two-out-of-three design would require tripping a failed channel. This is undesirable because a single failure would then cause spurious containment spray initiation. Spurious spray actuation is undesirable because of the cleanup problems presented. Therefore, these channels are designed with two-out-of-four logic so that a failed channel may be bypassed rather than tripped. Note that one channel may be bypassed and still satisfy the single failure criterion. Furthermore, with one channel bypassed, a single instrumentation channel failure will not spuriously initiate containment spray.
| |
| To avoid the inadvertent actuation of Containment Spray and Phase B Containment Isolation, the inoperable channel should not be placed in the tripped condition. Instead it is bypassed. Restoring the channel to OPERABLE status, or placing the inoperable channel in the bypass condition within 6 hours, is sufficient to assure that the Function remains OPERABLE and minimizes the time that the Function may be in a partial trip condition (assuming the inoperable channel has failed high). The Completion Time is further justified based on the low probability of an event occurring during this interval.
| |
| The Required Action is modified by a Note that allows one additional channel to be bypassed for up to 4 hours for surveillance testing. Placing Cook Nuclear Plant Unit 2 B 3.3.2-34 Revision No. 17
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) a second channel in the bypass condition for up to 4 hours for testing purposes is acceptable based on the results of Reference 8.
| |
| F.1 Condition F applies to the Auxiliary Feedwater Loss of Voltage Function.
| |
| If one channel (on the associated bus) is inoperable, Required Action F.1 requires that channel to be placed in trip within 1 hour. With a channel in trip, the Auxiliary Feedwater Loss of Voltage instrumentation channels are configured to provide a one-out-of-two logic to start the associated motor driven feedwater pump.
| |
| The specified Completion Time was chosen to be consistent with the Completion Time for an inoperable Loss of Voltage channel in ITS 3.3.5.
| |
| G.1 Condition G applies to the P-11 interlock.
| |
| With one or more channels inoperable, the operator must verify that the interlock is in the required state for the existing unit condition. This action manually accomplishes the function of the interlock. Determination must be made within 1 hour. The 1 hour Completion Time is equal to the time allowed by LCO 3.0.3 to initiate shutdown actions in the event of a complete loss of ESFAS function.
| |
| H.1 Condition H applies to a Trip of all Main Feedwater Pumps.
| |
| If one or more required channels are inoperable, 48 hours is allowed to return it to an OPERABLE status. This action recognizes the lack of manual trip provisions for a failed channel. The specified Completion Time is reasonable, considering the nature of this Function (i.e., Main Feedwater Pump Function is not credited in the safety analysis), the available redundancy, and the low probability of an event occurring during this interval.
| |
| The required actions are modified by a note that allows both channels on the same Main Feedwater pump to be non-functional for up to 4 hours without a required entry into Action Condition H. This provision allows pump startup and shutdown to occur when the Main Feedwater pump is reset and/or not capable of feeding the steam generators.
| |
| Cook Nuclear Plant Unit 2 B 3.3.2-35 Revision No. 58
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued)
| |
| I.1 If any Required Action and associated Completion Time cannot be met, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to MODE 3 within 6 hours.
| |
| The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| J.1 and J.2 If any Required Action and associated Completion Time cannot be met, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to MODE 3 within 6 hours and MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| K.1 and K.2 If any Required Action and associated Completion Time cannot be met, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to MODE 3 within 6 hours and MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| L.1 If any Required Action and associated Completion Time of Condition B cannot be met, the associated SGSV must be declared inoperable. This will require entry into the associated Conditions and Required Actions of LCO 3.7.2, "Steam Generator Stop Valves."
| |
| SURVEILLANCE The SRs for each ESFAS Function are identified by the SRs column REQUIREMENTS of Table 3.3.2-1.
| |
| A Note has been added to the SR Table to clarify that Table 3.3.2-1 determines which SRs apply to which ESFAS Functions.
| |
| Note that each channel of process protection supplies both trains of the ESFAS. When testing channel I, train A and train B must be examined.
| |
| Similarly, train A and train B must be examined when testing channel II, channel III, and channel IV (if applicable). The CHANNEL CALIBRATION Cook Nuclear Plant Unit 2 B 3.3.2-36 Revision No. 58
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued) and COTs are performed in a manner that is consistent with the assumptions used in analytically calculating the required channel accuracies.
| |
| SR 3.3.2.1 Performance of the CHANNEL CHECK once every 12 hours ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
| |
| Agreement criteria are determined by the unit staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.2.2 and SR 3.3.2.5 SR 3.3.2.2 is the performance of a TADOT. This test is a check of the Loss of Voltage Function. SR 3.3.2.5 is the performance of a TADOT.
| |
| This test is a check of the Undervoltage RCP Function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable TADOT of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.
| |
| Each SR is modified by a Note that excludes verification of setpoints for relays. Relay setpoints require elaborate bench calibration and are verified during CHANNEL CALIBRATION. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Cook Nuclear Plant Unit 2 B 3.3.2-37 Revision No. 60
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.3.2.3 SR 3.3.2.3 is the performance of an ACTUATION LOGIC TEST, using the semiautomatic tester. The train being tested is placed in the bypass condition, thus preventing inadvertent actuation. Through the semiautomatic tester, all possible logic combinations, with and without applicable permissives, are tested for each protection function. In addition, the master relay coil is pulse tested for continuity. This verifies that the logic modules are OPERABLE and that there is an intact voltage signal path to the master relay coils. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.2.4 SR 3.3.2.4 is the performance of a MASTER RELAY TEST. The MASTER RELAY TEST is the energizing of the master relay, verifying contact operation and a low voltage continuity check of the slave relay coil. Upon master relay contact operation, a low voltage is injected to the slave relay coil. This voltage is insufficient to pick up the slave relay, but large enough to demonstrate signal path continuity. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.2.6 SR 3.3.2.6 is the performance of a COT. A COT is performed on each required channel to ensure the entire channel will perform the intended Function. Setpoints must be found within the Allowable Values specified in Table 3.3.1-1. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable COT of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.
| |
| The difference between the current "as found" values and the previous test "as left" values must be consistent with the drift allowance used in the setpoint methodology. The setpoint shall be left set consistent with the assumptions of the current unit specific setpoint methodology.
| |
| Cook Nuclear Plant Unit 2 B 3.3.2-38 Revision No. 60
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| The "as found" and "as left" values must also be recorded and reviewed for consistency with the assumptions of Reference 6.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.2.6 is modified by a Note which applies to the SI Containment Pressure - High, Containment Spray Containment Pressure - High High, Phase B Isolation Containment Pressure - High High, Steam Line Isolation Containment Pressure - High High, and CEQ System Containment Pressure - High Functions. This Note requires, during the performance of SR 3.3.2.6, the associated transmitters of these Functions to be exercised by applying either a vacuum or pressure to the appropriate side of the transmitter. Exercising the associated transmitters during the performance of the COT is necessary to ensure Functions 1.c, 2.c, 3.b.(3), 4.c, and 7.c remain OPERABLE between each CHANNEL CALIBRATION.
| |
| SR 3.3.2.7 SR 3.3.2.7 is the performance of a CHANNEL CALIBRATION.
| |
| CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy.
| |
| CHANNEL CALIBRATIONS must be performed consistent with the assumptions of the unit specific setpoint methodology. The difference between the current "as found" values and the previous test "as left" values must be consistent with the drift allowance used in the setpoint methodology.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.2.8 SR 3.3.2.8 is the performance of a SLAVE RELAY TEST. The SLAVE RELAY TEST is the energizing of the slave relays. Contact operation is verified in one of two ways. Actuation equipment that may be operated in the design mitigation MODE is either allowed to function, or is placed in a condition where the relay contact operation can be verified without operation of the equipment. Actuation equipment that may not be operated in the design mitigation MODE is prevented from operation by the SLAVE RELAY TEST circuit. For this latter case, contact operation is verified by a continuity check of the circuit containing the slave relay. The Cook Nuclear Plant Unit 2 B 3.3.2-39 Revision No. 60
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.2.9 SR 3.3.2.9 is the performance of a TADOT. This test is a check of the Manual Initiation Functions, the AFW pump start on trip of all MFW pumps, and the P-4 interlock. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable TADOT of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. In some instances, the test includes actuation of the end device (i.e., pump starts, valve cycles, etc.).
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.2.10 SR 3.3.2.10 is the performance of a CHANNEL CALIBRATION.
| |
| CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to measured parameter within the necessary range and accuracy.
| |
| CHANNEL CALIBRATIONS must be performed consistent with the assumptions of the unit specific setpoint methodology. The difference between the current "as found" values and the previous test "as left" values must be consistent with the drift allowance used in the setpoint methodology.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.2.11 SR 3.3.2.11 is the performance of an ACTUATION LOGIC TEST. This SR is applied to the balance of plant actuation logic and relays that do not have the SSPS test circuits installed to utilize the semiautomatic tester or perform the continuity check. All possible logic combinations are tested for Table 3.3.2-1 Functions 6.e and 6.g. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Cook Nuclear Plant Unit 2 B 3.3.2-40 Revision No. 60
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.3.2.12 This SR ensures the individual channel ESF RESPONSE TIMES are less than or equal to the maximum values assumed in the accident analysis.
| |
| Response Time testing acceptance criteria are included in the UFSAR, Table 7.2-7 (Ref. 11). Individual component response times are not modeled in the analyses. The analyses model the overall or total elapsed time, from the point at which the parameter exceeds the trip setpoint value at the sensor, to the point at which the equipment in both trains reaches the required functional state (e.g., pumps at rated discharge pressure, valves in full open or closed position).
| |
| For channels that include dynamic transfer functions (e.g., lag, lead/lag, rate/lag, etc.), the response time test may be performed with the transfer functions set to one with the resulting measured response time compared to the appropriate UFSAR response time. Alternately, the response time test can be performed with the time constants set to their nominal value provided the required response time is analytically calculated assuming the time constants are set at their nominal values. The response time may be measured by a series of overlapping tests such that the entire response time is measured.
| |
| Response time may be verified by actual response time tests in any series of sequential, overlapping or total channel measurements, or by the summation of allocated sensor, signal processing and actuation logic response times with actual response time tests on the remainder of the channel. Allocations for sensor response times may be obtained from:
| |
| (1) historical records based on acceptable response time tests (hydraulic, noise, or power interrupt tests), (2) in place, onsite, or offsite (e.g., vendor) test measurements, or (3) utilizing vendor engineering specifications. WCAP-13632-P-A, Revision 2, "Elimination of Pressure Sensor Response Time Testing Requirements," dated January 1996 (Ref. 12), provides the basis and methodology for using allocated sensor response times in the overall verification of the channel response time for specific sensors identified in the WCAP. Response time verification for other sensor types must be demonstrated by test.
| |
| WCAP-14036-P, Revision 1, "Elimination of Periodic Protection Channel Response Time Tests," (Ref. 13) provides the basis and methodology for using allocated signal processing and actuation logic response times in the overall verification of the protection system channel response time.
| |
| The allocations for sensor, signal conditioning, and actuation logic response times must be verified prior to placing the component in operational service and re-verified following maintenance that may adversely affect response time. In general, electrical repair work does not impact response time provided the parts used for repair are of the same type and value. Specific components identified in the WCAP may be Cook Nuclear Plant Unit 2 B 3.3.2-41 Revision No. 58
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued) replaced without verification testing. One example where response time could be affected is replacing the sensing assembly of a transmitter.
| |
| The response time may be verified for components that replace the components that were previously evaluated in Ref. 12 and Ref. 13, provided that the components have been evaluated in accordance with the NRC approved methodology as discussed in Attachment 1 to TSTF-569, "Methodology to Eliminate Pressure Sensor and Protection Channel Response Time Testing," (Ref. 14).
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by a Note that clarifies that the turbine driven AFW pump is tested within 24 hours after reaching 850 psig in the SGs.
| |
| REFERENCES 1. Technical Requirements Manual.
| |
| : 2. IEEE-279, "Proposed Criteria for Nuclear Power Plant Protection Systems," August 1968.
| |
| : 3. UFSAR, Table 7.2-1.
| |
| : 4. UFSAR, Table 14.1.0-4.
| |
| : 5. 10 CFR 50.49.
| |
| : 6. WCAP-12741, "Westinghouse Menu Driven Setpoint Calculation Program (STEPIT)," as approved in Unit 1 and Unit 2 License Amendments 175 and 160, dated May 13, 1994.
| |
| : 7. UFSAR, Chapter 14.
| |
| : 8. WCAP-14333-P-A, Revision 1, October 1998.
| |
| : 9. WCAP-10271-P-A, "Evaluation of Surveillance Frequencies and Out of Service Times for the Reactor Protection Instrumentation System,"
| |
| including Supplement 1, May 1986, and Supplement 2, Rev. 1, June 1990.
| |
| : 10. WCAP-15376, "Risk-Informed Assessment of the RTS and ESFAS Surveillance Intervals and Reactor Trip Breaker Test and Completion Times," October 2000.
| |
| : 11. UFSAR, Table 7.2-7.
| |
| Cook Nuclear Plant Unit 2 B 3.3.2-42 Revision No. 79
| |
| | |
| ESFAS Instrumentation B 3.3.2 BASES REFERENCES (continued)
| |
| : 12. WCAP-13632-P-A, Revision 2, "Elimination of Pressure Sensor Response Time Testing Requirements," January 1996.
| |
| : 13. WCAP-14036-P, Revision 1, "Elimination of Periodic Protection Channel Response Time Tests," December 1995.
| |
| : 14. Attachment 1 to TSTF-569, "Methodology to Eliminate Pressure Sensor and Protection Channel Response Time Testing."
| |
| Cook Nuclear Plant Unit 2 B 3.3.2-43 Revision No. 79
| |
| | |
| PAM Instrumentation B 3.3.3 B 3.3 INSTRUMENTATION B 3.3.3 Post Accident Monitoring (PAM) Instrumentation BASES BACKGROUND The primary purpose of the PAM instrumentation is to display unit variables that provide information required by the control room operators during accident situations. This information provides the necessary support for the operator to take the manual actions for which no automatic control is provided and that are required for safety systems to accomplish their safety functions for Design Basis Accidents (DBAs).
| |
| The OPERABILITY of the accident monitoring instrumentation ensures that there is sufficient information available on selected unit parameters to monitor and to assess unit status and behavior following an accident.
| |
| The availability of accident monitoring instrumentation is important so that responses to corrective actions can be observed and the need for, and magnitude of, further actions can be determined. These essential instruments are identified in References 1, 2, and 5 addressing the recommendations of Regulatory Guide 1.97 (Ref. 3) as required by Supplement 1 to NUREG-0737 (Ref. 4).
| |
| The instrument channels required to be OPERABLE by this LCO include two classes of parameters identified during unit specific implementation of Regulatory Guide 1.97 as Type A and Category 1 variables.
| |
| These key variables are identified by the unit specific Regulatory Guide 1.97 analyses (Ref. 1, 2, and 5). These analyses identify the unit specific Type A and Category 1 variables and provide justification for deviating from the NRC guidance in Reference 3.
| |
| The specific instrument Functions listed in Table 3.3.3-1 are discussed in the LCO section.
| |
| APPLICABLE The PAM instrumentation LCO ensures the OPERABILITY of Regulatory SAFETY Guide 1.97 Type A variables so that the control room operating staff can:
| |
| ANALYSES
| |
| * Perform the diagnosis specified in the emergency operating procedures (these variables are restricted to preplanned actions for the primary success path of DBAs), e.g., loss of coolant accident (LOCA); and
| |
| * Take the specified, pre-planned, manually controlled actions, for which no automatic control is provided, and that are required for safety systems to accomplish their safety function.
| |
| Cook Nuclear Plant Unit 2 B 3.3.3-1 Revision No. 16
| |
| | |
| PAM Instrumentation B 3.3.3 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| The PAM Instrumentation LCO also ensures the OPERABILITY of Category 1, non-Type A, variables so the control room staff can:
| |
| * Determine whether systems important to safety are performing their intended functions;
| |
| * Determine the likelihood of a gross breach of the barriers to radioactivity release;
| |
| * Determine if a gross breach of a barrier has occurred; and
| |
| * Initiate action necessary to protect the public and to estimate the magnitude of any impending threat.
| |
| PAM instrumentation that meets the definition of Type A in Regulatory Guide 1.97 satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). Category 1, non-Type A, instrumentation must be retained in TS because it is intended to assist operators in minimizing the consequences of accidents.
| |
| Therefore, Category 1, non-Type A, variables are important for reducing public risk.
| |
| LCO The PAM instrumentation LCO provides OPERABILITY requirements for Regulatory Guide 1.97 Type A monitors, which provide information required by the control room operators to perform certain manual actions specified in the unit Emergency Operating Procedures. These manual actions ensure that a system can accomplish its safety function, and are credited in the safety analyses. Additionally, this LCO addresses Regulatory Guide 1.97 instruments that have been designated Category 1, non-Type A.
| |
| The OPERABILITY of the PAM instrumentation ensures there is sufficient information available on selected unit parameters to monitor and assess unit status following an accident. This capability is consistent with the recommendations of Reference 3.
| |
| LCO 3.3.3 requires two OPERABLE channels for most Functions. Two OPERABLE channels ensure no single failure prevents operators from getting the information necessary for them to determine the safety status of the unit, and to bring the unit to and maintain it in a safe condition following an accident.
| |
| Furthermore, OPERABILITY of two channels allows a CHANNEL CHECK during the post accident phase to confirm the validity of displayed information.
| |
| Cook Nuclear Plant Unit 2 B 3.3.3-2 Revision No. 0
| |
| | |
| PAM Instrumentation B 3.3.3 BASES LCO (continued)
| |
| One exception to the two channel requirement is Containment Isolation Valve (CIV) Position. In this case, the important information is the status of the containment penetrations. The LCO requires one position indicator for each active CIV. This is sufficient to redundantly verify the isolation status of each isolable penetration either via indicated status of the active valve and prior knowledge of a passive valve, or via system boundary status. If a normally active CIV is known to be closed and deactivated, position indication is not needed to determine status. Therefore, the position indication for valves in this state is not required to be OPERABLE.
| |
| Type A and Category 1 variables meet Regulatory Guide 1.97 Category 1 (Ref. 3) design and qualification requirements for seismic and environmental qualification, single failure criterion, utilization of emergency standby power, immediately accessible display, continuous readout, and recording of display, except for approved deviations, as described in References 1 and 2.
| |
| Listed below are discussions of the specified instrument Functions listed in Table 3.3.3-1. For all applicable Functions, the recorder or indicator may be used as the qualified instrument.
| |
| : 1. Neutron Flux Neutron Flux (NRI-21 and NRI-23) is a Category 1 variable provided to verify reactor shutdown. The range of each of the two neutron flux instruments (10E-8 to 200% power) covers the full range of flux that may occur post accident.
| |
| : 2. Steam Generator (SG) Pressure (per SG)
| |
| Steam Generator Pressure is a Type A, Category 1 variable provided for determination of required core exit temperature. Three steam generator pressure channels per steam generator are provided (MPP-210, MPP-211, MPP-212, MPP-220, MPP-221, MPP-222, MPP-230, MPP-231, MPP-232, MPP-240, MPP-241, and MPP-242).
| |
| Each channel has a range of 0 psig to 1200 psig. However, only two steam generator pressure channels per steam generator are required to satisfy the guidance in Reference 3. Each steam generator is treated separately and each steam generator is considered a separate Function. Therefore, separate Condition entry is allowed for each steam generator. This is acceptable since each steam generator has two channels and the channels of one steam generator are independent from the channels of the other steam generators.
| |
| Cook Nuclear Plant Unit 2 B 3.3.3-3 Revision No. 11
| |
| | |
| PAM Instrumentation B 3.3.3 BASES LCO (continued) 3, 4. Reactor Coolant System (RCS) Hot and Cold Leg Temperatures (Wide Range)
| |
| RCS Hot and Cold Leg Temperatures are Type A, Category 1 variables provided for verification of core cooling and long term surveillance. RCS hot and cold leg temperatures are used to determine RCS subcooling margin.
| |
| The RCS hot leg and RCS cold leg channels each receive input from one resistance temperature detector (RTD). In each of RCS loops 1 and 3, there is one RCS hot leg RTD (NTR-110 with MR-9, and NTR-130 with MR-11) and one RCS cold leg RTD (NTR-210 with MR-9, and NTR-230 with MR-11) that satisfy the guidance of Reference 3. The channels provide indication over a range of 0°F to 700°F.
| |
| : 5. RCS Pressure (Wide Range)
| |
| RCS wide range pressure is a Type A, Category 1 variable provided for verification of core cooling and RCS integrity long term surveillance.
| |
| RCS wide range pressure is used as criteria to manually trip the reactor coolant pumps.
| |
| In addition, RCS wide range pressure is used for determining RCS subcooling margin.
| |
| Two RCS Pressure (Wide Range) channels are provided (NPS-110 and NPS-111, with MR-13), each with a range of 0 psig to 3000 psig.
| |
| : 6. Reactor Coolant Inventory Tracking System (Reactor Vessel Level Indication)
| |
| Reactor coolant inventory is a Category 1 variable provided for verification and long term surveillance of core cooling.
| |
| The Reactor Coolant Inventory Tracking System consists of two channels of instrumentation (NLI-110, NLI-111, NLI-120, NLI-121, NLI-130, and NLI-131). Each channel is capable of measuring upper plenum level, narrow range level, and dynamic head (i.e., wide range level). The Reactor Coolant Inventory Tracking System provides a direct measurement of the collapsed liquid level above the fuel alignment plate. The collapsed level represents the amount of liquid mass that is in the reactor vessel above the core. Measurement of Cook Nuclear Plant Unit 2 B 3.3.3-4 Revision No. 0
| |
| | |
| PAM Instrumentation B 3.3.3 BASES LCO (continued) the collapsed water level is selected because it is a direct indication of the water inventory.
| |
| : 7. Containment Water Level Containment Water Level is a Type A, Category 1 variable provided for determination of adverse containment conditions. Two containment water level channels are provided (NLI-320 and NLI-321). Each channel is capable of measuring from 599' 3" elevation to 614' elevation (containment floor level to maximum flood level). Additionally, each channel is supplemented by two level switches. Each level switch will provide indication in the control room when the containment water level has exceeded its associated setpoint. One level switch actuates at a containment level of 602' 2 3/4" (NLI-330 and NLI-331) while the other level switch actuates when the containment level reaches 613' 0" (NLI-340 and NLI-341). The low switch provides a decision point associated with Type A use (switch the Emergency Core Cooling System (ECCS) suction source from the refueling water storage tank to the containment recirculation sump) while the high switch confirms whether or not the containment water level is approaching its design basis value.
| |
| : 8. Containment Pressure (Narrow Range)
| |
| Containment Pressure (Narrow Range) is a Type A, Category 1 variable used as criteria to manually establish or trip containment spray. Four containment pressure (narrow range) channels are provided (PPP-300, PPP-301, PPP-302, and PPP-303). Each channel has a range of -5 psig to +12 psig. However, only two of containment pressure (narrow range) channels are required to satisfy the guidance in Reference 3.
| |
| : 9. Penetration Flow Path Containment Isolation Valve Position Containment Isolation Valve (CIV) (excluding check valves) Position is a Category 1 variable provided for verification of Containment OPERABILITY, and Phase A and Phase B isolation.
| |
| In the case of CIV position, the important information is the isolation status of the containment penetrations (UFSAR Table 5.4-1). The LCO requires one channel of valve position indication in the control room to be OPERABLE for each active CIV in a containment penetration flow path, i.e., two total channels of CIV position indication for a penetration flow path with two active valves requiring Cook Nuclear Plant Unit 2 B 3.3.3-5 Revision No. 84
| |
| | |
| PAM Instrumentation B 3.3.3 BASES LCO (continued) post-accident valve position indication. For containment penetrations with only one active CIV having control room indication, Note (b) requires a single channel of valve position indication to be OPERABLE. This is sufficient to redundantly verify the isolation status of each isolable penetration either via indicated status of the active valve, as applicable, and prior knowledge of a passive valve, or via system boundary status. If a penetration flow path is isolated, position indication for the CIVs is not needed to determine status.
| |
| Therefore, the position indication for valves in an isolated penetration flow path is not required to be OPERABLE. Note (a) to the Required Channels states that the Function is not required for isolation valves whose associated penetration is isolated by at least one closed and deactivated automatic valve, closed manual valve, blind flange, or check valve with flow through the valve secured. Each penetration is treated separately and each penetration flow path is considered a separate function. Therefore, separate Condition entry is allowed for each inoperable penetration flow path.
| |
| : 10. Containment Area Radiation (High Range)
| |
| Containment Area Radiation (High Range) is a Type A, Category 1 variable provided for determination of adverse containment conditions. Two containment area radiation channels are provided (VRA-2310 and VRA-2410). Each channel is capable of monitoring from 1 R/hr to 10E7 R/hr.
| |
| : 11. Deleted
| |
| : 12. Pressurizer Level Pressurizer Level is a Type A, Category 1 variable used to determine whether to manually reduce ECCS flow. Three pressurizer level channels are provided (NLP-151, NLP-152, and NLP-153). Each channel has a range of 0 to 100% (96% of indicated volume).
| |
| However, only two pressurizer level channels are required to satisfy the guidance in Reference 3.
| |
| Cook Nuclear Plant Unit 2 B 3.3.3-6 Revision No. 29
| |
| | |
| PAM Instrumentation B 3.3.3 BASES LCO (continued)
| |
| : 13. Steam Generator Water Level (Wide Range)
| |
| SG Water Level is a Category 1 variable provided to monitor operation of decay heat removal via the SGs. Four steam generator level (wide range) channels (one per steam generator) are provided (BLI-110, BLI-120, BLI-130, and BLI-140). Each channel is capable of monitoring from 12 inches above the steam generator tube sheet to the separators.
| |
| : 14. Condensate Storage Tank (CST) Level CST Level is a Category 1 variable provided to ensure water supply for auxiliary feedwater (AFW). The CST provides the qualified water supply for the AFW System. Inventory is monitored from essentially the top of the CST to the bottom of the CST (95% total volume) by a single channel provided to satisfy the guidance of Reference 3, as described in Reference 1. CST Level is displayed on a control room indicator (CLI-114).
| |
| 15, 16, 17, 18. Core Exit Temperature Core Exit Temperature is a Type A, Category 1 variable used to determine whether to manually reduce ECCS flow. This variable is also provided for verification and long term surveillance of core cooling. In addition, core exit temperature is used for determining RCS subcooling margin.
| |
| Two OPERABLE channels of Core Exit Temperature, with one core exit thermocouple per channel, are required in each quadrant to provide indication of radial distribution of the coolant temperature rise across representative regions of the core. Two core exit temperature channels per quadrant ensure a single failure will not disable the ability to determine the radial temperature gradient. Each core exit temperature channel (SG-30 and SG-31 for TC 1 through 65) has a range of 200°F to 2300°F.
| |
| : 19. Secondary Heat Sink Indication (per SG)
| |
| Secondary Heat Sink Indication is a Type A, Category 1 variable used to determine whether to manually reduce ECCS flow. This variable is also provided to monitor operation of decay heat removal via the SGs.
| |
| As stated in Note (d) to Table 3.3.3-1, the requirements for this variable are met by any combination of two instruments per SG, Cook Nuclear Plant Unit 2 B 3.3.3-7 Revision No. 0
| |
| | |
| PAM Instrumentation B 3.3.3 BASES LCO (continued) including Steam Generator Water Level (Narrow Range) and Auxiliary Feedwater Flow. One auxiliary feedwater flow channel per SG is provided (FFI-210, FFI-220, FFI-230, and FFI-240). Each channel is capable of measuring from 0 lbm/hr to 250,000 lbm/hr.
| |
| Three steam generator water level (narrow range) channels per SG are provided (BLP-110, BLP-111, BLP-112, BLP-120, BLP-121, BLP-122, BLP-130, BLP-131, BLP-132, BLP-140, BLP-141, and BLP-142). Each channel is capable of measuring from below the first stage separator to the second stage separator. Thus, there are four available channels of Secondary Heat Sink Indication for each steam generator. Each Steam generator is treated separately and each steam generator is considered a separate Function. Therefore, separate Condition entry is allowed for each steam generator. This is acceptable since each steam generator has two required channels and the channels of one steam generator are independent from the channels of the other steam generators.
| |
| : 20. Emergency Core Cooling System Flow (per train)
| |
| Emergency Core Cooling System Flow is a Type A, Category 1 variable used as criteria to manually trip the reactor coolant pumps.
| |
| As stated in Note (e) to Table 3.3.3-1, the requirements for this variable are met by any combination of two instruments per train, including Centrifugal Charging Pump Flow, Safety Injection Pump Flow, Centrifugal Charging Pump Circuit Breaker Status, and Safety Injection Pump Circuit Breaker Status. Four Centrifugal Charging Pump Flow channels (two channels per train) are provided (IFI-51, IFI-52, IFI-53, and IFI-54). Each channel is capable of measuring from 0 gpm to 200 gpm. Two Safety Injection Pump Flow channels (one channel per train) are provided (IFI-260 and IFI-266). Each channel is capable of measuring from 0 gpm to 500 gpm. Two Centrifugal Charging Pump Circuit Breaker Status channels (one channel per train) are provided. Each channel is capable of indicating circuit breaker position (open or closed). Two Safety Injection Pump Circuit Breaker Status channels (one channel per train) are provided. Each channel is capable of indicating circuit breaker position (open or closed). One train consists of the Train A Safety Injection and Centrifugal Charging Pumps Breaker Status channels, the south Safety Injection Pump Flow channel, and the Loops 1 and 2 Centrifugal Charging Pump Flow channels, while the other train consists of the Train B Safety Injection and Centrifugal Charging Pumps Breaker Status channels, the north Safety Injection Pump Flow channel, and the Loops 3 and 4 Cook Nuclear Plant Unit 2 B 3.3.3-8 Revision No. 0
| |
| | |
| PAM Instrumentation B 3.3.3 BASES LCO (continued)
| |
| Centrifugal Charging Pump Flow channels. Thus, there are five instrument channels per train that can be used to meet the LCO. The selection of which train the instruments are associated with is based upon the instrumentation power supply. Each train is treated separately and each train is considered a separate Function.
| |
| Therefore, separate Condition entry is allowed for each train. This is acceptable since each train has two required channels and the channels of one train are independent from the channels of the other train.
| |
| : 21. Containment Pressure (Wide Range)
| |
| Containment Pressure (Wide Range) is a Category 1 variable provided for verification of RCS and containment OPERABILITY.
| |
| Two containment pressure (wide range) channels are provided (PPA-310 and PPA-312). Each channel is capable of monitoring from -5 psig to +36 psig.
| |
| : 22. Refueling Water Storage Tank Level Refueling Water Storage Tank Level is a Type A, Category 1 variable provided for determination of when the manual transfer to cold leg recirculation is required, based on low Refueling Water Storage Tank level. Two refueling water storage tank water level channels are provided (ILS-950 with MR-36, and ILS-951). Each channel is capable of monitoring from essentially the top of the tank (bottom of the tank overflow) to the bottom of the tank (bottom of the safety injection suction pipe).
| |
| : 23. RCS Subcooling Margin Monitor RCS Subcooling Margin Monitor is a Type A variable provided for the determination of when to manually trip or when to reduce pressurizer spray and ECCS flow. This variable is also provided for verification of core cooling. The RCS Subcooling Margin Monitor calculates the margin to saturation for the RCS from inputs for RCS Pressure (Wide Range), Core Exit Temperature, RCS Hot Leg Temperature (Wide Range) and RCS Cold Leg Temperature (Wide Range). The RCS Subcooling Margin Monitor is capable of measuring from 425°F subcooling to 75°F superheat. The output of the RCS Subcooling Margin Monitor is indicated in the control room. As stated in Note (f) to Table 3.3.3-1, the plant process computer subcooling margin readout can also be used in place of the RCS Subcooling Margin Monitor indicator in the control room.
| |
| Cook Nuclear Plant Unit 2 B 3.3.3-9 Revision No. 0
| |
| | |
| PAM Instrumentation B 3.3.3 BASES LCO (continued)
| |
| : 24. Component Cooling Water Pump Circuit Breaker Status Component Cooling Water Pump Circuit Breaker Status is a Type A, Category 1 variable provided for verification of component cooling water flow to Engineered Safety Feature Systems. Two component cooling water pump circuit breaker status channels (one channel per component cooling water pump) are provided. Each channel is capable of indicating circuit breaker position (open or closed).
| |
| : 25. Containment Recirculation Sump Water level Containment Recirculation Sump Water Level is a Type A, Category 1 variable provided for diagnosis of excessive fouling or blockage of the sump strainers. Two containment recirculation sump level channels are provided (NLI-300 and NLI-301). These instruments provide indication and alarm functions in the control room if the water level in the sump drops to an undesirable level. The level switch setpoint of 601-9 provides advance warning of potential air entrainment due to vortexing, which is a more limiting factor than the loss of NPSH to the ECCS/CTS pumps.
| |
| APPLICABILITY The PAM instrumentation LCO is applicable in MODES 1, 2, and 3.
| |
| These variables are related to the diagnosis and pre-planned actions required to mitigate DBAs. The applicable DBAs are assumed to occur in MODES 1, 2, and 3. In MODES 4, 5, and 6, unit conditions are such that the likelihood of an event that would require PAM instrumentation is low; therefore, the PAM instrumentation is not required to be OPERABLE in these MODES.
| |
| ACTIONS A Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Condition of this Specification may be entered independently for each Function listed on Table 3.3.3-1. The Completion Time(s) of the inoperable channel(s) of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.
| |
| A.1 Condition A applies when one or more Functions (except Functions 14 and 23) have one required channel that is inoperable. Required Action A.1 requires restoring the inoperable channel to OPERABLE status within 30 days. The 30 day Completion Time is based on operating experience and takes into account the remaining OPERABLE channel or remaining isolation barrier in the case of containment penetrations with only one CIV, the passive nature of the instrument (no critical automatic action is assumed to occur from these instruments), and Cook Nuclear Plant Unit 2 B 3.3.3-10 Revision No. 21
| |
| | |
| PAM Instrumentation B 3.3.3 BASES ACTIONS (continued) the low probability of an event requiring PAM instrumentation during this interval.
| |
| B.1 Condition B applies when the Required Action and associated Completion Time for Condition A are not met. This Required Action specifies immediate initiation of actions in Specification 5.6.6, which requires a written report to be submitted to the NRC. This report discusses the results of the evaluation into the cause of the inoperability and identifies proposed restorative actions. This action is appropriate in lieu of a shutdown requirement since alternative actions are identified before loss of functional capability, and given the likelihood of unit conditions that would require information provided by this instrumentation.
| |
| C.1 Condition C applies when either Function 14 or 23 (or both) have one required channel that is inoperable. Required Action C.1 requires restoring the inoperable channel to OPERABLE status within 30 days.
| |
| The 30 day Completion Time is based on operating experience and takes into account other non-Regulatory Guide 1.97 instrument channels to monitor the Function, the passive nature of the instrument (no critical automatic action is assumed to occur from these instruments), and the low probability of an event requiring PAM instrumentation during this interval.
| |
| D.1 Condition D applies when one or more Functions have two or more inoperable required channels (i.e., two or more channels inoperable in the same Function). Required Action D.1 requires restoring all but one channel in the Function(s) to OPERABLE status within 7 days. The Completion Time of 7 days is based on the relatively low probability of an event requiring PAM instrument operation and the availability of alternate means to obtain the required information. Continuous operation with two or more required channels inoperable in a Function is not acceptable because the alternate indications may not fully meet all performance qualification requirements applied to the PAM instrumentation. Therefore, requiring restoration of all but one inoperable channel of the Function limits the risk that the PAM Function will be in a degraded condition should an accident occur.
| |
| Cook Nuclear Plant Unit 2 B 3.3.3-11 Revision No. 29
| |
| | |
| PAM Instrumentation B 3.3.3 BASES ACTIONS (continued)
| |
| E.1 Condition E applies when the Required Action and associated Completion Time of Condition C or D is not met. Required Action E.1 requires entering the appropriate Condition referenced in Table 3.3.3-1 for the channel immediately. The applicable Condition referenced in the Table is Function dependent. Each time an inoperable channel has not met the Required Action of Condition C or D, and the associated Completion Time has expired, Condition E is entered for that channel and provides for transfer to the appropriate subsequent Condition.
| |
| F.1 and F.2 If the Required Action and associated Completion Time of Condition C or D is are not met and Table 3.3.3-1 directs entry into Condition F, the unit must be brought to a MODE where the requirements of this LCO do not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and MODE 4 within 12 hours.
| |
| The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems G.1 At this unit, alternate means of monitoring Reactor Vessel Water Level, Containment Area Radiation, Condensate Storage Tank Level, and Component Cooling Water Flow have been developed and tested. These alternate means may be temporarily installed if the normal PAM channel cannot be restored to OPERABLE status within the allotted time. If these alternate means are used, the Required Action is not to shut down the unit but rather to follow the directions of Specification 5.6.6, in the Administrative Controls section of the TS. The report provided to the NRC should discuss the alternate means used, describe the degree to which the alternate means are equivalent to the installed PAM channels, justify the areas in which they are not equivalent, and provide a schedule for restoring the normal PAM channels.
| |
| Cook Nuclear Plant Unit 2 B 3.3.3-12 Revision No. 29
| |
| | |
| PAM Instrumentation B 3.3.3 BASES SURVEILLANCE As noted at the beginning of the SRs, the following SRs apply to each REQUIREMENTS PAM instrumentation Function in Table 3.3.3-1, except where identified in the SR.
| |
| SR 3.3.3.1 Performance of the CHANNEL CHECK ensures that a gross instrumentation failure has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION. The Containment Area Radiation (High Range) instrumentation should be compared to similar unit instruments located throughout the unit. When only one channel of the Reactor Coolant Inventory Tracking System is OPERABLE, the RCS Subcooling Margin Monitor and Core Exit Temperature channels may be used for performance of the CHANNEL CHECK of the OPERABLE Reactor Coolant Inventory Tracking System channel.
| |
| Agreement criteria are determined by the unit staff, based on a combination of the channel instrument uncertainties, including isolation, indication, and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit. If the channels are within the criteria, it is an indication that the channels are OPERABLE.
| |
| As specified in the SR, a CHANNEL CHECK is only required for those channels that are normally energized.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Cook Nuclear Plant Unit 2 B 3.3.3-13 Revision No. 60
| |
| | |
| PAM Instrumentation B 3.3.3 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.3.3.2 Deleted SR 3.3.3.3 CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to measured parameter with the necessary range and accuracy. This SR is modified by a Note that excludes neutron detectors. For Function 9, the CHANNEL CALIBRATION shall consist of verifying that the position indication conforms to actual valve position. For Functions 15, 16, 17, and 18, whenever a sensing element is replaced, the next required CHANNEL CALIBRATION of the Core Exit Temperature thermocouple sensors is accomplished by an inplace cross calibration that compares the other sensing elements with the recently installed sensing elements.
| |
| For Functions 20 (Circuit Breaker Status channels) and 24, the CHANNEL CALIBRATION shall consist of verifying that the position indication conforms to actual circuit breaker position. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. NRC letter, T. G. Colburn (NRC) to M. P. Alexich (Indiana Michigan Power Company), "Emergency Response Capability - Conformance to Regulatory Guide 1.97 Revision 3 for the D. C. Cook Nuclear Plant, Units 1 and 2," dated December 14, 1990.
| |
| : 2. UFSAR, Table 7.8-1.
| |
| : 3. Regulatory Guide 1.97, Revision 3, May 1983.
| |
| : 4. NUREG-0737, Supplement 1, "TMI Action Items."
| |
| : 5. NRC letter, P.S.Tam (NRC), to M. K. Nazar, (Indiana Michigan Power Company), "Donald C. Cook Nuclear Plant, Units 1 & 2 (DCCNP-1 and DCCNP-2) - Issuance of Amendments Re: Containment Sump Modifications per Generic Letter 2004-02 (TAC Nos. MD5901 and MD5902)," dated October 18, 2007.
| |
| Cook Nuclear Plant Unit 2 B 3.3.3-14 Revision No. 60
| |
| | |
| Remote Shutdown Monitoring Instrumentation B 3.3.4 B 3.3 INSTRUMENTATION B 3.3.4 Remote Shutdown Monitoring Instrumentation BASES BACKGROUND The remote shutdown monitoring instrumentation provides the control room operator with sufficient instrumentation to support placing and maintaining the unit in a safe shutdown condition from a location other than the control room. This capability is necessary to protect against the possibility that the control room becomes inaccessible. A safe shutdown condition is defined as MODE 3. With the unit in MODE 3, the Auxiliary Feedwater (AFW) System and the main steam safety valves or the steam generator power operated relief valves can be used to remove core decay heat and meet all safety requirements. The long term supply of water for the AFW System and the ability to borate the Reactor Coolant System (RCS) from outside the control room allows extended operation in MODE 3.
| |
| If the control room becomes inaccessible, the operators can monitor the status of the reactor at the hot shutdown panel. The hot shutdown panel is located in the rear of the opposite units control room. The unit automatically reaches MODE 3 following a unit shutdown and can be maintained safely in MODE 3 for an extended period of time.
| |
| The OPERABILITY of the remote shutdown monitoring instrumentation functions ensures there is sufficient information available on selected unit parameters to support placing and maintaining the unit in MODE 3 should the control room become inaccessible.
| |
| APPLICABLE Remote shutdown monitoring instrumentation is required to provide SAFETY equipment at appropriate locations outside the control room with a ANALYSES capability to monitor the prompt shutdown to MODE 3, including the necessary instrumentation to support maintaining the unit in a safe condition in MODE 3.
| |
| The criteria governing the design and specific system requirements of the remote shutdown monitoring instrumentation are located in Plant Specific Design Criterion (PSDC) 11 (Ref. 1).
| |
| Remote Shutdown Monitoring Instrumentation satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The Remote Shutdown Monitoring Instrumentation LCO provides the OPERABILITY requirements of the monitoring instrumentation necessary to support placing and maintaining the unit in MODE 3 from a location other than the control room. The instrumentation required are listed in Table B 3.3.4-1.
| |
| Cook Nuclear Plant Unit 2 B 3.3.4-1 Revision No. 0
| |
| | |
| Remote Shutdown Monitoring Instrumentation B 3.3.4 BASES LCO (continued)
| |
| The monitoring instrumentation are those required for monitoring:
| |
| * Reactivity control;
| |
| * RCS pressure control;
| |
| * Reactor heat removal; and
| |
| * RCS makeup.
| |
| A Function of a remote shutdown monitoring instrumentation is OPERABLE if each instrument channel needed to support the remote shutdown monitoring instrumentation Function is OPERABLE with readout displayed external to the control room (i.e., on the hot shutdown panel located in the other units control room). For Function 1, each reactor trip breaker indication channel is provided by a single light to indicate whether the breaker is open or closed.
| |
| The remote shutdown monitoring instrumentation covered by this LCO do not need to be energized to be considered OPERABLE. This LCO is intended to ensure the instrumentation will be OPERABLE if unit conditions require that the remote shutdown monitoring instrumentation be placed in operation.
| |
| APPLICABILITY The Remote Shutdown Monitoring Instrumentation LCO is applicable in MODES 1, 2, and 3. This is required so that the unit can be placed and maintained in MODE 3 for an extended period of time from a location other than the control room.
| |
| This LCO is not applicable in MODE 4, 5, or 6. In these MODES, the facility is already subcritical and in a condition of reduced RCS energy.
| |
| Under these conditions, considerable time is available to restore necessary instrument functions if control room instruments become unavailable.
| |
| ACTIONS Remote shutdown monitoring instrumentation is inoperable when each Function is not accomplished by at least one designated remote shutdown monitoring instrumentation channel that satisfies the OPERABILITY criteria for the channel's Function. These criteria are outlined in the LCO section of the Bases.
| |
| A Note has been added to the ACTIONS to clarify the application of Completion Time rules. Separate Condition entry is allowed for each Function. The Completion Time(s) of the inoperable channel of a Cook Nuclear Plant Unit 2 B 3.3.4-2 Revision No. 0
| |
| | |
| Remote Shutdown Monitoring Instrumentation B 3.3.4 BASES ACTIONS (continued)
| |
| Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.
| |
| A.1 Condition A addresses the situation where one or more required Functions of the remote shutdown monitoring instrumentation are inoperable. The Required Action is to restore the required Function to OPERABLE status within 30 days. The Completion Time is based on operating experience and the low probability of an event that would require evacuation of the control room.
| |
| B.1 and B.2 If the Required Action and associated Completion Time of Condition A is not met, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| SURVEILLANCE SR 3.3.4.1 REQUIREMENTS Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
| |
| Agreement criteria are determined by the unit staff, based on a combination of the channel instrument uncertainties, including indication and readability. If the channels are within the criteria, it is an indication that the channels are OPERABLE. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.
| |
| Cook Nuclear Plant Unit 2 B 3.3.4-3 Revision No. 60
| |
| | |
| Remote Shutdown Monitoring Instrumentation B 3.3.4 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| As specified in the Surveillance, a CHANNEL CHECK is only required for those channels which are normally energized.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.4.2 CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy.
| |
| For the Reactor Trip Breaker Indication Function on the hot shutdown panel, the CHANNEL CALIBRATION shall consist of verifying that the position indication conforms to actual reactor trip breaker position.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 1.4.3.
| |
| Cook Nuclear Plant Unit 2 B 3.3.4-4 Revision No. 60
| |
| | |
| Remote Shutdown Monitoring Instrumentation B 3.3.4 Table B 3.3.4-1 (page 1 of 1)
| |
| Remote Shutdown Monitoring Instrumentation REQUIRED NUMBER FUNCTION MEASUREMENT RANGE OF CHANNELS
| |
| : 1. Reactor Trip Breaker Open - Close 1 per trip breaker Indication
| |
| : 2. Pressurizer Pressure 1700 - 2500 psig 1
| |
| : 3. Pressurizer Level 0 - 100% of instrument span 1
| |
| : 4. Steam Generator Pressure 0 - 1200 psig 1 (per steam generator)
| |
| : 5. Steam Generator Level 0 - 100% wide range 1 (per steam generator instrument span Cook Nuclear Plant Unit 2 B 3.3.4-5 Revision No. 0
| |
| | |
| LOP DG Start Instrumentation B 3.3.5 B 3.3 INSTRUMENTATION B 3.3.5 Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation BASES BACKGROUND The DGs provide a source of emergency power when offsite power is either unavailable or is insufficiently stable to allow safe unit operation.
| |
| Undervoltage protection will generate an LOP start actuation of the DG(s) if either a loss of voltage or a degraded voltage condition associated with offsite power occurs.
| |
| Three undervoltage relays with time delays are provided for each 4.16 kV emergency bus for detecting a loss of bus voltage. The relays are combined in a two-out-of-three logic to generate an LOP signal (i.e., the required number of channels required to trip to generate an LOP signal is two per bus) if the voltage is below approximately 78% for a short time.
| |
| The LOP start actuation for the Loss of Voltage Function is discussed in UFSAR, Section 8.4 (Ref. 1).
| |
| Undervoltage relays and time delays are also provided for detecting a sustained degraded voltage condition. Three undervoltage relays with time delays are provided for one Train "A" 4.16 kV emergency bus (T21D). Three undervoltage relays with time delays are provided for one Train "B" 4.16 kV emergency bus (T21A). The relays are combined in a two-out-of-three logic to generate an LOP signal (i.e., the required number of channels required to trip to generate an LOP signal is two per train) if the voltage is below approximately 93% for a specified delay time. If an accident signal (i.e., Steam Generator Water Level - Low Low signal or a Safety Injection signal) is present coincident with a degraded voltage condition, the delay time is approximately 9 seconds. If no accident signal is present coincident with a degraded voltage condition, the delay time is approximately 2 minutes. The LOP start actuation for the Degraded Voltage Function is discussed in UFSAR, Section 8.5 (Ref. 2).
| |
| The Allowable Value in conjunction with the trip setpoint and LCO establishes the threshold for Engineered Safety Features Actuation System (ESFAS) action to prevent exceeding acceptable limits such that the consequences of Design Basis Accidents (DBAs) will be acceptable.
| |
| The Allowable Value is considered a limiting value such that a channel is OPERABLE if the setpoint is found not to exceed the Allowable Value during the CHANNEL CALIBRATION. Note that although a channel is OPERABLE under these circumstances, the setpoint must be left adjusted to within the established calibration tolerance band of the setpoint in accordance with uncertainty assumptions stated in the referenced setpoint methodology, (as-left-criteria) and confirmed to be operating within the statistical allowances of the uncertainty terms assigned.
| |
| Cook Nuclear Plant Unit 2 B 3.3.5-1 Revision No. 0
| |
| | |
| LOP DG Start Instrumentation B 3.3.5 BASES BACKGROUND (continued)
| |
| Allowable Values and LOP DG Start Instrumentation Setpoints The trip setpoints used in the relays are based on preserving the analytical limits presented in UFSAR, Chapter 14 (Ref. 3). The selection of these trip setpoints is such that adequate protection is provided when all sensor and processing time delays are taken into account.
| |
| Setpoints adjusted consistent with the requirements of the Allowable Value ensure that the consequences of accidents will be acceptable, providing the unit is operated from within the LCOs at the onset of the accident and that the equipment functions as designed.
| |
| Allowable Values are specified for each Function in SR 3.3.5.3. Nominal Trip Setpoints are specified in the unit specific setpoint calculations. The trip setpoints are selected to ensure that the setpoint measured by the Surveillance procedure does not exceed the Allowable Value if the relay is performing as required. If the measured setpoint does not exceed the Allowable Value, the relay is considered OPERABLE. Operation with a trip setpoint less conservative than the Nominal Trip Setpoint, but within the Allowable Value, is acceptable provided that operation and testing is consistent with the assumptions of the unit specific setpoint calculation (Ref. 4).
| |
| APPLICABLE The LOP DG start instrumentation is required for the ESF Systems to SAFETY function in any accident with a loss of offsite power. Its design basis is ANALYSES that of the ESF Actuation System (ESFAS).
| |
| Accident analyses credit the loading of the DG based on the loss of offsite power during a loss of coolant accident (LOCA). The actual DG start has historically been associated with the ESFAS actuation. The DG loading has been included in the delay time associated with each safety system component requiring DG supplied power following a loss of offsite power.
| |
| The analyses assume a non-mechanistic DG loading, which does not explicitly account for each individual component of loss of power detection and subsequent actions.
| |
| The required channels of LOP DG start instrumentation, in conjunction with the ESF systems powered from the DGs, provide unit protection in the event of any of the analyzed accidents discussed in Reference 3, in which a loss of offsite power is assumed.
| |
| The delay times assumed in the safety analysis for the ESF equipment include the DG start delay, and the appropriate sequencing delay, if applicable. The response times for ESFAS actuated equipment in Cook Nuclear Plant Unit 2 B 3.3.5-2 Revision No. 0
| |
| | |
| LOP DG Start Instrumentation B 3.3.5 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| LCO 3.3.2, "Engineered Safety Feature Actuation System (ESFAS)
| |
| Instrumentation," include the appropriate DG loading and sequencing delay.
| |
| The LOP DG start instrumentation channels satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The LCO for LOP DG start instrumentation requires that three channels per bus of the Loss of Voltage Function and three channels per train of the Degraded Voltage Function shall be OPERABLE in MODES 1, 2, 3, and 4 since the LOP DG start instrumentation supports safety systems associated with the ESFAS. In MODES 5 and 6, the LOP DG start instrumentation for the Loss of Voltage Function must be OPERABLE whenever the associated DG is required to be OPERABLE to ensure that the automatic start of the DG is available when needed. A channel is OPERABLE with a trip setpoint value outside its calibration tolerance band provided the trip setpoint "as-found" value does not exceed its associated Allowable Value and provided the trip setpoint "as-left" value is adjusted to a value within the "as-left" calibration tolerance band of the Nominal Trip Setpoint. A trip setpoint may be set more conservative than the Nominal Trip Setpoint as necessary in response to unit conditions.
| |
| Loss of the LOP DG Start Instrumentation Function could result in the delay of safety systems initiation when required. This could lead to unacceptable consequences during accidents. During the loss of offsite power the DG powers the motor driven auxiliary feedwater pumps.
| |
| Failure of these pumps to start would leave only one turbine driven pump, as well as an increased potential for a loss of decay heat removal through the secondary system.
| |
| APPLICABILITY The LOP DG Start Instrumentation Functions are required in MODES 1, 2, 3, and 4 because ESF Functions are designed to provide protection in these MODES. Actuation in MODES or other specified conditions other than MODES 1, 2, 3, and 4 is required whenever the required DG must be OPERABLE so that it can perform its function on a loss of voltage to the associated emergency bus. The Degraded Voltage Function is not required in MODES or other specified conditions other than MODES 1, 2, 3, and 4 since the accident analysis does not assume this protection is OPERABLE. The Degraded Voltage Function is only required to provide undervoltage protection to automatically actuated ESFAS equipment during a sustained degraded voltage condition, and in MODES other than MODES 1, 2, 3, and 4, the ESFAS equipment is not automatically actuated.
| |
| Cook Nuclear Plant Unit 2 B 3.3.5-3 Revision No. 0
| |
| | |
| LOP DG Start Instrumentation B 3.3.5 BASES ACTIONS In the event a channel's trip setpoint is found nonconservative with respect to the Allowable Value, or the channel is found inoperable, then the function that channel provides must be declared inoperable and the LCO Condition entered for the particular protection function affected.
| |
| A Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed in the LCO. The Completion Time(s) of the inoperable channel(s)/train(s) of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.
| |
| A.1 Condition A applies to the LOP DG start Functions with one loss of voltage channel per bus or one degraded voltage channel per train inoperable.
| |
| If one channel is inoperable, Required Action A.1 requires that channel to be placed in trip within 1 hour. With a channel in trip, the LOP DG start instrumentation channels are configured to provide a one-out-of-two logic to generate an LOP signal.
| |
| The specified Completion Time is reasonable considering the Function maintains LOP DG start actuation capability on each associated 4.16 kV emergency bus and the low probability of an event occurring during these intervals.
| |
| B.1 Condition B applies when more than one loss of voltage channel per bus or more than one degraded voltage channel per train are inoperable.
| |
| Required Action B.1 requires restoring all but one channel per bus or train to OPERABLE status. The 1 hour Completion Time should allow ample time to repair most failures and takes into account the low probability of an event requiring an LOP DG start actuation occurring during this interval.
| |
| C.1 Condition C applies to each of the LOP DG start Functions when the Required Action and associated Completion Time for Condition A or B are not met.
| |
| In these circumstances the Conditions specified in LCO 3.8.1, "AC Sources - Operating," or LCO 3.8.2, "AC Sources - Shutdown," for the DG Cook Nuclear Plant Unit 2 B 3.3.5-4 Revision No. 0
| |
| | |
| LOP DG Start Instrumentation B 3.3.5 BASES ACTIONS (continued) made inoperable by failure of the LOP DG start instrumentation are required to be entered immediately. The actions of those LCOs provide for adequate compensatory actions to assure unit safety.
| |
| SURVEILLANCE SR 3.3.5.1 REQUIREMENTS Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
| |
| Agreement criteria are determined by the unit staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.5.2 SR 3.3.5.2 is the performance of a TADOT. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable TADOT of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. The test checks trip devices that provide actuation signals directly, bypassing the analog process control equipment. The SRs are modified by a Note that excludes verification of setpoints for relays. Relay setpoints require elaborate bench calibration and are verified during CHANNEL CALIBRATION. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Cook Nuclear Plant Unit 2 B 3.3.5-5 Revision No. 60
| |
| | |
| LOP DG Start Instrumentation B 3.3.5 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.3.5.3 SR 3.3.5.3 is the performance of a CHANNEL CALIBRATION. The setpoints, as well as the response to a loss of voltage and a degraded voltage test, shall include a single point verification that the trip occurs within the required time delay.
| |
| CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 8.4.
| |
| : 2. UFSAR, Section 8.5.
| |
| : 3. UFSAR, Chapter 14.
| |
| : 4. WCAP-12741, "Westinghouse Menu Driven Setpoint Calculation Program (STEPIT)," as approved in Unit 1 and Unit 2 License Amendments 175 and 160, dated May 13, 1994.
| |
| Cook Nuclear Plant Unit 2 B 3.3.5-6 Revision No. 60
| |
| | |
| Containment Purge Supply and Exhaust System Isolation Instrumentation B 3.3.6 B 3.3 INSTRUMENTATION B 3.3.6 Containment Purge Supply and Exhaust System Isolation Instrumentation BASES BACKGROUND Containment Purge Supply and Exhaust System isolation instrumentation closes the containment purge supply and exhaust isolation valves, containment instrumentation room purge supply and exhaust valves, and containment pressure relief isolation valves. This action isolates the containment atmosphere from the environment to minimize releases of radioactivity in the event of an accident. The system may be in use during reactor operation and with the reactor shutdown.
| |
| Containment Purge Supply and Exhaust System isolation initiates on an automatic Safety Injection (SI) signal, by manual actuation of Phase A Isolation, or manual actuation of Phase B isolation. The Bases for LCO 3.3.2, "Engineered Safety Feature Actuation System (ESFAS)
| |
| Instrumentation," discuss these modes of initiation.
| |
| Three radiation monitoring channels in each of two trains are also provided as input to the Containment Purge Supply and Exhaust System isolation. The channels in each train measure containment radiation at two locations. One channel in each train is an upper containment area radiation monitor, and the other two channels in each train measure radiation in lower containment samples. The radiation detectors that measure radiation in the lower containment samples are of two different types: gaseous and particulate. For the purpose of this LCO, the three radiation monitors in each train are considered redundant even though they measure radiation in different locations of the containment. The radiation monitors are arranged such that any one of the three radiation monitor channels in a train will initiate a Containment Purge Supply and Exhaust System isolation of the associated train of containment isolation valves in the Containment Purge Supply and Exhaust System. Since the radiation monitors that measure the radiation in lower containment constitute a sampling system, various components such as sample line valves and sample pumps are required to support the OPERABILITY of these monitors.
| |
| Containment Purge Supply and Exhaust System has inner and outer containment isolation valves. A Train "A" Containment Purge Supply and Exhaust System Isolation signal closes the inner containment isolation valves in the Containment Purge Supply and Exhaust System. A Train "B" Containment Purge Supply and Exhaust System Isolation signal closes the outer containment isolation valves in the Containment Purge Supply and Exhaust System. The Containment Purge Supply and Exhaust System is described in UFSAR, Section 5.5.3 (Ref. 1).
| |
| Cook Nuclear Plant Unit 2 B 3.3.6-1 Revision No. 0
| |
| | |
| Containment Purge Supply and Exhaust System Isolation Instrumentation B 3.3.6 BASES APPLICABLE The safety analyses assume that the containment remains intact with SAFETY penetrations unnecessary for core cooling isolated early in the event.
| |
| ANALYSES The isolation of the valves isolated by this instrumentation has not been analyzed mechanistically in the dose calculations, although its rapid isolation is assumed. The Containment Purge Supply and Exhaust System isolation radiation monitors act as backup to the SI signal to ensure closing of the containment purge supply and exhaust valves.
| |
| Containment isolation in turn ensures meeting the containment leakage rate assumptions of the safety analyses, and ensures that the calculated accidental offsite radiological doses are below 10 CFR 50.67 (Ref. 2) limits.
| |
| The Containment Purge Supply and Exhaust System isolation instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The LCO requirements ensure that the instrumentation necessary to initiate Containment Purge Supply and Exhaust System isolation, listed in Table 3.3.6-1, is OPERABLE.
| |
| : 1. Manual Initiation The LCO requires one channel per train to be OPERABLE. The operator can initiate Containment Purge Supply and Exhaust System isolation at any time by using either of two switches (manual Containment Isolation - Phase A actuation or manual Containment Spray, Containment Isolation - Phase B actuation) in either Train "A" or Train "B" in the control room. Each switch actuates its associated train. This action will cause actuation of components in the same manner as any of the automatic actuation signals.
| |
| The LCO for Manual Initiation ensures the proper amount of redundancy is maintained in the manual actuation circuitry to ensure the operator has manual initiation capability.
| |
| Each channel consists of one switch and the interconnecting wiring to the actuation logic. These switches are common to ESFAS Containment Isolation, Phase A and B Manual Initiation switches.
| |
| : 2. Automatic Actuation Logic and Actuation Relays The LCO requires two trains of Automatic Actuation Logic and Actuation Relays OPERABLE to ensure that no single random failure can prevent automatic actuation.
| |
| Automatic Actuation Logic and Actuation Relays consist of the same features and operate in the same manner as described for ESFAS Cook Nuclear Plant Unit 2 B 3.3.6-2 Revision No. 59
| |
| | |
| Containment Purge Supply and Exhaust System Isolation Instrumentation B 3.3.6 BASES LCO (continued)
| |
| Function 1.b, SI, ESFAS Function 3.a, Containment Phase A Isolation, and ESFAS Function 3.b, Containment Phase B Isolation.
| |
| The applicable MODES and specified conditions for the containment purge isolation portion of these Functions are different than those for their Phase A and Phase B isolation and SI roles. If one or more of the Phase A or Phase B isolation Functions becomes inoperable in such a manner that only the Containment Purge Supply and Exhaust System Isolation Function is affected, the Conditions applicable to their Phase A and Phase B isolation Functions need not be entered.
| |
| The less restrictive Actions specified for inoperability of the Containment Purge Supply and Exhaust System Isolation Functions specify sufficient compensatory measures for this case.
| |
| : 3. Containment Radiation (per train)
| |
| The LCO specifies three channels per train of radiation monitors during MODES 1, 2, 3, and 4 when any Containment Purge Supply and Exhaust System penetration flow path is open and two channels per train of radiation monitors during movement of irradiated fuel assemblies within containment to ensure that the radiation monitoring instrumentation necessary to initiate Containment Purge Supply and Exhaust System isolation remains OPERABLE. Each train is treated separately and each train is considered a separate Function.
| |
| Therefore, separate Condition entry is allowed for each train. This is acceptable since each train has either three or two required channels (with one out of the three necessary for a Containment Radiation signal), and the channels of one train are independent from the channels of the other train.
| |
| For sampling systems, channel OPERABILITY involves more than OPERABILITY of the channel electronics. OPERABILITY also requires correct valve lineups and sample pump operation, as well as detector OPERABILITY.
| |
| : 4. Safety Injection (SI) Input from Engineered Safety Features Actuation System (ESFAS)
| |
| Containment Purge Supply and Exhaust System Isolation is also initiated by all Functions that initiate SI. The Containment Purge Supply and Exhaust System Isolation function requirements for these Functions are the same as the requirements for their SI function, with the exception of the Applicability. Therefore, the requirements are not repeated in Table 3.3.6-1. Instead Function 1, SI, is referenced for all initiating functions and requirements, with the exception of the Applicability.
| |
| Cook Nuclear Plant Unit 2 B 3.3.6-3 Revision No. 0
| |
| | |
| Containment Purge Supply and Exhaust System Isolation Instrumentation B 3.3.6 BASES APPLICABILITY The Manual Initiation and Automatic Actuation Logic and Actuation Relays Functions are required to be OPERABLE in MODES 1, 2, 3, and 4, and during movement of irradiated fuel assemblies within containment. The Containment Radiation (per train) Function is required to be OPERABLE in MODES 1, 2, 3, and 4 when any Containment Purge Supply and Exhaust System penetration flow path is open and during movement of irradiated fuel assemblies within containment. By only requiring the Function to be OPERABLE when any Containment Purge Supply Exhaust System penetration flow path is open, this allows the Containment Radiation trip signal to the Containment Purge Supply and Exhaust System valves to be manually bypassed in MODES 1, 2, 3 and 4 when all the penetration flow paths are isolated (by at least one closed automatic valve). The SI Input from ESFAS Function is required to be OPERABLE in MODES 1, 2, 3, and 4. Under these conditions, the potential exists for an accident that could release significant fission product radioactivity into containment. Therefore, the Containment Purge Supply and Exhaust System isolation instrumentation must be OPERABLE in these MODES and other specified conditions.
| |
| While in MODES 5 and 6 without fuel handling in progress, the Containment Purge Supply and Exhaust System isolation instrumentation need not be OPERABLE since the potential for radioactive releases is minimized and operator action is sufficient to ensure post accident offsite doses are maintained within the limits of Reference 2.
| |
| ACTIONS The most common cause of channel inoperability is outright failure or drift of the bistable or process module sufficient to exceed the tolerance allowed by unit specific calibration procedures. Typically, the drift is found to be small and results in a delay of actuation rather than a total loss of function. This determination is generally made during the performance of a COT, when the process instrumentation is set up for adjustment to bring it within specification. If the trip setpoint is less conservative than the Allowable Value specified in Table 3.3.6-1, the channel must be declared inoperable immediately and the appropriate Condition entered.
| |
| A Note has been added to the ACTIONS (Note 1) to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed in Table 3.3.6-1. The Completion Time(s) of the inoperable channel(s)/train(s) of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.
| |
| Note 2 has also been added and states that the containment pressure relief penetration flow path may be unisolated intermittently under administrative controls to maintain containment pressure within the Cook Nuclear Plant Unit 2 B 3.3.6-4 Revision No. 0
| |
| | |
| Containment Purge Supply and Exhaust System Isolation Instrumentation B 3.3.6 BASES ACTIONS (continued) required limits of LCO 3.6.4, "Containment Pressure." These administrative controls consist of stationing a dedicated operator at the valve controls, who is in continuous communication with the control room.
| |
| In this way, the penetration can be rapidly isolated when a need for Containment Purge Supply and Exhaust System isolation is indicated.
| |
| A.1 Condition A applies to the failure of one radiation monitor channel in MODE 1, 2, 3, or 4 when any Containment Purge Supply and Exhaust System penetration flow path is open. When one channel in a train is inoperable, the channel must be restored to OPERABLE status.
| |
| However, since there are two remaining OPERABLE channels in the train, and either one can still cause a Containment Purge Supply and Exhaust System isolation, operation is allowed to continue until the next refueling outage. This is also the reason for allowing LCO 3.0.4.c to be applicable (Note to Required Action A.1). The inoperable channel is only required to be restored to OPERABLE status prior to entering MODE 4 from MODE 5 during the startup following a refueling outage. This allows operation to continue throughout the current fuel cycle and allows reactor startups to occur without restoring the inoperable channel, as long as a refueling outage has not occurred.
| |
| B.1 Condition B applies to the failure of one required radiation monitor channel during movement of irradiated fuel assemblies within containment. Since the two required containment radiation monitors per train measure different parameters, failure of a single channel may result in loss of the radiation monitoring Function for certain events.
| |
| Consequently, the failed channel must be restored to OPERABLE status.
| |
| The 4 hours allowed to restore the affected channel is justified by the low likelihood of events occurring during this interval, and recognition that one or more of the remaining channels will respond to most events.
| |
| C.1 Condition C applies to the manual initiation channels. If one or more required manual initiation channels are inoperable, 48 hours is allowed to restore the required channels to OPERABLE status. The specified Completion Time is reasonable considering that there are two automatic actuation trains OPERABLE for each Function, and the low probability of an event occurring during this interval.
| |
| Cook Nuclear Plant Unit 2 B 3.3.6-5 Revision No. 0
| |
| | |
| Containment Purge Supply and Exhaust System Isolation Instrumentation B 3.3.6 BASES ACTIONS (continued)
| |
| D.1 Condition D applies to all Containment Purge Supply and Exhaust System Isolation Functions. If one or more Automatic Actuation Logic and Actuation Relays trains are inoperable, one or more SI Input from ESFAS trains are inoperable, two or more required radiation monitoring channels in a single train are inoperable, or the Required Action and associated Completion Time of Condition A, B, or C are not met, operation may continue provided the containment purge supply and exhaust isolation valves are placed in the closed position immediately.
| |
| Placing the containment purge supply and exhaust isolation valves in the closed position accomplishes the safety function of the inoperable trains or channels.
| |
| SURVEILLANCE A Note has been added to the SR Table to clarify that Table 3.3.6-1 REQUIREMENTS determines which SRs apply to which Containment Purge Supply and Exhaust System Isolation Instrumentation Functions.
| |
| SR 3.3.6.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
| |
| Agreement criteria are determined by the unit staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Cook Nuclear Plant Unit 2 B 3.3.6-6 Revision No. 60
| |
| | |
| Containment Purge Supply and Exhaust System Isolation Instrumentation B 3.3.6 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.3.6.2 SR 3.3.6.2 is the performance of an ACTUATION LOGIC TEST. The train being tested may be placed in the bypass condition, thus preventing actuation. Through the semiautomatic tester, all possible logic combinations, with and without applicable permissives, may be tested for each protection function. In addition, the master relay coil may be pulse tested for continuity. This verifies that the logic modules are OPERABLE and there is an intact voltage signal path to the master relay coils. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.6.3 SR 3.3.6.3 is the performance of a MASTER RELAY TEST. The MASTER RELAY TEST is the energizing of the master relay, verifying contact operation and a low voltage continuity check of the slave relay coil. Upon master relay contact operation, a low voltage is injected to the slave relay coil. This voltage is insufficient to pick up the slave relay, but large enough to demonstrate signal path continuity. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.6.4 A COT is performed on each required channel to ensure the entire channel will perform the intended Function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable COT of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. This test verifies the capability of the instrumentation to provide the Containment Purge Supply and Exhaust System isolation. The setpoint shall be left consistent with the current unit specific calibration procedure tolerance.
| |
| SR 3.3.6.5 SR 3.3.6.5 is the performance of a SLAVE RELAY TEST. The SLAVE RELAY TEST is the energizing of the slave relays. Contact operation is verified in one of two ways. Actuation equipment that may be operated in the design mitigation mode is either allowed to function or is placed in a condition where the relay contact operation can be verified without Cook Nuclear Plant Unit 2 B 3.3.6-7 Revision No. 60
| |
| | |
| Containment Purge Supply and Exhaust System Isolation Instrumentation B 3.3.6 BASES SURVEILLANCE REQUIREMENTS (continued) operation of the equipment. Actuation equipment that may not be operated in the design mitigation mode is prevented from operation by the SLAVE RELAY TEST circuit. For this latter case, contact operation is verified by a continuity check of the circuit containing the slave relay. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.6.6 SR 3.3.6.6 is the performance of a TADOT. This test is a check of the Manual Initiation Function. Each Manual Initiation Function is tested up to, and including, the master relay coils. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable TADOT of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. In some instances, the test includes actuation of the end device (i.e., valves cycle).
| |
| The SR is modified by a Note that excludes verification of setpoints during the TADOT. The Function tested has no setpoints associated with it.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.6.7 CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 5.5.3.
| |
| : 2. 10 CFR 50.67.
| |
| : 3. WCAP-15376, Rev. 0, October 2000.
| |
| Cook Nuclear Plant Unit 2 B 3.3.6-8 Revision No. 60
| |
| | |
| CREV System Actuation Instrumentation B 3.3.7 B 3.3 INSTRUMENTATION B 3.3.7 Control Room Emergency Ventilation (CREV) System Actuation Instrumentation BASES BACKGROUND The CREV System provides a protected environment from which the unit can be operated following an uncontrolled release of radioactivity. During normal unit operation, the Control Room Air Conditioning (CRAC) System portion of the Control Room Ventilation System is operated in the air conditioning mode, which is further described in the Bases of LCO 3.7.11, "Control Room Air Conditioning (CRAC) System." Upon receipt of an actuation signal, the CREV System initiates filtered ventilation and pressurization of the control room. This system is described in the Bases for LCO 3.7.10, "Control Room Emergency Ventilation (CREV) System."
| |
| The actuation instrumentation consists of Safety Injection (SI) signals from both units as well as Automatic Actuation Logic and Actuation Relays from both units. The SI Function is discussed in LCO 3.3.2, "Engineered Safety Feature Actuation System (ESFAS) Instrumentation."
| |
| APPLICABLE The control room must be kept habitable for the operators stationed there SAFETY during accident recovery and post accident operations.
| |
| ANALYSES The CREV System acts to terminate the supply of unfiltered outside air to the control room, initiate filtration, and pressurize the control room. These actions are necessary to ensure the control room is kept habitable for the operators stationed there during accident recovery and post accident operations by minimizing the radiation exposure of control room personnel.
| |
| The CREV System actuation instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The LCO requirements ensure that instrumentation necessary to initiate the CREV System is OPERABLE.
| |
| : 1. and 3. Automatic Actuation Logic and Actuation Relays The LCO requires two trains of Automatic Actuation Logic and Actuation Relays from each unit to be OPERABLE to ensure that no single random failure can prevent automatic actuation.
| |
| Automatic Actuation Logic and Actuation Relays consist of the same features and operate in the same manner as described for ESFAS Function 1.b, SI, in LCO 3.3.2. The specified conditions for the CREV System portion of these Functions are different and less restrictive than those specified for their SI Cook Nuclear Plant Unit 2 B 3.3.7-1 Revision No. 0
| |
| | |
| CREV System Actuation Instrumentation B 3.3.7 BASES LCO (continued) roles. If one or more of the SI Functions becomes inoperable in such a manner that only the CREV System Function is affected, the Conditions applicable to their SI Function need not be entered. The less restrictive ACTIONS specified for inoperability of the CREV System Functions specify sufficient compensatory measures for this case.
| |
| : 2. and 4. Safety Injection Input from ESFAS CREV System Actuation is also initiated by all Functions that initiate SI. The CREV System Actuation function requirements for these Functions are the same as the requirements for their SI function, with the exception of the Applicability. Therefore, the requirements are not repeated in Table 3.3.7-1. Instead Function 1, SI, is referenced for all initiating functions and requirements, with the exception of the Applicability.
| |
| APPLICABILITY The CREV System Actuation Instrumentation Functions must be OPERABLE in MODE 1, 2, 3, or 4, and when Unit 1 is in MODE 1, 2, 3, or 4 to ensure a habitable environment for the control room operators.
| |
| The CREV System Actuation Instrumentation is not required in MODES 5 and 6 since the CREV System is not required OPERABLE in these MODES. During movement of irradiated fuel assemblies, CREV System Actuation Instrumentation Functions are not required to be OPERABLE since the fuel handling accident analysis assumes manual actuation of the CREV trains.
| |
| ACTIONS A Note has been added to the ACTIONS indicating that separate Condition entry is allowed for each Function. The Conditions of this Specification may be entered independently for each Function listed in Table 3.3.7-1 in the accompanying LCO. The Completion Time(s) of the inoperable train(s) of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.
| |
| A.1 Condition A applies to the Automatic Actuation Logic and Actuation Relays Functions of the CREV System.
| |
| If one train is inoperable in one or more required Functions, the associated CREV train must be placed in the pressurization/cleanup mode of operation within 7 days. This accomplishes the actuation instrumentation Function and places the unit in a conservative mode of operation. The 7 day Completion Time is the same as is allowed if one Cook Nuclear Plant Unit 2 B 3.3.7-2 Revision No. 0
| |
| | |
| CREV System Actuation Instrumentation B 3.3.7 BASES ACTIONS (continued) train of the mechanical portion of the system is inoperable. The basis for this Completion Time is the same as provided in LCO 3.7.10.
| |
| B.1.1, B.1.2, and B.2 Condition B applies to the failure of two CREV System Automatic Actuation Logic and Actuation Relays trains in one or more required Functions. The first Required Action is to place one CREV train in the pressurization/cleanup mode of operation immediately. This accomplishes the actuation instrumentation Function that may have been lost and places the unit in a conservative mode of operation. The applicable Conditions and Required Actions of LCO 3.7.10 must also be entered for the CREV train made inoperable by the inoperable actuation instrumentation. This ensures appropriate limits are placed upon train inoperability as discussed in the Bases for LCO 3.7.10.
| |
| Alternatively, both trains may be placed in the pressurization/cleanup mode. This ensures the CREV System function is performed even in the presence of a single failure.
| |
| C.1 and C.2 Condition C applies when the Required Action and associated Completion Time for Condition A or B have not been met. The unit must be brought to a MODE in which the LCO requirements are not applicable.
| |
| To achieve this status, the unit must be brought to MODE 3 within 6 hours and MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| SURVEILLANCE A Note has been added to the SR Table to clarify that Table 3.3.7-1 REQUIREMENTS determines which SRs apply to which CREV System Actuation Instrumentation Functions.
| |
| SR 3.3.7.1 SR 3.3.7.1 is the performance of an ACTUATION LOGIC TEST. The train being tested is placed in the bypass condition, thus preventing inadvertent actuation. Through the semiautomatic tester, all possible logic combinations, with and without applicable permissives, are tested for each protection function. In addition, the mater relay coil is pulse tested for continuity. This verifies that the logic modules are OPERABLE and there is an intact voltage signal path to the master relay coils. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Cook Nuclear Plant Unit 2 B 3.3.7-3 Revision No. 60
| |
| | |
| CREV System Actuation Instrumentation B 3.3.7 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.3.7.2 SR 3.3.7.2 is the performance of a MASTER RELAY TEST. The MASTER RELAY TEST is the energizing of the master relay, verifying contact operation and a low voltage continuity check of the slave relay coil. Upon master relay contact operation, a low voltage is injected to the slave relay coil. This voltage is insufficient to pick up the slave relay, but large enough to demonstrate signal path continuity. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.7.3 SR 3.3.7.3 is the performance of a SLAVE RELAY TEST. The SLAVE RELAY TEST is the energizing of the slave relays. Contact operation is verified in one of two ways. Actuation equipment that may be operated in the design mitigation MODE is either allowed to function or is placed in a condition where the relay contact operation can be verified without operation of the equipment. Actuation equipment that may not be operated in the design mitigation MODE is prevented from operation by the SLAVE RELAY TEST circuit. For this latter case, contact operation is verified by a continuity check of the circuit containing the slave relay. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. WCAP-15376, Rev. 0, October 2000.
| |
| Cook Nuclear Plant Unit 2 B 3.3.7-4 Revision No. 60
| |
| | |
| BDMI B 3.3.8 B 3.3 INSTRUMENTATION B 3.3.8 Boron Dilution Monitoring Instrumentation (BDMI)
| |
| BASES BACKGROUND The primary purpose of the BDMI is to provide indication of inadvertent positive reactivity changes when the reactor is in a shutdown condition (i.e., MODES 3, 4, and 5). Based on this indication, operator action can be taken to mitigate the consequences of the inadvertent addition of unborated primary grade water into the Reactor Coolant System (RCS).
| |
| The BDMI utilizes two channels of Westinghouse source range instrumentation. The source range neutron flux monitors are used to monitor the core reactivity condition. The installed source range neutron flux monitors are part of the Nuclear Instrumentation System. These detectors are located external to the reactor vessel and detect neutrons leaking from the core.
| |
| The installed source range neutron flux monitors are BF3 detectors operating in the proportional region of the gas filled detector characteristic curve. The detectors monitor the neutron flux in counts per second. The instrument range covers six decades of neutron flux (1E+6 cps). The detectors also provide continuous visual indication in the control room and an audible count rate (selectable between the source range neutron flux monitor channels) to alert operators to a possible dilution accident.
| |
| APPLICABLE The source range neutron flux monitor channels of the BDMI are credited SAFETY in the boron dilution accident analysis in the UFSAR (Ref. 1) to alert the ANALYSES operators of an event that could lead to an inadvertent criticality. The accident analyses rely on operator action to mitigate the consequences of inadvertent boron dilution events.
| |
| The BDMI satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO LCO 3.3.8 provides the requirements for OPERABILITY of two source range neutron flux monitor channels to provide protection against single failure. To be considered OPERABLE, each source range neutron flux monitor channel must provide visual neutron flux indication in the control room.
| |
| APPLICABILITY The BDMI must be OPERABLE in MODES 3, 4, and 5 because the safety analysis identifies this system as the primary means to indicate the need for operator action to mitigate an inadvertent boron dilution of the RCS.
| |
| The BDMI OPERABILITY requirements are not applicable in MODES 1 and 2 because an inadvertent boron dilution would be terminated by a source range trip, a trip on the Power Range Neutron Flux - High, or Cook Nuclear Plant Unit 2 B 3.3.8-1 Revision No. 0
| |
| | |
| BDMI B 3.3.8 BASES APPLICABILITY (continued)
| |
| Overtemperature T. These RTS Functions are discussed in LCO 3.3.1, "RTS Instrumentation."
| |
| In MODE 6, the requirements of LCO 3.9.2, "Nuclear Instrumentation,"
| |
| ensure that adequate instrumentation is available to indicate the need for operator action to mitigate an inadvertent dilution of the RCS.
| |
| ACTIONS A.1 With one source range neutron flux monitoring channel inoperable, Required Action A.1 requires that the inoperable channel must be restored to OPERABLE status within 7 days. In this condition, the remaining source range neutron flux monitoring channel is adequate to provide protection. The 7 day Completion Time is acceptable due to the low probability of a boron dilution accident and that one source range neutron flux monitoring channel remains OPERABLE.
| |
| B.1, B.2.1, B.2.2.1, and B.2.2.2 With two source range neutron flux monitoring channels inoperable, or the Required Action and associated Completion Time of Condition A not met, the initial action (Required Action B.1) is to suspend all operations involving positive reactivity additions immediately. This includes withdrawal of control or shutdown rods and intentional boron dilution.
| |
| Required Action B.1 is modified by two Notes. Note 1 permits unit temperature changes provided the temperature change is accounted for in the calculated SDM. Introduction of temperature changes, including temperature increases when a positive MTC exists, must be evaluated to ensure they do not result in a loss of required SDM. Note 2 permits addition of water from the refueling water storage tank (RWST) provided the RWST boron concentration is 2400 ppm. This boron concentration limit is established to meet SDM requirements. Therefore, SDM is maintained when water is added to the RCS from the RWST provided RWST boron concentration is 2400 ppm.
| |
| Required Action B.2.2.1 is modified by a Note stating the RWST is considered to be an unborated water source only if the RWST boron concentration is < 2400 ppm and less than the RCS boron concentration, in MODE 5. In MODES 3 and 4, these actions are not applicable since, with RWST boron concentration < 2400 ppm, the ACTIONS of LCO 3.5.4 would require a shutdown to MODE 5 if RWST boron concentration cannot be restored to within limits in 8 hours. After the shutdown to MODE 5 is complete, Required Actions B.3.1 and B.3.2 would apply.
| |
| Cook Nuclear Plant Unit 2 B 3.3.8-2 Revision No. 0
| |
| | |
| BDMI B 3.3.8 BASES ACTIONS (continued)
| |
| As an alternate to restoring one channel to OPERABLE status within 1 hour (Required Action B.2.1). Required Action B.2.2.1 requires isolation valves for unborated water sources to the Chemical and Volume Control System to be secured to prevent the flow of unborated water into the RCS. In addition, in MODE 5, if the RWST boron concentration is
| |
| < 2400 ppm and less than the Reactor Coolant System (RCS) boron concentration, the RWST is considered an unborated water source and is required to be isolated from the RCS. Once it is recognized that two source range neutron flux monitoring channels of the BDMI are inoperable, the operators will be aware of the possibility of a boron dilution, and the 1 hour Completion Time is adequate to complete the requirements of Required Action B.2.2.1.
| |
| Required Action B.2.2.2 accompanies Required Action B.2.2.1 to verify the SDM according to SR 3.1.1.1 within 1 hour and once per 12 hours thereafter. This backup action is intended to confirm that no unintended boron dilution has occurred while the BDMI was inoperable, and that the required SDM has been maintained. The specified Completion Time takes into consideration sufficient time for the initial determination of SDM and other information available in the control room related to SDM.
| |
| SURVEILLANCE SR 3.3.8.1 REQUIREMENTS Performance of the CHANNEL CHECK ensures that gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
| |
| Agreement criteria are determined by the unit staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Cook Nuclear Plant Unit 2 B 3.3.8-3 Revision No. 60
| |
| | |
| BDMI B 3.3.8 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.3.8.2 SR 3.3.8.2 is the performance of a CHANNEL CALIBRATION.
| |
| CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy. The CHANNEL CALIBRATION also includes obtaining the detector plateau or preamp discriminator curves, evaluating those curves, and comparing the curves to the manufacturers data. This SR is modified by a Note that states that neutron detectors are excluded from the CHANNEL CALIBRATION.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 14.1.5.
| |
| Cook Nuclear Plant Unit 2 B 3.3.8-4 Revision No. 60
| |
| | |
| RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 B 3.4 REACTOR COOLANT SYSTEM (RCS)
| |
| B 3.4.1 RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB) Limits BASES BACKGROUND These Bases address requirements for maintaining RCS pressure, temperature, and flow rate within limits assumed in the safety analyses.
| |
| The safety analyses (Ref. 1) of normal operating conditions and anticipated operational transients assume initial conditions within the normal steady state envelope. The limits placed on RCS pressure, temperature, and flow rate ensure that the minimum departure from nucleate boiling ratio (DNBR) will be met for each of the transients analyzed.
| |
| The RCS pressure limit is consistent with operation within the nominal operational envelope. Pressurizer pressure indications of at least three OPERABLE instrument loops are averaged to come up with a value for comparison to the limit. A lower pressure will cause the reactor core to approach DNB limits.
| |
| The RCS coolant average temperature limit is consistent with full power operation within the nominal operational envelope. Indications of at least three OPERABLE instrument loops are averaged to determine a value for comparison to the limit. A higher average temperature will cause the core to approach DNB limits.
| |
| The RCS flow rate normally remains constant during an operational fuel cycle with all pumps running. The minimum RCS flow limit corresponds to that assumed for DNB analyses. Flow rate indications are averaged to come up with a value for comparison to the limit. A lower RCS flow will cause the core to approach DNB limits.
| |
| Operation for significant periods of time outside these DNB limits increases the likelihood of a fuel cladding failure in a DNB limited event.
| |
| APPLICABLE The requirements of this LCO represent the initial conditions for DNB SAFETY limited transients analyzed in the unit safety analyses (Ref. 1). The ANALYSES safety analyses have shown that transients initiated from the limits of this LCO will result in meeting the DNBR criterion. This is the acceptance limit for the RCS DNB parameters. Changes to the unit that could impact these parameters must be assessed for their impact on the DNBR criteria. The transients analyzed for include loss of coolant flow events and rod misalignment events. A key assumption for the analysis of these events is that the core power distribution is within the limits of LCO 3.1.6, "Control Bank Insertion Limits," LCO 3.2.3, "AXIAL FLUX DIFFERENCE (AFD)," and LCO 3.2.4, "QUADRANT POWER TILT RATIO (QPTR)."
| |
| Cook Nuclear Plant Unit 2 B 3.4.1-1 Revision No. 0
| |
| | |
| RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| The pressurizer pressure limit and RCS average temperature limit specified in the COLR correspond to the analytical limits used in the safety analyses, with allowance for measurement uncertainty.
| |
| The RCS Pressure, Temperature, and Flow DNB Limits satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO This LCO specifies limits on the monitored process variables - pressurizer pressure, RCS average temperature, and RCS total flow rate - to ensure the core operates within the limits assumed in the safety analyses. These variables are contained in the COLR to provide operating and analysis flexibility from cycle to cycle. However, the minimum RCS flow, usually based on maximum analyzed steam generator tube plugging, is retained in the TS LCO. Operating within these limits will result in meeting the DNBR criterion in the event of a DNB limited transient.
| |
| RCS total flow rate contains a measurement error based on performing a precision heat balance (power balance around the steam generators) and using the result to calibrate the RCS flow rate indicators. Potential fouling of the feedwater venturi, which might not be detected, could bias the result from the precision heat balance in a nonconservative manner.
| |
| Therefore, a penalty for undetected fouling of the feedwater venturi raises the nominal flow measurement allowance for no fouling.
| |
| Any fouling that might bias the flow rate measurement greater than the penalty for undetected fouling of the feedwater venturi can be detected by monitoring and trending various unit performance parameters. If detected, either the effect of the fouling shall be quantified and compensated for in the RCS flow rate measurement or the venturi shall be cleaned to eliminate the fouling.
| |
| The numerical values for pressurizer pressure, RCS average temperature, and RCS total flow rate specified in the COLR are given for the measurement location and have been adjusted for instrument error.
| |
| APPLICABILITY In MODE 1, the limits on pressurizer pressure, RCS coolant average temperature, and RCS flow rate must be maintained during steady state operation in order to ensure DNBR criteria will be met in the event of an unplanned loss of forced coolant flow or other DNB limited transient. In all other MODES, the power level is low enough that DNB is not a concern.
| |
| A Note has been added to indicate the limit on pressurizer pressure is not applicable during short term operational transients such as a THERMAL Cook Nuclear Plant Unit 2 B 3.4.1-2 Revision No. 0
| |
| | |
| RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 BASES APPLICABILITY (continued)
| |
| POWER ramp increase > 5% RTP per minute or a THERMAL POWER step increase > 10% RTP. These conditions represent short term perturbations where actions to control pressure variations might be counterproductive. Also, since they represent transients initiated from power levels < 100% RTP, an increased DNBR margin exists to offset the temporary pressure variations.
| |
| ACTIONS A.1 With one or more of the RCS DNB parameters not within LCO limits, action must be taken to restore parameter(s) in order to restore DNB margin and eliminate the potential for violation of the accident analysis.
| |
| The 2 hour Completion Time for restoration of the parameters provides sufficient time to adjust plant parameters, to determine the cause for the off normal condition, and to restore the readings within limits, and is based on plant operating experience.
| |
| B.1 If Required Action A.1 is not met within the associated Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 2 within 6 hours. In MODE 2, the reduced power condition eliminates the potential for violation of the accident analysis. The Completion Time of 6 hours is reasonable to reach the required unit conditions in an orderly manner.
| |
| SURVEILLANCE SR 3.4.1.1 REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.4.1.2 The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Cook Nuclear Plant Unit 2 B 3.4.1-3 Revision No. 60
| |
| | |
| RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.4.1.3 Verification that the RCS total flow rate is greater than or equal to the limits ensures that the initial condition of the safety analyses are met.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.4.1.4 Measurement of RCS total flow rate by performance of a precision calorimetric heat balance allows the installed RCS flow instrumentation to be calibrated and verifies the actual RCS flow rate is greater than or equal to the minimum required RCS flow rate.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by a Note that allows entry into MODE 1, without having performed the SR, and placement of the unit in the best condition for performing the SR. The Note states that the SR is not required to be performed until 24 hours after 90% RTP. This exception is appropriate since the heat balance requires the unit to be at a minimum of 90% RTP to obtain the stated RCS flow accuracies. The Surveillance shall be performed within 24 hours after reaching 90% RTP.
| |
| REFERENCES 1. UFSAR, Chapter 14.
| |
| Cook Nuclear Plant Unit 2 B 3.4.1-4 Revision No. 60
| |
| | |
| RCS Minimum Temperature for Criticality B 3.4.2 B 3.4 REACTOR COOLANT SYSTEM (RCS)
| |
| B 3.4.2 RCS Minimum Temperature for Criticality BASES BACKGROUND This LCO is based upon meeting several major considerations before the reactor can be made critical and while the reactor is critical.
| |
| The first consideration is moderator temperature coefficient (MTC),
| |
| LCO 3.1.3, "Moderator Temperature Coefficient (MTC)." In the transient and accident analyses, the MTC is assumed to be in a range from slightly positive to negative and the operating temperature is assumed to be within the nominal operating envelope while the reactor is critical. The LCO on minimum temperature for criticality helps ensure the unit is operated consistent with these assumptions.
| |
| The second consideration is the protective instrumentation. Because certain protective instrumentation (e.g., excore neutron detectors) can be affected by moderator temperature, a temperature value within the nominal operating envelope is chosen to ensure proper indication and response while the reactor is critical.
| |
| The third consideration is the pressurizer operating characteristics. The transient and accident analyses assume that the pressurizer is within its normal startup and operating range (i.e., saturated conditions and steam bubble present). It is also assumed that the RCS temperature is within its normal expected range for startup and power operation. Since the density of the water, and hence the response of the pressurizer to transients, depends upon the initial temperature of the moderator, a minimum value for moderator temperature within the nominal operating envelope is chosen.
| |
| The fourth consideration is that the reactor vessel is above its minimum nil ductility reference temperature when the reactor is critical.
| |
| APPLICABLE Although the RCS minimum temperature for criticality is not itself an initial SAFETY condition assumed in Design Basis Accidents (DBAs), the closely aligned ANALYSES temperature for hot zero power (HZP) is a process variable that is an initial condition of DBAs, such as the uncontrolled rod cluster control assembly (RCCA) bank withdrawal from a subcritical condition, excessive heat removal due to feedwater malfunctions, and rupture of control rod drive mechanism housing (RCCA ejection) that either assumes the failure of, or presents a challenge to, the integrity of a fission product barrier.
| |
| All low power safety analyses assume initial RCS loop temperatures the HZP temperature of 547°F (Ref. 1). The minimum temperature for Cook Nuclear Plant Unit 2 B 3.4.2-1 Revision No. 0
| |
| | |
| RCS Minimum Temperature for Criticality B 3.4.2 BASES APPLICABLE SAFETY ANALYSES (continued) criticality limitation provides a small band, 6°F, for critical operation below HZP. This band allows critical operation below HZP during unit startup and does not adversely affect any safety analyses since the MTC is not significantly affected by the small temperature difference between HZP and the minimum temperature for criticality.
| |
| The RCS minimum temperature for criticality satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO Compliance with the LCO ensures that the reactor will not be made or maintained critical (keff 1.0) at a temperature less than a small band below the HZP temperature, which is assumed in the safety analysis.
| |
| Failure to meet the requirements of this LCO may produce initial conditions inconsistent with the initial conditions assumed in the safety analysis.
| |
| APPLICABILITY In MODE 1 and MODE 2 with keff 1.0, LCO 3.4.2 is applicable since the reactor can only be critical (keff 1.0) in these MODES.
| |
| ACTIONS A.1 If the parameters that are outside the limit cannot be restored, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to MODE 2 with keff < 1.0 within 30 minutes. Rapid reactor shutdown can be readily and practically achieved within a 30 minute period. The allowed time is reasonable, based on operating experience, to reach MODE 2 with keff < 1.0 in an orderly manner and without challenging unit systems.
| |
| SURVEILLANCE SR 3.4.2.1 REQUIREMENTS RCS loop average temperature is required to be verified at or above 541°F. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 14.1.1.
| |
| Cook Nuclear Plant Unit 2 B 3.4.2-2 Revision No. 60
| |
| | |
| RCS P/T Limits B 3.4.3 B 3.4 REACTOR COOLANT SYSTEM (RCS)
| |
| B 3.4.3 RCS Pressure and Temperature (P/T) Limits BASES BACKGROUND All components of the RCS are designed to withstand effects of cyclic loads due to system pressure and temperature changes. These loads are introduced by startup (heatup) and shutdown (cooldown) operations, power transients, and reactor trips. This LCO limits the pressure and temperature changes during RCS heatup and cooldown, within the design assumptions and the stress limits for cyclic operation.
| |
| This LCO contains P/T limit curves for heatup, cooldown, inservice leak and hydrostatic (ISLH) testing, criticality, and data for the maximum rate of change of reactor coolant temperature (Ref. 1).
| |
| Each P/T limit curve defines an acceptable region for normal operation.
| |
| The usual use of the curves is operational guidance during heatup or cooldown maneuvering, when pressure and temperature indications are monitored and compared to the applicable curve to determine that operation is within the allowable region. Vacuum fill of the RCS is performed in Mode 5 under sub-atmospheric pressure and isothermal RCS conditions. Vacuum fill is an acceptable condition since the resulting pressure/ temperature combination is reflected on the operating limits provided in Figures 3.4.3-1 and 3.4.3-2.
| |
| The LCO establishes operating limits that provide a margin to brittle failure of the reactor vessel and piping of the reactor coolant pressure boundary (RCPB). The vessel is the component most subject to brittle failure, and the LCO limits apply mainly to the vessel. The limits do not apply to the pressurizer, which has different design characteristics and operating functions.
| |
| 10 CFR 50, Appendix G (Ref. 2), requires the establishment of P/T limits for specific material fracture toughness requirements of the RCPB materials. Reference 2 requires an adequate margin to brittle failure during normal operation, anticipated operational occurrences, and system hydrostatic tests. It mandates the use of the American Society of Mechanical Engineers (ASME) Code, Section III, Appendix G (Ref. 3).
| |
| The neutron embrittlement effect on the material toughness is reflected by increasing the nil ductility reference temperature (RTNDT) as exposure to neutron fluence increases.
| |
| The actual shift in the RTNDT of the vessel material will be established periodically by removing and evaluating the irradiated reactor vessel material specimens, in accordance with ASTM E 185 (Ref. 4) and Appendix H of 10 CFR 50 (Ref. 5). The operating P/T limit curves will be Cook Nuclear Plant Unit 2 B 3.4.3-1 Revision No. 42
| |
| | |
| RCS P/T Limits B 3.4.3 adjusted, as necessary, based on the evaluation findings and the recommendations of Regulatory Guide 1.99 (Ref. 6).
| |
| The P/T limit curves are composite curves established by superimposing limits derived from stress analyses of those portions of the reactor vessel and head that are the most restrictive. At any specific pressure, temperature, and temperature rate of change, one location within the reactor vessel will dictate the most restrictive limit. Across the span of the P/T limit curves, different locations are more restrictive, and, thus, the curves are composites of the most restrictive regions.
| |
| The heatup curve represents a different set of restrictions than the cooldown curve because the directions of the thermal gradients through the vessel wall are reversed. The thermal gradient reversal alters the location of the tensile stress between the outer and inner walls.
| |
| The criticality limit curve includes the Reference 2 requirement that it be 40°F above the heatup curve or the cooldown curve, and not less than the minimum permissible temperature for ISLH testing. However, the criticality curve is not operationally limiting; a more restrictive limit exists in LCO 3.4.2, "RCS Minimum Temperature for Criticality."
| |
| The consequence of violating the LCO limits is that the RCS has been operated under conditions that can result in brittle failure of the RCPB, possibly leading to a nonisolable leak or loss of coolant accident. In the event these limits are exceeded, an evaluation must be performed to determine the effect on the structural integrity of the RCPB components.
| |
| The ASME Code, Section XI, Appendix E (Ref. 7), provides a recommended methodology for evaluating an operating event that causes an excursion outside the limits.
| |
| APPLICABLE The P/T limits are not derived from Design Basis Accident (DBA)
| |
| SAFETY analyses. They are prescribed during normal operation to avoid ANALYSES encountering pressure, temperature, and temperature rate of change conditions that might cause undetected flaws to propagate and cause nonductile failure of the RCPB, an unanalyzed condition. Reference 1 establishes the methodology for determining the P/T limits. Although the P/T limits are not derived from any DBA, the P/T limits are acceptance limits since they preclude operation in an unanalyzed condition.
| |
| RCS P/T limits satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The two elements of this LCO are:
| |
| : a. The limit curves for heatup, cooldown, criticality, and ISLH testing; and
| |
| : b. Limits on the rate of change of temperature.
| |
| Cook Nuclear Plant Unit 2 B 3.4.3-2 Revision No. 42
| |
| | |
| RCS P/T Limits B 3.4.3 BASES LCO (continued)
| |
| The LCO limits apply to all components of the RCS, except the pressurizer. These limits define allowable operating regions and permit a large number of operating cycles while providing a wide margin to nonductile failure.
| |
| The limits for the rate of change of temperature control the thermal gradient through the vessel wall and are used as inputs for calculating the heatup, cooldown, and ISLH testing P/T limit curves. Thus, the LCO for the rate of change of temperature restricts stresses caused by thermal gradients and also ensures the validity of the P/T limit curves.
| |
| Violating the LCO limits places the reactor vessel outside of the bounds of the stress analyses and can increase stresses in other RCPB components. The consequences depend on several factors, as follow:
| |
| : a. The severity of the departure from the allowable operating P/T regime or the severity of the rate of change of temperature;
| |
| : b. The length of time the limits were violated (longer violations allow the temperature gradient in the thick vessel walls to become more pronounced); and
| |
| : c. The existences, sizes, and orientations of flaws in the vessel material.
| |
| APPLICABILITY The RCS P/T limits LCO provides a definition of acceptable operation for prevention of nonductile failure in accordance with 10 CFR 50, Appendix G (Ref. 2). Although the P/T limits were developed to provide guidance for operation during heatup or cooldown (MODES 3, 4, and 5) or ISLH testing, their Applicability is at all times in keeping with the concern for nonductile failure. The limits do not apply to the pressurizer.
| |
| During MODES 1 and 2, other Technical Specifications provide limits for operation that can be more restrictive than or can supplement these P/T limits. LCO 3.4.1, "RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB) Limits," LCO 3.4.2, "RCS Minimum Temperature for Criticality," and Safety Limit 2.1, "Safety Limits," also provide operational restrictions for pressure and temperature and maximum pressure. Furthermore, MODES 1 and 2 are above the temperature range of concern for nonductile failure, and stress analyses have been performed for normal maneuvering profiles, such as power ascension or descent.
| |
| Cook Nuclear Plant Unit 2 B 3.4.3-3 Revision No. 0
| |
| | |
| RCS P/T Limits B 3.4.3 BASES ACTIONS A.1 and A.2 Operation outside the P/T limits during MODE 1, 2, 3, or 4 must be corrected so that the RCPB is returned to a condition that has been verified by stress analyses.
| |
| The 30 minute Completion Time reflects the urgency of restoring the parameters to within the analyzed range. Most violations will not be severe, and the activity can be accomplished in this time in a controlled manner.
| |
| Besides restoring operation within limits, an evaluation is required to determine if RCS operation can continue. The evaluation must verify the RCPB integrity remains acceptable and must be completed within 72 hours. The evaluation must include an analysis to determine the effects of the out-of-limit condition on the fracture toughness properties of the RCS. Several methods may be used, including comparison with pre-analyzed transients in the stress analyses, new analyses, or inspection of the components.
| |
| ASME Code, Section XI, Appendix E (Ref. 7), may be used to support the evaluation. However, its use is restricted to evaluation of the vessel beltline.
| |
| The 72 hour Completion Time is reasonable to accomplish the evaluation.
| |
| The evaluation for a mild violation is possible within this time, but more severe violations may require special, event specific stress analyses or inspections.
| |
| Condition A is modified by a Note requiring Required Action A.2 to be completed whenever the Condition is entered. The Note emphasizes the need to perform the evaluation of the effects of the excursion outside the allowable limits. Restoration alone per Required Action A.1 is insufficient because higher than analyzed stresses may have occurred and may have affected the RCPB integrity.
| |
| B.1 and B.2 If any Required Action and associated Completion Time of Condition A is not met, the unit must be placed in a lower MODE because either the RCS remained in an unacceptable P/T region for an extended period of time or a sufficiently severe event resulted in a determination that the RCS is or may be unacceptable for continued operation. Either possibility indicates a need for more careful examination of the event, best accomplished with the RCS at reduced pressure and temperature. In reduced pressure and temperature conditions, the possibility of propagation with undetected flaws is decreased.
| |
| Cook Nuclear Plant Unit 2 B 3.4.3-4 Revision No. 0
| |
| | |
| RCS P/T Limits B 3.4.3 BASES ACTIONS (continued)
| |
| If the required restoration activity cannot be accomplished within 30 minutes, Required Action B.1 and Required Action B.2 must be implemented to reduce pressure and temperature.
| |
| If the required evaluation for continued operation cannot be accomplished within 72 hours or the results are indeterminate or unfavorable, action must proceed to reduce pressure and temperature as specified in Required Action B.1 and Required Action B.2. A favorable evaluation must be completed and documented before returning to operating pressure and temperature conditions.
| |
| Pressure and temperature are reduced by bringing the unit to MODE 3 within 6 hours and to MODE 5 with RCS pressure < 500 psig within 36 hours.
| |
| The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| C.1 and C.2 Actions must be initiated immediately to correct operation outside of the P/T limits at times other than when in MODE 1, 2, 3, or 4, so that the RCPB is returned to a condition that has been verified by stress analysis.
| |
| The immediate Completion Time reflects the urgency of initiating action to restore the parameters to within the analyzed range. Most violations will not be severe, and the activity can be accomplished in this time in a controlled manner.
| |
| Besides restoring operation within limits, an evaluation is required to determine if RCS operation can continue. The evaluation must verify that the RCPB integrity remains acceptable and must be completed prior to entry into MODE 4. The evaluation must include an analysis to determine the effects of the out-of-limit condition on the fracture toughness properties of the RCS. Several methods may be used, including comparison with pre-analyzed transients in the stress analyses, or inspection of the components.
| |
| ASME Code, Section XI, Appendix E (Ref. 7), may be used to support the evaluation. However, its use is restricted to evaluation of the vessel beltline.
| |
| Cook Nuclear Plant Unit 2 B 3.4.3-5 Revision No. 0
| |
| | |
| RCS P/T Limits B 3.4.3 BASES ACTIONS (continued)
| |
| Condition C is modified by a Note requiring Required Action C.2 to be completed whenever the Condition is entered. The Note emphasizes the need to perform the evaluation of the effects of the excursion outside the allowable limits. Restoration alone per Required Action C.1 is insufficient because higher than analyzed stresses may have occurred and may have affected the RCPB integrity.
| |
| SURVEILLANCE SR 3.4.3.1 REQUIREMENTS Verification that operation is within limits is required when RCS pressure and temperature conditions are undergoing planned changes. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Surveillance for heatup, cooldown, or ISLH testing may be discontinued when the definition given in the relevant plant procedure for ending the activity is satisfied.
| |
| This SR is modified by a Note that only requires this SR to be performed during system heatup, cooldown, and ISLH testing. No SR is given for criticality operations because LCO 3.4.2 contains a more restrictive requirement.
| |
| REFERENCES 1. WCAP-15047, Rev. 2, dated May 2002.
| |
| : 2. 10 CFR 50, Appendix G.
| |
| : 3. ASME, Boiler and Pressure Vessel Code, Section III, Appendix G.
| |
| : 4. ASTM E 185-82, July 1982.
| |
| : 5. 10 CFR 50, Appendix H.
| |
| : 6. Regulatory Guide 1.99, Revision 2, May 1988.
| |
| : 7. ASME, Boiler and Pressure Vessel Code, Section XI, Appendix E.
| |
| Cook Nuclear Plant Unit 2 B 3.4.3-6 Revision No. 60
| |
| | |
| RCS Loops - MODES 1 and 2 B 3.4.4 B 3.4 REACTOR COOLANT SYSTEM (RCS)
| |
| B 3.4.4 RCS Loops - MODES 1 and 2 BASES BACKGROUND The primary function of the RCS is removal of the heat generated in the fuel due to the fission process, and transfer of this heat, via the steam generators (SGs), to the secondary plant.
| |
| The secondary functions of the RCS include:
| |
| : a. Moderating the neutron energy level to the thermal state, to increase the probability of fission;
| |
| : b. Improving the neutron economy by acting as a reflector;
| |
| : c. Carrying the soluble neutron poison, boric acid;
| |
| : d. Providing a second barrier against fission product release to the environment; and
| |
| : e. Removing the heat generated in the fuel due to fission product decay following a unit shutdown.
| |
| The reactor coolant is circulated through four loops connected in parallel to the reactor vessel, each containing an SG, a reactor coolant pump (RCP), and appropriate flow and temperature instrumentation for both control and protection. The reactor vessel contains the clad fuel. The SGs provide the heat sink to the isolated secondary coolant. The RCPs circulate the coolant through the reactor vessel and SGs at a sufficient rate to ensure proper heat transfer and prevent fuel damage. This forced circulation of the reactor coolant ensures mixing of the coolant for proper boration and chemistry control.
| |
| APPLICABLE Safety analyses contain various assumptions for the design bases SAFETY accident initial conditions including RCS pressure, RCS temperature, ANALYSES reactor power level, core parameters, and safety system setpoints. The important aspect for this LCO is the reactor coolant forced flow rate, which is represented by the number of RCS loops in service.
| |
| Both transient and steady state analyses have been performed to establish the effect of flow on the departure from nucleate boiling (DNB).
| |
| The transient and accident analyses for the unit have been performed assuming four RCS loops are in operation. The majority of the unit safety analyses are based on initial conditions at high core power or zero power.
| |
| The accident analyses that are most important to RCP operation are the Cook Nuclear Plant Unit 2 B 3.4.4-1 Revision No. 0
| |
| | |
| RCS Loops - MODES 1 and 2 B 3.4.4 BASES APPLICABLE SAFETY ANALYSES (continued) four pump coastdown, single pump locked rotor, single pump coastdown, and rod withdrawal events (Ref. 1).
| |
| Steady state DNB analyses have been performed for the four RCS loop operation. These analyses establish allowable RCS loop average temperature and T for the minimum measured flow and power distribution as a function of RCS pressure. These analyses also establish a locus of power, pressure, and temperature conditions for which the departure from nucleate boiling ratio (DNBR) is equal to its Safety Limit value. The area of permissible operation is bounded by the combination of assumed reactor trips for Power Range Neutron Flux - High, Overtemperature T, Overpower T, Pressurizer Pressure - Low, and Pressurizer Pressure - High Functions. The difference between the reactor trip values assumed in the safety analyses and the nominal reactor trip setpoints provides an allowance for instrumentation channel error and setpoint error.
| |
| The unit is designed to operate with all RCS loops in operation to maintain DNBR above the SL, during all normal operations and anticipated transients. By ensuring heat transfer in the nucleate boiling region, adequate heat transfer is provided between the fuel cladding and the reactor coolant.
| |
| RCS Loops - MODES 1 and 2 satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The purpose of this LCO is to require an adequate forced flow rate for core heat removal. Flow is represented by the number of RCPs in operation for removal of heat by the SGs. To meet safety analysis acceptance criteria for DNBR, four pumps are required at rated power.
| |
| An OPERABLE RCS loop consists of an OPERABLE RCP in operation providing forced flow for heat transport and an OPERABLE SG.
| |
| APPLICABILITY In MODES 1 and 2, the reactor is critical and thus has the potential to produce maximum THERMAL POWER. Thus, to ensure that the assumptions of the accident analyses remain valid, all RCS loops are required to be OPERABLE and in operation in these MODES to prevent DNB and core damage.
| |
| The decay heat production rate is much lower than the full power heat rate. As such, the forced circulation flow and heat sink requirements are reduced for lower, noncritical MODES as indicated by the LCOs for MODES 3, 4, and 5.
| |
| Cook Nuclear Plant Unit 2 B 3.4.4-2 Revision No. 12
| |
| | |
| RCS Loops - MODES 1 and 2 B 3.4.4 BASES APPLICABILITY (continued)
| |
| Operation in other MODES is covered by:
| |
| LCO 3.4.5, "RCS Loops - MODE 3";
| |
| LCO 3.4.6, "RCS Loops - MODE 4";
| |
| LCO 3.4.7, "RCS Loops - MODE 5, Loops Filled";
| |
| LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled";
| |
| LCO 3.9.4, "Residual Heat Removal (RHR) and Coolant Circulation - High Water Level"; and LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation - Low Water Level."
| |
| ACTIONS A.1 If the requirements of the LCO are not met, the Required Action is to reduce power and bring the unit to MODE 3. This lowers power level and thus reduces the core heat removal needs and minimizes the possibility of violating DNB limits.
| |
| The Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems.
| |
| SURVEILLANCE SR 3.4.4.1 REQUIREMENTS This SR requires verification that each RCS loop is in operation.
| |
| Verification includes flow rate, temperature, or pump status monitoring, which help ensure that forced flow is providing heat removal while maintaining the margin to the DNBR limit. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 14.1.
| |
| Cook Nuclear Plant Unit 2 B 3.4.4-3 Revision No. 60
| |
| | |
| RCS Loops - MODE 3 B 3.4.5 B 3.4 REACTOR COOLANT SYSTEM (RCS)
| |
| B 3.4.5 RCS Loops - MODE 3 BASES BACKGROUND In MODE 3, the primary function of the reactor coolant is removal of decay heat and transfer of this heat, via the steam generator (SG), to the secondary plant fluid. The secondary function of the reactor coolant is to act as a carrier for soluble neutron poison, boric acid.
| |
| The reactor coolant is circulated through four RCS loops, connected in parallel to the reactor vessel, each containing an SG, a reactor coolant pump (RCP), and appropriate flow, pressure, level, and temperature instrumentation for control, protection, and indication. The reactor vessel contains the clad fuel. The SGs provide the heat sink. The RCPs circulate the water through the reactor vessel and SGs at a sufficient rate to ensure proper heat transfer and prevent fuel damage.
| |
| In MODE 3, RCPs are used to provide forced circulation for heat removal during heatup and cooldown. The MODE 3 decay heat removal requirements are low enough that a single RCS loop with one RCP running is sufficient to remove core decay heat. However, two RCS loops are required to be OPERABLE to ensure redundant capability for decay heat removal. When the Rod Control System is capable of rod withdrawal then two RCS loops must be OPERABLE and in operation.
| |
| APPLICABLE Whenever the reactor trip breakers (RTBs) are in the closed position and SAFETY the control rod drive mechanisms (CRDMs) are energized, an inadvertent ANALYSES rod bank withdrawal from subcritical, resulting in a power excursion, is possible. Such a transient could be caused by a malfunction of the rod control system. In addition, the possibility of a power excursion due to the ejection of an inserted control rod is possible with the breakers closed or open. Such a transient could be caused by the mechanical failure of a CRDM.
| |
| Therefore, in MODE 3 with the Rod Control System capable of rod withdrawal, accidental control rod bank withdrawal from subcritical is postulated and requires at least two RCS loops to be OPERABLE and in operation to ensure that the accident analyses limits are met. For those conditions when the Rod Control System is not capable of rod withdrawal, two RCS loops are required to be OPERABLE, but only one RCS loop is required to be in operation to be consistent with MODE 3 accident analyses.
| |
| Failure to provide decay heat removal may result in challenges to a fission product barrier. The RCS loops are part of the primary success Cook Nuclear Plant Unit 2 B 3.4.5-1 Revision No. 0
| |
| | |
| RCS Loops - MODE 3 B 3.4.5 BASES APPLICABLE SAFETY ANALYSES (continued) path that functions or actuates to prevent or mitigate a Design Basis Accident or transient that either assumes the failure of, or presents a challenge to, the integrity of a fission product barrier.
| |
| RCS Loops - MODE 3 satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The purpose of this LCO is to require that at least two RCS loops be OPERABLE. In MODE 3 with the Rod Control System capable of rod withdrawal, two RCS loops must be in operation. Two RCS loops are required to be in operation in MODE 3 with the Rod Control System capable of rod withdrawal due to the postulation of a power excursion because of an inadvertent control rod bank withdrawal. The required number of RCS loops in operation ensures that the Safety Limit criteria will be met for all of the postulated accidents.
| |
| When the Rod Control System is not capable of rod withdrawal, only one RCS loop in operation is necessary to ensure removal of decay heat from the core and homogenous boron concentration throughout the RCS. An additional RCS loop is required to be OPERABLE to provide redundancy.
| |
| The Note permits all RCPs to be removed from operation for 1 hour per 8 hour period. The purpose of the Note is to permit an RCS pump to be de-energized when switching operation from one RCS loop to another.
| |
| The 1 hour time period specified is adequate to switch the RCS loops, and operating experience has shown that boron stratification is not a problem during this short period with no forced flow.
| |
| Utilization of the Note is permitted provided the following conditions are met:
| |
| : a. No operations are permitted that would dilute the RCS boron concentration with coolant at boron concentrations less than required to meet the requirements of LCO 3.1.1, "SHUTDOWN MARGIN (SDM)," thereby maintaining the margin to criticality. Boron reduction with coolant at boron concentrations less than required to assure SDM is maintained is prohibited because a uniform concentration distribution throughout the RCS cannot be ensured when in natural circulation;
| |
| : b. Core outlet temperature is maintained at least 10°F below saturation temperature, so that no vapor bubble may form and possibly cause a natural circulation flow obstruction; and
| |
| : c. The Rod Control System is not capable of rod withdrawal to avoid an accidental control rod bank withdrawal.
| |
| Cook Nuclear Plant Unit 2 B 3.4.5-2 Revision No. 0
| |
| | |
| RCS Loops - MODE 3 B 3.4.5 BASES LCO (continued)
| |
| An OPERABLE RCS loop consists of one OPERABLE RCP and one OPERABLE SG, which has the minimum water level specified in SR 3.4.5.2. An RCP is OPERABLE if it is capable of being powered and is able to provide forced flow if required.
| |
| APPLICABILITY In MODE 3, this LCO ensures forced circulation of the reactor coolant to remove decay heat from the core and to provide proper boron mixing.
| |
| The most stringent condition of the LCO, that is, two RCS loops OPERABLE and two RCS loops in operation, applies to MODE 3 with the Rod Control System capable of rod withdrawal. The least stringent condition, that is, two RCS loops OPERABLE and one RCS loop in operation, applies to MODE 3 with the Rod Control System not capable of rod withdrawal.
| |
| Operation in other MODES is covered by:
| |
| LCO 3.4.4, "RCS Loops - MODES 1 and 2";
| |
| LCO 3.4.6, "RCS Loops - MODE 4";
| |
| LCO 3.4.7, "RCS Loops - MODE 5, Loops Filled";
| |
| LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled";
| |
| LCO 3.9.4, "Residual Heat Removal (RHR) and Coolant Circulation - High Water Level"; and LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation - Low Water Level."
| |
| ACTIONS A.1 If one required RCS loop is inoperable, redundancy for heat removal is lost. The Required Action is restoration of the required RCS loop to OPERABLE status within the Completion Time of 72 hours. This time allowance is a justified period to be without the redundant, nonoperating loop because a single loop in operation has a heat transfer capability greater than that needed to remove the decay heat produced in the reactor core and because of the low probability of a failure in the remaining loop occurring during this period.
| |
| B.1 If restoration for Required Action A.1 is not possible within 72 hours, the unit must be brought to MODE 4. In MODE 4, the unit may be placed on the Residual Heat Removal System. The additional Completion Time of 12 hours is compatible with required operations to achieve cooldown and depressurization from the existing unit conditions in an orderly manner and without challenging unit systems.
| |
| Cook Nuclear Plant Unit 2 B 3.4.5-3 Revision No. 12
| |
| | |
| RCS Loops - MODE 3 B 3.4.5 BASES ACTIONS (continued)
| |
| C.1 If one required RCS loop is not in operation, and the Rod Control System is capable of rod withdrawal, the Required Action is to place the Rod Control System in a condition incapable of rod withdrawal (e.g.,
| |
| de-energize all CRDMs by opening the RTBs or de-energizing the motor generator (MG) sets). When the Rod Control System is capable of rod withdrawal, it is postulated that a power excursion could occur in the event of an inadvertent control rod bank withdrawal. This mandates having the heat transfer capacity of two RCS loops in operation. If only one loop is in operation, the Rod Control System must be rendered incapable of rod withdrawal. The Completion Time of 2 hours to defeat the Rod Control System is adequate to perform these operations in an orderly manner without exposing the unit to risk for an undue time period.
| |
| D.1, D.2, and D.3 If two required RCS loops are inoperable, or two required RCS loops are not in operation with Rod Control System capable of rod withdrawal, or required RCS loop not in operation with Rod Control System not capable of rod withdrawal, the Rod Control System must be placed in a condition incapable of rod withdrawal (e.g., all CRDMs must be de-energized by opening the RTBs or de-energizing the MG sets). All operations involving introduction of coolant into the RCS with boron concentration less than required to meet the requirements of LCO 3.1.1 must be suspended, and action to restore one of the RCS loops to OPERABLE status and operation must be initiated. Boron dilution requires forced circulation for proper mixing, and opening the RTBs or de-energizing the MG sets removes the possibility of an inadvertent rod withdrawal. Suspending operations that would cause the introduction of coolant into the RCS with boron concentration less than required to meet the requirements of LCO 3.1.1 is required to assure continued safe operation. With coolant added without forced circulation, unmixed coolant could be introduced to the core, however coolant added with boron concentration meeting the minimum SDM maintains acceptable margin to subcritical operations.
| |
| The immediate Completion Time reflects the importance of maintaining operation for heat removal. The action to restore must be continued until one loop is restored to OPERABLE status and operation.
| |
| SURVEILLANCE SR 3.4.5.1 REQUIREMENTS This SR requires verification that the required loops are in operation.
| |
| Verification includes flow rate, temperature, or pump status monitoring, which help ensure that forced flow is providing heat removal.
| |
| Cook Nuclear Plant Unit 2 B 3.4.5-4 Revision No. 70
| |
| | |
| RCS Loops - MODE 3 B 3.4.5 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.4.5.2 SR 3.4.5.2 requires verification of SG OPERABILITY. SG OPERABILITY is verified by ensuring that the secondary side water level is above the lower tap of the SG wide range level instrumentation by 418.77 inches for required RCS loops. If the SG tubes become uncovered, the associated loop may not be capable of providing the heat sink for removal of the decay heat. The water level can be verified by either the wide range or the narrow range instruments. A narrow range level instrument 6% or a wide range level instrument 79% ensures the Surveillance Requirement limit is met. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.4.5.3 Verification that each required RCP is OPERABLE ensures that safety analyses limits are met. The requirement also ensures that an additional RCP can be placed in operation, if needed, to maintain decay heat removal and reactor coolant circulation. Verification is performed by verifying proper breaker alignment and power availability to each required RCP. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by a Note that states the SR is not required to be performed until 24 hours after a required pump is not in operation. This is acceptable because proper breaker alignment and power availability are ensured if a pump is operating.
| |
| REFERENCES None.
| |
| Cook Nuclear Plant Unit 2 B 3.4.5-5 Revision No. 60
| |
| | |
| RCS Loops - MODE 4 B 3.4.6 B 3.4 REACTOR COOLANT SYSTEM (RCS)
| |
| B 3.4.6 RCS Loops - MODE 4 BASES BACKGROUND In MODE 4, the primary function of the reactor coolant is the removal of decay heat and the transfer of this heat to either the steam generator (SG) secondary side coolant or the component cooling water via the residual heat removal (RHR) heat exchangers. The secondary function of the reactor coolant is to act as a carrier for soluble neutron poison, boric acid.
| |
| The reactor coolant is circulated through four RCS loops connected in parallel to the reactor vessel, each loop containing an SG, a reactor coolant pump (RCP), and appropriate flow, pressure, level, and temperature instrumentation for control, protection, and indication. The RCPs circulate the coolant through the reactor vessel and SGs at a sufficient rate to ensure proper heat transfer and to prevent boric acid stratification.
| |
| In MODE 4, either RCPs or RHR loops can be used to provide forced circulation. The intent of this LCO is to provide forced flow from at least one RCP or one RHR loop for decay heat removal and transport. The flow provided by one RCP loop or RHR loop is adequate for decay heat removal. The other intent of this LCO is to require that two paths be available to provide redundancy for decay heat removal.
| |
| APPLICABLE In MODE 4, RCS circulation is considered in the determination of the time SAFETY available for mitigation of the accidental boron dilution event. The RCS ANALYSES and RHR loops provide this circulation.
| |
| RCS Loops - MODE 4 satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The purpose of this LCO is to require that at least two loops be OPERABLE in MODE 4 and that one of these loops be in operation. The LCO allows the two loops that are required to be OPERABLE to consist of any combination of RCS loops and RHR loops. Any one loop in operation provides enough flow to remove the decay heat from the core with forced circulation. An additional loop is required to be OPERABLE to provide redundancy for heat removal.
| |
| Note 1 permits all RCPs or RHR pumps to be removed from operation for 1 hour per 8 hour period. The purpose of the Note is to permit the RCS pump or RHR pump to be removed from operation when switching operation from one RCS loop, or one RHR loop or flowpath, to another.
| |
| The 1 hour time period is adequate to switch the loops, and operating experience has shown that boron stratification is not a problem during this short period with no forced flow.
| |
| Cook Nuclear Plant Unit 2 B 3.4.6-1 Revision No. 0
| |
| | |
| RCS Loops - MODE 4 B 3.4.6 BASES LCO (continued)
| |
| Utilization of the Note is permitted provided the following conditions are met:
| |
| : a. No operations are permitted that would dilute the RCS boron concentration with coolant with boron concentrations less than required to meet the requirements of LCO 3.1.1, "SHUTDOWN MARGIN (SDM)," therefore maintaining the margin to criticality.
| |
| Boron reduction with coolant at boron concentrations less than required to assure SDM is maintained is prohibited because a uniform concentration distribution throughout the RCS cannot be ensured when in natural circulation; and
| |
| : b. Core outlet temperature is maintained at least 10°F below saturation temperature, so that no vapor bubble may form and possibly cause a natural circulation flow obstruction.
| |
| Note 2 requires that the secondary side water temperature of each SG be
| |
| < 50°F above each of the RCS cold leg temperatures or the pressurizer water level be < 62% before the start of an RCP with any RCS cold leg temperature 152°F. This restraint is to prevent a low temperature overpressure event due to a thermal transient when an RCP is started.
| |
| An OPERABLE RCS loop comprises an OPERABLE RCP and an OPERABLE SG, which has the minimum water level specified in SR 3.4.6.2.
| |
| Similarly for the RHR System, an OPERABLE RHR loop comprises an OPERABLE RHR pump (either the east or west) capable of providing forced flow to an OPERABLE RHR heat exchanger. RCPs and RHR pumps are OPERABLE if they are capable of being powered and are able to provide forced flow if required. Management of gas voids is important to RHR System OPERABILITY.
| |
| APPLICABILITY In MODE 4, this LCO ensures forced circulation of the reactor coolant to remove decay heat from the core and to provide proper boron mixing.
| |
| One loop of either RCS or RHR provides sufficient circulation for these purposes. However, two loops consisting of any combination of RCS and RHR loops are required to be OPERABLE to meet single failure considerations.
| |
| Operation in other MODES is covered by:
| |
| LCO 3.4.4, "RCS Loops - MODES 1 and 2";
| |
| LCO 3.4.5, "RCS Loops - MODE 3";
| |
| LCO 3.4.7, "RCS Loops - MODE 5, Loops Filled";
| |
| LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled";
| |
| Cook Nuclear Plant Unit 2 B 3.4.6-2 Revision No. 57
| |
| | |
| RCS Loops - MODE 4 B 3.4.6 BASES APPLICABILITY (continued)
| |
| LCO 3.9.4, "Residual Heat Removal (RHR) and Coolant Circulation - High Water Level"; and LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation - Low Water Level."
| |
| ACTIONS A.1 If one required loop is inoperable, redundancy for heat removal is lost.
| |
| Action must be initiated to restore a second RCS or RHR loop to OPERABLE status. The immediate Completion Time reflects the importance of maintaining the availability of two paths for heat removal.
| |
| A.2 If restoration is not accomplished and an RHR loop is OPERABLE, the unit must be brought to MODE 5 within 24 hours. Bringing the unit to MODE 5 is a conservative action with regard to decay heat removal. With only one RHR loop OPERABLE, redundancy for decay heat removal is lost and, in the event of a loss of the remaining RHR loop, it would be safer to initiate that loss from MODE 5 rather than MODE 4. The Completion Time of 24 hours is a reasonable time, based on operating experience, to reach MODE 5 from MODE 4 in an orderly manner and without challenging plant systems.
| |
| This Required Action is modified by a Note which indicates that the unit must be placed in MODE 5 only if a RHR loop is OPERABLE. With no RHR loop OPERABLE, the unit is in a condition with only limited cooldown capabilities. Therefore, the actions are to be concentrated on the restoration of a RHR loop, rather than a cooldown of extended duration.
| |
| B.1 and B.2 If two required loops are inoperable or a required loop is not in operation, except during conditions permitted by Note 1 in the LCO section, all operations involving introduction of coolant into the RCS with boron concentration less than required to meet the requirements of LCO 3.1.1 must be suspended, and action to restore one RCS or RHR loop to OPERABLE status and operation must be initiated. The required margin to criticality must not be reduced in this type of operation. Suspending operations that would cause the introduction of coolant into the RCS with boron concentration less than required to meet the requirements of LCO 3.1.1 is required to assure continued safe operation. With coolant added without forced circulation, unmixed coolant could be introduced to the core, however coolant added with boron concentration meeting the Cook Nuclear Plant Unit 2 B 3.4.6-3 Revision No. 0
| |
| | |
| RCS Loops - MODE 4 B 3.4.6 BASES ACTIONS (continued) minimum SDM maintains acceptable margin to subcritical operations.
| |
| The immediate Completion Times reflect the importance of maintaining operation for decay heat removal. The action to restore must be continued until one loop is restored to OPERABLE status and operation.
| |
| SURVEILLANCE SR 3.4.6.1 REQUIREMENTS This SR requires verification that the required RCS or RHR loop is in operation and circulating reactor coolant. Verification includes flow rate, temperature, or pump status monitoring, which help ensure that forced flow is providing heat removal. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.4.6.2 SR 3.4.6.2 requires verification of SG OPERABILITY. SG OPERABILITY is verified by ensuring that the secondary side water level is above the lower tap of the SG wide range level instrumentation by 418.77 inches.
| |
| If the SG U-tubes become uncovered, the associated loop may not be capable of providing the heat sink necessary for removal of decay heat.
| |
| The water level can be verified by either the wide range or the narrow range level instruments. A narrow range level instrument 6% or a wide range level instrument 79% ensures the Surveillance Requirement limit is met. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.4.6.3 Verification that each required pump is OPERABLE ensures that an additional RCS or RHR pump can be placed in operation, if needed, to maintain decay heat removal and reactor coolant circulation. Verification is performed by verifying proper breaker alignment and power available to each required pump. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by a Note that states the SR is not required to be performed until 24 hours after a required pump is not in operation. This is acceptable because proper breaker alignment and power availability are ensured if a pump is operating.
| |
| Cook Nuclear Plant Unit 2 B 3.4.6-4 Revision No. 60
| |
| | |
| RCS Loops - MODE 4 B 3.4.6 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.4.6.4 RHR System piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the required RHR loop(s) and may also prevent water hammer, pump cavitation, and pumping of noncondensible gas into the reactor vessel.
| |
| Selection of RHR System locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.
| |
| The RHR System is OPERABLE when it is sufficiently filled with water.
| |
| Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criterion for gas volume at the suction or discharge of a pump), the Surveillance is not met. If it is determined by subsequent evaluation that the RHR System is not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water), the Surveillance may be declared met. Accumulated gas should be eliminated or brought within the acceptance criteria limits.
| |
| RHR System locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative sub-set of susceptible locations.
| |
| Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations, alternative methods (e.g.,
| |
| operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been Cook Nuclear Plant Unit 2 B 3.4.6-5 Revision No. 57
| |
| | |
| RCS Loops - MODE 4 B 3.4.6 BASES SURVEILLANCE REQUIREMENTS (continued) evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.
| |
| This SR is modified by a Note that states the SR is not required to be performed until 12 hours after entering MODE 4. In a rapid shutdown, there may be insufficient time to verify all susceptible locations prior to entering MODE 4.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES None.
| |
| Cook Nuclear Plant Unit 2 B 3.4.6-6 Revision No. 60
| |
| | |
| RCS Loops - MODE 5, Loops Filled B 3.4.7 B 3.4 REACTOR COOLANT SYSTEM (RCS)
| |
| B 3.4.7 RCS Loops - MODE 5, Loops Filled BASES BACKGROUND In MODE 5 with the RCS loops filled, the primary function of the reactor coolant is the removal of decay heat and transfer this heat either to the steam generator (SG) secondary side coolant via natural circulation (Ref. 1) or the component cooling water via the residual heat removal (RHR) heat exchangers. While the principal means for decay heat removal is via the RHR System, the SGs via natural circulation (Ref. 1) are specified as a backup means for redundancy. Even though the SGs cannot produce steam in this MODE, they are capable of being a heat sink due to their large contained volume of secondary water. As long as the SG secondary side water is at a lower temperature than the reactor coolant, heat transfer will occur. The rate of heat transfer is directly proportional to the temperature difference. The secondary function of the reactor coolant is to act as a carrier for soluble neutron poison, boric acid.
| |
| In MODE 5 with RCS loops filled, the reactor coolant is circulated by means of two RHR loops connected to the RCS, each loop containing an RHR heat exchanger, an RHR pump, and appropriate flow and temperature instrumentation for control, protection, and indication. One RHR pump circulates the water through the RCS at a sufficient rate to prevent boric acid stratification.
| |
| The number of loops in operation can vary to suit the operational needs.
| |
| The intent of this LCO is to provide forced flow from at least one RHR loop for decay heat removal and transport. The flow provided by one RHR loop is adequate for decay heat removal. The other intent of this LCO is to require that a second path be available to provide redundancy for heat removal.
| |
| The LCO provides for redundant paths of decay heat removal capability.
| |
| The first path can be an RHR loop that must be OPERABLE and in operation. The second path can be another OPERABLE RHR loop or maintaining two SGs with secondary side water levels above the lower tap of the SG wide range level instrumentation by 418.77 inches to provide an alternate method for decay heat removal via natural circulation (Ref. 1).
| |
| APPLICABLE In MODE 5, RCS circulation is considered in the determination of the time SAFETY available for mitigation of the accidental boron dilution event. The RHR ANALYSES loops provide this circulation.
| |
| RCS Loops - MODE 5, Loops Filled satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii).
| |
| Cook Nuclear Plant Unit 2 B 3.4.7-1 Revision No. 0
| |
| | |
| RCS Loops - MODE 5, Loops Filled B 3.4.7 BASES LCO The purpose of this LCO is to require that at least one of the RHR loops be OPERABLE and in operation with an additional RHR loop OPERABLE or two SGs with secondary side water level above the lower tap of the SG wide range level instrumentation by 418.77 inches. One RHR loop provides sufficient forced circulation to perform the safety functions of the reactor coolant under these conditions. An additional RHR loop is required to be OPERABLE to meet single failure considerations.
| |
| However, if the standby RHR loop is not OPERABLE, an acceptable alternate method is two SGs with their secondary side water levels above the lower tap of the SG wide range level instrumentation by 418.77 inches. Should the operating RHR loop fail, the SGs could be used to remove the decay heat via natural circulation.
| |
| Note 1 permits all RHR pumps to be removed from operation 1 hour per 8 hour period. The purpose of the Note is to permit the RHR pump to be removed from operation when switching operation from one RHR loop or flowpath to another. The 1 hour time period is adequate to switch the RHR loops, and operating experience has shown that boron stratification is not likely during this short period with no forced flow.
| |
| Utilization of Note 1 is permitted provided the following conditions are met:
| |
| : a. No operations are permitted that would dilute the RCS boron concentration with coolant with boron concentrations less than required to meet the requirements of LCO 3.1.1, "SHUTDOWN MARGIN (SDM)," therefore maintaining the margin to criticality.
| |
| Boron reduction with coolant at boron concentrations less than required to assure SDM is maintained is prohibited because a uniform concentration distribution throughout the RCS cannot be ensured when in natural circulation; and
| |
| : b. Core outlet temperature is maintained at least 10°F below saturation temperature, so that no vapor bubble may form and possibly cause a natural circulation flow obstruction.
| |
| Note 2 allows one RHR loop to be inoperable for a period of up to 2 hours, provided that the other RHR loop is OPERABLE and in operation. This permits periodic surveillance tests to be performed on the inoperable loop during the only time when such testing is safe and possible.
| |
| Note 3 requires that the secondary side water temperature of each SG be < 50°F above each of the RCS cold leg temperatures or the pressurizer water level be < 62% before the start of an reactor coolant pump (RCP) with an RCS cold leg temperature < 152°F. This restriction Cook Nuclear Plant Unit 2 B 3.4.7-2 Revision No. 0
| |
| | |
| RCS Loops - MODE 5, Loops Filled B 3.4.7 BASES LCO (continued) is to prevent a low temperature overpressure event due to a thermal transient when an RCP is started.
| |
| Note 4 provides for an orderly transition from MODE 5 to MODE 4 during a planned heatup by permitting removal of RHR loops from operation when at least one RCS loop is in operation. This Note provides for the transition to MODE 4 where an RCS loop is permitted to be in operation and replaces the RCS circulation function provided by the RHR loops.
| |
| RHR pumps are OPERABLE if they are capable of being powered and are able to provide flow. An SG can perform as a heat sink via natural circulation when it has an adequate water level and is OPERABLE.
| |
| Management of gas voids is important to RHR System OPERABILITY.
| |
| APPLICABILITY In MODE 5 with RCS loops filled, this LCO requires forced circulation of the reactor coolant to remove decay heat from the core and to provide proper boron mixing. One loop of RHR provides sufficient circulation for these purposes. However, one additional RHR loop is required to be OPERABLE, or the secondary side water level of at least two SGs is required to be above the lower tap of the SG wide range water level instrumentation by 418.77 inches.
| |
| Operation in other MODES is covered by:
| |
| LCO 3.4.4, "RCS Loops - MODES 1 and 2";
| |
| LCO 3.4.5, "RCS Loops - MODE 3";
| |
| LCO 3.4.6, "RCS Loops - MODE 4";
| |
| LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled";
| |
| LCO 3.9.4, "Residual Heat Removal (RHR) and Coolant Circulation - High Water Level"; and LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation - Low Water Level."
| |
| ACTIONS A.1, A.2, B.1 and B.2 If one RHR loop is OPERABLE and either the required SGs do not have secondary side water levels above the lower tap of the SG wide range level instrumentation by 418.77 inches or one required RHR loop is inoperable, redundancy for heat removal is lost. Action must be initiated immediately to restore a second RHR loop to OPERABLE status or to restore the secondary side water levels to within limit for the required SGs. Either Required Action will restore redundant heat removal paths.
| |
| The immediate Completion Time reflects the importance of maintaining the availability of two paths for heat removal.
| |
| Cook Nuclear Plant Unit 2 B 3.4.7-3 Revision No. 57
| |
| | |
| RCS Loops - MODE 5, Loops Filled B 3.4.7 BASES ACTIONS (continued)
| |
| C.1 and C.2 If a required RHR loop is not in operation or if no required loop is OPERABLE, all operations involving introduction of coolant into the RCS with boron concentration less than required to meet the requirements of LCO 3.1.1 must be suspended and action to restore one RHR loop to OPERABLE status and operation must be initiated. Suspending operations that would cause introduction of coolant into the RCS with boron concentration less than required to meet the requirements of LCO 3.1.1 is required to assure continued safe operation. With coolant added without forced circulation, unmixed coolant could be introduced to the core, however coolant added with boron concentration meeting the minimum SDM maintains acceptable margin to subcritical operations.
| |
| The immediate Completion Times reflect the importance of maintaining operation for heat removal.
| |
| SURVEILLANCE SR 3.4.7.1 REQUIREMENTS This SR requires verification that the required loop is in operation circulating reactor coolant. Verification includes flow rate, temperature, or pump status monitoring, which help ensure that forced flow is providing heat removal. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.4.7.2 Verifying that at least two SGs are OPERABLE by ensuring their secondary side water levels are above the lower tap of the SG wide range level instrumentation by 418.77 inches ensures an alternate decay heat removal method via natural circulation in the event that the second RHR loop is not OPERABLE. The water level can be verified by either the wide range or the narrow range instruments. A narrow range level instrument 6% or a wide range level instrument 79% ensures the Surveillance Requirement limit is met. If both RHR loops are OPERABLE, this Surveillance is not needed. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.4.7.3 Verification that each required RHR pump is OPERABLE ensures that an additional pump can be placed in operation, if needed, to maintain decay heat removal and reactor coolant circulation. Verification is performed by Cook Nuclear Plant Unit 2 B 3.4.7-4 Revision No. 60
| |
| | |
| RCS Loops - MODE 5, Loops Filled B 3.4.7 BASES SURVEILLANCE REQUIREMENTS (continued) verifying proper breaker alignment and power available to each required RHR pump. If secondary side water level is above the lower tap of the SG wide range level instrumentation by 418.77 inches in at least two SGs, this Surveillance is not needed. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by a Note that states the SR is not required to be performed until 24 hours after a required pump is not in operation. This is acceptable because proper breaker alignment and power availability are ensured if a pump is operating.
| |
| SR 3.4.7.4 RHR System piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the required RHR loop(s) and may also prevent water hammer, pump cavitation, and pumping of noncondensible gas into the reactor vessel.
| |
| Selection of RHR System locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.
| |
| The RHR System is OPERABLE when it is sufficiently filled with water.
| |
| Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criterion for gas volume at the suction or discharge of a pump), the Surveillance is not met. If it is determined by subsequent evaluation that the RHR System is not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water), the Surveillance may be declared met. Accumulated gas should be eliminated or brought within the acceptance criteria limits.
| |
| RHR System locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow Cook Nuclear Plant Unit 2 B 3.4.7-5 Revision No. 60
| |
| | |
| RCS Loops - MODE 5, Loops Filled B 3.4.7 BASES SURVEILLANCE REQUIREMENTS (continued) path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative sub-set of susceptible locations.
| |
| Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. NRC Information Notice 95-35, "Degraded Ability of Steam Generators to Remove Decay Heat by Natural Circulation."
| |
| Cook Nuclear Plant Unit 2 B 3.4.7-6 Revision No. 60
| |
| | |
| RCS Loops - MODE 5, Loops Not Filled B 3.4.8 B 3.4 REACTOR COOLANT SYSTEM (RCS)
| |
| B 3.4.8 RCS Loops - MODE 5, Loops Not Filled BASES BACKGROUND In MODE 5 with the RCS loops not filled, the primary function of the reactor coolant is the removal of decay heat generated in the fuel, and the transfer of this heat to the component cooling water via the residual heat removal (RHR) heat exchangers. The steam generators (SGs) are not available as a heat sink when the loops are not filled. The secondary function of the reactor coolant is to act as a carrier for the soluble neutron poison, boric acid.
| |
| In MODE 5 with loops not filled, only RHR pumps can be used for coolant circulation. The intent of this LCO is to provide forced flow from at least one RHR pump for decay heat removal and transport and to require that two paths be available to provide redundancy for heat removal.
| |
| APPLICABLE In MODE 5, RCS circulation is considered in the determination of the time SAFETY available for mitigation of the accidental boron dilution event. The RHR ANALYSES loops provide this circulation. The flow provided by one RHR loop is adequate for heat removal and for boron mixing.
| |
| RCS loops in MODE 5 (loops not filled) satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The purpose of this LCO is to require that at least two RHR loops be OPERABLE and one of these loops be in operation. An OPERABLE loop is one that has the capability of transferring heat from the reactor coolant at a controlled rate. Heat cannot be removed via the RHR System unless forced flow is used. A minimum of one running RHR pump meets the LCO requirement for one loop in operation. An additional RHR loop is required to be OPERABLE to provide redundancy for heat removal.
| |
| Note 1 permits all RHR pumps to be removed from operation for 30 minutes when switching from one loop to another. The circumstances for stopping both RHR pumps are to be limited to situations when the outage time is short and core outlet temperature is maintained at least 10°F below saturation temperature. The Note prohibits introduction of coolant into the RCS with boron concentration less than required to meet the requirements of LCO 3.1.1, "SHUTDOWN MARGIN (SDM)," and draining operations when RHR forced flow is stopped.
| |
| Note 2 allows one RHR loop to be inoperable for a period of 2 hours, provided that the other loop is OPERABLE and in operation. This permits periodic surveillance tests to be performed on the inoperable loop during the only time when these tests are safe and possible.
| |
| Cook Nuclear Plant Unit 2 B 3.4.8-1 Revision No. 0
| |
| | |
| RCS Loops - MODE 5, Loops Not Filled B 3.4.8 BASES LCO (continued)
| |
| An OPERABLE RHR loop is comprised of an OPERABLE RHR pump capable of providing forced flow to an OPERABLE RHR heat exchanger.
| |
| RHR pumps are OPERABLE if they are capable of being powered and are able to provide flow if required. Management of gas voids is important to RHR System OPERABILITY.
| |
| APPLICABILITY In MODE 5 with loops not filled, this LCO requires core heat removal and coolant circulation by the RHR System.
| |
| Operation in other MODES is covered by:
| |
| LCO 3.4.4, "RCS Loops - MODES 1 and 2";
| |
| LCO 3.4.5, "RCS Loops - MODE 3";
| |
| LCO 3.4.6, "RCS Loops - MODE 4";
| |
| LCO 3.4.7, "RCS Loops - MODE 5, Loops Filled";
| |
| LCO 3.9.4, "Residual Heat Removal (RHR) and Coolant Circulation - High Water Level"; and LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation - Low Water Level."
| |
| ACTIONS A.1 If one required RHR loop is inoperable, redundancy for RHR is lost.
| |
| Action must be initiated to restore a second loop to OPERABLE status.
| |
| The immediate Completion Time reflects the importance of maintaining the availability of two paths for heat removal.
| |
| B.1 and B.2 If no required loop is OPERABLE or the required loop is not in operation, except during conditions permitted by Note 1, all operations involving introduction of coolant into the RCS with boron concentration less than required to meet the requirements of LCO 3.1.1 must be suspended and action must be initiated immediately to restore an RHR loop to OPERABLE status and operation. The required margin to criticality must not be reduced in this type of operation. Suspending operations that would cause the introduction, into the RCS, of coolant with boron concentration less than required to meet the requirements of LCO 3.1.1 is required to assure continued safe operation. With coolant added without forced circulation, unmixed coolant could be introduced to the core, however coolant added with boron concentration meeting the minimum SDM maintains acceptable margin to subcritical operations. The immediate Completion Time reflects the importance of maintaining operation for heat removal. The action to restore must continue until one loop is restored to OPERABLE status and operation.
| |
| Cook Nuclear Plant Unit 2 B 3.4.8-2 Revision No. 57
| |
| | |
| RCS Loops - MODE 5, Loops Not Filled B 3.4.8 BASES SURVEILLANCE SR 3.4.8.1 REQUIREMENTS This SR requires verification that the required loop is in operation circulating reactor coolant. Verification includes flow rate, temperature, or pump status monitoring, which help ensure that forced flow is providing heat removal. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.4.8.2 Verification that each required pump is OPERABLE ensures that an additional pump can be placed in operation, if needed, to maintain decay heat removal and reactor coolant circulation. Verification is performed by verifying proper breaker alignment and power available to each required pump. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by a Note that states the SR is not required to be performed until 24 hours after a required pump is not in operation. This is acceptable because proper breaker alignment and power availability are ensured if a pump is operating.
| |
| SR 3.4.8.3 RHR System piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the RHR loops and may also prevent water hammer, pump cavitation, and pumping of noncondensible gas into the reactor vessel.
| |
| Selection of RHR System locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.
| |
| The RHR System is OPERABLE when it is sufficiently filled with water.
| |
| Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an Cook Nuclear Plant Unit 2 B 3.4.8-3 Revision No. 60
| |
| | |
| RCS Loops - MODE 5, Loops Not Filled B 3.4.8 BASES SURVEILLANCE REQUIREMENTS (continued) acceptance criterion for gas volume at the suction or discharge of a pump), the Surveillance is not met. If it is determined by subsequent evaluation that the RHR System is not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water), the Surveillance may be declared met. Accumulated gas should be eliminated or brought within the acceptance criteria limits.
| |
| RHR System locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative sub-set of susceptible locations.
| |
| Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES None.
| |
| Cook Nuclear Plant Unit 2 B 3.4.8-4 Revision No. 60
| |
| | |
| Pressurizer B 3.4.9 B 3.4 REACTOR COOLANT SYSTEM (RCS)
| |
| B 3.4.9 Pressurizer BASES BACKGROUND The pressurizer provides a point in the RCS where liquid and vapor are maintained in equilibrium under saturated conditions for pressure control purposes to prevent bulk boiling in the remainder of the RCS. Key functions include maintaining required primary system pressure during steady state operation, and limiting the pressure changes caused by reactor coolant thermal expansion and contraction during normal load transients.
| |
| The pressure control components addressed by this LCO include the pressurizer water level, the backup heaters, and their controls.
| |
| Pressurizer safety valves and pressurizer power operated relief valves are addressed by LCO 3.4.10, "Pressurizer Safety Valves," and LCO 3.4.11, "Pressurizer Power Operated Relief Valves (PORVs),"
| |
| respectively.
| |
| The intent of the LCO is to ensure that a steam bubble exists in the pressurizer prior to power operation to minimize the consequences of potential overpressure transients. The presence of a steam bubble is consistent with analytical assumptions. Relatively small amounts of noncondensible gases can inhibit the condensation heat transfer between the pressurizer spray and the steam, and diminish the spray effectiveness for pressure control.
| |
| Electrical immersion heaters, located in the lower section of the pressurizer vessel, keep the water in the pressurizer at saturation temperature and maintain a constant operating pressure. There are two types of pressurizer heaters. There are proportional heaters and backup heaters. The backup heaters are powered from the emergency busses and are required by this Specification. A minimum required available capacity of pressurizer backup heaters ensures that the RCS pressure can be maintained. The capability to maintain and control system pressure is important for maintaining subcooled conditions in the RCS and ensuring the capability to remove core decay heat by either forced or natural circulation of reactor coolant. Unless adequate backup heater capacity is available, the hot, high pressure condition cannot be maintained indefinitely and still provide the required subcooling margin in the primary system. Inability to control the system pressure and maintain subcooling under conditions of natural circulation flow in the primary system could lead to a loss of single phase natural circulation and decreased capability to remove core decay heat.
| |
| Cook Nuclear Plant Unit 2 B 3.4.9-1 Revision No. 0
| |
| | |
| Pressurizer B 3.4.9 BASES APPLICABLE In MODES 1, 2, and 3, the LCO requirement for a steam bubble is SAFETY reflected implicitly in the accident analyses. Safety analyses performed ANALYSES for lower MODES are not limiting. All analyses performed from a critical reactor condition assume the existence of a steam bubble and saturated conditions in the pressurizer. In making this assumption, the analyses neglect the small fraction of noncondensible gases normally present.
| |
| Safety analyses presented in the UFSAR (Ref. 1) do not take credit for pressurizer backup heater operation; however, an implicit initial condition assumption of the safety analyses is that the RCS is operating at normal pressure.
| |
| The maximum pressurizer water level limit, which ensures that a steam bubble exists in the pressurizer, satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). Although the heaters are not specifically used in accident analysis, the need to maintain subcooling in the long term during loss of offsite power, as indicated in NUREG-0737 (Ref. 2), is the reason for providing an LCO.
| |
| LCO The LCO requirement for the pressurizer to be OPERABLE with a water volume approximately 1600 cubic feet, which is equivalent to 92%,
| |
| ensures that a steam bubble exists. Limiting the LCO maximum operating water level preserves the steam space for pressure control.
| |
| The LCO has been established to ensure the capability to establish and maintain pressure control for steady state operation and to minimize the consequences of potential overpressure transients. Requiring the presence of a steam bubble is also consistent with analytical assumptions.
| |
| The LCO requires two trains of OPERABLE pressurizer backup heaters, each with a capacity 150 kW. The minimum heater capacity required is sufficient to provide assurance that the heaters can be energized during a loss of offsite power condition to provide adequate subcooling margin in the RCS to maintain natural circulation conditions in MODE 3. Seven heaters (each rated at 23.08 kW) per train are required to meet the 150 kW capacity requirement.
| |
| APPLICABILITY The need for pressure control is most pertinent when core heat can cause the greatest effect on RCS temperature, resulting in the greatest effect on pressurizer level and RCS pressure control. Thus, applicability has been designated for MODES 1 and 2. The applicability is also provided for MODE 3. The purpose is to prevent solid water RCS operation during heatup and cooldown to avoid rapid pressure rises caused by normal operational perturbation, such as reactor coolant pump startup.
| |
| In MODES 1, 2, and 3, there is need to maintain the availability of the pressurizer backup heaters. In the event of a loss of offsite power, the Cook Nuclear Plant Unit 2 B 3.4.9-2 Revision No. 0
| |
| | |
| Pressurizer B 3.4.9 BASES APPLICABILITY (continued) initial conditions of these MODES give the greatest demand for maintaining the RCS in a hot pressurized condition with loop subcooling for an extended period. For MODE 4, 5, or 6, it is not necessary to control pressure (by heaters) to ensure loop subcooling for heat transfer when the Residual Heat Removal (RHR) System is in service, and therefore, the LCO is not applicable.
| |
| ACTIONS A.1, A.2, A.3, and A.4 Pressurizer water level control malfunctions or other unit evolutions may result in a pressurizer water level above the nominal upper limit, even with the unit at steady state conditions. Normally the unit will trip in this event since the upper limit of this LCO is the same as the Pressurizer Water Level - High trip setpoint.
| |
| If the pressurizer water level is not within the limit, action must be taken to bring the unit to a MODE in which the LCO does not apply. To achieve this status, within 6 hours the unit must be brought to MODE 3 with all rods fully inserted and incapable of withdrawal. Additionally, the unit must be brought to MODE 4 within 12 hours. This takes the unit out of the applicable MODES.
| |
| The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| B.1 If one train of pressurizer backup heaters is inoperable, restoration is required within 72 hours. The Completion Time of 72 hours is reasonable considering the anticipation that a demand caused by loss of offsite power would be unlikely in this period. Pressure control may be maintained during this time using the pressurizer proportional heaters.
| |
| C.1 and C.2 If one train of pressurizer backup heaters are inoperable and cannot be restored in the allowed Completion Time of Required Action B.1, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to MODE 3 within 6 hours and to MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| Cook Nuclear Plant Unit 2 B 3.4.9-3 Revision No. 0
| |
| | |
| Pressurizer B 3.4.9 BASES SURVEILLANCE SR 3.4.9.1 REQUIREMENTS This SR requires that during steady state operation, pressurizer level is maintained below the nominal upper limit to provide a minimum space for a steam bubble. The Surveillance is performed by observing the indicated level. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.4.9.2 The SR is satisfied when the power supplies are demonstrated to be capable of producing the minimum power and the associated pressurizer backup heaters are verified to be at their specified capacity. This may be done by testing the power supply output with the heaters energized. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Chapter 14.
| |
| : 2. NUREG-0737, November 1980.
| |
| Cook Nuclear Plant Unit 2 B 3.4.9-4 Revision No. 60
| |
| | |
| Pressurizer Safety Valves B 3.4.10 B 3.4 REACTOR COOLANT SYSTEM (RCS)
| |
| B 3.4.10 Pressurizer Safety Valves BASES BACKGROUND The pressurizer safety valves provide, in conjunction with the Reactor Trip System, overpressure protection for the RCS. The pressurizer safety valves are totally enclosed pop type, spring loaded, self actuated valves with backpressure compensation. The safety valves are designed to prevent the system pressure from exceeding the system Safety Limit (SL), 2735 psig, which is 110% of the design pressure.
| |
| Because the safety valves are totally enclosed and self actuating, they are considered independent components. The relief capacity for each valve, 420,000 lb/hr, is based on postulated overpressure transient conditions resulting from a complete loss of steam flow to the turbine.
| |
| This event results in the maximum surge rate into the pressurizer, which specifies the minimum relief capacity for the safety valves. The discharge flow from the pressurizer safety valves is directed to the pressurizer relief tank. An acoustic flow monitor and a temperature indicator on each valve discharge alerts the operator to the passage of steam due to leakage or valve lifting.
| |
| Overpressure protection is required in MODES 1, 2, 3, 4, and 5; however, in MODE 4, with one or more RCS cold leg temperatures 299°F, and MODE 5 and MODE 6 with the reactor vessel head on, overpressure protection is provided by operating procedures and by meeting the requirements of LCO 3.4.12, "Low Temperature Overpressure Protection (LTOP) System."
| |
| The upper and lower pressure limits are based on the +/- 3% tolerance requirement (Ref. 1) for lifting pressures above 1000 psig. The lift setting is for the ambient conditions associated with MODES 1, 2, and 3. This requires either that the valves be set hot or that a correlation between hot and cold settings be established.
| |
| The pressurizer safety valves are part of the primary success path and mitigate the effects of postulated accidents. OPERABILITY of the safety valves ensures that the RCS pressure will be limited to 110% of design pressure. The consequences of exceeding the American Society of Mechanical Engineers (ASME) pressure limit (Ref. 1) could include damage to RCS components, increased leakage, or a requirement to perform additional stress analyses prior to resumption of reactor operation.
| |
| Cook Nuclear Plant Unit 2 B 3.4.10-1 Revision No. 0
| |
| | |
| Pressurizer Safety Valves B 3.4.10 BASES APPLICABLE All accident and safety analyses in the UFSAR (Ref. 2) that require safety SAFETY valve actuation assume operation of three pressurizer safety valves to ANALYSES limit increases in RCS pressure. The overpressure protection analysis (Ref. 3) is also based on operation of three safety valves. Accidents that could result in overpressurization if not properly terminated include:
| |
| : a. Uncontrolled rod withdrawal from full power;
| |
| : b. Loss of reactor coolant flow (reactor coolant pump locked rotor);
| |
| : c. Loss of external electrical load or turbine trip;
| |
| : d. Loss of normal feedwater;
| |
| : e. Loss of all AC power to unit auxiliaries; and
| |
| : f. Major rupture of main feedwater pipe.
| |
| Detailed analyses of the above transients are contained in Reference 2.
| |
| Safety valve actuation is required in events b, c, and e (above) to limit the pressure increase. Compliance with this LCO is consistent with the design bases and accident analyses assumptions.
| |
| Pressurizer Safety Valves satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The three pressurizer safety valves are set to open at the RCS design pressure (2500 psia), and within the ASME specified tolerance, to avoid exceeding the maximum design pressure SL, to maintain accident analyses assumptions, and to comply with ASME requirements. The upper and lower pressure tolerance limits are based on the +/- 3%
| |
| tolerance requirements (Ref. 1) for lifting pressures above 1000 psig.
| |
| The limit protected by this Specification is the reactor coolant pressure boundary (RCPB) SL of 110% of design pressure. Inoperability of one or more valves could result in exceeding the SL if a transient were to occur.
| |
| The consequences of exceeding the ASME pressure limit could include damage to one or more RCS components, increased leakage, or additional stress analysis being required prior to resumption of reactor operation.
| |
| APPLICABILITY In MODES 1, 2, and 3, and portions of MODE 4 above the LTOP arming temperature, OPERABILITY of three valves is required because the combined capacity is required to keep reactor coolant pressure below 110% of its design value during certain accidents. MODE 3 and portions of MODE 4 are conservatively included, although the listed accidents may not require the safety valves for protection.
| |
| Cook Nuclear Plant Unit 2 B 3.4.10-2 Revision No. 0
| |
| | |
| Pressurizer Safety Valves B 3.4.10 BASES APPLICABILITY (continued)
| |
| The LCO is not applicable in MODE 4 when any RCS cold leg temperatures are 299°F or in MODE 5 because LTOP is provided.
| |
| Overpressure protection is not required in MODE 6 with reactor vessel head removed.
| |
| The Note allows entry into MODES 3 and 4 with the lift settings outside the LCO limits. This permits testing and examination of the safety valves at high pressure and temperature near their normal operating range, but only after the valves have had a preliminary cold setting. The cold setting gives assurance that the valves are OPERABLE near their design condition. Only one valve at a time will be removed from service for testing. The 54 hour exception is based on 18 hour outage time for each of the three valves. The 18 hour period is derived from operating experience that hot testing can be performed in this timeframe.
| |
| ACTIONS A.1 With one pressurizer safety valve inoperable, restoration must take place within 15 minutes. The Completion Time of 15 minutes reflects the importance of maintaining the RCS Overpressure Protection System. An inoperable safety valve coincident with an RCS overpressure event could challenge the integrity of the pressure boundary.
| |
| B.1 and B.2 If Required Action A.1 and associated Completion Time is not met or if two or more pressurizer safety valves are inoperable, the unit must be brought to a MODE in which the requirement does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 4 with any RCS cold leg temperatures 299°F within 24 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| With any RCS cold leg temperatures at or below 299°F, overpressure protection is provided by the LTOP System. The change from MODE 1, 2, or 3 to MODE 4 reduces the RCS energy (core power and pressure),
| |
| lowers the potential for large pressurizer insurges, and thereby removes the need for overpressure protection by three pressurizer safety valves.
| |
| Cook Nuclear Plant Unit 2 B 3.4.10-3 Revision No. 0
| |
| | |
| Pressurizer Safety Valves B 3.4.10 BASES SURVEILLANCE SR 3.4.10.1 REQUIREMENTS SRs are specified in the INSERVICE TESTING PROGRAM. Pressurizer safety valves are to be tested in accordance with the requirements of the ASME OM Code (Ref. 4), which provides the activities and Frequencies necessary to satisfy the SRs. No additional requirements are specified.
| |
| The pressurizer safety valve setpoint is +/- 3% for OPERABILITY; however, the valves are reset to +/- 1% during the Surveillance to allow for drift.
| |
| REFERENCES 1. ASME, Boiler and Pressure Vessel Code, Section III.
| |
| : 2. UFSAR, Chapter 14.
| |
| : 3. WCAP-7769, Rev. 1, June 1972.
| |
| : 4. ASME, Operation and Maintenance Standards and Guides (OM Codes).
| |
| Cook Nuclear Plant Unit 2 B 3.4.10-4 Revision No. 61
| |
| | |
| Pressurizer PORVs B 3.4.11 B 3.4 REACTOR COOLANT SYSTEM (RCS)
| |
| B 3.4.11 Pressurizer Power Operated Relief Valves (PORVs)
| |
| BASES BACKGROUND The pressurizer is equipped with two types of devices for pressure relief:
| |
| pressurizer safety valves and PORVs. The PORVs are air operated valves that are controlled to open at a specific set pressure when the pressurizer pressure increases and close when the pressurizer pressure decreases. The PORVs may also be manually operated from the control room.
| |
| Block valves, which are normally open, are located between the pressurizer and the PORVs. The block valves are used to isolate the PORVs in case of excessive leakage or a stuck open PORV. Block valve closure is accomplished manually using controls in the control room. A stuck open PORV is, in effect, a small break loss of coolant accident (LOCA). As such, block valve closure terminates the RCS depressurization and coolant inventory loss.
| |
| The PORVs and their associated block valves are assumed to be used by unit operators to depressurize the RCS to recover from the steam generator tube rupture (SGTR) event. Additionally, the series arrangement of the PORVs and their block valves permit performance of surveillances on the valves during power operation.
| |
| The PORVs may also be used for feed and bleed core cooling in the case of multiple equipment failure events that are not within the design basis, such as a total loss of feedwater.
| |
| The block valves and their controls are powered from the emergency buses that normally receive power from qualified offsite power sources, but are also capable of being powered from emergency power sources in the event of a loss of offsite power. The PORVs and their controls are powered from the safety related DC Power Distribution System. Two PORVs and their associated block valves are powered from one safety train while the third PORV and associated block valve is powered by the other safety train (Ref. 1). The normal air supply for each PORV is the plant control air source. Two of the PORVs each have a solenoid control valve and an accumulator with a check valve, and open when the associated solenoid control valve and check valve opens. The two PORVs have emergency air tanks which support PORV operation if normal control air becomes unavailable. The other PORV only has a solenoid control valve, and opens when the associated solenoid control valve opens.
| |
| Cook Nuclear Plant Unit 2 B 3.4.11-1 Revision No. 66
| |
| | |
| Pressurizer PORVs B 3.4.11 BASES BACKGROUND (continued)
| |
| The unit has three PORVs, each having a relief capacity of 210,000 lb/hr at 2335 psig. Two PORVs maintain the pressurizer pressure below the Pressurizer Pressure - High reactor trip setpoint following a step reduction of 50% of full load with steam dump. In addition, the PORVs minimize challenges to the pressurizer safety valves and also may be used for low temperature overpressure protection (LTOP). See LCO 3.4.12, "Low Temperature Overpressure Protection (LTOP) System."
| |
| APPLICABLE Unit operators employ the PORVs to depressurize the RCS in response SAFETY to certain unit transients if normal pressurizer spray is not available. For ANALYSES the SGTR event, the safety analysis assumes that manual operator actions are required to mitigate the event. A loss of offsite power is assumed to accompany the event, and thus, normal pressurizer spray is unavailable to reduce RCS pressure. The PORVs are assumed to be used for RCS depressurization, which is one of the steps performed to equalize the primary and secondary pressures in order to terminate the primary to secondary break flow and the radioactive releases from the affected steam generator.
| |
| Control Air is required to support Pressurizer PORV operation during a SGTR event. There is no requirement to assume a single failure in the SGTR event. However, a LOOP in both units is assumed.
| |
| The PORVs are also modeled in safety analyses for events that result in increasing RCS pressure for which departure from nucleate boiling ratio (DNBR) criteria are critical (Ref. 2). By assuming PORV actuation, the primary pressure remains below the high pressurizer pressure trip setpoint; thus, the DNBR calculation is more conservative. As such, this actuation is not required to mitigate these events, and PORV automatic operation is, therefore, not an assumed safety function.
| |
| Pressurizer PORVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The LCO requires two PORVs and their associated block valves to be OPERABLE for manual operation to mitigate the effects associated with an SGTR. By maintaining two PORVs and their associated block valves OPERABLE, the single failure criterion is satisfied (one PORV is assumed to fail in the analysis). Any of the three PORVs can be used to meet this requirement. In addition, the third PORV and associated block valve are required to be OPERABLE to ensure the PORV is closed and not excessively leaking and the associated block valve is capable of isolating the PORV due to excessive leakage or being stuck open. An OPERABLE block valve may be either open and energized with the capability to be closed, or closed and energized with the capability to be opened, since the required safety function is accomplished by manual operation. Isolation of an OPERABLE PORV does not render that PORV Cook Nuclear Plant Unit 2 B 3.4.11-2 Revision No. 66
| |
| | |
| Pressurizer PORVs B 3.4.11 BASES LCO (continued) or block valve inoperable provided the relief function remains available with manual action.
| |
| An OPERABLE PORV is required to be capable of manually opening and closing, and not experiencing excessive seat leakage. Excessive seat leakage, although not associated with a specific acceptance criteria, exists when conditions dictate closure of the block valve to limit leakage.
| |
| Satisfying the LCO helps minimize challenges to fission product barriers.
| |
| For the purpose of applying Technical Specification 3.4.11 requirements, CD Emergency Diesel Generator (EDG) OPERABILITY is required for Control Air Compressor (CAC) availability. Availability of the CAC supports Pressurizer PORV OPERABILITY for the SGTR event. With the CAC unavailable (possibly caused by maintenance or CD EDG inoperability), the emergency air tanks support Pressurizer PORV OPERABILITY provided the pressure in each emergency air tank is 900 psig. The emergency air tanks are not required to maintain Pressurizer PORV OPERABILITY unless the CAC is unavailable.
| |
| When the CAC becomes unavailable (possibly caused by maintenance or CD EDG INOPERABILITY), Pressurizer PORV NRV-151 is INOPERABLE because it is not equipped with an emergency air tank.
| |
| If a Pressurizer PORV is INOPERABLE due to CAC unavailability, LCO 3.0.6 can be applied only when the CAC unavailability is due to CD EDG INOPERABILITY.
| |
| APPLICABILITY The PORVs are required to be OPERABLE in MODES 1, 2, and 3 for manual actuation to mitigate a steam generator tube rupture event.
| |
| In MODES 1, 2, and 3, the block valves are required to be OPERABLE to limit the potential for a small break LOCA through the flow path. The most likely cause for a PORV small break LOCA is a result of a pressure increase transient that causes the PORV to open. Imbalances in the energy output of the core and heat removal by the secondary system can cause the RCS pressure to increase to the PORV opening setpoint. The most rapid increases will occur at the higher operating power and pressure conditions of MODES 1 and 2. Pressure increases are less prominent in MODE 3 because the core input energy is reduced, but the RCS pressure is high. Therefore, the LCO is applicable in MODES 1, 2, and 3. The LCO is not applicable in MODES 4, 5, and 6 with the reactor vessel head in place when both pressure and core energy are decreased and the pressure surges become much less significant.
| |
| PORVs are required in other MODES for LTOP events. LCO 3.4.12 addresses the PORV requirements in these MODES.
| |
| Cook Nuclear Plant Unit 2 B 3.4.11-3 Revision No. 78
| |
| | |
| Pressurizer PORVs B 3.4.11 BASES ACTIONS A Note has been added to clarify that all pressurizer PORVs and block valves are treated as separate entities, each with separate Completion Times (i.e., the Completion Time is on a component basis).
| |
| A.1 PORVs may be inoperable and capable of being manually cycled (e.g.,
| |
| excessive seat leakage). In this condition, the associated block valve is required to be closed within 1 hour, but power must be maintained to the associated block valve, since removal of power would render the block valve inoperable.
| |
| Condition A is entered and associated Action A.1 are also applied for CAC unavailability as a means to account for impact on Pressurizer PORV NRV-151 Operability. With the CD EDG inoperable, PORV NRV-151 is inoperable, but the action to close the block valve need not be performed per provision in TS 3.0.6.
| |
| Quick access to the PORV for pressure control can be made when power remains on the closed block valve. The Completion Time of 1 hour is based on unit operating experience that has shown that minor problems can be corrected or closure accomplished in this time period.
| |
| B.1 and B.2 If one or more PORVs are inoperable and not capable of being manually cycled, it must be isolated by closing the associated block valve and removing the power to the associated block valve. The Completion Times of 1 hour are reasonable, based on challenges to the PORVs during this time period, and provide the operator adequate time to correct the situation.
| |
| C.1 If one or more block valves are inoperable, then it is necessary to place the associated PORV in manual control within the Completion Time of 1 hour. The prime importance for the capability to close the block valve(s) is to isolate a stuck open PORV. Therefore, if the block valve(s) cannot be restored to OPERABLE status within 1 hour, the Required Action is to place the PORV in manual control to preclude its automatic opening for an overpressure event and to avoid the potential for a stuck open PORV at a time that the block valve(s) are inoperable. The Completion Time of 1 hour is reasonable, based on the small potential for challenges to the system during this time period, and provides the operator time to correct the situation.
| |
| Required Action C.1 is modified by a Note stating that the Required Action does not apply if the sole reason for the block valve being declared Cook Nuclear Plant Unit 2 B 3.4.11-4 Revision No. 78
| |
| | |
| Pressurizer PORVs B 3.4.11 BASES ACTIONS (continued) inoperable is as a result of power being removed to comply with Required Action B.2. In this event, the Required Actions for inoperable PORV(s)
| |
| (which require the block valve power to be removed once it is closed) are adequate to address the condition. While it may be desirable to also place the PORV(s) in manual control, this may not be possible for all causes of Condition B entry with PORV(s) inoperable and not capable of being manually cycled (e.g., as a result of failed control power fuse(s) or control switch malfunctions(s)).
| |
| D.1 If two PORVs are inoperable and not capable of being manually cycled, it is necessary to restore one PORV to OPERABLE status within a Completion Time of 72 hours. Because at least one PORV remains OPERABLE, the assumptions of the SGTR analysis is still met, and the operator is permitted a Completion Time of 72 hours to restore one of the inoperable PORVs to OPERABLE status.
| |
| E.1 If two block valves are inoperable, it is necessary to restore at least one block valve to OPERABLE status within 72 hours. Because at least one block valve remains OPERABLE, the operator is permitted a Completion Time of 72 hours to restore one of the inoperable block valves to OPERABLE status.
| |
| Required Action E.1 is modified by a Note stating that the Required Action does not apply if the sole reason for the block valve being declared inoperable is a result of power being removed to comply with Required Action B.2. In this event, the Required Actions for inoperable PORV(s)
| |
| (which require the block valve power to be removed once it is closed) are adequate to address the condition. While it may be desirable to also place the PORV(s) in manual control, this may not be possible for all causes of Condition B entry with PORV(s) inoperable and not capable of being manually cycled (e.g., as a result of failed control power fuse(s) or control switch malfunctions(s)).
| |
| F.1 If one PORV is inoperable and not capable of being manually cycled and one block valve is inoperable (for reasons other than to comply with Required Action B.2) in a different line than the inoperable PORV, it is necessary to restore valve(s) to OPERABLE status within 72 hours such that only valve(s) in one line are inoperable. Since at least one PORV and its associated block valve remain OPERABLE, the operator is permitted a Completion Time of 72 hours. The Completion Time is Cook Nuclear Plant Unit 2 B 3.4.11-5 Revision No. 78
| |
| | |
| Pressurizer PORVs B 3.4.11 BASES ACTIONS (continued) reasonable based on a small potential for challenges to the system during this time period and to provide the operator time to correct the situation.
| |
| G.1 If three block valves are inoperable, it is necessary to restore at least one block valve to OPERABLE status within 2 hours. The Completion Time is reasonable based on a small potential for challenges to the system during this time period and to provide the operator time to correct the situation.
| |
| Required Action G.1 is modified by a Note stating that the Required Action does not apply if the sole reason for the block valve being declared inoperable is a result of power being removed to comply with Required Action B.2. In this event, the Required Actions for inoperable PORV(s)
| |
| (which require the block valve power to be removed once it is closed) are adequate to address the condition. While it may be desirable to also place the PORV(s) in manual control, this may not be possible for all causes of Condition B entry with PORV(s) inoperable and not capable of being manually cycled (e.g., as a result of failed control power fuse(s) or control switch malfunctions(s))
| |
| H.1 and H.2 If any Required Action and associated Completion Time of Condition A, B, C, D, E, F, or G is not met, if three PORVs are inoperable and not capable of being manually cycled, if two PORVs are inoperable and not capable of being manually cycled and one block valve inoperable (for reasons other than to comply with Required Action B.2) in a different line than the inoperable PORVs, or if one PORV is inoperable and not capable of being manually cycled and two block valves are inoperable (for reasons other than to comply with Required Action B.2) in different lines than the inoperable PORV, then the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| SURVEILLANCE SR 3.4.11.1 REQUIREMENTS Block valve cycling verifies that the valve(s) can be opened and closed if needed. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by a Note, which states that this SR is not required to Cook Nuclear Plant Unit 2 B 3.4.11-6 Revision No. 78
| |
| | |
| Pressurizer PORVs B 3.4.11 BASES SURVEILLANCE REQUIREMENTS (continued) be performed with the block valve closed in accordance with the Required Actions of this LCO. Opening the block valve in this condition increases the risk of an unisolable leak from the RCS since the PORV is already inoperable.
| |
| SR 3.4.11.2 SR 3.4.11.2 requires a complete cycle of each PORV. Operating a PORV through one complete cycle ensures that the PORV can be manually actuated for mitigation of an SGTR.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.)
| |
| The Note modifies this SR to allow entry into and operation in MODE 3 prior to performing the SR. This allows the test to be performed in MODE 3 under operating temperature and pressure conditions, prior to entering MODE 1 or 2. In accordance with Reference 4, administrative controls require this test be performed in MODE 3 or 4 to adequately simulate operating temperature and pressure effects on PORV operation.
| |
| SR 3.4.11.3 Operating the solenoid air control valve associated with each PORV, and the check valves on the air accumulators where applicable, ensures the PORV control system actuates properly when called upon. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. Regulatory Guide 1.32, February 1977.
| |
| : 2. UFSAR, Section 14.1.8.
| |
| : 3. ASME, Operation and Maintenance Standards and Guides (OM Codes).
| |
| : 4. Generic Letter 90-06, "Resolution of Generic Issue 70,
| |
| 'Power-Operated Relief Valve and Block Valve Reliability,' and Generic Issue 94, 'Additional Low-Temperature Overpressure for Light-Water Reactors,' Pursuant to 10 CFR 50.54(f)," June 25, 1990.
| |
| : 5. MD-12-CA-004-S, Determination of Available Pressurizer PORV Strokes using the Auxiliary Air Supply Backup Air Bottle Hold-Open Capacity.
| |
| Cook Nuclear Plant Unit 2 B 3.4.11-7 Revision No. 78
| |
| | |
| LTOP System B 3.4.12 B 3.4 REACTOR COOLANT SYSTEM (RCS)
| |
| B 3.4.12 Low Temperature Overpressure Protection (LTOP) System BASES BACKGROUND The LTOP System controls RCS pressure at low temperatures so the integrity of the reactor coolant pressure boundary (RCPB) is not compromised by violating the pressure and temperature (P/T) limits of 10 CFR 50, Appendix G (Ref. 1). The reactor vessel is the limiting RCPB component for demonstrating such protection. ITS 3.4.3, "RCS Pressure and Temperature (P/T) Limits," provides the maximum RCS pressure for the existing RCS cold leg temperature during cooldown, shutdown, and heatup to meet the Reference 1 requirements during the LTOP MODES.
| |
| The reactor vessel material is less tough at low temperatures than at normal operating temperature. As the vessel neutron exposure accumulates, the material toughness decreases and becomes less resistant to pressure stress at low temperatures (Ref. 2). RCS pressure, therefore, is maintained low at low temperatures and is increased only as temperature is increased.
| |
| The potential for vessel overpressurization is most acute when the RCS is water solid, occurring only while shutdown; a pressure fluctuation can occur more quickly than an operator can react to relieve the condition.
| |
| Exceeding the RCS P/T limits by a significant amount could cause brittle cracking of the reactor vessel. LCO 3.4.3 requires administrative control of RCS pressure and temperature during heatup and cooldown to prevent exceeding the P/T limits.
| |
| This LCO provides RCS overpressure protection by having a minimum coolant input capability, limiting reactor coolant pump (RCP) startup transients, and having adequate pressure relief capacity. Limiting coolant input capability requires all safety injection (SI) pumps and all but one charging pump incapable of injection into the RCS and isolation of the accumulators. RCPs shall not be started when RCS cold leg temperature is 152°F unless certain requirements are met. The pressure relief capacity requires either two redundant RCS relief valves or a depressurized RCS and an RCS vent of sufficient size. One RCS relief valve or the open RCS vent is the overpressure protection device that is available to terminate an increasing pressure event. When all RCS cold leg temperatures are 140°F, the coolant input capability is allowed to be increased by allowing both charging pumps to be capable of injecting into the RCS. This is acceptable since requiring three RCS relief valves provides adequate pressure relief capacity under these conditions (one of the two PORVs and the RHR suction relief valve are the overpressure protection devices that are available to terminate an increasing pressure event).
| |
| Cook Nuclear Plant Unit 2 B 3.4.12-1 Revision No. 0
| |
| | |
| LTOP System B 3.4.12 BASES BACKGROUND (continued)
| |
| With minimum coolant input capability, the ability to provide core coolant addition is restricted. The LCO does not specifically require the makeup control system deactivated or the SI actuation circuits blocked. Due to the lower pressures in the LTOP MODES and the expected core decay heat levels, the makeup system can provide adequate flow via the makeup control valve. If conditions require the use of more than one charging pump or an SI pump for makeup in the event of loss of inventory, then pumps can be made available through manual actions.
| |
| The LTOP System for pressure relief consists of two power operated relief valves (PORVs), with reduced lift settings, one PORV and one RHR suction relief valve, or a depressurized RCS and an RCS vent of sufficient size. Two RCS relief valves are required for redundancy. One RCS relief valve has adequate relieving capability to prevent overpressurization for the required coolant input capability. When all RCS cold leg temperatures are 140°F and two charging pumps are capable of injecting into the RCS, the LTOP System for pressure relief includes all three RCS relief valves (two PORVs and the RHR suction relief valve).
| |
| Three RCS relief valves are required for redundancy, since one PORV and one RHR suction relief valve have adequate relieving capability to prevent overpressurization at this coolant input capability.
| |
| PORV Requirements When the RCS temperature is below the LTOP enable temperature, a safeguards circuit is manually armed which allows the PORVs to open in the event of a low temperature overpressurization transient. RCS pressure is monitored by two wide range pressure instruments with each instrument providing an opening signal to one PORV.
| |
| The LTOP setpoints for both PORVs are the same. Having the setpoints of both valves within the limit ensures that the Reference 1 limits will not be exceeded in any analyzed event.
| |
| When a PORV is opened in an increasing pressure transient, the release of coolant will cause the pressure increase to slow and reverse. As the PORV releases coolant, the RCS pressure decreases until a reset pressure is reached and the valve is signaled to close. The pressure continues to decrease below the reset pressure as the valve closes.
| |
| RHR Suction Relief Valve Requirements During LTOP MODES, the RHR System is operated for decay heat removal and low pressure letdown control. Therefore, the RHR suction isolation valves are open in the piping from the RCS hot legs to the inlets Cook Nuclear Plant Unit 2 B 3.4.12-2 Revision No. 0
| |
| | |
| LTOP System B 3.4.12 BASES BACKGROUND (continued) of the RHR pumps. While these valves are open, the RHR suction relief valve is exposed to the RCS and is able to relieve pressure transients in the RCS.
| |
| The RHR suction isolation valves must be open to make the RHR suction relief valve OPERABLE for RCS overpressure mitigation. The RHR suction relief valve is a spring loaded, bellows type water relief valve with pressure tolerances and accumulation limits established by Section III of the American Society of Mechanical Engineers (ASME) Code (Ref. 3) for Class 2 relief valves.
| |
| RCS Vent Requirements Once the RCS is depressurized, a vent exposed to the containment atmosphere will maintain the RCS at containment ambient pressure in an RCS overpressure transient, if the relieving requirements of the transient do not exceed the capabilities of the vent. Thus, the vent path must be capable of relieving the flow resulting from the limiting LTOP mass or heat input transient, and maintaining pressure below the P/T limits. The required vent capacity may be provided by one or more vent paths.
| |
| For an RCS vent to meet the flow capacity requirement, it requires removing a pressurizer safety valve, blocking open any one of the three PORVs, and disabling its block valve in the open position, or similarly establishing a vent by opening sufficient RCS vent valves to provide a 2.0 square inch vent path. The vent path(s) must be above the level of reactor coolant, so as not to drain the RCS when open.
| |
| APPLICABLE Safety analyses (Ref. 4) demonstrate that the reactor vessel is SAFETY adequately protected against exceeding the Reference 1 P/T limits. In ANALYSES MODES 1, 2, and 3, and in MODE 4 with RCS cold leg temperature exceeding 299°F, the pressurizer safety valves will prevent RCS pressure from exceeding the Reference 1 limits. At 299°F and below, overpressure prevention falls to two OPERABLE RCS relief valves (or three RCS relief valves when all RCS cold leg temperatures are 140°F and two charging pumps are capable of injecting into the RCS) or to a depressurized RCS and a sufficient sized RCS vent. Each of these means has a limited overpressure relief capability.
| |
| The actual temperature at which the pressure in the P/T limit curve falls below the pressurizer safety valve setpoint increases as the reactor vessel material toughness decreases due to neutron embrittlement. Each time the P/T limit curves are revised, the LTOP System must be re-evaluated to ensure its functional requirements can still be met using the RCS relief valve method or the depressurized and vented RCS condition.
| |
| Cook Nuclear Plant Unit 2 B 3.4.12-3 Revision No. 0
| |
| | |
| LTOP System B 3.4.12 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| The LCO contains the acceptance limits that define the LTOP requirements. Any change to the RCS must be evaluated against the Reference 4 analyses to determine the impact of the change on the LTOP acceptance limits.
| |
| Transients that are capable of overpressurizing the RCS are categorized as either mass or heat input transients, examples of which follow:
| |
| Mass Input Type Transients
| |
| : a. Inadvertent safety injection; or
| |
| : b. Charging/letdown flow mismatch.
| |
| Heat Input Type Transients
| |
| : a. Inadvertent actuation of pressurizer heaters;
| |
| : b. Loss of RHR cooling; or
| |
| : c. Reactor coolant pump (RCP) startup with temperature asymmetry within the RCS or between the RCS and steam generators.
| |
| The following are required during the LTOP MODES to ensure that mass and heat input transients do not occur, which either of the LTOP overpressure protection means cannot handle:
| |
| : a. Rendering all SI pumps and all but one charging pump incapable of injection, unless all RCS cold leg temperatures are 140°F, and three RCS relief valves are OPERABLE, then only all of the SI pumps must be rendered incapable of injection;
| |
| : b. Deactivating the accumulator discharge isolation valves in their closed positions; and
| |
| : c. Disallowing a startup of an RCP with one or more RCS cold leg temperatures 152°F, unless the pressurizer water level is < 62% or the secondary water temperature of each steam generator is < 50°F above each of the RCS cold leg temperatures.
| |
| The Reference 4 analyses demonstrate that either one RCS relief valve or the depressurized RCS and RCS vent can maintain RCS pressure below limits when only one charging pump is actuated. Thus, the LCO allows only one charging pump to be capable of injecting into the RCS during the LTOP MODES. Since neither one RCS relief valve nor the Cook Nuclear Plant Unit 2 B 3.4.12-4 Revision No. 0
| |
| | |
| LTOP System B 3.4.12 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| RCS vent can handle the pressure transient need from accumulator injection, when RCS temperature is low, the LCO also requires the accumulators isolation when the accumulators are not depressurized and vented. The analyses also demonstrate that one PORV and one RHR suction relief valve can maintain RCS pressure below limits when both charging pumps are actuated, all RCS cold leg temperatures are 140°F.
| |
| Thus, the LCO allows two charging pumps to be capable of injecting into the RCS under these conditions.
| |
| The isolated accumulators must have their discharge valves closed and the valve power supply breakers fixed in their open positions.
| |
| Fracture mechanics analyses established the temperature of LTOP Applicability at 299°F.
| |
| PORV Performance The fracture mechanics analyses show that the vessel is protected when the PORVs are set to open at or below the specified setpoint. The setpoints are derived by analyses that model the performance of the LTOP System, assuming the mass addition transient of one or two charging pumps injecting into the RCS or the limiting heat input transient of an RCP startup with temperature asymmetry within the RCS or between the RCS and steam generators of 50°F above each of the RCS cold leg temperatures. These analyses consider pressure overshoot and undershoot beyond the PORV opening and closing, resulting from signal processing and valve stroke times. The PORV setpoints at or below the derived limit ensures the Reference 1 P/T limits will be met.
| |
| The PORV setpoints will be updated, as necessary, when the P/T limits are revised. The P/T limits are periodically modified as the reactor vessel material toughness decreases due to neutron embrittlement caused by neutron irradiation. Revised limits are determined using neutron fluence projections and the results of examinations of the reactor vessel material irradiation surveillance specimens. The Bases for LCO 3.4.3, "RCS Pressure and Temperature (P/T) Limits," discuss these examinations.
| |
| The PORVs are considered active components. Thus, the failure of one PORV is assumed to represent the worst case, single active failure.
| |
| RHR Suction Relief Valve Performance Analyses show that the RHR suction relief valve with a setpoint 450 psig will pass flow greater than that required for the mass addition transient of one charging pump injecting into the RCS while maintaining Cook Nuclear Plant Unit 2 B 3.4.12-5 Revision No. 0
| |
| | |
| LTOP System B 3.4.12 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| RCS pressure less than the P/T limit curve. Assuming all relief flow requirements during the mass addition event, the RHR suction relief valve will maintain RCS pressure to within the Appendix G limit curves and 110% of the RHR System design pressure (660 psig). When all RCS cold leg temperatures are 140°F and two charging pumps are capable of injecting into the RCS, the RHR suction relief valve and one PORV, in combination, will maintain RCS pressure less than the P/T limit curve.
| |
| As the RCS P/T limits are decreased to reflect the loss of toughness in the reactor vessel materials due to neutron embrittlement, the RHR suction relief valve must be analyzed to still accommodate the design basis transients for LTOP.
| |
| RCS Vent Performance With the RCS depressurized, analyses show a vent size of 2.0 square inches or a single blocked open PORV is capable of mitigating the allowed LTOP overpressure transient. The capacity of a vent this size is greater than the flow of the mass addition transient for the LTOP configuration of one charging pump OPERABLE, maintaining RCS pressure less than the maximum pressure on the P/T limit curve.
| |
| The RCS vent size will be re-evaluated for compliance each time the P/T limit curves are revised based on the results of the vessel material surveillance.
| |
| The RCS vent is passive and is not subject to active failure.
| |
| The LTOP System satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO This LCO requires that the LTOP System is OPERABLE. The LTOP System is OPERABLE when the minimum coolant input and pressure relief capabilities are OPERABLE. Violation of this LCO could lead to the loss of low temperature overpressure mitigation and violation of the Reference 1 limits as a result of an operational transient.
| |
| To limit the coolant input capability, the LCO provides two options. The first option requires that no SI pumps and a maximum of one charging pump be capable of injecting into the RCS, and all accumulators isolated (i.e., the discharge isolation valves closed and deactivated).
| |
| The first option, however, allows two charging pumps to be made capable of injecting into the RCS for 1 hour during pump swap operations. One hour provides sufficient time to safely complete the actual transfer and to Cook Nuclear Plant Unit 2 B 3.4.12-6 Revision No. 0
| |
| | |
| LTOP System B 3.4.12 BASES LCO (continued) complete the administrative controls and Surveillance Requirements associated with the swap. The intent is to minimize the actual time that more than one charging pump is physically capable of injection. In addition, an accumulator may be unisolated when the accumulator is depressurized and vented. This permits the accumulator discharge isolation valve Surveillance to be performed only under these pressure and temperature conditions.
| |
| Furthermore, the first LCO option requires one of the three pressure relief capabilities:
| |
| : a. Two OPERABLE PORVs; A PORV is OPERABLE for LTOP when its block valve is open, its lift setpoint is set to the specified limit required by the LCO and testing proves its ability to open at this setpoint, and motive power is available to the two valves and their control circuits. Motive power for the PORVs is through the use of air. Normally this air is supplied by the plant control air source. To assure OPERABILITY of the PORVs in the event of a loss of control air, a backup air supply is provided.
| |
| The backup air supply consists of compressed air bottles (the emergency air tank bank), piping, and valves. The backup air supply contains enough air to support PORV operation for 10 minutes with no operator action upon a loss of control air. Only two of the three PORVs have a backup air supply, therefore they are the only PORVs that can be used to meet the LCO requirements.
| |
| : b. One OPERABLE PORV and one OPERABLE RHR suction relief valve; or An RHR suction relief valve is OPERABLE for LTOP when its RHR suction isolation valves are open, its setpoint is 450 psig, and testing has proven its ability to open at this setpoint.
| |
| : c. A depressurized RCS and an RCS vent.
| |
| An RCS vent is OPERABLE when open with an area of 2.0 square inches or a single blocked open PORV.
| |
| Each of these methods of overpressure prevention is capable of mitigating the limiting LTOP transient.
| |
| Consistent with the first option, the second option requires that no SI pumps be capable of injecting into the RCS and that the accumulators are isolated, except an accumulator may be unisolated when it is Cook Nuclear Plant Unit 2 B 3.4.12-7 Revision No. 0
| |
| | |
| LTOP System B 3.4.12 BASES LCO (continued) depressurized and vented. However, the second option allows both charging pumps to be capable of injecting into the RCS, provided all RCS cold leg temperatures are 140°F and all three of the relief valves (two PORVs and one RHR suction relief valve) described in the first option are OPERABLE.
| |
| Both LCO options are modified by a Note that places restrictions on RCP startups. This is necessary to ensure the limiting heat input transient is maintained within the analyses assumptions. Therefore, the Note states that reactor coolant pumps shall not be started with one or more RCS cold leg temperatures 152°F unless the pressurizer water level is < 62%
| |
| or the secondary water temperature of each steam generator is < 50°F above each of the RCS cold leg temperatures.
| |
| APPLICABILITY This LCO is applicable in MODE 4 when any RCS cold leg temperature is 299°F, in MODE 5, and in MODE 6 when the reactor vessel head is on.
| |
| The pressurizer safety valves provide overpressure protection that meets the Reference 1 P/T limits with all RCS cold leg temperatures > 299°F.
| |
| When the reactor vessel head is off, overpressurization cannot occur.
| |
| LCO 3.4.3 provides the operational P/T limits for all MODES.
| |
| LCO 3.4.10, "Pressurizer Safety Valves," requires the OPERABILITY of the pressurizer safety valves that provide overpressure protection during MODES 1, 2, and 3, and MODE 4 with all RCS cold leg temperatures
| |
| > 299°F.
| |
| Low temperature overpressure prevention is most critical during shutdown when the RCS is water solid, and a mass or heat input transient can cause a very rapid increase in RCS pressure resulting in little or no time available to allow operator action to mitigate the event.
| |
| ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable LTOP system when entering MODE 4. There is an increased risk associated with entering MODE 4 from MODE 5 with LTOP inoperable and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.
| |
| A.1 and B.1 With one or more SI pumps capable of injecting into the RCS, RCS overpressurization is possible. In addition, when only one charging pump is allowed to be capable of injecting into the RCS and both charging pumps are actually capable, RCS overpressurization is possible.
| |
| Cook Nuclear Plant Unit 2 B 3.4.12-8 Revision No. 0
| |
| | |
| LTOP System B 3.4.12 BASES ACTIONS (continued)
| |
| To immediately initiate action to restore restricted coolant input capability to the RCS reflects the urgency of removing the RCS from this condition.
| |
| C.1, D.1, and D.2 An unisolated accumulator requires isolation within 1 hour. This is only required when the accumulator is not depressurized and vented.
| |
| If isolation is needed and cannot be accomplished in 1 hour, Required Action D.1 and Required Action D.2 provide two options, either of which must be performed in the next 12 hours. By increasing the RCS temperature to > 299°F, an accumulator pressure of 658 psig cannot exceed the LTOP limits if the accumulators are fully injected.
| |
| Depressurizing and venting the affected accumulators also gives this protection.
| |
| The Completion Times are based on operating experience that these activities can be accomplished in these time periods and on engineering evaluations indicating that an event requiring LTOP is not likely in the allowed times.
| |
| E.1 In MODE 4 when any RCS cold leg temperature is 299°F, with one required RCS relief valve inoperable, the RCS relief valve must be restored to OPERABLE status within a Completion Time of 7 days. Two or three RCS relief valves (depending upon the condition of the charging pumps) in any combination of the PORVs and the RHR suction relief valve are required to provide low temperature overpressure mitigation while withstanding a single failure of an active component.
| |
| The Completion Time considers the facts that only one or two of the RCS relief valves (depending upon the condition of the charging pumps) are required to mitigate an overpressure transient and that the likelihood of a single active failure of the remaining valve path(s) during this time period is very low.
| |
| F.1 The consequences of operational events that will overpressurize the RCS are more severe at lower temperature (Ref. 7). Thus, with one of the two RCS relief valves inoperable in MODE 5 or in MODE 6 with the head on, the Completion Time to restore the required valve to OPERABLE status is 24 hours.
| |
| Cook Nuclear Plant Unit 2 B 3.4.12-9 Revision No. 0
| |
| | |
| LTOP System B 3.4.12 BASES ACTIONS (continued)
| |
| The Completion Time represents a reasonable time to investigate and repair several types of relief valve failures without exposure to a lengthy period with only the minimum OPERABLE RCS relief valve(s) required to protect against overpressure events.
| |
| G.1 The RCS must be depressurized and a vent must be established within 12 hours when:
| |
| : a. Two or more required RCS relief valves are inoperable;
| |
| : b. A Required Action and associated Completion Time of Condition A, B, D, E, or F is not met; or
| |
| : c. The LTOP System is inoperable for any reason other than Condition A, B, C, D, E, or F (e.g., when an RCP is started without meeting the requirements of the Note to LCO 3.4.12).
| |
| The vent must be sized 2.0 square inches or the vent must be a blocked open PORV to ensure that the flow capacity is greater than that required for the worst case mass input transient reasonable during the applicable MODES. This action is needed to protect the RCPB from a low temperature overpressure event and a possible brittle failure of the reactor vessel.
| |
| The Completion Time considers the time required to place the unit in this Condition and the relatively low probability of an overpressure event during this time period due to increased operator awareness of administrative control requirements.
| |
| SURVEILLANCE SR 3.4.12.1, SR 3.4.12.2, and SR 3.4.12.3 REQUIREMENTS To minimize the potential for a low temperature overpressure event by limiting the mass input capability, no SI pumps and a maximum of one or two charging pumps (depending upon whether the LCO Option A or B is being used) are verified capable of injecting into the RCS and the accumulator discharge isolation valves are verified closed and deactivated. The SI pump(s) and charging pump are rendered incapable of injecting into the RCS through removing the power from the pumps by racking the breakers out under administrative control. An alternate method of LTOP control may be employed using at least two independent means to prevent RCS injection such that a single failure or single action will not result in an injection into the RCS. This may be accomplished Cook Nuclear Plant Unit 2 B 3.4.12-10 Revision No. 0
| |
| | |
| LTOP System B 3.4.12 BASES SURVEILLANCE REQUIREMENTS (continued) through the pump control switch being placed in pull to lock and at least one valve in the discharge flow path being closed, or at least one valve in the discharge flow path being closed and sealed or locked.
| |
| In addition, SR 3.4.12.3 is modified by a Note that allows the accumulator discharge isolation valve position to be verified by administrative means.
| |
| This is acceptable since the valve position was verified prior to deactivating the valve, access to the containment is restricted, and valves are only operated under strict procedural control.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.4.12.4 The required RHR suction relief valve shall be demonstrated OPERABLE by verifying the RHR suction isolation valves are open. This Surveillance is only required to be performed if the RHR suction relief valve is being used to meet this LCO.
| |
| The RHR suction isolation valves are verified to be opened. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.4.12.5 The RCS vent of 2.0 square inches or a blocked open PORV is proven OPERABLE by verifying its open condition. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| The passive vent path arrangement must only be open if the vent is being used to satisfy the pressure relief requirements of LCO 3.4.12.A.2.c.
| |
| Cook Nuclear Plant Unit 2 B 3.4.12-11 Revision No. 60
| |
| | |
| LTOP System B 3.4.12 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.4.12.6 The PORV block valve must be verified open to provide the flow path for each required PORV to perform its function when actuated. The valve must be remotely verified open in the main control room. This Surveillance is performed if one or more PORVs satisfy the LCO.
| |
| The block valve is a remotely controlled, motor operated valve. The power to the valve operator is not required removed, and the manual operator is not required locked in the inactive position. Thus, the block valve can be closed in the event the PORV develops excessive leakage or does not close (sticks open) after relieving an overpressure situation.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.4.12.7 Verification that each required emergency air tank banks pressure is 900 psig assures adequate air pressure for reliable PORV operation.
| |
| With the emergency air supply at 900 psig, there will be enough air to support PORV operation for 10 minutes with no operator action upon a loss of control air. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.4.12.8 Performance of a COT is required on each required PORV to verify and, as necessary, adjust its lift setpoint. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable COT of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. The COT will verify the setpoint is within the LCO limit. PORV actuation could depressurize the RCS and is not required.
| |
| Cook Nuclear Plant Unit 2 B 3.4.12-12 Revision No. 60
| |
| | |
| LTOP System B 3.4.12 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| A Note has been added indicating that this SR is not required to be performed until 12 hours after decreasing RCS cold leg temperature to 299°F. The COT cannot be performed until in the LTOP MODES when the PORV lift setpoint can be reduced to the LTOP setting. The test must be performed within 12 hours after entering the LTOP MODES. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.4.12.9 Performance of a CHANNEL CALIBRATION on each required PORV actuation channel is required to adjust the whole channel so that it responds and the valve opens within the required range and accuracy to known input. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. 10 CFR 50, Appendix G.
| |
| : 2. Generic Letter 88-11.
| |
| : 3. ASME, Boiler and Pressure Vessel Code, Section III.
| |
| : 4. WCAP-13235, "Donald C. Cook Units 1 & 2, Analysis of Low Temperature Overpressurization Mass Injection Events with Pressurizer Steam Bubble and RHR Relief Valve, March 1992; "WCAP-12483 Revision 1, "Analysis of Capsule U From the American Electric Power Company D. C. Cook Unit 1 Reactor Vessel Radiation Surveillance Program, December 2002;" and WCAP-13515, Revision 1, "Analysis of Capsule U From Indiana Michigan Power Company D. C. Cook Unit 2 Reactor Vessel Radiation Surveillance Program, May 2002."
| |
| : 5. 10 CFR 50, Section 50.46.
| |
| : 6. 10 CFR 50, Appendix K.
| |
| : 7. Generic Letter 90-06.
| |
| Cook Nuclear Plant Unit 2 B 3.4.12-13 Revision No. 60
| |
| | |
| RCS Operational LEAKAGE B 3.4.13 B 3.4 REACTOR COOLANT SYSTEM (RCS)
| |
| B 3.4.13 RCS Operational LEAKAGE BASES BACKGROUND Components that contain or transport the coolant to or from the reactor core make up the RCS. Component joints are made by welding, bolting, rolling, or pressure loading, and valves isolate connecting systems from the RCS.
| |
| During unit life, the joint and valve interfaces can produce varying amounts of reactor coolant LEAKAGE, through either normal operational wear or mechanical deterioration. The purpose of the RCS Operational LEAKAGE LCO is to limit system operation in the presence of LEAKAGE from these sources to amounts that do not compromise safety. This LCO specifies the types and amounts of LEAKAGE.
| |
| Plant Specific Design Criterion 16 (Ref. 1), requires means for detecting and, to the extent practical, identifying the source of reactor coolant LEAKAGE. Regulatory Guide 1.45 (Ref. 2) describes acceptable methods for selecting leakage detection systems.
| |
| The safety significance of RCS LEAKAGE varies widely depending on its source, rate, and duration. Therefore, detecting and monitoring reactor coolant LEAKAGE into the containment area is necessary. Quickly separating the identified LEAKAGE from the unidentified LEAKAGE is necessary to provide quantitative information to the operators, allowing them to take corrective action should a leak occur that is detrimental to the safety of the facility and the public.
| |
| A limited amount of leakage inside containment is expected from auxiliary systems that cannot be made 100% leaktight. Leakage from these systems should be detected, located, and isolated from the containment atmosphere, if possible, to not interfere with RCS leakage detection.
| |
| This LCO deals with protection of the reactor coolant pressure boundary (RCPB) from degradation and the core from inadequate cooling, in addition to preventing the accident analyses radiation release assumptions from being exceeded. The consequences of violating this LCO include the possibility of a loss of coolant accident (LOCA).
| |
| APPLICABLE Except for primary to secondary LEAKAGE, the safety analyses do not SAFETY address operational LEAKAGE. However, other operational LEAKAGE ANALYSES is related to the safety analyses for LOCA; the amount of leakage can affect the probability of such an event. The safety analysis for an event resulting in steam discharge to the atmosphere assumes that primary to secondary LEAKAGE from an individual SG is 0.25 gpm (1.0 gpm for all SGs) as a result of accident induced conditions. The LCO requirement Cook Nuclear Plant Unit 2 B 3.4.13-1 Revision No. 59
| |
| | |
| RCS Operational LEAKAGE B 3.4.13 BASES APPLICABLE SAFETY ANALYSES (continued) to limit primary to secondary LEAKAGE through any one SG to less than or equal to 150 gallons per day is significantly less than the conditions assumed in the safety analysis.
| |
| Primary to secondary LEAKAGE is a factor in the dose releases outside containment resulting from a steam line break (SLB) accident. To a lesser extent, primary to secondary LEAKAGE is a factor in the dose releases outside containment in other accidents or transients involving secondary steam release to the atmosphere, such as a steam generator tube rupture (SGTR). The leakage contaminates the secondary fluid.
| |
| The UFSAR (Ref. 3) analysis for SGTR assumes the contaminated secondary fluid is released via the steam generator power operated relief valves (and safety valves if their setpoint is reached) if offsite power is not available or if the condenser steam dump system fails to operate. The safety analysis for the SLB accident assumes 0.25 gpm per SG (1.0 gpm for all SGs) primary to secondary LEAKAGE as an initial condition. The dose consequences resulting from events resulting in a steam discharge to the atmosphere are within the limits defined in 10 CFR 50.67.
| |
| The RCS Operational LEAKAGE satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO RCS operational LEAKAGE shall be limited to:
| |
| : a. Pressure Boundary LEAKAGE No pressure boundary LEAKAGE is allowed, being indicative of material deterioration. LEAKAGE of this type is unacceptable as the leak itself could cause further deterioration, resulting in higher LEAKAGE. Violation of this LCO could result in continued degradation of the RCPB. LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE.
| |
| : b. Unidentified LEAKAGE The 0.8 gallon per minute (gpm) of unidentified LEAKAGE is allowed as a reasonable minimum detectable amount that the containment air particulate monitoring equipment can detect within a reasonable time period. The limit of 0.8 gpm is necessary to satisfy the requirements for the application of Leak-Before-Break methodology as documented in References 6 and 8, and approved by the NRC as documented in References 7 and 9. Violation of this LCO could result in continued degradation of the RCPB, if the LEAKAGE is from the pressure boundary.
| |
| Cook Nuclear Plant Unit 2 B 3.4.13-2 Revision No. 77
| |
| | |
| RCS Operational LEAKAGE B 3.4.13 BASES LCO (continued)
| |
| : c. Identified LEAKAGE Up to 10 gpm of identified LEAKAGE is considered allowable because LEAKAGE is from known sources that do not interfere with detection of unidentified LEAKAGE and is well within the capability of the RCS Makeup System. Identified LEAKAGE includes LEAKAGE to the containment from specifically known and located sources, but does not include pressure boundary LEAKAGE or controlled reactor coolant pump (RCP) seal leakoff (a normal function not considered LEAKAGE). Violation of this LCO could result in continued degradation of a component or system.
| |
| : d. Primary to Secondary LEAKAGE Through Any One SG The limit of 150 gallons per day per SG is based on the operational LEAKAGE performance criterion in NEI 97-06, Steam Generator Program Guidelines (Ref. 4). The Steam Generator Program operational LEAKAGE performance criterion in NEI 97-06 states, The RCS operational primary to secondary leakage through any one SG shall be limited to 150 gallons per day. The limit is based on operating experience with SG tube degradation mechanisms that result in tube leakage. The operational leakage rate criterion in conjunction with the implementation of the Steam Generator Program is an effective measure for minimizing the frequency of steam generator tube ruptures.
| |
| APPLICABILITY In MODES 1, 2, 3, and 4, the potential for RCPB LEAKAGE is greatest when the RCS is pressurized.
| |
| In MODES 5 and 6, LEAKAGE limits are not required because the reactor coolant pressure is far lower, resulting in lower stresses and reduced potentials for LEAKAGE.
| |
| LCO 3.4.14, "RCS Pressure Isolation Valve (PIV) Leakage," measures leakage through each individual PIV and can impact this LCO. Of the two PIVs in series in each isolated line, leakage measured through one PIV does not result in RCS LEAKAGE when the other is leak tight. If both valves leak and result in a loss of mass from the RCS, the loss must be included in the allowable identified LEAKAGE.
| |
| Cook Nuclear Plant Unit 2 B 3.4.13-3 Revision No. 12
| |
| | |
| RCS Operational LEAKAGE B 3.4.13 BASES ACTIONS A.1 Unidentified LEAKAGE or identified LEAKAGE in excess of the LCO limits must be reduced to within limits within 4 hours. This Completion Time allows time to verify leakage rates and either identify unidentified LEAKAGE or reduce LEAKAGE to within limits before the reactor must be shut down. This action is necessary to prevent further deterioration of the RCPB.
| |
| B.1 and B.2 If any Required Action and associated Completion Time of Condition A is not met, if any pressure boundary LEAKAGE exists, or if primary to secondary LEAKAGE is not within limit, the reactor must be brought to lower pressure conditions to reduce the severity of the LEAKAGE and its potential consequences. It should be noted that LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE. The reactor must be brought to MODE 3 within 6 hours and MODE 5 within 36 hours. This action reduces the LEAKAGE and also reduces the factors that tend to degrade the pressure boundary.
| |
| The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 5, the pressure stresses acting on the RCPB are much lower, and further deterioration is much less likely.
| |
| SURVEILLANCE SR 3.4.13.1 REQUIREMENTS Verifying RCS LEAKAGE to be within the LCO limits ensures the integrity of the RCPB is maintained. Pressure boundary LEAKAGE would at first appear as unidentified LEAKAGE and can only be positively identified by inspection. It should be noted that LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE. Unidentified LEAKAGE and identified LEAKAGE are determined by performance of an RCS water inventory balance.
| |
| The RCS water inventory balance must be performed with the reactor at steady state operating conditions. The Surveillance is modified by two Notes. Note 1 states that this SR is not required to be performed until 12 hours after establishing steady state operation. The 12 hour allowance provides sufficient time to collect and process all necessary data after stable unit conditions are established.
| |
| Steady state operation is required to perform a proper inventory balance since calculations during maneuvering are not useful. For RCS Cook Nuclear Plant Unit 2 B 3.4.13-4 Revision No. 15
| |
| | |
| RCS Operational LEAKAGE B 3.4.13 BASES SURVEILLANCE REQUIREMENTS (continued) operational LEAKAGE determination by water inventory balance, steady state is defined as stable RCS pressure, temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection and return flows.
| |
| An early warning of pressure boundary LEAKAGE or unidentified LEAKAGE is provided by the automatic systems that monitor the containment atmosphere radioactivity and the containment sump level. It should be noted that LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE. These leakage detection systems are specified in LCO 3.4.15, "RCS Leakage Detection Instrumentation."
| |
| Note 2 states that this SR is not applicable to primary to secondary LEAKAGE because LEAKAGE of 150 gallons per day cannot be measured accurately by an RCS water inventory balance.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.4.13.2 This SR verifies that primary to secondary LEAKAGE is less than or equal to 150 gallons per day through any one SG. Satisfying the primary to secondary LEAKAGE limit ensures that the operational LEAKAGE performance criterion in the Steam Generator Program is met. If this SR is not met, compliance with LCO 3.4.17, Steam Generator Tube Integrity, should be evaluated. The primary to secondary LEAKAGE is measured at room temperature as described in Reference 5. Prior to comparison with the 150 gallons per day TS limit, the measured primary to secondary LEAKAGE is multiplied by a volume correction factor of 1.52. The correction factor ensures the offsite dose analyses, which assume primary to secondary leakage is at normal operating temperature and pressure, remain bounding. The operational LEAKAGE rate limit applies to LEAKAGE through any one SG. If it is not practical to assign the LEAKAGE to an individual SG, all of the primary to secondary LEAKAGE should be conservatively assumed to be from one SG.
| |
| The Surveillance is modified by a Note which states that the Surveillance is not required to be performed until 12 hours after establishment of steady state operation. For RCS primary to secondary LEAKAGE determination, steady state is defined as stable RCS pressure, temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection and return flows.
| |
| Cook Nuclear Plant Unit 2 B 3.4.13-5 Revision No. 60
| |
| | |
| RCS Operational LEAKAGE B 3.4.13 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The primary to secondary LEAKAGE is determined using continuous process radiation monitors or radiochemical grab sampling in accordance with the EPRI guidelines (Ref. 5).
| |
| REFERENCES 1. UFSAR, Section 1.4.3.
| |
| : 2. Regulatory Guide 1.45, May 1973.
| |
| : 3. UFSAR, Section 14.2.4.
| |
| : 4. NEI 97-06, Steam Generator Program Guidelines.
| |
| : 5. EPRI, Pressurized Water Reactor Primary-to-Secondary Leak Guidelines.
| |
| : 6. Letter from Q. S Lies, Indiana Michigan Power Company, to the Nuclear Regulatory Commission, Request for License Amendment to Technical Specification 3.4.15, RCS Leakage Detection Instrumentation, and Application of Leak-Before-Break Methodology, dated November 20, 2018 (ML18334A267).
| |
| : 7. Letter from R. Kuntz, Nuclear Regulatory Commission, to J. P.
| |
| Gebbie, Indiana Michigan Power Company, Donald C. Cook Nuclear Plant, Unit Nos. 1 and 2 - Issuance of Amendment Nos. 349 and 330 to Apply Leak-Before-Break Methodology to Reactor Coolant System Branch Lines and Deletion of Containment Humidity Monitor Requirement, dated January 23, 2020 (ML19329A011).
| |
| : 8. Letter from M. W. Rencheck, Indiana Michigan Power Company, to the Nuclear Regulatory Commission, Donald C. Cook Nuclear Plant Units 1 and 2, Additional Information Supporting Implementation of Leak Before Break Methodology for the Pressurizer Surge Line, dated October 26, 2000 (ML003764628).
| |
| : 9. Letter from John F. Stang, Nuclear Regulatory Commission, to Robert P. Powers, Indiana Michigan Power Company, Donald C.
| |
| Cook Nuclear Plant, Units 1 and 2 - Review of Leak-Before-Break for the Pressurizer Surge Line Piping as Provided by 10 CFR Part 50, Appendix A, GDC 4, dated November 8, 2000 (ML003767675).
| |
| Cook Nuclear Plant Unit 2 B 3.4.13-6 Revision No. 77
| |
| | |
| RCS PIV Leakage B 3.4.14 B 3.4 REACTOR COOLANT SYSTEM (RCS)
| |
| B 3.4.14 RCS Pressure Isolation Valve (PIV) Leakage BASES BACKGROUND 10 CFR 50.2 and 10 CFR 50.55a(c) (Refs. 1 and 2) define RCS PIVs as any two normally closed valves in series within the reactor coolant pressure boundary (RCPB), which separate the high pressure RCS from an attached low pressure system. The 1975 Reactor Safety Study, WASH-1400, (Ref. 3) identified intersystem loss of coolant accidents (LOCAs) as a significant contributor to the risk of core melt. The study considered designs containing two in-series check valves and two check valves in series with a motor operated valve that isolated the high pressure RCS from the low pressure safety injection system. The scenario considered is a failure of the two check valves leading to overpressurization and rupture of the low pressure injection piping which results in a LOCA that bypasses containment. A letter was issued (Ref. 4) by the NRC requiring plants to describe the PIV configuration of the plant. On April 20, 1981, the NRC issued an Order modifying the Cook Nuclear Plant Unit 1 and Unit 2 Technical Specifications to include testing requirements on PIVs and to specify the PIVs to be tested (Ref. 5).
| |
| During their lives, these valves can produce varying amounts of reactor coolant leakage through either normal operational wear or mechanical deterioration. The RCS PIV Leakage LCO allows RCS high pressure operation when leakage through these valves exists in amounts that do not compromise safety.
| |
| The PIV leakage limit applies to each individual valve. Leakage through both series PIVs in a line must be included as part of the identified LEAKAGE, governed by LCO 3.4.13, "RCS Operational LEAKAGE." This is true during operation only when the loss of RCS mass through two series valves is determined by a water inventory balance (SR 3.4.13.1).
| |
| A known component of the identified LEAKAGE before operation begins is the least of the two individual leak rates determined for leaking series PIVs during the required surveillance testing; leakage measured through one PIV in a line is not RCS operational LEAKAGE if the other is leaktight.
| |
| Although this specification provides a limit on allowable PIV leakage rate, its main purpose is to prevent overpressure failure of the low pressure portions of connecting systems. The leakage limit is an indication that the PIVs between the RCS and the connecting systems are degraded or degrading. PIV leakage could lead to overpressure of the low pressure piping or components. Failure consequences could be a loss of coolant accident (LOCA) outside of containment, an unanalyzed accident, that could degrade the ability for low pressure injection.
| |
| Cook Nuclear Plant Unit 2 B 3.4.14-1 Revision No. 0
| |
| | |
| RCS PIV Leakage B 3.4.14 BASES BACKGROUND (continued)
| |
| PIVs required by the LCO are provided to isolate the RCS from the Residual Heat Removal (RHR) System.
| |
| The PIVs required by this LCO are listed in the Technical Requirements Manual (Ref. 6).
| |
| Violation of the PIV leakage limit could result in continued degradation of a PIV, which could lead to overpressurization of a low pressure system and the loss of the integrity of a fission product barrier.
| |
| Two motor operated valves are included in series in the suction piping of the RHR System to isolate the high pressure RCS from the low pressure piping of the RHR System when the RCS pressure is above the design pressure of the RHR System piping and components. Ensuring the RHR interlock that prevents the valves from being opened is OPERABLE ensures that RCS pressure will not pressurize the RHR System beyond its design pressure of 600 psig.
| |
| APPLICABLE Reference 3 identified potential intersystem LOCAs as a significant SAFETY contributor to the risk of core melt. The dominant accident sequence in ANALYSES the intersystem LOCA category is the failure of the low pressure portion of the RHR System outside of containment. The accident is the result of a postulated failure of the PIVs, which are part of the RCPB, and the subsequent pressurization of the RHR System downstream of the PIVs from the RCS. Because the low pressure portion of the RHR System is typically designed for 600 psig, overpressurization failure of the RHR low pressure line would result in a LOCA outside containment and subsequent risk of core melt.
| |
| RCS PIV Leakage satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO RCS PIV leakage is identified LEAKAGE into closed systems connected to the RCS. The PIVs required by this LCO are listed in the Technical Requirements Manual (Ref. 6). Isolation valve leakage is usually on the order of drops per minute. Leakage that increases significantly suggests that something is operationally wrong and corrective action must be taken.
| |
| The LCO PIV leakage limit is 0.5 gpm per nominal inch of valve size with a maximum limit of 5 gpm at an RCS pressure 2215 psig and 2255 psig. This criteria is based on a study by the Idaho National Engineering Laboratory (Ref. 7).
| |
| Reference 8 permits leakage testing at a lower pressure differential than between the specified maximum RCS pressure and the normal pressure Cook Nuclear Plant Unit 2 B 3.4.14-2 Revision No. 0
| |
| | |
| RCS PIV Leakage B 3.4.14 BASES LCO (continued) of the connected system during RCS operation (the maximum pressure differential) in those types of valves in which the higher service pressure will tend to diminish the overall leakage channel opening. In such cases, the observed rate may be adjusted to the maximum pressure differential by assuming leakage is directly proportional to the pressure differential to the one half power. However, in all cases, the minimum test differential pressure shall be 150 psid.
| |
| Ensuring the RHR interlock that prevents the valves from being opened is OPERABLE ensures that RCS pressure will not pressurize the RHR System beyond its design pressure of 600 psig.
| |
| APPLICABILITY In MODES 1, 2, 3, and 4, this LCO applies because the PIV leakage potential is greatest when the RCS is pressurized. In MODE 4, valves in the RHR flow path are not required to meet the requirements of this LCO when in, or during the transition to or from, the RHR mode of operation.
| |
| In MODES 5 and 6, leakage limits are not provided because the lower reactor coolant pressure results in a reduced potential for leakage and for a LOCA outside the containment.
| |
| ACTIONS The Actions are modified by two Notes. Note 1 provides clarification that each flow path allows separate entry into a Condition. This is allowed based upon the functional independence of the flow path. Note 2 requires an evaluation of affected systems if a PIV is inoperable. The leakage may have affected system operability, or isolation of a leaking flow path with an alternate valve may have degraded the ability of the interconnected system to perform its safety function.
| |
| A.1 and A.2 If leakage from one or more RCS PIVs is not within limit, the flow path must be isolated by two valves. Required Actions A.1 and A.2 are modified by a Note that the valves used for isolation must meet the same leakage requirements as the PIVs and must be within the RCPB or the high pressure portion of the system.
| |
| Required Action A.1 requires that the isolation with one valve must be performed within 24 hours. Twenty four hours provides time to reduce leakage in excess of the allowable limit and to isolate the affected system if leakage cannot be reduced. The 24 hour Completion Time allows the actions and restricts the operation with leaking isolation valves.
| |
| Required Action A.2 specifies that the double isolation barrier of two valves be restored by closing some other valve qualified for isolation.
| |
| Cook Nuclear Plant Unit 2 B 3.4.14-3 Revision No. 0
| |
| | |
| RCS PIV Leakage B 3.4.14 BASES ACTIONS (continued)
| |
| The 72 hour Completion Time after exceeding the limit considers the time required to complete the Required Action and the low probability of a second valve failing during this time period.
| |
| B.1 and B.2 If any Required Action and associated Completion Time of Condition A is not met, the unit must be brought to a MODE in which the requirement does not apply. To achieve this status, the unit must be brought to MODE 3 within 6 hours and MODE 5 within 36 hours. This Action may reduce the leakage and also reduces the potential for a LOCA outside the containment. The allowed Completion Times are reasonable based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| C.1 The inoperability of the RHR interlock renders the RHR suction isolation valves incapable of preventing inadvertent opening of the valves at RCS pressures in excess of the RHR systems design pressure. If the RHR interlock is inoperable, operation may continue as long as the affected RHR suction penetration is closed by at least one closed manual or deactivated power operated valve within 4 hours. This Required Action accomplishes the purpose of the function.
| |
| SURVEILLANCE SR 3.4.14.1 REQUIREMENTS Performance of leakage testing on each RCS PIV is required to verify that leakage is below the specified limit and to identify each leaking valve.
| |
| The leakage limit of 0.5 gpm per inch of nominal valve diameter up to 5 gpm maximum applies to each valve. Leakage testing requires a stable pressure condition.
| |
| For the two PIVs in series, the leakage requirement applies to each valve individually and not to the combined leakage across both valves. If the PIVs are not individually leakage tested, one valve may have failed completely and not be detected if the other valve in series meets the leakage requirement. In this situation, the protection provided by redundant valves would be lost.
| |
| The Frequency required by the INSERVICE TESTING PROGRAM is within frequency allowed by the American Society of Mechanical Engineers (ASME) OM Code (Ref. 9), and is based on the need to perform such Surveillances under the conditions that apply during an outage and the potential for an unplanned transient if the Surveillance Cook Nuclear Plant Unit 2 B 3.4.14-4 Revision No. 61
| |
| | |
| RCS PIV Leakage B 3.4.14 BASES SURVEILLANCE REQUIREMENTS (continued) were performed with the reactor at power.
| |
| The leakage limit is to be met at the RCS pressure associated with MODES 1 and 2. This permits leakage testing at high differential pressures with stable conditions not possible in the MODES with lower pressures. Therefore, this SR is modified by a Note that states the Surveillance is only required to be performed in MODES 1 and 2. Entry into MODES 3 and 4 is allowed to establish the necessary differential pressures and stable conditions to allow for performance of this Surveillance.
| |
| SR 3.4.14.2 Verifying that the RHR interlock that prevents the valves from being opened is OPERABLE ensures that RCS pressure will not pressurize the RHR System beyond its design pressure of 600 psig. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. 10 CFR 50.2.
| |
| : 2. 10 CFR 50.55a(c).
| |
| : 3. WASH-1400 (NUREG-75/014), Appendix V, October 1975.
| |
| : 4. Letter from D.G. Eisenhut, NRC, to all LWR licensees, LWR Primary Coolant System Pressure Isolation Valves, February 23, 1980.
| |
| : 5. Letter from S.A. Varga, NRC, to J. Dolan, Order for Modification of Licenses Concerning Primary Coolant System Pressure Isolation Valves, April 20, 1981.
| |
| : 6. Technical Requirements Manual.
| |
| : 7. EGG-NTAP-6175, Inservice Testing of Primary Pressure Isolation Valves, Idaho National Engineering Laboratory, February 1983.
| |
| : 8. NRC Safety Evaluation for License Amendment 174.
| |
| : 9. ASME, Operation and Maintenance Standards and Guides (OM Codes).
| |
| Cook Nuclear Plant Unit 2 B 3.4.14-5 Revision No. 61
| |
| | |
| RCS Leakage Detection Instrumentation B 3.4.15 B 3.4 REACTOR COOLANT SYSTEM (RCS)
| |
| B 3.4.15 RCS Leakage Detection Instrumentation BASES BACKGROUND Plant Specific Design Criterion 16 (Ref. 1) requires means for detecting and, to the extent practical, identifying the location of the source of RCS LEAKAGE. Regulatory Guide (RG) 1.45, Revision 0, (Ref. 2) describes acceptable methods for selecting leakage detection systems. While Cook Nuclear Plant (CNP) is not committed to RG 1.45, the requirements of RG 1.45 were followed to the extent practical. This was documented in D.C. Cook's response to Generic Letter 84-04 (Ref. 3), and accepted by the NRC as documented in the associated Safety Evaluation Report (Ref. 4).
| |
| Leakage detection systems must have the capability to detect significant reactor coolant pressure boundary (RCPB) degradation as soon after occurrence as practical to minimize the potential for propagation to a gross failure. Thus, an early indication or warning signal is necessary to permit proper evaluation of all unidentified LEAKAGE. In addition to meeting the OPERABILITY requirements, the monitors are typically set to provide the most sensitive response without causing an excessive number of spurious alarms.
| |
| The containment sump used to collect unidentified LEAKAGE is instrumented to detect increases above the normal flow rates.
| |
| The reactor coolant contains radioactivity that, when released to the containment, may be detected by radiation monitoring instrumentation.
| |
| Radioactivity detection systems are included for monitoring both particulate and gaseous activities because of their sensitivities and rapid responses to RCS LEAKAGE.
| |
| Air temperature and pressure monitoring methods may also be used to infer unidentified LEAKAGE to the containment. Containment temperature and pressure fluctuate slightly during unit operation, but a rise above the normally indicated range of values may indicate RCS leakage into the containment. The relevance of temperature and pressure measurements is affected by containment free volume and, for temperature, detector location. Alarm signals from these instruments can be valuable in recognizing rapid and sizable leakage to the containment.
| |
| Temperature and pressure monitors are not required by this LCO.
| |
| The above-mentioned LEAKAGE detection methods or systems differ in sensitivity and response time. Some of these systems could serve as early alarm systems signaling the operators that closer examination of other detection systems is necessary to determine the extent of any corrective action that may be required.
| |
| Cook Nuclear Plant Unit 2 B 3.4.15-1 Revision No. 75
| |
| | |
| RCS Leakage Detection Instrumentation B 3.4.15 APPLICABLE The need to evaluate the severity of an alarm or an indication is important SAFETY to the operators, and the ability to compare and verify with indications ANALYSES from other systems is necessary.
| |
| The safety significance of RCS LEAKAGE varies widely depending on its source, rate, and duration. Therefore, detecting and monitoring RCS LEAKAGE into the containment area is necessary. Quickly separating the identified LEAKAGE from the unidentified LEAKAGE provides quantitative information to the operators, allowing them to take corrective action should a leakage occur detrimental to the safety of the unit and the public. In addition, a specific leak before break analysis was performed for the pressurizer surge line (Ref. 6), and for the small diameter piping connected to the RCS (Ref. 7, 8 and 9), which assumed the operators would be capable of identifying a leak from this location prior to propagation of the break. The containment atmosphere particulate radioactivity monitor was specifically assumed in this analysis.
| |
| RCS Leakage Detection Instrumentation satisfies Criterion 1 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO This LCO requires instruments of diverse monitoring principles to be OPERABLE to provide confidence that small amounts of unidentified LEAKAGE are detected in time to allow actions to place the unit in a safe condition, when RCS LEAKAGE indicates possible RCPB degradation.
| |
| The LCO requires three instruments to be OPERABLE.
| |
| The containment sump is used to collect unidentified LEAKAGE. The containment sump consists of three sumps - the lower containment sump, the reactor cavity sump, and the pipe tunnel sump. The LCO requirements apply to the total amount of unidentified LEAKAGE collected in all three sumps. The monitor for the containment sump detects the operating frequency of a pump and is instrumented to detect when there is an increase above the normal value by 1 gpm. The identification of an increase in unidentified LEAKAGE will be delayed by the time required for the unidentified LEAKAGE to travel to the containment sump and it may take longer than four hours to detect a 1 gpm increase in unidentified LEAKAGE, depending on the origin and magnitude of the LEAKAGE. This sensitivity is acceptable for containment sump monitor OPERABILITY.
| |
| The reactor coolant contains radioactivity that, when released to the containment, can be detected by the gaseous or particulate containment atmosphere radioactivity monitor. Radioactivity detection systems are included for monitoring both particulate and gaseous activities because of their sensitivities and rapid responses to RCS LEAKAGE, but have recognized limitations. Reactor coolant radioactivity levels will be low during initial reactor startup and for a few weeks thereafter, until activated corrosion products have been formed and fission products appear from Cook Nuclear Plant Unit 2 B 3.4.15-2 Revision No. 77
| |
| | |
| RCS Leakage Detection Instrumentation B 3.4.15 BASES LCO (continued) fuel element cladding contamination or cladding defects. If there are few fuel element cladding defects and low levels of activation products, it may not be possible for the gaseous or particulate containment atmosphere radioactivity monitors to detect a 1 gpm increase within 4 hours during normal operation. The particulate containment atmosphere radioactivity monitor is OPERABLE when it is capable of detecting a 0.8 gpm increase in unidentified LEAKAGE within 1 hour given an RCS activity equivalent to that assumed in the design calculations for the monitors. The gaseous containment atmosphere radioactivity monitor is OPERABLE when it is capable of detecting a 1 gpm increase in unidentified LEAKAGE within 4 hours given an RCS activity equivalent to that assumed in the design calculations for the monitors.
| |
| The LCO is satisfied when monitors of diverse measurement means are available. Thus, one containment sump monitor in each sump (lower containment, reactor cavity, and pipe tunnel), a particulate radioactivity monitor, and a containment gaseous radioactivity monitor, provide an acceptable minimum. In addition, for a containment sump monitor to be OPERABLE, its associated sump pump and integrator must also be OPERABLE.
| |
| APPLICABILITY Because of elevated RCS temperature and pressure in MODES 1, 2, 3, and 4, RCS leakage detection instrumentation is required to be OPERABLE.
| |
| In MODE 5, the temperature is to be 200°F and pressure is maintained low or at atmospheric pressure. In MODE 6 the temperature is low and the pressure is maintained low or at atmospheric pressure. Since the temperatures and pressures are far lower than those for MODES 1, 2, 3, and 4, the likelihood of leakage and crack propagation are much smaller.
| |
| Therefore, the requirements of this LCO are not applicable in MODES 5 and 6.
| |
| ACTIONS A.1 and A.2 With the containment sump monitor(s) inoperable, no other form of sampling can provide the equivalent information; however, the containment atmosphere radioactivity monitor will provide indications of changes in leakage. Together with the containment atmosphere radioactivity monitor, the periodic surveillance for RCS water inventory balance, SR 3.4.13.1, must be performed at an increased frequency of 24 hours to provide information that is adequate to detect leakage. A Note is added allowing that SR 3.4.13.1 is not required to be performed until 12 hours after establishing steady state operation (stable RCS pressure, temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection and return flows). The Cook Nuclear Plant Unit 2 B 3.4.15-3 Revision No. 75
| |
| | |
| RCS Leakage Detection Instrumentation B 3.4.15 BASES ACTIONS (continued) 12 hour allowance provides sufficient time to collect and process all necessary data after stable unit conditions are established.
| |
| Restoration of the sump monitor(s) to OPERABLE status within a Completion Time of 30 days is required to regain the function after the failure of the monitors. This time is acceptable, considering the Frequency and adequacy of the RCS water inventory balance required by Required Action A.1.
| |
| B.1.1, B.1.2, and B.2 With the containment atmosphere particulate radioactivity monitoring instrumentation channel inoperable, alternative action is required. Either grab samples of the containment atmosphere must be taken and analyzed or water inventory balances, in accordance with SR 3.4.13.1, must be performed to provide alternate periodic information.
| |
| With a sample obtained and analyzed or water inventory balance performed every 12 hours, the reactor may be operated for up to 30 days to allow restoration of the required containment atmosphere particulate radioactivity monitor.
| |
| The 12 hour interval provides periodic information that is adequate to detect leakage. A Note is added allowing that SR 3.4.13.1 is not required to be performed until 12 hours after establishing steady state operation (stable RCS pressure, temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection and return flows). The 12 hour allowance provides sufficient time to collect and process all necessary data after stable unit conditions are established.
| |
| The 30 day Completion Time recognizes at least one other form of leakage detection is available.
| |
| C.1 and C.2 With the containment gaseous radioactivity monitor inoperable, alternative action is again required. Either grab samples of the containment atmosphere must be taken and analyzed or water inventory balances, in accordance with SR 3.4.13.1, must be performed to provide alternate periodic information. Provided a grab sample is taken or a water inventory balance is performed every 24 hours, reactor operation may continue while awaiting restoration of the containment gaseous radioactivity monitor to OPERABLE status.
| |
| The 24 hour interval provides periodic information that is adequate to detect RCS LEAKAGE. A Note is added allowing that SR 3.4.13.1 is not required to be performed until 12 hours after establishing steady state Cook Nuclear Plant Unit 2 B 3.4.15-4 Revision No. 75
| |
| | |
| RCS Leakage Detection Instrumentation B 3.4.15 BASES ACTIONS (continued) operation (stable RCS pressure, temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection and return flows). The 12 hour allowance provides sufficient time to collect and process all necessary data after stable unit conditions are established. The 30 day Completion Time recognizes at least one other form of leakage detection is available.
| |
| D.1, D.2.1, and D.2.2 With the containment sump monitor and the containment particulate radioactivity monitor inoperable, the only means of detecting LEAKAGE is the containment atmosphere gaseous radiation monitor. This Condition is applicable when the only OPERABLE monitor is the containment atmosphere gaseous radiation monitor. The containment atmosphere gaseous radioactivity monitor typically cannot detect a 1 gpm leak within four hours when RCS activity is low. In addition, this configuration does not provide the required diverse means of leakage detection. Indirect methods of monitoring RCS leakage must be implemented. Grab samples of the containment atmosphere must be taken to provide alternate periodic information. The 12 hour interval is sufficient to detect increasing RCS leakage. The Required Action provides 7 days to restore another RCS leakage monitor to OPERABLE status to regain the intended leakage detection diversity. The 7-day Completion Time ensures that the plant will not be operated in a degraded configuration for a lengthy time period.
| |
| E.1 and E.2 If any Required Action and associated Completion Time of Condition A, B, C, or D, cannot be met, the unit must be brought to a MODE in which the requirement does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| F.1 With all three types of required monitors inoperable (i.e., LCO 3.4.15.a, b, and c not met), no automatic means of monitoring leakage are available, and immediate unit shutdown in accordance with LCO 3.0.3 is required.
| |
| SURVEILLANCE SR 3.4.15.1 REQUIREMENTS SR 3.4.15.1 requires the performance of a CHANNEL CHECK of the required containment atmosphere radioactivity monitor. The check gives Cook Nuclear Plant Unit 2 B 3.4.15-5 Revision No. 75
| |
| | |
| RCS Leakage Detection Instrumentation B 3.4.15 BASES SURVEILLANCE REQUIREMENTS (continued) reasonable confidence that the channel is operating properly. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.4.15.2 SR 3.4.15.2 requires the performance of a COT on the required containment atmosphere radioactivity monitor. The test ensures that the monitor can perform its function in the desired manner. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL OPERATIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. The test verifies the alarm setpoint and relative accuracy of the instrument string. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.4.15.3 and SR 3.4.15.4 These SRs require the performance of a CHANNEL CALIBRATION for each of the RCS leakage detection instrumentation channels. The calibration verifies the accuracy of the instrument string, including the instruments located inside containment. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 1.4.3.
| |
| : 2. Regulatory Guide 1.45, Rev. 0, Reactor Coolant Pressure Boundary Leakage Detection System, May 1973.
| |
| : 3. AEP Letter to NRC, AEP:NRC:0137D, "NRC Generic Letter 84-04; Elimination Of Postulated Pipe Breaks In Primary Main Loops Generic Issue A-2, Asymmetric Blowdown Loads On PWR Primary Systems Request For License Condition Deletion," dated September 10, 1984.
| |
| : 4. NRC Letter to AEP, "Generic Letter 84-04, Safety Evaluation of Westinghouse Topical Reports Dealing With Elimination of Postulated Pipe Breaks in PWR Primary Main Loops," dated November 22, 1985.
| |
| : 5. UFSAR, Section 4.2.7 Cook Nuclear Plant Unit 2 B 3.4.15-6 Revision No. 75
| |
| | |
| RCS Leakage Detection Instrumentation B 3.4.15 BASES REFERENCES (continued)
| |
| : 6. WCAP- 15435, Rev. 1, Technical Justification for Eliminating Pressurizer Surge Line Rupture as the Structural Design Basis for D.C. Cook Units 1 and 2 Nuclear Power Plants, August 2000.
| |
| : 7. WCAP-18295-P, Rev. 0, Technical Justification for Eliminating Accumulator Line Rupture as the Structural Design Basis for D.C.
| |
| Cook Units 1 and 2, Using Leak-Before-Break Methodology, January 2018.
| |
| : 8. WCAP-18302-P, Rev. 0, Technical Justification for Eliminating Residual Heat Removal Line Rupture as the Structural Design Basis for D.C. Cook Units 1 and 2, Using Leak-Before-Break Methodology, January 2018.
| |
| : 9. WCAP-18309-P, Rev. 0, Technical Justification for Eliminating Safety Injection Line Rupture as the Structural Design Basis for D.C. Cook Units 1 and 2, Using Leak-Before-Break Methodology, January 2018.
| |
| Cook Nuclear Plant Unit 2 B 3.4.15-7 Revision No. 77
| |
| | |
| RCS Leakage Detection Instrumentation B 3.4.15 THIS PAGE INTENTIONALLY LEFT BLANK Cook Nuclear Plant Unit 2 B 3.4.15-8 Revision No. 32
| |
| | |
| RCS Specific Activity B 3.4.16 B 3.4 REACTOR COOLANT SYSTEM (RCS)
| |
| B 3.4.16 RCS Specific Activity BASES BACKGROUND The maximum dose that an individual at the exclusion area boundary can receive for 2 hours following an accident, or at the low population zone outer boundary for the radiological release duration, is specified in 10 CFR 50.67 (Ref. 1). Doses to control room operators must be limited per GDC 19. The limits on specific activity ensure that the offsite and control room doses are appropriately limited during analyzed transients and accidents.
| |
| The RCS specific activity LCO limits the allowable concentration level of radionuclides in the reactor coolant. The LCO limits are established to minimize the dose consequences in the event of a steam line break (SLB) or steam generator tube rupture (SGTR) accident.
| |
| The LCO contains specific activity limits for both DOSE EQUIVALENT I-131 and DOSE EQUIVALENT XE-133. The allowable levels are intended to ensure that offsite and control room doses meet the appropriate acceptance criteria in the Standard Review Plan (Ref. 2).
| |
| APPLICABLE The LCO limits on the specific activity of the reactor coolant ensure that SAFETY the resulting offsite and control room doses meet the appropriate SRP ANALYSES acceptance criteria following a SLB or SGTR accident. The safety analyses (Refs. 3 and 4) assume the specific activity of the reactor coolant is at the LCO limits, and an existing reactor coolant steam generator (SG) tube leakage rate of 0.25 gpm per SG (1 gpm for all SGs) exists. The safety analyses assume the specific activity of the secondary coolant is at its limit of 0.1 Ci/gm DOSE EQUIVALENT I-131 from LCO 3.7.17, "Secondary Specific Activity."
| |
| The analyses for the SLB and SGTR accidents establish the acceptance limits for RCS specific activity. Reference to these analyses is used to assess changes to the unit that could affect RCS specific activity, as they relate to the acceptance limits.
| |
| The safety analyses consider two cases of reactor coolant iodine specific activity. One case assumes specific activity at 1.0 Ci/gm DOSE EQUIVALENT I-131 with a concurrent large iodine spike that increases the rate of release of iodine from the fuel rods containing cladding defects to the primary coolant immediately after a SLB (by a factor of 500), or SGTR (by a factor of 335), respectively.
| |
| Cook Nuclear Plant Unit 2 B 3.4.16-1 Revision No. 59
| |
| | |
| RCS Specific Activity B 3.4.16 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| The second case assumes the initial reactor coolant iodine activity at 60.0 Ci/gm DOSE EQUIVALENT I-131 due to an iodine spike caused by a reactor or an RCS transient prior to the accident. In both cases, the noble gas specific activity is assumed to be 215.1 Ci/gm DOSE EQUIVALENT XE-133.
| |
| The SGTR analysis assumes a rise in pressure in the ruptured SG which causes radioactively contaminated steam to discharge to the atmosphere through the power operated relief valves or the main steam safety valves.
| |
| The atmospheric discharge stops when the primary to secondary leakage is halted via operator action. The unaffected SG removes core decay heat by venting steam until Residual Heat Removal (RHR) system entry conditions are reached.
| |
| The SLB radiological analysis assumes that offsite power is lost at the same time as the pipe break occurs outside containment. The affected SG blows down completely and steam is vented directly to the atmosphere. The unaffected SG removes core decay heat by venting steam to the atmosphere until RHR system entry conditions are reached.
| |
| Operation with iodine specific activity levels greater than the LCO limit is permissible, if the activity levels do not exceed 60.0 Ci/gm for more than 48 hours.
| |
| The limits on RCS specific activity are also used for establishing standardization in radiation shielding and plant personnel radiation protection practices.
| |
| RCS specific activity satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The iodine specific activity in the reactor coolant is limited to 1.0 Ci/gm DOSE EQUIVALENT I-131, and the noble gas specific activity in the reactor coolant is limited to 215.1 Ci/gm DOSE EQUIVALENT XE-133.
| |
| The limits on specific activity ensure that offsite and control room doses will meet the appropriate SRP acceptance criteria (Ref. 2).
| |
| The SLB and SGTR accident analyses (Refs. 3 and 4) show that the calculated doses are within acceptable limits. Violation of the LCO may result in reactor coolant radioactivity levels that could, in the event of a SLB or SGTR, lead to doses that exceed the SRP acceptance criteria (Ref. 2).
| |
| Cook Nuclear Plant Unit 2 B 3.4.16-2 Revision No. 59
| |
| | |
| RCS Specific Activity B 3.4.16 BASES APPLICABILITY In MODES 1, 2, 3, and 4, operation within the LCO limits for DOSE EQUIVALENT I-131 and DOSE EQUIVALENT XE-133 is necessary to limit the potential consequences of a SLB or SGTR to within the SRP acceptance criteria (Ref. 2).
| |
| In MODES 5 and 6, the steam generators are not being used for decay heat removal, the RCS and steam generators are depressurized, and primary to secondary leakage is minimal. Therefore, the monitoring of RCS specific activity is not required.
| |
| ACTIONS A.1 and A.2 With the DOSE EQUIVALENT I-131 greater than the LCO limit, samples at intervals of 4 hours must be taken to demonstrate that the specific activity is 60.0 Ci/gm. The Completion Time of 4 hours is required to obtain and analyze a sample. Sampling is continued every 4 hours to provide a trend.
| |
| The DOSE EQUIVALENT I-131 must be restored to within limit within 48 hours. The Completion Time of 48 hours is acceptable since it is expected that, if there were an iodine spike, the normal coolant iodine concentration would be restored within this time period. Also, there is a low probability of a SLB or SGTR occurring during this time period.
| |
| A Note permits the use of the provisions of LCO 3.0.4.c. This allowance permits entry into the applicable MODE(S), relying on Required Actions A.1 and A.2 while the DOSE EQUIVALENT I-131 LCO limit is not met.
| |
| This allowance is acceptable due to the significant conservatism incorporated into the specific activity limit, the low probability of an event that is limiting due to exceeding this limit, and the ability to restore transient-specific activity excursions while the plant remains at, or proceeds to, power operation.
| |
| B.1 and B.2 If the Required Action and associated Completion Time of Condition A is not met, if the DOSE EQUIVALENT I-131 is > 60.0 Ci/gm, or if DOSE EQUIVALENT XE-133 is not within limit, the reactor must be brought to MODE 3 within 6 hours and MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
| |
| Cook Nuclear Plant Unit 2 B 3.4.16-3 Revision No. 59
| |
| | |
| RCS Specific Activity B 3.4.16 BASES SURVEILLANCE SR 3.4.16.1 REQUIREMENTS SR 3.4.16.1 requires performing a gamma isotopic analysis as a measure of the noble gas specific activity of the reactor coolant. This measurement is the sum of the degassed gamma activities and the gaseous gamma activities in the sample taken. This Surveillance provides an indication of any increase in the noble gas specific activity.
| |
| Trending the results of this Surveillance allows proper remedial action to be taken before reaching the LCO limit under normal operating conditions. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Due to the inherent difficulty in detecting Kr-85 in a reactor coolant sample due to masking from radioisotopes with similar decay energies, such as F-18 and I-134, it is acceptable to include the minimum detectable activity for Kr-85 in the SR 3.4.16.1 calculation. If a specific noble gas nuclide listed in the definition of DOSE EQUIVALENT XE-133 is not detected, it should be assumed to be present at the minimum detectable activity.
| |
| SR 3.4.16.2 This Surveillance is performed to ensure iodine specific activity remains within the LCO limit during normal operation and following fast power changes when iodine spiking is more apt to occur. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Frequency, between 2 and 6 hours after a power change >
| |
| 15% RTP within a 1 hour period, is established because the iodine levels peak during this time following iodine spike initiation; samples at other times would provide inaccurate results.
| |
| REFERENCES
| |
| : 1. 10 CFR 50.67.
| |
| : 2. Standard Review Plan (SRP) Section 15.0.1 "Radiological Consequence Analyses Using Alternative Source Terms."
| |
| : 3. UFSAR, Section 14.2.4.
| |
| : 4. UFSAR, Section 14.2.5 Cook Nuclear Plant Unit 2 B 3.4.16-4 Revision No. 60
| |
| | |
| SG Tube Integrity B 3.4.17 B 3.4 REACTOR COOLANT SYSTEM (RCS)
| |
| B 3.4.17 Steam Generator (SG) Tube Integrity BASES BACKGROUND Steam generator (SG) tubes are small diameter, thin walled tubes that carry primary coolant through the primary to secondary heat exchangers.
| |
| The SG tubes have a number of important safety functions. Steam generator tubes are an integral part of the reactor coolant pressure boundary (RCPB) and, as such, are relied on to maintain the primary systems pressure and inventory. The SG tubes isolate the radioactive fission products in the primary coolant from the secondary system. In addition, as part of the RCPB, the SG tubes are unique in that they act as the heat transfer surface between the primary and secondary systems to remove heat from the primary system. This Specification addresses only the RCPB integrity function of the SG. The SG heat removal function is addressed by LCO 3.4.4, RCS Loops - MODES 1 and 2, LCO 3.4.5, RCS Loops - MODE 3, LCO 3.4.6, RCS Loops - MODE 4, and LCO 3.4.7, RCS Loops - MODE 5, Loops Filled.
| |
| SG tube integrity means that the tubes are capable of performing their intended RCPB safety function consistent with the licensing basis, including applicable regulatory requirements.
| |
| Steam generator tubing is subject to a variety of degradation mechanisms. Steam generator tubes may experience tube degradation related to corrosion phenomena, such as wastage, pitting, intergranular attack, and stress corrosion cracking, along with other mechanically induced phenomena such as denting and wear. These degradation mechanisms can impair tube integrity if they are not managed effectively.
| |
| The SG performance criteria are used to manage SG tube degradation.
| |
| Specification 5.5.7, Steam Generator (SG) Program, requires that a program be established and implemented to ensure that SG tube integrity is maintained. Pursuant to Specification 5.5.7, tube integrity is maintained when the SG performance criteria are met. There are three SG performance criteria: structural integrity, accident induced leakage, and operational LEAKAGE. The SG performance criteria are described in Specification 5.5.7. Meeting the SG performance criteria provides reasonable assurance of maintaining tube integrity at normal and accident conditions.
| |
| The processes used to meet the SG performance criteria are defined by the Steam Generator Program Guidelines (Ref. 1).
| |
| Cook Nuclear Plant Unit 2 B 3.4.17-1 Revision No. 12
| |
| | |
| SG Tube Integrity B 3.4.17 BASES APPLICABLE The steam generator tube rupture (SGTR) accident is the limiting design SAFETY basis event for SG tubes and avoiding an SGTR is the basis for this ANALYSES Specification. The analysis of an SGTR event assumes a bounding primary to secondary LEAKAGE rate equal to the accident induced LEAKAGE rate of 0.25 gpm (1.0 for all SGs) plus the leakage rate associated with a double-ended rupture of a single tube. The accident analysis for an SGTR assumes the contaminated secondary fluid is only briefly released to the atmosphere via the SG power operated relief valves.
| |
| The analysis for design basis accidents and transients other than an SGTR assumes the SG tubes retain their structural integrity (i.e., they are assumed not to rupture.) In these analyses, the steam discharge to the atmosphere is based on the total primary to secondary LEAKAGE from an individual SG of 0.25 gpm (1.0 gpm for all SGs) as a result of accident induced conditions. For accidents that do not involve fuel damage, the primary coolant activity level of DOSE EQUIVALENT I-131 is assumed to be equal to the LCO 3.4.16, RCS Specific Activity, limits. For accidents that assume fuel damage, the primary coolant activity is a function of the amount of activity released from the damaged fuel. The dose consequences of these events are within the limits of 10 CFR 50.67 (Ref.
| |
| 3).
| |
| Steam generator tube integrity satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The LCO requires that SG tube integrity be maintained. The LCO also requires that all SG tubes that satisfy the plugging criteria be plugged in accordance with the Steam Generator Program.
| |
| During an SG inspection, any inspected tube that satisfies the Steam Generator Program plugging criteria is removed from service by plugging.
| |
| If a tube was determined to satisfy the plugging criteria but was not plugged, the tube may still have tube integrity.
| |
| In the context of this Specification, an SG tube is defined as the entire length of the tube, including the tube wall, between the tube-to-tubesheet weld at the tube inlet and the tube-to-tubesheet weld at the tube outlet.
| |
| The tube-to-tubesheet weld is not considered part of the tube.
| |
| An SG tube has tube integrity when it satisfies the SG performance criteria. The SG performance criteria are defined in Specification 5.5.7, Steam Generator Program, and describe acceptable SG tube performance. The Steam Generator Program also provides the evaluation process for determining conformance with the SG performance criteria.
| |
| Cook Nuclear Plant Unit 2 B 3.4.17-2 Revision No. 59
| |
| | |
| SG Tube Integrity B 3.4.17 BASES LCO (continued) There are three SG performance criteria: structural integrity, accident induced leakage, and operational LEAKAGE. Failure to meet any one of these criteria is considered failure to meet the LCO.
| |
| The structural integrity performance criterion provides a margin of safety against tube burst or collapse under normal and accident conditions, and ensures structural integrity of the SG tubes under all anticipated transients included in the design specification. Tube burst is defined as, The gross structural failure of the tube wall. The condition typically corresponds to an unstable opening displacement (e.g., opening area increased in response to constant pressure) accompanied by ductile (plastic) tearing of the tube material at the ends of the degradation. Tube collapse is defined as, For the load displacement curve for a given structure, collapse occurs at the top of the load versus displacement curve where the slope of the curve becomes zero. The structural integrity performance criterion provides guidance on assessing loads that have a significant effect on burst or collapse. In that context, the term significant is defined as An accident loading condition other than differential pressure is considered significant when the addition of such loads in the assessment of the structural integrity performance criterion could cause a lower structural limit or limiting burst/collapse condition to be established. For tube integrity evaluations, except for circumferential degradation, axial thermal loads are classified as secondary loads. For circumferential degradation, the classification of axial thermal loads as primary or secondary loads will be evaluated on a case-by-case basis.
| |
| The division between primary and secondary classifications will be based on detailed analysis and/or testing.
| |
| Structural integrity requires that the primary membrane stress intensity in a tube not exceed the yield strength for all ASME Code, Section III, Service Level A (normal operating conditions) and Service Level B (upset or abnormal conditions) transients included in the design specification.
| |
| This includes safety factors and applicable design basis loads based on ASME Code, Section III, Subsection NB (Ref. 4) and Draft Regulatory Guide 1.121 (Ref. 5).
| |
| The accident induced leakage performance criterion ensures that the primary to secondary LEAKAGE caused by a design basis accident, other than an SGTR, is within the accident analysis assumptions. The accident analysis assumes that accident induced leakage does not exceed 0.25 gpm per SG (1.0 gpm for all SGs). The accident induced leakage rate includes any primary to secondary LEAKAGE existing prior to the accident in addition to primary to secondary LEAKAGE induced during the accident.
| |
| Cook Nuclear Plant Unit 2 B 3.4.17-3 Revision No. 59
| |
| | |
| SG Tube Integrity B 3.4.17 BASES LCO (continued) The operational LEAKAGE performance criterion provides an observable indication of SG tube conditions during plant operation. The limit on operational LEAKAGE is contained in LCO 3.4.13, RCS Operational LEAKAGE, and limits primary to secondary LEAKAGE through any one SG to 150 gallons per day. This limit is based on the assumption that a single crack leaking this amount would not propagate to an SGTR under the stress conditions of a LOCA or a main steam line break. If this amount of LEAKAGE is due to more than one crack, the cracks are very small, and the above assumption is conservative.
| |
| APPLICABILITY Steam generator tube integrity is challenged when the pressure differential across the tubes is large. Large differential pressures across SG tubes can only be experienced in MODE 1, 2, 3, or 4.
| |
| RCS conditions are far less challenging in MODES 5 and 6 than during MODES 1, 2, 3, and 4. In MODES 5 and 6, primary to secondary differential pressure is low, resulting in lower stresses and reduced potential for LEAKAGE.
| |
| ACTIONS The ACTIONS are modified by a Note clarifying that the Conditions may be entered independently for each SG tube. This is acceptable because the Required Actions provide appropriate compensatory actions for each affected SG tube. Complying with the Required Actions may allow for continued operation, and subsequent affected SG tubes are governed by subsequent Condition entry and application of associated Required Actions.
| |
| A.1 and A.2 Condition A applies if it is discovered that one or more SG tubes examined in an inservice inspection satisfy the tube plugging criteria but were not plugged in accordance with the Steam Generator Program as required by SR 3.4.17.2. An evaluation of SG tube integrity of the affected tube(s) must be made. Steam generator tube integrity is based on meeting the SG performance criteria described in the Steam Generator Program. The SG plugging criteria define limits on SG tube degradation that allow for flaw growth between inspections while still providing assurance that the SG performance criteria will continue to be met. In order to determine if an SG tube that should have been plugged has tube integrity, an evaluation must be completed that demonstrates that the SG performance criteria will continue to be met until the next refueling outage or SG tube inspection. The tube integrity determination is based on the estimated condition of the tube at the time the situation is discovered and the estimated growth of the degradation prior to the next SG tube inspection. If it is determined that tube integrity is not being maintained, Condition B applies.
| |
| Cook Nuclear Plant Unit 2 B 3.4.17-4 Revision No. 38
| |
| | |
| SG Tube Integrity B 3.4.17 BASES Actions (continued)
| |
| A Completion Time of 7 days is sufficient to complete the evaluation while minimizing the risk of plant operation with an SG tube that may not have tube integrity.
| |
| If the evaluation determines that the affected tube(s) have tube integrity, Required Action A.2 allows plant operation to continue until the next refueling outage or SG inspection provided the inspection interval continues to be supported by an operational assessment that reflects the affected tubes. However, the affected tube(s) must be plugged prior to entering MODE 4 following the next refueling outage or SG inspection.
| |
| This Completion Time is acceptable since operation until the next inspection is supported by the operational assessment.
| |
| B.1 and B.2 If the Required Actions and associated Completion Times of Condition A are not met or if SG tube integrity is not being maintained, the reactor must be brought to MODE 3 within 6 hours and MODE 5 within 36 hours.
| |
| The allowed Completion Times are reasonable, based on operating experience, to reach the desired plant conditions from full power conditions in an orderly manner and without challenging plant systems.
| |
| SURVEILLANCE SR 3.4.17.1 REQUIREMENTS During shutdown periods the SGs are inspected as required by this SR and the Steam Generator Program. NEI 97-06, Steam Generator Program Guidelines (Ref. 1), and its referenced EPRI Guidelines, establish the content of the Steam Generator Program. Use of the Steam Generator Program ensures that the inspection is appropriate and consistent with accepted industry practices.
| |
| During SG inspections a condition monitoring assessment of the SG tubes is performed. The condition monitoring assessment determines the as found condition of the SG tubes. The purpose of the condition monitoring assessment is to ensure that the SG performance criteria have been met for the previous operating period.
| |
| Cook Nuclear Plant Unit 2 B 3.4.17-5 Revision No. 12
| |
| | |
| SG Tube Integrity B 3.4.17 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| The Steam Generator Program determines the scope of the inspection and the methods used to determine whether the tubes contain flaws satisfying the tube plugging criteria. Inspection scope (i.e., which tubes or areas of tubing within the SG are to be inspected) is a function of existing and potential degradation locations. The Steam Generator Program also specifies the inspection methods to be used to find potential degradation.
| |
| Inspection methods are a function of degradation morphology, non-destructive examination (NDE) technique capabilities, and inspection locations.
| |
| The Steam Generator Program defines the Frequency of SR 3.4.17.1.
| |
| The Frequency is determined by the operational assessment and other limits in the SG examination guidelines (Ref. 6). The Steam Generator Program uses information on existing degradations and growth rates to determine an inspection Frequency that provides reasonable assurance that the tubing will meet the SG performance criteria at the next scheduled inspection. In addition, Specification 5.5.7 contains prescriptive requirements concerning inspection intervals to provide added assurance that the SG performance criteria will be met between scheduled inspections. If crack indications are found in any SG tube, the maximum inspection interval for all affected and potentially affected SGs is restricted by Specification 5.5.7 until subsequent inspections support extending the inspection interval.
| |
| SR 3.4.17.2 During an SG inspection, any inspected tube that satisfies the Steam Generator Program plugging criteria is removed from service by plugging.
| |
| The tube plugging criteria delineated in Specification 5.5.7 are intended to ensure that tubes accepted for continued service satisfy the SG performance criteria with allowance for error in the flaw size measurement and for future flaw growth. In addition, the tube plugging criteria, in conjunction with other elements of the Steam Generator Program, ensure that the SG performance criteria will continue to be met until the next inspection of the subject tube(s). Reference 1 provides guidance for performing operational assessments to verify that the tubes remaining in service will continue to meet the SG performance criteria.
| |
| The Frequency of prior to entering MODE 4 following an SG inspection ensures that the Surveillance has been completed and all tubes meeting the plugging criteria are plugged prior to subjecting the SG tubes to significant primary to secondary pressure differential.
| |
| Cook Nuclear Plant Unit 2 B 3.4.17-6 Revision No. 38
| |
| | |
| SG Tube Integrity B 3.4.17 BASES REFERENCES 1. NEI 97-06, Steam Generator Program Guidelines.
| |
| : 2. Not Used.
| |
| : 3. 10 CFR 50.67.
| |
| : 4. ASME Boiler and Pressure Vessel Code, Section III, Subsection NB.
| |
| : 5. Draft Regulatory Guide 1.121, Basis for Plugging Degraded Steam Generator Tubes, August 1976.
| |
| : 6. EPRI, Pressurized Water Reactor Steam Generator Examination Guidelines.
| |
| Cook Nuclear Plant Unit 2 B 3.4.17-7 Revision No. 59
| |
| | |
| Accumulators B 3.5.1 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)
| |
| B 3.5.1 Accumulators BASES BACKGROUND The functions of the ECCS accumulators are to supply water to the Reactor Coolant System (RCS), contributing to the filling of the reactor vessel downcomer during the later stage of the blowdown phase through the beginning of the reflood phase during a large break loss of coolant accident (LOCA), and to provide RCS makeup for a small break LOCA.
| |
| The blowdown phase of a large break LOCA is the initial period of the transient during which the RCS departs from equilibrium conditions, and heat from fission product decay, hot internals, and the vessel continues to be transferred to the reactor coolant. The blowdown phase of the transient ends when the RCS pressure falls to a value approaching that of the containment atmosphere.
| |
| In the refill phase of a large break LOCA, which immediately follows the blowdown phase, reactor coolant inventory has vacated the core through steam flashing and ejection out through the break. The balance of accumulator inventory is then available to help fill voids in the lower plenum and reactor vessel downcomer so as to establish a recovery level at the bottom of the core and ongoing reflood of the core with the addition of safety injection (SI) water.
| |
| The accumulators are pressure vessels partially filled with borated water and pressurized with nitrogen gas. The accumulators are passive components, since no operator or control actions are required in order for them to perform their function. Internal accumulator tank pressure is sufficient to discharge the accumulator contents to the RCS, if RCS pressure decreases below the accumulator pressure.
| |
| Each accumulator is piped into an RCS cold leg via an accumulator line and is isolated from the RCS by a motor operated isolation valve and two check valves in series.
| |
| The accumulator size, water volume, and nitrogen cover pressure are selected so that three of the four accumulators are sufficient to partially cover the core before significant clad melting or zirconium water reaction can occur following a large break LOCA. The need to ensure that three accumulators are adequate for this function is consistent with the large break LOCA assumption that the entire contents of one accumulator will be lost via the RCS pipe break during the blowdown phase of the large break LOCA.
| |
| Cook Nuclear Plant Unit 2 B 3.5.1-1 Revision No. 0
| |
| | |
| Accumulators B 3.5.1 BASES APPLICABLE The accumulators are assumed OPERABLE in both the large and small SAFETY break LOCA analyses at full power (Ref. 1). These are the Design Basis ANALYSES Accidents (DBAs) that establish the acceptance limits for the accumulators. Reference to the analyses for these DBAs is used to assess changes in the accumulators as they relate to the acceptance limits.
| |
| In performing the LOCA calculations, conservative assumptions are made concerning the availability of ECCS flow. In the early stages of a large break LOCA, with or without a loss of offsite power, the accumulators provide the sole source of makeup water to the RCS. The assumption of loss of offsite power is required by regulations and conservatively imposes a delay wherein the ECCS pumps cannot deliver flow until the emergency diesel generators start, come to rated speed, and go through their timed loading sequence. In cold leg large break scenarios, the entire contents of one accumulator are assumed to be lost through the break.
| |
| The limiting large break LOCA is a split break (break area less than that resulting from the complete severance of the pipe) at the discharge of the reactor coolant pump. During this event, the accumulators discharge to the RCS as soon as RCS pressure decreases to below accumulator pressure.
| |
| As a conservative estimate, no credit is taken for ECCS pump flow until an effective delay has elapsed. This delay accounts for the SI signal generation, diesels starting, and the pumps being loaded and delivering full flow. During this time, the accumulators are analyzed as providing the sole source of emergency core cooling. No operator action is assumed during the blowdown stage of a large break LOCA.
| |
| The worst case small break LOCA analyses also assume a time delay before pumped flow reaches the core. For the larger range of small breaks, the rate of blowdown is such that the increase in fuel clad temperature is terminated solely by the accumulators, with pumped flow then providing continued cooling. As break size decreases, the accumulators, safety injection pumps, and centrifugal charging pumps all play a part in terminating the rise in clad temperature. As break size continues to decrease, the role of the accumulators continues to decrease until they are not required and the safety injection and centrifugal charging pumps become solely responsible for terminating the temperature increase.
| |
| This LCO helps to ensure that the following acceptance criteria established for the ECCS by 10 CFR 50.46 (Ref. 2) will be met following a LOCA:
| |
| : a. Maximum fuel element cladding temperature is 2200°F; Cook Nuclear Plant Unit 2 B 3.5.1-2 Revision No. 30
| |
| | |
| Accumulators B 3.5.1 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| : b. Maximum cladding oxidation is 0.17 times the total cladding thickness before oxidation;
| |
| : c. Maximum hydrogen generation from a zirconium water reaction is 0.01 times the hypothetical amount that would be generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react; and
| |
| : d. Core is maintained in a coolable geometry.
| |
| Since the accumulators discharge during the blowdown phase of a large break LOCA, they do not contribute to the long term cooling requirements of 10 CFR 50.46.
| |
| For the small break LOCA analysis, a nominal contained accumulator water volume is used, while the large break LOCA analysis uses accumulator water volume values that are obtained from statistical sampling over a given range. The contained water volume is the same as the deliverable volume for the accumulators, since the accumulators are emptied, once discharged. For small breaks, an increase in water volume is a peak clad temperature penalty. For large breaks, an increase in water volume can be either a peak clad temperature penalty or benefit, depending on downcomer filling and subsequent spill through the break during the core reflooding portion of the transient. The analysis makes a conservative assumption with respect to ignoring or taking credit for line water volume from the accumulator to the check valve. The small break LOCA analysis assumes a nominal value of 946 ft3, while the large break LOCA analysis uses accumulator water volume values that are sampled over a range of 921 ft3 to 971 ft3. The nominal value is used since competing effects related to ECCS bypass, the impact of gas volume changes on the injection rate, and spilled ECCS water modeled as spray (which reduces the containment pressure) can result in the most limiting value being other values within the Technical Specification Limits.
| |
| Generic Westinghouse sensitivities using the Technical Specification limits justify the use of the nominal value in the safety analysis.
| |
| The minimum boron concentration setpoint (or a more conservative value) is used in the post LOCA boron concentration calculation. The calculation is performed to assure reactor subcriticality in a post LOCA environment. Of particular interest is the large break LOCA, since no credit is taken for control rod assembly insertion (except during hot leg switchover for large cold leg breaks). A reduction in the accumulator minimum boron concentration would produce a subsequent reduction in the available containment sump concentration for post LOCA shutdown and an increase in the maximum sump pH. The maximum boron Cook Nuclear Plant Unit 2 B 3.5.1-3 Revision No. 30
| |
| | |
| Accumulators B 3.5.1 BASES APPLICABLE SAFETY ANALYSES (continued) concentration is used in determining the cold leg to hot leg recirculation injection switchover time and minimum sump pH.
| |
| The small break LOCA peak clad temperature analysis is performed at the minimum nitrogen cover pressure, since it has been determined that higher nitrogen cover pressure results in a computed peak clad temperature benefit. The maximum nitrogen cover pressure limit prevents accumulator relief valve actuation, and ultimately preserves accumulator integrity. The large break LOCA analysis uses accumulator pressure values that are obtained from statistical sampling over a given range.
| |
| The effects on containment mass and energy releases from the accumulators are accounted for in the appropriate analyses (Ref. 1).
| |
| The Accumulators satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The LCO establishes the minimum conditions required to ensure that the accumulators are available to accomplish their core cooling safety function following a LOCA. Four accumulators are required to ensure that 100% of the contents of three of the accumulators will reach the core during a large break LOCA. This is consistent with the assumption that the contents of one accumulator spill through the break. If less than three accumulators are injected during the blowdown phase of a large break LOCA, the ECCS acceptance criteria of 10 CFR 50.46 (Ref. 2) could be violated.
| |
| For an accumulator to be considered OPERABLE, the isolation valve must be fully open, power removed above 2000 psig, and the limits established in the SRs for contained volume, boron concentration, and nitrogen cover pressure must be met.
| |
| APPLICABILITY In MODES 1 and 2, and in MODE 3 with RCS pressure > 1000 psig, the accumulator OPERABILITY requirements are based on full power operation. Although cooling requirements decrease as power decreases, the accumulators are still required to provide core cooling as long as elevated RCS pressures and temperatures exist.
| |
| This LCO is only applicable at pressures > 1000 psig. At pressures 1000 psig, the rate of RCS blowdown is such that the ECCS pumps can provide adequate injection to ensure that peak clad temperature remains below the 10 CFR 50.46 (Ref. 2) limit of 2200°F.
| |
| In MODE 3, with RCS pressure 1000 psig, and in MODES 4, 5, and 6, the accumulator motor operated isolation valves are closed to isolate the Cook Nuclear Plant Unit 2 B 3.5.1-4 Revision No. 30
| |
| | |
| Accumulators B 3.5.1 BASES APPLICABILITY (continued) accumulators from the RCS. This allows RCS cooldown and depresssurization without discharging the accumulators into the RCS or requiring depressurization of the accumulators ACTIONS A.1 If the boron concentration of one accumulator is not within limits, it must be returned to within the limits within 72 hours. In this condition, ability to maintain subcriticality or minimum boron precipitation time may be reduced. The boron in the accumulators contributes to the assumption that the combined ECCS water in the partially recovered core during the early reflooding phase of a large break LOCA is sufficient to keep that portion of the core subcritical. One accumulator below the minimum boron concentration limit, however, will have no effect on available ECCS water and an insignificant effect on core subcriticality during reflood.
| |
| Boiling of ECCS water in the core during reflood concentrates boron in the saturated liquid that remains in the core. In addition, current analysis techniques demonstrate that while the accumulators are assumed to discharge following a large main steam line break, their impact is minor and not a design limiting event. Thus, 72 hours is allowed to return the boron concentration to within limits.
| |
| B.1 If one accumulator is inoperable for a reason other than boron concentration, the accumulator must be returned to OPERABLE status within 24 hours. In this condition, the required contents of three accumulators cannot be assumed to reach the core during a large break LOCA. Due to the severity of the consequences should a large break LOCA occur in these conditions, the 24 hour Completion Time to open the valve, remove power to the valve, or restore the proper water volume or nitrogen cover pressure ensures that prompt action will be taken to return the inoperable accumulator to OPERABLE status. The Completion Time minimizes the time the unit is exposed to a LOCA under these conditions. The 24 hours allowed to restore an inoperable accumulator to OPERABLE status is justified in WCAP-15049-A, Rev. 1 (Ref. 3).
| |
| C.1 and C.2 If the accumulator cannot be returned to OPERABLE status within the associated Completion Time, the unit must be brought to a MODE or other specified condition in which the LCO does not apply. To achieve this status, the unit must be brought to MODE 3 within 6 hours and RCS pressure reduced to 1000 psig within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to Cook Nuclear Plant Unit 2 B 3.5.1-5 Revision No. 30
| |
| | |
| Accumulators B 3.5.1 BASES ACTIONS (continued) reach the required plant conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| D.1 If more than one accumulator is inoperable, the unit is in a condition outside the accident analyses; therefore, LCO 3.0.3 must be entered immediately.
| |
| SURVEILLANCE SR 3.5.1.1 REQUIREMENTS Each accumulator isolation valve should be verified to be fully open. This verification ensures that the accumulators are available for injection and ensures timely discovery if a valve should be less than fully open. If an isolation valve is not fully open, the rate of injection to the RCS would be reduced. Although a motor operated valve position should not change with power removed, a closed valve could result in not meeting accident analyses assumptions. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.5.1.2 and SR 3.5.1.3 Borated water volume and nitrogen cover pressure are verified for each accumulator. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.5.1.4 The boron concentration should be verified to be within required limits for each accumulator since the static design of the accumulators limits the ways in which the concentration can be changed. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. Sampling the affected accumulator within 6 hours after a volume increase of 13 ft3 will identify whether inleakage has caused a reduction in boron concentration to below the required limit. It is not necessary to verify boron concentration if the added water inventory is from the refueling water storage tank (RWST), because the water contained in the RWST is within the accumulator boron concentration requirements. This is consistent with the recommendation of NUREG-1366 (Ref. 4).
| |
| Cook Nuclear Plant Unit 2 B 3.5.1-6 Revision No. 60
| |
| | |
| Accumulators B 3.5.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.5.1.5 Verification that power is removed from each accumulator isolation valve operator when the RCS pressure is 2000 psig ensures that an active failure could not result in the closure of an accumulator motor operated isolation valve. If this were to occur, only two accumulators would be available for injection given a single failure coincident with a LOCA. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR allows power to be supplied to the motor operated isolation valves when RCS pressure is < 2000 psig, thus allowing operational flexibility by avoiding unnecessary delays to manipulate the breakers during plant startups or shutdowns.
| |
| REFERENCES 1. UFSAR, Section 14.3.
| |
| : 2. 10 CFR 50.46.
| |
| : 3. WCAP-15049-A, "Risk-Informed Evaluation of an Extension to Accumulator Completion Times," Rev. 1, April 1999.
| |
| : 4. NUREG-1366, February 1990.
| |
| Cook Nuclear Plant Unit 2 B 3.5.1-7 Revision No. 60
| |
| | |
| ECCS - Operating B 3.5.2 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)
| |
| B 3.5.2 ECCS - Operating BASES BACKGROUND The function of the ECCS is to provide core cooling and negative reactivity to ensure that the reactor core is protected after any of the following accidents:
| |
| : a. Loss of coolant accident (LOCA), coolant leakage greater than the capability of the normal charging system;
| |
| : b. Rupture of a control rod drive mechanism housing (rod cluster control assembly ejection);
| |
| : c. Loss of secondary coolant accident; and
| |
| : d. Steam generator tube rupture (SGTR).
| |
| The addition of negative reactivity is designed primarily for the rupture of a steam pipe accident where primary cooldown could add enough positive reactivity to achieve criticality and return to significant power.
| |
| There are three phases of ECCS operation: injection, cold leg recirculation, and hot leg recirculation. In the injection phase, water is taken from the refueling water storage tank (RWST) and injected into the Reactor Coolant System (RCS) through the cold legs. When sufficient water is removed from the RWST to ensure that enough boron has been added to maintain the reactor subcritical and the containment sumps have enough water to supply the required net positive suction head to the ECCS pumps, suction is switched to the containment sump for cold leg recirculation. Within approximately 7.5 hours, the ECCS flow is shifted to the hot leg recirculation phase to provide a backflush in order to minimize the potential for boron precipitation.
| |
| The ECCS consists of three separate subsystems: centrifugal charging (high head), safety injection (SI) (intermediate head), and residual heat removal (RHR) (low head). Each subsystem consists of two redundant, 100% capacity trains. The ECCS accumulators and the RWST are also part of the ECCS, but are not considered part of an ECCS flow path as described by this LCO.
| |
| The ECCS flow paths consist of piping, valves, heat exchangers, and pumps such that water from the RWST can be injected into the RCS following the accidents described above. The major components of each subsystem are the centrifugal charging pumps, the RHR pumps, heat Cook Nuclear Plant Unit 2 B 3.5.2-1 Revision No. 0
| |
| | |
| ECCS - Operating B 3.5.2 BASES BACKGROUND (continued) exchangers, and the SI pumps. Each of the three subsystems consists of two 100% capacity trains that are interconnected and redundant such that either train is capable of supplying 100% of the flow required to mitigate the accident consequences. This interconnecting and redundant subsystem design provides the operators with the ability to utilize components from opposite trains to achieve the required 100% flow to the core. The ECCS pumps are provided with recirculation lines that ensure each pump can maintain minimum flow requirements when operating at or near shutoff head conditions.
| |
| During the injection phase of LOCA recovery, a suction header supplies water from the RWST to the ECCS pumps. Separate piping supplies each subsystem and each train within the subsystem. The discharge from the centrifugal charging pumps combines prior to entering the boron injection tank (BIT) and then divides again into four supply lines, each of which feeds an injection line to one RCS cold leg. Each of the SI trains, as well as each of the RHR trains, is capable of injecting into the four RCS cold legs. The discharge from the SI pumps combines via two normally open cross tie valves and feeds an injection line to each of the RCS cold legs. The discharges from the RHR pumps are normally cross-tied with both pumps feeding the injection lines (common to the SI injection line) to the four RCS cold legs. Control valves are set to balance the flow to the RCS. This balance ensures sufficient flow to the core to meet the analysis assumptions following a LOCA in one of the RCS cold legs and precludes pump runout.
| |
| For LOCAs that are too small to depressurize the RCS below the shutoff head of the SI pumps, the centrifugal charging pumps supply water until the RCS pressure decreases below the SI pump shutoff head. During this period, the steam generators are used to provide part of the core cooling function.
| |
| During the recirculation phase of LOCA recovery, RHR pump suction is transferred to the containment sump. The RHR pumps then supply the other ECCS pumps. Initially, recirculation is through the same paths as the injection phase. Subsequently, for SI and RHR pumps, recirculation alternates injection between the hot and cold legs. During recirculation, the discharges from the RHR pumps are not cross-tied.
| |
| The centrifugal charging subsystem of the ECCS also functions to supply borated water to the reactor core following increased heat removal events, such as a main steam line break (MSLB). The limiting design conditions occur when the negative moderator temperature coefficient is highly negative, such as at the end of each cycle.
| |
| Cook Nuclear Plant Unit 2 B 3.5.2-2 Revision No. 30
| |
| | |
| ECCS - Operating B 3.5.2 BASES BACKGROUND (continued)
| |
| The ECCS subsystems are actuated upon receipt of an SI signal. The actuation of safeguard loads is accomplished in a programmed time sequence. If offsite power is available, the safeguard loads start in the programmed sequence. If offsite power is not available, the Engineered Safety Feature (ESF) buses shed normal operating loads and are connected to the emergency diesel generators (EDGs). Safeguard loads are then actuated in the programmed time sequence. The time delay associated with diesel starting, sequenced loading, and pump starting determines the time required before pumped flow is available to the core following a LOCA.
| |
| The active ECCS components, along with the passive accumulators, the RWST, and the containment recirculation sump, covered in LCO 3.5.1, "Accumulators," LCO 3.5.4, "Refueling Water Storage Tank (RWST)," and LCO 3.6.15, Containment Recirculation Sump, provide the cooling water necessary to meet Plant Specific Design Criteria 37, 41, and 44 (Ref. 1).
| |
| APPLICABLE The LCO helps to ensure that the following acceptance criteria for the SAFETY ECCS, established by 10 CFR 50.46 (Ref. 2), will be met following a ANALYSES LOCA:
| |
| : a. Maximum fuel element cladding temperature is 2200°F;
| |
| : b. Maximum cladding oxidation is 0.17 times the total cladding thickness before oxidation;
| |
| : c. Maximum hydrogen generation from a zirconium water reaction is 0.01 times the hypothetical amount generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react;
| |
| : d. Core is maintained in a coolable geometry; and
| |
| : e. Adequate long term core cooling capability is maintained.
| |
| The LCO also limits the magnitude of the post trip return to power following an MSLB event and ensures that containment temperature limits are met.
| |
| Each ECCS subsystem is taken credit for in a large break LOCA event at full power (Ref. 3). This event establishes the requirement for runout flow for the ECCS pumps, as well as the maximum response time for their actuation. The centrifugal charging pumps and SI pumps are credited in a small break LOCA event (Ref. 4). This event establishes the required flow and discharge head at the design point for the centrifugal charging Cook Nuclear Plant Unit 2 B 3.5.2-3 Revision No. 81
| |
| | |
| ECCS - Operating B 3.5.2 BASES APPLICABLE SAFETY ANALYSES (continued) pumps. The SGTR (Ref. 5) and MSLB (Ref. 6) events also credit the centrifugal charging pumps. The OPERABILITY requirements for the ECCS are based on the following LOCA analysis assumptions:
| |
| : a. A large break LOCA event, with loss of offsite power and a single failure disabling one ECCS train (both EDG trains are assumed to operate due to requirements for modeling full active containment heat removal system operation); and
| |
| : b. A small break LOCA event, with a loss of offsite power and a single failure disabling one ECCS train.
| |
| During the blowdown stage of a large break LOCA, the RCS depressurizes as primary coolant is ejected through the break into the containment. The nuclear reaction is terminated either by moderator voiding during large breaks or control rod insertion for small breaks.
| |
| Following depressurization, emergency cooling water is injected into the cold legs, flows into the downcomer, fills the lower plenum, and refloods the core.
| |
| The effects on containment mass and energy releases are accounted for in appropriate analyses (Ref. 7). The LCO ensures that an ECCS train will deliver sufficient water to match boiloff rates soon enough to minimize the consequences of the core being uncovered following a large break LOCA. It also ensures that the centrifugal charging and SI pumps will deliver sufficient water and boron during a small break LOCA to maintain core subcriticality. For smaller LOCAs, the centrifugal charging pump delivers sufficient fluid to maintain RCS inventory. For a small break LOCA, the steam generators continue to serve as the heat sink, providing part of the required core cooling.
| |
| ECCS - Operating satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO In MODES 1, 2, and 3, two independent (and redundant) ECCS trains are required to ensure that sufficient ECCS flow is available, assuming a single failure affecting either ECCS train. Additionally, individual components within the ECCS trains may be called upon to mitigate the consequences of other transients and accidents.
| |
| In MODES 1, 2, and 3, an ECCS train consists of a centrifugal charging subsystem, an SI subsystem, and an RHR subsystem. Each ECCS train includes the piping, instruments, and controls to ensure an OPERABLE flow path capable of taking suction from the RWST upon an SI signal and manually transferring suction to the containment sump.
| |
| Cook Nuclear Plant Unit 2 B 3.5.2-4 Revision No. 0
| |
| | |
| ECCS - Operating B 3.5.2 BASES LCO (continued)
| |
| During an event requiring ECCS actuation, a flow path is required to provide an abundant supply of water from the RWST to the RCS via the ECCS pumps and their respective supply headers to each of the four cold leg injection nozzles. In the long term, this flow path may be switched to take its supply from the containment sump and to supply its flow to the RCS hot and cold legs. Management of gas voids is important to ECCS OPERABILITY.
| |
| The flow path for each ECCS train must maintain its designed independence to ensure that no single failure can disable both ECCS trains.
| |
| APPLICABILITY In MODES 1, 2, and 3, the ECCS OPERABILITY requirements for the limiting Design Basis Accident, a large break LOCA, are based on full power operation. Although reduced power would not require the same level of performance, the accident analysis does not provide for reduced cooling requirements in the lower MODES. MODE 2 and MODE 3 requirements are bounded by the MODE 1 analysis.
| |
| This LCO is only applicable in MODE 3 and above. Below MODE 3, the SI signal setpoint is allowed to be manually bypassed by operator control, and system functional requirements are relaxed as described in LCO 3.5.3, "ECCS - Shutdown."
| |
| In MODES 5 and 6, unit conditions are such that the probability of an event requiring ECCS injection is extremely low.
| |
| ACTIONS A.1 With one or more ECCS trains inoperable and at least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train available, the inoperable components must be returned to OPERABLE status within 72 hours. The 72 hour Completion Time is based on an NRC reliability evaluation (Ref. 8) and is a reasonable time for repair of many ECCS components.
| |
| An ECCS train is inoperable if it is not capable of delivering minimum required flow to the RCS. Individual components are inoperable if they are not capable of performing their design function or supporting systems are not available.
| |
| The LCO requires the OPERABILITY of a number of independent subsystems. Due to the redundancy of ECCS trains and the diversity of subsystems, the inoperability of one active component in an ECCS train does not render the ECCS incapable of performing its function. Neither does the inoperability of two different components, each in a different ECCS train, necessarily result in a loss of function for the ECCS.
| |
| Cook Nuclear Plant Unit 2 B 3.5.2-5 Revision No. 57
| |
| | |
| ECCS - Operating B 3.5.2 BASES ACTIONS (continued)
| |
| This allows increased flexibility in unit operations under circumstances when components in opposite ECCS trains are inoperable.
| |
| Closure of the cross-tie valves in the RHR system or the cross-tie valves in the SI system affects the ability of the affected system to accommodate a single failure and still accomplish its safety function. To support LOCA analysis assumptions, an RHR system train and an SI system train must be capable of delivering the required flow to all four RCS loops for the train to accomplish its safety function, i.e., to be considered OPERABLE.
| |
| The piping arrangement is such that closure of an RHR or SI system cross-tie valve will result in each train of the affected system delivering flow to only two RCS loops. Therefore, the closure of one or more of the RHR cross-tie valves, or one or more of the SI cross-tie valves, renders both trains of the affected system inoperable. If both pumps in the affected system are OPERABLE when one or more cross-tie valves are closed, at least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train will still be provided, and the system safety function will be accomplished. Operation in this condition is limited by Action A.1 to 72 hours because a subsequent single failure of a pump in the affected system will result in flow to only two RCS loops, and the system safety function would be lost.
| |
| An event accompanied by a loss of offsite power and the failure of an EDG can disable one ECCS train until power is restored. A reliability analysis (Ref. 8) has shown that the impact of having one full ECCS train inoperable is sufficiently small to justify continued operation for 72 hours.
| |
| B.1 and B.2 If the inoperable ECCS train(s) cannot be returned to OPERABLE status within the associated Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to MODE 3 within 6 hours and MODE 4 within 12 hours.
| |
| The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| C.1 Condition A is applicable with one or more ECCS trains inoperable. The allowed Completion Time of Required Action A.1 is based on the assumption that at least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train is available. An inoperable RHR or SI pump concurrent with a closed cross-tie valve in the affected system will result in less than 100% of the ECCS flow equivalent to a single OPERABLE ECCS train because there will be flow to only two RCS loops. With less than 100% of the ECCS flow equivalent to a single OPERABLE ECCS Cook Nuclear Plant Unit 2 B 3.5.2-6 Revision No. 44
| |
| | |
| ECCS - Operating B 3.5.2 BASES ACTIONS (continued) train available, the facility is in a condition outside of the accident analyses. Therefore, LCO 3.0.3 must be entered immediately.
| |
| SURVEILLANCE SR 3.5.2.1 REQUIREMENTS Verification of proper valve position ensures that the flow path from the ECCS pumps to the RCS is maintained. Misalignment of these valves could render both ECCS trains inoperable. Securing these valves in position by locking out control power ensures that they cannot change position as a result of an active failure or be inadvertently misaligned.
| |
| These valves are of the type, described in Reference 9, that can disable the function of both ECCS trains and invalidate the accident analyses.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program SR 3.5.2.2 Verifying the correct alignment for manual, power operated, and automatic valves in the ECCS flow paths provides assurance that the proper flow paths will exist for ECCS operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these were verified to be in the correct position prior to locking, sealing, or securing. This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves. A valve that receives an actuation signal is allowed to be in a nonaccident position provided the valve will automatically reposition within the proper stroke time. This Surveillance does not require any testing or valve manipulation. Rather, it involves verification that those valves capable of being mispositioned are in the correct position. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| The Surveillance is modified by a Note which exempts system vent flow paths opened under administrative control. The administrative control should be proceduralized and include stationing a dedicated individual at the system vent flow path who is in continuous communication with the operators in the control room. This individual will have a method to rapidly close the system vent flow path if directed.
| |
| SR 3.5.2.3 Verifying that each ECCS pump's developed head at the flow test point is greater than or equal to the required developed head ensures that ECCS Cook Nuclear Plant Unit 2 B 3.5.2-7 Revision No. 60
| |
| | |
| ECCS - Operating B 3.5.2 BASES SURVEILLANCE REQUIREMENTS (continued) pump performance has not degraded to an unacceptable level during the cycle. Flow and differential head are normal tests of ECCS pump performance required by the ASME OM Code (Ref. 10). Since the ECCS pumps cannot be tested with flow through the normal ECCS flow paths, they are tested on recirculation flow (RHR and SI pumps) or normal charging flow path (centrifugal charging pumps). This test confirms one point on the pump design curve and is indicative of overall performance.
| |
| Such inservice tests confirm component OPERABILITY and detect incipient failures by indicating abnormal performance. The Frequency of this SR is in accordance with the INSERVICE TESTING PROGRAM.
| |
| SR 3.5.2.4 and SR 3.5.2.5 These Surveillances demonstrate that each automatic ECCS valve actuates to the required position on an actual or simulated SI signal and that each ECCS pump starts on receipt of an actual or simulated SI signal. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.5.2.6 Proper throttle valve position is necessary for proper ECCS performance.
| |
| These valves have stops to allow proper positioning for restricted flow to a ruptured cold leg, ensuring that the other cold legs receive at least the required minimum flow. This Surveillance verifies the mechanical stop of each listed ECCS throttle valve is in the correct position. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.5.2.7 DELETED Cook Nuclear Plant Unit 2 B 3.5.2-8 Revision No. 81
| |
| | |
| ECCS - Operating B 3.5.2 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.5.2.8 ECCS piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the ECCS and may also prevent water hammer, pump cavitation, and pumping of noncondensible gas into the reactor vessel.
| |
| Selection of ECCS locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.
| |
| The ECCS is OPERABLE when it is sufficiently filled with water.
| |
| Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criterion for gas volume at the suction or discharge of a pump), the Surveillance is not met. If it is determined by subsequent evaluation that the ECCS is not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water), the Surveillance may be declared met. Accumulated gas should be eliminated or brought within the acceptance criteria limits.
| |
| ECCS locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative sub-set of susceptible locations. Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety.
| |
| Cook Nuclear Plant Unit 2 B 3.5.2-9 Revision No. 57
| |
| | |
| ECCS - Operating B 3.5.2 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| For these locations, alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location.
| |
| Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES
| |
| : 1. UFSAR, Section 1.4.7.
| |
| : 2. 10 CFR 50.46.
| |
| : 3. UFSAR, Section 14.3.1.
| |
| : 4. UFSAR, Section 14.3.2.
| |
| : 5. UFSAR, Section 14.2.4.
| |
| : 6. UFSAR, Section 14.2.5.
| |
| : 7. UFSAR, Section 14.3.4.
| |
| : 8. NRC Memorandum to V. Stello, Jr., from R.L. Baer, "Recommended Interim Revisions to LCOs for ECCS Components,"
| |
| December 1, 1975.
| |
| : 9. IE Information Notice No. 87-01.
| |
| : 10. ASME, Operations and Maintenance Standards and Guides (OM Codes).
| |
| Cook Nuclear Plant Unit 2 B 3.5.2-10 Revision No. 60
| |
| | |
| ECCS - Shutdown B 3.5.3 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)
| |
| B 3.5.3 ECCS - Shutdown BASES BACKGROUND The Background section for Bases 3.5.2, "ECCS - Operating," as it describes the design of the ECCS, is applicable to these Bases, with the following modifications.
| |
| In MODE 4, the required ECCS train consists of two separate subsystems: centrifugal charging (high head) and residual heat removal (RHR) (low head).
| |
| The ECCS flow paths consist of piping, valves, heat exchangers, and pumps such that water from the refueling water storage tank (RWST) and the containment recirculation sump can be injected into the Reactor Coolant System (RCS) following the accidents described in Bases 3.5.2.
| |
| APPLICABLE The Cook Nuclear Plant Licensing Basis does not require performance of SAFETY an analysis to determine the effects of a Loss of Coolant Accident (LOCA)
| |
| ANALYSES occurring in MODE 4, nor does it require an analysis to prove ECCS equipment capability to mitigate a MODE 4 LOCA. However, these Technical Specifications require certain ECCS subsystems to be OPERABLE in MODE 4 to ensure sufficient ECCS flow is available to the core and adequate core cooling is maintained following a MODE 4 LOCA.
| |
| Due to the stable conditions associated with operation in MODE 4 and the reduced probability of occurrence of a Design Basis Accident (DBA), the ECCS operational requirements are reduced. It is understood in these reductions that automatic safety injection (SI) actuation is not available.
| |
| In this MODE, sufficient time exists for manual actuation of the required ECCS to mitigate the consequences of a DBA.
| |
| Only one train of ECCS is required for MODE 4. This requirement dictates that single failures are not considered during this MODE of operation.
| |
| ECCS - Shutdown satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO In MODE 4, one of the two independent (and redundant) ECCS trains is required to be OPERABLE to ensure that sufficient ECCS flow is available to the core following a DBA.
| |
| In MODE 4, an ECCS train consists of a centrifugal charging subsystem and an RHR subsystem. Each train includes the piping, instruments, and controls to ensure an OPERABLE flow path capable of taking suction from the RWST and transferring suction to the containment sump.
| |
| Cook Nuclear Plant Unit 2 B 3.5.3-1 Revision No. 81
| |
| | |
| ECCS - Shutdown B 3.5.3 BASES LCO (continued)
| |
| During an event requiring ECCS actuation, a flow path is required to provide an abundant supply of water from the RWST to the RCS via the ECCS pumps and their respective supply headers to each of the four cold leg injection nozzles. In the long term, this flow path may be switched to take its supply from the containment sump and to deliver its flow to the RCS hot and cold legs. Management of gas voids is important to ECCS OPERABILITY.
| |
| APPLICABILITY In MODES 1, 2, and 3, the OPERABILITY requirements for ECCS are covered by LCO 3.5.2.
| |
| In MODE 4 with RCS temperature below 350°F, one OPERABLE ECCS train is acceptable without single failure consideration, on the basis of the stable reactivity of the reactor and the limited core cooling requirements.
| |
| In MODES 5 and 6, unit conditions are such that the probability of an event requiring ECCS injection is extremely low.
| |
| ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable ECCS centrifugal charging subsystem when entering MODE 4. There is an increased risk associated with entering MODE 4 from MODE 5 with an inoperable ECCS centrifugal charging subsystem and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.
| |
| A.1 With no ECCS RHR subsystem OPERABLE, the unit is not prepared to respond to a loss of coolant accident or to continue a cooldown using the RHR pumps and heat exchangers. The Completion Time of immediately to initiate actions that would restore at least one ECCS RHR subsystem to OPERABLE status ensures that prompt action is taken to restore the required cooling capacity.
| |
| With both RHR subsystems inoperable, it would be unwise to require the plant to go to MODE 5, where the only available heat removal system is the RHR. Therefore, the appropriate action is to initiate measures to restore one ECCS RHR subsystem and to continue the actions until the subsystem is restored to OPERABLE status.
| |
| Cook Nuclear Plant Unit 2 B 3.5.3-2 Revision No. 57
| |
| | |
| ECCS - Shutdown B 3.5.3 BASES ACTIONS (continued)
| |
| B.1 With no ECCS centrifugal charging subsystem OPERABLE, the unit is not prepared to provide high pressure response to Design Basis Events requiring SI. The 1 hour Completion Time to restore at least one ECCS centrifugal charging subsystem to OPERABLE status ensures that prompt action is taken to provide the required cooling capacity.
| |
| C.1 When the Required Action of Condition B cannot be completed within the required Completion Time, the unit should be placed in MODE 5.
| |
| Twenty-four hours is a reasonable time, based on operating experience, to reach MODE 5 in an orderly manner and without challenging unit systems or operators.
| |
| SURVEILLANCE SR 3.5.3.1 REQUIREMENTS The applicable Surveillance descriptions from Bases 3.5.2 apply.
| |
| However, a Note has been added that allows the acceptance criteria of SR 3.5.2.2 to be modified. The Note allows valves to not be in the correct position (i.e., in the nonaccident position and not capable of being automatically repositioned within the assumed time), provided the valves can be aligned to the correct position (e.g., using the valve control switches). This is acceptable since automatic actuation of the ECCS train is not required in MODE 4.
| |
| REFERENCES None.
| |
| Cook Nuclear Plant Unit 2 B 3.5.3-3 Revision No. 0
| |
| | |
| RWST B 3.5.4 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)
| |
| B 3.5.4 Refueling Water Storage Tank (RWST)
| |
| BASES BACKGROUND The RWST supplies borated water to the Chemical and Volume Control System (CVCS) during normal and abnormal operating conditions, to the refueling pool during refueling, and to the ECCS and the Containment Spray System during accident conditions.
| |
| The RWST supplies both trains of the ECCS and the Containment Spray System through a common supply header during the injection phase of a loss of coolant accident (LOCA) recovery. Separate piping off the common supply header supplies each ECCS subsystem and each containment spray subsystem. Motor operated isolation valves are provided (a common motor operated isolation valve for the safety injection pumps, an individual motor operated isolation valve for each residual heat removal pump, and two common motor operated isolation valves for the centrifugal charging pumps) to isolate the RWST from the ECCS once the system has been transferred to the recirculation mode.
| |
| The recirculation mode is entered when pump suction is manually transferred to the containment sump after sufficient water has been transferred from the RWST to the containment recirculation sump. Use of a single RWST to supply both trains of the ECCS and Containment Spray System is acceptable since the RWST is a passive component, and passive failures are not required to be assumed to occur during the injection phase of ECCS operation.
| |
| The switchover from normal operation to the injection phase of ECCS operation requires changing centrifugal charging pump suction from the CVCS volume control tank (VCT) to the RWST through the use of isolation valves. The isolation valves are interlocked so that the VCT isolation valves will begin to close once either of the RWST isolation valves is fully open. Since the VCT is under pressure, the preferred pump suction will be from the VCT until the tank is isolated. This will result in a delay in obtaining the RWST borated water. The effects of this delay are discussed in the Applicable Safety Analyses section of these Bases.
| |
| During normal operation in MODES 1, 2, and 3, the safety injection (SI) and residual heat removal (RHR) pumps are aligned to take suction from the RWST.
| |
| When the suction for the ECCS and Containment Spray System pumps is transferred to the containment sump, the RWST flow paths must be isolated to prevent a release of the containment sump contents to the Cook Nuclear Plant Unit 2 B 3.5.4-1 Revision No. 0
| |
| | |
| RWST B 3.5.4 BASES BACKGROUND (continued)
| |
| RWST, which could result in a release of contaminants to the atmosphere and the eventual loss of suction head for the ECCS pumps.
| |
| This LCO ensures that:
| |
| : a. The RWST contains sufficient borated water to support the ECCS during the injection phase;
| |
| : b. Sufficient water volume exists in the containment sump to support continued operation of the ECCS and Containment Spray System pumps at the time of transfer to the recirculation mode of cooling; and
| |
| : c. The reactor remains subcritical following a LOCA.
| |
| Insufficient water in the RWST could result in insufficient cooling capacity when the transfer to the recirculation mode occurs. Improper boron concentrations could result in a reduction of SDM or excessive boric acid precipitation in the core following the LOCA, as well as excessive caustic stress corrosion of mechanical components and systems inside the containment.
| |
| APPLICABLE During accident conditions, the RWST provides a source of borated water SAFETY to the ECCS and Containment Spray System pumps. As such, it ANALYSES provides containment cooling and depressurization, core cooling, and replacement inventory and is a source of negative reactivity for reactor shutdown (Refs. 1 and 2). The design basis transients and applicable safety analyses concerning each of these systems are discussed in the Applicable Safety Analyses section of B 3.5.2, "ECCS - Operating,"
| |
| B 3.5.3, "ECCS - Shutdown," and B 3.6.6, "Containment Spray System."
| |
| These analyses are used to assess changes to the RWST in order to evaluate their effects in relation to the acceptance limits in the analyses.
| |
| The RWST must also meet volume, boron concentration, and temperature requirements for non-LOCA events. The volume is not an explicit assumption in non-LOCA events since the required volume is a small fraction of the available volume. The deliverable volume limit is set by the LOCA and containment analyses. For the RWST, the deliverable volume is different from the total volume contained since, due to the design of the tank, more water can be contained than can be delivered.
| |
| The minimum boron concentration is an explicit assumption in the main steam line break (MSLB) analysis to ensure the required shutdown capability. The minimum boron concentration limit is an important assumption in ensuring the required shutdown capability. The minimum boron concentration is an explicit assumption in the inadvertent ECCS Cook Nuclear Plant Unit 2 B 3.5.4-2 Revision No. 0
| |
| | |
| RWST B 3.5.4 BASES APPLICABLE SAFETY ANALYSES (continued) actuation analysis. The minimum RWST temperature is an assumption in the inadvertent ECCS actuation analysis, although the inadvertent ECCS actuation event is typically nonlimiting. An RWST temperature more conservative (i.e., a lower RWST temperature) than the minimum RWST temperature is assumed in the MSLB analysis.
| |
| The MSLB analysis has considered a delay associated with the interlock between the VCT and RWST isolation valves, and the results show that the departure from nucleate boiling design basis is met. The delay has been established as 27 seconds, with offsite power available, or 37 seconds without offsite power.
| |
| For a large break LOCA analysis, the minimum water volume limit of 375,500 gallons and the lower boron concentration limit of 2400 ppm are used to compute the post LOCA sump boron concentration necessary to assure subcriticality. The large break LOCA is the limiting case since the safety analysis assumes that all control rods are out of the core, except during hot leg switchover.
| |
| The upper limit on boron concentration of 2600 ppm is used to determine the maximum allowable time to switch to hot leg recirculation following a LOCA. The purpose of switching from cold leg to hot leg injection is to minimize the potential for boron precipitation in the core following the accident.
| |
| In the ECCS and containment analyses, the containment spray temperature is assumed to be greater than the RWST upper temperature limit of 100°F. Maintaining RWST water temperature 100°F ensures the Containment Spray System will provide sufficient pressure suppression capability to limit the containment peak pressure transient to less than the containment design internal pressure, and that containment cooling will be maintained following a LOCA or MSLB. The lower temperature limit of 70°F is assumed in the ECCS analysis to determine the FQ(Z) limit. This temperature determines the Containment Spray System water temperature delivered to the containment following a LOCA. It is one of the factors that determines the containment backpressure in the ECCS analyses. For the containment response following an MSLB, the lower limit on boron concentration and a conservative value with respect to the upper limit on RWST water temperature are used to maximize the total energy release to containment.
| |
| The RWST satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| Cook Nuclear Plant Unit 2 B 3.5.4-3 Revision No. 0
| |
| | |
| RWST B 3.5.4 BASES LCO The RWST ensures that an adequate supply of borated water is available to cool and depressurize the containment in the event of a Design Basis Accident (DBA), to cool and cover the core in the event of a LOCA, to maintain the reactor subcritical following a DBA, and to ensure adequate level in the containment sump to support ECCS and Containment Spray System pump operation in the recirculation mode.
| |
| To be considered OPERABLE, the RWST must meet the water volume, boron concentration, and temperature limits established in the SRs.
| |
| APPLICABILITY In MODES 1, 2, 3, and 4, RWST OPERABILITY requirements are dictated by ECCS and Containment Spray System OPERABILITY requirements. Since both the ECCS and the Containment Spray System must be OPERABLE in MODES 1, 2, 3, and 4, the RWST must also be OPERABLE to support their operation. In MODES 5 and 6, unit conditions are such that the probability of an event requiring ECCS injection is extremely low.
| |
| ACTIONS A.1 With RWST boron concentration or borated water temperature not within limits, they must be returned to within limits within 8 hours. Under these conditions neither the ECCS nor the Containment Spray System can perform its design function. Therefore, prompt action must be taken to restore the RWST to OPERABLE condition. The 8 hour limit to restore the RWST temperature or boron concentration to within limits was developed considering the time required to change either the boron concentration or temperature and the fact that the contents of the tank are still available for injection.
| |
| B.1 With the RWST inoperable for reasons other than Condition A (e.g., water volume), it must be restored to OPERABLE status within 1 hour.
| |
| In this condition, neither the ECCS nor the Containment Spray System can perform its design function. Therefore, prompt action must be taken to restore the RWST to OPERABLE status. The short time limit of 1 hour to restore the RWST to OPERABLE status is based on this condition simultaneously affecting redundant trains.
| |
| C.1 and C.2 If the RWST cannot be returned to OPERABLE status within the associated Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be Cook Nuclear Plant Unit 2 B 3.5.4-4 Revision No. 0
| |
| | |
| RWST B 3.5.4 BASES ACTIONS (continued) brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| SURVEILLANCE SR 3.5.4.1 REQUIREMENTS The RWST borated water temperature should be verified. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.5.4.2 The RWST water volume should be verified to be above the required minimum level in order to ensure that a sufficient initial supply is available for injection and to support continued ECCS and Containment Spray System pump operation on recirculation. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.5.4.3 The boron concentration of the RWST should be verified to be within the required limits. This SR ensures that the reactor will remain subcritical following a LOCA. Further, it assures that the resulting sump pH will be maintained in an acceptable range so that boron precipitation in the core will not occur and the effect of chloride and caustic stress corrosion on mechanical systems and components will be minimized. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 6.2.2.
| |
| : 2. UFSAR, Section 14.3.
| |
| Cook Nuclear Plant Unit 2 B 3.5.4-5 Revision No. 60
| |
| | |
| Seal Injection Flow B 3.5.5 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)
| |
| B 3.5.5 Seal Injection Flow BASES BACKGROUND The function of the seal injection throttle valves during an accident is similar to the function of the ECCS throttle valves in that each restricts flow from the centrifugal charging pump header to the Reactor Coolant System (RCS).
| |
| The restriction on reactor coolant pump (RCP) seal injection flow limits the amount of ECCS flow that would be diverted from the injection path following an accident. This limit is based on safety analysis assumptions that are required because RCP seal injection flow is not isolated during safety injection (SI).
| |
| The RCP seal injection flow is restricted by the seal injection line flow resistance which is adjusted through positioning of the manual RCP seal injection throttle valves. The RCP seal injection flow resistance is determined by measuring the pressurizer pressure, the centrifugal charging pump discharge header pressure, and the RCP seal injection flow rate.
| |
| The charging flow control valve throttles the centrifugal charging pump discharge header flow as necessary to maintain the programmed level in the pressurizer. The charging flow control valve fails open to ensure that, in the event of either loss of air or loss of control signal to the valve, when the centrifugal charging pumps are supplying charging flow, seal injection flow to the RCP seals is maintained. Positioning of the charging flow control valve may vary during normal plant operating conditions, resulting in a proportional change to RCP seal injection flow. The flow resistance provided by RCP seal injection throttle valves will remain fixed when the charging flow control valve is repositioned provided the throttle valve(s) position are not adjusted.
| |
| APPLICABLE All ECCS subsystems are taken credit for in the large break loss of SAFETY coolant accident (LOCA) at full power (Ref. 1). The LOCA analysis ANALYSES establishes the minimum flow for the ECCS pumps. The centrifugal charging pumps are also credited in the small break LOCA analysis (Ref. 2). This analysis establishes the flow and discharge head at the design point for the centrifugal charging pumps. The steam generator tube rupture (Ref. 3) and main steam line break event (Ref. 4) analyses also credit the centrifugal charging pumps, but are not limiting in their design. Reference to these analyses is made in assessing changes to the Seal Injection System for evaluation of their effects in relation to the acceptance limits in these analyses.
| |
| Cook Nuclear Plant Unit 2 B 3.5.5-1 Revision No. 0
| |
| | |
| Seal Injection Flow B 3.5.5 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| This LCO ensures that seal injection flow resistance will be sufficient for RCP seal integrity but limited so that the ECCS trains will be capable of delivering sufficient water to match boiloff rates soon enough to minimize uncovering of the core following a large LOCA. It also ensures that the centrifugal charging pumps will deliver sufficient water and boron during a small break LOCA to maintain the core subcritical. For smaller LOCAs, the charging pumps alone deliver sufficient fluid to overcome the loss and maintain RCS inventory.
| |
| Seal Injection Flow satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The intent of the LCO limit on seal injection flow resistance is to make sure that flow through the RCP seal water injection line is low enough to ensure that sufficient centrifugal charging pump injection flow is directed to the RCS via the injection points.
| |
| This is accomplished by limiting the seal injection line resistance to a value consistent with the assumptions in the accident analysis. The limit on RCP seal injection flow resistance must be met to assure that the ECCS is OPERABLE. If this limit is not met, the ECCS flow may not be as assumed in the accident analysis. The restriction on seal injection flow is accomplished by maintaining the seal water injection flow resistance 0.227 ft/gpm2. With the seal injection flow resistance within limit, the resulting total seal injection flow will be within the assumptions made for seal flow during accident conditions.
| |
| In order to establish the proper flow line resistance, the centrifugal charging pump discharge header pressure, the RCP seal injection flow rate, and the pressurizer pressure are measured. The line resistance is then determined from those inputs. A reduction in RCS pressure with no concurrent decrease in centrifugal charging pump discharge header pressure would increase the differential pressure across the manual throttle valves, and result in more flow being discharged through the RCP seal injection line. The flow resistance limit assures that when RCS pressure drops during a LOCA and seal injection flow increases in response to the higher differential pressure, the resulting flow will be consistent with the accident analysis.
| |
| The limit on seal injection flow resistance must be met to render the ECCS OPERABLE. If these conditions are not met, the ECCS flow will not be as assumed in the accident analyses.
| |
| Cook Nuclear Plant Unit 2 B 3.5.5-2 Revision No. 0
| |
| | |
| Seal Injection Flow B 3.5.5 BASES APPLICABILITY In MODES 1, 2, and 3, the seal injection flow resistance limit is dictated by ECCS flow requirements, which are specified for MODES 1, 2, 3, and 4. The seal injection flow resistance limit is not applicable for MODE 4 and lower, however, because high seal injection flow is less critical as a result of the lower initial RCS pressure and decay heat removal requirements in these MODES. Therefore, RCP seal injection flow resistance must be limited in MODES 1, 2, and 3 to ensure adequate ECCS performance.
| |
| ACTIONS A.1 With the seal injection flow resistance not within its limit, the amount of charging flow available to the RCS may be reduced. Under this condition, action must be taken to restore the flow resistance to within its limit. The operator has 4 hours from the time the flow resistance is known to not be within the limit to correctly position the manual valves and thus be in compliance with the accident analysis. The Completion Time minimizes the potential exposure of the unit to a LOCA with insufficient injection flow and provides a reasonable time to restore seal injection flow resistance within limits. This time is conservative with respect to the Completion Times of other ECCS LCOs; it is based on operating experience and is sufficient for taking corrective actions by operations personnel.
| |
| B.1 and B.2 When the Required Actions cannot be completed within the required Completion Time, a controlled shutdown must be initiated. The Completion Time of 6 hours for reaching MODE 3 from MODE 1 is a reasonable time for a controlled shutdown, based on operating experience and normal cooldown rates, and does not challenge plant safety systems or operators. Continuing the plant shutdown begun in Required Action B.1, an additional 6 hours is a reasonable time, based on operating experience and normal cooldown rates, to reach MODE 4, where this LCO is no longer applicable.
| |
| SURVEILLANCE SR 3.5.5.1 REQUIREMENTS Verification that the seal injection flow resistance is within the limit ensures that the ECCS injection flows stay within the safety analysis. A differential pressure is established between the charging header and the RCS, and the total seal injection flow is verified to be within the limit determined in accordance with the ECCS safety analysis. The flow resistance shall be 0.227 ft/gpm2.
| |
| Cook Nuclear Plant Unit 2 B 3.5.5-3 Revision No. 60
| |
| | |
| Seal Injection Flow B 3.5.5 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| The seal injection flow resistance, RSL, is determined from the following expression:
| |
| RSL = 2.31(PCHP-PSI)/Q2 where:
| |
| PCHP = charging pump header pressure (psig);
| |
| PSI = 2300 psig (high pressure operation); and Q = total seal injection flow (gpm).
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| As noted, the Surveillance is not required to be performed until 4 hours after the pressurizer pressure has stabilized within a +/- 20 psig range of normal operating pressure. The pressurizer pressure requirement is specified since this configuration will produce the required pressure conditions necessary to assure that the manual valves are set correctly.
| |
| The pressurizer pressure indications are averaged to determine whether the appropriate pressure has been achieved. The exception is limited to 4 hours to ensure that the Surveillance is timely.
| |
| REFERENCES 1. UFSAR, Section 14.3.1.
| |
| : 2. UFSAR, Section 14.3.2.
| |
| : 3. UFSAR, Section 14.2.4.
| |
| : 4. UFSAR, Section 14.2.5.
| |
| Cook Nuclear Plant Unit 2 B 3.5.5-4 Revision No. 60
| |
| | |
| Containment B 3.6.1 B 3.6 CONTAINMENT SYSTEMS B 3.6.1 Containment BASES BACKGROUND The containment is a steel-lined, reinforced concrete structure. The containment structure, including all its penetrations, includes a low leakage steel liner designed to contain the radioactive material that may be released from the reactor core following a design basis loss of coolant accident (LOCA). Additionally, the containment structure provides shielding from the fission products that may be present in the containment atmosphere following accident conditions.
| |
| The containment structure is a reinforced concrete vertical cylinder with a slab base and a hemispherical dome. A welded steel liner (dome, wall, and bottom) is attached to the inside face of the concrete shell, to ensure a high degree of leak tightness. The structure serves as both a biological shield and a pressure container.
| |
| Containment piping penetration assemblies provide for the passage of process, service, sampling, and instrumentation pipelines into the containment structure while maintaining containment integrity.
| |
| The inner steel liner and its penetrations establish the leakage limiting boundary of the containment. Maintaining the containment OPERABLE limits the leakage of fission product radioactivity from the containment to the environment. SR 3.6.1.1 leakage rate requirements comply with 10 CFR 50, Appendix J, Option B (Ref. 1), as modified by approved exemptions.
| |
| The isolation devices for the penetrations in the containment boundary are a part of the containment leak tight barrier. To maintain this leak tight barrier:
| |
| : a. All penetrations required to be closed during accident conditions are either:
| |
| : 1. Capable of being closed by an OPERABLE automatic containment isolation system; or
| |
| : 2. Closed by manual valves, blind flanges, or de-activated automatic valves secured in their closed positions, except as provided in LCO 3.6.3, "Containment Isolation Valves";
| |
| : b. Each air lock is OPERABLE, except as provided in LCO 3.6.2, "Containment Air Locks";
| |
| : c. The equipment hatch is closed; and Cook Nuclear Plant Unit 2 B 3.6.1-1 Revision No. 0
| |
| | |
| Containment B 3.6.1 BASES BACKGROUND (continued)
| |
| : d. The sealing mechanism associated with each containment penetration (e.g., welds, bellows, or O-rings) is OPERABLE (i.e.,
| |
| OPERABLE such that the containment leakage limits are met).
| |
| APPLICABLE The safety design basis for the containment is that the containment must SAFETY withstand the pressures and temperatures of the limiting Design Basis ANALYSES Accident (DBA) without exceeding the design leakage rates.
| |
| The DBAs that result in a challenge to containment OPERABILITY from high pressures and temperatures are a LOCA and a steam line break (Ref. 2). In addition, release of significant fission product radioactivity within containment can occur from a LOCA (Ref. 2) or a rod ejection accident (Ref. 3). In the DBA analyses, it is assumed that the containment is OPERABLE such that, for the DBAs involving release of fission product radioactivity, release to the environment is controlled by the rate of containment leakage. The containment is designed with an allowable leakage rate of 0.18% of containment air weight per day (Ref. 4). This leakage rate, used in the evaluation of offsite doses resulting from accidents, is defined in 10 CFR 50, Appendix J, Option B (Ref. 1), as La: the maximum allowable containment leakage rate at the calculated peak containment internal pressure (Pa) resulting from the limiting design basis LOCA. The allowable leakage rate represented by La forms the basis for the acceptance criteria imposed on all containment leakage rate testing. La is assumed to be 0.18% per day in the safety analysis at Pa = 12 psig (Ref. 4).
| |
| Satisfactory leakage rate test results are a requirement for the establishment of containment OPERABILITY.
| |
| The Containment satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO Containment OPERABILITY is maintained by limiting leakage to 1.0 La, except prior to the first startup after performing a required Containment Leakage Rate Testing Program leakage test. At this time the applicable leakage limits must be met.
| |
| Compliance with this LCO will ensure a containment configuration, including equipment hatches, that is structurally sound and that will limit leakage to those leakage rates assumed in the safety analysis.
| |
| Individual leakage rates specified for the containment air lock (LCO 3.6.2) are not specifically part of the acceptance criteria of 10 CFR 50, Appendix J. Therefore, leakage rates exceeding these individual limits only result in the containment being inoperable when the leakage results in exceeding the overall acceptance criteria of 1.0 La.
| |
| Cook Nuclear Plant Unit 2 B 3.6.1-2 Revision No. 59
| |
| | |
| Containment B 3.6.1 BASES APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material into containment. In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, containment is not required to be OPERABLE in MODE 5 to prevent leakage of radioactive material from containment. The requirements for containment during MODE 6 are addressed in LCO 3.9.3, "Containment Penetrations."
| |
| ACTIONS A.1 In the event containment is inoperable, containment must be restored to OPERABLE status within 1 hour. The 1 hour Completion Time provides a period of time to correct the problem commensurate with the importance of maintaining containment OPERABLE during MODES 1, 2, 3, and 4.
| |
| This time period also ensures that the probability of an accident (requiring containment OPERABILITY) occurring during periods when containment is inoperable is minimal.
| |
| B.1 and B.2 If containment cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| SURVEILLANCE SR 3.6.1.1 REQUIREMENTS Maintaining the containment OPERABLE requires compliance with the visual examinations and leakage rate test requirements of the Containment Leakage Rate Testing Program. Failure to meet air lock leakage limits specified in LCO 3.6.2 does not invalidate the acceptability of these overall leakage determinations unless their contribution to overall Type A, B, and C leakage causes that to exceed limits. As left leakage prior to the first startup after performing a required Containment Leakage Rate Testing Program leakage test is required to be 0.6 La for combined Type B and C leakage, and 0.75 La for overall Type A leakage. At all other times between required leakage rate tests, the acceptance criteria is based on an overall Type A leakage limit of 1.0 La. At 1.0 La the offsite dose consequences are bounded by the assumptions of the safety analysis. SR Frequencies are as required by the Containment Leakage Rate Testing Program. These periodic testing requirements verify that the containment leakage rate does not exceed the leakage rate assumed in the safety analysis.
| |
| Cook Nuclear Plant Unit 2 B 3.6.1-3 Revision No. 0
| |
| | |
| Containment B 3.6.1 BASES REFERENCES 1. 10 CFR 50, Appendix J, Option B.
| |
| : 2. UFSAR, Section 14.3.4.
| |
| : 3. UFSAR, Section 14.2.6.
| |
| : 4. UFSAR, Section 5.7.
| |
| Cook Nuclear Plant Unit 2 B 3.6.1-4 Revision No. 0
| |
| | |
| Containment Air Locks B 3.6.2 B 3.6 CONTAINMENT SYSTEMS B 3.6.2 Containment Air Locks BASES BACKGROUND Containment air locks form part of the containment pressure boundary and provide a means for personnel access during all MODES of operation.
| |
| Each air lock is nominally a right circular cylinder, approximately 10 ft in diameter, with a door at each end. The doors are interlocked to prevent simultaneous opening. During periods when containment is not required to be OPERABLE, the door interlock mechanism may be disabled, allowing both doors of an air lock to remain open for extended periods when frequent containment entry is necessary. Each air lock door has been designed and tested to certify its ability to withstand a pressure in excess of the maximum expected pressure following a Design Basis Accident (DBA) in containment. As such, closure of a single door supports containment OPERABILITY. Each of the doors contains double gasketed seals and local leakage rate testing capability to ensure pressure integrity. To effect a leak tight seal, the air lock design uses pressure seated doors (i.e., an increase in containment internal pressure results in increased sealing force on each door).
| |
| Each personnel air lock is provided with limit switches on both doors that provide local indication of door position. Additionally, a control room alarm is provided for each air lock to alert the operator whenever an air lock door is open for greater than approximately 5 minutes.
| |
| The containment air locks form part of the containment pressure boundary. As such, air lock integrity and leak tightness is essential for maintaining the containment leakage rate within limit in the event of a DBA. Not maintaining air lock integrity or leak tightness may result in a leakage rate in excess of that assumed in the unit safety analyses.
| |
| APPLICABLE The DBAs that result in a release of radioactive material within SAFETY containment are a loss of coolant accident and a rod ejection accident ANALYSES (Refs. 1 and 2). In the analysis of each of these accidents, it is assumed that containment is OPERABLE such that release of fission products to the environment is controlled by the rate of containment leakage. The containment is designed with an allowable leakage rate of 0.18% of containment air weight per day (Ref. 3). This leakage rate is defined in 10 CFR 50, Appendix J, Option B (Ref. 4), as La = 0.18% of containment air weight per day, the maximum allowable containment leakage rate at the calculated peak containment internal pressure Pa = 12 psig following Cook Nuclear Plant Unit 2 B 3.6.2-1 Revision No. 59
| |
| | |
| Containment Air Locks B 3.6.2 BASES APPLICABLE SAFETY ANALYSES (continued) a design basis LOCA. This allowable leakage rate forms the basis for the acceptance criteria imposed on the SRs associated with the air locks.
| |
| The Containment Air Locks satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO Each containment air lock forms part of the containment pressure boundary. As part of the containment pressure boundary, the air lock safety function is related to control of the containment leakage rate resulting from a DBA. Thus, each air lock's structural integrity and leak tightness are essential to the successful mitigation of such an event.
| |
| Each air lock is required to be OPERABLE. For the air lock to be considered OPERABLE, the air lock interlock mechanism must be OPERABLE, the air lock must be in compliance with the Type B air lock leakage test, and both air lock doors must be OPERABLE. The interlock allows only one air lock door of an air lock to be opened at one time. This provision ensures that a gross breach of containment does not exist when containment is required to be OPERABLE. Closure of a single door in each air lock is sufficient to provide a leak tight barrier following postulated events. Nevertheless, both doors are kept closed when the air lock is not being used for normal entry into or exit from containment.
| |
| APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment. In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, the containment air locks are not required in MODE 5 to prevent leakage of radioactive material from containment. The requirements for the containment air locks during MODE 6 are addressed in LCO 3.9.3, "Containment Penetrations."
| |
| ACTIONS The ACTIONS are modified by a Note that allows entry and exit to perform repairs on the affected air lock component. If the outer door is inoperable, then it may be easily accessed for most repairs. If repairs on either door must be performed from the barrel side of the door then it is permissible to enter the air lock through the OPERABLE door, which means there is a short time during which the containment boundary is not intact (during access through the OPERABLE door). The ability to open the OPERABLE door, even if it means the containment boundary is temporarily not intact, is acceptable due to the low probability of an event that could pressurize the containment during the short time in which the OPERABLE door is expected to be open. After each entry and exit, the OPERABLE door must be immediately closed.
| |
| Cook Nuclear Plant Unit 2 B 3.6.2-2 Revision No. 0
| |
| | |
| Containment Air Locks B 3.6.2 BASES ACTIONS (continued)
| |
| A second Note has been added to provide clarification that, for this LCO, separate Condition entry is allowed for each air lock. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable air lock. Complying with the Required Actions may allow for continued operation, and a subsequent inoperable air lock is governed by subsequent Condition entry and application of associated Required Actions.
| |
| In the event the air lock leakage results in exceeding the overall containment leakage rate, Note 3 directs entry into the applicable Conditions and Required Actions of LCO 3.6.1, "Containment."
| |
| A.1, A.2, and A.3 With one air lock door in one or more containment air locks inoperable, the OPERABLE door must be verified closed (Required Action A.1) in each affected containment air lock. This ensures that a leak tight containment barrier is maintained by the use of an OPERABLE air lock door. This action must be completed within 1 hour. This specified time period is consistent with the ACTIONS of LCO 3.6.1, which requires containment be restored to OPERABLE status within 1 hour.
| |
| In addition, the affected air lock penetration must be isolated by locking closed the OPERABLE air lock door within the 24 hour Completion Time.
| |
| The 24 hour Completion Time is reasonable for locking the OPERABLE air lock door, considering the OPERABLE door of the affected air lock is being maintained closed.
| |
| Required Action A.3 verifies that an air lock with an inoperable door has been isolated by the use of a locked and closed OPERABLE air lock door. This ensures that an acceptable containment leakage boundary is maintained. The Completion Time of once per 31 days is based on engineering judgment and is considered adequate in view of the low likelihood of a locked door being mispositioned and other administrative controls. Required Action A.3 is modified by a Note that applies to air lock doors located in high radiation areas and allows these doors to be verified locked closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of the door, once it has been verified to be in the proper position, is small.
| |
| Cook Nuclear Plant Unit 2 B 3.6.2-3 Revision No. 0
| |
| | |
| Containment Air Locks B 3.6.2 BASES ACTIONS (continued)
| |
| The Required Actions have been modified by two Notes. Note 1 ensures that only the Required Actions and associated Completion Times of Condition C are required if both doors in the same air lock are inoperable.
| |
| With both doors in the same air lock inoperable, an OPERABLE door is not available to be closed. Required Actions C.1 and C.2 are the appropriate remedial actions. The exception of Note 1 does not affect tracking the Completion Time from the initial entry into Condition A; only the requirement to comply with the Required Actions. Note 2 allows use of the air lock for entry and exit for 7 days under administrative controls if both air locks have an inoperable door. This 7 day restriction begins when the second air lock is discovered inoperable. Containment entry may be required on a periodic basis to perform Technical Specifications (TS) Surveillances and Required Actions, as well as other activities on equipment inside containment that are required by TS or activities on equipment that support TS-required equipment. This Note is not intended to preclude performing other activities (i.e., non-TS required activities) if the containment is entered, using the inoperable air lock, to perform an allowed activity listed above. This allowance is acceptable due to the low probability of an event that could pressurize the containment during the short time that the OPERABLE door is expected to be open.
| |
| B.1, B.2, and B.3 With an air lock interlock mechanism inoperable in one or more air locks, the Required Actions and associated Completion Times are consistent with those specified in Condition A.
| |
| The Required Actions have been modified by two Notes. Note 1 ensures that only the Required Actions and associated Completion Times of Condition C are required if both doors in the same air lock are inoperable.
| |
| With both doors in the same air lock inoperable, an OPERABLE door is not available to be closed. Required Actions C.1 and C.2 are the appropriate remedial actions. Note 2 allows entry into and exit from containment under the control of a dedicated individual stationed at the air lock to ensure that only one door is opened at a time (i.e., the individual performs the function of the interlock).
| |
| Required Action B.3 is modified by an additional Note that applies to air lock doors located in high radiation areas and allows these doors to be verified locked closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of the door, once it has been verified to be in the proper position, is small.
| |
| Cook Nuclear Plant Unit 2 B 3.6.2-4 Revision No. 0
| |
| | |
| Containment Air Locks B 3.6.2 BASES ACTIONS (continued)
| |
| C.1, C.2, and C.3 With one or more air locks inoperable for reasons other than those described in Condition A or B, Required Action C.1 requires action to be initiated immediately to evaluate previous combined leakage rates using current air lock test results. An evaluation is acceptable, since it is overly conservative to immediately declare the containment inoperable if both doors in an air lock have failed a seal test or if the overall air lock leakage is not within limits. In many instances (e.g., only one seal per door has failed), containment remains OPERABLE, yet only 1 hour (per LCO 3.6.1) would be provided to restore the air lock door to OPERABLE status prior to requiring a unit shutdown. In addition, even with both doors failing the seal test, the overall containment leakage rate can still be within limits.
| |
| Required Action C.2 requires that one door in the affected containment air lock must be verified to be closed within the 1 hour Completion Time.
| |
| This specified time period is consistent with the ACTIONS of LCO 3.6.1, which requires that containment be restored to OPERABLE status within 1 hour.
| |
| Additionally, the affected air lock(s) must be restored to OPERABLE status within the 24 hour Completion Time. The specified time period is considered reasonable for restoring an inoperable air lock to OPERABLE status, assuming that at least one door is maintained closed in each affected air lock.
| |
| D.1 and D.2 If any Required Action and associated Completion Time is not met, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| SURVEILLANCE SR 3.6.2.1 REQUIREMENTS Maintaining containment air locks OPERABLE requires compliance with the leakage rate test requirements of the Containment Leakage Rate Testing Program. This SR reflects the leakage rate testing requirements with regard to air lock leakage (Type B leakage tests). The acceptance criteria were established during initial air lock and containment OPERABILITY testing. The periodic testing requirements verify that the Cook Nuclear Plant Unit 2 B 3.6.2-5 Revision No. 0
| |
| | |
| Containment Air Locks B 3.6.2 BASES SURVEILLANCE REQUIREMENTS (continued) air lock leakage does not exceed the allowed fraction of the overall containment leakage rate. The Frequency is required by the Containment Leakage Rate Testing Program.
| |
| The SR has been modified by two Notes. Note 1 states that an inoperable air lock door does not invalidate the previous successful performance of the overall air lock leakage test. This is considered reasonable since either air lock door is capable of providing a fission product barrier in the event of a DBA. Note 2 has been added to this SR requiring the results to be evaluated against the acceptance criteria which is applicable to SR 3.6.1.1. This ensures that air lock leakage is properly accounted for in determining the combined Type B and C containment leakage rate.
| |
| SR 3.6.2.2 The air lock interlock is designed to prevent simultaneous opening of both doors in a single air lock. Since both the inner and outer doors of an air lock are designed to withstand the maximum expected post accident containment pressure, closure of either door will support containment OPERABILITY. Thus, the door interlock feature supports containment OPERABILITY while the air lock is being used for personnel transit in and out of the containment. Periodic testing of this interlock demonstrates that the interlock will function as designed and that simultaneous opening of the inner and outer doors will not inadvertently occur. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 14.3.4.
| |
| : 2. UFSAR, Section 14.2.6.
| |
| : 3. UFSAR, Section 5.7.
| |
| : 4. 10 CFR 50, Appendix J, Option B.
| |
| Cook Nuclear Plant Unit 2 B 3.6.2-6 Revision No. 60
| |
| | |
| Containment Isolation Valves B 3.6.3 B 3.6 CONTAINMENT SYSTEMS B 3.6.3 Containment Isolation Valves BASES BACKGROUND The containment isolation valves form part of the containment pressure boundary and provide a means for fluid penetrations not serving accident consequence limiting systems to be provided with two isolation barriers that are closed on a containment isolation signal. These isolation devices are either passive or active (automatic). Manual valves, de-activated automatic valves secured in their closed position (including check valves with flow through the valve secured), blind flanges, and closed systems are considered passive devices. Automatic valves designed to close without operator action following an accident are considered active devices. Two barriers in series are normally provided for each penetration so that no single credible failure or malfunction of an active component can result in a loss of isolation or leakage that exceeds limits assumed in the safety analyses. One of these barriers may be a closed system. In addition, for one penetration both barriers are provided by a single blind flange, since the blind flange has two separate seals (each of the two seals is considered a barrier for the purposes of this LCO). An exception to the requirement for two barriers applies to those penetrations which carry instrument sensing lines. Such penetrations consist of single manual valve (normally open) and a closed system outside containment, which is considered an extension of the containment liner. These barriers (typically containment isolation valves) make up the Containment Isolation System.
| |
| Automatic isolation signals are produced during accident conditions.
| |
| Containment Phase "A" isolation occurs upon receipt of a Safety Injection Input from Engineered Safety Features Actuation System (ESFAS) signal.
| |
| The Phase "A" isolation signal isolates nonessential process lines in order to minimize leakage of fission product radioactivity. Containment Phase "B" isolation occurs upon receipt of a Containment Pressure -
| |
| High High signal and isolates the remaining process lines, except systems required for accident mitigation. In addition to the isolation signals listed above, the containment purge supply and exhaust valves isolate upon receipt of a Containment Radiation - High signal or a Safety Injection Input from ESFAS signal. As a result, the containment isolation valves (and blind flanges) help ensure that the containment atmosphere will be isolated from the environment in the event of a release of fission product radioactivity to the containment atmosphere as a result of a Design Basis Accident (DBA).
| |
| The OPERABILITY requirements for containment isolation valves help ensure that containment is isolated within the time limits assumed in the Cook Nuclear Plant Unit 2 B 3.6.3-1 Revision No. 0
| |
| | |
| Containment Isolation Valves B 3.6.3 BASES BACKGROUND (continued) safety analyses. Therefore, the OPERABILITY requirements provide assurance that the containment function assumed in the safety analyses will be maintained.
| |
| Containment Purge Supply and Exhaust System The Containment Purge Supply and Exhaust System operates to supply outside air into the containment for ventilation and cooling or heating and may also be used to reduce the concentration of noble gases within containment prior to and during personnel access. In addition, it serves as a backup means of pressure relief, in the event that the Containment Pressure Relief System is out of service. The supply and exhaust lines each contain two isolation valves. The containment purge valves are qualified for automatic closure from their open position under DBA conditions. However, the containment purge valves are normally maintained closed in MODES 1, 2, 3, and 4 (except for the reasons listed in SR 3.6.3.1) to ensure the containment boundary is maintained and to minimize the time the associated penetrations are open.
| |
| APPLICABLE The containment isolation valve LCO was derived from the assumptions SAFETY related to minimizing the loss of reactor coolant inventory and ANALYSES establishing the containment boundary during major accidents. As part of the containment boundary, containment isolation valve OPERABILITY supports leak tightness of the containment. Therefore, the safety analyses of any event requiring isolation of containment is applicable to this LCO.
| |
| The DBAs that result in a release of radioactive material within containment are a loss of coolant accident (LOCA) (Ref. 1) and a rod ejection accident (Ref. 2). In the analyses for each of these accidents, it is assumed that containment isolation valves are either closed or function to close within the required isolation time following event initiation. This ensures that potential paths to the environment through containment isolation valves (including containment purge valves) are minimized.
| |
| The DBA analysis assumes that, after the accident and prior to core damage, isolation of the containment is complete and leakage terminated except for the design leakage rate, La.
| |
| The Containment Purge Supply and Exhaust System is designed in accordance with the requirements of NRC Branch Technical Position CSB 6-4, Rev. 1. This includes, but is not limited to, an analysis of the impact of purging on Emergency Core Cooling System performance, an evaluation of the radiological consequences of a design basis accident Cook Nuclear Plant Unit 2 B 3.6.3-2 Revision No. 0
| |
| | |
| Containment Isolation Valves B 3.6.3 BASES APPLICABLE SAFETY ANALYSES (continued) while purging, and limiting containment purge operation to using no more than one supply path and one exhaust path at a time. The containment purge valves have been demonstrated capable of closing against the dynamic forces associated with a LOCA and are assured of receiving a containment ventilation isolation signal.
| |
| The Containment Isolation Valves satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO Containment isolation valves form a part of the containment boundary.
| |
| The containment isolation valves' safety function is related to minimizing the loss of reactor coolant inventory and establishing the containment boundary during a DBA.
| |
| The automatic power operated isolation valves are required to have isolation times within limits and to actuate on an automatic isolation signal. The valves covered by this LCO are listed in the UFSAR (Ref. 3) and the associated stroke times are listed in the INSERVICE TESTING PROGRAM.
| |
| The normally closed isolation valves are considered OPERABLE when manual valves are closed, automatic valves are de-activated and secured in their closed position, blind flanges are in place, and closed systems are intact. These passive isolation valves/devices are those listed in Reference 3.
| |
| The containment isolation valve leakage rates are addressed by LCO 3.6.1, "Containment," as Type C testing.
| |
| This LCO provides assurance that the containment isolation valves and purge valves will perform their designed safety functions to minimize the loss of reactor coolant inventory and establish the containment boundary during accidents.
| |
| APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment. In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, the containment isolation valves are not required to be OPERABLE in MODE 5. The requirements for containment isolation valves during MODE 6 are addressed in LCO 3.9.3, "Containment Penetrations."
| |
| Cook Nuclear Plant Unit 2 B 3.6.3-3 Revision No. 61
| |
| | |
| Containment Isolation Valves B 3.6.3 BASES ACTIONS The ACTIONS are modified by a Note allowing penetration flow paths to be unisolated intermittently under administrative controls. These administrative controls consist of stationing a dedicated operator at the valve controls, who is in continuous communication with the control room.
| |
| In this way, the penetration can be rapidly isolated when a need for containment isolation is indicated.
| |
| A second Note has been added to provide clarification that, for this LCO, separate Condition entry is allowed for each penetration flow path. This is acceptable since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable containment isolation valve. Complying with the Required Actions may allow for continued operation, and subsequent inoperable containment isolation valves are governed by subsequent Condition entry and application of associated Required Actions.
| |
| The ACTIONS are further modified by a third Note, which ensures appropriate remedial actions are taken, if necessary, if the affected systems are rendered inoperable by an inoperable containment isolation valve.
| |
| In the event the isolation valve leakage results in exceeding the overall containment leakage rate, Note 4 directs entry into the applicable Conditions and Required Actions of LCO 3.6.1.
| |
| A.1 and A.2 In the event one containment isolation valve in one or more penetration flow paths is inoperable, the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic containment isolation valve, a closed manual valve, a blind flange, and a check valve with flow through the valve secured. For a penetration flow path isolated in accordance with Required Action A.1, the device used to isolate the penetration should be the closest available one to containment. Required Action A.1 must be completed within 4 hours. The 4 hour Completion Time is reasonable, considering the time required to isolate the penetration and the relative importance of supporting containment OPERABILITY during MODES 1, 2, 3, and 4.
| |
| For affected penetration flow paths that cannot be restored to OPERABLE status within the 4 hour Completion Time and that have been isolated in accordance with Required Action A.1, the affected penetration flow paths must be verified to be isolated on a periodic basis. This is Cook Nuclear Plant Unit 2 B 3.6.3-4 Revision No. 0
| |
| | |
| Containment Isolation Valves B 3.6.3 BASES ACTIONS (continued) necessary to ensure that containment penetrations required to be isolated following an accident and no longer capable of being automatically isolated will be in the isolation position should an event occur. This Required Action does not require any testing or device manipulation.
| |
| Rather, it involves verification that those isolation devices outside containment and capable of being mispositioned are in the correct position. The Completion Time of "once per 31 days for isolation devices outside containment" is appropriate considering the fact that the devices are operated under administrative controls and the probability of their misalignment is low. For the isolation devices inside containment, the time period specified as "prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of the inaccessibility of the isolation devices and other administrative controls that will ensure that isolation device misalignment is an unlikely possibility.
| |
| Condition A has been modified by a Note indicating that this Condition is only applicable to those penetration flow paths with two containment isolation valves. For penetration flow paths with only one containment isolation valve, Condition C provides the appropriate actions.
| |
| Required Action A.2 is modified by two Notes. Note 1 applies to isolation devices located in high radiation areas and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Note 2 applies to isolation devices that are locked, sealed, or otherwise secured in position and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since the function of locking, sealing, or securing components is to ensure that these devices are not inadvertently repositioned. Therefore, the probability of misalignment of these devices once they have been verified to be in the proper position, is small.
| |
| B.1 With two containment isolation valves in one or more penetration flow paths inoperable, the affected penetration flow path must be isolated within 1 hour. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange.
| |
| The 1 hour Completion Time is consistent with the ACTIONS of LCO 3.6.1. Condition B is modified by a Note indicating this Condition is Cook Nuclear Plant Unit 2 B 3.6.3-5 Revision No. 0
| |
| | |
| Containment Isolation Valves B 3.6.3 BASES ACTIONS (continued) only applicable to penetration flow paths with two containment isolation valves. Condition A of this LCO addresses the condition of one containment isolation valve inoperable in this type of penetration flow path.
| |
| C.1 and C.2 With one or more penetration flow paths with one containment isolation valve inoperable, the inoperable valve flow path must be restored to OPERABLE status or the affected penetration flow path must be isolated.
| |
| The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure.
| |
| Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange. A check valve may not be used to isolate the affected penetration flow path.
| |
| Required Action C.1 must be completed within the 72 hour Completion Time. The specified time period is reasonable for those penetrations with a closed system considering the relative stability of the closed system (hence, reliability) to act as a penetration isolation boundary and the relative importance of maintaining containment integrity during MODES 1, 2, 3, and 4. In the event the affected penetration flow path is isolated in accordance with Required Action C.1, the affected penetration flow path must be verified to be isolated on a periodic basis. This periodic verification is necessary to assure leak tightness of containment and that containment penetrations requiring isolation following an accident are isolated. The Completion Time of once per 31 days for verifying that each affected penetration flow path is isolated is appropriate because the valves are operated under administrative controls and the probability of their misalignment is low.
| |
| Condition C is modified by a Note indicating that this Condition is only applicable to those penetration flow paths with only one containment isolation valve and a closed system. The closed system must meet the requirements of Reference 3. This Note is necessary since this Condition is written to specifically address those penetration flow paths in a closed system.
| |
| Required Action C.2 is modified by two Notes. Note 1 applies to valves and blind flanges located in high radiation areas and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Note 2 applies to isolation devices that are Cook Nuclear Plant Unit 2 B 3.6.3-6 Revision No. 0
| |
| | |
| Containment Isolation Valves B 3.6.3 BASES ACTIONS (continued) locked, sealed, or otherwise secured in position and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since the function of locking, sealing, or securing components is to ensure that these devices are not inadvertently repositioned. Therefore, the probability of misalignment of these valves, once they have been verified to be in the proper position, is small.
| |
| D.1 and D.2 If any Required Action and associated Completion Time is not met, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| SURVEILLANCE SR 3.6.3.1 REQUIREMENTS This SR ensures that the containment purge supply and exhaust valves are closed as required or, if open, open for an allowable reason. If a purge valve is open in violation of this SR, the valve is considered inoperable. The SR is not required to be met when the containment purge valves are open for the reasons stated. The valves may be opened for pressure control, ALARA or air quality considerations for personnel entry, or for Surveillances or maintenance activities that require the valves to be open. The containment purge valves are capable of closing in the environment following a LOCA. Therefore, these valves are allowed to be open for limited periods of time. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.6.3.2 This SR requires verification that each containment isolation manual valve and blind flange located outside containment and not locked, sealed, or otherwise secured and required to be closed during accident conditions is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside of the containment boundary is within design limits. This SR does not require any testing or valve manipulation. Rather, it involves verification that those containment isolation valves outside containment and capable of being mispositioned are in the correct position. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The SR specifies Cook Nuclear Plant Unit 2 B 3.6.3-7 Revision No. 60
| |
| | |
| Containment Isolation Valves B 3.6.3 BASES SURVEILLANCE REQUIREMENTS (continued) that containment isolation valves that are open under administrative controls are not required to meet the SR during the time the valves are open. This SR does not apply to valves that are locked, sealed, or otherwise secured in the closed position, since these were verified to be in the correct position upon locking, sealing, or securing.
| |
| The Note applies to valves and blind flanges located in high radiation areas and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted during MODES 1, 2, 3, and 4 for ALARA reasons. Therefore, the probability of misalignment of these containment isolation valves, once they have been verified to be in the proper position, is small.
| |
| SR 3.6.3.3 This SR requires verification that each containment isolation manual valve and blind flange located inside containment and not locked, sealed, or otherwise secured and required to be closed during accident conditions is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside of the containment boundary is within design limits. For containment isolation valves inside containment, the Frequency of "prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is appropriate since these containment isolation valves are operated under administrative controls and the probability of their misalignment is low. The SR specifies that containment isolation valves that are open under administrative controls are not required to meet the SR during the time they are open. This SR does not apply to valves that are locked, sealed, or otherwise secured in the closed position, since these were verified to be in the correct position upon locking, sealing, or securing.
| |
| This Note allows valves and blind flanges located in high radiation areas to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted during MODES 1, 2, 3, and 4, for ALARA reasons. Therefore, the probability of misalignment of these containment isolation valves, once they have been verified to be in their proper position, is small.
| |
| Cook Nuclear Plant Unit 2 B 3.6.3-8 Revision No. 60
| |
| | |
| Containment Isolation Valves B 3.6.3 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.6.3.4 Verifying that the isolation time of each automatic power operated containment isolation valve is within limits is required to demonstrate OPERABILITY. The isolation time test ensures the valve will isolate in a time period less than or equal to that assumed in the safety analyses.
| |
| The Frequency of this SR is in accordance with the INSERVICE TESTING PROGRAM.
| |
| SR 3.6.3.5 Automatic containment isolation valves close on a containment isolation signal to prevent leakage of radioactive material from containment following a DBA. This SR ensures that each automatic containment isolation valve will actuate to its isolation position on a containment isolation signal. This surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 14.3.4.
| |
| : 2. UFSAR, Section 14.2.6.
| |
| : 3. UFSAR, Section 5.4.1 and Table 5.4-1.
| |
| Cook Nuclear Plant Unit 2 B 3.6.3-9 Revision No. 61
| |
| | |
| Containment Pressure B 3.6.4 B 3.6 CONTAINMENT SYSTEMS B 3.6.4 Containment Pressure BASES BACKGROUND The containment pressure is limited during normal operation to preserve the initial conditions assumed in the accident analyses for a loss of coolant accident (LOCA) and steam line break (SLB). These limits also prevent the containment pressure from exceeding the containment design negative pressure differential with respect to the outside atmosphere during normal operations.
| |
| Containment pressure is a process variable that is monitored and controlled. The containment pressure limits are derived from the input conditions used in the containment functional analyses and the containment structure external pressure analysis. Should operation occur outside these limits coincident with a Design Basis Accident (DBA), post accident containment pressures could exceed calculated values.
| |
| APPLICABLE Containment internal pressure is an initial condition used in the DBA SAFETY analyses to establish the maximum peak containment internal pressure.
| |
| ANALYSES The limiting DBAs considered, relative to containment pressure, are the LOCA and SLB, which are analyzed using computer pressure transients.
| |
| The worst case LOCA generates larger mass and energy release than the worst case SLB. Thus, the LOCA event bounds the SLB event from the containment long term peak pressure standpoint (Ref. 1). However, in localized areas, the SLB event results in higher short term subcompartment pressures than a LOCA (Ref. 1).
| |
| The initial pressure condition used in the containment analysis was 15.0 psia (0.3 psig). This resulted in a calculated maximum peak pressure from a LOCA of 10.78 psig. The containment analysis (Ref. 1) shows that the maximum peak calculated containment pressure, Pa, results from the limiting LOCA. The maximum calculated containment pressure resulting from the worst case LOCA, 10.78 psig, does not exceed the containment design pressure, 12 psig.
| |
| The containment was also designed for an external pressure load equivalent to -2.0 psig. The -1.5 psig limit is a conservative limit for normal operations. In addition, the -1.5 psig limit is assumed in the Transient Mass Distribution analysis, which analyzes the containment response during the blowdown phase of the large break LOCA (Ref. 2).
| |
| For certain aspects of transient accident analyses, maximizing the calculated containment pressure is not conservative. In particular, the cooling effectiveness of the Emergency Core Cooling System during the core reflood phase of a LOCA analysis increases with increasing Cook Nuclear Plant Unit 2 B 3.6.4-1 Revision No. 54
| |
| | |
| Containment Pressure B 3.6.4 BASES APPLICABLE SAFETY ANALYSES (continued) containment backpressure. Therefore, for the reflood phase, the containment backpressure is calculated in a manner designed to conservatively minimize, rather than maximize, the containment pressure response in accordance with 10 CFR 50, Appendix K (Ref. 3).
| |
| Containment Pressure satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO Maintaining containment pressure at less than or equal to the LCO upper pressure limit ensures that, in the event of a DBA, the resultant peak containment accident pressure will remain below the containment design pressure. Maintaining containment pressure at greater than or equal to the LCO lower pressure limit ensures that the containment will not exceed the design negative differential pressure during normal operations. In addition, maintaining containment pressure at greater than or equal to the LCO lower pressure limit ensures that assumptions made in the blowdown phase of the large break LOCA analysis remain valid.
| |
| APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment. Since maintaining containment pressure within limits is essential to ensure initial conditions assumed in the accident analyses are maintained, the LCO is applicable in MODES 1, 2, 3, and 4.
| |
| In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, maintaining containment pressure within the limits of the LCO is not required in MODE 5 or 6.
| |
| ACTIONS A.1 When containment pressure is not within the limits of the LCO, it must be restored to within these limits within 1 hour. The Required Action is necessary to return operation to within the bounds of the containment analysis. The 1 hour Completion Time is consistent with the ACTIONS of LCO 3.6.1, "Containment," which requires that containment be restored to OPERABLE status within 1 hour.
| |
| B.1 and B.2 If containment pressure cannot be restored to within limits within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| Cook Nuclear Plant Unit 2 B 3.6.4-2 Revision No. 0
| |
| | |
| Containment Pressure B 3.6.4 BASES SURVEILLANCE SR 3.6.4.1 REQUIREMENTS Verifying that containment pressure is within limits ensures that unit operation remains within the limits assumed in the containment analysis.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 14.3.4.
| |
| : 2. UFSAR, Section 5.2.2.2.
| |
| : 3. 10 CFR 50, Appendix K.
| |
| Cook Nuclear Plant Unit 2 B 3.6.4-3 Revision No. 60
| |
| | |
| Containment Air Temperature B 3.6.5 B 3.6 CONTAINMENT SYSTEMS B 3.6.5 Containment Air Temperature BASES BACKGROUND The containment structure serves to contain radioactive material that may be released from the reactor core following a Design Basis Accident (DBA). The containment average air temperature is limited, during normal operation, to preserve the initial conditions assumed in the accident analyses for a loss of coolant accident (LOCA) and steam line break (SLB).
| |
| The containment average air temperature limit is derived from the input conditions used in the containment functional analyses and the containment structure external pressure analyses. This LCO ensures that initial conditions assumed in the analysis of containment response to a DBA are not violated during unit operations. The total amount of energy to be removed from containment by the Containment Spray System and the Ice Bed during post accident conditions is dependent upon the energy released to the containment due to the event, as well as the initial containment temperature and pressure. Exceeding containment design pressure may result in leakage greater than that assumed in the accident analysis. Operation with containment temperature in excess of the LCO limit violates an initial condition assumed in the accident analysis.
| |
| APPLICABLE Containment average air temperature is an initial condition used in the SAFETY DBA analyses that establishes the containment environmental ANALYSES qualification operating envelope for both pressure and temperature. The limit for containment average air temperature ensures that operation is maintained within the assumptions used in the DBA analyses for containment (Ref. 1).
| |
| The limiting DBAs considered relative to containment air temperature are the LOCA and SLB. The DBA LOCA and SLB are analyzed using computer codes designed to predict the resultant containment pressure transients. No two DBAs are assumed to occur simultaneously or consecutively. The postulated DBAs are analyzed with regard to Engineered Safety Feature (ESF) systems, assuming the loss of one ESF bus, which is the worst case single active failure, resulting in one train each of Containment Spray System, Residual Heat Removal System, and Containment Air Recirculation/Hydrogen Skimmer (CEQ) System being rendered inoperable.
| |
| The limiting DBA for the maximum peak containment air temperature is an SLB. For the upper compartment, the initial containment average air temperature assumed in the design basis analyses (Ref. 1) is 100°F. For the lower compartment, the initial average containment air temperature assumed in the design basis analyses is 120°F. This resulted in a Cook Nuclear Plant Unit 2 B 3.6.5-1 Revision No. 45
| |
| | |
| Containment Air Temperature B 3.6.5 BASES APPLICABLE SAFETY ANALYSES (continued) maximum containment air temperature of 324.7°F. The design temperature at Pa is 196°F for the containment upper compartment and 244°F for the containment lower compartment.
| |
| The limiting DBA for the peak clad temperature analysis is a large break LOCA. For this analysis, the bounding range for the upper containment initial temperature is 60°F to 100°F and the bounding range for the lower containment initial is 60°F to 120°F. The temperature upper limits are also used to establish the environmental qualification operating envelope for both containment compartments. The maximum peak containment air temperature for both containment compartments was calculated to exceed the containment design temperature for only a short time during the transient. The basis of the containment design temperature, however, is to ensure the performance of safety related equipment inside containment (Ref. 3). Thermal analyses showed that the time interval during which the containment air temperature exceeded the containment design temperature was short enough that the equipment surface temperatures remained below the design temperature. Therefore, it is concluded that the calculated transient containment air temperatures are acceptable for the DBA SLB.
| |
| The containment pressure transient is sensitive to the initial containment temperature bias. Sensitivities have been run to determine the appropriate bias. The limiting DBA for establishing the maximum peak containment internal pressure is a LOCA. The temperature upper limits, 100°F for the upper compartment and 120°F for the lower compartment, are used in this analysis to ensure that, in the event of an accident, the maximum containment internal pressure will not be exceeded in either containment compartment.
| |
| Containment Air Temperature satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO During a DBA, with an initial containment average air temperature within the LCO temperature limits, the resultant accident temperature profile assures that the containment structural temperature is maintained below its design temperature and that required safety related equipment will continue to perform its function.
| |
| APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment. In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, maintaining containment average air temperature within the limit is not required in MODE 5 or 6.
| |
| Cook Nuclear Plant Unit 2 B 3.6.5-2 Revision No. 45
| |
| | |
| Containment Air Temperature B 3.6.5 BASES ACTIONS A.1 When containment average air temperature in the upper or lower compartment is not within the limit of the LCO, the average air temperature in the affected compartment must be restored to within limits within 8 hours. This Required Action is necessary to return operation to within the bounds of the containment analysis. The 8 hour Completion Time is acceptable considering the sensitivity of the analysis to variations in this parameter and provides sufficient time to correct minor problems.
| |
| B.1 and B.2 If the containment average air temperature cannot be restored to within its limits within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| SURVEILLANCE SR 3.6.5.1 and SR 3.6.5.2 REQUIREMENTS Verifying that containment average air temperature is within the LCO limits ensures that containment operation remains within the limits assumed for the containment analyses. In order to determine the containment average air temperature, an average is calculated using measurements taken at locations within the containment selected to provide a representative sample of the overall containment atmosphere.
| |
| In the upper compartment, two locations at a nominal elevation of 712 ft 0 inches and a third location at a nominal elevation of 624 ft 10 inches are used and an arithmetic average taken. In the lower compartment, a volume weighted average temperature is calculated whereby the volume fraction for each of the various areas of lower containment is multiplied by the representative temperature, utilizing one or more temperature instruments, in that volume. In this way the temperatures are weighted according to the volume fraction. These weighted temperatures are then summed to determine the Weighted Average Temperature for Lower Containment. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 14.3.4.
| |
| : 2. 10 CFR 50.49.
| |
| Cook Nuclear Plant Unit 2 B 3.6.5-3 Revision No. 60
| |
| | |
| Containment Spray System B 3.6.6 3.6 CONTAINMENT SYSTEMS B 3.6.6 Containment Spray System BASES BACKGROUND The Containment Spray System provides containment atmosphere cooling to limit post accident pressure and temperature in containment to less than the design values. Reduction of containment pressure and the iodine removal capability of the spray reduce the release of fission product radioactivity from containment to the environment, in the event of a Design Basis Accident (DBA). The Containment Spray System is designed to meet the requirements of Plant Specific Design Criteria (PSDC) 41, "Engineered Safety Features Performance Capability,"
| |
| PSDC 42, "Emergency Safety Features Components Capability,"
| |
| PSDC 49, "Reactor Containment Design Basis," PSDC 52, "Containment Heat Removal Systems," PSDC 58, "Inspection of Containment Pressure - Reducing Systems," PSDC 59, "Testing of Containment Pressure - Reducing Systems," PSDC 60, "Testing of Containment Spray System," PSDC 61, "Testing of Operational Sequence of the Containment Pressure - Reducing Systems" (Ref. 1).
| |
| The Containment Spray System consists of two separate trains of equal capacity, each capable of meeting the system design basis spray coverage. Each train includes a containment spray pump, one containment spray heat exchanger, spray headers, nozzles, valves, and piping. Each train is powered from a separate Engineered Safety Feature (ESF) bus. The refueling water storage tank (RWST) supplies borated water to the Containment Spray System during the injection phase of operation. In the recirculation mode of operation, containment spray pump suction is transferred from the RWST to the containment recirculation sump.
| |
| The diversion of a portion of the recirculation flow from each train of the Residual Heat Removal (RHR) System to additional redundant spray headers completes the Containment Spray System heat removal capability. Each RHR train is capable of supplying spray coverage, if required, to supplement the Containment Spray System.
| |
| The Containment Spray System and RHR System provide a spray of cold or subcooled borated water into the upper and lower (Containment Spray System only) regions of containment and in dead ended volumes (Containment Spray System only) to limit the containment pressure and temperature during a DBA. The RWST solution temperature is an important factor in determining the heat removal capability of the Containment Spray System during the injection phase. In the recirculation mode of operation, heat is removed from the containment Cook Nuclear Plant Unit 2 B 3.6.6-1 Revision No. 0
| |
| | |
| Containment Spray System B 3.6.6 BASES BACKGROUND (continued) sump water by the Containment Spray System and RHR heat exchangers. Each train of the Containment Spray System, supplemented by a train of RHR spray, provides adequate spray coverage to meet the system design requirements for containment heat removal.
| |
| The Spray Additive System injects a sodium hydroxide (NaOH) solution into the spray, by an eductor system, using the containment spray pump discharge flow as the motive force.
| |
| The Containment Spray System is actuated either automatically by a Containment Pressure - High High signal or manually. An automatic actuation opens the containment spray pump discharge valves and the valves associated with the Spray Additive System tank, starts the two containment spray pumps, and begins the injection phase. A manual actuation of a containment spray train requires the operator to actuate a switch on the main control board to begin the same sequence. The injection phase continues until an RWST level Low-Low alarm is received.
| |
| When the RWST has decreased to a level indicating a sufficient volume has been transferred to containment, the operator aligns the containment spray pump suction to the containment recirculation sump. The Containment Spray System in the recirculation mode maintains an equilibrium temperature between the containment atmosphere and the recirculated sump water. Operation of the Containment Spray System in the recirculation mode is controlled by the operator in accordance with the emergency operating procedures.
| |
| The RHR spray operation is initiated manually, when required by the emergency operating procedures, after the Emergency Core Cooling System (ECCS) is operating in the recirculation mode. The RHR sprays are available to supplement the Containment Spray System, if required, in limiting containment pressure. This additional spray capacity would typically be used after the ice bed has been depleted and in the event that containment pressure rises above a predetermined limit. The Containment Spray System is an ESF system. It is designed to ensure that the heat removal capability required during the post accident period can be attained.
| |
| The operation of the Containment Spray System, together with the ice condenser, is adequate to assure pressure suppression during the initial blowdown of steam and water from a DBA. During the post blowdown period, the Containment Air Recirculation/Hydrogen Skimmer (CEQ)
| |
| System is automatically started. The CEQ System returns upper compartment air through the divider barrier to the lower compartment.
| |
| Cook Nuclear Plant Unit 2 B 3.6.6-2 Revision No. 0
| |
| | |
| Containment Spray System B 3.6.6 BASES BACKGROUND (continued)
| |
| This serves to equalize pressures in containment and to continue circulating heated air and steam through the ice condenser, where heat is removed by the remaining ice.
| |
| The Containment Spray System limits the temperature and pressure that could be expected following a DBA. Protection of containment integrity limits leakage of fission product radioactivity from containment to the environment.
| |
| APPLICABLE The limiting DBAs considered relative to the Containment Spray System SAFETY are the loss of coolant accident (LOCA) and the steam line break (SLB).
| |
| ANALYSES The DBA LOCA and SLB are analyzed using computer codes designed to predict the resultant containment pressure and temperature transients.
| |
| No two DBAs are assumed to occur simultaneously or consecutively.
| |
| The postulated DBAs are analyzed, in regard to containment ESF systems, assuming the loss of one ESF bus, which is the worst case single active failure, resulting in one train of the Containment Spray System, the RHR System, and the CEQ System being rendered inoperable (Ref. 2).
| |
| The DBA analyses show that the maximum peak containment pressure of 10.78 psig results from the LOCA analysis, and is calculated to be less than the containment design pressure. The maximum DBA peak transient containment atmosphere temperature of 324.7°F results from the SLB analysis. The analysis is performed to ensure the OPERABILITY of safety related equipment inside containment (Ref. 3). Environmental Qualification evaluations demonstrate the EQ related components are qualified for the peak transient DBA SLB temperature of 324.7°F.
| |
| Therefore, it is concluded that the calculated transient containment atmosphere temperatures are acceptable for the DBA SLB.
| |
| The modeled Containment Spray System actuation from the containment analysis is based on a response time associated with exceeding the Containment Pressure - High High signal setpoint to achieving full flow through the containment spray nozzles. A delayed response time initiation provides conservative analyses of peak calculated containment temperature and pressure responses. The Containment Spray System total response time of 115 seconds includes signal delay, diesel generator startup, and system startup time.
| |
| For certain aspects of transient accident analyses, maximizing the calculated containment pressure is not conservative. In particular, the Cook Nuclear Plant Unit 2 B 3.6.6-3 Revision No. 54
| |
| | |
| Containment Spray System B 3.6.6 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| ECCS cooling effectiveness during the core reflood phase of a LOCA analysis increases with increasing containment backpressure. For these calculations, the containment backpressure is calculated in a manner designed to conservatively minimize, rather than maximize, the calculated transient containment pressures in accordance with 10 CFR 50, Appendix K (Ref. 4). The large break LOCA analysis is based on the assumption that the containment spray temperature is 65°F during the injection phase of the accident, and both Containment Spray System trains are operating. Therefore, if a containment spray temperature of 65°F cannot be assured, the affected train of the Containment Spray System is considered to be inoperable and the automatic start feature of the pump in that train is disabled.
| |
| The Containment Spray System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO During a DBA, one train of Containment Spray System is required to provide the heat removal capability assumed in the safety analyses.
| |
| Additionally, a minimum of one train of the Containment Spray System, with spray pH adjusted by the Spray Additive System, is required to scavenge iodine fission products from the containment atmosphere and ensure their retention in the containment sump water. To ensure that these requirements are met, two containment spray trains must be OPERABLE with power from two safety related, independent power supplies. Therefore, in the event of an accident, at least one train in each system operates.
| |
| If a containment spray temperature of 65°F during the injection phase of a large break LOCA cannot be assured, the affected train of the Containment Spray System is considered to be inoperable and the automatic start feature of the pump in that train is disabled.
| |
| Each containment spray train includes a spray pump, headers, valves, heat exchangers, nozzles, piping, instruments, and controls to ensure an OPERABLE flow path capable of taking suction from the RWST upon an ESF actuation signal and manually transferring suction to the containment sump. Management of gas voids is important to Containment Spray System OPERABILITY.
| |
| APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment and an increase in containment pressure and temperature requiring the operation of the Containment Spray System.
| |
| In MODES 5 and 6, the probability and consequences of these events are reduced because of the pressure and temperature limitations of these Cook Nuclear Plant Unit 2 B 3.6.6-4 Revision No. 57
| |
| | |
| Containment Spray System B 3.6.6 BASES APPLICABILITY (continued)
| |
| MODES. Thus, the Containment Spray System is not required to be OPERABLE in MODE 5 or 6.
| |
| ACTIONS A.1 With one containment spray train inoperable, the affected train must be restored to OPERABLE status within 72 hours. The components in this degraded condition are capable of providing 100% of the heat removal and iodine removal needs after an accident. The 72 hour Completion Time was developed taking into account the redundant heat removal and iodine removal capabilities afforded by the OPERABLE train and the low probability of a DBA occurring during this period.
| |
| B.1 and B.2 If the affected containment spray train cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 5 within 84 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| The extended interval to reach MODE 5 allows additional time and is reasonable when considering that the driving force for a release of radioactive material from the Reactor Coolant System is reduced in MODE 3.
| |
| SURVEILLANCE SR 3.6.6.1 REQUIREMENTS Verifying the correct alignment of manual, power operated, and automatic valves, excluding check valves, in the Containment Spray System provides assurance that the proper flow path exists for Containment Spray System operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position since they were verified in the correct position prior to being secured. This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves. This SR does not require any testing or valve manipulation.
| |
| Rather, it involves verification that those valves outside containment and capable of potentially being mispositioned, are in the correct position.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| The Surveillance is modified by a Note which exempts system vent flow paths opened under administrative control. The administrative control Cook Nuclear Plant Unit 2 B 3.6.6-5 Revision No. 60
| |
| | |
| Containment Spray System B 3.6.6 BASES SURVEILLANCE REQUIREMENTS (continued) should be proceduralized and include stationing a dedicated individual at the system vent flow path who is in continuous communication with the operators in the control room. This individual will have a method to rapidly close the system vent flow path if directed.
| |
| SR 3.6.6.2 Verifying that each containment spray pump's developed head at the flow test point is greater than or equal to the required developed head ensures that spray pump performance has not degraded to an unacceptable level during the cycle. Flow and differential head are normal tests of centrifugal pump performance required by the ASME OM Code (Ref. 5).
| |
| Since the containment spray pumps cannot be tested with flow through the spray headers, they are tested on bypass flow. This test confirms one point on the pump design curve and is indicative of overall performance.
| |
| Such inservice tests confirm component OPERABILITY and detect incipient failures by indicating abnormal performance. The Frequency of this SR is in accordance with the INSERVICE TESTING PROGRAM.
| |
| SR 3.6.6.3 and SR 3.6.6.4 These SRs require verification that each automatic containment spray valve actuates to its correct position and each containment spray pump starts upon receipt of an actual or simulated containment spray actuation signal. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| These Surveillances include a Note that states that in MODE 4, only the manual portion of the actuation signal is required. This is acceptable since the automatic portion of the actuation signal is not required to be OPERABLE by ITS 3.3.2, "Engineered Safety Features Actuation System (ESFAS) Instrumentation."
| |
| SR 3.6.6.5 With the containment spray inlet valves closed and the spray header drained of any solution, low pressure air or smoke can be blown through test connections. This SR ensures that each spray nozzle is unobstructed and that spray coverage of the containment during an accident is not degraded. The event based surveillance frequency following maintenance that could result in nozzle blockage was chosen Cook Nuclear Plant Unit 2 B 3.6.6-6 Revision No. 61
| |
| | |
| Containment Spray System B 3.6.6 BASES SURVEILLANCE REQUIREMENTS (continued) because this passive portion of the system is not susceptible to service induced degradation.
| |
| SR 3.6.6.6 Containment Spray System piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the containment spray trains and may also prevent water hammer and pump cavitation.
| |
| Selection of Containment Spray System locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration.
| |
| Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.
| |
| The Containment Spray System is OPERABLE when it is sufficiently filled with water. Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criterion for gas volume at the suction or discharge of a pump), the Surveillance is not met. If it is determined by subsequent evaluation that the Containment Spray System is not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water), the Surveillance may be declared met.
| |
| Accumulated gas should be eliminated or brought within the acceptance criteria limits.
| |
| Containment Spray System locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative sub-set of susceptible locations. Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations, alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for Cook Nuclear Plant Unit 2 B 3.6.6-7 Revision No. 57
| |
| | |
| Containment Spray System B 3.6.6 BASES SURVEILLANCE REQUIREMENTS (continued) susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 1.4.7.
| |
| : 2. UFSAR, Section 14.3.4.
| |
| : 3. 10 CFR 50.49.
| |
| : 4. 10 CFR 50, Appendix K.
| |
| : 5. ASME, Operation and Maintenance Standards and Guides (OM Codes).
| |
| Cook Nuclear Plant Unit 2 B 3.6.6-8 Revision No. 60
| |
| | |
| Spray Additive System B 3.6.7 B 3.6 CONTAINMENT SYSTEMS B 3.6.7 Spray Additive System BASES BACKGROUND The Spray Additive System is a subsystem of the Containment Spray System that assists in reducing the iodine fission product inventory in the containment atmosphere resulting from a Design Basis Accident (DBA).
| |
| Radioiodine in its various forms is the fission product of primary concern in the evaluation of a DBA. It is absorbed by the aqueous spray without chemical reaction from the containment atmosphere. To enhance the iodine absorption capacity of the spray, the spray solution is adjusted to an alkaline pH that promotes iodine hydrolysis, in which iodine is converted to nonvolatile forms. Because of its stability when exposed to radiation and elevated temperature, sodium hydroxide (NaOH) is the preferred spray additive. The NaOH added to the spray also ensures a pH value of between 7.0 and 10.0 of the solution recirculated from the containment sump. This pH band minimizes the evolution of iodine as well as the occurrence of chloride and caustic stress corrosion on mechanical systems and components.
| |
| The Spray Additive System consists of one spray additive tank that is shared by the two trains of spray additive equipment. Each train of equipment provides a flow path from the spray additive tank to a containment spray pump and consists of an eductor for each containment spray pump, valves, instrumentation, and connecting piping. Each eductor draws the NaOH spray solution from the common tank using a portion of the borated water discharged by the containment spray pump as the motive flow. The eductor mixes the NaOH solution and the borated water and discharges the mixture into the containment spray pump suction line.
| |
| The Containment Spray System actuation signal opens the valves from the spray additive tank to the spray pump suctions. The 30% to 34%
| |
| NaOH solution is drawn into the spray pump suctions. The spray additive tank capacity provides for the addition of NaOH solution to all of the water sprayed from the RWST into containment. The percent solution and volume of solution sprayed into containment ensures a long term containment sump pH of 7.0 and 10.0. This ensures the continued iodine retention effectiveness of the sump water during the recirculation phase of spray operation and also minimizes the occurrence of chloride induced stress corrosion cracking of the stainless steel recirculation piping.
| |
| Cook Nuclear Plant Unit 2 B 3.6.7-1 Revision No. 26
| |
| | |
| Spray Additive System B 3.6.7 BASES APPLICABLE The Spray Additive System is essential to the removal of airborne iodine SAFETY within containment following a DBA.
| |
| ANALYSES Following the assumed release of radioactive materials into containment, the containment is assumed to leak at its design value volume following the accident. There are portions of the containment that are not sprayed (e.g., steam generator enclosures and pressurizer enclosure). In order to account for these unsprayed regions, the analysis assumes that removal of iodine takes place only in the sprayed regions, while mass transfer of iodine from unsprayed to sprayed regions accounts for the decrease in the iodine concentration in the unsprayed regions (Ref. 1).
| |
| The DBA response time assumed for the Spray Additive System is the same as for the Containment Spray System and is discussed in the Bases for LCO 3.6.6, "Containment Spray System."
| |
| The DBA analyses assume that one train of the Containment Spray System/Spray Additive System is inoperable and that the minimum required volume of the spray additive tank volume is added to the remaining Containment Spray System flow path.
| |
| The Spray Additive System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The Spray Additive System is necessary to reduce the release of radioactive material to the environment in the event of a DBA. To be considered OPERABLE, the volume and concentration of the spray additive solution must be sufficient to provide NaOH injection into the spray flow until the Containment Spray System suction path is switched from the RWST to the containment sump, and to raise the average spray solution pH to a level conducive to iodine removal, namely, to between 7.0 and 10.0. This pH range minimizes the evolution of iodine without introducing conditions that may induce caustic stress corrosion cracking of mechanical system components. In addition, it is essential that valves in the Spray Additive System flow paths are properly positioned and that automatic valves are capable of activating to their correct positions.
| |
| APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment requiring the operation of the Spray Additive System. The Spray Additive System assists in reducing the iodine fission product inventory prior to release to the environment.
| |
| In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. Thus, the Spray Additive System is not required to be OPERABLE in MODE 5 or 6.
| |
| Cook Nuclear Plant Unit 2 B 3.6.7-2 Revision No. 0
| |
| | |
| Spray Additive System B 3.6.7 BASES ACTIONS A.1 If the Spray Additive System is inoperable, it must be restored to OPERABLE within 72 hours. The pH adjustment of the Containment Spray System flow for corrosion protection and iodine retention enhancement is reduced in this condition. The 72 hour Completion Time takes into account the redundant flow path capabilities and the low probability of the worst case DBA occurring during this period. In addition, if the Containment Spray System is available, it would remove some iodine from the containment atmosphere in the event of a DBA.
| |
| B.1 and B.2 If the Spray Additive System cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 5 within 84 hours. The allowed Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems. The extended interval to reach MODE 5 allows additional time and is reasonable when considering that the driving force for the release of radioactive material from the Reactor Coolant System is reduced in MODE 3.
| |
| SURVEILLANCE SR 3.6.7.1 REQUIREMENTS Verifying the correct alignment of Spray Additive System manual, power operated, and automatic valves in the spray additive flow path provides assurance that the system is able to provide additive to the Containment Spray System in the event of a DBA. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, or securing. This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves. This SR does not require any testing or valve manipulation. Rather, it involves verification that those valves outside containment and capable of potentially being mispositioned are in the correct position. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.6.7.2 To provide effective iodine retention, the containment spray must be an alkaline solution. Since the RWST contents are normally acidic, the volume of the spray additive tank must provide a sufficient volume of spray additive to adjust pH for all water injected. This SR is performed to verify the availability of sufficient NaOH solution in the Spray Additive System. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Cook Nuclear Plant Unit 2 B 3.6.7-3 Revision No. 60
| |
| | |
| Spray Additive System B 3.6.7 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.6.7.3 This SR provides verification (by chemical analysis) of the NaOH concentration in the spray additive tank and is sufficient to ensure that the spray solution being injected into containment is at the correct pH level.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.6.7.4 This SR provides verification that each automatic valve in the Spray Additive System flow path actuates to its correct position. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.6.7.5 To ensure that the correct pH level is established in the borated water solution provided by the Containment Spray System, the flow rate in the Spray Additive System is verified once every 5 years. This SR provides assurance that the correct amount of NaOH will be metered into the flow path upon Containment Spray System initiation. The test is performed by verifying the flow rate from the spray additive tank test line to each Containment Spray System train with each containment spray pump operating in the recirculation mode. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Chapter 14.3.5.9.
| |
| Cook Nuclear Plant Unit 2 B 3.6.7-4 Revision No. 60
| |
| | |
| B 3.6.8 B 3.6 CONTAINMENT SYSTEMS B 3.6.8 Deleted Cook Nuclear Plant Unit 2 B 3.6.8-1 Revision No. 29
| |
| | |
| B 3.6.8 THIS PAGE INTENTIONALLY LEFT BLANK Cook Nuclear Plant Unit 2 B 3.6.8-2 Revision 29
| |
| | |
| DIS B 3.6.9 B 3.6 CONTAINMENT SYSTEMS B 3.6.9 Distributed Ignition System (DIS)
| |
| BASES BACKGROUND The DIS reduces the potential for breach of primary containment due to a hydrogen oxygen reaction in post accident environments. The DIS is required by 10 CFR 50.44, "Standards for Combustible Gas Control Systems in Light-Water-Cooled Reactors" (Ref. 1) to reduce the hydrogen concentration in the primary containment following a degraded core accident. The DIS must be capable of handling an amount of hydrogen equivalent to that generated from a metal water reaction involving 75% of the fuel cladding surrounding the active fuel region (excluding the plenum volume).
| |
| 10 CFR 50.44 (Ref. 1) requires units with ice condenser containments to install suitable hydrogen control systems that would accommodate an amount of hydrogen equivalent to that generated from the reaction of 75% of the fuel cladding with water. The DIS provides this required capability. This requirement was placed on ice condenser units because of their small containment volume and low design pressure (compared with pressurized water reactor dry containments). Calculations indicate that if hydrogen equivalent to that generated from the reaction of 75% of the fuel cladding with water were to collect in the primary containment, the resulting hydrogen concentration would be far above the lower flammability limit such that, if ignited from a random ignition source, the resulting hydrogen burn would seriously challenge the containment and safety systems in the containment.
| |
| The DIS is based on the concept of controlled ignition using thermal ignitors, designed to be capable of functioning in a post accident environment, seismically supported, and capable of actuation from the control room. A total of 70 ignitors are distributed throughout the various regions of containment in which hydrogen could be released or to which it could flow in significant quantities. The ignitors are arranged in two independent trains such that each containment region has at least two ignitors, one from each train, controlled and powered redundantly so that ignition would occur in each region even if one train failed to energize.
| |
| When the DIS is initiated, the ignitor elements are energized and heat up to a surface temperature 1700°F. At this temperature, they ignite the hydrogen gas that is present in the airspace in the vicinity of the ignitor.
| |
| The DIS depends on the dispersed location of the ignitors so that local pockets of hydrogen at increased concentrations would burn before reaching a hydrogen concentration significantly higher than the lower flammability limit. Hydrogen ignition in the vicinity of the ignitors is assumed to occur when the local hydrogen concentration reaches Cook Nuclear Plant Unit 2 B 3.6.9-1 Revision No. 0
| |
| | |
| DIS B 3.6.9 BASES BACKGROUND (continued) 8.0 volume percent (v/o) in fog inerted regions and 6.0 v/o in regions with negligible fog inerting, and results in 85% of the hydrogen present being consumed.
| |
| APPLICABLE The DIS causes hydrogen in containment to burn in a controlled manner SAFETY as it accumulates following a degraded core accident (Ref. 2). Burning ANALYSES occurs at the lower flammability concentration, where the resulting temperatures and pressures are relatively benign. Without the system, hydrogen could build up to higher concentrations that could result in a violent reaction if ignited by a random ignition source after such a buildup.
| |
| The hydrogen ignitors are not included for mitigation of a Design Basis Accident (DBA) because an amount of hydrogen equivalent to that generated from the reaction of 75% of the fuel cladding with water is far in excess of the hydrogen calculated for the limiting DBA loss of coolant accident (LOCA). The hydrogen ignitors, however, have been shown by probabilistic risk analysis to be a significant contributor to limiting the severity of accident sequences that are commonly found to dominate risk for units with ice condenser containments. The Distributed Ignition System satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO Two DIS trains must be OPERABLE with power from two independent, safety related power supplies. An OPERABLE DIS train consists of 34 of 35 ignitors capable of being energized. (See footnote)
| |
| Operation with at least one DIS train ensures that the hydrogen in containment can be burned in a controlled manner. Unavailability of both DIS trains could lead to hydrogen buildup to higher concentrations, which could result in a violent reaction if ignited. The reaction could take place fast enough to lead to high temperatures and overpressurization of containment and, as a result, breach containment or cause containment leakage rates above those assumed in the safety analyses. Damage to safety related equipment located in containment could also occur.
| |
| Each containment region must contain at least one OPERABLE hydrogen ignitor. This ensures there is at least one OPERABLE hydrogen ignitor from one of the two DIS trains.
| |
| Footnote: For the remainder of Fuel Cycle 18, or until the next entry into a MODE which allows replacement of the affected ignitors, DIS Train B can still perform its safety function and may be considered OPERABLE with one lower containment Phase 2 Power Supply ignitor inoperable and with one lower containment Phase 3 Power Supply ignitor inoperable (Reference 3).
| |
| Cook Nuclear Plant Unit 2 B 3.6.9-2 Revision No. 29
| |
| | |
| DIS B 3.6.9 BASES APPLICABILITY Requiring OPERABILITY in MODES 1 and 2 for the DIS ensures its immediate availability after safety injection and scram actuated on a LOCA initiation. In the post accident environment, the two DIS subsystems are required to control the hydrogen concentration within containment to near its flammability limit of 4.0 v/o assuming a worst case single failure. This prevents overpressurization of containment and damage to safety related equipment and instruments located within containment.
| |
| In MODES 3 and 4, both the hydrogen production rate and the total hydrogen production after a LOCA would be significantly less than that calculated for the DBA LOCA. Also, because of the limited time in these MODES, the probability of an accident requiring the DIS is low.
| |
| Therefore, the DIS is not required in MODES 3 and 4.
| |
| In MODES 5 and 6, the probability and consequences of a LOCA are reduced due to the pressure and temperature limitations of these MODES. Therefore, the DIS is not required to be OPERABLE in MODES 5 and 6.
| |
| ACTIONS A.1 and A.2 (See footnote)
| |
| With one DIS train inoperable, the inoperable train must be restored to OPERABLE status within 7 days or the OPERABLE train must be verified OPERABLE frequently by performance of SR 3.6.9.1. The 7 day Completion Time is based on the low probability of the occurrence of a degraded core event that would generate hydrogen in amounts equivalent to a metal water reaction of 75% of the core cladding, the length of time after the event that operator action would be required to prevent hydrogen accumulation from exceeding this limit, and the low probability of failure of the OPERABLE DIS train. Alternative Required Action A.2, by frequent Surveillances, provides assurance that the OPERABLE train continues to be OPERABLE.
| |
| Footnote: For the remainder of Fuel Cycle 18, or until the next entry into a MODE which allows replacement of the affected ignitors, DIS Train B can still perform its safety function and may be considered OPERABLE with one lower containment Phase 2 Power Supply ignitor inoperable and with one lower containment Phase 3 Power Supply ignitor inoperable (Reference 3).
| |
| Cook Nuclear Plant Unit 2 B 3.6.9-3 Revision No. 25
| |
| | |
| DIS B 3.6.9 BASES ACTIONS B.1 Condition B is one containment region with no OPERABLE hydrogen ignitor. Thus, while in Condition B, or in Conditions A and B simultaneously, there would always be ignition capability in the adjacent containment regions that would provide redundant capability by flame propagation to the region with no OPERABLE ignitors.
| |
| Required Action B.1 calls for the restoration of one hydrogen ignitor in each region to OPERABLE status within 7 days. The 7 day Completion Time is based on the same reasons given under Required Action A.1.
| |
| C.1 If any Required Action and associated Completion Time is not met, the unit must be placed in a MODE in which the LCO does not apply. This is done by placing the unit in at least MODE 3 within 6 hours. The allowed Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems.
| |
| SURVEILLANCE SR 3.6.9.1 REQUIREMENTS This SR confirms that 34 of 35 hydrogen ignitors (or 33 ignitors if allowed by footnote) can be successfully energized in each train. The ignitors are simple resistance elements. Therefore, energizing provides assurance of OPERABILITY. The allowance of one inoperable hydrogen ignitor is acceptable because, although one inoperable hydrogen ignitor in a region would compromise redundancy in that region, the containment regions are interconnected so that ignition in one region would cause burning to progress to the others (i.e., there is overlap in each hydrogen ignitor's effectiveness between regions). The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.6.9.2 This SR confirms that the two inoperable hydrogen ignitors allowed by SR 3.6.9.1 (i.e., one in each train) are not in the same containment region. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Footnote: For the remainder of Fuel Cycle 18, or until the next entry into a MODE which allows replacement of the affected ignitors, DIS Train B can still perform its safety function and may be considered OPERABLE with one lower containment Phase 2 Power Supply ignitor inoperable and with one lower containment Phase 3 Power Supply ignitor inoperable (Reference 3).
| |
| Cook Nuclear Plant Unit 2 B 3.6.9-4 Revision No. 60
| |
| | |
| DIS B 3.6.9 BASES SURVEILLANCE SR 3.6.9.3 REQUIREMENTS A more detailed functional test is performed to verify system OPERABILITY. Each ignitor is visually examined to ensure that it is clean and that the electrical circuitry is energized. All ignitors, including normally inaccessible ignitors, are visually checked for a glow to verify that they are energized. Additionally, the surface temperature of each ignitor (see footnote) is measured to be 1700°F to demonstrate that a temperature sufficient for ignition is achieved. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. 10 CFR 50.44.
| |
| : 2. UFSAR, Section 5.8.
| |
| : 3. Letter from T. Beltz, NRC, to J. Jensen, I&M, Donald C. Cook Nuclear Plant, Unit 2 - Issuance of Exigent Amendment Re: The Containment Distributed Ignition System (TAC No. ME3129), dated February 4, 2010.
| |
| Footnote: For the remainder of Fuel Cycle 18, or until the next entry into a MODE which allows replacement of the affected ignitors, DIS Train B can still perform its safety function and may be considered OPERABLE with one lower containment Phase 2 Power Supply ignitor inoperable and with one lower containment Phase 3 Power Supply ignitor inoperable (Reference 3).
| |
| Cook Nuclear Plant Unit 2 B 3.6.9-5 Revision No. 60
| |
| | |
| DIS B 3.6.9 THIS PAGE INTENTIONALLY LEFT BLANK Cook Nuclear Plant Unit 2 B 3.6.9-6 Revision No. 25
| |
| | |
| CEQ System B 3.6.10 B 3.6 CONTAINMENT SYSTEMS B 3.6.10 Containment Air Recirculation/Hydrogen Skimmer (CEQ) System BASES BACKGROUND The CEQ System is designed to assure the rapid return of air from the upper to the lower containment compartment after the initial blowdown following a Design Basis Accident (DBA). The return of this air to the lower compartment and subsequent recirculation back up through the ice condenser assists in cooling the containment atmosphere and limiting post accident pressure and temperature in containment to less than design values. Limiting pressure and temperature reduces the release of fission product radioactivity from containment to the environment in the event of a DBA.
| |
| The CEQ System provides post accident hydrogen mixing in selected areas of containment. The hydrogen skimmer portion of the CEQ System consists of two hydrogen skimmer headers routed to potential hydrogen pockets in containment, terminating on the suction side of either of the two CEQ System fans at the header isolation valves. The minimum design flow from each potential hydrogen pocket is sufficient to limit the local concentration of hydrogen.
| |
| The CEQ System consists of two separate trains of equal capacity, each capable of meeting the design bases. Each train includes a 100%
| |
| capacity air return fan, dampers, two upper compartment headers, and a hydrogen skimmer header with an isolation valve. Each train is powered from a separate Engineered Safety Features (ESF) bus.
| |
| The CEQ fans are automatically started by the Containment Pressure -
| |
| High signal in approximately 2 minutes after the containment pressure reaches the pressure setpoint. This also supports the required ice melt during a small break loss of coolant accident (LOCA) to ensure adequate containment recirculation sump inventory for initiation of the recirculation mode. The hydrogen skimmer header isolation valve opens when the CEQ System fan starts. The time delay ensures that the core reflood time assumed in the LOCA peak clad temperature analysis is met.
| |
| After starting, the fans displace air from the upper compartment to the lower compartment, thereby returning the air that was displaced by the high energy line break blowdown from the lower compartment and equalizing pressures throughout containment. After discharge into the lower compartment, air flows with steam produced by residual heat through the ice condenser doors into the ice condenser compartment where the steam portion of the flow is condensed. The air flow returns to the upper compartment through the top deck doors in the upper portion of the ice condenser compartment. The CEQ System fans operate Cook Nuclear Plant Unit 2 B 3.6.10-1 Revision No. 0
| |
| | |
| CEQ System B 3.6.10 BASES BACKGROUND (continued) continuously after actuation, circulating air through the containment volume and purging all potential hydrogen pockets in containment.
| |
| The CEQ System also functions, after all the ice has melted, to circulate any steam still entering the lower compartment to the upper compartment where the Containment Spray System can cool it.
| |
| The CEQ System is designed to ensure that the heat removal capability required during the post accident period can be attained. The operation of the CEQ System, in conjunction with the ice bed, the Containment Spray System, and the Residual Heat Removal (RHR) System spray, provides the required heat removal capability to limit post accident conditions to less than the containment design values.
| |
| APPLICABLE The limiting DBAs considered relative to containment temperature and SAFETY pressure are the LOCA and the steam line break (SLB). The LOCA and ANALYSES SLB are analyzed using computer codes designed to predict the resultant containment pressure and temperature transients. DBAs are assumed not to occur simultaneously or consecutively. The postulated DBAs are analyzed, in regard to ESF systems, assuming the loss of one ESF bus, which is the worst case single active failure and results in one train each of the Containment Spray System, RHR System, and CEQ System being inoperable (Ref. 1). The DBA analyses show that the maximum peak containment pressure results from the LOCA analysis and is calculated to be less than the containment design pressure.
| |
| For certain aspects of transient accident analyses, maximizing the calculated containment pressure is not conservative. In particular, the cooling effectiveness of the Emergency Core Cooling System during the core reflood phase of a LOCA analysis increases with increasing containment backpressure. For these calculations, the containment backpressure is calculated in a manner designed to conservatively minimize, rather than maximize, the calculated transient containment pressures, in accordance with 10 CFR 50, Appendix K (Ref. 2).
| |
| The modeled CEQ System actuation from the containment analysis is based upon a response time associated with exceeding the Containment Pressure - High Function setpoint to achieving full CEQ System air flow.
| |
| The response time band ensures that containment temperature and pressure profiles are as assumed in the overall accident analyses (i.e., containment structural response and peak clad temperature analyses). The CEQ System total response time of 132 seconds includes the built in signal delay.
| |
| The CEQ System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| Cook Nuclear Plant Unit 2 B 3.6.10-2 Revision No. 0
| |
| | |
| CEQ System B 3.6.10 BASES LCO In the event of a DBA, one train of the CEQ System is required to provide the minimum air recirculation for heat removal and hydrogen mixing assumed in the safety analyses. To ensure this requirement is met, two trains of the CEQ System must be OPERABLE. This will ensure that at least one train will operate, assuming the worst case single failure occurs.
| |
| APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause an increase in containment pressure and temperature requiring the operation of the CEQ System.
| |
| Therefore, the LCO is applicable in MODES 1, 2, 3, and 4.
| |
| In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, the CEQ System is not required to be OPERABLE in these MODES.
| |
| ACTIONS A.1 If one of the trains of the CEQ System is inoperable, it must be restored to OPERABLE status within 72 hours. The components in this degraded condition are capable of providing 100% of the flow and hydrogen skimming needs after an accident. The 72 hour Completion Time was developed taking into account the redundant flow and hydrogen skimming capability of the OPERABLE CEQ System train and the low probability of a DBA occurring in this period.
| |
| B.1 and B.2 If the CEQ System train cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| SURVEILLANCE SR 3.6.10.1 REQUIREMENTS Verifying that each CEQ System fan starts on an actual or simulated actuation signal, after a delay 108 seconds and 132 seconds, and operates for 15 minutes is sufficient to ensure that all fans are OPERABLE and that all associated controls and time delays are functioning properly. It also ensures that blockage, fan and/or motor failure, or excessive vibration can be detected for corrective action. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Cook Nuclear Plant Unit 2 B 3.6.10-3 Revision No. 60
| |
| | |
| CEQ System B 3.6.10 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| This SR has been modified by a Note that states that this Surveillance is only required to be met in MODES 1, 2, and 3. This allowance is necessary since the specified delay (i.e., 108 seconds and 132 seconds) is only applicable to the automatic actuation signal (i.e., Containment Pressure - High), which is only required to be OPERABLE in MODES 1, 2, and 3. In addition, LCO 3.3.2, "Engineered Safety Feature Actuation System (ESFAS) Instrumentation," requires the CEQ System Manual Initiation Function to be OPERABLE in MODE 4 and requires the performance of a TADOT every 24 months. This requirement will ensure the Manual Initiation Function can actuate the required equipment in MODE 4.
| |
| SR 3.6.10.2 Verifying, with the return air fan discharge backdraft damper locked closed and the fan motor energized, the static pressure between the fan discharge and the backdraft damper is 4.0 inches water gauge confirms one operating condition of the fan. This test is indicative of overall fan motor performance. Such tests confirm component OPERABILITY and detect incipient failures by indicating abnormal performance. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.6.10.3 Verifying the OPERABILITY of the return air damper provides assurance that the proper flow path will exist when the fan is started. By applying the correct counterweight, the damper operation can be confirmed. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.6.10.4 Verifying the OPERABILITY of the motor operated valve in the hydrogen skimmer header provides assurance that the proper flow path will exist when the valve receives an actuation signal. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Cook Nuclear Plant Unit 2 B 3.6.10-4 Revision No. 60
| |
| | |
| CEQ System B 3.6.10 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| This SR has been modified by a Note that states that this Surveillance is only required to be met in MODES 1, 2, and 3. This allowance is acceptable since, in MODE 4, automatic operation is not required.
| |
| LCO 3.3.2 requires only the CEQ System Manual Initiation Function to be OPERABLE in MODE 4 and requires the performance of a TADOT every 24 months. This requirement will ensure the Manual Initiation Function can actuate the required equipment in MODE 4.
| |
| REFERENCES 1. UFSAR, Section 14.3.4.
| |
| : 2. 10 CFR 50, Appendix K.
| |
| Cook Nuclear Plant Unit 2 B 3.6.10-5 Revision No. 0
| |
| | |
| Ice Bed B 3.6.11 B 3.6 CONTAINMENT SYSTEMS B 3.6.11 Ice Bed BASES BACKGROUND The ice bed consists of a minimum of 2,200,000 lb of ice stored within the ice condenser. The primary purpose of the ice bed is to provide a large heat sink in the event of a release of energy from a Design Basis Accident (DBA) in containment. The ice would absorb energy and limit containment peak pressure and temperature during the accident transient. Limiting the pressure and temperature reduces the release of fission product radioactivity from containment to the environment in the event of a DBA.
| |
| The ice condenser is an annular compartment enclosing approximately 300° of the perimeter of the upper containment compartment, but penetrating the operating deck so that a portion extends into the lower containment compartment. The lower portion has a series of hinged doors exposed to the atmosphere of the lower containment compartment, which, for normal unit operation, are designed to remain closed. At the top of the ice condenser is another set of doors exposed to the atmosphere of the upper compartment, which also remain closed during normal unit operation. Intermediate deck doors, located below the top deck doors, form the floor of a plenum at the upper part of the ice condenser. These doors also remain closed during normal unit operation.
| |
| The upper plenum area is used to facilitate surveillance and maintenance of the ice bed.
| |
| The ice baskets contain the ice within the ice condenser. The ice bed is considered to consist of the total volume from the bottom elevation of the ice baskets to the top elevation of the ice baskets. The ice baskets position the ice within the ice bed in an arrangement to promote heat transfer from steam to ice. This arrangement enhances the ice condenser's primary function of condensing steam and absorbing heat energy released to the containment during a DBA.
| |
| In the event of a DBA, the ice condenser inlet doors (located below the operating deck) open due to the pressure rise in the lower compartment.
| |
| This allows air and steam to flow from the lower compartment into the ice condenser. The resulting pressure increase within the ice condenser causes the intermediate deck doors and the top deck doors to open, which allows the air to flow out of the ice condenser into the upper compartment. Steam condensation within the ice condenser limits the pressure and temperature buildup in containment. A divider barrier (i.e., operating deck and extensions thereof) separates the upper and lower compartments and ensures that the steam is directed into the ice condenser.
| |
| Cook Nuclear Plant Unit 2 B 3.6.11-1 Revision No. 0
| |
| | |
| Ice Bed B 3.6.11 BASES BACKGROUND (continued)
| |
| The ice, together with the containment spray, is adequate to absorb at least twice the initial blowdown of steam and water from a loss of coolant accident (LOCA) or at least twice the energy released from a feedwater or main steam line break. The excess capacity is necessary to absorb the additional heat loads that would enter containment during several hours following the initial blowdown. The additional heat loads would come from the residual heat in the reactor core, the hot piping and components, and the secondary system, including the steam generators. During the post blowdown period, the Containment Air Recirculation/Hydrogen Skimmer (CEQ) System returns upper compartment air through the divider barrier to the lower compartment. This serves to equalize pressures in containment and to continue circulating heated air and steam from the lower compartment through the ice condenser where the heat is removed by the remaining ice.
| |
| As ice melts, the water passes through the ice condenser floor drains into the lower compartment. Thus, a second function of the ice bed is to be a large source of borated water (via the containment sump) for long term Emergency Core Cooling System (ECCS) and Containment Spray System heat removal functions in the recirculation mode.
| |
| A third function of the ice bed and melted ice is to remove fission product iodine that may be released from the core during a DBA. Iodine removal occurs during the ice melt phase of the accident and continues as the melted ice is sprayed into the containment atmosphere by the Containment Spray System. The ice is adjusted to an alkaline pH using sodium tetraborate, to assist in minimizing evolution of iodine from the containment sump. The alkaline pH also minimizes the occurrence of the chloride and caustic stress corrosion on mechanical systems and components exposed to ECCS and Containment Spray System fluids in the recirculation mode of operation.
| |
| It is important for ice to exist in the ice baskets, the ice to be appropriately distributed around the 24 ice condenser bays, and for open flow paths to exist around ice baskets. This is especially important during the initial blowdown so that the steam and water mixture entering the lower compartment do not pass through only part of the ice condenser, depleting the ice there while bypassing the ice in other bays.
| |
| Two phenomena that can degrade the ice bed during the long service period are:
| |
| : a. Loss of ice by melting or sublimation; and
| |
| : b. Obstruction of flow passages through the ice bed due to buildup of ice.
| |
| Cook Nuclear Plant Unit 2 B 3.6.11-2 Revision No. 0
| |
| | |
| Ice Bed B 3.6.11 BASES BACKGROUND (continued)
| |
| Both of these degrading phenomena are reduced by minimizing air leakage into and out of the ice condenser.
| |
| The ice bed limits the temperature and pressure that could be expected following a DBA, thus limiting leakage of fission product radioactivity from containment to the environment.
| |
| APPLICABLE The limiting DBAs considered relative to containment temperature and SAFETY pressure are the loss of coolant accident (LOCA) and the steam line ANALYSES break (SLB). The LOCA and SLB are analyzed using computer codes designed to predict the resultant containment pressure and temperature transients. DBAs are not assumed to occur simultaneously or consecutively.
| |
| Although the ice condenser is a passive system that requires no electrical power to perform its function, the Containment Spray System and the CEQ System also function to assist the ice bed in limiting pressures and temperatures. Therefore, the postulated DBAs are analyzed in regards to containment Engineered Safety Feature (ESF) systems, assuming the worst case single active failure.
| |
| The limiting DBA analyses (Ref. 1) show that the maximum peak containment pressure results from the LOCA analysis and is calculated to be less than the containment design pressure. The maximum peak containment atmosphere temperature results from the SLB analysis and is discussed in the Bases for LCO 3.6.5, "Containment Air Temperature."
| |
| In addition to calculating the overall peak containment pressures, the DBA analyses include calculation of the transient differential pressures that occur across subcompartment walls during the initial blowdown phase of the accident transient. The internal containment walls and structures are designed to withstand these local transient pressure differentials for the limiting DBAs.
| |
| The Ice Bed satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The ice bed LCO requires the existence of the required quantity of stored ice, appropriate distribution of the ice within the ice bed, open flow paths through the ice bed, and appropriate chemical content and pH of the stored ice. The stored ice functions to absorb heat during the blowdown phase and long term phase of a DBA, thereby limiting containment air temperature and pressure. The chemical content and pH of the stored ice provides core SDM (boron content) and assists in removing radioactive iodine from the containment atmosphere when the melted ice is recirculated through the ECCS and the Containment Spray System, respectively.
| |
| Cook Nuclear Plant Unit 2 B 3.6.11-3 Revision No. 0
| |
| | |
| Ice Bed B 3.6.11 BASES APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause an increase in containment pressure and temperature requiring the operation of the ice bed.
| |
| Therefore, the LCO is applicable in MODES 1, 2, 3, and 4.
| |
| In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, the ice bed is not required to be OPERABLE in these MODES.
| |
| ACTIONS A.1 If the ice bed is inoperable, it must be restored to OPERABLE status within 48 hours. The Completion Time was developed based on operating experience, which confirms that due to the very large mass of stored ice, the parameters comprising OPERABILITY do not change appreciably in this time period. If a degraded condition is identified, even for temperature, with such a large mass of ice it is not possible for the degraded condition to significantly degrade further in a 48 hour period.
| |
| Therefore, 48 hours is a reasonable amount of time to correct a degraded condition before initiating a shutdown.
| |
| B.1 and B.2 If the ice bed cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| SURVEILLANCE SR 3.6.11.1 REQUIREMENTS Verifying that the maximum temperature of the ice bed is 27°F ensures that the ice is kept well below the melting point. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Cook Nuclear Plant Unit 2 B 3.6.11-4 Revision No. 60
| |
| | |
| Ice Bed B 3.6.11 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.6.11.2 Ice mass determination methodology is designed to verify the total as-found (pre-maintenance) mass of ice in the ice bed, and the appropriate distribution of that mass, using a random sampling of individual baskets.
| |
| The random sample will include at least 30 baskets from each of three defined radial zones (at least 90 baskets total). Zone A consists of baskets located in radial rows 7, 8, and 9 (innermost rows adjacent to the Crane Wall), zone B consists of baskets located in radial rows 4, 5, and 6 (middle rows of the ice bed), and zone C consists of baskets located in radial rows 1, 2, and 3 (outermost rows adjacent to the containment structure).
| |
| The radial zones chosen include the row groupings nearest the inside and outside walls of the ice bed and the middle rows of the ice bed. These groupings facilitate the statistical sampling plan by creating sub-populations of ice baskets that have similar mean mass and sublimation characteristics.
| |
| Methodology for determining sample ice basket mass will be either by direct lifting or by alternative techniques discussed in Reference 2, except visual estimation which is precluded by Reference 3. Any method chosen will include procedural allowances for the accuracy of the method used.
| |
| The number of sample baskets in any radial zone may be increased once by adding 20 or more randomly selected baskets to verify the total mass of that radial zone (Ref. 3).
| |
| In the event the mass of a selected basket in a sample population (initial or expanded) cannot be determined by any available means (e.g., due to surface ice accumulation or obstruction), a randomly selected representative alternate basket may be used to replace the original selection in that sample population. If employed, the representative alternate must meet the following criteria:
| |
| : a. Alternate selection must be from the same bay-zone (i.e., same bay, same radial zone) as the original selection; and
| |
| : b. Alternate selection cannot be a repeated selection (original or alternate) in the current Surveillance, and cannot have been used as an analyzed alternate selection in the three most recent Surveillances.
| |
| The complete basis for the methodology used in establishing the 95%
| |
| confidence level in the total ice bed mass is documented in Reference 2 and approved in Reference 3.
| |
| Cook Nuclear Plant Unit 2 B 3.6.11-5 Revision No. 0
| |
| | |
| Ice Bed B 3.6.11 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| The total ice mass and individual radial zone ice mass requirements defined in this Surveillance, and the minimum ice mass per basket requirement defined by SR 3.6.11.3, are the minimum requirements for OPERABILITY. Additional ice mass beyond the SRs is maintained to address sublimation. This sublimation allowance is generally applied to baskets in each radial zone, as appropriate, at the beginning of an operating cycle to ensure sufficient ice is available at the end of the operating cycle for the ice condenser to perform its intended design function.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.6.11.3 Verifying that each selected sample basket from SR 3.6.11.2 contains at least 600 lbs of ice in the as-found (pre-maintenance) condition ensures that a significant localized degraded mass condition is avoided.
| |
| This SR establishes a per basket limit to ensure any ice mass degradation is consistent with the initial conditions of the DBA by not significantly affecting the containment pressure response. Reference 2 provides insights through sensitivity runs that demonstrate that the containment peak pressure during a DBA is not significantly affected by the ice mass in a large localized region of baskets being degraded below the required safety analysis mean, when the radial zone and total ice mass requirements of SR 3.6.11.2 are satisfied. Any basket identified as containing less than 600 lbs of ice requires appropriately entering ACTION A for an inoperable ice bed due to the potential that it may represent a significant condition adverse to quality.
| |
| As documented in Reference 2, maintenance practices actively manage individual ice basket mass above the required safety analysis mean for each radial zone. Specifically, each basket is serviced to keep its ice mass above 1132 lbs for zone A, 1132 lbs for zone B, and 1132 lbs for zone C. If a basket sublimates below the safety analysis mean value, this instance is identified within the CNP corrective action program, including evaluating maintenance practices to identify the cause and correct any deficiencies. These maintenance practices provide defense in depth beyond compliance with the ice bed Surveillance Requirements by limiting the occurrence of individual baskets with ice mass less than the required safety analysis mean.
| |
| Cook Nuclear Plant Unit 2 B 3.6.11-6 Revision No. 60
| |
| | |
| Ice Bed B 3.6.11 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| For Fuel Cycle 26, individual ice baskets need not be serviced to keep their ice mass above 1132 lbs. provided that SR 3.6.11.2 and SR 3.6.11.3 requirements are projected to be met for the fuel cycle. An evaluation (Reference 5) has demonstrated that the as-left ice basket condition would not result in a significant localized degraded mass condition during the fuel cycle.
| |
| SR 3.6.11.4 This SR ensures that the flow channels through the ice bed have not accumulated ice blockage that exceeds 15 percent of the total flow area through the ice bed region. The allowable 15 percent buildup of ice is based on the analysis of the sub-compartment response to a design basis LOCA with partial blockage of the ice condenser flow channels. The analysis did not perform detailed flow area modeling, but lumped the ice condenser bays into six sections ranging from 2.75 bays to 6.5 bays.
| |
| Individual bays are acceptable with greater than 15 percent blockage, as long as 15 percent blockage is not exceeded for any analysis section.
| |
| To provide a 95 percent confidence that flow blockage does not exceed the allowed 15 percent, the visual inspection must be made for at least 54 (33 percent) of the 162 flow channels per ice condenser bay. The visual inspection of the ice bed flow channels is to inspect the flow area, by looking down from the top of the ice bed, and where view is achievable up from the bottom of the ice bed. Flow channels to be inspected are determined by random sample. As the most restrictive ice bed flow passage is found at a lattice frame elevation, the 15 percent blockage criteria only applies to "flow channels" that comprise the area:
| |
| : a. between ice baskets; and
| |
| : b. past lattice frames and wall panels.
| |
| Due to significantly larger flow area in the regions of the upper deck grating and the lower inlet plenum support structures and turning vanes, a gross buildup of ice on these structures would be required to degrade air and steam flow. Therefore, these structures are excluded as part of a flow channel for application of the 15 percent blockage criteria. Industry experience has shown that removal of ice from the excluded structures during the refueling outage is sufficient to ensure they remain operable throughout the operating cycle. Removal of any gross ice buildup on the excluded structures is performed following outage maintenance activities.
| |
| Operating experience has demonstrated that the ice bed is the region that is the most flow restrictive, due to the normal presence of ice accumulation on lattice frames and wall panels. The flow area through Cook Nuclear Plant Unit 2 B 3.6.11-7 Revision No. 82
| |
| | |
| Ice Bed B 3.6.11 BASES SURVEILLANCE REQUIREMENTS (continued) the ice basket support platform is not a more restrictive flow area because it is easily accessible from the lower plenum and is maintained clear of ice accumulation. There is no mechanistically credible method for ice to accumulate on the ice basket support platform during unit operation.
| |
| Plant and industry experience has shown that the vertical flow area through the ice basket support platform remains clear of ice accumulation that could produce blockage. Normally only a glaze may develop or exist on the ice basket support platform which is not significant to blockage of flow area. Additionally, outage maintenance practices provide measures to clear the ice basket support platform following maintenance activities of any accumulation of ice that could block flow areas.
| |
| Frost buildup or loose ice is not to be considered as flow channel blockage, whereas attached ice is considered blockage of a flow channel.
| |
| Frost is the solid form of water that is loosely adherent, and can be brushed off with the open hand. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.6.11.5 This SR ensures that a representative sampling of ice baskets, which are relatively thin walled, perforated cylinders, have not been degraded by wear, cracks, corrosion, or other damage. The SR is designed around a full-length inspection of a sample of baskets, and is intended to monitor the effect of the ice condenser environment on ice baskets. The groupings defined in the SR (two baskets in each azimuthal third of the ice bed) ensure that the sampling of baskets is reasonably distributed.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.6.11.6 Verifying the chemical composition of the stored ice ensures that the stored ice has a boron concentration 1800 ppm and 2300 ppm as sodium tetraborate and a high pH, 9.0 and 9.5 at 25°C, in order to meet the requirement for borated water when the melted ice is used in the ECCS recirculation mode of operation. Additionally, the minimum boron concentration limit is used to assure reactor subcriticality in a post LOCA environment, while the maximum boron concentration limit is used as the bounding value in the hot leg switchover timing calculation (Ref. 4). This is accomplished by obtaining at least 24 ice samples. Each sample is Cook Nuclear Plant Unit 2 B 3.6.11-8 Revision No. 60
| |
| | |
| Ice Bed B 3.6.11 BASES SURVEILLANCE REQUIREMENTS (continued) taken approximately one foot from the top of the ice of each randomly selected ice basket in each ice condenser bay. The SR is modified by a Note that allows the boron concentration and pH value obtained from averaging the individual samples' analysis results to satisfy the requirements of the SR. If either the average boron concentration or average pH value is outside their prescribed limit, then entry into Condition A is required. Sodium tetraborate has been proven effective in maintaining the boron content for long storage periods, and it also enhances the ability of the solution to remove and retain fission product iodine, although the removal of iodine from the containment atmosphere by the sodium tetraborate is not assumed in the accident analysis. This pH range also minimizes the occurrence of chloride and caustic stress corrosion on mechanical systems and components exposed to ECCS and Containment Spray System fluids in the recirculation mode of operation.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.6.11.7 This SR ensures that initial ice fill and any subsequent ice additions meet the boron concentration and pH requirements of SR 3.6.11.6. The SR is modified by a Note that allows the chemical analysis to be performed on either the liquid or resulting ice of each sodium tetraborate solution prepared. If ice is obtained from offsite sources, then chemical analysis data must be obtained for the ice supplied.
| |
| Cook Nuclear Plant Unit 2 B 3.6.11-9 Revision No. 60
| |
| | |
| Ice Bed B 3.6.11 BASES REFERENCES 1. UFSAR, Section 14.3.4.
| |
| : 2. Topical Report ICUG-001, "Application of the Active Ice Mass Management (AIMM) Concept to the Ice Condenser Ice Mass Technical Specifications," Rev. 3, September 2003.
| |
| : 3. NRC Letter dated September 11, 2003, "Safety Evaluation for Ice Condenser Utility Group Topical Report No. ICUG-001, Revision 2, RE: Application of the Active Ice Mass Management Concept to the Ice Condenser Ice Mass Technical Specification (TAC No. MB3379)."
| |
| : 4. UFSAR, Table 5.3.2-1.
| |
| : 5. MD-02-ICE-002-N, Revise Unit 2 Ice Basket Acceptance Criteria for Unit 2 Cycle 26, Feb 2021.
| |
| Cook Nuclear Plant Unit 2 B 3.6.11-10 Revision No. 82
| |
| | |
| Ice Condenser Doors B 3.6.12 B 3.6 CONTAINMENT SYSTEMS B 3.6.12 Ice Condenser Doors BASES BACKGROUND The ice condenser doors consist of the inlet doors, the intermediate deck doors, and the top deck doors. The functions of the doors are to:
| |
| : a. Seal the ice condenser from air leakage during the lifetime of the unit; and
| |
| : b. Open in the event of a Design Basis Accident (DBA) to direct the hot steam air mixture from the DBA into the ice bed, where the ice would absorb energy and limit containment peak pressure and temperature during the accident transient.
| |
| Limiting the pressure and temperature following a DBA reduces the release of fission product radioactivity from containment to the environment.
| |
| The ice condenser is an annular compartment enclosing approximately 300° of the perimeter of the upper containment compartment, but penetrating the operating deck so that a portion extends into the lower containment compartment. The inlet doors separate the atmosphere of the lower compartment from the ice bed inside the ice condenser. The top deck doors are above the ice bed and exposed to the atmosphere of the upper compartment. The intermediate deck doors, located below the top deck doors, form the floor of a plenum at the upper part of the ice condenser. This plenum area is used to facilitate surveillance and maintenance of the ice bed.
| |
| The ice baskets held in the ice bed within the ice condenser are arranged to promote heat transfer from steam to ice. This arrangement enhances the ice condenser's primary function of condensing steam and absorbing heat energy released to the containment during a DBA.
| |
| In the event of a DBA, the ice condenser inlet doors (located below the operating deck) open due to the pressure rise in the lower compartment.
| |
| This allows air and steam to flow from the lower compartment into the ice condenser. The resulting pressure increase within the ice condenser causes the intermediate deck doors and the top deck doors to open, which allows the air to flow out of the ice condenser into the upper compartment. Steam condensation within the ice condensers limits the pressure and temperature buildup in containment. A divider barrier separates the upper and lower compartments and ensures that the steam is directed into the ice condenser.
| |
| Cook Nuclear Plant Unit 2 B 3.6.12-1 Revision No. 0
| |
| | |
| Ice Condenser Doors B 3.6.12 BASES BACKGROUND (continued)
| |
| The ice, together with the containment spray, serves as a containment heat removal system and is adequate to absorb at least twice the initial blowdown of steam and water from a loss of coolant accident (LOCA) or at least twice the energy released from a feedwater or main steam line break. The excess capacity is necessary to absorb the additional heat loads that would enter containment during the several hours following the initial blowdown. The additional heat loads would come from the residual heat in the reactor core, the hot piping and components, and the secondary system, including the steam generators. During the post blowdown period, the Containment Air Recirculation/Hydrogen Skimmer (CEQ) System returns upper compartment air through the divider barrier to the lower compartment. This serves to equalize pressures in containment and to continue circulating heated air and steam from the lower compartment through the ice condenser, where the heat is removed by the remaining ice.
| |
| The water from the melted ice drains into the lower compartment where it serves as a source of borated water (via the containment sump) for the Emergency Core Cooling System (ECCS) and the Containment Spray System heat removal functions in the recirculation mode. The ice (via the Containment Spray System) and the recirculated ice melt also serve to clean up the containment atmosphere.
| |
| The ice condenser doors ensure that the ice stored in the ice bed is preserved during normal operation (doors closed) and that the ice condenser functions as designed if called upon to act as a passive heat sink following a DBA.
| |
| APPLICABLE The limiting DBAs considered relative to containment pressure and SAFETY temperature are the loss of coolant accident (LOCA) and the steam line ANALYSES break (SLB). The LOCA and SLB are analyzed using computer codes designed to predict the resultant containment pressure and temperature transients. DBAs are assumed not to occur simultaneously or consecutively.
| |
| Although the ice condenser is a passive system that requires no electrical power to perform its function, the Containment Spray System and CEQ System also function to assist the ice bed in limiting pressures and temperatures. Therefore, the postulated DBAs are analyzed with respect to Engineered Safety Feature (ESF) systems, assuming the loss of one ESF bus, which is the worst case single active failure and results in one train each of the Containment Spray System and the CEQ System being rendered inoperable.
| |
| Cook Nuclear Plant Unit 2 B 3.6.12-2 Revision No. 0
| |
| | |
| Ice Condenser Doors B 3.6.12 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| The limiting DBA analyses (Ref. 1) show that the maximum peak containment pressure results from the LOCA analysis and is calculated to be less than the containment design pressure.
| |
| The maximum peak containment atmosphere temperature results from the SLB analysis and is discussed in the Bases for LCO 3.6.5, "Containment Air Temperature."
| |
| An additional design requirement was imposed on the ice condenser door design for a small break accident in which the flow of heated air and steam is not sufficient to fully open the doors.
| |
| For this situation, the doors are designed so that all of the doors would partially open by approximately the same amount. Thus, the partially opened doors would modulate the flow so that each ice bay would receive an approximately equal fraction of the total flow.
| |
| This design feature ensures that the heated air and steam will not flow preferentially to some ice bays and deplete the ice there without utilizing the ice in the other bays.
| |
| In addition to calculating the overall peak containment pressures, the DBA analyses include the calculation of the transient differential pressures that would occur across subcompartment walls during the initial blowdown phase of the accident transient. The internal containment walls and structures are designed to withstand the local transient pressure differentials for the limiting DBAs.
| |
| The Ice Condenser Doors satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO This LCO establishes the minimum equipment requirements to assure that the ice condenser doors perform their safety function. The ice condenser inlet doors, intermediate deck doors, and top deck doors must be closed to minimize air leakage into and out of the ice condenser, with its attendant leakage of heat into the ice condenser and loss of ice through melting and sublimation. The doors must be OPERABLE to ensure the proper opening of the ice condenser in the event of a DBA.
| |
| OPERABILITY includes being free of any obstructions that would limit their opening, and for the inlet doors, being adjusted such that the opening and closing torques are within limits. The ice condenser doors function with the ice condenser to limit the pressure and temperature that could be expected following a DBA.
| |
| Cook Nuclear Plant Unit 2 B 3.6.12-3 Revision No. 0
| |
| | |
| Ice Condenser Doors B 3.6.12 BASES APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause an increase in containment pressure and temperature requiring the operation of the ice condenser doors. Therefore, the LCO is applicable in MODES 1, 2, 3, and 4.
| |
| The probability and consequences of these events in MODES 5 and 6 are reduced due to the pressure and temperature limitations of these MODES. Therefore, the ice condenser doors are not required to be OPERABLE in these MODES.
| |
| ACTIONS A Note (Note 1) provides clarification that, for this LCO, separate Condition entry is allowed for each ice condenser door. Note 2 has been added to allow an intermediate deck or top deck door to be inoperable for a short duration solely due to personnel standing on or opening the door to perform required Surveillances, minor preventative maintenance, or system walkdowns, and not require entry into associated Conditions and Required Actions. This is acceptable since the ice bed temperature is normally continuously monitored using an alarm in the control room, which alarms on increasing ice bed temperature.
| |
| A.1 If an ice condenser inlet door is inoperable due to being physically restrained from opening, the door must be restored to OPERABLE status within 1 hour. The Required Action is necessary to return operation to within the bounds of the containment analysis. The 1 hour Completion Time is consistent with the ACTIONS of LCO 3.6.1, "Containment," which requires containment to be restored to OPERABLE status within 1 hour.
| |
| B.1 and B.2 If an ice condenser door is determined to be inoperable for reasons other than Condition A or if a door is found that is not closed, it is acceptable to continue unit operation for up to 14 days, provided the ice bed temperature is monitored once per 4 hours to ensure that the open or inoperable door is not allowing enough air leakage to cause the maximum ice bed temperature to approach the melting point. The Completion Time of once per 4 hours is based on the fact that temperature changes cannot occur rapidly in the ice bed because of the large mass of ice involved.
| |
| The 14 day Completion Time is based on long term ice storage tests that indicate that if the temperature is maintained below 27°F, there would not be a significant loss of ice from sublimation.
| |
| Cook Nuclear Plant Unit 2 B 3.6.12-4 Revision No. 0
| |
| | |
| Ice Condenser Doors B 3.6.12 BASES ACTIONS (continued)
| |
| C.1 If Required Action B.1 or B.2 and associated Completion Time is not met, the doors must be restored to OPERABLE status and closed positions within 48 hours. The 48 hour Completion Time is based on the fact that, with the very large mass of ice involved, it would not be possible for the temperature to increase to the melting point and a significant amount of ice to melt in a 48 hour period. The 48 hour Completion Time is also consistent with the ACTIONS of LCO 3.6.11, "Ice Bed."
| |
| D.1 and D.2 With any Required Action and associated Completion Time of Condition A or C not met, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| SURVEILLANCE SR 3.6.12.1 REQUIREMENTS Verifying that the inlet doors are in their closed positions makes the operator aware of an inadvertent opening of one or more doors. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.6.12.2 Verifying, by visual inspection, that each intermediate deck door is closed and not impaired by ice, frost, or debris provides assurance that the intermediate deck doors (which form the floor of the upper plenum where frequent maintenance on the ice bed is performed) have not been left open or obstructed. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Cook Nuclear Plant Unit 2 B 3.6.12-5 Revision No. 60
| |
| | |
| Ice Condenser Doors B 3.6.12 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.6.12.3 Verifying, by visual inspection, that the top deck doors are in place and not obstructed provides assurance that the doors are performing their function of keeping warm air out of the ice condenser during normal operation, and would not be obstructed if called upon to open in response to a DBA. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.6.12.4 Verifying, by visual inspection, that the ice condenser inlet doors are not impaired by ice, frost, or debris provides assurance that the doors are free to open in the event of a DBA. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.6.12.5 Verifying the opening torque of the inlet doors provides assurance that no doors have become stuck in the closed position. The value of 675 in-lb is based on the design opening pressure on the doors of 1.0 lb/ft2. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Cook Nuclear Plant Unit 2 B 3.6.12-6 Revision No. 60
| |
| | |
| Ice Condenser Doors B 3.6.12 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.6.12.6 The torque test Surveillance ensures that the inlet doors have not developed excessive friction and that the return springs are producing a door return torque within limits. The torque test consists of the following:
| |
| : 1. Verify that the torque, T(OPEN), required to cause opening motion at the 40° open position is 195 in-lb;
| |
| : 2. Verify that the torque, T(CLOSE), required to hold the door stationary (i.e., keep it from closing) at the 40° open position is 78 in-lb; and
| |
| : 3. Calculate the frictional torque, T(FRICT) = 0.5 {T(OPEN) - T(CLOSE)},
| |
| and verify that the T(FRICT) is 40 in-lb.
| |
| T(OPEN) is known as the "door opening torque" and is equal to the nominal door torque plus a frictional torque component. T(CLOSE) is defined as the "door closing torque" and is equal to the nominal door torque minus a frictional torque component.
| |
| The purpose of the friction and return torque Specifications is to ensure that, in the event of a small break LOCA or SLB, all of the 24 door pairs open uniformly. This assures that, during the initial blowdown phase, the steam and water mixture entering the lower compartment does not pass through part of the ice condenser, depleting the ice there, while bypassing the ice in other bays. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Cook Nuclear Plant Unit 2 B 3.6.12-7 Revision No. 60
| |
| | |
| Ice Condenser Doors B 3.6.12 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.6.12.7 Verifying the OPERABILITY of the intermediate deck doors provides assurance that the intermediate deck doors are free to open in the event of a DBA. The verification consists of visually inspecting the intermediate doors for structural deterioration, verifying free movement of the vent assemblies, and ascertaining free movement of each door when lifted with the applicable force shown below:
| |
| Door Lifting Force
| |
| : a. Adjacent to crane wall 37.4 lb
| |
| : b. Paired with door adjacent to crane wall 33.8 lb
| |
| : c. Adjacent to containment wall 31.8 lb
| |
| : d. Paired with door adjacent to containment wall 31.0 lb The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 14.3.4.
| |
| Cook Nuclear Plant Unit 2 B 3.6.12-8 Revision No. 60
| |
| | |
| Divider Barrier Integrity B 3.6.13 B 3.6 CONTAINMENT SYSTEMS B 3.6.13 Divider Barrier Integrity BASES BACKGROUND The divider barrier consists of the walls of the ice compartment, the operating deck, the compartments enclosing the upper portion of the steam generators and pressurizer, the bulkhead separating the reactor cavity from the refueling canal, the walls and floors of the east and west CEQ fan room area, and portions of the walls of the refueling canal. The operating deck includes hatches above the reactor coolant pumps. Other portions of the divider barrier are penetrated by hatches for general access and materials handling. The divider barrier separates the upper and lower containment compartments. A flexible barrier seal is located between the ice condenser compartment and the containment cylinder wall. This barrier is also located between the containment liner and other structural elements that are part of the divider barrier. Divider barrier integrity is necessary to minimize bypassing of the ice condenser by the hot steam and air mixture released into the lower compartment during a Design Basis Accident (DBA). This ensures that most of the gases pass through the ice bed, which condenses the steam and limits pressure and temperature during the accident transient. Limiting the pressure and temperature reduces the release of fission product radioactivity from containment to the environment in the event of a DBA.
| |
| In the event of a DBA, the ice condenser inlet doors (located below the operating deck) open due to the pressure rise in the lower compartment.
| |
| This allows air and steam to flow from the lower compartment into the ice condenser. The resulting pressure increase within the ice condenser causes the intermediate deck doors and the door panels at the top of the condenser to open, which allows the air to flow out of the ice condenser into the upper compartment. The ice condenses the steam as it enters, thus limiting the pressure and temperature buildup in containment. The divider barrier separates the upper and lower compartments and ensures that the steam is directed into the ice condenser. The ice, together with the containment spray, is adequate to absorb the initial blowdown of steam and water from a DBA as well as the additional heat loads that would enter containment over several hours following the initial blowdown. The additional heat loads would come from the residual heat in the reactor core, the hot piping and components, and the secondary system, including the steam generators. During the post blowdown period, the Containment Air Recirculation/Hydrogen Skimmer (CEQ)
| |
| System returns upper compartment air through the divider barrier to the lower compartment. This serves to equalize pressures in containment and to continue circulating heated air and steam from the lower compartment through the ice condenser, where the heat is removed by the remaining ice.
| |
| Cook Nuclear Plant Unit 2 B 3.6.13-1 Revision No. 0
| |
| | |
| Divider Barrier Integrity B 3.6.13 BASES BACKGROUND (continued)
| |
| Divider barrier integrity ensures that the high energy fluids released during a DBA would be directed through the ice condenser and that the ice condenser would function as designed if called upon to act as a passive heat sink following a DBA.
| |
| APPLICABLE Divider barrier integrity ensures the functioning of the ice condenser to SAFETY limit the containment pressure and temperature that could be ANALYSES experienced following a DBA. The limiting DBAs considered relative to containment temperature and pressure are the loss of coolant accident (LOCA) and the steam line break (SLB). The LOCA and SLB are analyzed using computer codes designed to predict the resultant containment pressure and temperature transients. DBAs are assumed not to occur simultaneously or consecutively.
| |
| Although the ice condenser is a passive system that requires no electrical power to perform its function, the Containment Spray System and the CEQ System also function to assist the ice bed in limiting pressures and temperatures. Therefore, the postulated DBAs are analyzed, with respect to containment Engineered Safety Feature (ESF) systems, assuming the loss of one ESF bus, which is the worst case single active failure and results in the inoperability of one train in both the Containment Spray System and the CEQ System.
| |
| The limiting DBA analyses (Ref. 1) show that the maximum peak containment pressure results from the LOCA analysis and is calculated to be less than the containment design pressure. The maximum peak containment temperature results from the SLB analysis and is discussed in the Bases for LCO 3.6.5, "Containment Air Temperature."
| |
| In addition to calculating the overall peak containment pressures, the DBA analyses include calculation of the transient differential pressures that occur across subcompartment walls during the initial blowdown phase of the accident transient. The internal containment walls and structures are designed to withstand these local transient pressure differentials for the limiting DBAs.
| |
| The Divider Barrier Integrity satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO This LCO establishes the minimum equipment requirements to ensure that the divider barrier performs its safety function of ensuring that bypass leakage, in the event of a DBA, does not exceed the bypass leakage assumed in the accident analysis. Included are the requirements that the personnel access doors and equipment hatches in the divider barrier are OPERABLE and closed and that the divider barrier seal is properly installed and has not degraded with time. As Noted, the personnel Cook Nuclear Plant Unit 2 B 3.6.13-2 Revision No. 0
| |
| | |
| Divider Barrier Integrity B 3.6.13 BASES LCO (continued) access doors between containment upper and lower compartments may be opened intermittently under administrative control for personnel transit.
| |
| Transit through the divider barrier may be required to perform Technical Specifications (TS) Surveillances and Required Actions, as well as other activities on equipment inside the containment that are required by TS or activities on equipment that support TS-required equipment. This Note is not intended to preclude performing other activities (i.e., non-TS-related activities) if the containment was entered. The required administrative controls consist of either stationing a dedicated individual at the applicable door to assure closure of the door or requiring the individual who accesses the door to ensure closure of the door. This allowance is acceptable since the door is only opened for a brief time interval. The divider barrier functions with the ice condenser to limit the pressure and temperature that could be expected following a DBA.
| |
| APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause an increase in containment pressure and temperature requiring the integrity of the divider barrier.
| |
| Therefore, the LCO is applicable in MODES 1, 2, 3, and 4.
| |
| The probability and consequences of these events in MODES 5 and 6 are low due to the pressure and temperature limitations of these MODES. As such, divider barrier integrity is not required in these MODES.
| |
| ACTIONS A.1 If a personnel access door or equipment hatch is inoperable or open, 1 hour is allowed to restore the door or equipment hatch to OPERABLE status and the closed position. The 1 hour Completion Time is consistent with LCO 3.6.1, "Containment," which requires that containment be restored to OPERABLE status within 1 hour.
| |
| Condition A has been modified by a Note to provide clarification that separate Condition entry is allowed for each personnel access door or equipment hatch.
| |
| B.1 If the divider barrier seal is inoperable, 1 hour is allowed to restore the seal to OPERABLE status. The 1 hour Completion Time is consistent with LCO 3.6.1, which requires that containment be restored to OPERABLE status within 1 hour.
| |
| Cook Nuclear Plant Unit 2 B 3.6.13-3 Revision No. 0
| |
| | |
| Divider Barrier Integrity B 3.6.13 BASES ACTIONS (continued)
| |
| C.1 and C.2 If divider barrier integrity cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| SURVEILLANCE SR 3.6.13.1 REQUIREMENTS Verification, by visual inspection, that all personnel access doors and equipment hatches between the upper and lower containment compartments are closed provides assurance that divider barrier integrity is maintained prior to the reactor being taken from MODE 5 to MODE 4.
| |
| This SR is necessary because many of the doors and hatches may have been opened for maintenance during the shutdown.
| |
| SR 3.6.13.2 Verification, by visual inspection, that the personnel access door and equipment hatch seals, sealing surfaces, and alignments are acceptable provides assurance that divider barrier integrity is maintained. This inspection cannot be made when the door or hatch is closed. Therefore, SR 3.6.13.2 is required for each door or hatch that has been opened, prior to the final closure. Some doors and hatches may not be opened for long periods of time. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.6.13.3 Verification, by visual inspection, after each opening of a personnel access door or equipment hatch that it has been closed makes the operator aware of the importance of closing it and thereby provides additional assurance that divider barrier integrity is maintained while in applicable MODES.
| |
| Cook Nuclear Plant Unit 2 B 3.6.13-4 Revision No. 60
| |
| | |
| Divider Barrier Integrity B 3.6.13 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.6.13.4 Conducting periodic physical property tests on divider barrier seal test coupons provides assurance that the seal material has not degraded in the containment environment, including the effects of irradiation with the reactor at power. The required tests include a tensile strength test and a test for elongation. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.6.13.5 Visual inspection of the seal around the perimeter provides assurance that the seal is properly secured in place, such that the total divider barrier bypass area is less than or equal to the design basis limit of 7 square feet. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 14.3.4.1.3.1.3.
| |
| : 2. UFSAR, Section 14.3.4.1.3.1.1.e Cook Nuclear Plant Unit 2 B 3.6.13-5 Revision No. 60
| |
| | |
| Containment Recirculation Drains B 3.6.14 B 3.6 CONTAINMENT SYSTEMS B 3.6.14 Containment Recirculation Drains BASES BACKGROUND The containment recirculation drains consist of the ice condenser drains, the refueling canal drains, the Containment Air Recirculation/Hydrogen Skimmer System (CEQ) fan room drains, and the flood-up overflow wall flow paths. The ice condenser is partitioned into 24 bays, each having a pair of inlet doors that open from the bottom plenum to allow the hot steam-air mixture from a Design Basis Accident (DBA) to enter the ice condenser. Twenty-one of the 24 bays have an ice condenser floor drain at the bottom to drain the melted ice into the lower compartment (in the 3 bays that do not have drains, the water drains through the floor drains in the adjacent bays). Each drain leads to a drain pipe that drops down several feet, then makes one or more 90° bends and exits into the lower compartment. A check (flapper) valve at the end of each pipe keeps warm air from entering during normal operation, but when the water exerts pressure, it opens to allow the water to spill into the lower compartment. This prevents water from backing up and interfering with the ice condenser inlet doors. The water delivered to the lower containment serves to cool the atmosphere as it falls through to the floor and provides a source of borated water at the containment sump for long term use by the Emergency Core Cooling System (ECCS) and the Containment Spray System during the recirculation mode of operation.
| |
| The CEQ fan room drains are at the floor level of the east and west CEQ fan rooms. Two drains are located in the west CEQ fan room (stairwell) and one drain is located in the east CEQ fan room (vent well). Each drain is covered by a debris interceptor which is designed to prevent blockage of the drain line. Each drain leads to the lower containment sump. The containment sump contains a flow opening to allow water to flow into the lower containment. In the event of a DBA, the CEQ fan room drains provide a return path to the lower compartment for the portion of Containment Spray System water sprayed into the upper compartment which reaches the fan rooms.
| |
| The flood-up overflow wall flow paths are communication paths within the lower compartment to allow water to flow between the loop subcompartment inside the crane wall and the annulus (pipe tunnel) outside the crane wall. The flow paths consist of a series of five 10 diameter openings in the flood-up overflow wall behind the Pressurizer Relief Tank (PRT) and two large rectangular openings in the crane wall.
| |
| These flow paths allow water in the lower compartment to reach either the main sump strainer in the loop subcompartment or the remote sump strainer in the annulus. The flow paths are protected by a debris interceptor inside the crane wall at the base of the PRT.
| |
| Cook Nuclear Plant Unit 2 B 3.6.14-1 Revision No. 19
| |
| | |
| Containment Recirculation Drains B 3.6.14 BASES BACKGROUND (continued)
| |
| The three refueling canal drains are at low points in the refueling canal.
| |
| During a refueling, blind flanges are installed in the drains and the canal is flooded to facilitate the refueling process. The water acts to shield and cool the spent fuel as it is transferred from the reactor vessel to storage.
| |
| After refueling, the canal is drained and the blind flanges removed. In the event of a DBA, the refueling canal drains are the main return path to the lower compartment for Containment Spray System water sprayed into the upper compartment.
| |
| The ice condenser drains, the refueling canal drains, the CEQ fan room drains, and the flood-up overflow wall flow paths function with the ice bed, the Containment Spray System, and the ECCS to limit the pressure and temperature that could be expected following a DBA.
| |
| APPLICABLE The limiting DBAs considered relative to containment temperature and SAFETY pressure are the loss of coolant accident (LOCA) and the steam line ANALYSES break (SLB). The LOCA and SLB are analyzed using computer codes designed to predict the resultant containment pressure and temperature transients. DBAs are assumed not to occur simultaneously or consecutively. Although the ice condenser is a passive system that requires no electrical power to perform its function, the Containment Spray System and the CEQ System also function to assist the ice bed in limiting pressures and temperatures. Therefore, the analysis of the postulated DBAs, with respect to Engineered Safety Feature (ESF) systems, assumes the loss of one ESF bus, which is the worst case single active failure and results in one train of the Containment Spray System and one train of the CEQ System being rendered inoperable.
| |
| The limiting DBA analyses (Ref. 1) show that the maximum peak containment pressure results from the LOCA analysis and is calculated to be less than the containment design pressure. The maximum peak containment atmosphere temperature results from the SLB analysis and is discussed in the Bases for LCO 3.6.5, "Containment Air Temperature."
| |
| In addition to calculating the overall peak containment pressures, the DBA analyses include calculation of the transient differential pressures that occur across subcompartment walls during the initial blowdown phase of the accident transient. The internal containment walls and structures are designed to withstand these local transient pressure differentials for the limiting DBAs.
| |
| The Containment Recirculation Drains satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| Cook Nuclear Plant Unit 2 B 3.6.14-2 Revision No. 16
| |
| | |
| Containment Recirculation Drains B 3.6.14 BASES LCO This LCO establishes the minimum requirements to ensure that the containment recirculation drains perform their safety functions. The ice condenser floor drain valve disks must be closed to minimize air leakage into and out of the ice condenser during normal operation and must open in the event of a DBA when water begins to drain out. Two of the three refueling canal drains must have their blind flanges removed and remain clear to ensure the return of Containment Spray System water to the lower containment in the event of a DBA. The CEQ fan room drains must also remain clear to ensure the return of Containment Spray System water to the lower containment in the event of a DBA. The flood-up overflow wall flow paths must remain clear to ensure water can flow readily between the loop subcompartment and the annulus. The containment recirculation drains function with the ice condenser, ECCS, and Containment Spray System to limit the pressure and temperature that could be expected following a DBA.
| |
| APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause an increase in containment pressure and temperature, which would require the operation of the containment recirculation drains. Therefore, the LCO is applicable in MODES 1, 2, 3, and 4.
| |
| The probability and consequences of these events in MODES 5 and 6 are low due to the pressure and temperature limitations of these MODES. As such, the containment recirculation drains are not required to be OPERABLE in these MODES.
| |
| BASES ACTIONS A.1 If one ice condenser floor drain is inoperable, 1 hour is allowed to restore the drain to OPERABLE status. The Required Action is necessary to return operation to within the bounds of the containment analysis. The 1 hour Completion Time is consistent with the ACTIONS of LCO 3.6.1, "Containment," which requires that containment be restored to OPERABLE status within 1 hour.
| |
| B.1 If one required refueling canal drain is inoperable, 1 hour is allowed to restore the required drain to OPERABLE status. The Required Action is necessary to return operation to within the bounds of the containment analysis. The 1 hour Completion Time is consistent with the ACTIONS of LCO 3.6.1, which requires that containment be restored to OPERABLE status in 1 hour.
| |
| Cook Nuclear Plant Unit 2 B 3.6.14-3 Revision No. 16
| |
| | |
| Containment Recirculation Drains B 3.6.14 BASES ACTIONS (continued)
| |
| C.1 If one CEQ fan room drain is inoperable, 1 hour is allowed to restore the drain to OPERABLE status. The Required Action is necessary to return operation to within the bounds of the containment analysis. The 1 hour Completion Time is consistent with the ACTIONS of LCO 3.6.1, Containment, which requires that the containment be restored to OPERABLE status within 1 hour.
| |
| D.1 If one flow path in the flood-up overflow wall is inoperable, 1 hour is allowed to restore the drain to OPERABLE status. The Required Action is necessary to return operations to within the bounds of the containment analysis. The 1 hour Completion Time is consistent with the ACTIONS of LCO 3.6.1, Containment, which requires that containment be restored to OPERABLE status within 1 hour.
| |
| E.1 and E.2 If the affected drain(s) cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| SURVEILLANCE SR 3.6.14.1 and SR 3.6.14.2 REQUIREMENTS Verifying the OPERABILITY of the required refueling canal drains ensures that they will be able to perform their functions in the event of a DBA. SR 3.6.14.2 confirms that the required refueling canal drain blind flanges have been removed and that the required drains are clear of any obstructions that could impair their functioning. In addition to debris near the drains, attention must be given to any debris that is located where it could be moved to the drains in the event that the Containment Spray System is in operation and water is flowing to the drains. This verification is performed by SR 3.6.14.1, which requires verification that there is no debris present in the upper containment or refueling canal that could obstruct the required refueling canal drains. SR 3.6.14.1 and SR 3.6.14.2 must be performed before entering MODE 4 from MODE 5 after every filling of the canal to ensure that the blind flanges have been removed and that no debris that could impair the drains was deposited during the time the canal was filled. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Cook Nuclear Plant Unit 2 B 3.6.14-4 Revision No. 60
| |
| | |
| Containment Recirculation Drains B 3.6.14 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.6.14.3 Verifying the OPERABILITY of the ice condenser floor drains ensures that they will be able to perform their functions in the event of a DBA.
| |
| Inspecting the drain valve disk ensures that the valve is performing its function of sealing the drain line from warm air leakage into the ice condenser during normal operation, yet will open if melted ice fills the line following a DBA. Verifying that the drain lines are not obstructed ensures their readiness to drain water from the ice condenser. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.6.14.4 and SR 3.6.14.5 Verifying the operability of the CEQ fan room drains ensures that they will be able to perform their function in the event of a DBA. SR 3.6.14.4 confirms that the required drains are clear of any obstructions. In addition to debris near the drains, attention must be given to debris that is located where it could be moved to the drains in the event that the Containment Spray System is in operation and water is flowing to the drains.
| |
| SR 3.6.14.4 must be performed before entering MODE 4 from MODE 5 and after personnel entry into a CEQ fan room while in MODES 1 through
| |
| : 4. This frequency was developed considering such factors as the location of the drains, and the absence of personnel traffic in the vicinity of the drains. The SR is modified by a Note. The Note indicates that only the CEQ fan room that has been entered need be inspected if the SR is being performed due to personnel entry in MODES 1 through 4. The Note precludes unnecessarily requiring inspection of both CEQ fan rooms if only one has been entered. SR 3.6.14.5 confirms that the CEQ fan room debris interceptors are installed and free of structural distress.
| |
| SR 3.6.14.5 also confirms that the flow opening at the lower containment sump is not obstructed. The 24 month frequency was developed considering such factors as the location and the design of the debris interceptors and flow opening.
| |
| Cook Nuclear Plant Unit 2 B 3.6.14-5 Revision No. 60
| |
| | |
| Containment Recirculation Drains B 3.6.14 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.6.14.6 and SR 3.6.14.7 Verifying the OPERABILITY of the flood-up overflow wall flow paths ensures that they will be able to perform their function in the event of a DBA. SR 3.6.14.6 confirms that the required flow paths are clear of any obstructions. In addition to debris near the flow paths, attention must be given to debris that is located where it could be moved to the flow paths in the event that the ECCS and Containment Spray System are in the Recirculation Mode of operation and water is flowing to the main and remote recirculation sump strainers. SR 3.6.14.6 must be performed before entering MODE 4 from MODE 5 and after personnel entry into the lower compartment while in MODES 1 through 4. This frequency was developed considering such factors as the location of the flow paths and the absence of traffic in the vicinity of the flow paths. The SR is modified by a Note. The Note indicates that only the lower containment area that has been accessed need be inspected if the SR is being performed due to personnel entry in MODES 1 through 4. The Note precludes unnecessarily requiring inspection of the entire lower containment if only a portion has been accessed. SR 3.6.14.7 confirms that the flood-up overflow debris interceptor is installed and free of structural distress. The 24 month frequency was developed considering such factors as the location and design of the debris interceptor. Because of high radiation levels in the vicinity of the debris interceptor, this Surveillance is normally done during a shutdown.
| |
| REFERENCES 1. UFSAR, Section 14.3.4.
| |
| Cook Nuclear Plant Unit 2 B 3.6.14-6 Revision No. 16
| |
| | |
| Containment Recirculation Sump B 3.6.15 B 3.6 CONTAINMENT SYSTEMS B 3.6.15 Containment Recirculation Sump BASES BACKGROUND The containment recirculation sump provides a borated water source to support recirculation of coolant from the containment recirculation sump for residual heat removal, emergency core cooling, and containment cooling, during accident conditions.
| |
| The containment recirculation sump supplies both trains of the Emergency Core Cooling System (ECCS) and the Containment Spray System (CTS) during any accident that requires recirculation of coolant from the containment recirculation sump. The recirculation mode is initiated when the pump suction is transferred to the containment recirculation sump on low Refueling Water Storage Tank (RWST) level, which ensures the containment recirculation sump has enough water to supply the net positive suction head to the ECCS and CTS pumps. The use of a single containment recirculation sump to supply both trains of the ECCS and CTS is acceptable since the containment recirculation sump is a passive component, and passive failures are not required to be assumed to occur coincident with Design Basis Events.
| |
| The containment recirculation sump contains strainers to limit the quantity of the debris materials from entering the sump suction piping. Debris accumulation on the strainers can lead to undesirable hydraulic effects including air ingestion through vortexing or deaeration, and reduced net positive suction head (NPSH) at pump suction piping.
| |
| While the majority of debris accumulates on the strainers, some fraction penetrates the strainers and is transported to downstream components in the ECCS, CTS, and the Reactor Coolant System (RCS). Debris that penetrates the strainer can result in wear to the downstream components, blockages, or reduced heat transfer across the fuel cladding. Excessive debris in the containment recirculation sump water source could result in insufficient recirculation of coolant during the accident, or insufficient heat removal from the core during the accident.
| |
| APPLICABLE During all accidents that require recirculation, the containment SAFETY recirculation sump provides a source of borated water to the ECCS ANALYSIS and CTS pumps. As such, it supports residual heat removal, emergency core cooling, and containment cooling, during an accident. It also provides a source of negative reactivity (Ref. 1). The design basis transients and applicable safety analyses concerning each of these systems are discussed in the Applicable Safety Analyses section of Cook Nuclear Plant Unit 2 B 3.6.15-1 Rev. 81
| |
| | |
| Containment Recirculation Sump B 3.6.15 BASES APPLICABLE SAFETY ANALYSIS (continued)
| |
| B 3.5.2, "ECCS - Operating," B 3.5.3, "ECCS - Shutdown," and B 3.6.6, "Containment Spray System."
| |
| UFSAR Section 14.3.9 (Ref. 2) describes evaluations that confirm long-term core cooling is assured following any accident that requires recirculation from the containment recirculation sump.
| |
| The containment recirculation sump satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The containment recirculation sump is required to ensure a source of borated water to support ECCS and CTS OPERABILITY. A containment recirculation sump consists of the containment drainage flow paths, debris interceptors, flood-up overflow wall openings, the recirculation sump strainers, and the inlet to the ECCS and CTS. An OPERABLE containment recirculation sump has no structural damage or abnormal corrosion that could prevent recirculation of coolant and will not be restricted by containment accident generated and transported debris.
| |
| Containment accident generated and transported debris consists of the following:
| |
| : a. Accident generated debris sources - Insulation, coatings, and other materials which are damaged by the high-energy line break (HELB) and transported to the containment recirculation sump. This includes materials within the HELB zone of influence and other materials (e.g.,
| |
| unqualified coatings) that fail due to the post-accident containment environment following the accident;
| |
| : b. Latent debris sources - Pre-existing dirt, dust, paint chips, fines or shards of insulation, and other materials inside containment that do not have to be damaged by the HELB to be transported to the containment recirculation sump; and
| |
| : c. Chemical product debris sources - Aluminum, zinc, carbon steel, copper, and non-metallic materials such as paints, thermal insulation, and concrete that are susceptible to chemical reactions within the post-accident containment environment leading to corrosion products that are generated within the containment recirculation sump pool or are generated within containment and transported to the containment recirculation sump.
| |
| Containment debris limits are defined in UFSAR Section 14.3.9 (Ref. 2).
| |
| Cook Nuclear Plant Unit 2 B 3.6.15-2 Rev. 81
| |
| | |
| Containment Recirculation Sump B 3.6.15 BASES APPLICABILITY In MODES 1, 2, 3, and 4, containment recirculation sump OPERABILITY requirements are dictated by the ECCS and CTS OPERABILITY requirements. Since both the ECCS and the CTS must be OPERABLE in MODES 1, 2, 3, and 4, the containment recirculation sump must also be OPERABLE to support their operation.
| |
| In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Thus, the containment recirculation sump is not required to be OPERABLE in MODES 5 or 6.
| |
| ACTIONS A.1, A.2, and A.3 Condition A is applicable when there is a condition which results in containment accident generated and transported debris exceeding the analyzed limits. Containment debris limits are defined in UFSAR Section 14.3.9 (Ref. 2).
| |
| Immediate action must be initiated to mitigate the condition. Examples of mitigating actions are:
| |
| * Removing the debris source from containment or preventing the debris from being transported to the containment recirculation sump;
| |
| * Evaluating the debris source against the assumptions in the analysis;
| |
| * Deferring maintenance that would affect availability of the affected systems and other LOCA mitigating equipment;
| |
| * Deferring maintenance that would affect availability of primary defense-in-depth systems, such as containment coolers;
| |
| * Briefing operators on LOCA debris management actions; or
| |
| * Applying an alternative method to establish new limits.
| |
| While in this condition, the RCS water inventory balance, SR 3.4.13.1, must be performed at an increased Frequency of once per 24 hours. An unexpected increase in RCS leakage could be indicative of an increased potential for an RCS pipe break, which could result in debris being generated and transported to the containment recirculation sump. The more frequent monitoring allows operators to act in a timely fashion to minimize the potential for an RCS pipe break while the containment recirculation sump is inoperable.
| |
| The inoperable containment recirculation sump must be restored to OPERABLE status in 90 days. A 90-day Completion Time is reasonable for emergent conditions that involve debris in excess of the analyzed limits that could be generated and transported to the containment Cook Nuclear Plant Unit 2 B 3.6.15-3 Rev. 81
| |
| | |
| Containment Recirculation Sump B 3.6.15 BASES ACTIONS (continued) recirculation sump under accident conditions. The likelihood of an initiating event in the 90-day Completion Time is very small and there is margin in the associated analyses. The mitigating actions of Required Action A.1 provide additional assurance that the effects of debris in excess of the analyzed limits will be mitigated during the Completion Time.
| |
| B.1 When the containment recirculation sump is inoperable for reasons other than Condition A, such as blockage, structural damage, or abnormal corrosion that could prevent recirculation of coolant, it must be restored to OPERABLE status within 72 hours. The 72 hour Completion Time takes into account the reasonable time for repairs, and low probability of an accident that requires the containment recirculation sump occurring during this period.
| |
| Required Action B.1 is modified by two Notes. The first Note indicates that the applicable Conditions and Required Actions of LCO 3.5.2, "ECCS
| |
| - Operating," and LCO 3.5.3, "ECCS - Shutdown," should be entered if an inoperable containment recirculation sump results in an inoperable ECCS train. The second Note indicates that the applicable Conditions and Required Actions of LCO 3.6.6, "Containment Spray Systems," should be entered if an inoperable containment recirculation sump results in an inoperable CTS train. This is an exception to LCO 3.0.6 and ensures the proper actions are taken for these components.
| |
| C.1 and C.2 If the containment recirculation sump cannot be restored to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
| |
| Cook Nuclear Plant Unit 2 B 3.6.15-4 Rev. 81
| |
| | |
| Containment Recirculation Sump B 3.6.15 BASES SURVEILLANCE SR 3.6.15.1 REQUIREMENTS Periodic inspections are performed to verify the containment recirculation sump does not show current or potential debris blockage, structural damage, or abnormal corrosion to ensure the operability and structural integrity of the containment recirculation sump (Ref. 1).
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Chapter 6 and Chapter 14
| |
| : 2. UFSAR, Section 14.3.9, Containment and Recirculation Sump Analyses.
| |
| Cook Nuclear Plant Unit 2 B 3.6.15-5 Rev. 81
| |
| | |
| MSSVs B 3.7.1 B 3.7 PLANT SYSTEMS B 3.7.1 Main Steam Safety Valves (MSSVs)
| |
| BASES BACKGROUND The primary purpose of the MSSVs is to provide overpressure protection for the secondary system. The MSSVs also provide protection against overpressurizing the reactor coolant pressure boundary (RCPB) by providing a heat sink for the removal of energy from the Reactor Coolant System (RCS) if the preferred heat sink, provided by the Condenser and Circulating Water System, is not available.
| |
| Five MSSVs are located on each main steam header, outside containment, upstream of the steam generator stop valves, as described in the UFSAR, Section 10.2.2 (Ref. 1). The MSSVs must have sufficient capacity to limit the secondary system pressure to 110% of the steam generator design pressure in order to meet the requirements of the ASME Code, Section III (Ref. 2). The MSSV design includes staggered setpoints, according to Table 3.7.1-2, so that only the needed valves will actuate. Staggered setpoints reduce the potential for valve chattering that is due to steam pressure insufficient to fully open all valves following a turbine reactor trip.
| |
| APPLICABLE The design basis for the MSSVs comes from Reference 2 and its purpose SAFETY is to limit the secondary system pressure to 110% of design pressure ANALYSES for any anticipated operational transient or accident considered in the Design Basis Accident (DBA) and transient analysis.
| |
| The events that challenge the relieving capacity of the MSSVs, and thus RCS pressure, are those characterized as decreased heat removal events, which are presented in UFSAR, Section 14.1 (Ref. 3). Of these, the full power turbine trip without steam dump is the limiting anticipated operational transient. This event also terminates normal feedwater flow to the steam generators.
| |
| The safety analysis demonstrates that the transient response for turbine trip occurring from full power without a direct reactor trip presents no hazard to the integrity of the RCS or the Main Steam System. One turbine trip analysis is performed assuming primary system pressure control via operation of the pressurizer relief valves and spray. This analysis demonstrates that the DNB design basis is met. Another analysis is performed assuming no primary system pressure control, but crediting reactor trip on high pressurizer pressure and operation of the pressurizer safety valves. This analysis demonstrates that RCS integrity is maintained by showing that the maximum RCS pressure does not exceed 110% of the design pressure. All cases analyzed demonstrate Cook Nuclear Plant Unit 2 B 3.7.1-1 Revision No. 0
| |
| | |
| MSSVs B 3.7.1 BASES APPLICABLE SAFETY ANALYSES (continued) that the MSSVs maintain Main Steam System integrity by limiting the maximum steam pressure to less than 110% of the steam generator design pressure.
| |
| In addition to the decreased heat removal events, reactivity insertion events may also challenge the relieving capacity of the MSSVs. The uncontrolled rod cluster control assembly (RCCA) bank withdrawal at power event is characterized by an increase in core power and steam generation rate until reactor trip occurs when the Overtemperature T, Power Range Neutron Flux - High, or the Pressurizer Water Level - High setpoint is reached. Steam flow to the turbine will not increase from its initial value for this event. The increased heat transfer to the secondary side causes an increase in steam pressure and may result in opening of the MSSVs prior to reactor trip, assuming no credit for operation of the steam generator (SG) power operated relief valves (PORVs) or condenser steam dump valves. The UFSAR, Section 14.1.2 (Ref. 4.)
| |
| safety analysis of the RCCA bank withdrawal at power event for a range of initial core power levels demonstrates that the MSSVs are capable of preventing secondary side overpressurization for this anticipated operational transient.
| |
| The UFSAR safety analyses discussed above assume that all of the MSSVs for each steam generator are OPERABLE. If there are inoperable MSSV(s), it is necessary to limit the primary system power during steady-state operation and anticipated operational transients to a value that does not result in exceeding the combined steam flow capacity of the turbine (if available) and the remaining OPERABLE MSSVs. In addition, it is necessary to limit the primary side heat generation that can be achieved during an anticipated operational transient by reducing the setpoint of the Power Range Neutron Flux - High reactor trip function.
| |
| The required limitations on primary system power and Power Range Neutron Flux - High setpoint necessary to prevent secondary system overpressurization are determined using a conservative heat balance calculation as described in the attachment to Reference 5.
| |
| The MSSVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The accident analysis requires that five MSSVs per steam generator be OPERABLE to provide overpressure protection for design basis transients. The LCO requires that five MSSVs per steam generator be OPERABLE in compliance with Reference 2, and the DBA analysis.
| |
| Cook Nuclear Plant Unit 2 B 3.7.1-2 Revision No. 0
| |
| | |
| MSSVs B 3.7.1 BASES LCO (continued)
| |
| The OPERABILITY of the MSSVs is defined as the ability to open upon demand within the setpoint tolerances, to relieve steam generator overpressure, and reseat when pressure has been reduced. The OPERABILITY of the MSSVs is determined by periodic surveillance testing in accordance with the INSERVICE TESTING PROGRAM.
| |
| This LCO provides assurance that the MSSVs will perform their designed safety functions to mitigate the consequences of accidents that could result in a challenge to the RCPB, or Main Steam System integrity.
| |
| APPLICABILITY In MODES 1, 2, and 3, five MSSVs per steam generator are required to be OPERABLE to prevent Main Steam System overpressurization.
| |
| In MODES 4 and 5, there are no credible transients requiring the MSSVs.
| |
| The steam generators are not normally used for heat removal in MODES 5 and 6, and thus cannot be overpressurized; there is no requirement for the MSSVs to be OPERABLE in these MODES.
| |
| ACTIONS The ACTIONS Table is modified by a Note indicating that separate Condition entry is allowed for each MSSV.
| |
| A.1 and A.2 With one or more inoperable MSSVs on one or more steam generators, Required Action A.1 requires an appropriate reduction in reactor power within 4 hours. However, with a reactor power reduction alone there may be insufficient total steam flow capacity provided by the remaining OPERABLE MSSVs to preclude overpressurization in the event of a turbine trip without steam dump. Therefore, a Completion Time of 36 hours is allowed in Required Action A.2 to reduce the setpoints. The Completion Time of 36 hours is based on a reasonable time to correct the MSSV inoperability, the time required to perform the power reduction, operating experience in resetting all channels of a protective function, and on the low probability of the occurrence of a transient that could result in steam generator overpressure during this period.
| |
| The maximum THERMAL POWER corresponding to the heat removal capacity of the remaining OPERABLE MSSVs is determined via a conservative heat balance calculation as described in the attachment to Reference 5, with an appropriate allowance for Nuclear Instrumentation System trip channel uncertainties.
| |
| Cook Nuclear Plant Unit 2 B 3.7.1-3 Revision No. 61
| |
| | |
| MSSVs B 3.7.1 BASES ACTIONS (continued)
| |
| Required Action A.2 is modified by a Note, indicating that the Power Range Neutron Flux-High reactor trip setpoint reduction is only required in MODE 1. In MODES 2 and 3 the Reactor Trip System trips specified in LCO 3.3.1, "Reactor Trip System Instrumentation," provide sufficient protection.
| |
| The allowed Completion Times are reasonable based on operating experience to accomplish the Required Actions in an orderly manner without challenging unit systems.
| |
| B.1 and B.2 If any Required Action and associated Completion Time is not met, or if one or more steam generators have 4 inoperable MSSVs, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours, and in MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| SURVEILLANCE SR 3.7.1.1 REQUIREMENTS This SR verifies the OPERABILITY of the MSSVs by the verification of each MSSV lift setpoint in accordance with the INSERVICE TESTING PROGRAM. The ASME Code, Section XI (Ref. 6), requires that safety and relief valve tests be performed in accordance with ANSI/ASME OM-1-1987 (Ref. 7).
| |
| The ASME Code specifies the activities and frequencies necessary to satisfy the requirements. Table 3.7.1-2 allows a +/- 3% setpoint tolerance for OPERABILITY; however, the valves are reset to +/- 1% during the Surveillance to allow for drift. The lift settings, according to Table 3.7.1-2, correspond to ambient conditions of the valve at nominal operating temperature and pressure.
| |
| This SR is modified by a Note that allows entry into and operation in MODE 3 prior to performing the SR. The MSSVs may be either bench tested or tested in situ at hot conditions using an assist device to simulate lift pressure. If the MSSVs are not tested at hot conditions, the lift setting pressure shall be corrected to ambient conditions of the valve at operating temperature and pressure.
| |
| Cook Nuclear Plant Unit 2 B 3.7.1-4 Revision No. 61
| |
| | |
| MSSVs B 3.7.1 BASES REFERENCES 1. UFSAR, Section 10.2.2.
| |
| : 2. ASME, Boiler and Pressure Vessel Code, Section III, 1971.
| |
| : 3. UFSAR, Section 14.1.
| |
| : 4. UFSAR, Section 14.1.2.
| |
| : 5. NRC Information Notice 94-60, "Potential Overpressurization of the Main Steam System," August 22, 1994.
| |
| : 6. ASME, Boiler and Pressure Vessel Code, Section XI.
| |
| : 7. ANSI/ASME OM-1-1987.
| |
| Cook Nuclear Plant Unit 2 B 3.7.1-5 Revision No. 0
| |
| | |
| SGSVs B 3.7.2 B 3.7 PLANT SYSTEMS B 3.7.2 Steam Generator Stop Valves (SGSVs)
| |
| BASES BACKGROUND The SGSVs are used to isolate steam flow from the secondary side of the steam generators.
| |
| One SGSV is located in each main steam line outside, but close to, containment. The SGSVs are downstream from the main steam safety valves (MSSVs) and auxiliary feedwater (AFW) pump turbine steam supply, to prevent MSSV and AFW isolation from the steam generators by SGSV closure. Closing the SGSVs isolates each steam generator from the others, and isolates the turbine, Steam Bypass System, and other auxiliary steam supplies from the steam generators.
| |
| The SGSV is a gate valve with redundant actuator trains. Either actuator train can independently perform the safety function to fast-close the SGSV on demand. Each actuator train consists of a fail-open, air-operated valve on the associated SGSV. For each SGSV, one actuator train is associated with ESF Train A, and one actuator train is associated with ESF Train B.
| |
| The actuator train does not include any portion of the analog channels or protection system actuation logic and actuation relays that provide inputs to the valve actuator trains. LCO 3.3.2, Engineered Safety Feature Actuation System (ESFAS) Instrumentation, provides separate Conditions, Required Actions, and Surveillance Requirements for the analog channels and protection system logic and relays.
| |
| The SGSVs close on a steam generator isolation signal generated by the Engineered Safety Feature Actuation System (ESFAS) logic. These signals include the Containment Pressure - High High signal, High Steam Flow in Two Steam Lines Coincident with Tavg - Low Low, and Steam Line Pressure - Low. In addition, emergency closure can be initiated by operator actuation of the dump valves in the SGSV Control System. The SGSVs fail closed on loss of control air and fail as-is on loss of DC control power.
| |
| A description of the SGSVs is found in the UFSAR, Section 10.2 (Ref. 1).
| |
| APPLICABLE The design basis of the SGSVs is established by the accident analysis of SAFETY the SLB events presented in the UFSAR, Section 14.2.5 (Ref. 2). The ANALYSES design precludes the blowdown of more than one steam generator, assuming a single active component failure (e.g., the failure of one SGSV to close on demand).
| |
| (continued)
| |
| Cook Nuclear Plant Unit 2 B 3.7.2-1 Revision No. 64
| |
| | |
| SGSVs B 3.7.2 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| The limiting case is the SLB upstream of the steam flow restrictor (i.e.,
| |
| inside containment), with the unit initially at no load conditions, and failure of the SGSV on the affected steam generator to close. With the most reactive rod cluster control assembly assumed stuck in the fully withdrawn position, there is an increased possibility that the core will become critical and return to power. The core is ultimately shut down by the boric acid injection delivered by the Emergency Core Cooling System.
| |
| The accident analysis compares several different SLB events against different acceptance criteria. The analysis includes scenarios with offsite power available, and with a loss of offsite power following turbine trip.
| |
| With offsite power available, the reactor coolant pumps continue to circulate coolant through the steam generators, maximizing the Reactor Coolant System (RCS) cooldown. With a loss of offsite power, the response of mitigating systems is delayed. Significant single failures considered include failure of an SGSV to close.
| |
| The SGSVs serve only a closed safety function and remain open during power operation. These valves operate during a SLB, steam generator tube rupture, and feedwater line break.
| |
| The SGSVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO This LCO requires that four SGSVs and their associated actuator trains in the steam lines be OPERABLE. The SGSVs are considered OPERABLE when the isolation times are within limits, and they close on an isolation actuation signal.
| |
| An SGSV actuator train is considered OPERABLE when it is capable of fast-closing the associated SGSV on demand and within the required isolation time. This includes having the ability to support fast-closure of the SGSV within the required isolation time.
| |
| This LCO provides assurance that the SGSVs will perform their design safety function to mitigate the consequences of accidents such that offsite exposures are less than 10 CFR 50.67 (Ref. 3) limits.
| |
| APPLICABILITY The SGSVs and their associated actuator trains must be OPERABLE in MODE 1, and in MODES 2 and 3 except when closed, when there is significant mass and energy in the RCS and steam generators. When the SGSVs are closed, they are already performing the safety function.
| |
| In MODE 4, the steam generator energy is low, thus the probability of a SLB is low.
| |
| (continued)
| |
| Cook Nuclear Plant Unit 2 B 3.7.2-2 Revision No. 64
| |
| | |
| SGSVs B 3.7.2 BASES APPLICABILITY (continued)
| |
| In MODE 5 or 6, the steam generators do not contain much energy because their temperature is below the boiling point of water; therefore, the SGSVs are not required for isolation of potential high energy secondary system pipe breaks in these MODES.
| |
| ACTIONS A.1 With a single actuator train inoperable on one SGSV, action must be taken to restore the inoperable actuator train to OPERABLE status within 7 days. The 7-day Completion Time is reasonable in light of the redundant actuator train design such that with one actuator train inoperable, the affected SGSV is still capable of closing on demand via the remaining OPERABLE actuator train. The 7-day Completion Time takes into account the redundant OPERABLE actuator train to the SGSV, reasonable time for repairs, and the low probability of an event occurring that requires the inoperable actuator train to the affected SGSV.
| |
| B.1 With one actuator train on one SGSV inoperable; and one actuator train on an additional SGSV inoperable, such that the inoperable actuator trains are not in the same ESF Train, action must be taken to restore one of the inoperable actuator trains to OPERABLE status within 72 hours.
| |
| With one actuator train inoperable on two different SGSVs that are not in the same ESF Train, there is an increased likelihood that an additional failure (such as the failure of an actuator logic train) could cause one SGSV to fail to close. The 72-hour Completion Time is reasonable since the redundant actuator train design ensures that with only one actuator train on each of two affected SGSVs inoperable, each SGSV is still capable of closing on demand.
| |
| C.1 With one actuator train on one SGSV inoperable; and one actuator train on an additional SGSV inoperable, such that both inoperable actuator trains are in the same ESF Train, action must be taken to restore one of the inoperable actuator trains to OPERABLE status within 24 hours. The 24-hour Completion Time provides a reasonable amount of time for restoring at least one actuator train since the redundant actuator train design for each SGSV ensures that a single inoperable actuator train cannot prevent the affected SGSV(s) from closing on demand. With two actuator trains inoperable in the same ESF Train, an additional failure (such as the failure of an actuator logic train in the other ESF Train) could cause both affected SGSVs to fail to close on demand. The 24 hour (continued)
| |
| Cook Nuclear Plant Unit 2 B 3.7.2-3 Revision No. 64
| |
| | |
| SGSVs B 3.7.2 BASES ACTIONS (continued)
| |
| Completion Time takes into account the redundant OPERABLE actuator trains to the affected SGSVs and the low probability of an event occurring that requires the inoperable actuator trains to the affected SGSVs.
| |
| D.1 Required Action D.1 provides assurance that the appropriate Condition is entered for the affected SGSV if its associated actuator trains become inoperable. Failure of both actuator trains for a single SGSV results in the inability to close the affected SGSV on demand.
| |
| E.1 With three or more SGSV actuator trains inoperable or when Required Action A.1, B.1, or C.1 are not completed within the required Completion Time, the affected SGSVs may be incapable of closing on demand and must be immediately declared inoperable. Having three actuator trains inoperable could involve two inoperable actuator trains on one SGSV and one inoperable actuator train on another SGSV, or an inoperable actuator train on each of three SGSVs, for which the inoperable actuator trains could all be in the same ESF Train or be staggered among the two ESF Trains.
| |
| Depending on which of these conditions or combinations is in effect, the condition or combination could mean that all of the affected SGSVs remain capable of closing on demand (due to the redundant actuator train design), or that at least one SGSV is inoperable, or that with an additional single failure up to three SGSVs could be incapable of closing on demand. Therefore, in some cases, immediately declaring the affected SGSVs inoperable is conservative (when some or all of the affected SGSVs may still be capable of closing on demand even with a single additional failure), while in other cases it is appropriate (when at least one of the SGSVs would be inoperable, or up to three could be rendered inoperable by an additional single failure). Required Action E.1 is conservatively based on the worst-case condition and therefore requires immediately declaring all the affected SGSVs inoperable.
| |
| F.1 With one SGSV inoperable in MODE 1, action must be taken to restore OPERABLE status within 8 hours. Some repairs to the SGSV can be made with the unit hot. The 8 hour Completion Time is reasonable, considering the low probability of an accident occurring during this time period that would require a closure of the SGSVs.
| |
| (continued)
| |
| Cook Nuclear Plant Unit 2 B 3.7.2-4 Revision No. 64
| |
| | |
| SGSVs B 3.7.2 BASES ACTIONS (continued)
| |
| Condition F is entered when one SGSV is inoperable in MODE 1, including when both actuator trains for one SGSV are inoperable. When only one actuator train is inoperable on one SGSV, Condition A applies.
| |
| G.1 If the SGSV cannot be restored to OPERABLE status within 8 hours, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in MODE 2 within 6 hours and Condition H would be entered. The Completion Time is reasonable, based on operating experience, to reach MODE 2 in an orderly manner and without challenging unit systems.
| |
| H.1 and H.2 Condition H is modified by a Note indicating that separate Condition entry is allowed for each SGSV.
| |
| Since the SGSVs are required to be OPERABLE in MODES 2 and 3, the inoperable SGSVs must be closed. When closed, the SGSVs are already in the position required by the assumptions in the safety analysis.
| |
| The 8 hour Completion Time is consistent with that allowed in Condition F.
| |
| For inoperable SGSVs that are closed, the inoperable SGSVs must be verified on a periodic basis to be closed. This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day Completion Time is reasonable, based on engineering judgment, in view of SGSV status indications available in the control room, and other administrative controls, to ensure that these valves are in the closed position.
| |
| I.1 and I.2 If the SGSVs are not closed within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed at least in MODE 3 within 6 hours, and in MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from MODE 2 conditions in an orderly manner and without challenging unit systems.
| |
| Cook Nuclear Plant Unit 2 B 3.7.2-5 Revision No. 64
| |
| | |
| SGSVs B 3.7.2 BASES SURVEILLANCE SR 3.7.2.1 REQUIREMENTS This SR verifies that SGSV closure time is within the limit given in Reference 4 and is within that assumed in the accident analyses. The valve(s) may also be tested to more restrictive requirements in accordance with the INSERVICE TESTING PROGRAM. This SR is normally performed upon returning the unit to operation following a refueling outage. The SGSVs should not be tested at power, since a unit trip could occur. As the SGSVs are not tested at power, they are exempt from the ASME OM Code (Ref. 5) requirements during operation in MODE 1 or 2.
| |
| The Frequency is in accordance with the INSERVICE TESTING PROGRAM.
| |
| This test is conducted in MODE 3 with the unit at operating temperature and pressure. This SR is modified by a Note that allows entry into and operation in MODE 3 prior to performing the SR. This allows a delay of testing until MODE 3, to establish conditions consistent with those under which the acceptance criterion was generated.
| |
| SR 3.7.2.2 This SR verifies that each actuator train can close its respective SGSV on an actual or simulated actuation signal. This Surveillance is normally performed upon returning the unit to operation following a refueling outage. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 10.2.
| |
| : 2. UFSAR, Section 14.2.5.
| |
| : 3. 10 CFR 50.67.
| |
| : 4. Technical Requirements Manual
| |
| : 5. ASME, Operations and Maintenance Standards and Guides (OM Codes).
| |
| Cook Nuclear Plant Unit 2 B 3.7.2-6 Revision No. 64
| |
| | |
| MFIVs and MFRVs B 3.7.3 B 3.7 PLANT SYSTEMS B 3.7.3 Main Feedwater Isolation Valves (MFIVs) and Main Feedwater Regulation Valves (MFRVs)
| |
| BASES BACKGROUND The MFIVs isolate main feedwater (MFW) flow to the secondary side of the steam generators following receipt of a feedwater isolation signal (Safety Injection Input from ESFAS, Steam Generator Water Level - High High, or Reactor Trip, P-4 coincident with Tavg - Low). The safety related function of the MFRVs is to provide the second isolation of MFW flow to the secondary side of the steam generators following receipt of a feedwater isolation signal. Closure of the MFIVs or MFRVs terminates flow to the steam generators, terminating the event for feedwater line breaks (FWLBs) occurring upstream of the MFIVs or MFRVs. The consequences of events occurring in the main steam lines or in the MFW lines downstream from the MFIVs will be mitigated by their closure. Closure of the MFIVs or MFRVs effectively terminates the addition of feedwater to an affected steam generator, limiting the mass and energy release for steam line breaks (SLBs) or FWLBs inside containment and reducing the cooldown effects for SLBs.
| |
| The MFIVs or MFRVs isolate the nonsafety related portions from the safety related portions of the system. In the event of a secondary side pipe rupture inside containment, the valves limit the quantity of high energy fluid that enters containment through the break.
| |
| One MFIV and one MFRV are located on each MFW line, outside containment. The MFIVs and MFRVs are located upstream of the AFW injection point so that AFW may be supplied to the steam generators following MFIV or MFRV closure. A check valve at the main feedwater inlet provides the credited safety related pressure boundary for the controlled addition of auxiliary feedwater (AFW) to the steam generators.
| |
| The MFIVs and MFRVs close on receipt of a feedwater isolation signal.
| |
| They may also be actuated manually. In addition to the MFIVs and the MFRVs, a check valve and a manual valve outside containment are available.
| |
| A description of the MFIVs and MFRVs is found in the UFSAR, Section 10.5.1.2 (Ref. 1).
| |
| APPLICABLE The design basis of the MFIVs and MFRVs is established by the SAFETY analyses for the large SLB. It is also influenced by the accident analysis ANALYSES for the large FWLB. Closure of the MFRVs may also be relied on to terminate an SLB for core response analysis and excess feedwater event upon the receipt of a Steam Generator Water Level - High High signal.
| |
| Cook Nuclear Plant Unit 2 B 3.7.3-1 Revision No. 51
| |
| | |
| MFIVs and MFRVs B 3.7.3 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| The MFRVs are assumed to close following a large SLB to limit the resulting Reactor Coolant System (RCS) cooldown, which could cause a return to criticality of the core. While failure of an MFRV to close following a SLB or FWLB can result in additional mass and energy being delivered to the steam generators, contributing to cooldown, this is not assumed since a single failure of one train of SI is more limiting. The MFIVs are assumed to close following a large SLB in order to limit the mass and energy released into the containment. Failure of an MFIV to close in the faulted loop is also assumed. This failure also results in additional mass and energy releases following a SLB or FWLB event.
| |
| The MFIVs and MFRVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO This LCO ensures that the MFIVs and MFRVs will isolate MFW flow to the steam generators, following an event requiring their isolation. These valves will also isolate the nonsafety related portions from the safety related portions of the system.
| |
| This LCO requires that four MFIVs and four MFRVs be OPERABLE. The MFIVs and MFRVs are considered OPERABLE when isolation times are within limits and they close on an isolation actuation signal.
| |
| Failure to meet the LCO requirements can result in additional mass and energy being released to containment following a SLB or FWLB inside containment. Since a feedwater isolation signal on Steam Generator Water Level - High High is relied on to terminate an excess feedwater flow event, failure to meet the LCO may result in the introduction of water into the main steam lines.
| |
| APPLICABILITY The MFIVs and MFRVs must be OPERABLE whenever there is significant mass and energy in the RCS and steam generators. This ensures that, in the event of a FWLB or SLB, a single failure cannot result in the blowdown of more than one steam generator. In MODES 1, 2, and 3, the MFIVs and MFRVs are required to be OPERABLE to limit the amount of available fluid that could be added to containment in the case of a FWLB or SLB inside containment. When the valves are closed and de-activated or isolated by a closed manual valve, they are already performing their safety function.
| |
| In MODES 4, 5, and 6, steam generator energy is low. Therefore, the MFIVs and MFRVs are normally closed since MFW is not required.
| |
| Cook Nuclear Plant Unit 2 B 3.7.3-2 Revision No. 2
| |
| | |
| MFIVs and MFRVs B 3.7.3 BASES ACTIONS The ACTIONS Table is modified by a Note indicating that separate Condition entry is allowed for each valve.
| |
| A.1 and A.2 With one or more MFIVs inoperable, action must be taken to restore the affected valves to OPERABLE status, or to close or isolate inoperable affected valves within 72 hours. When these valves are closed or isolated, they are performing their required safety function.
| |
| The 72 hour Completion Time takes into account the redundancy afforded by the remaining OPERABLE valves and the low probability of an event occurring during this time period that would require isolation of the MFW flow paths. The 72 hour Completion Time is reasonable, based on operating experience.
| |
| Inoperable MFIVs that are closed or isolated must be verified on a periodic basis that they are closed or isolated. This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day Completion Time is reasonable, based on engineering judgment, in view of valve status indications available in the control room, and other administrative controls, to ensure that these valves are closed or isolated.
| |
| B.1 and B.2 With one or more MFRVs inoperable, action must be taken to restore the affected valves to OPERABLE status, or to close or isolate inoperable affected valves within 72 hours. When these valves are closed or isolated, they are performing their required safety function.
| |
| The 72 hour Completion Time takes into account the redundancy afforded by the remaining OPERABLE valves and the low probability of an event occurring during this time period that would require isolation of the MFW flow paths. The 72 hour Completion Time is reasonable, based on operating experience.
| |
| Inoperable MFRVs, that are closed or isolated, must be verified on a periodic basis that they are closed or isolated. This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day Completion Time is reasonable, based on engineering judgment, in view of valve status indications available in the control room, and other administrative controls to ensure that the valves are closed or isolated.
| |
| Cook Nuclear Plant Unit 2 B 3.7.3-3 Revision No. 0
| |
| | |
| MFIVs and MFRVs B 3.7.3 BASES ACTIONS (continued)
| |
| C.1 With both the MFIV and MFRV inoperable in the same flow path, there is no redundant system to operate automatically and perform the required safety function. Under these conditions, the affected flow path must be isolated within 8 hours. This action returns the system to the condition where at least one valve in each flow path is performing the required safety function. The 8 hour Completion Time is reasonable, based on operating experience, to complete the actions required to close the MFIV or MFRV, or otherwise isolate the affected flow path.
| |
| D.1 and D.2 If any Required Action and associated Completion Time is not met, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours and in MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| SURVEILLANCE SR 3.7.3.1 and SR 3.7.3.2 REQUIREMENTS These SRs verify that the closure time of each MFIV and MFRV is within the limit given in Reference 2 and is within that assumed in the accident and transient analyses. The valve(s) may also be tested to more restrictive requirements in accordance with the INSERVICE TESTING PROGRAM.
| |
| The Frequency for this SR is in accordance with the INSERVICE TESTING PROGRAM SR 3.7.3.3 This SR verifies that each MFIV and MFRV can close on an actual or simulated actuation signal. This Surveillance is normally performed upon returning the unit to operation following a refueling outage.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 10.5.1.2.
| |
| : 2. Technical Requirements Manual Cook Nuclear Plant Unit 2 B 3.7.3-4 Revision No. 61
| |
| | |
| SG PORVs B 3.7.4 B 3.7 PLANT SYSTEMS B 3.7.4 Steam Generator (SG) Power Operated Relief Valves (PORVs)
| |
| BASES BACKGROUND The SG PORVs provide a method for cooling the unit to residual heat removal (RHR) entry conditions should the preferred heat sink via the Steam Dump System to the condenser not be available, as discussed in the UFSAR, Section 10.2.2 (Ref. 1). This is done in conjunction with the Auxiliary Feedwater System providing cooling water from the condensate storage tank (CST). The SG PORVs may also be required to meet the design cooldown rate during a normal cooldown when steam pressure drops too low for maintenance of a vacuum in the condenser to permit use of the Steam Dump System.
| |
| One SG PORV line for each of the four steam generators is provided.
| |
| Each SG PORV line consists of one SG PORV and an associated isolation valve.
| |
| The SG PORVs are provided with upstream isolation valves to permit their being tested at power, and to provide an alternate means of isolation. The SG PORVs are equipped with pneumatic controllers to permit control of the cooldown rate. The Control Air System provides the normal air supply for pneumatic control.
| |
| Reactor Nitrogen backup supports PORV operation if Control Air becomes unavailable.
| |
| A description of the SG PORVs is found in Reference 1. In addition, handwheels are provided for local manual operation.
| |
| APPLICABLE The design basis of the SG PORVs is established by the capability to cool SAFETY the unit to RHR entry conditions. The accident analysis assumes the ANALYSES capacity of each SG PORV is 420,000 lb/hr steam flow. This capacity is adequate to cool the unit to RHR entry conditions with only three steam generators and associated SG PORVs, utilizing the cooling water supply available in the CST.
| |
| In the accident analysis presented in Reference 2, the SG PORVs are assumed to be used by the operator to cool down the unit to RHR entry conditions for accidents accompanied by a loss of offsite power. Prior to operator actions to cool down the unit, the SG PORVs and main steam safety valves (MSSVs) are assumed to operate automatically to relieve steam and maintain the steam generator pressure below the design value. However, automatic actuation of the SG PORVs is not credited.
| |
| For the recovery from a steam generator tube rupture (SGTR) event, the operator is also required to perform a limited cooldown to establish Cook Nuclear Plant Unit 2 B 3.7.4-1 Revision No. 66
| |
| | |
| SG PORVs B 3.7.4 BASES APPLICABLE SAFETY ANALYSES (continued) adequate subcooling as a necessary step to terminate the primary to secondary break flow into the ruptured steam generator. The time required to terminate the primary to secondary break flow for an SGTR is more critical than the time required to cool down to RHR conditions for this event and also for other accidents. Thus, the SGTR is the limiting event for the SG PORVs. Four SG PORVs are required to be OPERABLE to satisfy the SGTR accident analysis.
| |
| Control Air or nitrogen is required to support SG PORV operation during a SGTR event. There is no requirement to assume a single failure in the SGTR event. However, a LOOP in both units is assumed.
| |
| The SG PORVs are equipped with isolation valves in the event an SG PORV spuriously fails open or fails to close during use.
| |
| The SG PORVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO Four SG PORVs are required to be OPERABLE. One SG PORV is required from each of four steam generators to ensure that at least three SG PORVs are available to conduct a unit cooldown following an SGTR, in which one steam generator becomes unavailable.
| |
| The Control Air Compressor (CAC), along with CD Emergency Diesel Generator (EDG) availability, supports SG PORV OPERABILITY for SGTR mitigation. With the CAC unavailable (e.g. maintenance), Reactor Nitrogen backup supports SG PORV Operability provided the aligned Nitrogen inventory is equal to or greater than one bulk nitrogen tank at 580 psig pressure (2065 standard cubic feet) or other equivalent nitrogen source. The Reactor Nitrogen System is not required to maintain SG PORV OPERABILITY unless the CAC or CD EDG is unavailable.
| |
| Failure to meet the LCO can result in the inability to cool the unit to RHR entry conditions following an event in which the condenser is unavailable for use with the Steam Dump System.
| |
| An SG PORV is considered OPERABLE when it is capable, manually from the control room, of fully opening and closing.
| |
| APPLICABILITY In MODES 1, 2, and 3, and in MODE 4, when a steam generator is being relied upon for heat removal, the SG PORVs are required to be OPERABLE.
| |
| In MODE 5 or 6, an SGTR is not a credible event.
| |
| Cook Nuclear Plant Unit 2 B 3.7.4-2 Revision No. 66
| |
| | |
| SG PORVs B 3.7.4 BASES ACTIONS A.1 With one SG PORV inoperable, action must be taken to restore OPERABLE status within 7 days. The 7 day Completion Time allows for the redundant capability afforded by the nonsafety grade backup in the Steam Dump System.
| |
| B.1 With two or more SG PORVs inoperable, action must be taken to restore all but one SG PORV to OPERABLE status. Since the isolation valve can be closed to isolate an SG PORV, some repairs may be possible with the unit at power. The 24 hour Completion Time is reasonable to repair inoperable SG PORVs, based on the availability of the Steam Dump System, and the low probability of an event occurring during this period that would require the SG PORVs.
| |
| C.1 and C.2 If the SG PORV(s) cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours, and in MODE 4, without reliance upon steam generator for heat removal, within 24 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| D.1 If one or more required SG PORVs are inoperable in MODE 4, the unit is in a degraded condition with reduced safety related means to cool the unit to RHR entry conditions following an event, and the possibility of no means for conducting a cooldown with nonsafety related equipment since the condenser may be unavailable for use with the Steam Dump System.
| |
| The seriousness of this condition requires that action be started immediately to restore the inoperable SG PORV(s) to OPERABLE status.
| |
| SURVEILLANCE SR 3.7.4.1 REQUIREMENTS To perform a controlled cooldown of the RCS, the SG PORVs must be able to be opened remotely and throttled through their full range. This SR ensures that the SG PORVs are tested through a full control cycle.
| |
| Performance of inservice testing or use of an SG PORV during a unit cooldown may satisfy this requirement. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Cook Nuclear Plant Unit 2 B 3.7.4-3 Revision No. 66
| |
| | |
| SG PORVs B 3.7.4 BASES REFERENCES 1. UFSAR, Section 10.2.2.
| |
| : 2. UFSAR, Section 14.2.4.
| |
| : 3. MD-12-N2-001-N, Steam Generator PORV N2 Supply Requirements for Consumed Volume and Tank Pressure Cook Nuclear Plant Unit 2 B 3.7.4-4 Revision No. 66
| |
| | |
| AFW System B 3.7.5 B 3.7 PLANT SYSTEMS B 3.7.5 Auxiliary Feedwater (AFW) System BASES BACKGROUND The AFW System automatically supplies feedwater to the steam generators to remove decay heat from the Reactor Coolant System (RCS) when the main feedwater supply is not available. The AFW pumps normally take suction from a common suction header from the condensate storage tank (CST) (LCO 3.7.6, "Condensate Storage Tank (CST)) and pump to the steam generator secondary side via separate and independent connections to the main feedwater (MFW) piping outside containment. The steam generators function as a heat sink for core decay heat. The heat load is dissipated by releasing steam to the atmosphere from the steam generators via the main steam safety valves (MSSVs) (LCO 3.7.1, Main Steam Safety Valves (MSSVs)) or steam generator power operated relief valves (LCO 3.7.4, Steam Generator (SG) Power Operated Relief Valves (PORVs)). If the main condenser is available, steam may be released via the steam dump valves and recirculated to the CST.
| |
| The AFW System consists of two motor driven AFW pumps and one steam turbine driven pump configured into three trains. Each motor driven pump is capable of providing 450 gpm at a pressure of 1065 psig (plus 3%) at the entrance of the steam generators, and the turbine driven pump is capable of providing 900 gpm at a pressure of 1065 psig (plus 3%) at the entrance of the steam generators, as assumed in the accident analysis. The pumps are equipped with recirculation lines to prevent pump operation against a closed system. Each motor driven AFW pump is powered from an independent Class 1E power supply and feeds two steam generators. The steam turbine driven AFW pump receives steam from two main steam lines upstream of the steam generator stop valves (SGSVs). Each of the steam feed lines will supply 100% of the requirements of the turbine driven AFW pump.
| |
| The AFW System is capable of supplying feedwater to the steam generators during normal unit startup, shutdown, and hot standby conditions.
| |
| The turbine driven AFW pump supplies a common header capable of feeding all steam generators with DC powered control valves actuated to the appropriate steam generator. The turbine driven AFW pump at full flow is sufficient to remove decay heat and cool the unit to residual heat removal (RHR) entry conditions. Thus, the requirement for diversity in motive power sources for the AFW System is met.
| |
| Cook Nuclear Plant Unit 2 B 3.7.5-1 Revision No. 0
| |
| | |
| AFW System B 3.7.5 BASES BACKGROUND (continued)
| |
| The motor driven AFW pumps are sized to deliver enough water to maintain a minimum area of heat transfer in the steam generators in order to prevent loss of primary water through the pressurizer safety or power operated relief valves. The higher capacity turbine driven AFW pump will maintain a tube sheet coverage of 10 feet. Subsequently, the AFW System supplies sufficient water to cool the unit to RHR entry conditions, with steam released through the SG PORVs.
| |
| The turbine driven AFW pump starts automatically on any one of the following signals:
| |
| : a. Steam Generator Water Level - Low Low (Table 3.3.2-1 Function 6.c);
| |
| : b. Undervoltage Reactor Coolant Pump (Table 3.3.2-1 Function 6.f);
| |
| and
| |
| : c. Anticipated Transient Without Scram Mitigation System Actuation Circuitry (AMSAC): less than 25% feedwater flow to 3 out of 4 loops and above 40% power (a non-Technical Specification signal).
| |
| The motor driven AFW pumps start automatically on any one of the following signals:
| |
| : a. Steam Generator Water Level - Low Low (Table 3.3.2-1 Function 6.c);
| |
| : b. Safety Injection Input from ESFAS (Table 3.3.2-1 Function 6.d);
| |
| : c. Trip of all Main Feedwater Pumps (Table 3.3.2-1 Function 6.g);
| |
| : d. Loss of Voltage (Table 3.3.2-1 Function 6.e); and
| |
| : e. AMSAC: less than 25% feedwater flow to 3 out of 4 loops and above 40% power (a non-Technical Specification signal).
| |
| The AFW System is discussed in the UFSAR, Section 10.5.2 (Ref. 1).
| |
| APPLICABLE The AFW System mitigates the consequences of any event when the SAFETY MFW System is not available.
| |
| ANALYSES The design basis of the AFW System is to supply water to the steam generator to remove decay heat and other residual heat by delivering at least the minimum required flow rate to the steam generators at pressures corresponding to the lowest main steam safety valve set pressure plus 3%.
| |
| Cook Nuclear Plant Unit 2 B 3.7.5-2 Revision No. 0
| |
| | |
| AFW System B 3.7.5 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| In addition, the AFW System must supply enough makeup water to replace steam generator secondary inventory lost as the unit cools to MODE 4 conditions. Sufficient AFW flow must also be available to meet the requirements of the Design Basis Accidents (DBAs) and transients, and accounts for flow diversions such as pump recirculation and line breaks.
| |
| The limiting DBAs and transients for the AFW System are as follows:
| |
| : a. Loss of external electric load or turbine trip;
| |
| : b. Loss of normal feedwater;
| |
| : c. Excessive heat removal due to Feedwater System malfunctions;
| |
| : d. Steam generator tube rupture;
| |
| : e. Rupture of a steam line; and
| |
| : f. Major rupture of main feedwater pipe.
| |
| In addition, the minimum available AFW flow and system characteristics are considerations in the analysis of a small break loss of coolant accident (LOCA).
| |
| The AFW System design is such that it can perform its function following a feedwater line break (FWLB) upstream and downstream of the main feedwater check valve. If the break is postulated in a feedwater line between the main feedwater check valve and the steam generator, fluid from the steam generator may also be discharged through the break.
| |
| Furthermore, a break in this location could preclude the subsequent addition of auxiliary feedwater to the affected steam generator. A break upstream of the feedwater line check valve would affect the nuclear steam supply system only as a loss of normal feedwater. Depending upon the size of the break and the unit operating conditions at the time of the break, the break could cause either a RCS cooldown or a RCS heatup. Potential RCS cooldown resulting from a secondary pipe rupture is evaluated in the steamline break event. Therefore, only the RCS heatup effects are evaluated for a FWLB. Analyses have been performed at full power with and without loss of offsite power. The flow assumed is less than any combination that 2 out of 3 pumps would normally supply.
| |
| The ESFAS automatically actuates the AFW turbine driven pump and associated power operated valves and controls when required to ensure an adequate feedwater supply to the steam generators during loss of power. DC power operated valves are provided for each AFW line Cook Nuclear Plant Unit 2 B 3.7.5-3 Revision No. 0
| |
| | |
| AFW System B 3.7.5 BASES APPLICABLE SAFETY ANALYSES (continued) associated with the turbine driven pump to control the AFW flow to each steam generator.
| |
| The AFW System satisfies the requirements of Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO This LCO provides assurance that the AFW System will perform its design safety function to mitigate the consequences of accidents that could result in overpressurization of the reactor coolant pressure boundary. Three independent AFW trains are required to be OPERABLE to ensure the availability of decay heat removal for all events accompanied by a loss of offsite power and a single failure. This is accomplished by powering two of the pumps from independent emergency buses. The third AFW pump is powered by a different means, a steam driven turbine supplied with steam from a source that is not isolated by closure of the SGSVs.
| |
| The AFW System is configured into three trains. The AFW System is considered OPERABLE when the components and flow paths required to provide redundant AFW flow to the steam generators are OPERABLE.
| |
| This requires that the two motor driven AFW pumps be OPERABLE in two independent discharge paths, each supplying AFW to separate steam generators. The turbine driven AFW pump is required to be OPERABLE with redundant steam supplies from each of two main steam lines upstream of the SGSVs, and shall be capable of supplying AFW to all of the steam generators. The piping, valves, instrumentation, and controls required to perform the safety related function also are required to be OPERABLE.
| |
| The LCO is modified by a Note indicating that only one AFW train, which includes a motor driven pump, is required to be OPERABLE in MODE 4.
| |
| This is because of the reduced heat removal requirements and short period of time in MODE 4 during which the AFW is required and the insufficient steam available in MODE 4 to power the turbine driven AFW pump.
| |
| APPLICABILITY In MODES 1, 2, and 3, the AFW System is required to be OPERABLE in the event that it is called upon to function when the MFW is lost. In addition, the AFW System is required to supply enough makeup water to replace the steam generator secondary inventory, lost as the unit cools to MODE 4 conditions.
| |
| In MODE 4 the AFW System may be used for heat removal via the steam generators.
| |
| Cook Nuclear Plant Unit 2 B 3.7.5-4 Revision No. 0
| |
| | |
| AFW System B 3.7.5 BASES APPLICABILITY (continued)
| |
| In MODE 5 or 6, the steam generators are not normally used for heat removal, and the AFW System is not required.
| |
| ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable AFW train. There is an increased risk associated with entering a MODE or other specified condition in the Applicability with an AFW train inoperable and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.
| |
| A.1 If the turbine driven AFW train is inoperable due to one inoperable steam supply, or if a turbine driven pump is inoperable for any reason while in MODE 3 immediately following refueling, action must be taken to restore the inoperable equipment to an OPERABLE status within 7 days. The 7 day Completion Time is reasonable, based on the following reasons:
| |
| : a. For the inoperability of the turbine driven AFW pump due to one inoperable steam supply, the 7 day Completion Time is reasonable since there is a redundant steam supply line for the turbine driven pump and the turbine driven train is still capable of performing its specified function for most postulated events.
| |
| : b. For the inoperability of a turbine driven AFW pump while in MODE 3 immediately subsequent to a refueling, the 7 day Completion Time is reasonable due to the minimal decay heat levels in this situation.
| |
| : c. For both the inoperability of the turbine driven pump due to one inoperable steam supply, and an inoperable turbine driven AFW pump while in MODE 3 immediately following a refueling outage, the 7 day Completion Time is reasonable due to the availability of redundant OPERABLE motor driven AFW pumps, and due to the low probability of an event requiring the use of the turbine driven AFW pump.
| |
| The second Completion Time for Required Action A.1 establishes a limit on the maximum time allowed for any combination of Conditions to be inoperable during any continuous failure to meet this LCO.
| |
| The 10 day Completion Time provides a limitation time allowed in this specified Condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which Conditions A and B are entered concurrently. The AND connector between 7 days and 10 days Cook Nuclear Plant Unit 2 B 3.7.5-5 Revision No. 80
| |
| | |
| AFW System B 3.7.5 BASES ACTIONS (continued) dictates that both Completion Times apply simultaneously, and the more restrictive must be met.
| |
| Condition A is modified by a Note which limits the applicability of the Condition for an inoperable turbine driven AFW pump in MODE 3 to when the unit is in MODE 3 following a refueling. Condition A allows the turbine driven AFW train to be inoperable for 7 days vice the 72 hour Completion Time in Condition B. This longer Completion Time is based on the reduced decay heat following refueling and prior to the reactor being critical.
| |
| B.1 With one of the required AFW trains (pump or flow path) inoperable in MODE 1, 2, or 3 for reasons other than Condition A, action must be taken to restore OPERABLE status within 72 hours. This Condition includes the loss of two steam supply lines to the turbine driven AFW pump. The 72 hour Completion Time is reasonable, based on the redundant capabilities afforded by the AFW System, the time needed for repairs, and the low probability of a DBA occurring during this time period.
| |
| The second Completion Time for Required Action B.1 establishes a limit on the maximum time allowed for any combination of Conditions to be inoperable during any continuous failure to meet this LCO.
| |
| The 10 day Completion Time provides a limitation time allowed in this specified Condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which Conditions A and B are entered concurrently. The AND connector between 72 hours and 10 days dictates that both Completion Times apply simultaneously, and the more restrictive must be met.
| |
| C.1 and C.2 With one of the required motor driven AFW trains (pump or flow path) inoperable and the turbine driven AFW train inoperable due to one inoperable steam supply, action must be taken to restore the affected equipment to OPERABLE status within 24 hours. Assuming no single active failures when in this condition, the accident (a FLB or MSLB) could result in the loss of the remaining steam supply to the turbine driven AFW pump due to the faulted SG. In this condition, the AFW system may no longer be able to meet the required flow to the SGs assumed in the safety analysis due to the analysis requiring flow from two AFW.
| |
| Cook Nuclear Plant Unit 2 B 3.7.5-6 Revision No. 80
| |
| | |
| AFW System B 3.7.5 BASES ACTIONS (continued)
| |
| The 24 hour Completion Time is reasonable based on the remaining OPERABLE steam supply to the turbine driven AFW pump, the availability of the remaining OPERABLE motor driven AFW pump, and the low probability of an event occurring that would require the inoperable steam supply to be available for the turbine driven AFW pump.
| |
| D.1 and D.2 When Required Action A.1, B.1, C.1 or C.2 cannot be completed within the associated Completion Time, or if two AFW trains are inoperable in MODE 1, 2, or 3 for reasons other than Condition C, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours, and in MODE 4 within 18 hours.
| |
| The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| In MODE 4 with two AFW trains inoperable, operation is allowed to continue because only one motor driven pump AFW train is required in accordance with the Note that modifies the LCO. Although not required, the unit may continue to cool down and initiate RHR.
| |
| E.1 If all three AFW trains are inoperable in MODE 1, 2, or 3, the unit is in a seriously degraded condition with no safety related means for conducting a cooldown, and only limited means for conducting a cooldown with nonsafety related equipment. In such a condition, the unit should not be perturbed by any action, including a power change, that might result in a trip. The seriousness of this condition requires that action be started immediately to restore one AFW train to OPERABLE status.
| |
| Required Action E.1 is modified by a Note indicating that all required MODE changes are suspended until one AFW train is restored to OPERABLE status. In this case, LCO 3.0.3 is not applicable because it could force the unit into a less safe condition.
| |
| F.1 In MODE 4, either the reactor coolant pumps or the RHR loops can be used to provide forced circulation. This is addressed in LCO 3.4.6, "RCS Loops - MODE 4." With one required AFW train inoperable, action must be taken to immediately restore the inoperable train to OPERABLE status. The immediate Completion Time is consistent with LCO 3.4.6.
| |
| Cook Nuclear Plant Unit 2 B 3.7.5-7 Revision No. 80
| |
| | |
| AFW System B 3.7.5 BASES SURVEILLANCE SR 3.7.5.1 REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves in the required AFW System water and steam supply flow paths provides assurance that the proper flow paths will exist for AFW operation. Verification of the AFW System water supply flow path includes both the suction (either a flow path from the CST or the Essential Service Water (ESW) System) and discharge flow paths. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since they are verified to be in the correct position prior to locking, sealing, or securing. This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves. This Surveillance does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position.
| |
| The SR is modified by a Note that states one or more AFW trains may be considered OPERABLE during alignment and operation for steam generator level control, if it is capable of being manually (i.e., remotely or locally, as appropriate) realigned to the AFW mode of operation, provided it is not otherwise inoperable. This exception allows the system to be out of its normal standby alignment and temporarily incapable of automatic initiation without declaring the train(s) inoperable. Since AFW may be used during startup, shutdown, hot standby operations, and hot shutdown operations for steam generator level control, and these manual operations are an accepted function of the AFW System, OPERABILITY (i.e., the intended safety function) continues to be maintained.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.7.5.2 Verifying that each required AFW pump's developed head at the flow test point is greater than or equal to the required developed head ensures that AFW pump performance has not degraded to an unacceptable level during the cycle. Flow and differential head are normal tests of centrifugal pump performance required by the ASME OM Code (Ref. 2).
| |
| Because it is undesirable to introduce cold AFW into the steam generators while they are operating, this testing is performed on recirculation flow. This test confirms one point on the pump design curve and is indicative of overall performance. Such inservice tests confirm component OPERABILITY and detect incipient failures by indicating abnormal performance. Performance of inservice testing as discussed in the ASME OM Code (Ref. 2) and the INSERVICE TESTING PROGRAM satisfies this requirement.
| |
| This SR is modified by a Note indicating that the SR should be deferred for the turbine driven AFW pump until suitable test conditions are Cook Nuclear Plant Unit 2 B 3.7.5-8 Revision No. 80
| |
| | |
| AFW System B 3.7.5 BASES SURVEILLANCE REQUIREMENTS (continued) established. This deferral is required because there is insufficient steam pressure to perform the test at entry into MODE 3. At 850 psig, there is sufficient pressure to perform the test.
| |
| SR 3.7.5.3 This SR verifies that AFW can be delivered to the appropriate steam generator in the event of any accident or transient that generates an ESFAS, by demonstrating that each automatic valve in the flow path actuates to its correct position on an actual or simulated actuation signal.
| |
| This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| The SR is modified by two Notes. Note 1 states that one or more AFW trains may be considered OPERABLE during alignment and operation for steam generator level control, if it is capable of being manually (i.e.,
| |
| remotely or locally, as appropriate) realigned to the AFW mode of operation, provided it is not otherwise inoperable. This exception allows the AFW train(s) to be out of normal standby alignment and temporarily incapable of automatic initiation without declaring the train(s) inoperable.
| |
| Since AFW may be used during startup, shutdown, hot standby operations, and hot shutdown operations for steam generator level control, these manual operations are an accepted condition of the AFW System, OPERABILITY (i.e., the intended safety function) continues to be maintained. Note 2 states that the SR is only required to be met in MODES 1, 2, and 3. It is not required to be met in MODE 4 since the AFW train is only required for the purposes of removing decay heat when the SG is relied upon for heat removal. The operation of the AFW train is by manual means and automatic startup of the AFW train is not required.
| |
| SR 3.7.5.4 This SR verifies that the AFW pumps will start in the event of any accident or transient that generates an ESFAS by demonstrating that each AFW pump starts automatically on an actual or simulated actuation signal in MODES 1, 2, and 3. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by three Notes. Note 1 indicates that the SR may be deferred for the turbine driven AFW pump until suitable test conditions are established. This deferral is required because there is insufficient steam pressure to perform the test at entry into MODE 3. At 850 psig, there is sufficient steam pressure to perform the test. Note 2 states that one or more AFW trains may be considered OPERABLE during alignment and Cook Nuclear Plant Unit 2 B 3.7.5-9 Revision No. 80
| |
| | |
| AFW System B 3.7.5 BASES SURVEILLANCE REQUIREMENTS (continued) operation for steam generator level control, if it is capable of being manually (i.e., remotely or locally, as appropriate) realigned to the AFW mode of operation, provided it is not otherwise inoperable. This exception allows the AFW train(s) to be out of normal standby alignment and temporarily incapable of automatic initiation without declaring the train(s) inoperable. Since AFW may be used during startup, shutdown, hot standby operations, and hot shutdown operations for steam generator level control, these manual operations are an accepted condition of the AFW System. OPERABILITY (i.e., the intended safety function) continues to be maintained. Note 3 states that the SR is only required to be met in MODES 1, 2, and 3. It is not required to be met in MODE 4 since the AFW train is only required for the purposes of removing decay heat when the SG is relied upon for heat removal. The operation of the AFW train is by manual means and automatic startup of the AFW train is not required.
| |
| REFERENCES 1. UFSAR, Section 10.5.2.
| |
| : 2. ASME, Operations and Maintenance Standards and Guides (OM Codes).
| |
| Cook Nuclear Plant Unit 2 B 3.7.5-10 Revision No. 80
| |
| | |
| CST B 3.7.6 B 3.7 PLANT SYSTEMS B 3.7.6 Condensate Storage Tank (CST)
| |
| BASES BACKGROUND The CST provides a qualified source of water to the steam generators for removing decay and sensible heat from the Reactor Coolant System (RCS). The CST provides a passive flow of water, by gravity, to the Auxiliary Feedwater (AFW) System (LCO 3.7.5, "Auxiliary Feedwater (AFW) System"). The steam produced is released to the atmosphere by the main steam safety valves (MSSVs) or the steam generator (SG) power operated relief valves (PORVs). The AFW pumps are equipped with recirculation lines to the CST.
| |
| When the steam generator stop valves are open, the preferred means of heat removal is to discharge steam to the condenser by the nonsafety grade path of the steam dump valves. The condensed steam may be returned to the CST by the hotwell pump.
| |
| Because the CST is a principal component in removing residual heat from the RCS, it is designed to withstand earthquakes. The CST is designed to Seismic Category I and ensures availability of the auxiliary feedwater supply. Auxiliary feedwater is also available from alternate sources such as the Essential Service Water System or the opposite units CST. In addition, the CST is also designed as a Seismic Category l structure due to its close proximity to the refueling water storage tank.
| |
| A description of the CST is found in the UFSAR, Section 10.5.2 (Ref. 1).
| |
| APPLICABLE The CST provides cooling water to remove decay heat and to cool down SAFETY the unit following the events in the accident analysis as discussed in ANALYSES the UFSAR, Chapter 14 (Ref. 2). OPERABILITY of the CST is implicitly assumed in the accident analysis via the requirement for AFW OPERABILITY. In addition, the CST analysis assumptions are either 2 hours at MODE 3 steaming through the steam dump valves, MSSVs, or SG PORVs followed by a 4 hour cooldown to residual heat removal (RHR) entry conditions, or 9 hours at MODE 3 steaming through the MSSVs or SG PORVs. Although not part of the UFSAR Chapter 14 accident analysis, the CST also contains sufficient volume to supply the turbine driven AFW pump for the 4 hour station blackout coping period (Ref. 3).
| |
| The CST satisfies Criteria 2 and 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The CST must contain sufficient cooling water to remove the metal and water sensible heat in the RCS from 100.34% RTP to a nominal no-load condition in MODE 3, and to either remove decay heat for 2 hours Cook Nuclear Plant Unit 2 B 3.7.6-1 Revision No. 55
| |
| | |
| CST B 3.7.6 BASES LCO (continued) in MODE 3 and then cool down the RCS to RHR entry conditions assuming a coincident loss of offsite power, or to remove decay heat for 9 hours in MODE 3 assuming a loss of offsite power as the initiating event.
| |
| The CST volume required is equivalent to a usable volume of 138,335 gallons, which is based on the more limiting of either holding the unit in MODE 3 for 9 hours or holding the unit in MODE 3 for 2 hours followed by a 4 hour cooldown to RHR entry conditions. This basis is established to satisfy the limiting Reference 3 analysis (holding the unit in MODE 3 for 9 hours) and exceeds the volume required by the other analysis assumptions (holding the unit in MODE 3 for 2 hours followed by a 4 hour cooldown to RHR entry conditions). The CST volume limit includes an allowance for water not usable because of tank discharge line location, other physical characteristics such as net positive suction head and vortexing, and an additional volume for conservatism. The actual CST usable volume required for holding the unit in MODE 3 for 9 hours is 138,300 gallons.
| |
| The OPERABILITY of the CST is determined by maintaining the tank volume at or above the minimum required volume.
| |
| APPLICABILITY In MODES 1, 2, and 3, and in MODE 4, when steam generator is being relied upon for heat removal, the CST is required to be OPERABLE.
| |
| In MODE 5 or 6, the CST is not required because the AFW System is not required.
| |
| ACTIONS A.1 and A.2 If the CST is not OPERABLE, the OPERABILITY of the backup supply should be verified by administrative means within 4 hours and once every 12 hours thereafter. OPERABILITY of the backup auxiliary feedwater supply (i.e., the Essential Service Water (ESW) System) must include verification that the flow paths from the ESW System to the AFW pumps are OPERABLE, and that both ESW trains are OPERABLE and in operation. For the ESW System to be considered the backup supply it must also be in operation. The CST must be restored to OPERABLE status within 7 days, because the backup auxiliary feedwater supply may be performing this function in addition to its normal functions. The 4 hour Completion Time is reasonable, based on operating experience, to verify the OPERABILITY of the backup auxiliary feedwater supply. Additionally, verifying the backup auxiliary feedwater supply every 12 hours is Cook Nuclear Plant Unit 2 B 3.7.6-2 Revision No. 55
| |
| | |
| CST B 3.7.6 BASES ACTIONS (continued) adequate to ensure the backup auxiliary feedwater supply continues to be available. The 7 day Completion Time is reasonable, based on an OPERABLE backup auxiliary feedwater supply being available, and the low probability of an event occurring during this time period requiring the CST.
| |
| B.1 and B.2 If any Required Action and associated Completion Time cannot be met, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours, and in MODE 4, without reliance on the steam generator for heat removal, within 24 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| SURVEILLANCE SR 3.7.6.1 REQUIREMENTS This SR verifies that the CST contains the required volume of cooling water. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 10.5.2.
| |
| : 2. UFSAR, Chapter 14.
| |
| : 3. Calculation TH-99-13, Condensate Storage Tank Inventory Cook Nuclear Plant Unit 2 B 3.7.6-3 Revision No. 60
| |
| | |
| CCW System B 3.7.7 B 3.7 PLANT SYSTEMS B 3.7.7 Component Cooling Water (CCW) System BASES BACKGROUND The CCW System provides a heat sink for the removal of process and operating heat from safety related components during a Design Basis Accident (DBA) or transient. During normal operation, the CCW System also provides this function for various nonessential components, as well as the spent fuel storage pool. The CCW System serves as a barrier to the release of radioactive byproducts between potentially radioactive systems and the Essential Service Water (ESW) System, and thus to the environment.
| |
| The CCW System is arranged as two independent, full capacity safeguard cooling loops, and has isolatable nonsafety related components. Each safety related train includes a full capacity pump, heat exchanger, piping, valves, a common surge tank, and instrumentation.
| |
| Each safety related train is powered from a separate bus. An open surge tank in the system is equipped with a low level alarm that annunciates in the control room to ensure that sufficient net positive suction head is available. The pump in each train is automatically started on receipt of a Safety Injection signal, the heat exchanger outlet valves are opened, and certain nonessential components are isolated. The pumps are also started on a low header pressure signal, but this is not required for OPERABILITY of the CCW System.
| |
| Additional information on the design and operation of the system, along with a list of the components served, is presented in the UFSAR, Section 9.5 (Ref. 1). The principal safety related function of the CCW System is the removal of decay heat from the reactor via the Residual Heat Removal (RHR) System. This may be during a normal or post accident cooldown and shutdown.
| |
| APPLICABLE The design basis of the CCW System is for one CCW train to remove the SAFETY post loss of coolant accident (LOCA) heat load from the containment ANALYSES sump during the recirculation phase, with a maximum CCW temperature of 120°F (Ref. 2). The Emergency Core Cooling System (ECCS) LOCA and containment OPERABILITY LOCA each model the maximum and minimum performance of the CCW System, respectively. The normal temperature range of the CCW is between 60°F and 105°F, and, during unit cooldown to MODE 5 (Tavg 200°F), a maximum temperature of 120°F is assumed. This prevents the containment sump fluid from increasing in temperature during the recirculation phase following a LOCA, and provides a gradual reduction in the temperature of this fluid as it is supplied to the Reactor Coolant System (RCS) by the ECCS pumps.
| |
| Cook Nuclear Plant Unit 2 B 3.7.7-1 Revision No. 0
| |
| | |
| CCW System B 3.7.7 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| The CCW System is designed to perform its function with a single failure of any active component, assuming a loss of offsite power.
| |
| The CCW System also functions to cool the unit from RHR entry conditions (Tavg < 350°F), to MODE 5 (Tavg 200°F), during normal and post accident operations. The time required to cool from 350°F to 200°F is a function of the number of CCW and RHR trains operating. One CCW train is sufficient to remove decay heat during subsequent operations with Tavg 200°F.
| |
| The CCW System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The CCW trains are independent of each other to the degree that each has separate controls and power supplies and the operation of one does not depend on the other. In the event of a DBA, one CCW train is required to provide the minimum heat removal capability assumed in the safety analysis for the systems to which it supplies cooling water. To ensure this requirement is met, two trains of CCW must be OPERABLE.
| |
| At least one CCW train will operate assuming the worst case single active failure occurs coincident with a loss of offsite power.
| |
| A CCW train is considered OPERABLE when:
| |
| : a. The pump and surge tank are OPERABLE; and
| |
| : b. The associated piping, valves, heat exchanger, and instrumentation and controls required to perform the safety related function are OPERABLE.
| |
| The isolation of CCW from other components or systems not required for safety may render those components or systems inoperable but does not affect the OPERABILITY of the CCW System.
| |
| APPLICABILITY In MODES 1, 2, 3, and 4, the CCW System is a normally operating system, which must be prepared to perform its post accident safety functions, primarily RCS heat removal, which is achieved by cooling the RHR heat exchanger.
| |
| In MODE 5 or 6, the OPERABILITY requirements of the CCW System are determined by the systems it supports.
| |
| Cook Nuclear Plant Unit 2 B 3.7.7-2 Revision No. 62
| |
| | |
| CCW System B 3.7.7 BASES ACTIONS A.1 Required Action A.1 is modified by a Note indicating that the applicable Conditions and Required Actions of LCO 3.4.6, "RCS Loops - MODE 4,"
| |
| be entered if an inoperable CCW train results in an inoperable RHR loop.
| |
| This is an exception to LCO 3.0.6 and ensures the proper actions are taken for these components.
| |
| If one CCW train is inoperable, action must be taken to restore OPERABLE status within 72 hours. In this condition, the remaining OPERABLE CCW train is adequate to perform the heat removal function.
| |
| The 72 hour Completion Time is reasonable, based on the redundant capabilities afforded by the OPERABLE train, and the low probability of a DBA occurring during this period.
| |
| B.1 and B.2 If the CCW train cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours and in MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| SURVEILLANCE SR 3.7.7.1 REQUIREMENTS This SR is modified by a Note indicating that the isolation of the CCW flow to individual components may render those components inoperable but does not affect the OPERABILITY of the CCW System.
| |
| Verifying the correct alignment for manual, power operated, and automatic valves in the CCW flow path provides assurance that the proper flow paths exist for CCW operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves are verified to be in the correct position prior to locking, sealing, or securing. This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves. This Surveillance does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Cook Nuclear Plant Unit 2 B 3.7.7-3 Revision No. 60
| |
| | |
| CCW System B 3.7.7 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.7.7.2 This SR verifies proper automatic operation of the CCW valves on an actual or simulated actuation signal. The CCW System is a normally operating system that cannot be fully actuated as part of routine testing during normal operation. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.7.7.3 This SR verifies proper automatic operation of the CCW pumps on an actual or simulated actuation signal. The CCW System is a normally operating system that cannot be fully actuated as part of routine testing during normal operation. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 9.5.
| |
| : 2. UFSAR, Table 9.5-3.
| |
| Cook Nuclear Plant Unit 2 B 3.7.7-4 Revision No. 60
| |
| | |
| ESW System B 3.7.8 B 3.7 PLANT SYSTEMS B 3.7.8 Essential Service Water (ESW) System BASES BACKGROUND The ESW System provides a heat sink for the removal of process and operating heat from safety related components during a Design Basis Accident (DBA) or transient. During normal operation, and a normal shutdown, the ESW System also provides this function for various safety related and nonsafety related components. The safety related functions are covered by this LCO.
| |
| The ESW System consists of two ESW pumps, two duplex strainers, and associated piping and valves. ESW System piping is arranged in two independent headers (trains), each serving certain safety related components. The two trains are arranged such that a rupture in either train will not jeopardize the safety functions of the ESW System. Each train is served by one ESW pump. One crosstie valve is available on each train in order to crosstie the train to one of the Unit 1 ESW trains (since each unit train has a crosstie valve, both must be open to crosstie the two trains). Two of the four pumps can supply all of the Unit 1 and Unit 2 ESW flow requirements for unit operation, shutdown, and refueling.
| |
| Therefore, each ESW train is normally crosstied with the associated Unit 1 ESW train, with one ESW pump in each of the crosstied trains in operation. All four ESW pumps start on a Safety Injection signal from either unit. In addition, the Component Cooling Water (CCW) heat exchanger ESW outlet valves of the affected unit actuate to a predetermined position to ensure that the required ESW flow distributions are maintained during the recirculation phase on an accident. Flow is automatically supplied to the Containment Spray System heat exchangers during the recirculation phase of the accident if a Containment Spray signal has been initiated. Upon receipt of a Containment Isolation - Phase B Isolation signal, full ESW accident flow is established to both CTS heat exchangers. The header and valve arrangement ensures adequate ESW flow under all normal and emergency conditions. The ESW pumps obtain and discharge water to the ultimate heat sink (UHS), which is further discussed in the Bases for LCO 3.7.9, "Ultimate Heat Sink." In addition, the ESW System provides the backup water supply to the Auxiliary Feedwater System, when required by LCO 3.7.6, "Condensate Storage Tank."
| |
| Additional information about the design and operation of the ESW System, along with a list of the components served, is presented in the UFSAR, Section 9.8.3 (Ref. 1). The principal safety related functions of the ESW System are the removal of decay heat from the reactor via the CCW System and assisting in the removal of heat from containment after a DBA via the Containment Spray System.
| |
| Cook Nuclear Plant Unit 2 B 3.7.8-1 Revision No. 37
| |
| | |
| ESW System B 3.7.8 BASES APPLICABLE The design basis of the ESW System is for one ESW train to assist in the SAFETY removal of core decay heat following a design basis loss of coolant ANALYSES accident (LOCA) as discussed in the UFSAR, Section 9.8.3.2 (Ref. 2).
| |
| This prevents the containment sump fluid from increasing in temperature during the recirculation phase following a LOCA and provides for a gradual reduction in the temperature of this fluid as it is supplied to the Reactor Coolant System by the Emergency Core Cooling System (ECCS) pumps. The ESW System is designed to perform its function with a single failure of any active component, assuming the loss of offsite power.
| |
| The ESW System, in conjunction with the CCW System, removes heat from the Residual Heat Removal (RHR) System, from RHR entry conditions to MODE 5 during normal and post accident operations (Ref. 3). The time required for this evolution is a function of the number of CCW and RHR System trains that are operating. One ESW train is sufficient to remove decay heat during subsequent operations in MODES 5 and 6.
| |
| The ESW System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO Two ESW trains are required to be OPERABLE to provide the required redundancy to ensure that the system functions to remove post accident heat loads, assuming that the worst case single active failure occurs coincident with the loss of offsite power.
| |
| An ESW train is considered OPERABLE during MODES 1, 2, 3, and 4 when:
| |
| : a. The pump is OPERABLE; and
| |
| : b. The associated piping, valves, heat exchanger, strainer, and instrumentation and controls required to perform the safety related function are OPERABLE.
| |
| In addition, when an ESW train is crosstied with the associated Unit 1 ESW train, OPERABILITY of the ESW train also includes the associated Unit 1 ESW pump.
| |
| APPLICABILITY In MODES 1, 2, 3, and 4, the ESW System is a normally operating system that is required to support the OPERABILITY of the equipment serviced by the ESW System and required to be OPERABLE in these MODES.
| |
| In MODES 5 and 6, the OPERABILITY requirements of the ESW System are determined by the systems it supports.
| |
| Cook Nuclear Plant Unit 2 B 3.7.8-2 Revision No. 62
| |
| | |
| ESW System B 3.7.8 BASES ACTIONS A.1 If one ESW train is inoperable, action must be taken to restore OPERABLE status within 72 hours. In this condition, the remaining OPERABLE ESW train is adequate to perform the heat removal function.
| |
| However, the overall reliability is reduced because a single failure in the OPERABLE ESW train could result in loss of ESW System function. As noted in the LCO Note, ESW train OPERABILITY includes the associated Unit 1 ESW pump when the ESW train is crosstied with the associated Unit 1 ESW train. Thus, restoring the inoperable ESW train can be accomplished by closing the crosstie valves between the two trains.
| |
| Required Action A.1 is modified by two Notes. The first Note indicates that the applicable Conditions and Required Actions of LCO 3.8.1, "AC Sources - Operating," should be entered if an inoperable ESW train results in an inoperable emergency diesel generator. The second Note indicates that the applicable Conditions and Required Actions of LCO 3.4.6, "RCS Loops - MODE 4," should be entered if an inoperable ESW train results in an inoperable decay heat removal train. This is an exception to LCO 3.0.6 and ensures the proper actions are taken for these components. The 72 hour Completion Time is based on the redundant capabilities afforded by the OPERABLE train, and the low probability of a DBA occurring during this time period.
| |
| B.1 and B.2 If the ESW train cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours and in MODE 5 within 36 hours.
| |
| The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| SURVEILLANCE SR 3.7.8.1 REQUIREMENTS This SR is modified by a Note indicating that the isolation of the ESW System components or systems may render those components inoperable, but does not affect the OPERABILITY of the ESW System.
| |
| Verifying the correct alignment for manual, power operated, and automatic valves in the ESW flow path provides assurance that the proper flow paths exist for ESW operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since they are verified to be in the correct position prior to being locked, sealed, or secured. This SR does not require any testing or valve manipulation; Cook Nuclear Plant Unit 2 B 3.7.8-3 Revision No. 0
| |
| | |
| ESW System B 3.7.8 BASES SURVEILLANCE REQUIREMENTS (continued) rather, it involves verification that those valves capable of being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.7.8.2 This SR verifies proper automatic operation of the ESW valves on an actual or simulated actuation signal. The ESW System is a normally operating system that cannot be fully actuated as part of normal testing.
| |
| This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.7.8.3 This SR verifies proper automatic operation of the required ESW pumps on an actual or simulated actuation signal. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 9.8.3.
| |
| : 2. UFSAR, Section 9.8.3.2.
| |
| : 3. UFSAR, Section 9.5.2.
| |
| Cook Nuclear Plant Unit 2 B 3.7.8-4 Revision No. 60
| |
| | |
| UHS B 3.7.9 B 3.7 PLANT SYSTEMS B 3.7.9 Ultimate Heat Sink (UHS)
| |
| BASES BACKGROUND The UHS provides a heat sink for process and operating heat from safety related components during a transient or accident, as well as during normal operation. This is done by utilizing the Essential Service Water (ESW) System and its associated loads.
| |
| The UHS is Lake Michigan. Water is drawn from three submerged intake structures in the lake, located approximately 2,250 ft from the shoreline, and is piped through three parallel lines to the screen house. The screen house, common to both units, contains the circulating water pumps and valves, traveling water screens, ESW pumps, and associated equipment.
| |
| The intake structures, the screen house, and connecting piping are all designed to ensure a reliable flow of cooling water to the plant at all times.
| |
| The Circulating Water System and related structures are designed to satisfy normal operating requirements and to assure that water is available to the ESW pumps under all foreseeable conditions.
| |
| Traveling water screens of adequate capacity for normal plant operation are provided in the intake structure. The huge oversize of the screen installation, in terms of the essential flow requirements, provides assurance that adequate water is available to the ESW pumps. The two principal functions of the UHS are the dissipation of residual heat after reactor shutdown, and dissipation of residual heat after a transient or accident.
| |
| The basic performance requirements are that a 30 day supply of water be available, and that the design basis temperatures of safety related equipment not be exceeded.
| |
| Additional information on the design and operation of the system, along with a list of components served, can be found in Reference 1.
| |
| APPLICABLE The UHS is the sink for heat removed from the reactor core following all SAFETY accidents and anticipated operational occurrences in which the unit is ANALYSES cooled down and placed on residual heat removal (RHR) operation. The UHS is the normal heat sink for condenser cooling via the Circulating Water System. Therefore, unit operation at full power is its maximum heat load. Its maximum post accident heat load occurs approximately 20 minutes after a design basis loss of coolant accident (LOCA). Near this time, the unit switches from injection to recirculation and the containment cooling systems and RHR are required to remove the core decay heat.
| |
| Cook Nuclear Plant Unit 2 B 3.7.9-1 Revision No. 0
| |
| | |
| UHS B 3.7.9 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| The operating limits are based on conservative heat transfer analyses for the worst case LOCA. References 1 and 2 provide the details of the assumptions used in the analysis, which include worst expected meteorological conditions, conservative uncertainties when calculating decay heat, and worst case single active failure (e.g., single failure of a manmade structure). The UHS is consistent with the Regulatory Guide 1.27 (Ref. 3) requirement that requires a 30 day supply of cooling water in the UHS.
| |
| The UHS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The UHS is required to be OPERABLE and is considered OPERABLE if it contains a sufficient volume of water at or below the maximum temperature that would allow the ESW System to operate for at least 30 days following the design basis LOCA without the loss of net positive suction head (NPSH), and without exceeding the maximum design temperature of the equipment served by the ESW System. To meet this condition, the UHS temperature should not exceed 86.9°F and the level should not fall below the level necessary for normal unit operation.
| |
| APPLICABILITY In MODES 1, 2, 3, and 4, the UHS is required to support the OPERABILITY of the equipment serviced by the UHS and required to be OPERABLE in these MODES.
| |
| In MODE 5 or 6, the OPERABILITY requirements of the UHS are determined by the systems it supports.
| |
| ACTIONS A.1 and A.2 If the UHS is inoperable, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours and in MODE 5 within 36 hours.
| |
| The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| SURVEILLANCE SR 3.7.9.1 REQUIREMENTS This SR verifies that the average water temperature of the UHS (as measured in the forebay) is 86.9°F to ensure the ESW System is available to cool its associated loads to at least their maximum design temperature with the maximum accident or normal design heat loads for 30 days following a Design Basis Accident. One acceptable method of Cook Nuclear Plant Unit 2 B 3.7.9-2 Revision No. 62
| |
| | |
| UHS B 3.7.9 BASES SURVEILLANCE REQUIREMENTS (continued) determining the UHS temperature is averaging the available operating circulating water pumps discharge temperatures. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 10.6.2.
| |
| : 2. UFSAR, Table 9.8-5.
| |
| : 3. Regulatory Guide 1.27, Revision 2, January 1976.
| |
| : 4. MD-12-ESW-106-N Assessment of Increased Lake Water Temperature on Safety Related and Non-Safety Related Systems.
| |
| Cook Nuclear Plant Unit 2 B 3.7.9-3 Revision No. 60
| |
| | |
| CREV System B 3.7.10 B 3.7 PLANT SYSTEMS B 3.7.10 Control Room Emergency Ventilation (CREV) System BASES BACKGROUND The CREV System provides a protected environment from which occupants can control the unit following an uncontrolled release of radioactivity, or smoke.
| |
| The CREV System consists of two trains that circulate and filter the control room envelope (CRE) and outside air and a CRE boundary that limits the inleakage of unfiltered air. Each train shares a common filter unit consisting of a prefilter, a high efficiency particulate air (HEPA) filter, and an activated charcoal adsorber section for removal of gaseous activity (principally iodines). Each train includes an independent and redundant filter unit fan. Ductwork, valves or dampers, doors, barriers, and instrumentation also form part of the system.
| |
| The CRE is the area within the confines of the CRE boundary that contains the spaces that control room occupants inhabit to control the unit during normal and accident conditions. The CRE consists of the control room, the control room heating, ventilation, and air conditioning equipment room, and the plant process computer room. The CRE is protected during normal operation, natural events, and accident conditions. The CRE boundary is the combination of walls, floor, roof, ducting, doors, penetrations, and equipment that physically form the CRE.
| |
| The OPERABILITY of the CRE boundary must be maintained to ensure that the inleakage of unfiltered air into the CRE will not exceed the inleakage assumed in the licensing basis analysis of design basis accident (DBA) consequences to the CRE occupants. The CRE and its boundary are defined in the Control Room Envelope Habitability Program.
| |
| The CREV System is an emergency system which is normally in the standby mode of operation. The CREV System is part of the Control Room Ventilation System. During normal unit operation, the Control Room Air Conditioning (CRAC) System portion of the Control Room Ventilation System is operating in the air conditioning mode, which is further described in the Bases of LCO 3.7.11, "Control Room Air Conditioning (CRAC) System." Upon receipt of the actuating signal(s),
| |
| normal outside air intake supply to the CRAC System is isolated. Upon receipt of the same actuating signal(s), the emergency air intake supply to the CREV System is opened to a predetermined position and the CREV fans start. Both outside air and air within the CRE are directed through the CREV System filter unit and directed to the CRE to maintain the CRE boundary at a positive pressure. This emergency mode of operation is known as the pressurization/cleanup mode. The prefilter removes any Cook Nuclear Plant Unit 2 B 3.7.10-1 Revision No. 23
| |
| | |
| CREV System B 3.7.10 BASES BACKGROUND (continued) large particles in the air to prevent excessive loading of the HEPA filter and charcoal adsorber.
| |
| Outside air is added to the air being recirculated from the CRE and both are filtered. Pressurization of the CRE minimizes infiltration of unfiltered air through the CRE boundary from all the surrounding areas adjacent to the CRE boundary. A Safety Injection signal from either unit or a Control Room Radiation - High signal will place the CREV System in the pressurization/cleanup mode.
| |
| A single CREV System train operating at a flow rate of approximately 1000 cfm will pressurize the CRE to about 0.0625 inches water gauge relative to external areas adjacent to the CRE boundary. The CREV System operation in maintaining the CRE habitable is discussed in the UFSAR, Section 9.10 (Ref. 1).
| |
| Normally open isolation dampers of the CRAC System are arranged in series pairs so that the failure of one damper to shut will not result in a breach of isolation of the control room boundary. The CREV System is designed in accordance with Seismic Category I requirements.
| |
| The CREV System is designed to maintain a habitable environment in the CRE for 30 days of continuous occupancy after a Design Basis Accident (DBA) without exceeding a 5 rem total effective dose equivalent (TEDE).
| |
| APPLICABLE The CREV System components are arranged in redundant, safety related SAFETY ventilation trains both sharing a common filter unit, ducting, and intake ANALYSES path. The location of components and ducting within the CRE ensures an adequate supply of filtered air to all areas requiring access. The CREV System provides airborne radiological protection for the CRE occupants, as demonstrated by the CRE occupant dose analyses for the most limiting design basis accident fission product release presented in the UFSAR, Chapter 14 (Ref. 2).
| |
| The CREV System provides protection from smoke to the CRE occupants. There is no quantitative limit for smoke. The limit is qualitative and is based on the discretion of the Shift Manager. If the level of smoke, as determined by the Shift Manager, would prevent the operators from functioning in the control room, then the CREV System should be considered inoperable.
| |
| Cook Nuclear Plant Unit 2 B 3.7.10-2 Revision No. 23
| |
| | |
| CREV System B 3.7.10 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| Analyses have determined that the CREV System is not required to be operable to ensure hazardous chemical limits are not exceeded (Ref. 3).
| |
| There are no Surveillance Requirements to verify CREV System operability for hazardous chemicals or smoke.
| |
| The worst case single active failure of a component of the CREV System, assuming a loss of offsite power, does not impair the ability of the system to perform its design function.
| |
| The CREV System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO Two CREV trains are required to be OPERABLE to ensure that at least one is available if a single active failure disables the other train. Total system failure, such as from a loss of both ventilation trains or from an inoperable CRE boundary, could result in exceeding a dose of 5 rem TEDE to the CRE occupants in the event of a large radioactive release.
| |
| Each CREV System train is considered OPERABLE when the individual components necessary to limit CRE occupant exposure are OPERABLE.
| |
| A CREV train is OPERABLE when the associated:
| |
| : a. Fan is OPERABLE;
| |
| : b. HEPA filters and charcoal adsorbers are not excessively restricting flow, and are capable of performing their filtration functions; and
| |
| : c. Ductwork, valves, and dampers are OPERABLE, and air circulation can be maintained.
| |
| In order for the CREV System trains to be considered OPERABLE, the CRE boundary must be maintained such that the CRE occupant dose from a large radioactive release does not exceed the calculated dose in the licensing basis consequence analyses for DBAs, and that CRE occupants are protected from smoke.
| |
| The LCO is modified by a Note allowing the CRE boundary to be opened intermittently under administrative controls. This Note only applies to openings in the CRE boundary that can be rapidly restored to the design condition, such as doors, hatches, floor plugs, and access panels. For entry and exit through doors, the administrative control of the opening is performed by the person(s) entering or exiting the area.
| |
| Cook Nuclear Plant Unit 2 B 3.7.10-3 Revision No. 23
| |
| | |
| CREV System B 3.7.10 BASES LCO (continued)
| |
| For other openings, these controls should be proceduralized and consist of stationing a dedicated individual at the opening who is in continuous communication with the operators in the CRE. This individual will have a method to rapidly close the opening and to restore the CRE boundary to a condition equivalent to the design condition when a need for CRE isolation is indicated.
| |
| APPLICABILITY In MODES 1, 2, 3, and 4, and during movement of irradiated fuel assemblies in the containment, auxiliary building, and Unit 1 containment, the CREV System must be OPERABLE to ensure that the CRE will remain habitable during and following a DBA.
| |
| During movement of irradiated fuel assemblies, the CREV System must be OPERABLE to cope with the release from a fuel handling accident.
| |
| ACTIONS A.1 When one CREV train is inoperable, for reasons other than an inoperable CRE boundary, action must be taken to restore OPERABLE status within 7 days. In this condition, the remaining OPERABLE CREV train is adequate to perform the CRE occupant protection function. However, the overall reliability is reduced because a failure in the OPERABLE CREV train could result in loss of CREV function. The 7 day Completion Time is based on the low probability of a DBA occurring during this time period, and ability of the remaining train to provide the required capability.
| |
| B.1, B.2, and B.3 If the unfiltered inleakage of potentially contaminated air past the CRE boundary and into the CRE can result in CRE occupant radiological dose greater than the calculated dose of the licensing basis analyses of DBA consequences (allowed to be up to 5 rem TEDE), or inadequate protection of CRE occupants from smoke, the CRE boundary is inoperable. Actions must be taken to restore an OPERABLE CRE boundary within 90 days.
| |
| During the period that the CRE boundary is considered inoperable, action must be initiated to implement mitigating actions to lessen the effect on CRE occupants from the potential hazards of a radiological event or a challenge from smoke. Actions must be taken within 24 hours to verify that in the event of a DBA, the mitigating actions will ensure that CRE occupant radiological exposures will not exceed the calculated dose of the licensing basis analyses of DBA consequences, and that CRE occupants are protected from smoke. Analyses have determined that the CREV System is not required to be operable to ensure hazardous chemical limits are not exceeded (Ref. 3).
| |
| Cook Nuclear Plant Unit 2 B 3.7.10-4 Revision No. 23
| |
| | |
| CREV System B 3.7.10 BASES ACTIONS (continued)
| |
| These mitigating actions (i.e., actions that are taken to offset the consequences of the inoperable CRE boundary) should be preplanned for implementation upon entry into the condition, regardless of whether entry is intentional or unintentional. The 24 hour Completion Time is reasonable based on the low probability of a DBA occurring during this time period, and the use of mitigating actions. The 90 day Completion Time is reasonable based on the determination that the mitigating actions will ensure protection of CRE occupants within analyzed limits while limiting the probability that CRE occupants will have to implement protective measures that may adversely affect their ability to control the reactor and maintain it in a safe shutdown condition in the event of a DBA. In addition, the 90 day Completion Time is a reasonable time to diagnose, plan and possibly repair, and test most problems with the CRE boundary.
| |
| C.1 If the CREV filter unit is inoperable in MODE 1, 2, 3, or 4, the CREV trains cannot perform their intended functions. Action must be taken to restore an OPERABLE filter unit within 24 hours. The 24 hour Completion Time is reasonable based on the low probability of a DBA occurring during this time period. The 24 hour Completion Time is a typically reasonable time to diagnose, plan and possibly repair, and test most problems with the filter unit.
| |
| D.1 and D.2 In MODE 1, 2, 3, or 4, if the inoperable CREV train, CRE boundary, or filter unit cannot be restored to OPERABLE status within the required Completion Time, the unit must be placed in a MODE minimizes accident risk. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours, and in MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| E.1 and E.2 During movement of irradiated fuel assemblies in the containment, auxiliary building, or Unit 1 containment, if the inoperable CREV train cannot be restored to OPERABLE status within the required Completion Time, action must be taken to immediately place the OPERABLE CREV train in the pressurization/cleanup mode. This action ensures that the remaining train is OPERABLE and that any active failure would be readily detected.
| |
| Cook Nuclear Plant Unit 2 B 3.7.10-5 Revision No. 23
| |
| | |
| CREV System B 3.7.10 BASES ACTIONS (continued)
| |
| An alternative to Required Action E.1 is to immediately suspend activities that could result in a release of radioactivity that might require isolation of the CRE (Required Action E.2). This places the unit in a condition where the LCO does not apply. This does not preclude the movement of fuel to a safe position.
| |
| F.1 During movement of irradiated fuel assemblies in the containment, auxiliary building, or Unit 1 containment, with two CREV trains inoperable, or with one or more CREV System trains inoperable due to inoperable CRE boundary, action must be taken immediately to suspend activities that could result in a release of radioactivity that requires isolation of the CRE. This places the unit in a condition that minimizes the accident risk.
| |
| This does not preclude the movement of fuel to a safe position.
| |
| G.1 If both CREV trains are inoperable in MODE 1, 2, 3, or 4 for reasons other than an inoperable CRE boundary or filter unit (i.e., Conditions B and C), the CREV System may not be capable of performing the intended function and the unit is in a condition outside the accident analyses.
| |
| Therefore, LCO 3.0.3 must be entered immediately.
| |
| SURVEILLANCE SR 3.7.10.1 REQUIREMENTS Standby systems should be checked periodically to ensure that they function properly. As the environment and normal operating conditions on this system are not too severe, testing each train provides an adequate check of this system. Operating the CREV train, with flow through the HEPA filter and charcoal adsorber train, for 15 minutes demonstrates the function of the CREV train. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.7.10.2 This SR verifies that the required CREV System testing is performed in accordance with the Ventilation Filter Testing Program (VFTP). The VFTP includes testing the performance of the HEPA filter, charcoal adsorber efficiency, minimum and maximum flow rate, and the physical properties of the activated charcoal. Specific test Frequencies and additional information are discussed in detail in the VFTP.
| |
| Cook Nuclear Plant Unit 2 B 3.7.10-6 Revision No. 60
| |
| | |
| CREV System B 3.7.10 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.7.10.3 This SR verifies that each CREV train starts and operates on an actual or simulated actuation signal. The SR excludes automatic dampers and valves that are locked, sealed, or otherwise secured in the actuated position. The SR does not apply to dampers or valves that are locked, sealed, or otherwise secured in the actuated position since the affected dampers or valves were verified to be in the actuated position prior to being locked, sealed or otherwise secured. Placing an automatic valve or damper in a locked, sealed, or otherwise secured position requires an assessment of the operability of the system or any supported systems, including whether it is necessary for the valve or damper to be repositioned to the non-actuated position to support the accident analysis.
| |
| Restoration of an automatic valve or damper to the non-actuated position requires verification that the SR has been met within its required Frequency.
| |
| The only actuation signal necessary to be verified is the Safety Injection (SI) signal, since the Control Room Radiation - High signal is not assumed in the accident analysis. A Note has been included that states the Surveillance is only required to be met in MODES 1, 2, 3, and 4, since these are the MODES the SI signal is assumed to start the CREV trains.
| |
| The CREV trains are assumed to be manually started during a fuel handling accident. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.7.10.4 This SR verifies the OPERABILITY of the CRE boundary by testing for unfiltered air inleakage past the CRE boundary and into the CRE. The details of the testing are specified in the Control Room Envelope Habitability Program.
| |
| The CRE is considered habitable when the radiological dose to CRE occupants calculated in the licensing basis analyses of DBA consequences is no more than 5 rem TEDE, the CRE occupants are protected from smoke, and analyses demonstrate that the CREV System is not needed to prevent exceeding hazardous chemical limits. This SR verifies that the unfiltered air inleakage into the CRE is no greater than the flow rate assumed in the licensing basis analyses of DBA consequences. When unfiltered air inleakage is greater than the assumed flow rate, Condition B must be entered. Required Action B.3 allows time to restore the CRE boundary to OPERABLE status provided mitigating actions can ensure that the CRE remains within the licensing basis habitability limits for the occupants following an accident.
| |
| Compensatory measures are discussed in Regulatory Guide 1.196, Section C.2.7.3, (Ref. 4) which endorses, with exceptions, NEI 99-03, Section 8.4 and Appendix F (Ref. 5). These compensatory measures Cook Nuclear Plant Unit 2 B 3.7.10-7 Revision No. 83
| |
| | |
| CREV System B 3.7.10 BASES SURVEILLANCE REQUIREMENTS (continued) may also be used as mitigating actions as required by Required Action B.2. Temporary analytical methods may also be used as compensatory measures to restore OPERABILITY (Ref. 6). Options for restoring the CRE boundary to OPERABLE status include changing the licensing basis DBA consequence analysis, repairing the CRE boundary, or a combination of these actions. Depending upon the nature of the problem and the corrective action, a full scope inleakage test may not be necessary to establish that the CRE boundary has been restored to OPERABLE status. There are no SRs to verify CREV System operability for hazardous chemicals or smoke.
| |
| REFERENCES 1. UFSAR, Section 9.10.
| |
| : 2. UFSAR, Chapter 14.
| |
| : 3. Letter from Indiana Michigan Power Company (J. A. Zwolinski) to the NRC, Response to Nuclear Regulatory Commission Generic Letter 2003-01: Control Room Habitability, dated December 4, 2003, Response to Item 1.b (Letter AEP:NRC:3054-15).
| |
| : 4. Regulatory Guide 1.196, Control Room Habitability at Light-Water Nuclear Power Reactors, May 2003.
| |
| : 5. NEI 99-03, Control Room Habitability Assessment, June 2001.
| |
| : 6. Letter from Eric J. Leeds (NRC) to James W. Davis (NEI) dated January 30, 2004, NEI Draft White Paper, Use of Generic Letter 91-18 Process and Alternative Source Terms in the Context of Control Room Habitability. (ADAMS Accession No. ML040160868).
| |
| Cook Nuclear Plant Unit 2 B 3.7.10-8 Revision No. 83
| |
| | |
| CRAC System B 3.7.11 B 3.7 PLANT SYSTEMS B 3.7.11 Control Room Air Conditioning (CRAC) System BASES BACKGROUND The CRAC System is a subsystem of the Control Room Ventilation System and provides temperature control for the control room during normal operations and accident conditions.
| |
| The CRAC System consists of two independent and redundant trains that provide cooling and heating. Each train consists of an air handling unit, heating coils, humidifier package, instrumentation, and controls to provide for control room temperature control. The air handling unit includes a chilled water coil and a fan. Each chilled water coil is provided with chilled water from an associated liquid chiller or cooling directly from the Essential Service Water (ESW) System. Condenser water for each liquid chiller is taken from a different header of the ESW System.
| |
| The CRAC System is an emergency system, which may also operate during normal unit operations. A single train will provide the required temperature control to maintain the control room 85°F during normal operations and 97°F during accident conditions with the Control Room Emergency Ventilation (CREV) System in the pressurization/cleanup mode. The CRAC System operation in maintaining the control room temperature is discussed in the UFSAR, Section 9.10 (Ref. 1).
| |
| APPLICABLE The design basis of the CRAC System is to maintain the control room SAFETY temperature for 30 days of continuous occupancy.
| |
| ANALYSES The CRAC System components are arranged in redundant, safety related trains. During accident conditions with the CREV System in the pressurization/cleanup mode, the CRAC System maintains the temperature 97°F. A single active failure of a component of the CRAC System, with a loss of offsite power, does not impair the ability of the system to perform its design function. Redundant detectors and controls are provided for control room temperature control. The CRAC System is analyzed in accordance with Seismic Category I requirements. The CRAC System is capable of removing sensible and latent heat loads from the control room, which include consideration of equipment heat loads and personnel occupancy requirements, to ensure equipment OPERABILITY.
| |
| The CRAC System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| Cook Nuclear Plant Unit 2 B 3.7.11-1 Revision No. 0
| |
| | |
| CRAC System B 3.7.11 BASES LCO Two independent and redundant trains of the CRAC System are required to be OPERABLE to ensure that at least one is available, assuming a single failure disabling the other train. Total system failure could result in the equipment operating temperature exceeding limits in the event of an accident.
| |
| The CRAC System is considered to be OPERABLE when the individual components necessary to maintain the control room temperature within its maximum limit are OPERABLE in both trains. These components include the cooling coils (cooled by either the Chilled Water System or, if the Ultimate Heat Sink temperature is 65°F, the ESW System) and associated temperature control instrumentation. In addition, the CRAC System must be OPERABLE to the extent that air circulation can be maintained.
| |
| APPLICABILITY In MODES 1, 2, 3, and 4, and during movement of irradiated fuel assemblies in the containment and auxiliary building, the CRAC System must be OPERABLE to ensure that the control room temperature will not exceed equipment operational requirements following isolation of the control room.
| |
| In MODE 5 or 6, the CRAC System is not required for the mitigation of a postulated event.
| |
| ACTIONS A.1 With one CRAC train inoperable, action must be taken to restore OPERABLE status within 30 days. In this condition, the remaining OPERABLE CRAC train is adequate to maintain the control room temperature within limits. However, the overall reliability is reduced because a single failure in the OPERABLE CRAC train could result in loss of CRAC System function. The 30 day Completion Time is based on the low probability of an event requiring control room isolation, and the consideration that the remaining train can provide the required protection.
| |
| B.1 and B.2 In MODE 1, 2, 3, or 4, if the inoperable CRAC train cannot be restored to OPERABLE status within the required Completion Time of Condition A, the unit must be placed in a MODE that minimizes the risk. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours, and in MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| Cook Nuclear Plant Unit 2 B 3.7.11-2 Revision No. 0
| |
| | |
| CRAC System B 3.7.11 BASES ACTIONS (continued)
| |
| C.1 and C.2 During movement of irradiated fuel, if the inoperable CRAC train cannot be restored to OPERABLE status within the required Completion Time, the OPERABLE CRAC train must be placed in operation immediately.
| |
| This action ensures that the remaining train is OPERABLE, that no failures preventing automatic actuation will occur, and that active failures will be readily detected.
| |
| An alternative to Required Action C.1 is to immediately suspend activities that present a potential for releasing radioactivity that might require isolation of the control room (Required Action C.2). This places the unit in a condition that minimizes accident risk. This does not preclude the movement of fuel to a safe position.
| |
| D.1 During movement of irradiated fuel assemblies, with two CRAC trains inoperable, action must be taken immediately to suspend activities that could result in a release of radioactivity that might require isolation of the control room. This places the unit in a condition that minimizes risk. This does not preclude the movement of fuel to a safe position.
| |
| E.1 If both CRAC trains are inoperable in MODE 1, 2, 3, or 4, the CRAC System may not be capable of performing its intended function.
| |
| Therefore, LCO 3.0.3 must be entered immediately.
| |
| SURVEILLANCE SR 3.7.11.1 and SR 3.7.11.2 REQUIREMENTS These SRs verify that the heat removal capability of each CRAC train is sufficient to maintain control room air temperature 85°F. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 9.10.
| |
| Cook Nuclear Plant Unit 2 B 3.7.11-3 Revision No. 60
| |
| | |
| ESF Ventilation System B 3.7.12 B 3.7 PLANT SYSTEMS B 3.7.12 Engineered Safety Features (ESF) Ventilation System BASES BACKGROUND The ESF Ventilation System filters air from the enclosures for the ESF equipment (containment spray pump, residual heat removal (RHR) pump, safety injection pump, RHR heat exchanger, containment spray heat exchanger, and reciprocating and centrifugal charging pump enclosures) during normal operation, transients, and accidents. The ESF Ventilation System, in conjunction with other systems, also provides adequate cooling in the ESF enclosure areas.
| |
| The ESF Ventilation System consists of two independent and redundant trains. Each train consists of a roll media roughing filter, a high efficiency particulate air (HEPA) filter, an activated charcoal adsorber section for removal of gaseous activity (principally iodines), and a fan. Ductwork, valves or dampers, and instrumentation also form part of the system.
| |
| The design of each train includes a bypass of the charcoal adsorber section. There are two independent air operated, fail-closed, dampers in the charcoal adsorber section bypass. These dampers are arranged in parallel. Normally, one train is in operation, directing the exhaust air through the roughing and HEPA filters, bypassing the charcoal adsorber section, and discharging it to the unit vent, while the other train is in standby. In the event of a Phase B isolation (Containment Pressure - High High) signal: a) for the standby train, the fan automatically starts (via a containment spray pump closed breaker signal); and b) for both the operating and standby trains, the charcoal adsorber section bypasses are automatically closed and the air is directed through the charcoal adsorber section in addition to the roughing and HEPA filters. The standby train also starts on any train related ESF system pump start signal, or upon receipt of a Safety Injection signal.
| |
| The roughing filters remove any large particles in the air, and any entrained water droplets present, to prevent excessive loading of the HEPA filters and charcoal adsorbers.
| |
| The ESF Ventilation System is discussed in UFSAR, Section 9.9.3.1 (Ref. 1).
| |
| APPLICABLE The design basis of the ESF Ventilation System is established by the SAFETY large break LOCA. The system evaluation assumes leakage from the ANALYSES Emergency Core Cooling System (ECCS) and Containment Spray System components during the recirculation mode. The system is indirectly credited in dose consequence analyses and will assist in limiting radioactive release to within the 10 CFR 50.67 (Ref. 2) limits and to 5 rem total effective dose equivalent (TEDE) for control room operators (Ref. 3).
| |
| Cook Nuclear Plant Unit 2 B 3.7.12-1 Revision No. 71
| |
| | |
| ESF Ventilation System B 3.7.12 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| The analysis of the effects and consequences of a large break LOCA is presented in Reference 4.
| |
| The ESF Ventilation System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO Two independent and redundant trains of the ESF Ventilation System are required to be OPERABLE to ensure that at least one is available, assuming that a single failure disables the other train coincident with loss of offsite power. Total system failure could result in the atmospheric release from the ESF enclosure areas exceeding 10 CFR 50.67 limits in the event of a Design Basis Accident (DBA), based on the capability of the ESF fan charcoal filters to correct for ECCS recirculation leakage.
| |
| ESF Ventilation System is considered OPERABLE when the individual components necessary to maintain the ESF enclosure areas filtration are OPERABLE in both trains.
| |
| An ESF Ventilation System train is considered OPERABLE when its associated:
| |
| : a. Fan is OPERABLE;
| |
| : b. HEPA filter and charcoal adsorbers are not excessively restricting flow, and are capable of performing their filtration functions; and
| |
| : c. Ductwork, valves, and dampers are OPERABLE and air flow can be maintained.
| |
| In addition, a train is allowed to be operating since, if a loss of power occurs, it will automatically restart when power is restored.
| |
| The LCO is modified by a Note allowing the ESF enclosure boundary to be opened intermittently under administrative controls. For entry and exit through doors, the administrative control of the opening is performed by the person(s) entering or exiting the area. For other openings, these controls consist of stationing a dedicated individual at the opening who is in continuous communication with the control room. This individual will have a method to rapidly close the opening when a need for ESF enclosure isolation is indicated.
| |
| APPLICABILITY In MODES 1, 2, 3, and 4, the ESF Ventilation System is required to be OPERABLE consistent with the OPERABILITY requirements of the ECCS.
| |
| In MODE 5 or 6, the ESF Ventilation System is not required to be OPERABLE since the ECCS is not required to be OPERABLE.
| |
| Cook Nuclear Plant Unit 2 B 3.7.12-2 Revision No. 71
| |
| | |
| ESF Ventilation System B 3.7.12 BASES ACTIONS A.1 With one ESF Ventilation train inoperable, action must be taken to restore OPERABLE status within 7 days. During this time, the remaining OPERABLE train is adequate to perform the ESF Ventilation System function.
| |
| The 7 day Completion Time is appropriate because the risk contribution is less than that for the ECCS (72 hour Completion Time), and this system is not a direct support system for the ECCS. The 7 day Completion Time is based on the low probability of a DBA occurring during this time period, and ability of the remaining train to provide the required capability.
| |
| B.1 If the ESF enclosure boundary is inoperable, the ESF Ventilation trains cannot perform their intended functions. Actions must be taken to restore an OPERABLE ESF enclosure boundary within 24 hours. During the period that the ESF enclosure boundary is inoperable, appropriate compensatory measures consistent with the intent, as applicable, of GDC 19, 60, 64 and 10 CFR 50.67 should be utilized to protect plant personnel from potential hazards. Preplanned measures should be available to address these concerns for intentional and unintentional entry into the condition. The 24 hour Completion Time is reasonable based on the low probability of a DBA occurring during this time period, and the use of compensatory measures. The 24 hour Completion Time is a typically reasonable time to diagnose, plan and possibly repair, and test most problems with the ESF enclosure boundary.
| |
| C.1 and C.2 If the ESF Ventilation train or ESF enclosure boundary cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours, and in MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| SURVEILLANCE SR 3.7.12.1 REQUIREMENTS Standby systems should be checked periodically to ensure that they function properly. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Cook Nuclear Plant Unit 2 B 3.7.12-3 Revision No. 60
| |
| | |
| ESF Ventilation System B 3.7.12 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.7.12.2 This SR verifies that the required ESF Ventilation System testing is performed in accordance with the Ventilation Filter Testing Program (VFTP). The VFTP includes testing HEPA filter performance, charcoal adsorbers efficiency, minimum and maximum system flow rate, and the physical properties of the activated charcoal (general use and following specific operations). Specific test Frequencies and additional information are discussed in detail in the VFTP.
| |
| SR 3.7.12.3 This SR verifies that each ESF Ventilation train starts and operates on an actual or simulated actuation signal. The SR excludes automatic dampers and valves that are locked, sealed, or otherwise secured in the actuated position. The SR does not apply to dampers or valves that are locked, sealed, or otherwise secured in the actuated position since the affected dampers or valves were verified to be in the actuated position prior to being locked, sealed or otherwise secured. Placing an automatic valve or damper in a locked, sealed, or otherwise secured position requires an assessment of the operability of the system or any supported systems, including whether it is necessary for the valve or damper to be repositioned to the non-actuated position to support the accident analysis.
| |
| Restoration of an automatic valve or damper to the non-actuated position requires verification that the SR has been met within its required Frequency.
| |
| One ESF Ventilation train is normally operating with flow bypassing the charcoal adsorber section. This test confirms that each train, when in standby, starts upon receipt of a Containment Pressure - High High signal and that the exhaust flow can be directed through the entire filter unit including the HEPA filter and charcoal adsorber section. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.7.12.4 This SR verifies the integrity of the ESF enclosure. The ability of the ESF enclosure to maintain a negative pressure, with respect to potentially uncontaminated adjacent areas, is periodically tested to verify proper functioning of the ESF Ventilation System. During the post accident mode of operation, the ESF Ventilation System is designed to maintain a slight negative pressure in the ESF enclosure, with respect to adjacent areas, at a flowrate 22,500 cfm to prevent unfiltered leakage. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Cook Nuclear Plant Unit 2 B 3.7.12-4 Revision No. 83
| |
| | |
| ESF Ventilation System B 3.7.12 BASES REFERENCES 1. UFSAR, Section 9.9.3.1.
| |
| : 2. 10 CFR 50.67.
| |
| : 3. 10 CFR 50, Appendix A, GDC 19.
| |
| : 4. UFSAR, Section 14.3.5.5.
| |
| Cook Nuclear Plant Unit 2 B 3.7.12-5 Revision No. 59
| |
| | |
| FHAEV System B 3.7.13 B 3.7 PLANT SYSTEMS B 3.7.13 Fuel Handling Area Exhaust Ventilation (FHAEV) System BASES BACKGROUND The FHAEV System filters airborne radioactive particulates from the area of the fuel pool following a fuel handling accident. The FHAEV System, in conjunction with other normally operating systems, also provides environmental control of temperature and humidity in the fuel pool area.
| |
| The FHAEV System is a common Unit 1 and Unit 2 system and consists of two trains sharing a common filter unit but with redundant fans. One train is in operation during the movement of irradiated fuel assemblies in the auxiliary building. Each fan can draw air through a common slot exhaust plenum along the north side of the spent fuel pool to direct it through a common filter housing and discharge it to the Unit 1 vent. The filter housing consists of a roll media roughing filter, a high efficiency particulate air (HEPA) filter, and an activated charcoal adsorber section for removal of gaseous activity (principally iodines). There is a normally open bypass on the charcoal adsorber section, however during the movement of irradiated fuel assemblies within the storage pool each damper must be closed. The Fuel Handling Area Supply Air System is made up of four supply units composed of fans, filters, and steam coils.
| |
| Normally, all four supply units are in operation, drawing outside air through the steam coils and filters and discharging it into the fuel handling area. The FHAEV System fans draw the air through the fuel handling area into the exhaust plenum and through the FHAEV System filter train.
| |
| The combined capacity of the four supply units is less than that of a single FHAEV System fan, thus the fuel handling area, as well as the entire space within the auxiliary building pressure boundary, are maintained at a slightly negative pressure. Ductwork, valves or dampers, and instrumentation also form part of the system. Upon receipt of a Fuel Handling Area Radiation - High signal the fuel handling area supply fans are tripped, thus ensuring a negative pressure within the space. The charcoal adsorber section bypass dampers also receive a close signal upon receipt of Fuel Handling Area Radiation - High signal (however, these dampers are maintained closed when the required FHAEV train is in operation).
| |
| The FHAEV is discussed in the UFSAR, Sections 9.9.3.2 and 14.2.1 (Refs. 1 and 2, respectively).
| |
| Cook Nuclear Plant Unit 2 B 3.7.13-1 Revision No. 0
| |
| | |
| FHAEV System B 3.7.13 BASES APPLICABLE The FHAEV System design basis is established by the consequences of SAFETY the limiting Design Basis Accident (DBA), which is a fuel handling ANALYSES accident. The analysis of the fuel handling accident, given in Reference 2, assumes that all fuel rods in an assembly are damaged.
| |
| The DBA analysis of the fuel handling accident assumes that only one train of the FHAEV System is operating and the exhaust flow is directed through the charcoal adsorber section and the Fuel Handling Area Supply Air System fans are automatically shutdown upon receipt of a Fuel Handling Area Radiation - High signal. The amount of fission products available for release from the auxiliary building is determined for a fuel handling accident. These assumptions and the analysis follow the guidance discussed in the UFSAR (Ref. 2).
| |
| The FHAEV System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO One train of the FHAEV System is required to be OPERABLE and in operation. The required FHAEV train is in operation when one fan is operating and all charcoal adsorber section bypass dampers are closed and inlet dampers are open. Total system failure could result in the atmospheric release from the fuel handling building exceeding the 10 CFR 50.67 (Ref. 3) limits in the event of a fuel handling accident.
| |
| The FHAEV train is considered OPERABLE when the individual components necessary to control exposure in the auxiliary building are OPERABLE. Thus, the required FHAEV train is considered OPERABLE when its associated:
| |
| : a. Fan is OPERABLE;
| |
| : b. HEPA filter and charcoal adsorber are not excessively restricting flow, and are capable of performing their filtration function;
| |
| : c. Ductwork, valves, and dampers are OPERABLE, and air flow can be maintained; and
| |
| : d. Fuel Handling Area Supply Air System fans must be capable of being stopped upon receipt of a Fuel Handling Area Radiation - High signal.
| |
| The LCO is modified by a Note allowing the auxiliary building boundary to be opened intermittently under administrative controls. For entry and exit through doors the administrative control of the opening is performed by the person(s) entering or exiting the area. For other openings, these controls consist of stationing a dedicated individual at the opening who is in continuous communication with the control room. This individual will have a method to rapidly close the opening when a need for auxiliary building isolation is indicated.
| |
| Cook Nuclear Plant Unit 2 B 3.7.13-2 Revision No. 59
| |
| | |
| FHAEV System B 3.7.13 BASES APPLICABILITY During movement of irradiated fuel in the auxiliary building, the FHAEV System is required to be OPERABLE to alleviate the consequences of a fuel handling accident.
| |
| In MODE 1, 2, 3, 4, 5, or 6, the FHAEV System is not required to be OPERABLE since the FHAEV System is only credited during a fuel handling accident in the auxiliary building.
| |
| ACTIONS LCO 3.0.3 is not applicable while in MODE 5 or 6. However, since irradiated fuel assembly movement can occur in MODE 1, 2, 3, or 4, the ACTIONS have been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 5 or 6, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1, 2, 3, or 4, the fuel movement is independent of reactor operations. Entering LCO 3.0.3, while in MODE 1, 2, 3, or 4 would require the unit to be shutdown unnecessarily.
| |
| A.1 When the required FHAEV train is inoperable or not in operation during movement of irradiated fuel assemblies in the auxiliary building, action must be taken to place the unit in a condition in which the LCO does not apply. Action must be taken immediately to suspend movement of irradiated fuel assemblies in the auxiliary building. This does not preclude the movement of fuel to a safe position.
| |
| SURVEILLANCE SR 3.7.13.1 REQUIREMENTS This SR requires verification that the required FHAEV train is operating with flow through the filter unit, including the HEPA filter and charcoal adsorber section. Verification includes fan status and also verifies that each charcoal bypass damper is closed. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.7.13.2 Standby systems should be checked periodically to ensure that they function properly. As the environmental and normal operating conditions on this system are not severe, testing each train provides an adequate check on this system.
| |
| Operating the required FHAEV train, with flow through the HEPA filter and charcoal adsorber train, for 15 minutes demonstrates the function of the system. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Cook Nuclear Plant Unit 2 B 3.7.13-3 Revision No. 60
| |
| | |
| FHAEV System B 3.7.13 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.7.13.3 This SR verifies that the required FHAEV System testing is performed in accordance with the Ventilation Filter Testing Program (VFTP). The VFTP includes testing HEPA filter performance, charcoal adsorber efficiency, minimum and maximum system flow rate, and the physical properties of the activated charcoal (general use and following specific operations). Specific test frequencies and additional information are discussed in detail in the VFTP.
| |
| SR 3.7.13.4 This SR verifies that the required FHAEV train actuates on an actual or simulated actuation signal. The SR excludes automatic dampers and valves that are locked, sealed, or otherwise secured in the actuated position. The SR does not apply to dampers or valves that are locked, sealed, or otherwise secured in the actuated position since the affected dampers or valves were verified to be in the actuated position prior to being locked, sealed or otherwise secured. Placing an automatic valve or damper in a locked, sealed, or otherwise secured position requires an assessment of the operability of the system or any supported systems, including whether it is necessary for the valve or damper to be repositioned to the non-actuated position to support the accident analysis. Restoration of an automatic valve or damper to the non-actuated position requires verification that the SR has been met within its required Frequency.
| |
| The test must verify that the signal automatically shuts down each of the Fuel Handling Area Supply Air System fans. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.7.13.5 This SR verifies the integrity of the auxiliary building enclosure. The ability of the pool storage area to maintain negative pressure with respect to potentially uncontaminated adjacent areas is periodically tested to verify proper function of the FHAEV train. During the accident mode of operation, the FHAEV train is designed to maintain a slight negative pressure in the FHAEV train, to prevent unfiltered leakage. The FHAEV train is designed to maintain a pressure 0.125 inches of vacuum water gauge with respect to atmospheric pressure at a flow rate of 27,000 cfm. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Cook Nuclear Plant Unit 2 B 3.7.13-4 Revision No. 83
| |
| | |
| FHAEV System B 3.7.13 BASES REFERENCES 1. UFSAR, Section 9.9.3.2.
| |
| : 2. UFSAR, Section 14.2.1.
| |
| : 3. 10 CFR 50.67.
| |
| Cook Nuclear Plant Unit 2 B 3.7.13-5 Revision No. 83
| |
| | |
| Fuel Storage Pool Water Level B 3.7.14 B 3.7 PLANT SYSTEMS B 3.7.14 Fuel Storage Pool Water Level BASES BACKGROUND The minimum water level in the fuel storage pool meets the assumptions of iodine decontamination factors following a fuel handling accident. The specified water level shields and minimizes the general area dose when the storage racks are filled to their maximum capacity. The water also provides shielding during the movement of spent fuel.
| |
| A general description of the fuel storage pool design is given in the UFSAR, Section 9.7.2 (Ref. 1). A description of the Spent Fuel Pool Cooling System is given in the UFSAR, Section 9.4 (Ref. 2). The assumptions of the fuel handling accident are given in the UFSAR, Section 14.2.1 (Ref. 3).
| |
| APPLICABLE The minimum water level in the fuel storage pool meets the SAFETY assumptions of the fuel handling accident described in the UFSAR ANALYSES (Ref. 3). The resultant 2 hour dose per person at the exclusion area boundary is less than the 10 CFR 50.67 (Ref. 4) limits.
| |
| According to Reference 3, there is 23 ft of water above the top of the damaged fuel bundle during a fuel handling accident. With 23 ft of water, the assumptions discussed in Reference 3 can be used directly. In practice, this LCO preserves this assumption for the bulk of the fuel in the storage racks. In the case of a single bundle dropped and lying horizontally on top of the spent fuel racks, however, there may be < 23 ft of water above the top of the fuel bundle (due to the width of the bundle).
| |
| To offset this small nonconservatism, the analysis assumes that all fuel rods fail, although analysis shows that only the first few rows fail from a hypothetical maximum drop.
| |
| The Fuel Storage Pool Water Level satisfies Criteria 2 and 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The fuel storage pool water level is required to be 23 ft over the top of irradiated fuel assemblies seated in the storage racks. The specified water level preserves the assumptions of the fuel handling accident analysis (Ref. 3). As such, it is the minimum required for movement within the fuel storage pool.
| |
| APPLICABILITY This LCO applies during movement of irradiated fuel assemblies in the fuel storage pool, since the potential for a release of fission products exists.
| |
| Cook Nuclear Plant Unit 2 B 3.7.14-1 Revision No. 59
| |
| | |
| Fuel Storage Pool Water Level B 3.7.14 BASES ACTIONS A.1 When the initial conditions for prevention of an accident cannot be met, steps should be taken to preclude the accident from occurring. When the fuel storage pool water level is lower than the required level, the movement of irradiated fuel assemblies in the fuel storage pool is immediately suspended to a safe position. This action effectively precludes the occurrence of a fuel handling accident. This does not preclude movement of a fuel assembly to a safe position.
| |
| Required Action A.1 is modified by a Note indicating that LCO 3.0.3 does not apply. If moving irradiated fuel assemblies while in MODE 5 or 6, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODES 1, 2, 3, and 4, the fuel movement is independent of reactor operations. Therefore, inability to suspend movement of irradiated fuel assemblies is not sufficient reason to require a reactor shutdown.
| |
| SURVEILLANCE SR 3.7.14.1 REQUIREMENTS This SR verifies sufficient fuel storage pool water is available in the event of a fuel handling accident. The water level in the fuel storage pool must be checked periodically. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 9.7.2.
| |
| : 2. UFSAR, Section 9.4.
| |
| : 3. UFSAR, Section 14.2.1.
| |
| : 4. 10 CFR 50.67.
| |
| Cook Nuclear Plant Unit 2 B 3.7.14-2 Revision No. 60
| |
| | |
| Fuel Storage Pool Boron Concentration B 3.7.15 B 3.7 PLANT SYSTEMS B 3.7.15 Fuel Storage Pool Boron Concentration BASES BACKGROUND The fuel storage pool is shared by Unit 1 and Unit 2, and is described in the Bases for LCO 3.7.16, "Spent Fuel Pool Storage."
| |
| The water in the spent fuel storage pool normally contains soluble boron, which would result in large subcriticality margins under actual operating conditions. However, the NRC guidelines, based upon the accident condition in which all soluble poison is assumed to have been lost, specify that the limiting keff of 0.95 for normal storage be evaluated in the absence of soluble boron. Hence, the design of all regions is based on the use of unborated water, which maintains each region in a subcritical condition for the allowed loading patterns. The double contingency principle discussed in ANSI N-16.1-1975 and the April 1978 NRC letter (Ref. 1) allows credit for soluble boron under other abnormal or accident conditions, since only a single independent accident need be considered at one time. For example, the only accident scenario that has a potential for more than negligible positive reactivity effect is an inadvertent misplacement of a new fuel assembly. This accident has the potential for exceeding the limiting reactivity, should there be a concurrent and independent accident condition resulting in the loss of all soluble poison.
| |
| To prevent these postulated criticality related accidents, boron is dissolved in the pool water. Safe operation with no movement of assemblies may therefore be achieved by controlling the location of each assembly in accordance with LCO 3.7.16, "Spent Fuel Pool Storage."
| |
| Prior to movement of an assembly, it is necessary to perform SR 3.7.16.1.
| |
| APPLICABLE Although credit for the soluble boron normally present in the spent fuel SAFETY pool water is permitted under abnormal or accident conditions, most ANALYSES abnormal or accident conditions will not result in exceeding the limiting reactivity even in the absence of soluble boron. The effects on reactivity of credible abnormal and accident conditions due to temperature increase, boiling, assembly dropped on top of a rack, lateral rack module movement and misplacement of a fuel assembly have been analyzed. Of these abnormal or accident conditions, only the inadvertent misplacement of a fresh fuel assembly has the potential for exceeding the limiting reactivity, should there be a concurrent and independent accident condition resulting in the loss of all soluble boron. The largest reactivity increase would occur if a new fuel assembly of 4.95% enrichment were to be positioned in a location designated as empty in the checkerboard pattern shown in Figure 4.3-2 with the remainder of the fuel rack fully loaded with fuel of the highest permissible reactivity (Ref. 2).
| |
| Cook Nuclear Plant Unit 2 B 3.7.15-1 Revision No. 24
| |
| | |
| Fuel Storage Pool Boron Concentration B 3.7.15 BASES APPLICABLE SAFETY ANALSYSES (continued)
| |
| The concentration of dissolved boron in the fuel storage pool satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The fuel storage pool boron concentration is required to be 2400 ppm.
| |
| The specified concentration of dissolved boron in the fuel storage pool preserves the assumptions used in the analyses of the potential critical accident scenarios as described in Reference 2. This concentration of dissolved boron is the minimum required concentration for fuel assembly storage and movement within the fuel storage pool.
| |
| APPLICABILITY This LCO applies whenever fuel assemblies are stored in the spent fuel storage pool, until a complete spent fuel storage pool verification has been performed following the last movement of fuel assemblies in the spent fuel storage pool. This LCO does not apply following the verification, since the verification would confirm that there are no misloaded fuel assemblies. With no further fuel assembly movements in progress, there is no potential for a misloaded fuel assembly or a dropped fuel assembly.
| |
| ACTIONS A.1, A.2.1, and A.2.2 When the concentration of boron in the fuel storage pool is less than required, immediate action must be taken to preclude the occurrence of an accident or to mitigate the consequences of an accident in progress.
| |
| This is most efficiently achieved by immediately suspending the movement of fuel assemblies. The initiation of action to restore the concentration of boron to within limit occurs simultaneously with suspending movement of fuel assemblies. Alternatively, beginning a verification of the fuel storage pool fuel locations, to ensure proper locations of the fuel, can be performed. However, prior to resuming movement of fuel assemblies, the concentration of boron must be restored. This does not preclude movement of a fuel assembly to a safe position.
| |
| The Required Actions are modified by a Note indicating that LCO 3.0.3 does not apply. If the LCO is not met while moving irradiated fuel assemblies in MODE 5 or 6, LCO 3.0.3 would not be applicable. If moving irradiated fuel assemblies while in MODE 1, 2, 3, or 4, the fuel movement is independent of reactor operation. Therefore, inability to suspend movement of fuel assemblies is not sufficient reason to require a reactor shutdown.
| |
| SURVEILLANCE SR 3.7.15.1 REQUIREMENTS This SR verifies that the concentration of boron in the fuel storage pool is within the required limit. As long as this SR is met, the analyzed Cook Nuclear Plant Unit 2 B 3.7.15-2 Revision No. 24
| |
| | |
| Fuel Storage Pool Boron Concentration B 3.7.15 BASES SURVEILLANCE REQUIREMENTS (continued) accidents are fully addressed. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. Double contingency principle of ANSI N16.1-1975, as specified in the April 14, 1978 NRC letter (Section 1.2) and implied in the proposed revision to Regulatory Guide 1.13 (Section 1.4, Appendix A).
| |
| : 2. UFSAR, Section 9.7.2.
| |
| Cook Nuclear Plant Unit 2 B 3.7.15-3 Revision No. 60
| |
| | |
| Spent Fuel Pool Storage B 3.7.16 B 3.7 PLANT SYSTEMS B 3.7.16 Spent Fuel Pool Storage BASES BACKGROUND The spent fuel storage pool is shared by Unit 1 and Unit 2. The high density spent fuel storage racks are divided into three separate and distinct regions. Region 1 is designed to accommodate new fuel with a maximum enrichment of 4.95 weight percent U-235, or spent fuel regardless of the discharge fuel burnup. Region 2 is designed to accommodate high burnup fuel. Region 3 is designed to accommodate intermediate burnup fuel. This information pertains to Figure 4.3-1, Normal Storage Pattern. Figure 4.3-2, Interim Storage Pattern, shows the number of storage positions when checkerboarding is used. Fuel assemblies not meeting the criteria of Table 3.7.16-1 shall be stored in accordance with Specification 4.3.1.1 in Section 4.3, "Fuel Storage."
| |
| The water in the spent fuel storage pool normally contains soluble boron, which would result in large subcriticality margins under actual operating conditions. However, the NRC guidelines, based upon the accident condition in which all soluble poison is assumed to have been lost, specify that the limiting keff of 0.95 for normal storage be evaluated in the absence of soluble boron. Hence, the design of all regions is based on the use of unborated water, which maintains each region in a subcritical condition for the allowed loading patterns. The double contingency principle discussed in ANSI N-16.1-1975 and the April 1978 NRC letter (Ref. 1) allows credit for soluble boron under other abnormal or accident conditions, since only a single independent accident need be considered at one time. For example, the only accident scenario that has a potential for more than negligible positive reactivity effect is an inadvertent misplacement of a new fuel assembly. This accident has the potential for exceeding the limiting reactivity, should there be a concurrent and independent accident condition resulting in the loss of all soluble poison.
| |
| To prevent these postulated criticality related accidents, boron is dissolved in the pool water. Safe operation with no movement of assemblies may therefore be achieved by controlling the location of each assembly in accordance with the accompanying LCO. Prior to movement of an assembly, it is necessary to perform SR 3.7.16.1.
| |
| APPLICABLE The hypothetical accidents can only take place during or as a result of the SAFETY movement of an assembly (Ref. 2). For these accident occurrences, the ANALYSES presence of soluble boron in the spent fuel storage pool (controlled by LCO 3.7.15, "Fuel Storage Pool Boron Concentration") prevents criticality in all three regions. By closely controlling the movement of each assembly and by checking the location of each assembly after movement, the time period for potential accidents may be limited to a small fraction of the total operating time. During the remaining time period with no Cook Nuclear Plant Unit 2 B 3.7.16-1 Revision No. 24
| |
| | |
| Spent Fuel Pool Storage B 3.7.16 BASES APPLICABLE SAFETY ANALYSES (continued) potential for accidents, the operation may be under the auspices of the accompanying LCO.
| |
| The configuration of fuel assemblies in the fuel storage pool satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The restrictions on the placement of fuel assemblies within the spent fuel pool, in accordance with Table 3.7.16-1, in the accompanying LCO, ensures the keff of the spent fuel storage pool will always remain 0.95, assuming the pool to be flooded with unborated water. Fuel assemblies not meeting the criteria of Table 3.7.16-1 shall be stored in accordance with Specification 4.3.1.1.
| |
| APPLICABILITY This LCO applies whenever any fuel assembly is stored in Region 2 or 3 of the fuel storage pool.
| |
| ACTIONS A.1 When the configuration of fuel assemblies stored in Region 2 or 3 of the spent fuel storage pool is not in accordance with Table 3.7.16-1 or paragraph 4.3.1.1, the immediate action is to initiate action to make the necessary fuel assembly movement(s) to bring the configuration into compliance with Table 3.7.16-1 or Specification 4.3.1.1.
| |
| Required Action A.1 is modified by a Note indicating that LCO 3.0.3 does not apply. If unable to move irradiated fuel assemblies while in MODE 5 or 6, LCO 3.0.3 would not be applicable. If unable to move irradiated fuel assemblies while in MODE 1, 2, 3, or 4, the action is independent of reactor operation. Therefore, inability to move fuel assemblies is not sufficient reason to require a reactor shutdown.
| |
| SURVEILLANCE SR 3.7.16.1 REQUIREMENTS This SR verifies by administrative means that the initial enrichment and burnup of the fuel assembly is in accordance with Table 3.7.16-1. For fuel assemblies that do not meet the criteria of Table 3.7.16-1, performance of this SR will ensure compliance with Specification 4.3.1.1.
| |
| REFERENCES 1. Double contingency principle of ANSI N16.1-1975, as specified in the April 14, 1978 NRC letter (Section 1.2) and implied in the proposed revision to Regulatory Guide 1.13 (Section 1.4, Appendix A).
| |
| : 2. UFSAR, Section 9.7.2.
| |
| Cook Nuclear Plant Unit 2 B 3.7.16-2 Revision No. 24
| |
| | |
| Secondary Specific Activity B 3.7.17 B 3.7 PLANT SYSTEMS B 3.7.17 Secondary Specific Activity BASES BACKGROUND Activity in the secondary coolant results from steam generator tube outleakage from the Reactor Coolant System (RCS). Under steady state conditions, the activity is primarily iodines with relatively short half lives and, thus, indicates current conditions. During transients, I-131 spikes have been observed as well as increased releases of some noble gases.
| |
| Other fission product isotopes, as well as activated corrosion products in lesser amounts, may also be found in the secondary coolant.
| |
| A limit on secondary coolant specific activity during power operation minimizes releases to the environment because of normal operation, anticipated operational transients, and accidents.
| |
| This limit is lower than the activity value that might be expected from a tube leak allowed by LCO 3.4.13, "RCS Operational LEAKAGE" of primary coolant at the limit of 1.0 µCi/gm (LCO 3.4.16, "RCS Specific Activity"). The steam line failure is assumed to result in the release of the noble gas and iodine activity contained in the steam generator inventory, the feedwater, and the reactor coolant LEAKAGE. Most of the iodine isotopes have short half lives (i.e., < 20 hours).
| |
| Operating a unit at the allowable limits would not allow the 2 hour site boundary exposure or the control room exposure to exceed the 10 CFR 50.67 (Ref. 1) total effective dose equivalent (TEDE) limits.
| |
| APPLICABLE The accident analysis of the main steam line break (MSLB), as SAFETY discussed in the UFSAR, Section 14.2.7 (Ref. 2) assumes the initial ANALYSES secondary coolant specific activity to have a radioactive isotope concentration of 0.10 µCi/gm DOSE EQUIVALENT I-131. This assumption is used in the analysis for determining the radiological consequences of the postulated accident. The accident analysis, based on this and other assumptions, shows that the radiological consequences of an MSLB do not exceed the unit site boundary limits (Ref. 1) for dose and a control room dose limit of 5 rem TEDE (Ref. 1).
| |
| Cook Nuclear Plant Unit 2 B 3.7.17-1 Revision No. 59
| |
| | |
| Secondary Specific Activity B 3.7.17 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| With the loss of offsite power, the remaining steam generators are available for core decay heat dissipation by venting steam to the atmosphere through the main steam safety valves (MSSVs) and steam generator (SG) power operated relief valves (PORVs). The Auxiliary Feedwater System supplies the necessary makeup to the steam generators. Venting continues until the reactor coolant temperature and pressure have decreased sufficiently for the Residual Heat Removal System to complete the cooldown.
| |
| In the evaluation of the radiological consequences of this accident, the activity released from the steam generator connected to the failed steam line is assumed to be released directly to the environment. The unaffected steam generators are assumed to discharge steam and any entrained activity through the MSSVs and SG PORVs during the event.
| |
| Since no credit is taken in the analysis for activity plateout or retention, the resultant radiological consequences represent a conservative estimate of the potential integrated dose due to the postulated steam line failure.
| |
| Secondary Specific Activity limits satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO As indicated in the Applicable Safety Analyses, the specific activity of the secondary coolant is required to be 0.10 µCi/gm DOSE EQUIVALENT I-131 to limit the radiological consequences of a Design Basis Accident (DBA) to less than the required site boundary limit (Ref. 1) and a control room dose limit of 5 rem TEDE (Ref. 1).
| |
| Monitoring the specific activity of the secondary coolant ensures that when secondary specific activity limits are exceeded, appropriate actions are taken in a timely manner to place the unit in an operational MODE that would minimize the radiological consequences of a DBA.
| |
| APPLICABILITY In MODES 1, 2, 3, and 4, the limits on secondary specific activity apply due to the potential for secondary steam releases to the atmosphere.
| |
| In MODES 5 and 6, the steam generators are not being used for heat removal. Both the RCS and steam generators are depressurized, and primary to secondary LEAKAGE is minimal. Therefore, monitoring of secondary specific activity is not required.
| |
| Cook Nuclear Plant Unit 2 B 3.7.17-2 Revision No. 59
| |
| | |
| Secondary Specific Activity B 3.7.17 BASES ACTIONS A.1 and A.2 Specific activity of the secondary coolant exceeding the allowable value is an indication of a problem in the RCS and contributes to increased post accident doses. If the secondary specific activity is not within limits, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours, and in MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| SURVEILLANCE SR 3.7.17.1 REQUIREMENTS This SR verifies that the secondary specific activity is within the limits of the accident analysis. A gamma isotopic analysis of the secondary coolant, which determines DOSE EQUIVALENT I-131, confirms the validity of the safety analysis assumptions as to the source terms in post accident releases. It also serves to identify and trend any unusual isotopic concentrations that might indicate changes in reactor coolant activity or LEAKAGE. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. 10 CFR 50.67.
| |
| : 2. UFSAR, Section 14.2.7.
| |
| Cook Nuclear Plant Unit 2 B 3.7.17-3 Revision No. 60
| |
| | |
| AC Sources - Operating B 3.8.1 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.1 AC Sources - Operating BASES BACKGROUND The unit Class 1E AC Electrical Power Distribution System AC sources consist of the offsite power sources (preferred and alternate), and the onsite standby power sources (Train A and Train B diesel generators (DGs)). As required by Atomic Energy Commission Proposed General Design Criterion 39 (Ref. 1), the design of the AC electrical power system provides independence and redundancy to ensure an available source of power to the Engineered Safety Feature (ESF) systems.
| |
| The onsite Class 1E AC Distribution System is divided into redundant load groups (trains) so that the loss of any one group does not prevent the minimum safety functions from being performed. Each train has connections to a preferred offsite power source, an alternate offsite power source, an auxiliary source (unit auxiliary transformer), and a single DG.
| |
| Additionally, the AC electrical sources must include those electrical sources from Unit 1 that are required to support the Essential Service Water (ESW) System since the ESW headers are common to both units.
| |
| In addition, the AC electrical sources must include those AC electrical sources from Unit 1 during fuel handling operations in the auxiliary building since the Fuel Handling Area Exhaust Ventilation (FHAEV)
| |
| System loads are supplied by Unit 1. The onsite Class 1E AC Distribution System associated with the other unit is also divided into redundant load groups and include the same connections to AC sources.
| |
| The onsite Class 1E AC Distribution System includes Train A and Train B.
| |
| Train A and Train B are normally powered from the main generator. The main generator supplies Train A via unit auxiliary transformer TR2CD and supplies Train B via unit auxiliary transformer TR2AB. The unit auxiliary transformer TR2CD supplies bus 2C, which in turn supplies the onsite Class 1E 4.16 kV emergency bus T21C, a Train A bus. The unit auxiliary transformer TR2CD also supplies bus 2D, which in turn supplies the onsite Class 1E 4.16 kV emergency bus T21D, also a Train A bus. The unit auxiliary transformer TR2AB supplies bus 2A, which in turn supplies the onsite Class 1E 4.16 kV emergency bus T21A, a Train B bus. The unit auxiliary transformer TR2AB also supplies bus 2B, which in turn supplies the onsite Class 1E 4.16 kV emergency bus T21B, also a Train B bus. The preferred qualified offsite circuit is supplied via reserve auxiliary transformers (RAT) TR201CD and TR201AB. The Train A and Train B 4.16 kV emergency buses will automatically transfer to the preferred qualified offsite circuit as a result of a turbine generator trip.
| |
| RATs from the same train of each unit share a 34.5 kV line from the onsite switchyards to the loop enclosure. The line continues Cook Nuclear Plant Unit 2 B 3.8.1-1 Revision No. 13
| |
| | |
| AC Sources - Operating B 3.8.1 BASES BACKGROUND (continued) from the loop enclosure to each RAT by a separate 34.5 kV cable.
| |
| RAT TR201CD supplies the Train A 4.16 kV emergency bus T21C via bus 2C while emergency bus T21D is supplied via bus 2D.
| |
| RAT TR201AB supplies the Train B 4.16 kV emergency bus T21A via bus 2A while emergency bus T21B is supplied via bus 2B. A 69 kV line supplies the alternate qualified offsite circuit that consists of TR12EP-1 and the cabling, voltage regulators, switches, and breakers to either Train A 4.16 kV emergency buses T21C and T21D or Train B 4.16 kV emergency buses T21A and T21B. The 69 kV line feeds transformer TR12EP-1 which can be manually aligned to directly supply Train A 4.16 kV emergency buses T21C and T21D or Train B 4.16 kV emergency buses T21A and T21B. The qualified offsite circuits are physically independent from one another. A detailed description of the offsite power network and the circuits to the Class 1E emergency buses is found in the UFSAR, Section 8.3 (Ref. 2).
| |
| A qualified offsite circuit consists of all breakers, transformers, switches, interrupting devices, cabling, and controls required to transmit power from the offsite transmission network to the onsite Class 1E emergency buses.
| |
| The LCO section provides a description of the required components that comprise the qualified offsite circuits.
| |
| Certain required unit loads are returned to service in a predetermined sequence in order to prevent overloading the transformer supplying offsite power to the onsite Class 1E Electrical Power Distribution System. Within approximately 40 seconds after the initiating signal is received, all permanently connected loads and auto-connected loads, via individual time delay relays, needed to recover the unit or maintain it in a safe condition are returned to service.
| |
| The onsite standby power source for each ESF train is a dedicated DG.
| |
| DG 2-CD is dedicated to emergency buses T21C and T21D. DG 2-AB is dedicated to emergency buses T21A and T21B. A DG starts automatically on an ESF actuation signal, specifically a safety injection (SI) signal (i.e.,
| |
| Pressurizer Pressure - Low, Containment Pressure - High, Steam Line Pressure - Low, or Steam Line Pressure - High Differential Pressure Between Steam Lines signal) or on a Loss of Voltage signal (refer to LCO 3.3.5, "Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation"). After the DG has started, it will automatically tie to its respective buses after offsite power is tripped as a consequence of emergency bus undervoltage or degraded voltage, independent of or coincident with an SI signal. The DGs will also start and operate in the standby mode without tying to the emergency bus on an SI signal alone.
| |
| Following the trip of offsite power, an undervoltage signal strips nonpermanent loads from the emergency bus. When the DG is tied to the Cook Nuclear Plant Unit 2 B 3.8.1-2 Revision No. 27
| |
| | |
| AC Sources - Operating B 3.8.1 BASES BACKGROUND (continued) emergency bus, loads are then sequentially connected to their respective emergency bus by the individual time delay relays. The individual time delay relays control the permissive and starting signals to motor breakers to prevent overloading the DG by automatic load application.
| |
| In the event of a loss of preferred power, the ESF electrical loads are automatically connected to the DGs in sufficient time to provide for safe reactor shutdown and to mitigate the consequences of a Design Basis Accident (DBA) such as a loss of coolant accident (LOCA).
| |
| Certain required unit loads are returned to service in a predetermined sequence in order to prevent overloading the DG in the process. Within approximately 1 minute after the initiating signal is received, all loads needed to recover the unit or maintain it in a safe condition are returned to service.
| |
| The continuous service rating of each DG is 3500 kW. The DGs were originally purchased with a 2 hour duration 10% overload capability.
| |
| However, this additional margin is currently not tested or credited in the accident analysis. During Surveillance testing, there may be overshoots or short-term perturbations above 3500 kW. The overload rating is included to account for these anomalies. The ESF loads that are powered from the 4.16 kV emergency buses are listed in Reference 4.
| |
| Each DG has its own starting air system consisting of two redundant starting air trains. Each train has one start receiver that normally contains sufficient air for two EDG start sequences. One start sequence includes a 10 second continuous crank and the second start sequence includes an actual run of the DG. The energy used for the first start sequence is greater than that required for the DG run sequence. Also each DG has its own day tank and fuel oil transfer system. The fuel oil transfer system, which includes two transfer pumps, is capable of transferring fuel oil from the associated fuel oil storage tank to the day tank. Each transfer pump is capable of maintaining the level in the day tank when the associated DG is operating at full load.
| |
| An independent onsite standby AC power source consisting of two supplemental diesel generators (SDGs) is provided to automatically supply power to 4.16 kV bus 1, the EP bus, which is normally supplied by the 69 kV alternate qualified offsite circuit and can be manually aligned to directly supply the 4.16 kV emergency buses. The SDGs are used to support extended Completion Times in the event of an inoperable DG.
| |
| Cook Nuclear Plant Unit 2 B 3.8.1-3 Revision No. 4
| |
| | |
| AC Sources - Operating B 3.8.1 APPLICABLE The initial conditions of DBA and transient analyses in the UFSAR, SAFETY Chapter 14 (Ref. 5), assume ESF systems are OPERABLE. The AC ANALYSES electrical power sources are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor Coolant System (RCS), and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution Limits; Section 3.4, Reactor Coolant System (RCS); and Section 3.6, Containment Systems.
| |
| The OPERABILITY of the AC electrical power sources is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit. This results in maintaining at leastone train of the onsite or offsite AC sources OPERABLE during accident conditions in the event of:
| |
| : a. An assumed loss of all offsite power or all onsite AC power; and
| |
| : b. A worst case single failure.
| |
| AC Sources - Operating satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO Two qualified circuits between the offsite transmission network and the onsite Class 1E Electrical Power Distribution System and separate and independent DGs for each train ensure availability of the required power to shut down the reactor and maintain it in a safe shutdown condition after an anticipated operational transient or a postulated DBA.
| |
| Each offsite circuit must be capable of maintaining rated frequency and voltage, and accepting required loads during an accident, while connected to the emergency buses.
| |
| The preferred qualified offsite circuit consists of RATs TR201CD and TR201AB, the cabling and breakers to 4.16 kV buses 2A, 2B, 2C, and 2D, 4.16 kV buses 2A, 2B, 2C, and 2D, and the cabling and breakers to 4.16 kV emergency buses T21A, T21B, T21C, and T21D.
| |
| The alternate qualified offsite circuit consists of transformer TR12EP-1, the cabling, voltage regulators, and switches to 4.16 kV bus 1, and the cabling, switches, and breakers to either Train A 4.16 kV emergency buses T21C and T21D or Train B 4.16 kV emergency buses T21A and T21B. The alternate qualified offsite circuit is supplied from the 69 kV Bus #2 of the Cook-Thornton Station.
| |
| Each DG must be capable of starting, accelerating to rated speed and voltage, and connecting to its respective emergency bus on detection of bus undervoltage. This will be accomplished within 10 seconds. Each DG must also be capable of accepting required loads within the assumed loading sequence intervals, and continue to operate until offsite power Cook Nuclear Plant Unit 2 B 3.8.1-4 Revision No. 49
| |
| | |
| AC Sources - Operating B 3.8.1 BASES LCO (continued) can be restored to the emergency buses. These capabilities are required to be met from a variety of initial conditions such as DG in standby with the engine hot and DG in standby with the engine at ambient conditions.
| |
| Additional DG capabilities must be demonstrated to meet required Surveillances, e.g., capability of the DG to reject a load equivalent to its associated single largest post-accident load.
| |
| Proper sequencing of loads, including tripping of nonpermanent loads, is a required function for DG OPERABILITY. In addition, day tank fuel oil level, air start receiver pressure (air pressure for one start in one air receiver), and fuel oil transfer system (one of the two fuel oil transfer pumps) requirements must be met for each required DG.
| |
| The AC sources in one train must be separate and independent (to the extent possible) of the AC sources in the other train. For the DGs, separation and independence are complete, except for the fuel oil storage tanks, which are shared between units.
| |
| For the offsite AC sources, separation and independence are to the extent practical. If the main generator is supplying the Class 1E Electrical Power Distribution System, the preferred qualified offsite circuit must be capable of fast transfer to both trains of the Class 1E Electrical Power Distribution System. The alternate qualified offsite circuit must be capable of manual transfer to one train of the Class 1E Electrical Power Distribution System. The qualified preferred or alternate offsite circuit may be connected to more than one ESF train and not violate separation criteria.
| |
| Additionally, the electrical units electrical sources must include electrical sources from the other unit that is required to support the Essential Service Water (ESW) System. When an ESW train is not isolated from Unit 1, the Unit 1 AC sources are required to be OPERABLE and capable of supplying the appropriate Unit 1 Class 1E Distribution subsystems. In this case, at least one Unit 1 qualified circuit shall be OPERABLE. If a Unit 1 qualified circuit is not supplying the appropriate Unit 1 Class 1E Distribution subsystem, then the required Unit 1 preferred qualified circuit must be OPERABLE with the capability to fast transfer to the appropriate Unit 1 Class 1E Distribution subsystem. If both ESW trains are not isolated from Unit 1, then two Unit 1 DGs are required to be OPERABLE. If only one ESW train is isolated from Unit 1, then the Unit 1 DG associated with the un-isolated ESW train must be OPERABLE.
| |
| Cook Nuclear Plant Unit 2 B 3.8.1-5 Revision No. 43
| |
| | |
| AC Sources - Operating B 3.8.1 BASES APPLICABILITY The AC sources are required to be OPERABLE in MODES 1, 2, 3, and 4 to ensure that:
| |
| : a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of anticipated operational transients or abnormal transients; and
| |
| : b. Adequate core cooling is provided and containment OPERABILITY and other vital functions are maintained in the event of a postulated DBA.
| |
| A Note has been added taking exception to the Applicability requirements for the required Unit 1 AC sources in LCO 3.8.1.c and LCO 3.8.1.d provided the associated required equipment is inoperable. This exception is intended to allow declaring the Unit 1 supported equipment inoperable either in lieu of declaring the Unit 1 AC sources inoperable, or at any time subsequent to entering ACTIONS for an inoperable Unit 1 AC Source.
| |
| This exception is acceptable since, with the Unit 1 powered equipment inoperable and the associated ACTIONS entered, the Unit 1 AC sources provide no additional assurance of meeting the above criteria.
| |
| The AC power requirements for MODES 5 and 6 and other conditions in which AC sources are required are covered in LCO 3.8.2, "AC Sources - Shutdown."
| |
| ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable DG.
| |
| There is an increased risk associated with entering a MODE or other specified condition in the Applicability with an inoperable DG and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.
| |
| A.1 To ensure a highly reliable power source remains with one required offsite circuit inoperable, it is necessary to verify the OPERABILITY of the remaining required offsite circuit(s) on a more frequent basis.
| |
| Since the Required Action only specifies "perform," a failure of SR 3.8.1.1 acceptance criteria does not result in a Required Action not met Cook Nuclear Plant Unit 2 B 3.8.1-6 Revision No. 43
| |
| | |
| AC Sources - Operating B 3.8.1 BASES ACTIONS (continued)
| |
| However, if a second required circuit fails SR 3.8.1.1, the second offsite circuit is inoperable, and Condition D, for two offsite circuits inoperable, is entered. As Noted, this Required Action is not applicable if only a required Unit 1 offsite circuit is inoperable.
| |
| A.2 Required Action A.2, which only applies if the train cannot be powered from an offsite source, is intended to provide assurance that an event coincident with a single failure of the associated DG will not result in a complete loss of safety function of critical redundant required features.
| |
| These features are designed with redundant safety related trains. This includes motor driven auxiliary feedwater pumps. Single train systems are normally not included, although, for this Required Action, the turbine driven auxiliary feedwater pump is considered redundant to Trains A and B. Redundant required features failures consist of inoperable features associated with a train, redundant to the train that has no offsite power available.
| |
| The Completion Time for Required Action A.2 is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." In this Required Action, the Completion Time only begins on discovery that both:
| |
| : a. The train has no offsite power supplying its loads; and
| |
| : b. A redundant required feature on another train is inoperable.
| |
| If at any time during the existence of Condition A (one required offsite circuit inoperable) a redundant required feature subsequently becomes inoperable, this Completion Time begins to be tracked.
| |
| Discovering no offsite power to one train of the onsite Class 1E Electrical Power Distribution System or the required Unit 1 onsite Class 1E Electrical Power Distribution System coincident with one or more inoperable required support or supported features, or both, that are associated with another train, results in starting the Completion Times for the Required Action. Twenty-four hours is acceptable because it minimizes risk while allowing time for restoration before subjecting the unit to transients associated with shutdown.
| |
| Cook Nuclear Plant Unit 2 B 3.8.1-7 Revision No. 43
| |
| | |
| AC Sources - Operating B 3.8.1 BASES ACTIONS (continued)
| |
| The remaining required OPERABLE offsite circuits and DGs are adequate to supply electrical power to Train A and Train B of the onsite Class 1E Electrical Power Distribution System and the Unit 1 Class 1E Electrical Power Distribution System when required to be OPERABLE.
| |
| The 24 hour Completion Time takes into account the component OPERABILITY of the redundant counterpart to the inoperable required feature. Additionally, the 24 hour Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.
| |
| A.3 Operation may continue in Condition A for a period that should not exceed 72 hours. With one offsite circuit inoperable, the reliability of the offsite system is degraded, and the potential for a loss of offsite power is increased, with attendant potential for a challenge to the unit safety systems. In this condition, however, the remaining required OPERABLE offsite circuits and DGs are adequate to supply electrical power to the onsite Class 1E Electrical Power Distribution System and the Unit 1 Class 1E Electrical Power Distribution System when required to be OPERABLE.
| |
| The 72 hour Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.
| |
| The second Completion Time for Required Action A.3 establishes a limit on the maximum time allowed for any combination of required AC power sources to be inoperable during any single contiguous occurrence of failing to meet the LCO. If Condition A is entered while, for instance, a DG is inoperable and that DG is subsequently returned OPERABLE, the LCO may already have been not met for up to 14 days. This could lead to a total of 17 days, since initial failure to meet the LCO, to restore the offsite circuit. At this time, a DG could again become inoperable, the circuit restored OPERABLE, and an additional 14 days (for a total of 31 days) allowed prior to complete restoration of the LCO. The 17 day Completion Time provides a limit on the time allowed in a specified condition after discovery of failure to meet LCO 3.8.1.a or b. This limit is Cook Nuclear Plant Unit 2 B 3.8.1-8 Revision No. 43
| |
| | |
| AC Sources - Operating B 3.8.1 BASES ACTIONS (continued) considered reasonable for situations in which Conditions A and B are entered concurrently. The "AND" connector between the 72 hour and 17 day Completion Times means that both Completion Times apply simultaneously, and the more restrictive Completion Time must be met.
| |
| As in Required Action A.2, the Completion Time allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." This will result in establishing the "time zero" at the time that LCO 3.8.1.a or b was initially not met, instead of at the time Condition A was entered.
| |
| B.1 The SDGs must be available in order to extend the Completion Time for an inoperable DG from 72 hours to 14 days. The SDGs shall not be used to extend the Completion Time for more than one inoperable DG (of the four total DGs for both units) at a time. However, since both units may require the same DG to be OPERABLE in accordance with LCO 3.8.1, both units may use the 14 day completion time for this single DG inoperability. SDG mechanical and electrical reliability is demonstrated by performance of periodic testing and inspections during normal operations. Following the initial administrative verification within 1 hour, availability of both SDGs shall be verified at least once every 12 hours.
| |
| Verification of SDG availability requires:
| |
| : 1) verifying that the SDG equipment is mechanically and electrically ready for automatic operation, 2) verifying that the onsite diesel fuel oil supply is sufficient to allow both SDGs to be operated continuously at design load for 24 hours, 3) verifying that the SDGs are aligned to automatically supply power to the 4.16 kV bus 1, which can be manually aligned to directly supply the 4.16 kV emergency buses; and 4) verifying that at least one SDG remote monitoring terminal is active and updating.
| |
| B.2 To ensure a highly reliable power source remains with an inoperable DG, it is necessary to verify the availability of the offsite circuits on a more frequent basis. Since the Required Action only specifies "perform," a failure of SR 3.8.1.1 acceptance criteria does not result in a Required Action being not met. However, if a circuit fails to pass SR 3.8.1.1, it is inoperable. Upon offsite circuit inoperability, additional Conditions and Required Actions must then be entered. As Noted, this Required Action is not applicable if a required Unit 1 DG is inoperable.
| |
| B.3 Required Action B.3 is intended to provide assurance that a loss of offsite Cook Nuclear Plant Unit 2 B 3.8.1-9 Revision No. 41
| |
| | |
| AC Sources - Operating B 3.8.1 BASES ACTIONS (continued) power, during the period that a DG is inoperable, does not result in a complete loss of safety function of critical systems. These features are designed with redundant safety related trains. This includes motor driven auxiliary feedwater pumps. Single train systems are normally not included, although, for this Required Action, the turbine driven auxiliary feedwater pump is considered redundant to Trains A and B. Redundant required feature failures consist of inoperable features associated with a train, redundant to the train that has an inoperable DG.
| |
| The Completion Time for Required Action B.3 is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." In this Required Action, the Completion Time only begins on discovery that both:
| |
| : a. An inoperable DG exists; and
| |
| : b. A redundant required feature on another train is inoperable.
| |
| If at any time during the existence of this Condition (one required DG inoperable) a redundant required feature subsequently becomes inoperable, this Completion Time begins to be tracked.
| |
| Discovering one required DG inoperable coincident with one or more inoperable required support or supported features, or both, that are associated with another train, results in starting the Completion Time for the Required Action. Four hours from the discovery of these events existing concurrently is acceptable because it minimizes risk while allowing time for restoration before subjecting the unit to transients associated with shutdown.
| |
| In this condition, the remaining OPERABLE DG and offsite circuits are adequate to supply electrical power to the onsite Class 1E Electrical Power Distribution System and the Unit 1 Class 1E Electrical Power Distribution System when required to be OPERABLE. Thus, on a component basis, single failure protection for the required feature's function may have been lost; however, function has not been lost. The 4 hour Completion Time takes into account the OPERABILITY of the redundant counterpart to the inoperable required feature. Additionally, the 4 hour Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.
| |
| B.4.1 and B.4.2 Required Action B.4.1 provides an allowance to avoid unnecessary Cook Nuclear Plant Unit 2 B 3.8.1-10 Revision No. 41
| |
| | |
| AC Sources - Operating B 3.8.1 BASES ACTIONS (continued) testing of OPERABLE DG(s). If it can be determined that the cause of an inoperable DG does not exist on the other required OPERABLE DG(s), SR 3.8.1.2 does not have to be performed. If the cause of inoperability exists on other DG(s), the other DG(s) would be declared inoperable upon discovery and Condition F or H of LCO 3.8.1 would be entered.
| |
| Once the failure is repaired, the common cause failure no longer exists, and Required Action B.4.1 is satisfied. If the cause of the initial inoperable DG cannot be confirmed not to exist on the remaining DG(s),
| |
| performance of SR 3.8.1.2 suffices to provide assurance of continued OPERABILITY of those DG(s).
| |
| In the event the inoperable DG is restored to OPERABLE status prior to completing either B.4.1 or B.4.2, the plant corrective action program will continue to evaluate the common cause possibility. This continued evaluation, however, is no longer under the 24 hour constraint imposed while in Condition B.
| |
| According to Generic Letter 84-15 (Ref. 7), 24 hours is reasonable to confirm that the OPERABLE DG(s) is not affected by the same problem as the inoperable DG.
| |
| B.5 Operation may continue in Condition B for a period that should not exceed 72 hours. However, an evaluation performed in accordance with Regulatory Guide 1.177 (Ref. 6) has determined that operation may continue in Condition B for a period that should not exceed 14 days if both SDGs are available. Therefore, when one required DG is inoperable to perform either preplanned maintenance (preventive or corrective) or unplanned corrective maintenance work, the Completion Time can be extended from 72 hours to 14 days if both SDGs are verified available for backup operation in accordance with Required Action B.1.
| |
| In Condition B, the remaining required OPERABLE DG(s), the offsite circuits, and the SDGs are adequate to supply electrical power to the onsite Class 1E Electrical Power Distribution System and Unit 1 Class 1E Electrical Power Distribution System when required to be OPERABLE. The 14 day Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period. A Configuration Risk Management Program (CRMP) shall also be implemented prior to the Completion Time exceeding 72 hours to assess risk of any activities beyond 72 hours that the required DG is inoperable. In addition, planned maintenance or inspections using the 14 day Completion Time shall be limited to once per operating cycle per train.
| |
| Cook Nuclear Plant Unit 2 B 3.8.1-11 Revision No. 41
| |
| | |
| AC Sources - Operating B 3.8.1 BASES ACTIONS (continued)
| |
| The second Completion Time for Required Action B.5 establishes a limit on the maximum time allowed for any combination of required AC power sources to be inoperable during any single contiguous occurrence of failing to meet the LCO. For example, if Condition B is entered while an offsite circuit is inoperable and that circuit is subsequently restored OPERABLE, the LCO may already have been not met for up to 72 hours.
| |
| This could lead to a total of 17 days, since initial failure to meet the LCO, to restore the DG. At this time, an offsite circuit could again become inoperable, the DG restored OPERABLE, and an additional 72 hours (for a total of 20 days) allowed prior to complete restoration of the LCO. This is precluded by the 17 day Completion Time which provides a limit on time allowed in a specified condition after discovery of failure to meet LCO 3.8.1.a or b. This limit is considered reasonable for situations in which Conditions A and B are entered concurrently. The "AND" connector between the 14 day and 17 day Completion Times means that both Completion Times apply simultaneously, and the more restrictive Completion Time must be met.
| |
| As in Required Action B.3, the Completion Time allows for an exception to the normal "time zero" for beginning the allowed time "clock." This will result in establishing the "time zero" at the time that the LCO was initially not met, instead of at the time Condition B was entered.
| |
| C.1 and C.2 If one or both SDGs become unavailable with a required DG inoperable, then action is required to restore both SDGs to available status within 72 hours, or to restore the required DG to OPERABLE status within 72 hours. In Condition C, the remaining required OPERABLE DG(s) and offsite circuits are adequate to supply electrical power to the onsite Class 1E Electrical Power Distribution System and Unit 2 Class 1E Electrical Power Distribution System when required to OPERABLE. The 72 hour Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period. The Completion Time of 72 hours begins with the discovery of unavailability of one or both SDGs.
| |
| However, since the Completion Time of Condition B began at the time the DG was originally declared inoperable, the total time the DG may be inoperable prior to entering Condition G, which requires that the unit must be brought to a MODE in which the LCO does not apply, is limited to a total of 14 days by Required Action B.5.
| |
| D.1 and D.2 Required Action D.1, which applies when two required offsite circuits are inoperable and with inoperability of redundant required features, is Cook Nuclear Plant Unit 2 B 3.8.1-12 Revision No. 41
| |
| | |
| AC Sources - Operating B 3.8.1 BASES ACTIONS (continued) intended to provide assurance that an event with a coincident single failure will not result in a complete loss of redundant required safety functions. The Completion Time for taking this action is reduced to 12 hours from that allowed for one train without offsite power (Required Action A.2). The rationale for the reduction to 12 hours is that a Completion Time of 24 hours for two required offsite circuits inoperable is based upon the assumption that two complete safety trains are OPERABLE. When a concurrent redundant required feature failure exists, this assumption is not the case, and a shorter Completion Time of 12 hours is appropriate. These features are designed with redundant safety related trains. This includes motor driven auxiliary feedwater pumps. Single train features are normally not included, although, for this Required Action, the turbine driven auxiliary feedwater pump is considered redundant to Trains A and B. Redundant required features failures consist of inoperable features associated with a train, redundant to the train that has no offsite power available.
| |
| The Completion Time for Required Action D.1 is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." In this Required Action the Completion Time only begins on discovery that both:
| |
| : a. All required offsite circuits are inoperable; and
| |
| : b. A redundant required feature is inoperable.
| |
| If at any time during the existence of Condition D (two required offsite circuits inoperable) a redundant required feature subsequently becomes inoperable, this Completion Time begins to be tracked.
| |
| Operation may continue in Condition D for a period that should not exceed 24 hours. This level of degradation means that the offsite electrical power system does not have the capability to effect a safe shutdown and to mitigate the effects of an accident; however, the onsite AC sources have not been degraded. This level of degradation generally corresponds to a total loss of the immediately accessible offsite power sources.
| |
| Because of the normally high availability of the offsite sources, this level of degradation may appear to be more severe than other combinations of two AC sources inoperable that involve one or more DGs inoperable.
| |
| However, two factors tend to decrease the severity of this level of degradation:
| |
| Cook Nuclear Plant Unit 2 B 3.8.1-13 Revision No. 41
| |
| | |
| AC Sources - Operating B 3.8.1 BASES ACTIONS (continued)
| |
| : a. The configuration of the redundant AC electrical power system that remains available is not susceptible to a single bus or switching failure; and
| |
| : b. The time required to detect and restore an unavailable offsite power source is generally much less than that required to detect and restore an unavailable onsite AC source.
| |
| With two of the required offsite circuits inoperable, sufficient onsite AC sources are available to maintain the unit in a safe shutdown condition in the event of a DBA or transient. In fact, a simultaneous loss of offsite AC sources, a LOCA, and a worst case single failure were postulated as a part of the design basis in the safety analysis. Thus, the 24 hour Completion Time provides a period of time to effect restoration of one of the offsite circuits commensurate with the importance of maintaining an AC electrical power system capable of meeting its design criteria.
| |
| With the available offsite AC sources, two less than required by the LCO, operation may continue for 24 hours. If two offsite sources are restored within 24 hours, unrestricted operation may continue. If only one offsite source is restored within 24 hours, power operation continues in accordance with Condition A.
| |
| E.1 and E.2 Pursuant to LCO 3.0.6, the Distribution System ACTIONS would not be entered even if all AC sources to it were inoperable, resulting in de-energization. Therefore, the Required Actions of Condition E are modified by a Note to indicate that when Condition E is entered with no AC source to any train, the Conditions and Required Actions for LCO 3.8.9, "Distribution Systems - Operating," must be immediately entered. This allows Condition E to provide requirements for the loss of one offsite circuit and one DG, without regard to whether a train is de-energized. LCO 3.8.9 provides the appropriate restrictions for a de-energized train. Condition E must be entered when the preferred offsite source and DG are inoperable and when the alternate source is not supplying the train.
| |
| Operation may continue in Condition E for a period that should not exceed 12 hours.
| |
| In Condition E, individual redundancy is lost in both the offsite electrical power system and the onsite AC electrical power system. Since power system redundancy is provided by two diverse sources of power, however, the reliability of the power systems in this Condition may appear higher than that in Condition D (loss of both required offsite circuits). This Cook Nuclear Plant Unit 2 B 3.8.1-14 Revision No. 41
| |
| | |
| AC Sources - Operating B 3.8.1 BASES ACTIONS (continued) difference in reliability is offset by the susceptibility of this power system configuration to a single bus or switching failure. The 12 hour Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.
| |
| F.1 With two required DGs inoperable, there is no more than two remaining standby AC sources. Thus, with an assumed loss of offsite electrical power, sufficient standby AC sources may not be available to power the minimum required ESF functions. Since the offsite electrical power system is the only source of AC power for the majority of ESF equipment for this level of degradation, the risk associated with continued operation for a very short time could be less than that associated with an immediate controlled shutdown (the immediate shutdown could cause grid instability, which could result in a total loss of AC power). Since any inadvertent generator trip could also result in a total loss of offsite AC power, however, the time allowed for continued operation is severely restricted.
| |
| The intent here is to avoid the risk associated with an immediate controlled shutdown and to minimize the risk associated with this level of degradation.
| |
| With both unit DGs inoperable, operation may continue for a period that should not exceed 2 hours. This Completion Time assumes complete loss of onsite (DG) AC capability to power minimum loads needed to respond to analyzed event.
| |
| G.1 and G.2 If the inoperable AC electric power sources cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| H.1 Condition H corresponds to a level of degradation in which all redundancy in the AC electrical power supplies has been lost. At this severely degraded level, any further losses in the AC electrical power system will cause a loss of function. Therefore, no additional time is justified for Cook Nuclear Plant Unit 2 B 3.8.1-15 Revision No. 41
| |
| | |
| AC Sources - Operating B 3.8.1 BASES ACTIONS (continued) continued operation. The unit is required by LCO 3.0.3 to commence a controlled shutdown.
| |
| SURVEILLANCE The AC sources are designed to permit inspection and testing of all REQUIREMENTS important areas and features, especially those that have a standby function, in accordance with Plant Specific Design Criterion (PSDC) 39 (Ref. 8). Periodic component tests are supplemented by extensive functional tests during refueling outages (under simulated accident conditions). The SRs for demonstrating the OPERABILITY of the DGs are in accordance with the recommendations of Regulatory Guide 1.9 (Ref. 3), Regulatory Guide 1.108 (Ref. 9), Regulatory Guide 1.137 (Ref. 10), and IEEE Standard 387-1995 (Ref. 11) as addressed in the applicable SR discussion.
| |
| Where the SRs discussed herein specify voltage and frequency tolerances, the following is applicable. The minimum steady state output voltage of 3910 V is 94% of the nominal 4160 V output voltage. This value allows for voltage drop to the terminals of 4160 V motors whose minimum operating voltage is specified as 90% or 3740 V. It also allows for voltage drops to motors and other equipment down through the 120 V level where the minimum operating voltage is also usually specified as 90% of nameplate rating. The specified maximum steady state output voltage of 4400 V is equal to the maximum operating voltage specified for 4000 V motors. It ensures that for a lightly loaded distribution system, the voltage at the terminals of 4000 V motors is no more than the maximum rated operating voltages. The specified minimum and maximum steady state frequencies of the DG are 59.4 Hz and 60.5 Hz, respectively.
| |
| These values ensure the ESF pumps can achieve adequate fluid flow to meet their safety and accident mitigation functions.
| |
| SR 3.8.1.1 This SR ensures proper circuit continuity for the offsite AC electrical power supply to the onsite distribution network and availability of offsite AC electrical power. The breaker alignment verifies that each breaker is in its correct position to ensure that the required qualified offsite circuits are OPERABLE, and that appropriate independence of offsite circuits is maintained. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.8.1.2 and SR 3.8.1.8 These SRs help to ensure the availability of the standby electrical power Cook Nuclear Plant Unit 2 B 3.8.1-16 Revision No. 60
| |
| | |
| AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued) supply to mitigate DBAs and transients and to maintain the unit in a safe shutdown condition.
| |
| To minimize the wear on moving parts that do not get lubricated when the engine is not running, these SRs are modified by a Note (Note 1 for SR 3.8.1.2 and Note for SR 3.8.1.8) to indicate that all DG starts for these Surveillances may be preceded by an engine prelube period and followed by a warmup period prior to loading.
| |
| For the purposes of SR 3.8.1.2 and SR 3.8.1.8 testing, the DGs are started from standby conditions. Standby conditions for a DG means that the diesel engine coolant and oil are being continuously circulated and temperature is being maintained consistent with manufacturer recommendations.
| |
| In order to reduce stress and wear on diesel engines, the manufacturer recommends a modified start in which the DGs are gradually accelerated to synchronous speed prior to loading. These start procedures are the intent of Note 2.
| |
| SR 3.8.1.8 requires that, at a 184 day Frequency, the DG starts from standby conditions and achieves required voltage and frequency within 10 seconds. The 10 second start requirement supports the assumptions of the design basis LOCA analysis in the UFSAR, Section 14.3 (Ref. 5).
| |
| The 10 second start requirement is not applicable to SR 3.8.1.2 (see Note 2 of SR 3.8.1.2) when a modified start procedure as described above is used. If a modified start is not used, the 10 second start requirement of SR 3.8.1.8 applies.
| |
| Since SR 3.8.1.8 requires a 10 second start, it is more restrictive than SR 3.8.1.2, and it may be performed in lieu of SR 3.8.1.2.
| |
| In addition, the DG is required to maintain proper voltage and frequency limits after steady state is achieved. The voltage and frequency limits are normally achieved within 10 seconds. The time for the DG to reach steady state operation, unless the modified DG start method is employed, is periodically monitored and the trend evaluated to identify degradation of governor and voltage regulator performance.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Cook Nuclear Plant Unit 2 B 3.8.1-17 Revision No. 60
| |
| | |
| AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.8.1.3 Consistent with Regulatory Guide 1.9 (Ref. 3), this Surveillance verifies that the DGs are capable of synchronizing with the offsite electrical system and accepting loads 90% to 100% of the continuous rating of the DG. A minimum run time of 60 minutes is required to stabilize engine temperatures, while minimizing the time that the DG is connected to the offsite source.
| |
| Although no power factor requirements are established by this SR, the DG is normally operated at a power factor between 0.8 lagging and 1.0.
| |
| The 0.8 value is the design rating of the machine, while the 1.0 is an operational goal to ensure circulating currents are minimized. The load band is provided to avoid routine overloading of the DG. Routine overloading may result in more frequent teardown inspections being required in order to maintain DG reliability.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by four Notes. Note 1 indicates that diesel engine runs for this Surveillance may include gradual loading, as recommended by the manufacturer, so that mechanical stress and wear on the diesel engine are minimized. Note 2 states that momentary transients, because of changing bus loads, do not invalidate this test. Note 3 indicates that this Surveillance should be conducted on only one Unit 2 DG at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations. Note 4 stipulates a prerequisite requirement for performance of this SR. A successful DG start must precede this test to credit satisfactory performance.
| |
| SR 3.8.1.4 This SR provides verification that the level of fuel oil in the day tank is above the level at which fuel oil is automatically added. The level is expressed as an equivalent volume in gallons, of which 31.4 gallons is unusable (due to tank geometry and vortexing considerations) and 70 gallons is usable, and is selected to ensure adequate fuel oil for greater than 15 minutes of DG operation at full load.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.8.1.5 Microbiological fouling is a major cause of fuel oil degradation. There are numerous bacteria that can grow in fuel oil and cause fouling, but all must Cook Nuclear Plant Unit 2 B 3.8.1-18 Revision No. 60
| |
| | |
| AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued) have a water environment in order to survive. Removal of water from each fuel oil day tank eliminates the necessary environment for bacterial survival. This is the most effective means of controlling microbiological fouling. In addition, it eliminates the potential for water entrainment in the fuel oil during DG operation.
| |
| Water may come from any of several sources, including condensation, ground water, rain water, contaminated fuel oil, and breakdown of the fuel oil by bacteria.
| |
| Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.8.1.6 This Surveillance ensures that, without the aid of the refill compressor, sufficient air start capacity for each DG is available. While the system design requirements provide for two engine start cycles from each of the two air start receivers associated with each DG without recharging, only one start sequence is required to meet the OPERABILITY requirements (since the accident analysis assumes the DG starts on the first attempt).
| |
| The pressure specified in this SR reflects the lowest value at which one DG start can be accomplished with one air start receiver.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.8.1.7 This Surveillance demonstrates that each required fuel oil transfer pump (one per fuel oil transfer system) operates automatically and transfers fuel oil from its associated storage tank to its associated day tank. This is required to support continuous operation of standby power sources. This Surveillance provides assurance that the fuel oil transfer pump is OPERABLE, the fuel oil piping system is intact, the fuel delivery piping is not obstructed, and the controls and control systems for automatic fuel transfer systems are OPERABLE.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Cook Nuclear Plant Unit 2 B 3.8.1-19 Revision No. 60
| |
| | |
| AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.8.1.9 Automatic transfer of each 4.16 kV emergency bus power supply from the normal auxiliary circuit to the preferred offsite circuit and the manual alignment to the alternate required offsite circuit demonstrates the OPERABILITY of the required offsite circuit to power the shutdown loads.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| As noted (Note 1 to SR 3.8.1.9), SR 3.8.1.9.a is only required to be met when the auxiliary source is supplying the onsite electrical power subsystem. This is acceptable since the preferred offsite source would be supplying the onsite electrical power subsystem and a transfer would not be necessary.
| |
| SR 3.8.1.10 Each DG is provided with an engine overspeed trip to prevent damage to the engine. Recovery from the transient caused by the loss of a large load could cause diesel engine overspeed, which, if excessive, might result in a trip of the engine. This Surveillance demonstrates the DG load response characteristics and capability to reject the largest single load without exceeding a predetermined frequency and while maintaining a specified margin to the overspeed trip. Voltage and frequency are also verified to reach steady state conditions within 2 seconds. For this unit, the single load for each DG is 600 kW. This Surveillance may be accomplished by:
| |
| : a. Tripping the DG output breaker with the DG carrying greater than or equal to its associated single largest post-accident load while paralleled to offsite power, or while solely supplying the bus; or
| |
| : b. Tripping its associated single largest post-accident load with the DG solely supplying the bus.
| |
| Consistent with Regulatory Guide 1.9 (Ref. 3), the load rejection test is acceptable if the increase in diesel speed does not exceed 75% of the difference between synchronous speed and the overspeed trip setpoint, or 15% above nominal speed, whichever is lower. This corresponds to 64.4 Hz, which is the nominal speed plus 75% of the difference between nominal speed and the overspeed trip setpoint.
| |
| The time, voltage, and frequency tolerances specified in this SR are Cook Nuclear Plant Unit 2 B 3.8.1-20 Revision No. 60
| |
| | |
| AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued) derived from Regulatory Guide 1.9 (Ref. 3) recommendations for response during load sequence intervals. The 2 seconds specified is equal to approximately 60% of the 3.49 second load sequence interval associated with sequencing of the largest load. The voltage and frequency specified are consistent with the design range of the equipment powered by the DG. SR 3.8.1.10.a corresponds to the maximum frequency excursion, while SR 3.8.1.10.b and SR 3.8.1.10.c are steady state voltage and frequency values to which the system must recover following load rejection. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by a Note. Note 1 ensures that the DG is tested under load conditions that are as close to design basis conditions as possible.
| |
| When synchronized with offsite power, testing should be performed at a power factor of 0.86. This power factor is representative of the actual inductive loading a DG would see under design basis accident conditions.
| |
| Under certain conditions, however, Note 1 allows the Surveillance to be conducted at a power factor other than 0.86. These conditions occur when grid voltage is high, and the additional field excitation needed to get the power factor to 0.86 results in voltages on the emergency busses that are too high.
| |
| Under these conditions, the power factor should be maintained as close as practicable to 0.86 while still maintaining acceptable voltage limits on the emergency busses. In other circumstances, the grid voltage may be such that the DG excitation levels needed to obtain a power factor of 0.86 may not cause unacceptable voltages on the emergency busses, but the excitation levels are in excess of those recommended for the DG. In such cases, the power factor shall be maintained as close as practicable to 0.86 without exceeding the DG excitation limits.
| |
| Prior to the performance of this Surveillance in MODE 1 or 2 a risk assessment shall be performed to determine that plant safety is maintained. As part of this assessment weather conditions will be assessed, and the SR will not be scheduled when severe weather conditions and/or unstable grid conditions are predicted or present.
| |
| Also, no discretionary maintenance activities will be scheduled which could cause a line outage or challenge offsite power availability.
| |
| Additionally, no switchyard activities will be allowed during the performance of this Surveillance.
| |
| Cook Nuclear Plant Unit 2 B 3.8.1-21 Revision No. 60
| |
| | |
| AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.8.1.11 Consistent with Regulatory Guide 1.9 (Ref. 3), paragraph C.2.2.8, this Surveillance demonstrates the DG capability to reject a full load (90% to 100% of the DG continuous rating) without overspeed tripping or exceeding the predetermined voltage limits. The DG full load rejection may occur because of a system fault or inadvertent breaker tripping. This Surveillance ensures proper engine generator load response under the simulated test conditions. This test simulates the loss of the total connected load that the DG experiences following a full load rejection and verifies that the DG does not trip upon loss of the load. These acceptance criteria provide for DG damage protection. While the DG is not expected to experience this transient during an event and continues to be available, this response ensures that the DG is not degraded for future application, including reconnection to the bus if the trip initiator can be corrected or isolated.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR has been modified by a Note. Note 1 ensures that the DG is tested under load conditions that are as close to design basis conditions as possible. When synchronized with offsite power, testing should be performed at a power factor of 0.86. This power factor is representative of the actual inductive loading a DG would see under design basis accident conditions. Under certain conditions, however, Note 1 allows the Surveillance to be conducted at a power factor other than 0.86. These conditions occur when grid voltage is high, and the additional field excitation needed to get the power factor to 0.86 results in voltages on the emergency busses that are too high.
| |
| Under these conditions, the power factor should be maintained as close as practicable to 0.86 while still maintaining acceptable voltage limits on the emergency busses. In other circumstances, the grid voltage may be such that the DG excitation levels needed to obtain a power factor of 0.86 may not cause unacceptable voltages on the emergency busses, but the excitation levels are in excess of those recommended for the DG. In such cases, the power factor shall be maintained as close as practicable to 0.86 without exceeding the DG excitation limits.
| |
| Cook Nuclear Plant Unit 2 B 3.8.1-22 Revision No. 60
| |
| | |
| AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| Prior to the performance of this Surveillance in MODE 1 or 2 a risk assessment shall be performed to determine that plant safety is maintained. As part of this assessment weather conditions will be assessed, and the SR will not be scheduled when severe weather conditions and/or unstable grid conditions are predicted or present.
| |
| Also, no discretionary maintenance activities will be scheduled which could cause a line outage or challenge offsite power availability.
| |
| Additionally, no switchyard activities will be allowed during the performance of this Surveillance.
| |
| SR 3.8.1.12 Consistent with Regulatory Guide 1.9 (Ref. 3), paragraph C.2.2.4, this Surveillance demonstrates the as designed operation of the standby power sources during loss of the offsite source. This test verifies all actions encountered from the loss of offsite power, including shedding of the nonessential loads and energization of the emergency buses and respective loads from the DG. It further demonstrates the capability of the DG to automatically achieve the required voltage and frequency within the specified time.
| |
| The DG autostart time of 10 seconds is derived from requirements of the accident analysis to respond to a design basis large break LOCA. The Surveillance should be continued for a minimum of 5 minutes in order to demonstrate that all starting transients have decayed and stability is achieved.
| |
| The requirement to verify the connection and power supply of permanent and autoconnected loads is intended to satisfactorily show the relationship of these loads to the DG loading logic. In certain circumstances, many of these loads cannot actually be connected or loaded without undue hardship or potential for undesired operation. For instance, Emergency Core Cooling Systems (ECCS) injection valves are not desired to be stroked open, or centrifugal charging trains are not capable of being operated at full flow, or residual heat removal (RHR) trains performing a decay heat removal function are not desired to be realigned to the ECCS mode of operation. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the DG systems to perform these functions is acceptable.
| |
| This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.
| |
| Cook Nuclear Plant Unit 2 B 3.8.1-23 Revision No. 52
| |
| | |
| AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by two Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. For the purpose of this testing, the DGs must be started from standby conditions, that is, with the engine coolant and oil continuously circulated and temperature maintained consistent with manufacturer recommendations. The reason for Note 2 is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. This restriction from normally performing the Surveillance in MODE 1, 2, 3, or 4, is further amplified to allow portions of the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines unit safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial Surveillance, a successful partial Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial Surveillance; as well as the operator procedures available to cope with these outcomes.
| |
| These shall be measured against the avoided risk of a unit shutdown and startup to determine that unit safety is maintained or enhanced when portions of the Surveillance are performed in MODE 1, 2, 3, or 4. Risk insights or deterministic methods may be used for the assessment.
| |
| Credit may be taken for unplanned events that satisfy this SR.
| |
| SR 3.8.1.13 Consistent with Regulatory Guide 1.9 (Ref. 3), paragraph C.2.2.5, this Surveillance demonstrates that the DG automatically starts and achieves the required voltage and frequency within the specified time (10 seconds) from the design basis actuation signal (ESF actuation signal). In addition, the DG is required to maintain proper voltage and frequency limits after steady state is achieved. The voltage and frequency limits are normally achieved within 10 seconds. The time for the DG to reach the steady state voltage and frequency limits is periodically monitored and the trend evaluated to identify degradation of governor and voltage regulator performance. The DG is required to operate for 5 minutes. The Cook Nuclear Plant Unit 2 B 3.8.1-24 Revision No. 60
| |
| | |
| AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued) 5 minute period provides sufficient time to demonstrate stability.
| |
| SR 3.8.1.13.d and SR 3.8.1.13.e ensure that permanently connected loads and emergency loads are energized from the offsite electrical power system on an ESF signal without loss of offsite power.
| |
| The requirement to verify the connection of permanent and auto-connected loads is intended to satisfactorily show the relationship of these loads to the DG loading logic. In certain circumstances, many of these loads cannot actually be connected or loaded without undue hardship or potential for undesired operation. For instance, ECCS injection valves are not desired to be stroked open, or centrifugal charging trains are not capable of being operated at full flow, or RHR trains performing a decay heat removal function are not desired to be realigned to the ECCS mode of operation. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the DG system to perform these functions is acceptable.
| |
| This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by two Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. For the purpose of this testing, the DGs must be started from standby conditions, that is, with the engine coolant and oil continuously circulated and temperature maintained consistent with manufacturer recommendations. The reason for Note 2 is that during operation with the reactor critical, performance of this Surveillance could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, unit safety systems. This restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow portions of the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and Cook Nuclear Plant Unit 2 B 3.8.1-25 Revision No. 60
| |
| | |
| AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued) other unanticipated OPERABILITY concerns) provided an assessment determines unit safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial Surveillance, a successful partial Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a unit shutdown and startup to determine that unit safety is maintained or enhanced when portions of the Surveillance are performed in MODE 1 or 2. Risk insights or deterministic methods may be used for the assessment. Credit may be taken for unplanned events that satisfy this SR.
| |
| SR 3.8.1.14 Consistent with Regulatory Guide 1.9 (Ref. 3), paragraph C.2.2.12, this Surveillance demonstrates that DG noncritical protective functions (e.g., low lube oil pressure) are bypassed on a loss of voltage signal or an ESF actuation test signal. The noncritical trips are bypassed during DBAs and provide an alarm on an abnormal engine condition. This alarm provides the operator with sufficient time to react appropriately. The DG availability to mitigate the DBA is more critical than protecting the engine against minor problems that are not immediately detrimental to emergency operation of the DG.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| The SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required DG from service. This restriction from normally performing the Surveillance in MODE 1 or 2 is; further amplified to allow the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines unit safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed Surveillance, a Cook Nuclear Plant Unit 2 B 3.8.1-26 Revision No. 60
| |
| | |
| AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued) successful Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the Surveillance as well as the operator procedures available to cope with these outcomes.
| |
| These shall be measured against the avoided risk of a unit shutdown and startup to determine that unit safety is maintained or enhanced when the Surveillance is performed in MODE 1 or 2. Risk insights or deterministic methods may be used for this assessment. Credit may be taken for unplanned events that satisfy this SR.
| |
| SR 3.8.1.15 This Surveillance demonstrates the DGs can start and run continuously at full load capability (90% to 100% of the DG continuous rating) for an interval of not less than 8 hours. The run duration of 8 hours is consistent with IEEE Standard 387-1995 (Ref. 11). The DG starts for this Surveillance can be performed either from standby or hot conditions. The provisions for prelubricating and warmup, discussed in SR 3.8.1.2, and for gradual loading, discussed in SR 3.8.1.3, are applicable to this SR.
| |
| The load band is provided to avoid routine overloading of the DG.
| |
| Routine overloading may result in more frequent teardown inspections being required in order to maintain DG reliability.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This Surveillance is modified by two Notes. Note 1 states that momentary transients due to changing bus loads do not invalidate this test. Similarly, momentary power factor transients above the power factor limit will not invalidate the test. Note 2 ensures that the DG is tested under load conditions that are as close to design basis conditions as possible. When synchronized with offsite power, testing should be performed at a power factor of 0.86. This power factor is representative of the actual inductive loading a DG would see under design basis accident conditions. Under certain conditions, however, Note 2 allows the Surveillance to be conducted as a power factor other than 0.86. These conditions occur when grid voltage is high, and the additional field excitation needed to get the power factor to 0.86 results in voltages on the emergency busses that are too high. Under these conditions, the power factor should be maintained as close as practicable to 0.86 while still maintaining Cook Nuclear Plant Unit 2 B 3.8.1-27 Revision No. 60
| |
| | |
| AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued) acceptable voltage limits on the emergency busses. In other circumstances, the grid voltage may be such that the DG excitation levels needed to obtain a power factor of 0.86 may not cause unacceptable voltages on the emergency busses, but the excitation levels are in excess of those recommended for the DG. In such cases, the power factor shall be maintained close as practicable to 0.86 without exceeding the DG excitation limits.
| |
| Prior to the performance of this Surveillance in MODE 1 or 2 a risk assessment shall be performed to determine that plant safety is maintained. As part of this assessment weather conditions will be assessed, and the SR will not be scheduled when severe weather conditions and/or unstable grid conditions are predicted or present.
| |
| Also, no discretionary maintenance activities will be scheduled which could cause a line outage or challenge offsite power availability.
| |
| Additionally, no switchyard activities will be allowed during the performance of this Surveillance.
| |
| SR 3.8.1.16 This Surveillance demonstrates that the diesel engine can restart from a hot condition, such as subsequent to shutdown from normal Surveillances, and achieve the required voltage and frequency within 10 seconds. The 10 second time is derived from the requirements of the accident analysis to respond to a design basis large break LOCA. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by two Notes. Note 1 ensures that the test is performed with the diesel sufficiently hot. The load band is provided to avoid routine overloading of the DG. Routine overloads may result in more frequent teardown inspections being required in order to maintain DG reliability. The requirement that the diesel has operated for at least 2 hours at full load conditions prior to performance of this Surveillance is based on operating experience for achieving hot conditions. Momentary transients due to changing bus loads do not invalidate this test. Note 2 allows all DG starts to be preceded by an engine prelube period to minimize wear and tear on the diesel during testing.
| |
| Cook Nuclear Plant Unit 2 B 3.8.1-28 Revision No. 60
| |
| | |
| AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.8.1.17 Consistent with Regulatory Guide 1.9 (Ref. 3), paragraph C.2.2.11, this Surveillance ensures that the manual synchronization and load transfer from the DG to the offsite source can be made and the DG can be returned to ready-to-load status when offsite power is restored. It also ensures that the auto-start logic is reset to allow the DG to reload if a subsequent loss of offsite power occurs. The DG is considered to be in ready-to-load status when the DG is running at rated speed and voltage, with the DG output breaker open.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems.
| |
| This restriction from normally performing the Surveillance in MODE 1, 2, 3, or 4 is further amplified to allow the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines unit safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed Surveillance, a successful Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a unit shutdown and startup to determine that unit safety is maintained or enhanced when the Surveillance is performed in MODE 1, 2, 3, or 4.
| |
| Risk insights or deterministic methods may be used for this assessment.
| |
| Credit may be taken for unplanned events that satisfy this SR.
| |
| SR 3.8.1.18 Under accident conditions loads are sequentially connected to the bus by the individual time delay relays. The sequencing logic controls the permissive and starting signals to motor breakers to prevent overloading of the DGs or RATs (as applicable) due to high motor starting currents.
| |
| Verifying the load sequencer time within plus or minus 5% of its required value ensures that sufficient time exists for the DG to restore frequency and voltage and RATs to restore voltage prior to applying the next load and that safety analysis assumptions regarding ESF equipment time delays are not violated. Reference 4 provides a summary of the Cook Nuclear Plant Unit 2 B 3.8.1-29 Revision No. 60
| |
| | |
| AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued) automatic loading of emergency buses.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems.
| |
| This restriction from normally performing the Surveillance in MODE 1, 2, 3, or 4 is further amplified to allow portions of the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines unit safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial Surveillance, a successful partial Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a unit shutdown and startup to determine that unit safety is maintained or enhanced when portions of the Surveillance are performed in MODE 1, 2, 3, or 4. Risk insights or deterministic methods may be used for the assessment. Credit may be taken for unplanned events that satisfy this SR.
| |
| SR 3.8.1.19 In the event of a DBA coincident with a loss of offsite power, the DGs are required to supply the necessary power to ESF systems so that the fuel, RCS, and containment design limits are not exceeded.
| |
| This Surveillance demonstrates the DG operation, as discussed in the Bases for SR 3.8.1.12, during a loss of offsite power actuation test signal in conjunction with an ESF actuation signal. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the DG system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Cook Nuclear Plant Unit 2 B 3.8.1-30 Revision No. 60
| |
| | |
| AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| This SR is modified by two Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. For the purpose of this testing, the DGs must be started from standby conditions, that is, with the engine coolant and oil continuously circulated and temperature maintained consistent with manufacturer recommendations for DGs. The reason for Note 2 is that the performance of the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. This restriction from normally performing the Surveillance in MODE 1, 2, 3, or 4 is further amplified to allow portions of the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines unit safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial Surveillance, a successful partial Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a unit shutdown and startup to determine that unit safety is maintained or enhanced when portions of the Surveillance are performed in MODE 1, 2, 3, or 4. Risk insights or deterministic methods may be used for the assessment. Credit may be taken for unplanned events that satisfy this SR.
| |
| SR 3.8.1.20 DELETED SR 3.8.1.21 Demonstration of the test mode override ensures that the DG availability under accident conditions will not be compromised as the result of testing and the DG will automatically reset to ready to load operation if a LOCA actuation signal is received during operation in the test mode. Ready to load operation is defined as the DG running at rated speed and voltage with the DG output breaker open.
| |
| The requirement to automatically energize the emergency loads with offsite power is essentially identical to that of SR 3.8.1.13. The intent in the requirement associated with SR 3.8.1.21.b is to show that the emergency loading was not affected by the DG operation in test mode. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the emergency loads to perform these functions is acceptable.
| |
| Cook Nuclear Plant Unit 2 B 3.8.1-31 Revision No. 76
| |
| | |
| AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required DG from service, perturb the electrical distribution system, and challenge safety systems. This restriction from normally performing the Surveillance in MODE 1, 2, 3, or 4 is further amplified to allow portions of the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines unit safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial Surveillance, a successful partial Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a unit shutdown and startup to determine that unit safety is maintained or enhanced when portions of the Surveillance are performed in MODE 1, 2, 3, or 4. Risk insights or deterministic methods may be used for the assessment. Credit may be taken for unplanned events that satisfy this SR.
| |
| SR 3.8.1.22 This Surveillance demonstrates that the DG starting independence has not been compromised. Also, this Surveillance demonstrates that each engine can achieve proper speed within the specified time when the DGs are started simultaneously.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by a Note. The reason for the Note is to minimize wear on the DG during testing. For the purpose of this testing, the DGs must be started from standby conditions, that is, with the engine coolant and oil continuously circulated and temperature maintained consistent with manufacturer recommendations.
| |
| Cook Nuclear Plant Unit 2 B 3.8.1-32 Revision No. 76
| |
| | |
| AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.8.1.23 With the exception of this Surveillance, all other Surveillances of this Specification (SR 3.8.1.1 through SR 3.8.1.22) are applied to Unit 2 sources. This Surveillance is provided to direct that appropriate Surveillances for the required Unit 1 AC sources are governed by the applicable Unit 1 Technical Specifications. Performance of the applicable Unit 1 Surveillances will satisfy the Unit 1 requirements as well as satisfy this Unit 2 Surveillance Requirement. Exceptions are noted to the Unit 1 SRs of LCO 3.8.1. SR 3.8.1.9.b is not required to be met since only one offsite circuit is required to be OPERABLE. SR 3.8.1.13, SR 3.8.1.14 (ESF actuation signal portion only), SR 3.8.1.19, and SR 3.8.1.21 are not required to be met because the ESF actuation signal is not required to be OPERABLE. SR 3.8.1.22 is excepted because starting independence is not required with the DG(s) that is not required to be OPERABLE.
| |
| The Frequency required by the applicable Unit 1 SR also governs performance of that SR for Unit 2.
| |
| As noted (Note 1 to SR 3.8.1.23), if Unit 1 is in MODE 5 or 6, or moving irradiated fuel assemblies, SR 3.8.1.3, SR 3.8.1.10 through SR 3.8.1.12, SR 3.8.1.14 through SR 3.8.1.17, and SR 3.8.1.18 are not required to be performed. This ensures that this Unit 2 SR will not require a Unit 1 SR to be performed, when the Unit 1 Technical Specifications exempts performance of a Unit 1 SR (however, as stated in the Unit 1 SR 3.8.2.1 Note 1, while performance of an SR exempted, the SR must still be met).
| |
| As noted (Note 2 to SR 3.8.1.23), SR 3.8.1.9.a is only required to be met when the auxiliary source is supplying the Unit 1 electrical power distribution subsystem since the preferred offsite source is required to support Unit 2 operations.
| |
| REFERENCES 1. Atomic Energy Commission Proposed General Design Criterion 39, July 1967.
| |
| : 2. UFSAR, Section 8.3.
| |
| : 3. Regulatory Guide 1.9, Rev. 3.
| |
| : 4. UFSAR, Section 8.4.
| |
| Cook Nuclear Plant Unit 2 B 3.8.1-33 Revision No. 76
| |
| | |
| AC Sources - Operating B 3.8.1 BASES REFERENCES (continued)
| |
| : 5. UFSAR, Chapter 14.
| |
| : 6. Regulatory Guide 1.177, August 1978.
| |
| : 7. Generic Letter 84-15, "Proposed Staff Actions to Improve and Maintain Diesel Generator Reliability," July 2, 1984.
| |
| : 8. UFSAR, Section 1.4.7.
| |
| : 9. Regulatory Guide 1.108, Rev. 1, August 1977.
| |
| : 10. Regulatory Guide 1.137, Rev. 1, October 1979.
| |
| : 11. IEEE Standard 387-1995.
| |
| : 12. ASME Operation and Maintenance Standards and Guides (OM Codes).
| |
| Cook Nuclear Plant Unit 2 B 3.8.1-34 Revision No. 76
| |
| | |
| AC Sources - Shutdown B 3.8.2 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.2 AC Sources - Shutdown BASES BACKGROUND A description of the AC sources is provided in the Bases for LCO 3.8.1, "AC Sources - Operating."
| |
| APPLICABLE The OPERABILITY of the minimum AC sources during MODES 5 and 6 SAFETY and during movement of irradiated fuel assemblies in the containment, ANALYSES auxiliary building, and Unit 1 containment ensures that:
| |
| : a. The unit can be maintained in the shutdown or refueling condition for extended periods;
| |
| : b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and
| |
| : c. Adequate AC electrical power is provided to mitigate events postulated during shutdown, such as a fuel handling accident.
| |
| In general, when the unit is shut down, the Technical Specifications requirements ensure that the unit has the capability to mitigate the consequences of postulated accidents. However, assuming a single failure and concurrent loss of all offsite or all onsite power is not required.
| |
| The rationale for this is based on the fact that many Design Basis Accidents (DBAs) that are analyzed in MODES 1, 2, 3, and 4 have no specific analyses in MODES 5 and 6. Worst case bounding events are deemed not credible in MODES 5 and 6 because the energy contained within the reactor pressure boundary, reactor coolant temperature and pressure, and the corresponding stresses result in the probabilities of occurrence being significantly reduced or eliminated, and in minimal consequences. These deviations from DBA analysis assumptions and design requirements during shutdown conditions are allowed by the LCO for required systems.
| |
| During MODES 1, 2, 3, and 4, various deviations from the analysis assumptions and design requirements are allowed within the Required Actions. This allowance is in recognition that certain testing and maintenance activities must be conducted provided an acceptable level of risk is not exceeded. During MODES 5 and 6, performance of a significant number of required testing and maintenance activities is also required. In MODES 5 and 6, the activities are generally planned and administratively controlled. Relaxations from MODE 1, 2, 3, and 4 LCO requirements are acceptable during shutdown modes based on:
| |
| : a. The fact that time in an outage is limited. This is a risk prudent goal as well as a utility economic consideration.
| |
| Cook Nuclear Plant Unit 2 B 3.8.2-1 Revision No. 0
| |
| | |
| AC Sources - Shutdown B 3.8.2 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| : b. Requiring appropriate compensatory measures for certain conditions.
| |
| These may include administrative controls, reliance on systems that do not necessarily meet typical design requirements applied to systems credited in operating MODE analyses, or both.
| |
| : c. Prudent utility consideration of the risk associated with multiple activities that could affect multiple systems.
| |
| : d. Maintaining, to the extent practical, the ability to perform required functions (even if not meeting MODE 1, 2, 3, and 4 OPERABILITY requirements) with systems assumed to function during an event.
| |
| In the event of an accident during shutdown, this LCO ensures the capability to support systems necessary to avoid immediate difficulty, assuming either a loss of all offsite power or a loss of all onsite diesel generator (DG) power.
| |
| AC Sources - Shutdown satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO One offsite circuit capable of supplying the onsite Class 1E power distribution subsystem(s) of LCO 3.8.10, "Distribution Systems - Shutdown," ensures that most of the required loads are powered from offsite power. In addition, to ensure the remainder of the loads are powered from offsite power, one Unit 1 qualified circuit is required between the offsite transmission network and the Unit 1 onsite Class 1E AC electrical power distribution subsystem required to be OPERABLE by LCO 3.8.10. This will ensure that Unit 2 will have sufficient offsite power to support the Fuel Handling Area Exhaust Ventilation (FHAEV) System since this system is supplied by Unit 1 AC sources. An OPERABLE DG, associated with a distribution system train required to be OPERABLE by LCO 3.8.10, ensures a diverse power source is available to provide electrical power support, assuming a loss of the offsite circuit. Together, OPERABILITY of the required offsite circuit(s) and DG ensures the availability of sufficient AC sources to operate the unit in a safe manner and to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents).
| |
| The qualified offsite circuit(s) must be capable of maintaining rated frequency and voltage, and accepting required loads during an accident, while connected to the emergency bus(es).
| |
| The preferred qualified offsite circuit consists of reserve auxiliary transformers (RATs) TR201CD and TR201AB, as applicable, the cabling and breakers to the required 4.16 kV buses 2A, 2B, 2C, and 2D, the Cook Nuclear Plant Unit 2 B 3.8.2-2 Revision No. 0
| |
| | |
| AC Sources - Shutdown B 3.8.2 BASES LCO (continued) required 4.16 kV buses 2A, 2B, 2C, and 2D, and the cabling and breakers to the required 4.16 kV emergency buses T21A, T21B, T21C, and T21D.
| |
| The alternate qualified offsite circuit consists of transformer TR12EP-1, the cabling, voltage regulators, and switches to 4.16 kV bus 1, and the cabling, switches, and breakers to either Train A 4.16 kV emergency buses T21C and T21D or Train B 4.16 kV emergency buses T21A and T21B. The alternate qualified offsite circuit is supplied from the 69 kV Bus #2 of the Cook-Thornton Station.
| |
| The required DG must be capable of starting, accelerating to rated speed and voltage, and connecting to its respective emergency bus on detection of bus undervoltage. This sequence must be accomplished within 10 seconds. The DG must be capable of accepting required loads within the assumed loading sequence intervals, and continue to operate until offsite power can be restored to the emergency buses. These capabilities are required to be met from a variety of initial conditions such as DG in standby with the engine hot and DG in standby at ambient conditions.
| |
| Additional DG capabilities must be demonstrated to meet required Surveillances, e.g., capability of the DG to reject a load equivalent to its associated single largest post-accident load.
| |
| Proper sequencing of loads, including tripping of nonessential loads, is a required function for DG OPERABILITY. The necessary portions of the Essential Service Water System and Ultimate Heat Sink capable of providing cooling to the required DG are also required.
| |
| Additionally, units electrical sources must include electrical sources from Unit 1 that is required to support the FHAEV System when handling fuel in the auxiliary building. Either the preferred or alternate Unit 1 source is required. The preferred qualified offsite circuit is supplied via RAT TR101CD and RAT TR101AB. A 34.5 kV line supplies RAT TR101CD and RAT TR101AB. RAT TR101CD supplies the Train A 4.16 kV bus T11D via bus 1D. The preferred offsite circuit extends to Train A 600 V bus 11D since an FHAEV fan is supplied from this bus.
| |
| RAT TR101AB supplies the Train B 4.16 kV bus T11A via bus 1A. The preferred offsite circuit extends to Train B 600 V bus 11A since an FHAEV fan is supplied from this circuit. A 69 kV line supplies the alternate qualified offsite circuit. The 69 kV line supplies transformer TR12EP-1 which can be manually aligned to directly supply Train A 4.16 kV bus T11D and Train B 4.16 kV bus T11A. The alternate offsite source is also required to supply the associated 600 V AC bus.
| |
| Cook Nuclear Plant Unit 2 B 3.8.2-3 Revision No. 49
| |
| | |
| AC Sources - Shutdown B 3.8.2 BASES APPLICABILITY The AC sources required to be OPERABLE in MODES 5 and 6 and during movement of irradiated fuel assemblies in the containment, auxiliary building, and Unit 1 containment provide assurance that:
| |
| : a. Systems to provide adequate coolant inventory makeup are available for the irradiated fuel assemblies in the core;
| |
| : b. Systems needed to mitigate a fuel handling accident are available;
| |
| : c. Systems necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and
| |
| : d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.
| |
| The AC power requirements for MODES 1, 2, 3, and 4 are covered in LCO 3.8.1.
| |
| ACTIONS LCO 3.0.3 is not applicable while in MODE 5 or 6. However, since irradiated fuel assembly movement can occur in MODE 1, 2, 3, or 4, the ACTIONS have been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 5 or 6, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1, 2, 3, or 4, the fuel movement is independent of reactor operations. Entering LCO 3.0.3, while in MODE 1, 2, 3, or 4 would require the unit to be shutdown unnecessarily.
| |
| A.1 An offsite circuit would be considered inoperable if it were not available to one required train. If two trains are required by LCO 3.8.10, the one train with offsite power available may be capable of supporting sufficient required features to allow continuation of CORE ALTERATIONS and irradiated fuel movement. By the allowance of the option to declare required features inoperable, with no offsite power available, appropriate restrictions will be implemented in accordance with the affected required features LCO's ACTIONS.
| |
| A.2.1, A.2.2, A.2.3, A.2.4, B.1, B.2, B.3, and B.4 With the required offsite circuit(s) not available to all required trains, the option would still exist to declare all required features inoperable. Since this option may involve undesired administrative efforts, the allowance for sufficiently conservative actions is made. With the required DG inoperable, the minimum required diversity of AC power sources is not Cook Nuclear Plant Unit 2 B 3.8.2-4 Revision No. 43
| |
| | |
| AC Sources - Shutdown B 3.8.2 BASES ACTIONS (continued) available. It is, therefore, required to suspend CORE ALTERATIONS, movement of irradiated fuel assemblies, and operations involving positive reactivity additions that could result in loss of required SDM (MODE 5) specified in LCO 3.1.1, "SHUTDOWN MARGIN (SDM)," or boron concentration (MODE 6) specified in LCO 3.9.1, "Boron Concentration."
| |
| Suspending positive reactivity additions that could result in failure to meet the minimum SDM or boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than that what would be required in the RCS for minimum SDM or refueling boron concentration.
| |
| This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation.
| |
| Introduction of temperature changes including temperature increases when operating with a positive moderator temperature coefficient (MTC) must also be evaluated to ensure they do not result in a loss of required SDM.
| |
| Suspension of these activities does not preclude completion of actions to establish a safe conservative condition. These actions minimize the probability or the occurrence of postulated events. It is further required to immediately initiate action to restore the required AC sources and to continue this action until restoration is accomplished in order to provide the necessary AC power to the unit safety systems.
| |
| The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required AC electrical power sources should be completed as quickly as possible in order to minimize the time during which the unit safety systems may be without sufficient power.
| |
| Pursuant to LCO 3.0.6, the Distribution System ACTIONS would not be entered even if all AC sources to it are inoperable, resulting in de-energization. Therefore, the Required Actions of Condition A are modified by a Note to indicate that when Condition A is entered with no AC power to any required emergency bus, the ACTIONS for LCO 3.8.10 must be immediately entered. This Note allows Condition A to provide requirements for the loss of the offsite circuit, whether or not a train is de-energized. LCO 3.8.10 would provide the appropriate restrictions for the situation involving a de-energized train.
| |
| Cook Nuclear Plant Unit 2 B 3.8.2-5 Revision No. 43
| |
| | |
| AC Sources - Shutdown B 3.8.2 SURVEILLANCE SR 3.8.2.1 REQUIREMENTS SR 3.8.2.1 requires the SRs from LCO 3.8.1 that are necessary for ensuring the OPERABILITY of the AC sources in other than MODES 1, 2, 3, and 4 to be applicable. SR 3.8.1.9 is not required to be met since the auxiliary source cannot power the Class 1E electrical power distribution subsystems unless the subsystems are being powered via backfeed through the main transformer, and since only one offsite circuit is required to be OPERABLE. If the Class 1E electrical power distribution subsystems are being powered by backfeed, SR 3.8.1.9.a or SR 3.8.1.9.b is implemented by SR 3.8.2.2. SR 3.8.1.13, SR 3.8.1.14 (ESF actuation signal portion only), SR 3.8.1.19, and SR 3.8.1.21 are not required to be met because the ESF actuation signal is not required to be OPERABLE.
| |
| SR 3.8.1.22 is excepted because starting independence is not required with the DG(s) that is not required to be OPERABLE. Refer to the corresponding Bases for LCO 3.8.1 for a discussion of each SR.
| |
| This SR is modified by a Note. The reason for the Note is to preclude requiring the OPERABLE DG(s) from being paralleled with the offsite power network or otherwise rendered inoperable during performance of SRs, and to preclude de-energizing a required emergency 4.16 kV emergency bus or disconnecting a required offsite circuit during performance of SRs. With limited AC sources available, a single event could compromise both the required circuit and the DG. It is the intent that these SRs must still be capable of being met, but actual performance is not required during periods when the DG and offsite circuit is required to be OPERABLE.
| |
| SR 3.8.2.2 SR 3.8.2.2 requires that SR 3.8.1.9.a or SR 3.8.1.9.b be met when the electrical distribution subsystem is being supplied by backfeed from an offsite source via the main transformer and a unit auxiliary transformer, i.e., the normal auxiliary circuit. SR 3.8.1.9.a and SR 3.8.1.9.b require, respectively, verification of the automatic transfer of each 4.16 kV emergency bus power supply from the normal auxiliary circuit to the preferred offsite circuit and verification of the manual alignment to the alternate required offsite circuit. These verifications demonstrate the OPERABILITY of the required offsite circuit to power the shutdown loads when the backfeed alignment is being used to supply the required electrical distribution subsystem.
| |
| REFERENCES None.
| |
| Cook Nuclear Plant Unit 2 B 3.8.2-6 Revision No. 76
| |
| | |
| Diesel Fuel Oil B 3.8.3 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.3 Diesel Fuel Oil BASES BACKGROUND Each diesel generator (DG) is provided with access to a storage tank.
| |
| There are two storage tanks for the site, shared between the two units.
| |
| Each storage tank supplies two DGs, one DG in each unit, as show in the UFSAR, Figure 8.4-1 (Ref. 1). Each storage tank has a fuel oil capacity sufficient to operate one DG for a period of 7 days while the DG is supplying maximum post loss of coolant accident load demand discussed in the UFSAR, Section 8.4 (Ref. 1). The maximum load demand is calculated using the assumption that a minimum of one DG is available.
| |
| This onsite fuel oil capacity is sufficient to operate the DG for longer than the time to replenish the onsite supply from outside sources.
| |
| Fuel oil is transferred from storage tank to day tank by either of two transfer pumps associated with each storage tank. Redundancy of pumps and piping precludes the failure of one pump, or the rupture of any pipe, valve or tank to result in the loss of more than one unit DG. All outside tanks and piping are located underground.
| |
| For proper operation of the standby DGs, it is necessary to ensure the proper quality of the fuel oil. Regulatory Guide 1.137 (Ref. 2) addresses the recommended fuel oil practices as supplemented by ANSI N195 (Ref. 3). The fuel oil properties governed by these SRs are the water and sediment content, the kinematic viscosity (or saybolt viscosity), specific gravity (or API gravity), and impurity level.
| |
| APPLICABLE The initial conditions of Design Basis Accident (DBA) and transient SAFETY analyses in the UFSAR, Chapter 14 (Ref. 4), assume Engineered Safety ANALYSES Feature (ESF) systems are OPERABLE. The DGs are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that fuel, Reactor Coolant System and containment design limits are not exceeded.
| |
| These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution Limits; Section 3.4, Reactor Coolant System (RCS);
| |
| and Section 3.6, Containment Systems.
| |
| Since diesel fuel oil subsystem supports the operation of the standby AC power sources, they satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| Cook Nuclear Plant Unit 2 B 3.8.3-1 Revision No. 67
| |
| | |
| Diesel Fuel Oil B 3.8.3 BASES LCO Stored diesel fuel oil in each storage tank is required to have sufficient supply for 7 days of full load operation of one DG. It is also required to meet specific standards for quality. This requirement, in conjunction with an ability to obtain replacement supplies within 7 days, supports the availability of DGs required to shut down the reactor and to maintain it in a safe condition for an anticipated operational transient or a postulated DBA with loss of offsite power. DG day tank fuel requirements, as well as transfer capability from the storage tank to the day tank, are addressed in LCO 3.8.1, "AC Sources - Operating," and LCO 3.8.2, "AC Sources - Shutdown."
| |
| APPLICABILITY The AC sources (LCO 3.8.1 and LCO 3.8.2) are required to ensure the availability of the required power to shut down the reactor and maintain it in a safe shutdown condition after an anticipated operational transient or a postulated DBA. Since stored diesel fuel oil supports LCO 3.8.1 and LCO 3.8.2, stored diesel fuel oil is required to be within limits when the associated DG is required to be OPERABLE.
| |
| ACTIONS The ACTIONS Table is modified by a Note indicating that separate Condition entry is allowed for each DG. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable DG subsystem. Complying with the Required Actions for one inoperable DG subsystem may allow for continued operation, and subsequent inoperable DG subsystem(s) are governed by separate Condition entry and application of associated Required Actions.
| |
| A.1 In this condition, the 7 day fuel oil supply for a DG is not available.
| |
| However, the Condition is restricted to fuel oil level reductions that maintain at least a 6 day supply. These circumstances may be caused by events, such as full load operation required after an inadvertent start while at minimum required level, or feed and bleed operations, which may be necessitated by increasing particulate levels or any number of other oil quality degradations. This restriction allows sufficient time for obtaining the requisite replacement volume and performing the analyses required prior to addition of fuel oil to the tank. A period of 48 hours is considered sufficient to complete restoration of the required level prior to declaring the DG inoperable. This period is acceptable based on the remaining capacity (> 6 days), the fact that procedures will be initiated to obtain replenishment, and the low probability of an event during this brief period.
| |
| Cook Nuclear Plant Unit 2 B 3.8.3-2 Revision No. 67
| |
| | |
| Diesel Fuel Oil B 3.8.3 BASES ACTIONS (continued)
| |
| B.1 This Condition is entered as a result of a failure to meet the acceptance criterion of SR 3.8.3.2. Normally, trending of particulate levels allows sufficient time to correct high particulate levels prior to reaching the limit of acceptability. Poor sample procedures (bottom sampling),
| |
| contaminated sampling equipment, and errors in laboratory analysis can produce failures that do not follow a trend. Since the presence of particulates does not mean failure of the fuel oil to burn properly in the diesel engine, and particulate concentration is unlikely to change significantly between Surveillance Frequency intervals, and proper engine performance has been recently demonstrated (within 31 days), it is prudent to allow a brief period prior to declaring the associated DG inoperable. The 7 day Completion Time allows for further evaluation, resampling and re-analysis of the DG fuel oil.
| |
| C.1 With the new fuel oil properties defined in the Bases for SR 3.8.3.2 not within the required limits, a period of 30 days is allowed for restoring the stored fuel oil properties. This period provides sufficient time to test the stored fuel oil to determine that the new fuel oil, when mixed with previously stored fuel oil, remains acceptable, or to restore the stored fuel oil properties. This restoration may involve feed and bleed procedures, filtering, or combinations of these procedures. Even if a DG start and load was required during this time interval and the fuel oil properties were outside limits, there is a high likelihood that the DG would still be capable of performing its intended function.
| |
| D.1 With a Required Action and associated Completion Time not met, or one or more DG's fuel oil subsystem not within limits for reasons other than addressed by Condition A, B, or C, the associated DG may be incapable of performing its intended function and must be immediately declared inoperable.
| |
| Cook Nuclear Plant Unit 2 B 3.8.3-3 Revision No. 0
| |
| | |
| Diesel Fuel Oil B 3.8.3 BASES SURVEILLANCE SR 3.8.3.1 REQUIREMENTS This SR provides verification that there is an adequate inventory of fuel oil in each storage tank to support one DGs operation for 7 days at full load.
| |
| The 7 day period is sufficient time to place the unit in a safe shutdown condition and to bring in replenishment fuel from an offsite location.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.8.3.2 The tests listed below are a means of determining whether new fuel oil is of the appropriate grade and has not been contaminated with substances that would have an immediate, detrimental impact on diesel engine combustion. If results from these tests are within acceptable limits, the fuel oil may be added to the storage tanks without concern for contaminating the entire volume of fuel oil in the storage tanks. These tests are to be conducted prior to adding the new fuel to the storage tank(s). The tests, limits, and applicable ASTM Standards are as follows:
| |
| : a. Sample the new fuel oil in accordance with ASTM D4057-81 (Ref. 5);
| |
| : b. Verify that the sample has: (1) when tested in accordance with ASTM D1298-80 (Ref. 5) an absolute specific gravity at 60/60°F of 0.82 and 0.88, an API gravity at 60°F of 30° and 40°, an API gravity of within 0.3 degrees at 60°F when compared to the suppliers certificate, or a specific gravity of within 0.0016 at 60/60° when compared to the suppliers certificate; (2) a kinematic viscosity at 40°C of 1.9 centistokes and 4.1 centistokes or Saybolt viscosity at 100°F of 32.6 and 40.1, if gravity was not determined by comparison with supplier's certification, when tested in accordance with ASTM 975-81 (Ref. 5); and (3) a flash point of 125°F when tested in accordance with ASTM D975-81 (Ref. 5); and
| |
| : c. Verify that the new fuel oil has a clear and bright appearance with proper color when tested in accordance with ASTM D4176-82 (Ref. 5).
| |
| Failure to meet any of the above limits is cause for rejecting the new fuel oil, but does not represent a failure to meet the LCO concern since the fuel oil is not added to the storage tanks.
| |
| Following the initial new fuel oil sample, the fuel oil is analyzed within 31 days following addition of the new fuel oil to the fuel oil storage tank(s) to establish that the other properties specified in Table 1 of Cook Nuclear Plant Unit 2 B 3.8.3-4 Revision No. 67
| |
| | |
| Diesel Fuel Oil B 3.8.3 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| ASTM D975-81 (Ref. 6) are met for new fuel oil when tested in accordance with ASTM D975-81 (Ref. 5), except that the analysis for sulfur may be performed in accordance with ASTM D2622-82 (Ref. 5).
| |
| The 31 day period is acceptable because the fuel oil properties of interest, even if they were not within stated limits, would not have an immediate effect on DG operation. This Surveillance ensures the availability of high quality fuel oil for the DGs.
| |
| Fuel oil degradation during long term storage shows up as an increase in particulate, due mostly to oxidation. The presence of particulate does not mean the fuel oil will not burn properly in a diesel engine. The particulate can cause fouling of filters and fuel oil injection equipment, however, which can cause engine failure.
| |
| Particulate concentrations should be determined in accordance with ASTM D2276-83, Method A (Ref. 5). This method involves a gravimetric determination of total particulate concentration in the fuel oil and has a limit of 10 mg/l. It is acceptable to obtain a field sample for subsequent laboratory testing in lieu of field testing.
| |
| The Frequency of this test takes into consideration fuel oil degradation trends that indicate that particulate concentration is unlikely to change significantly between Frequency intervals.
| |
| SR 3.8.3.3 Microbiological fouling is a major cause of fuel oil degradation. There are numerous bacteria that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive. Removal of water from the fuel storage tanks eliminates the necessary environment for bacterial survival. This is the most effective means of controlling microbiological fouling. In addition, it eliminates the potential for water entrainment in the fuel oil during DG operation. Water may come from any of several sources, including condensation, ground water, rain water, and contaminated fuel oil, and from breakdown of the fuel oil by bacteria.
| |
| Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system. The Surveillance Frequencies are established by Regulatory Guide 1.137 (Ref. 2). This SR is for preventive maintenance. The presence of water does not necessarily represent failure of this SR, provided the accumulated water is removed during performance of the Surveillance. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Cook Nuclear Plant Unit 2 B 3.8.3-5 Revision No. 60
| |
| | |
| Diesel Fuel Oil B 3.8.3 BASES REFERENCES 1. UFSAR, Section 8.4.
| |
| : 2. Regulatory Guide 1.137, October 1979.
| |
| : 3. ANSI N195-1976, Appendix B.
| |
| : 4. UFSAR, Chapter 14.
| |
| : 5. ASTM Standards: D4057-81 (Standard Practice for Manual Sampling of Petroleum and Petroleum Products), D1298-80 (Standard Test Method for Density, Relative Density (Specific Gravity), or API Gravity of Crude Petroleum and Liquid Petroleum Products by Hydrometer Method), D975-81 (Standard Specification for Diesel Fuel Oils), D4176-82 (Standard Test Method for Free Water and Particulate Contamination in Distillate Fuels (Visual Inspection Procedures)), D2622-82 (Standard Test Method for Sulfur in Petroleum Products by Wavelength Dispersive X-ray Fluorescence Spectrometry), and D2276-83 (Standard Test Method for Particulate Contaminant in Aviation Fuel by Line Sampling), Method A.
| |
| : 6. ASTM Standards, D975-81 (Standard Specification for Diesel Fuel Oils), Table 1.
| |
| Cook Nuclear Plant Unit 2 B 3.8.3-6 Revision No. 0
| |
| | |
| DC Sources - Operating B 3.8.4 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.4 DC Sources - Operating BASES BACKGROUND The DC electrical power system consists of the Train A and Train B 250 VDC electrical power subsystems and the Train N 250 VDC electrical power system. Unit 1 also has an identical set of DC electrical power subsystems. When the Essential Service Water (ESW) trains are not isolated from Unit 1 ESW trains, the associated Unit 1 Train A and Train B 250 VDC electrical power distribution subsystems are required to support Unit 2 ESW operation. The Train A and Train B 250 VDC electrical power system provides the AC emergency power system with control power. It also provides both motive and control power to selected safety related equipment and preferred AC vital bus power (via inverters).
| |
| The Train N 250 VDC electrical power subsystem provides a reliable source for power and control of the turbine driven auxiliary feedwater train. As required by Atomic Energy Commission Proposed General Design Criterion 39 and Safety Guide 6 (Ref. 1), the DC electrical power system is designed to have sufficient independence, redundancy, and testability to perform its safety functions, assuming a single failure.
| |
| The Trains A, B, and N 250 VDC electrical power subsystems are independent safety related Class 1E DC electrical power subsystems.
| |
| The Trains A and B 250 VDC electrical power subsystems are also redundant. Each subsystem consists of one full capacity 250 VDC battery, two battery chargers, and all the associated control equipment and interconnecting cabling supplying power to the associated bus within the train.
| |
| Each Train A and Train B 250 VDC source is obtained by use of one 250 VDC battery consisting of 116 lead acid cells connected in series.
| |
| The Train N 250 VDC source is obtained by use of one 250 VDC battery consisting of 117 lead acid cells connected in series. Additionally there is one standby battery charger per subsystem, which provides backup service in the event that the normal battery charger is out of service. If the standby battery charger is substituted for one of the normal battery chargers, the requirements of independence and redundancy between subsystems are maintained.
| |
| During normal operation, the Train A, Train B, or Train N 250 VDC load is powered from the associated battery charger with the battery floating on the system. In case of loss of normal power to the battery charger, the DC load is automatically powered from the associated batteries.
| |
| Cook Nuclear Plant Unit 2 B 3.8.4-1 Revision No. 3
| |
| | |
| DC Sources - Operating B 3.8.4 BASES BACKGROUND (continued)
| |
| The Train A and Train B DC electrical power subsystems provide control power for its associated Class 1E AC power load group, 4.16 kV, 600 V, and 480 V switchgear. The Train A and Train B 250 VDC electrical power subsystems also provide DC electrical power to the inverters, which in turn power the 120 VAC vital buses.
| |
| The DC power distribution system is described in more detail in Bases for LCO 3.8.9, "Distribution System - Operating," and LCO 3.8.10, "Distribution Systems - Shutdown."
| |
| Each 250 VDC battery is separately housed in a ventilated room apart from its charger and distribution centers. Each subsystem is located in an area separated physically and electrically from the other subsystem to ensure that a single failure in one subsystem does not cause a failure in a redundant subsystem. There is no sharing between redundant Class 1E DC electrical power subsystems.
| |
| Each Train A and Train B battery has adequate storage capacity to meet the duty cycle(s) discussed in the UFSAR, Section 8.3.4 (Ref. 4). The Train N 250 VDC battery has adequate storage capacity to meet the duty cycle(s) discussed in the UFSAR Section 8.3.6 (Ref. 5). Each battery is designed with additional capacity above that required by the design duty cycle to allow for temperature variations and other factors.
| |
| The batteries for Train A, Train B, and Train N DC electrical power subsystems are sized to produce required capacity at 80% of nameplate rating, corresponding to warranted capacity at end of life cycles and the 100% design demand. Also, the batteries are sized to provide the minimum required voltage for essential components in the system.
| |
| The battery cells are of flooded lead acid construction with a nominal specific gravity of 1.215. The open circuit voltage is the voltage maintained when there is no charging or discharging. Once fully charged with its open circuit voltage, the battery cell will maintain its capacity for some time without further charging per manufacturer's instructions.
| |
| Optimal long term performance however, is obtained by maintaining a float voltage 2.21 to 2.22 Vpc. This provides adequate over-potential, which limits the formation of lead sulfate and self discharge.
| |
| Each Train A, Train B, and Train N DC electrical power subsystem battery charger has ample power output capacity for the steady state operation of connected loads required during normal operation, while at the same time maintaining its battery bank fully charged. Each battery charger also has sufficient excess capacity to restore the battery from the design minimum Cook Nuclear Plant Unit 2 B 3.8.4-2 Revision No. 0
| |
| | |
| DC Sources - Operating B 3.8.4 BASES BACKGROUND (continued) charge to its fully charged state while supplying normal steady state loads discussed in the UFSAR, Sections 8.3.4 and 8.3.6 (Refs. 4 and 5).
| |
| Each required battery charger is normally in the float-charge mode.
| |
| Float-charge is the condition in which the charger is supplying the connected loads and the battery cells are receiving adequate current to optimally charge the battery. This assures the internal losses of a battery are overcome and the battery is maintained in a fully charged state.
| |
| When desired, the charger can be placed in the equalize mode. The equalize mode is at a higher voltage than the float mode and charging current is correspondingly higher. The battery charger is operated in the equalize mode after a battery discharge or for routine maintenance.
| |
| Following a battery discharge, the battery recharge characteristic accepts current at the current limit of the battery charger (if the discharge was significant, e.g., following a battery service test) until the battery terminal voltage approaches the charger voltage setpoint. Charging current then reduces exponentially during the remainder of the recharge cycle. For example, since lead-calcium batteries have nominal recharge efficiencies of greater than 95%, once at least 105% of the ampere-hours discharged have been returned, the battery capacity would be restored to the same condition as it was prior to the discharge. This can be monitored by direct observation of the exponentially decaying charging current or by evaluating the amp-hours discharged from the battery and amp-hours returned to the battery.
| |
| APPLICABLE The initial conditions of Design Basis Accident (DBA) and transient SAFETY analyses in the UFSAR, Chapter 14 (Ref. 6), assume that Engineered ANALYSES Safety Feature (ESF) systems are OPERABLE. The DC electrical power system provides normal and emergency DC electrical power for the DGs, emergency auxiliaries, and control and switching during all MODES of operation.
| |
| The OPERABILITY of the DC sources is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit. This includes maintaining the DC sources OPERABLE during accident conditions in the event of:
| |
| : a. An assumed loss of all offsite AC power or all onsite AC power; and
| |
| : b. A worst-case single failure.
| |
| The DC Sources - Operating satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| Cook Nuclear Plant Unit 2 B 3.8.4-3 Revision No. 0
| |
| | |
| DC Sources - Operating B 3.8.4 BASES LCO The DC electrical power subsystems - with a) each Train A and Train B 250 VDC subsystem consisting of one 250 VDC battery, one battery charger and the corresponding control equipment and interconnecting cabling supplying power to the associated bus within the train, b) the Train N 250 VDC subsystem consisting of one 250 VDC battery, one battery charger, and the corresponding control equipment and interconnecting cabling supplying power to the associated bus, and c) the required Unit 1 Train A and Train B 250 VDC electrical power subsystems capable of supplying the ESW System components when required by LCO 3.7.8, "Essential Service Water (ESW) System" each consisting of one 250 VDC battery, one battery charger and the corresponding control equipment and interconnecting cabling supplying power to the associated bus within the train are required to be OPERABLE to ensure the availability of the required power to shut down the reactor and maintain it in a safe condition after an anticipated operational transient or a postulated DBA. Loss of any train associated with the DC electrical power system does not prevent the minimum safety function from being performed (Ref. 7).
| |
| An OPERABLE DC electrical power subsystem requires a battery and one charger to be operating and connected to the associated DC bus.
| |
| APPLICABILITY Train A and Train B 250 VDC electrical power subsystems and the Unit 1 Train A and Train B DC electrical power subsystems are required to be OPERABLE in MODES 1, 2, 3, and 4 to ensure safe unit operation and to ensure that:
| |
| : a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of anticipated operational transients or abnormal transients; and
| |
| : b. Adequate core cooling is provided, and containment integrity and other vital functions are maintained in the event of a postulated DBA.
| |
| The Train N 250 VDC electrical power subsystem is required to be OPERABLE in MODES 1, 2, and 3 to support the turbine driven auxiliary feedwater train in the event that it is called upon to function when the Main Feedwater System is lost.
| |
| The DC electrical power requirements for MODES 5 and 6 and other conditions in which DC electrical power subsystems are required are addressed in the Bases for LCO 3.8.5, "DC Sources - Shutdown."
| |
| Cook Nuclear Plant Unit 2 B 3.8.4-4 Revision No. 0
| |
| | |
| DC Sources - Operating B 3.8.4 BASES ACTIONS A.1, A.2, and A.3 Condition A represents one required Train A or Train B battery charger inoperable (e.g., the voltage limit of SR 3.8.4.1 is not maintained). The ACTIONS provide a tiered response that focuses on returning the battery to the fully charged state and restoring a fully qualified charger to OPERABLE status in a reasonable time period. Required Action A.1 requires that the battery terminal voltage be restored to greater than or equal to the minimum established float voltage (specified in SR 3.8.4.1 Bases) within 2 hours. This time provides for returning the inoperable charger to OPERABLE status or providing an alternate means of restoring battery terminal voltage to greater than or equal to the minimum established float voltage. Restoring the battery terminal voltage to greater than or equal to the minimum established float voltage provides good assurance that, within 12 hours, the battery will be restored to its fully charged condition (Required Action A.2) from any discharge that might have occurred due to the charger inoperability.
| |
| A discharged battery having terminal voltage of at least the minimum established float voltage indicates that the battery is on the exponential charging current portion (the second part) of its recharge cycle. The time to return a battery to its fully charged state under this condition is simply a function of the amount of the previous discharge and the recharge characteristic of the battery. Thus there is good assurance of fully recharging the battery within 12 hours, avoiding a premature shutdown with its own attendant risk.
| |
| Required Action A.2 requires that the battery float current be verified as less than or equal to 2 amps. This indicates that, if the battery had been discharged as the result of the inoperable battery charger, it has now been fully recharged. If at the expiration of the initial 12 hour period the battery float current is not less than or equal to 2 amps this indicates there may be additional battery problems and ACTION C must be entered.
| |
| Required Action A.3 limits the restoration time for the inoperable battery charger to 7 days. This action is applicable if an alternate means of restoring battery terminal voltage to greater than or equal to the minimum established float voltage has been used (e.g., balance of plant non-Class 1E battery charger). The 7 day Completion Time reflects a reasonable time to effect restoration of the qualified battery charger to OPERABLE status.
| |
| Cook Nuclear Plant Unit 2 B 3.8.4-5 Revision No. 0
| |
| | |
| DC Sources - Operating B 3.8.4 BASES ACTIONS (continued)
| |
| B.1 Condition B represents one Train A or Train B 250 VDC electrical power subsystem with a loss of ability to completely respond to an event, and a potential loss of ability to remain energized during normal operation. It is therefore, imperative that the operator's attention focus on stabilizing the unit, minimizing the potential for complete loss of DC power to the affected train. The 2 hour limit is consistent with the allowed time for an inoperable DC electrical power distribution subsystem train.
| |
| If one of the Train A or Train B 250 VDC electrical power subsystems is inoperable for reasons other than Condition A (e.g., inoperable battery or inoperable battery charger and associated inoperable battery), the remaining DC electrical power subsystem has the capacity to support a safe shutdown and to mitigate an accident condition. Since a subsequent worst-case single failure could, however, result in the loss of minimum necessary DC electrical subsystems to mitigate a worst case accident, continued power operation should not exceed 2 hours. The 2 hour Completion Time is based on Regulatory Guide 1.93 (Ref. 8) and reflects a reasonable time to assess unit status as a function of the inoperable DC electrical power subsystem and, if the DC electrical power subsystem is not restored to OPERABLE status, to prepare to effect an orderly and safe unit shutdown.
| |
| C.1 and C.2 If any Required Action and associated Completion Time of Condition A or B is not met, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| The Completion Time to bring the unit to MODE 5 is consistent with the time required in Regulatory Guide 1.93 (Ref. 8).
| |
| D.1 If the Train N DC electrical power subsystem is inoperable, the Train N powered system is not capable of performing its intended function.
| |
| Immediately declaring the affected supported feature, e.g., the turbine driven AFW train, inoperable allows the ACTIONS of LCO 3.7.5, "Auxiliary Feedwater System (AFW)," to apply appropriate limitations on continued reactor operation.
| |
| Cook Nuclear Plant Unit 2 B 3.8.4-6 Revision No. 0
| |
| | |
| DC Sources - Operating B 3.8.4 BASES ACTIONS (continued)
| |
| E.1 If one or both required Unit 1 Train A and Train B DC electrical power subsystems are inoperable, the associated ESW train(s) are not capable of performing their intended function. Immediately declaring the affected supported feature, e.g., ESW train, inoperable allows the ACTIONS of LCO 3.7.8 to apply appropriate limitations on continued reactor operation.
| |
| SURVEILLANCE SR 3.8.4.1 REQUIREMENTS Verifying battery terminal voltage while on float charge for the batteries helps to ensure the effectiveness of the battery chargers, which support the ability of the batteries to perform their intended function. Float charge is the condition in which the charger is supplying the continuous charge required to overcome the internal losses of a battery and maintain the battery in a fully charged state while supplying the continuous steady state loads of the associated DC subsystem. On float charge, battery cells will receive adequate current to optimally charge the battery. The voltage requirements are based on the nominal design voltage of the battery and are consistent with the minimum float voltage established by the battery manufacturer (2.20 Vpc or 255.2 VDC at the battery terminals of the Train A and Train B batteries and 2.20 Vpc or 257.4 VDC for the Train N battery). This voltage maintains the battery plates in a condition that supports maintaining the grid life (expected to be approximately 20 years). The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.8.4.2 This SR verifies the design capacity of the battery chargers. According to Regulatory Guide 1.32 (Ref. 9), the battery charger supply is recommended to be based on the largest combined demands of the various steady state loads and the charging capacity to restore the battery from the design minimum charge state to the fully charged state, irrespective of the status of the unit during these demand occurrences.
| |
| The minimum required amperes and duration ensure that these requirements can be satisfied.
| |
| This SR requires that each Train A and Train B required battery charger be capable of supplying 300 amps at 250 VDC for 4 hours and the Train N battery charger is capable of supplying 25 amps at 250 VDC for 4 hours. The ampere requirements are based on the output rating of the chargers. The voltage requirements are based on the charger voltage Cook Nuclear Plant Unit 2 B 3.8.4-7 Revision No. 60
| |
| | |
| DC Sources - Operating B 3.8.4 BASES SURVEILLANCE REQUIREMENTS (continued) level after a response to a loss of AC power. The time period is sufficient to detect significant charger failures.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.8.4.3 A battery service test is a special test of the battery capability, as found, to satisfy the design requirements (battery duty cycle) of the DC electrical power system. The battery charger must be disconnected throughout the performance of the battery service test. The discharge rate and test length should correspond to the design duty cycle requirements as specified in the applicable design documents.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by two Notes. Note 1 allows the performance of a modified performance discharge test in lieu of a service test.
| |
| The reason for Note 2 is that performing the Surveillance would perturb the electrical distribution system and challenge safety systems. This restriction from normally performing the Surveillance in MODE 1, 2, 3, or 4 is further amplified to allow portions of the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial Surveillance, a successful partial Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a unit shutdown and startup to determine that unit safety is maintained or enhanced when portions of the Surveillance are performed in MODE 1, 2, 3, or 4. Risk insights or deterministic methods may be used for the assessment. Credit may be taken for unplanned events that satisfy this SR.
| |
| Cook Nuclear Plant Unit 2 B 3.8.4-8 Revision No. 60
| |
| | |
| DC Sources - Operating B 3.8.4 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.8.4.4 With the exception of this Surveillance, all other Surveillances of this Specification (SR 3.8.4.1 through 3.8.4.3) are applied to the Unit 2 DC sources. This Surveillance is provided to direct that appropriate Surveillances for the required Unit 1 DC sources are governed by the applicable Unit 1 Technical Specifications. Performance of the applicable opposite unit Surveillances will satisfy the opposite unit requirements as well as satisfy the given unit Surveillance Requirement.
| |
| The Frequency required by the applicable Unit 1 SR also governs performance of that SR for Unit 2.
| |
| As noted, when Unit 1 is in MODE 5 or 6, or moving irradiated fuel assemblies in the containment or auxiliary building, SR 3.8.4.3 is not required to be performed. This ensures that a Unit 2 SR will not require a Unit 1 SR to be performed, when Unit 1 Technical Specifications exempts performance of a Unit 1 SR (however, as stated in the Unit 1 SR 3.8.5.1 Bases, while performance of an SR is exempted, the SR must still be met).
| |
| REFERENCES 1. Atomic Energy Commission Proposed General Design Criterion 39, July 1967, and Safety Guide 6.
| |
| : 2. Not Used.
| |
| : 3. Not Used.
| |
| : 4. UFSAR, Section 8.3.4.
| |
| : 5. UFSAR, Section 8.3.6.
| |
| : 6. UFSAR, Chapter 14.
| |
| : 7. UFSAR, Section 8.5.
| |
| : 8. Regulatory Guide 1.93, December 1974.
| |
| : 9. IEEE-450-2010.
| |
| : 10. Regulatory Guide 1.32, February 1977.
| |
| Cook Nuclear Plant Unit 2 B 3.8.4-9 Revision No. 68
| |
| | |
| DC Sources - Shutdown B 3.8.5 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.5 DC Sources - Shutdown BASES BACKGROUND A description of the DC sources is provided in the Bases for LCO 3.8.4, "DC Sources - Operating."
| |
| APPLICABLE The initial conditions of Design Basis Accident (DBA) and transient SAFETY analyses in the UFSAR, Chapter 14 (Ref. 1), assume that Engineered ANALYSES Safety Feature systems are OPERABLE. The DC electrical power system provides normal and emergency DC electrical power for the diesel generators, emergency auxiliaries, and control and switching during all MODES of operation.
| |
| The OPERABILITY of the DC subsystems is consistent with the initial assumptions of the accident analyses and the requirements for the supported systems' OPERABILITY.
| |
| The OPERABILITY of the minimum DC electrical power sources during MODES 5 and 6 and during movement of irradiated fuel assemblies in the containment, auxiliary building, and Unit 1 containment ensures that:
| |
| : a. The unit can be maintained in the shutdown or refueling condition for extended periods;
| |
| : b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and
| |
| : c. Adequate DC electrical power is provided to mitigate events postulated during shutdown, such as a fuel handling accident.
| |
| In general, when the unit is shut down, the Technical Specifications requirements ensure that the unit has the capability to mitigate the consequences of postulated accidents. However, assuming a single failure and concurrent loss of all offsite or all onsite power is not required.
| |
| The rationale for this is based on the fact that many Design Basis Accidents (DBAs) that are analyzed in MODES 1, 2, 3, and 4 have no specific analyses in MODES 5 and 6 because the energy contained within the reactor pressure boundary, reactor coolant temperature and pressure, and the corresponding stresses result in the probabilities of occurrence being significantly reduced or eliminated, and in minimal consequences.
| |
| These deviations from DBA analysis assumptions and design requirements during shutdown conditions are allowed by the LCO for required systems.
| |
| The shutdown Technical Specification requirements are designed to ensure that the unit has the capability to mitigate the consequences of Cook Nuclear Plant Unit 2 B 3.8.5-1 Revision No. 0
| |
| | |
| DC Sources - Shutdown B 3.8.5 BASES APPLICABLE SAFETY ANALYSES (continued) certain postulated accidents. Worst case DBAs which are analyzed for operating MODES are generally viewed not to be a significant concern during shutdown MODES due to the lower energies involved. The Technical Specifications therefore require a lesser complement of electrical equipment to be available during shutdown than is required during operating MODES. More recent work completed on the potential risks associated with shutdown, however, have found significant risk associated with certain shutdown evolutions. As a result, in addition to the requirements established in the Technical Specifications, the industry has adopted NUMARC 91-06, "Guidelines for Industry Actions to Assess Shutdown Management," as an Industry initiative to manage shutdown tasks and associated electrical support to maintain risk at an acceptable low level. This may require the availability of additional equipment beyond that required by the shutdown Technical Specifications.
| |
| DC Sources - Shutdown satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The Train A or Train B 250 VDC electrical power subsystem, consisting of one battery, one battery charger, and the corresponding control equipment and interconnecting cabling, is required to be OPERABLE to support one train of the distribution subsystem(s) required OPERABLE by LCO 3.8.10, "Distribution Systems - Shutdown." This ensures the availability of sufficient DC electrical power sources to operate the unit in a safe manner and to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents).
| |
| APPLICABILITY The DC electrical power sources required to be OPERABLE in MODES 5 and 6, and during movement of irradiated fuel assemblies in the containment, auxiliary building, and Unit 1 containment, provide assurance that:
| |
| : a. Required features to provide adequate coolant inventory makeup are available for the irradiated fuel assemblies in the core;
| |
| : b. Required features needed to mitigate a fuel handling accident are available;
| |
| : c. Required features necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and
| |
| : d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.
| |
| The DC electrical power requirements for MODES 1, 2, 3, and 4 are covered in LCO 3.8.4.
| |
| Cook Nuclear Plant Unit 2 B 3.8.5-2 Revision No. 0
| |
| | |
| DC Sources - Shutdown B 3.8.5 BASES ACTIONS LCO 3.0.3 is not applicable while in MODE 5 or 6. However, since irradiated fuel assembly movement can occur in MODE 1, 2, 3, or 4, the ACTIONS have been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 5 or 6, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1, 2, 3, or 4, the fuel movement is independent of reactor operations. Entering LCO 3.0.3, while in MODE 1, 2, 3, or 4 would require the unit to be shutdown unnecessarily.
| |
| A.1, A.2, A.3, and A.4 With the required Train A or Train B 250 VDC electrical power subsystem inoperable, the minimum required DC power sources are not available.
| |
| Therefore, suspension of CORE ALTERATIONS, movement of irradiated fuel assemblies, and operations involving positive reactivity additions that could result in loss of required SDM (MODE 5) specified in LCO 3.1.1, "SHUTDOWN MARGIN (SDM)," or boron concentration (MODE 6) specified in LCO 3.9.1, "Boron Concentration," is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than that what would be required in the Reactor Coolant System (RCS) for minimum SDM or refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. Introduction of temperature changes including temperature increases when operating with a positive Moderator Temperature Coefficient (MTC) must also be evaluated to ensure they do not result in a loss of required SDM.
| |
| Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition. These actions minimize probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required DC electrical power subsystem and to continue this action until restoration is accomplished in order to provide the necessary DC electrical power to the unit safety systems.
| |
| The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required DC electrical power subsystems should be completed as quickly as possible in order to minimize the time during which the unit safety systems may be without sufficient power.
| |
| Cook Nuclear Plant Unit 2 B 3.8.5-3 Revision No. 0
| |
| | |
| DC Sources - Shutdown B 3.8.5 BASES SURVEILLANCE SR 3.8.5.1 REQUIREMENTS SR 3.8.5.1 requires performance of all Surveillances required by SR 3.8.4.1 through SR 3.8.4.3. Therefore, see the corresponding Bases for LCO 3.8.4 for a discussion of each SR.
| |
| This SR is modified by a Note. The reason for the Note is to preclude requiring the OPERABLE DC sources from being discharged below their capability to provide the required power supply or otherwise rendered inoperable during the performance of SRs. It is the intent that this SR must still be capable of being met, but actual performance is not required.
| |
| REFERENCES 1. UFSAR, Chapter 14.
| |
| Cook Nuclear Plant Unit 2 B 3.8.5-4 Revision No. 0
| |
| | |
| Battery Parameters B 3.8.6 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.6 Battery Parameters BASES BACKGROUND This LCO delineates the limits on battery float current as well as cell electrolyte temperature, level, and float voltage for the DC electrical power subsystem batteries. A discussion of these batteries and their OPERABILITY requirements is provided in the Bases for LCO 3.8.4, "DC Sources - Operating," and LCO 3.8.5, "DC Sources - Shutdown." In addition to the limitations of this Specification, the Battery Monitoring and Maintenance Program also implements a program specified in Specification 5.5.15 for monitoring various battery parameters that is based on the recommendations of IEEE Standard 450-2010, "IEEE Recommended Practice For Maintenance, Testing, And Replacement Of Vented Lead-Acid Batteries For Stationary Applications" (Ref. 1).
| |
| The battery cells are of flooded lead acid construction with a nominal specific gravity of 1.215. The open circuit voltage is the voltage maintained when there is no charging or discharging. Once fully charged with its open circuit voltage, the battery cell will maintain its capacity for some time without further charging per manufacturer's instructions.
| |
| Optimal long term performance however, is obtained by maintaining a float voltage 2.21 to 2.22 Vpc. This provides adequate over-potential which limits the formation of lead sulfate and self discharge.
| |
| APPLICABLE The initial conditions of Design Basis Accident (DBA) and transient SAFETY analyses in the UFSAR, Chapter 14 (Ref. 2), assume Engineered Safety ANALYSES Feature systems are OPERABLE. The DC electrical power system provides normal and emergency DC electrical power for the DGs, emergency auxiliaries, and control and switching during all MODES of operation.
| |
| The specific Applicable Safety Analyses for the DC Electrical Power System are provided in the Bases for LCO 3.8.4 and LCO 3.8.5.
| |
| Battery Parameters satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO Battery parameters must remain within acceptable limits to ensure availability of the required DC power to shut down the reactor and maintain it in a safe condition after an anticipated operational transient or a postulated DBA. Battery parameter limits are conservatively established, allowing continued DC electrical system function even with limits not met. Additional preventative maintenance, testing, and monitoring performed in accordance with the Battery Monitoring and Maintenance Program is conducted as specified in Specification 5.5.15.
| |
| Cook Nuclear Plant Unit 2 B 3.8.6-1 Revision No. 68
| |
| | |
| Battery Parameters B 3.8.6 BASES APPLICABILITY The battery parameters are required solely for the support of the associated DC electrical power subsystems. Therefore, battery parameter limits are only required when the DC electrical power subsystem is required to be OPERABLE. Refer to the Applicability discussion in Bases for LCO 3.8.4 and LCO 3.8.5.
| |
| ACTIONS A.1, A.2, and A.3 With one or more cells in one or more batteries < 2.07 V, the battery cell is degraded. Within 2 hours verification of the required battery charger OPERABILITY is made by monitoring the battery terminal voltage (SR 3.8.4.1) and of the overall battery state of charge by monitoring the battery float charge current (SR 3.8.6.1). This assures that there is still sufficient battery capacity to perform the intended function. Therefore, the affected battery is not required to be considered inoperable solely as a result of one or more cells in one or more batteries < 2.07 V, and continued operation is permitted for a limited period up to 24 hours.
| |
| Since the Required Actions only specify "perform," a failure of SR 3.8.4.1 or SR 3.8.6.1 acceptance criteria does not result in this Required Action not met. However, if one of the SRs is failed the appropriate Condition(s),
| |
| depending on the cause of the failures, is entered. If SR 3.8.6.1 is failed then there is not assurance that there is still sufficient battery capacity to perform the intended function and the battery must be declared inoperable immediately.
| |
| B.1 and B.2 One or more batteries with float current > 2 amps indicates that a partial discharge of the battery capacity has occurred. This may be due to a temporary loss of a battery charger or possibly due to one or more battery cells in a low voltage condition reflecting some loss of capacity. Within 2 hours verification of the required battery charger OPERABILITY is made by monitoring the battery terminal voltage. If the terminal voltage is found to be less than the minimum established float voltage there are two possibilities, the battery charger is inoperable or is operating in the current limit mode. If the charger is operating in the current limit mode after 2 hours that is an indication that the battery has been substantially discharged and likely cannot perform its required design functions. The time to return the battery to its fully charged condition in this case is a function of the battery charger capacity, the amount of loads on the associated DC system, the amount of the previous discharge, and the recharge characteristic of the battery. The charge time can be extensive, and there is not adequate assurance that it can be recharged within 12 hours (Required Action B.2). The battery must therefore be declared inoperable.
| |
| Cook Nuclear Plant Unit 2 B 3.8.6-2 Revision No. 0
| |
| | |
| Battery Parameters B 3.8.6 BASES ACTIONS (continued)
| |
| If the float voltage is found to be satisfactory there is good assurance that, within 12 hours, the battery will be restored to its fully charged condition (Required Action B.2) from any discharge that might have occurred due to a temporary loss of the battery charger.
| |
| A discharged battery with float voltage (the charger setpoint) across its terminals indicates that the battery is on the exponential charging current portion (the second part) of its recharge cycle. The time to return a battery to its fully charged state under this condition is simply a function of the amount of the previous discharge and the recharge characteristic of the battery. Thus there is good assurance of fully recharging the battery within 12 hours, avoiding a premature shutdown with its own attendant risk.
| |
| If the condition is due to one or more cells in a low voltage condition but still greater than 2.07 V and float voltage is found to be satisfactory, this is not indication of a substantially discharged battery and 12 hours is a reasonable time prior to declaring the battery inoperable.
| |
| Since Required Action B.1 only specifies "perform," a failure of SR 3.8.4.1 acceptance criteria does not result in the Required Action not met.
| |
| However, if SR 3.8.4.1 is failed, the appropriate Condition(s), depending on the cause of the failure, is entered.
| |
| C.1, C.2, and C.3 With one or more batteries with one or more cells electrolyte level above the top of the plates, but below the minimum established design limits, the battery still retains sufficient capacity to perform the intended function.
| |
| Therefore, the affected battery is not required to be considered inoperable solely as a result of electrolyte level not met. Within 31 days the minimum established design limits for electrolyte level must be re-established.
| |
| With electrolyte level below the top of the plates there is a potential for dryout and plate degradation. Required Actions C.1 and C.2 address this potential (as well as provisions in Specification 5.5.15, "Battery Monitoring and Maintenance Program"). They are modified by a Note that indicates they are only applicable if electrolyte level is below the top of the plates.
| |
| Within 8 hours level is required to be restored to above the top of the plates. The Required Action C.2 requirement to verify that there is no leakage by visual inspection and the Specification 5.5.15.b item to initiate action to equalize and test in accordance with manufacturer's recommendation are taken from Annex D of IEEE Standard 450-2010.
| |
| Cook Nuclear Plant Unit 2 B 3.8.6-3 Revision No. 68
| |
| | |
| Battery Parameters B 3.8.6 BASES ACTIONS (continued)
| |
| They are performed following the restoration of the electrolyte level to above the top of the plates. Based on the results of the manufacturer's recommended testing the batteries may have to be declared inoperable and the affected cells replaced.
| |
| D.1 With one or more batteries with pilot cell temperature less than the minimum established design limits, 12 hours is allowed to restore the temperature to within limits. A low electrolyte temperature limits the current and power available. Since the battery is sized with margin, while battery capacity is degraded, there is reasonable assurance that sufficient capacity exists to perform the intended function and the affected battery is not required to be considered inoperable solely as a result of the pilot cell temperature not met. However, pilot cell temperature must be restored within 12 hours or the battery shall be declared inoperable in accordance with Condition F.
| |
| E.1 With batteries in redundant trains with battery parameters not within limits there is not sufficient assurance that battery capacity has not been affected to the degree that the batteries can still perform their required function, given that redundant batteries are involved. With redundant batteries involved this potential could result in a total loss of function on multiple systems that rely upon the batteries. The longer Completion Times specified for battery parameters on non-redundant batteries not within limits are therefore not appropriate, and the parameters must be restored to within limits on at least one train within 2 hours.
| |
| F.1 With one or more batteries with any battery parameter outside the allowances of the Required Actions for Condition A, B, C, D, or E, or failure of the battery performance discharge test (SR 3.8.6.6), sufficient capacity to supply the maximum expected load requirement is not assured and the corresponding battery must be declared inoperable.
| |
| Additionally, discovering one or more batteries in one train with one or more battery cells float voltage less than 2.07 V and float current greater than 2 amps indicates that the battery capacity may not be sufficient to perform the intended functions. The battery must therefore be declared inoperable immediately.
| |
| Cook Nuclear Plant Unit 2 B 3.8.6-4 Revision No. 3
| |
| | |
| Battery Parameters B 3.8.6 BASES SURVEILLANCE SR 3.8.6.1 REQUIREMENTS Verifying battery float current while on float charge is used to determine the state of charge of the battery. Float charge is the condition in which the charger is supplying the continuous charge required to overcome the internal losses of a battery and maintain the battery in a charged state.
| |
| The float current requirements are based on the float current indicative of a charged battery. Use of float current to determine the state of charge of the battery is consistent with IEEE-450 (Ref. 1). The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by a Note that states the float current requirement is not required to be met when battery terminal voltage is less than the minimum established float voltage of SR 3.8.4.1. When this float voltage is not maintained the Required Actions of LCO 3.8.4 ACTION A are being taken, which provide the necessary and appropriate verifications of the battery condition. Furthermore, the float current limit of 2 amps is established based on the nominal float voltage value and is not directly applicable when this voltage is not maintained.
| |
| SR 3.8.6.2 and SR 3.8.6.5 Optimal long term battery performance is obtained by maintaining a float voltage greater than or equal to the minimum established design limits provided by the battery manufacturer, which corresponds to 257.5 VDC for a 116 cell battery and 259.7 VDC for a 117 cell battery at the battery terminals, or 2.22 Vpc. This provides adequate over-potential, which limits the formation of lead sulfate and self discharge, which could eventually render the battery inoperable. Float voltages in this range or less, but greater than 2.07 Vpc, are addressed in Specification 5.5.15.
| |
| SRs 3.8.6.2 and 3.8.6.5 require verification that the cell float voltages are equal to or greater than the short term absolute minimum voltage of 2.07 V. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.8.6.3 The limit specified for electrolyte level (i.e., greater than or equal to the low level mark) ensures that the plates suffer no physical damage and maintains adequate electron transfer capability. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Cook Nuclear Plant Unit 2 B 3.8.6-5 Revision No. 60
| |
| | |
| Battery Parameters B 3.8.6 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.8.6.4 This Surveillance verifies that the pilot cell temperature is greater than or equal to the minimum established design limit (i.e., 60°F for the Train A and Train B 250 VDC batteries and 45°F for the Train N 250 VDC battery). Pilot cell electrolyte temperature is maintained above this temperature to assure the battery can provide the required current and voltage to meet the design requirements. Temperatures lower than assumed in battery sizing calculations act to inhibit or reduce battery capacity. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.8.6.6 A battery performance discharge test is a test of constant current capacity of a battery, normally done in the as found condition, after having been in service, to detect any change in the capacity determined by the acceptance test. The test is intended to determine overall battery degradation due to age and usage.
| |
| Either the battery performance discharge test or the modified performance discharge test is acceptable for satisfying SR 3.8.6.6; however, only the modified performance discharge test may be used to satisfy the battery service test requirements of SR 3.8.4.3.
| |
| A modified discharge test is a test of the battery capacity and its ability to provide a high rate, short duration load (usually the highest rate of the duty cycle). This will often confirm the battery's ability to meet the critical period of the load duty cycle, in addition to determining its percentage of rated capacity. Initial conditions for the modified performance discharge test should be as specified in IEEE-450 (Ref. 1).
| |
| It may consist of just two rates; for instance the one minute rate for the battery or the largest current load of the duty cycle, followed by the test rate employed for the performance test, both of which envelope the duty cycle of the service test. Since the ampere-hours removed by a one minute discharge represents a very small portion of the battery capacity, the test rate can be changed to that for the modified performance discharge test without compromising the results of the performance discharge test. The battery terminal voltage for the modified performance discharge test must remain above the minimum battery terminal voltage specified in the battery service test for the duration of time equal to that of the service test. Currently, the modified performance discharge test is performed by testing the battery using the service test profile for the first 4 hours followed by the performance discharge test profile for the Cook Nuclear Plant Unit 2 B 3.8.6-6 Revision No. 68
| |
| | |
| Battery Parameters B 3.8.6 BASES SURVEILLANCE REQUIREMENTS (continued) remainder of the test. This method has been determined by the system engineer and the battery manufacturer to be an acceptable modified performance test procedure, and is consistent with IEEE-450 (Ref. 1).
| |
| The acceptance criteria for this Surveillance are consistent with IEEE-450 (Ref. 1) and IEEE-485 (Ref. 3). These references recommend that the battery be replaced if its capacity is below 80% of the manufacturer's rating. A capacity of 80% shows that the battery rate of deterioration is increasing, even if there is ample capacity to meet the load requirements.
| |
| Furthermore, the battery is sized to meet the assumed duty cycle loads when the battery design capacity reaches this 80% limit.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. If the battery shows degradation, or if the battery has reached 85% of its expected life and capacity is < 100% of the manufacturer's rating, the Surveillance Frequency is reduced to 12 months. However, if the battery shows no degradation but has reached 85% of its expected life, the Surveillance Frequency is only reduced to 24 months for batteries that retain capacity 100% of the manufacturer's ratings. Degradation is indicated, according to IEEE-450 (Ref. 1), when the battery capacity drops by more than 10% relative to its capacity on the previous performance test or when it is below 90% of the manufacturer's rating. The 12 month and 24 month Frequencies are consistent with the recommendations in IEEE-450 (Ref. 1). For batteries that are not degraded, and at less than 85% of expected service life, the Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by a Note. The reason for the Note is that performing the Surveillance would perturb the electrical distribution system and challenge safety systems. This restriction from normally performing the Surveillance in MODE 1, 2, 3, or 4 is further amplified to allow portions of the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines unit safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial Surveillance, a successful partial Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial Surveillance; as well as the operator procedures available to cope with these outcomes.
| |
| These shall be measured against the avoided risk of a unit shutdown and startup to determine that unit safety is maintained or enhanced when portions of the Surveillance are performed in MODE 1, 2, 3 or 4. Risk Cook Nuclear Plant Unit 2 B 3.8.6-7 Revision No. 68
| |
| | |
| Battery Parameters B 3.8.6 BASES SURVEILLANCE REQUIREMENTS (continued) insights or deterministic methods may be used for the assessment.
| |
| Credit may be taken for unplanned events that satisfy this SR.
| |
| REFERENCES 1. IEEE-450-2010.
| |
| : 2. UFSAR, Chapter 14.
| |
| : 3. IEEE-485-1997.
| |
| Cook Nuclear Plant Unit 2 B 3.8.6-8 Revision No. 68
| |
| | |
| Inverters - Operating B 3.8.7 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.7 Inverters - Operating BASES BACKGROUND The inverters are the preferred source of power for the 120 VAC vital bus electrical power distribution subsystems because of the stability and reliability they achieve. The function of each inverter is to provide 120 VAC electrical power to the associated 120 VAC vital bus. There are two inverters per train (i.e., Train A and Train B), for a total of four inverters. The 120 VAC vital bus can be powered from a Train A or Train B 250 VDC bus through an inverter or from a regulated 600/120 VAC transformer. Each inverter is normally supplied from the Train A or Train B 250 VDC bus. If the associated Train A or Train B 250 VDC bus fails or if the DC to AC section of the inverter cabinet fails, the AC vital bus is transferred to the regulated 600/120 VAC transformer.
| |
| The inverter provides an uninterruptible power source for the instrumentation and controls for the Reactor Trip System (RTS) and the Engineered Safety Feature Actuation System (ESFAS). Specific details on inverters and their operating characteristics are found in the UFSAR, Chapter 8 (Ref. 1).
| |
| APPLICABLE The initial conditions of Design Basis Accident (DBA) and transient SAFETY analyses in UFSAR Chapter 14 (Ref. 2), assume Engineered Safety ANALYSES Feature systems are OPERABLE. The inverters are designed to provide the required capacity, capability, redundancy, and reliability to ensure the availability of necessary power to the RTS and ESFAS instrumentation and controls so that the fuel, Reactor Coolant System, and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution Limits; Section 3.4, Reactor Coolant System (RCS); and Section 3.6, Containment Systems.
| |
| The OPERABILITY of the inverters is consistent with the initial assumptions of the accident analyses and is based on meeting the design basis of the unit. This includes maintaining required 120 VAC vital buses OPERABLE during accident conditions in the event of:
| |
| : a. An assumed loss of all offsite AC electrical power or all onsite AC electrical power; and
| |
| : b. A worst case single failure.
| |
| Inverters are a part of the electrical power distribution system and, as such, Inverters - Operating satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| Cook Nuclear Plant Unit 2 B 3.8.7-1 Revision No. 3
| |
| | |
| Inverters - Operating B 3.8.7 BASES LCO The inverters ensure the availability of 120 VAC electrical power for the systems instrumentation required to shut down the reactor and maintain it in a safe condition after an anticipated operational transient or a postulated DBA.
| |
| Maintaining the required inverters OPERABLE ensures that the redundancy incorporated into the design of the RTS and ESFAS instrumentation and controls is maintained. The four inverters (two per train) ensure an uninterruptible supply of 120 VAC electrical power to the 120 VAC vital buses even if the 4.16 kV emergency buses are de-energized.
| |
| OPERABLE inverters require the associated vital bus to be powered by the inverter with output voltage and frequency within tolerances, and power input to the inverter from a Train A or Train B 250 VDC bus.
| |
| APPLICABILITY The inverters are required to be OPERABLE in MODES 1, 2, 3, and 4 to ensure that:
| |
| : a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of anticipated operational transients or abnormal transients; and
| |
| : b. Adequate core cooling is provided, and containment OPERABILITY and other vital functions are maintained in the event of a postulated DBA.
| |
| Inverter requirements for MODES 5 and 6 and other conditions in which the inverters are required are covered in the Bases for LCO 3.8.8, "Inverters - Shutdown."
| |
| ACTIONS A.1 With a Train A or Train B inverter inoperable, its associated 120 VAC vital bus becomes inoperable until it is re-energized from its regulated 600/120 VAC transformer via the static transfer switch or manual bypass switch of the inverter cabinet. LCO 3.8.9, "Distribution Systems - Operating" addresses this action however, pursuant to LCO 3.0.6, this action would not be entered even if the 120 VAC vital bus were de-energized. For this reason a Note has been included in Condition A requiring the entry into the Conditions and Required Actions of LCO 3.8.9. This ensures that proper action for a de-energized 120 VAC vital bus is taken.
| |
| Required Action A.1 allows 24 hours to fix the inoperable inverter and return it to service. The 24 hour limit is based upon engineering judgment, taking into consideration the time required to repair an inverter and the additional risk to which the unit is exposed because of the Cook Nuclear Plant Unit 2 B 3.8.7-2 Revision No. 3
| |
| | |
| Inverters - Operating B 3.8.7 BASES ACTIONS (continued) inverter inoperability. This has to be balanced against the risk of an immediate shutdown, along with the potential challenges to safety systems such a shutdown might entail. When the 120 VAC vital bus is powered from its regulated 600/120 VAC transformer, it is relying upon interruptible AC electrical power sources (offsite and onsite). The uninterruptible inverter source to the 120 VAC vital buses is the preferred source for powering instrumentation trip setpoint devices.
| |
| B.1 With two inverters in the same train inoperable, the remaining inverters are capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe condition, assuming no single failure. The overall reliability is reduced, however, because a single failure in one of the two remaining inverters could result in the minimum ESF functions not being supported. Therefore, one of the inverters must be restored to OPERABLE status within 6 hours.
| |
| The 6 hour Completion Time is consistent with that allowed for an inoperable RTS train and an inoperable ESFAS train, since the inverters support the 120 VAC vital buses, which in turn support the RTS and ESFAS trains.
| |
| C.1 and C.2 If the Train A or Train B inverter(s) cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| SURVEILLANCE SR 3.8.7.1 REQUIREMENTS This Surveillance verifies that the inverters are functioning properly with all required circuit breakers closed and the 120 VAC vital buses energized from the associated inverter. Each inverter must be connected to its associated 250 VDC bus. The verification of proper voltage and frequency output ensures that the required power is readily available for the instrumentation of the RTS and ESFAS connected to the 120 VAC vital buses. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Cook Nuclear Plant Unit 2 B 3.8.7-3 Revision No. 60
| |
| | |
| Inverters - Operating B 3.8.7 BASES REFERENCES 1. UFSAR, Chapter 8.
| |
| : 2. UFSAR, Chapter 14.
| |
| Cook Nuclear Plant Unit 2 B 3.8.7-4 Revision No. 0
| |
| | |
| Inverters - Shutdown B 3.8.8 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.8 Inverters - Shutdown BASES BACKGROUND A description of the inverters is provided in the Bases for LCO 3.8.7, "Inverters - Operating."
| |
| APPLICABLE The initial conditions of Design Basis Accident (DBA) and transient SAFETY analyses in UFSAR Chapter 14 (Ref. 1), assume Engineered Safety ANALYSES Feature systems are OPERABLE. The DC to AC inverters are designed to provide the required capacity, capability, redundancy, and reliability to ensure the availability of necessary power to the Reactor Trip System and Engineered Safety Features Actuation System instrumentation and controls so that the fuel, Reactor Coolant System (RCS), and containment design limits are not exceeded.
| |
| The OPERABILITY of the inverters is consistent with the initial assumptions of the accident analyses and the requirements for the supported systems' OPERABILITY.
| |
| The OPERABILITY of two inverters to the required 120 AC vital bus during MODES 5 and 6 and during the movement of irradiated fuel assemblies in the containment, auxiliary building, and Unit 1 containment ensures that:
| |
| : a. The unit can be maintained in the shutdown or refueling condition for extended periods;
| |
| : b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and
| |
| : c. Adequate power is available to mitigate events postulated during shutdown, such as a fuel handling accident.
| |
| In general, when the unit is shut down, the Technical Specifications requirements ensure that the unit has the capability to mitigate the consequences of postulated accidents. However, assuming a single failure and concurrent loss of all offsite or all onsite power is not required.
| |
| The rationale for this is based on the fact that many DBAs that are analyzed in MODES 1, 2, 3, and 4 have no specific analyses in MODES 5 and 6 because the energy contained within the reactor pressure boundary, reactor coolant temperature and pressure, and the corresponding stresses result in the probabilities of occurrence being significantly reduced or eliminated, and in minimal consequences. These deviations from DBA analysis assumptions and design requirements during shutdown conditions are allowed by the LCO for required systems.
| |
| Cook Nuclear Plant Unit 2 B 3.8.8-1 Revision No. 0
| |
| | |
| Inverters - Shutdown B 3.8.8 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| The shutdown Technical Specification requirements are designed to ensure that the unit has the capability to mitigate the consequences of certain postulated accidents. Worst case DBAs which are analyzed for operating MODES are generally viewed not to be a significant concern during shutdown MODES due to the lower energies involved. The Technical Specifications therefore require a lesser complement of electrical equipment to be available during shutdown than is required during operating MODES. More recent work completed on the potential risks associated with shutdown, however, have found significant risk associated with certain shutdown evolutions. As a result, in addition to the requirements established in the Technical Specifications, the industry has adopted NUMARC 91-06, "Guidelines for Industry Actions to Assess Shutdown Management," as an Industry initiative to manage shutdown tasks and associated electrical support to maintain risk at an acceptable low level. This may require the availability of additional equipment beyond that required by the shutdown Technical Specifications.
| |
| The inverters were previously identified as part of the electrical power distribution system and, as such, Inverters - Shutdown satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The inverters ensure the availability of electrical power for the instrumentation for systems required to shut down the reactor and maintain it in a safe condition after an anticipated operational transient or a postulated DBA. The battery powered inverters provide uninterruptible supply of AC electrical power to the 120 VAC vital buses even if the 4.16 kV emergency buses are de-energized. OPERABILITY of the inverters requires that the 120 VAC vital bus be powered by the inverter.
| |
| This ensures the availability of sufficient inverter power sources to operate the unit in a safe manner and to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents).
| |
| APPLICABILITY The inverters required to be OPERABLE in MODES 5 and 6 and during movement of irradiated fuel assemblies in the containment, auxiliary building, and Unit 1 containment provide assurance that:
| |
| : a. Systems to provide adequate coolant inventory makeup are available for the irradiated fuel in the core;
| |
| : b. Systems needed to mitigate a fuel handling accident are available;
| |
| : c. Systems necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and Cook Nuclear Plant Unit 2 B 3.8.8-2 Revision No. 0
| |
| | |
| Inverters - Shutdown B 3.8.8 BASES APPLICABILITY (continued)
| |
| : d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.
| |
| Inverter requirements for MODES 1, 2, 3, and 4 are covered in LCO 3.8.7.
| |
| ACTIONS LCO 3.0.3 is not applicable while in MODE 5 or 6. However, since irradiated fuel assembly movement can occur in MODE 1, 2, 3, or 4, the ACTIONS have been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 5 or 6, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1, 2, 3, or 4, the fuel movement is independent of reactor operations. Entering LCO 3.0.3, while in MODE 1, 2, 3, or 4 would require the unit to be shutdown unnecessarily.
| |
| A.1, A.2, A.3, and A.4 With one or more required inverters inoperable, the minimum required inverters is not available. Therefore, suspension of CORE ALTERATIONS, movement of irradiated fuel assemblies, and operations involving positive reactivity additions that could result in loss of required SDM (MODE 5) specified in LCO 3.1.1, "SHUTDOWN MARGIN (SDM),"
| |
| or boron concentration (MODE 6) specified in LCO 3.9.1, "Boron Concentration," is required to assure continued safe operation.
| |
| Introduction of coolant inventory must be from sources that have a boron concentration greater than that what would be required in the RCS for minimum SDM or refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. Introduction of temperature changes including temperature increases when operating with a positive Moderator Temperature Coefficient (MTC) must also be evaluated to ensure they do not result in a loss of required SDM.
| |
| Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition. These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required inverters and to continue this action until restoration is accomplished in order to provide the necessary inverter power to the unit safety systems.
| |
| The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required inverters should be completed as quickly as possible in order to minimize the time the unit safety systems may be without power or powered from the regulated 600/120 VAC transformer via the inverter.
| |
| Cook Nuclear Plant Unit 2 B 3.8.8-3 Revision No. 0
| |
| | |
| Inverters - Shutdown B 3.8.8 BASES SURVEILLANCE SR 3.8.8.1 REQUIREMENTS This Surveillance verifies that the required inverters are functioning properly with all required circuit breakers closed and AC vital buses energized from the inverter. The verification of proper voltage and frequency output ensures that the required power is readily available for the instrumentation connected to the AC vital buses. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Chapter 14.
| |
| Cook Nuclear Plant Unit 2 B 3.8.8-4 Revision No. 60
| |
| | |
| Distribution Systems - Operating B 3.8.9 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.9 Distribution Systems - Operating BASES BACKGROUND The onsite Class 1E AC, DC, and 120 VAC vital bus electrical power distribution systems are for the most part divided by train into two redundant and independent AC, DC, and 120 VAC vital bus electrical power distribution subsystems, as required by Safety Guide 6 (Ref. 1).
| |
| The exception is the Train N DC electrical power distribution subsystem which supports the turbine driven auxiliary feedwater (AFW) train.
| |
| Unit 1 also has an identical electrical power distribution system. When the Essential Service Water (ESW) trains are not isolated from Unit 1, the associated Unit 1 electrical power distribution subsystems (except for the Train N DC electrical power distribution subsystem) are required to support Unit 2 operation.
| |
| The AC electrical power subsystem for each train consists of two primary Engineered Safety Feature (ESF) 4.16 kV buses and two 600 V buses.
| |
| Each 4.16 kV emergency bus has two separate and independent offsite sources of power as well as a dedicated onsite diesel generator (DG) source. Each 4.16 kV emergency bus is normally connected to the main generator via the unit auxiliary transformer. After a loss of the normal power source to a 4.16 kV emergency bus, a transfer to the preferred offsite source is accomplished by a main generator trip signal. If the preferred offsite source is unavailable, each onsite emergency DG supplies power to the two associated 4.16 kV emergency buses. A 4.16 kV emergency bus can be manually transferred to the alternate offsite source. Control power for the 4.16 kV breakers is supplied from the Class 1E batteries. Additional description of this system may be found in the Bases for LCO 3.8.1, "AC Sources - Operating," and the Bases for LCO 3.8.4, "DC Sources - Operating."
| |
| The AC electrical power distribution subsystem for each train includes the safety related buses shown in Table B 3.8.9-1. The Unit 1 AC electrical power distribution subsystems are also included in the table since they are required to support Unit 2 operations when the associated ESW train is not isolated.
| |
| The 120 VAC vital bus electrical power distribution system is arranged in two load groups per train and are normally powered from the inverters.
| |
| The alternate power supply for the 120 VAC vital buses are regulated 600/120 VAC transformers powered from the same train as the associated inverter, and its use is governed by LCO 3.8.7, "Inverters - Operating." Each regulated 600/120 VAC transformer is powered from a Class 1E AC bus.
| |
| Cook Nuclear Plant Unit 2 B 3.8.9-1 Revision No. 3
| |
| | |
| Distribution Systems - Operating B 3.8.9 BASES BACKGROUND (continued)
| |
| The Train A and Train B 250 VDC electrical power distribution subsystem consists of two 250 VDC buses (one for each train). The Train N 250 VDC electrical power subsystem consists of one bus and supports the operation of the turbine driven auxiliary feedwater train.
| |
| The list of all required DC and 120 VAC vital distribution buses is presented in Table B 3.8.9-1. The Unit 1 Train A and Train B 250 VDC electrical power distribution subsystem buses are also included in the table since they are required to support Unit 2 operations when the associated ESW train is not isolated. The Unit 1 Train N 250 VDC electrical power distribution subsystem is not required to support Unit 2 operations.
| |
| APPLICABLE The initial conditions of Design Basis Accident (DBA) and transient SAFETY analyses in the UFSAR, Chapter 14 (Ref. 2), assume ESF systems are ANALYSES OPERABLE. The AC, DC, and 120 VAC vital bus electrical power distribution systems are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor Coolant System, and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution Limits; Section 3.4, Reactor Coolant System (RCS); and Section 3.6, Containment Systems.
| |
| The OPERABILITY of the AC, DC, and 120 VAC vital bus electrical power distribution systems is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit.
| |
| This includes maintaining power distribution systems OPERABLE during accident conditions in the event of:
| |
| : a. An assumed loss of all offsite power or all onsite AC electrical power; and
| |
| : b. A worst case single failure.
| |
| Distribution Systems - Operating satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The required power distribution subsystems listed in Table B 3.8.9-1 ensure the availability of AC, DC, and 120 VAC vital bus electrical power for the systems required to shut down the reactor and maintain it in a safe condition after an anticipated operational transient or a postulated DBA.
| |
| The AC, DC, and 120 VAC vital bus electrical power distribution subsystems are required to be OPERABLE and certain buses of the Unit 1 AC and DC electrical power distribution subsystems may be required to be OPERABLE to support the equipment required to be OPERABLE by LCO 3.7.8, "Essential Service Water (ESW) System."
| |
| Cook Nuclear Plant Unit 2 B 3.8.9-2 Revision No. 0
| |
| | |
| Distribution Systems - Operating B 3.8.9 BASES LCO (continued)
| |
| Maintaining the Train A and Train B AC, Train A and Train B 250 VDC, Train N 250 VDC, Train A and Train B 120 VAC vital bus, and the required Unit 1 AC and DC electrical power distribution subsystems OPERABLE ensures that the redundancy incorporated into the design of ESF is not defeated. Therefore, a single failure within any system or within the electrical power distribution subsystems will not prevent safe shutdown of the reactor.
| |
| OPERABLE AC electrical power distribution subsystems require the associated buses to be energized to their proper voltages. OPERABLE DC electrical power distribution subsystems require the associated buses be energized to their proper voltage from either the associated battery or required charger. OPERABLE 120 VAC vital bus electrical power distribution subsystems require the associated buses to be energized to their proper voltage from the associated inverter via inverted DC voltage or the regulated 600/120 VAC transformer via the static transfer switch or manual bypass switch of the inverter cabinet.
| |
| Based on the number of safety significant electrical loads associated with each bus listed in Table B 3.8.9-1, if one or more of the buses becomes inoperable, entry into the appropriate ACTIONS of LCO 3.8.9 is required.
| |
| Some buses, such as distribution panels, which help comprise the AC and DC distribution systems, are not listed in Table B 3.8.9-1. The loss of electrical loads associated with these buses may not result in a complete loss of a redundant safety function necessary to shut down the reactor and maintain it in a safe condition. Therefore, should one or more of these buses become inoperable due to a failure not affecting the OPERABILITY of a bus listed in Table B 3.8.9-1 (e.g., a breaker supplying a single distribution panel fails open), the individual loads on the bus would be declared inoperable, and the appropriate Conditions and Required Actions of the LCOs governing the individual loads would be entered. However, if one or more of these buses is inoperable due to a failure also affecting the OPERABILITY of a bus listed in Table B 3.8.9-1 (e.g., loss of 4.16 kV emergency bus, which results in de-energization of all buses powered from the 4.16 kV emergency bus),
| |
| then although the individual loads are still considered inoperable, the Conditions and Required Actions of the LCO for the individual loads are not required to be entered, since LCO 3.0.6 allows this exception (i.e., the loads are inoperable due to the inoperability of a support system governed by a Technical Specification; the 4.16 kV emergency bus).
| |
| In addition, tie breakers between redundant safety related AC and DC electrical power distribution subsystems must be open. This prevents any electrical malfunction in any power distribution subsystem from propagating to the redundant subsystem, that could cause the failure of a Cook Nuclear Plant Unit 2 B 3.8.9-3 Revision No. 3
| |
| | |
| Distribution Systems - Operating B 3.8.9 BASES LCO (continued) redundant subsystem and a loss of essential safety function(s). If any tie breakers are closed, the electrical power distribution subsystems that are not being powered from their normal source (i.e., they are being powered from their redundant electrical power distribution subsystem) are considered inoperable. This applies to the onsite, safety related redundant electrical power distribution subsystems. It does not, however, preclude redundant Class 1E 4.16 kV buses from being powered from the same offsite circuit.
| |
| APPLICABILITY The Train A and Train B AC, Train A and Train B 120 VAC vital bus, Train A and Train B 250 VDC, and the Unit 1 Train A and Train B AC and Train A and Train B 250 VDC electrical power distribution subsystems are required to be OPERABLE in MODES 1, 2, 3, and 4 to ensure that:
| |
| : a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of anticipated operational transients; and
| |
| : b. Adequate core cooling is provided, and containment OPERABILITY and other vital functions are maintained in the event of a postulated DBA.
| |
| The Train N 250 VDC electrical power distribution subsystem is required to be OPERABLE in MODES 1, 2, and 3 to support the turbine driven auxiliary feedwater train in the event that it is called upon to function when the Main Feedwater System is lost.
| |
| Electrical power distribution subsystem requirements for MODES 5 and 6 and other conditions in which electrical power distribution subsystems are required are covered in the Bases for LCO 3.8.10, "Distribution Systems - Shutdown."
| |
| ACTIONS A.1 With one or both Train A and Train B AC electrical power distribution subsystems (except 120 VAC vital buses), inoperable and a loss of function has not occurred, the remaining AC electrical power distribution subsystems are capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition, assuming no single failure. The overall reliability is reduced, however, because a single failure in the remaining electrical power distribution subsystems could result in the minimum required ESF functions not being supported. Therefore, the AC electrical power distribution subsystem(s) must be restored to OPERABLE status within 8 hours.
| |
| Cook Nuclear Plant Unit 2 B 3.8.9-4 Revision No. 0
| |
| | |
| Distribution Systems - Operating B 3.8.9 BASES ACTIONS (continued)
| |
| Condition A worst scenario is one train without AC power (i.e., no offsite power to the train and the associated DG inoperable). In this Condition, the unit is more vulnerable to a complete loss of AC power. It is, therefore, imperative that the unit operator's attention be focused on minimizing the potential for loss of power to the remaining train by stabilizing the unit, and on restoring power to the affected train. The 8 hour time limit before requiring a unit shutdown in this Condition is acceptable because of:
| |
| : a. The potential for decreased safety if the unit operator's attention is diverted from the evaluations and actions necessary to restore power to the affected train, to the actions associated with taking the unit to shutdown within this time limit; and
| |
| : b. The potential for an event in conjunction with a single failure of a redundant component in the train with AC power.
| |
| The second Completion Time for Required Action A.1 establishes a limit on the maximum time allowed for any combination of required distribution subsystems to be inoperable during any single contiguous occurrence of failing to meet LCO 3.8.9.a, b, or c. If Condition A is entered while, for instance, a Train A or Train B 250 VDC bus is inoperable and subsequently restored OPERABLE, the LCO may already have been not met for up to 2 hours. This could lead to a total of 10 hours, since initial failure to meet the LCO, to restore the AC distribution system. At this time, a Train A or Train B 250 VDC circuit could again become inoperable, and AC distribution restored OPERABLE. This could continue indefinitely.
| |
| The Completion Time allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." This will result in establishing the "time zero" at the time the LCO was initially not met, instead of the time Condition A was entered. The 16 hour Completion Time is an acceptable limitation on this potential to fail to meet the LCO indefinitely.
| |
| Required Action A.1 is modified by a Note that requires the applicable Conditions and Required Actions of LCO 3.8.4, "DC Sources - Operating,"
| |
| to be entered for DC sources made inoperable by inoperable power distribution subsystems. This is an exception to LCO 3.0.6 and ensures the proper actions are taken for these components. Inoperability of a distribution system can result in loss of charging power to batteries and eventual loss of DC power. This Note ensures that the appropriate attention is given to restoring charging power to batteries, if necessary, after loss of distribution systems.
| |
| Cook Nuclear Plant Unit 2 B 3.8.9-5 Revision No. 0
| |
| | |
| Distribution Systems - Operating B 3.8.9 BASES ACTIONS (continued)
| |
| B.1 With one or both 120 VAC vital bus electrical power distribution subsystems inoperable, and a loss of function has not yet occurred, the remaining OPERABLE 120 VAC vital buses are capable of supporting the minimum safety functions necessary to shut down the unit and maintain it in the safe shutdown condition. Overall reliability is reduced, however, since an additional single failure could result in the minimum required ESF functions not being supported. Therefore, the required 120 VAC vital bus must be restored to OPERABLE status within 8 hours by powering the bus from the associated inverter via inverted DC or the regulated 600/120 VAC transformer via the static transfer switch or manual bypass switch of the inverter cabinet.
| |
| Condition B represents one or more 120 VAC vital buses without power; potentially both the DC source and the associated AC source are nonfunctioning. In this situation, the unit is significantly more vulnerable to a complete loss of all noninterruptible power. It is, therefore, imperative that the operator's attention focus on stabilizing the unit, minimizing the potential for loss of power to the remaining 120 VAC vital buses and restoring power to the affected 120 VAC vital bus.
| |
| This 8 hour limit is more conservative than Completion Times allowed for the vast majority of components that are without adequate 120 VAC vital bus power. Taking exception to LCO 3.0.2 for components without adequate 120 VAC vital bus power, that would have the Required Action Completion Times shorter than 8 hours if declared inoperable, is acceptable because of:
| |
| : a. The potential for decreased safety by requiring a change in unit conditions (i.e., requiring a shutdown) and not allowing stable operations to continue;
| |
| : b. The potential for decreased safety by requiring entry into numerous Applicable Conditions and Required Actions for components without adequate 120 VAC vital bus power and not providing sufficient time for the operators to perform the necessary evaluations and actions for restoring power to the affected train; and
| |
| : c. The potential for an event in conjunction with a single failure of a redundant component.
| |
| The 8 hour Completion Time takes into account the importance to safety of restoring the 120 VAC vital bus electrical power distribution subsystem(s) to OPERABLE status, the redundant capability afforded by Cook Nuclear Plant Unit 2 B 3.8.9-6 Revision No. 3
| |
| | |
| Distribution Systems - Operating B 3.8.9 BASES ACTIONS (continued) the other OPERABLE 120 VAC vital buses, and the low probability of a DBA occurring during this period.
| |
| The second Completion Time for Required Action B.1 establishes a limit on the maximum time allowed for any combination of required distribution subsystems to be inoperable during any single contiguous occurrence of failing to meet LCO 3.8.9.a, b, or c. If Condition B is entered while, for instance, an AC bus is inoperable and subsequently returned OPERABLE, the LCO may already have been not met for up to 8 hours.
| |
| This could lead to a total of 16 hours, since initial failure to meet the LCO, to restore the 120 VAC vital bus electrical power distribution subsystem.
| |
| At this time, an AC train could again become inoperable, and 120 VAC vital bus electrical power distribution subsystem restored OPERABLE.
| |
| This could continue indefinitely.
| |
| This Completion Time allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." This will result in establishing the "time zero" at the time the LCO was initially not met, instead of the time Condition B was entered. The 16 hour Completion Time is an acceptable limitation on this potential to fail to meet the LCO indefinitely.
| |
| C.1 With one Train A or Train B 250 VDC electrical power distribution subsystem inoperable, and a loss of function has not yet occurred, the remaining Train A or Train B 250 VDC electrical power distribution subsystem is capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition, assuming no single failure. The overall reliability is reduced, however, because a single failure in the remaining Train A or Train B 250 VDC electrical power distribution subsystem could result in the minimum required ESF functions not being supported. Therefore, the Train A or Train B 250 VDC electrical power distribution subsystem must be restored to OPERABLE status within 2 hours by powering the bus from the associated battery or chargers.
| |
| Condition C represents one Train A or Train B 250 VDC electrical power distribution subsystem without adequate DC power; potentially both with the battery significantly degraded and the associated chargers nonfunctioning. In this situation, the unit is significantly more vulnerable to a complete loss of all DC power. It is, therefore, imperative that the operator's attention focus on stabilizing the unit, minimizing the potential for loss of power to the remaining trains and restoring power to the affected train.
| |
| Cook Nuclear Plant Unit 2 B 3.8.9-7 Revision No. 3
| |
| | |
| Distribution Systems - Operating B 3.8.9 BASES ACTIONS (continued)
| |
| This 2 hour limit is more conservative than Completion Times allowed for the vast majority of components that would be without power. Taking exception to LCO 3.0.2 for components without adequate DC power, which would have Required Action Completion Times shorter than 2 hours, is acceptable because of:
| |
| : a. The potential for decreased safety by requiring a change in unit conditions (i.e., requiring a shutdown) while not allowing stable operations to continue;
| |
| : b. The potential for decreased safety by requiring entry into numerous applicable Conditions and Required Actions for components without DC power and not providing sufficient time for the operators to perform the necessary evaluations and actions for restoring power to the affected train; and
| |
| : c. The potential for an event in conjunction with a single failure of a redundant component.
| |
| The 2 hour Completion Time for DC buses is consistent with Regulatory Guide 1.93 (Ref. 3).
| |
| The second Completion Time for Required Action C.1 establishes a limit on the maximum time allowed for any combination of required distribution subsystems to be inoperable during any single contiguous occurrence of failing to meet LCO 3.8.9.a, b, or c. If Condition C is entered while, for instance, a Train A or Train B AC bus is inoperable and subsequently returned OPERABLE, the LCO may already have been not met for up to 8 hours. This could lead to a total of 10 hours, since initial failure to meet the LCO, to restore the Train A or Train B 250 VDC distribution system.
| |
| At this time, a Train A or Train B AC train could again become inoperable, and Train A or Train B DC distribution system restored OPERABLE. This could continue indefinitely.
| |
| This Completion Time allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." This will result in establishing the "time zero" at the time the LCO was initially not met, instead of the time Condition C was entered. The 16 hour Completion Time is an acceptable limitation on this potential to fail to meet the LCO indefinitely.
| |
| Cook Nuclear Plant Unit 2 B 3.8.9-8 Revision No. 0
| |
| | |
| Distribution Systems - Operating B 3.8.9 BASES ACTIONS (continued)
| |
| D.1 and D.2 If any Required Action and associated Completion Time of Condition A, B, or C is not met, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| E.1 With the required Train N 250 VDC electrical power distribution system inoperable, the Train N powered system is not capable of performing its intended function. Immediately declaring the affected supported feature (e.g., the turbine driven AFW System) inoperable allows the ACTIONS of LCO 3.7.5, "Auxiliary Feedwater System (AFW)," to apply appropriate limitations on continued reactor operation.
| |
| F.1 With the required portions of the Unit 1 Train A and Train B AC electrical power distribution subsystems and Train A and Train B 250 VDC electrical power distribution subsystems inoperable, the associated ESW train is not capable of performing its intended function. Immediately declaring the affected supported feature (i.e., the ESW train) inoperable allows the ACTIONS of LCO 3.7.8 to apply appropriate limitations on continued reactor operation.
| |
| G.1 Condition G corresponds to a level of degradation in the electrical power distribution system that causes a required safety function to be lost.
| |
| When more than one inoperable electrical power distribution subsystem results in the loss of a required function, the unit is in a condition outside the accident analysis. Therefore, no additional time is justified for continued operation. LCO 3.0.3 must be entered immediately to commence a controlled shutdown.
| |
| Cook Nuclear Plant Unit 2 B 3.8.9-9 Revision No. 0
| |
| | |
| Distribution Systems - Operating B 3.8.9 BASES SURVEILLANCE SR 3.8.9.1 REQUIREMENTS This Surveillance verifies that the required AC, DC, and 120 VAC vital bus electrical power distribution systems are functioning properly, with the correct circuit breaker alignment. The correct breaker alignment ensures the appropriate separation and independence of the electrical divisions is maintained, and the appropriate voltage is available to each required bus.
| |
| The verification of proper voltage availability on the buses ensures that the required voltage is readily available for motive as well as control functions for critical system loads connected to these buses. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. Safety Guide 6, March 1971.
| |
| : 2. UFSAR, Chapter 14.
| |
| : 3. Regulatory Guide 1.93, December 1974.
| |
| Cook Nuclear Plant Unit 2 B 3.8.9-10 Revision No. 60
| |
| | |
| Distribution Systems - Operating B 3.8.9 Table B 3.8.9-1 (page 1 of 1)
| |
| AC, DC, and 120 VAC Vital Bus Electrical Power Distribution Systems TYPE VOLTAGE TRAIN A(a)(b) TRAIN B(a)(b) TRAIN N(a)
| |
| AC Buses 4.16 kV Emergency Bus Emergency Bus Not Applicable T21C, T21D T21A, T21B 600 V Emergency Bus Emergency bus 21C, 21D 21A, 21B DC Buses 250 V Main Distribution Main Distribution Battery Distribution Cabinet CD Cabinet AB Cabinet N AC Vital 120 V Instrument Instrument Not Applicable Buses Distribution Cabinet Distribution Cabinet Channels I and II Channels III and IV (a) Each train of the AC, DC, and 120 VAC Vital Bus Electrical Power Distribution Systems is a subsystem.
| |
| (b) If the ESW crosstie header associated with Train A ESW pump is not isolated, the following Unit 1 buses are required to be OPERABLE: 4.16 kV Emergency Bus T11A and 250 V Main Distribution Cabinet AB. If the ESW crosstie header associated with Train B ESW pump is not isolated the following Unit 1 buses are required to be OPERABLE: 4.16 kV Emergency Bus T11D and 250 V Main Distribution Cabinet CD.
| |
| Cook Nuclear Plant Unit 2 B 3.8.9-11 Revision No. 0
| |
| | |
| Distribution Systems - Shutdown B 3.8.10 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.10 Distribution Systems - Shutdown BASES BACKGROUND A description of the AC, DC, and 120 VAC vital bus electrical power distribution systems is provided in the Bases for LCO 3.8.9, "Distribution Systems - Operating."
| |
| APPLICABLE The initial conditions of Design Basis Accident and transient analyses in SAFETY Chapter 14 (Ref. 1), assume Engineered Safety Feature (ESF) systems ANALYSES are OPERABLE. The AC, DC, and 120 VAC vital bus electrical power distribution systems are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor Coolant System, and containment design limits are not exceeded.
| |
| The OPERABILITY of the AC, DC, and 120 VAC vital bus electrical power distribution system is consistent with the initial assumptions of the accident analyses and the requirements for the supported systems' OPERABILITY.
| |
| The OPERABILITY of the minimum AC, DC, and 120 VAC vital bus electrical power distribution subsystems during MODES 5 and 6, and during movement of irradiated fuel assemblies in the containment, auxiliary building, and Unit 1 containment ensures that:
| |
| : a. The unit can be maintained in the shutdown or refueling condition for extended periods;
| |
| : b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and
| |
| : c. Adequate power is provided to mitigate events postulated during shutdown, such as a fuel handling accident.
| |
| The Distribution Systems - Shutdown satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO Various combinations of subsystems, equipment, and components are required OPERABLE by other LCOs, depending on the specific unit condition. Implicit in those requirements is the required OPERABILITY of necessary support required features. This LCO explicitly requires energization of the portions of the electrical power distributions subsystems necessary to support OPERABILITY of required systems, equipment, and components - all specifically addressed in each LCO and implicitly required via the definition of OPERABILITY.
| |
| Cook Nuclear Plant Unit 2 B 3.8.10-1 Revision No. 0
| |
| | |
| Distribution Systems - Shutdown B 3.8.10 BASES LCO (continued)
| |
| Maintaining these portions of the distribution system energized ensures the availability of sufficient power to operate the unit in a safe manner to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents).
| |
| APPLICABILITY The AC, DC, and 120 VAC vital bus electrical power distribution subsystems required to be OPERABLE in MODES 5 and 6, and during movement of irradiated fuel assemblies in the containment, auxiliary building, and Unit 1 containment, provide assurance that:
| |
| : a. Systems to provide adequate coolant inventory makeup are available for the irradiated fuel in the core;
| |
| : b. Systems needed to mitigate a fuel handling accident are available;
| |
| : c. Systems necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and
| |
| : d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition and refueling condition.
| |
| The AC, DC, and 120 VAC vital bus electrical power distribution subsystems requirements for MODES 1, 2, 3, and 4 are covered in LCO 3.8.9.
| |
| ACTIONS LCO 3.0.3 is not applicable while in MODE 5 or 6. However, since irradiated fuel assembly movement can occur in MODE 1, 2, 3, or 4, the ACTIONS have been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 5 or 6, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1, 2, 3, or 4, the fuel movement is independent of reactor operations. Entering LCO 3.0.3, while in MODE 1, 2, 3, or 4 would require the unit to be shutdown unnecessarily.
| |
| A.1, A.2.1, A.2.2, A.2.3, A.2.4, and A.2.5 Although redundant required features may require redundant trains of electrical power distribution subsystems to be OPERABLE, one OPERABLE distribution subsystem train may be capable of supporting sufficient required features to allow continuation of CORE ALTERATIONS and irradiated fuel movement. By allowing the option to declare required features associated with an inoperable distribution subsystem inoperable, appropriate restrictions are implemented in accordance with the affected Cook Nuclear Plant Unit 2 B 3.8.10-2 Revision No. 7
| |
| | |
| Distribution Systems - Shutdown B 3.8.10 BASES ACTIONS (continued) distribution subsystem LCO's Required Actions. In many instances, this option may involve undesired administrative efforts. Therefore, the allowance for sufficiently conservative actions is made (i.e., to suspend CORE ALTERATIONS, movement of irradiated fuel assemblies, and operations involving positive reactivity additions that could result in loss of required SDM (MODE 5) specified in LCO 3.1.1, "SHUTDOWN MARGIN (SDM)," or boron concentration (MODE 6) specified in LCO 3.9.1, "Boron Concentration." Suspending positive reactivity additions that could result in failure to meet the minimum SDM or boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than that what would be required in the RCS for minimum SDM or refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. Introduction of temperature changes including temperature increases when operating with a positive moderator temperature coefficient (MTC) must also be evaluated to ensure they do not result in a loss of required SDM.
| |
| Suspension of these activities does not preclude completion of actions to establish a safe conservative condition. These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required AC, DC, and 120 VAC vital bus electrical power distribution subsystems and to continue this action until restoration is accomplished in order to provide the necessary power to the unit safety systems.
| |
| Notwithstanding performance of the above conservative Required Actions, a required residual heat removal (RHR) subsystem may be inoperable. In this case, Required Actions A.2.1 through A.2.4 do not adequately address the concerns relating to coolant circulation and heat removal. Pursuant to LCO 3.0.6, the RHR ACTIONS would not be entered. Therefore, Required Action A.2.5 is provided to direct declaring RHR inoperable, which results in taking the appropriate RHR actions.
| |
| The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required distribution subsystems should be completed as quickly as possible in order to minimize the time the unit safety systems may be without power.
| |
| B.1 When the Fuel Handling Area Exhaust Ventilation (FHAEV) System is required to be OPERABLE, and the required Unit 1 AC electrical power distribution subsystem is inoperable, the minimum required electrical Cook Nuclear Plant Unit 2 B 3.8.10-3 Revision No. 0
| |
| | |
| Distribution Systems - Shutdown B 3.8.10 BASES ACTIONS (continued) power is not available. It is therefore required to declare the FHAEV System inoperable. Since the Unit 1 AC electrical power distribution subsystem only affects the FHAEV System, the associated portions of the FHAEV System are declared inoperable and the applicable ACTIONS of LCO 3.7.13, "Fuel Handling Area Exhaust Ventilation (FHAEV) System,"
| |
| are entered.
| |
| SURVEILLANCE SR 3.8.10.1 REQUIREMENTS This Surveillance verifies that the AC, DC, and 120 VAC vital bus electrical power distribution subsystems are functioning properly, with all the buses energized. The verification of proper voltage availability on the buses ensures that the required power is readily available for motive as well as control functions for critical system loads connected to these buses. Since the Unit 1 AC electrical power distribution subsystem only affects the FHAEV System, the SR is modified by a Note that specifies the SR is not required to be met for the Unit 1 AC electrical power distribution subsystem when the associated FHAEV System is not required to be OPERABLE per LCO 3.7.13. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Chapter 14.
| |
| Cook Nuclear Plant Unit 2 B 3.8.10-4 Revision No. 60
| |
| | |
| Boron Concentration B 3.9.1 B 3.9 REFUELING OPERATIONS B 3.9.1 Boron Concentration BASES BACKGROUND The limit on the boron concentrations of the Reactor Coolant System (RCS), the refueling canal, and the refueling cavity during refueling ensures that the reactor remains subcritical during MODE 6. Refueling boron concentration is the soluble boron concentration in the coolant in each of these volumes having direct access to the reactor core during refueling.
| |
| The soluble boron concentration offsets the core reactivity and is measured by chemical analysis of a representative sample of the coolant in each of the volumes. The refueling boron concentration limit is specified in the COLR. Plant procedures ensure the specified boron concentration in order to maintain an overall core reactivity of keff 0.95 during fuel handling, with control rods and fuel assemblies assumed to be in the most adverse configuration (least negative reactivity) allowed by plant procedures.
| |
| Plant Specific Design Criterion (PSDC) 27 requires that two independent reactivity control systems, preferably of different design principles, be provided. According to PSDC 28 (Ref. 1), the reactivity controls must be capable of making and holding the core subcritical from any hot standby or hot operating condition. The Chemical and Volume Control System (CVCS) is the system capable of maintaining the reactor subcritical in cold conditions by maintaining the boron concentration.
| |
| The reactor is brought to shutdown conditions before beginning operations to open the reactor vessel for refueling. After the RCS is cooled and depressurized and the vessel head is unbolted, the head is removed. The refueling canal and the refueling cavity are then flooded with borated water from the refueling water storage tank through the open reactor vessel by gravity feeding or by the use of the Residual Heat Removal (RHR) System pumps.
| |
| The pumping action of the RHR System in the RCS and the natural circulation due to thermal driving heads in the reactor vessel and refueling cavity mix the added concentrated boric acid with the water in the refueling canal. The RHR System is in operation during refueling (see LCO 3.9.4, "Residual Heat Removal (RHR) and Coolant Circulation - High Water Level," and LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation - Low Water Level") to provide forced circulation in the RCS and assist in maintaining the boron concentrations in the RCS, the refueling canal, and the refueling cavity above the COLR limit.
| |
| Cook Nuclear Plant Unit 2 B 3.9.1-1 Revision No. 0
| |
| | |
| Boron Concentration B 3.9.1 BASES APPLICABLE During refueling operations, the reactivity condition of the core is SAFETY consistent with the initial conditions assumed for the boron dilution ANALYSES accident in the accident analysis and is conservative for MODE 6. The boron concentration limit specified in the COLR is based on the core reactivity at the beginning of each fuel cycle (the end of refueling) and includes an uncertainty allowance.
| |
| The required boron concentration and the plant refueling procedures that verify the correct fuel loading plan (including full core mapping) ensure that the keff of the core will remain 0.95 during the refueling operation.
| |
| Hence, at least a 5% k/k margin of safety is established during refueling.
| |
| During refueling, the water volume in the spent fuel pool, the transfer canal, the refueling canal, the refueling cavity, and the reactor vessel form a single mass. As a result, the soluble boron concentration is relatively the same in each of these volumes.
| |
| The RCS boron concentration satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The LCO requires that a minimum boron concentration be maintained in the RCS, the refueling canal including the transfer canal, and the refueling cavity while in MODE 6. The boron concentration limit specified in the COLR ensures that a core keff of 0.95 is maintained during fuel handling operations. Violation of the LCO could lead to an inadvertent criticality during MODE 6.
| |
| APPLICABILITY This LCO is applicable in MODE 6 to ensure that the fuel in the reactor vessel will remain subcritical. The required boron concentration ensures a keff 0.95. Above MODE 6, LCO 3.1.1, "SHUTDOWN MARGIN (SDM)," ensures that an adequate amount of negative reactivity is available to shut down the reactor and maintain it subcritical.
| |
| The Applicability is modified by a Note. The Note states that the limits on boron concentration are only applicable to the refueling canal and the refueling cavity when those volumes are connected to (i.e., are in communication with) the RCS. When the refueling canal and the refueling cavity are isolated from the RCS, no potential path for boron dilution exists.
| |
| ACTIONS A.1 and A.2 Continuation of CORE ALTERATIONS or positive reactivity additions (including actions to reduce boron concentration) is contingent upon maintaining the unit in compliance with the LCO. If the boron concentration of any coolant volume in the RCS, the refueling canal, or the refueling cavity is less than its limit, all operations involving CORE ALTERATIONS or positive reactivity additions must be suspended immediately.
| |
| Cook Nuclear Plant Unit 2 B 3.9.1-2 Revision No. 0
| |
| | |
| Boron Concentration B 3.9.1 BASES ACTIONS (continued)
| |
| Suspension of CORE ALTERATIONS and positive reactivity additions shall not preclude moving a component to a safe position. Operations that individually add limited positive reactivity (e.g., temperature fluctuations from inventory addition or temperature control fluctuations),
| |
| but when combined with all other operations affecting core reactivity (e.g., intentional boration) result in overall net negative reactivity addition, are not precluded by this action.
| |
| A.3 In addition to immediately suspending CORE ALTERATIONS and positive reactivity additions, boration to restore the concentration must be initiated immediately.
| |
| In determining the required combination of boration flow rate and concentration, no unique Design Basis Event must be satisfied. The only requirement is to restore the boron concentration to its required value as soon as possible. In order to raise the boron concentration as soon as possible, the operator should begin boration with the best source available for unit conditions.
| |
| Once actions have been initiated, they must be continued until the boron concentration is restored. The restoration time depends on the amount of boron that must be injected to reach the required concentration.
| |
| SURVEILLANCE SR 3.9.1.1 and SR 3.9.1.2 REQUIREMENTS These SRs ensure that the coolant boron concentration in the RCS, and connected portions of the refueling canal and the refueling cavity, is within the COLR limits. The boron concentration is determined periodically and prior to re-connecting portions of the refueling canal and the refueling cavity to the RCS, by chemical analysis.
| |
| The SR 3.9.1.1 Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The SR 3.9.1.2 Frequency of once within 72 hours prior to connecting the refueling canal and refueling cavity to the RCS ensures that if any dilution activity has occurred while the cavity and canal were disconnected from the RCS, correct boron concentration is verified prior to communication with the RCS.
| |
| REFERENCES 1. UFSAR, Section 1.4.5.
| |
| Cook Nuclear Plant Unit 2 B 3.9.1-3 Revision No. 60
| |
| | |
| Nuclear Instrumentation B 3.9.2 B 3.9 REFUELING OPERATIONS B 3.9.2 Nuclear Instrumentation BASES BACKGROUND The source range neutron flux monitors (i.e., the Westinghouse source range neutron flux monitors and the Thermo Gamma-Metrics neutron flux monitors) are used during refueling operations to monitor the core reactivity condition. The Westinghouse source range neutron flux monitors are part of the Nuclear Instrumentation System (NIS). The Thermo Gamma-Metrics neutron flux monitors are part of the Thermo Gamma-Metrics Neutron Flux Monitoring System. Both of these types of detectors are located external to the reactor vessel and detect neutrons leaking from the core.
| |
| The Westinghouse source range neutron flux monitors are BF3 detectors operating in the proportional region of the gas filled detector characteristic curve. The detectors monitor the neutron flux in counts per second. The instrument range covers six decades of neutron flux (1E+6 cps). The detectors also provide continuous visual indication in the control room and an audible count rate (selectable between proportional source range neutron flux monitors) to alert operators to a possible dilution accident.
| |
| The NIS is designed in accordance with the criteria presented in Reference 1.
| |
| There are two Thermo Gamma-Metrics neutron flux monitors. Each monitor includes two fission chamber detectors capable of monitoring a wide range from source level (shutdown) to full power reactor operation.
| |
| In the source range, the detectors monitor the neutron flux in counts per second and are capable of detecting six decades of neutron flux. The detectors also provide continuous visual indication in the control room of source count rate and a source rate of change. In addition, at least one of the Thermo Gamma-Metrics neutron flux monitors can be configured to provide an audible count rate to alert operators to a possible dilution accident.
| |
| APPLICABLE Two OPERABLE source range neutron flux monitors are required to SAFETY provide a signal to alert the operator to unexpected changes in core ANALYSES reactivity such as with a boron dilution accident (Ref. 2). The audible count rate from the source range neutron flux monitors provides prompt and definite indication of any boron dilution. The count rate increase is proportional to the subcritical multiplication factor and allows operators to promptly recognize the initiation of a boron dilution event. Prompt recognition of the initiation of a boron dilution event is consistent with the assumptions of the safety analysis and is necessary to assure sufficient time is available for isolation of the primary water makeup source before SHUTDOWN MARGIN is lost (Ref. 2).
| |
| The source range neutron flux monitors satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| Cook Nuclear Plant Unit 2 B 3.9.2-1 Revision No. 56
| |
| | |
| Nuclear Instrumentation B 3.9.2 BASES LCO This LCO requires that two source range neutron flux monitors (any combination of Westinghouse source range neutron flux and Thermo Gamma-Metrics neutron flux monitors) be OPERABLE to ensure that redundant monitoring capability is available to detect changes in core reactivity. To be OPERABLE, each monitor must provide visual indication in the control room. In addition, at least one monitor must provide an OPERABLE audible count rate function to alert the operators in the control room to the initiation of a boron dilution event.
| |
| APPLICABILITY In MODE 6, the source range neutron flux monitors must be OPERABLE to determine changes in core reactivity. There are no other direct means available to check core reactivity levels. In MODES 2, 3, 4, and 5, these same installed source range detectors and circuitry are also required to be OPERABLE by LCO 3.3.1, "Reactor Trip System (RTS)
| |
| Instrumentation" and LCO 3.3.8, "Boron Dilution Monitoring Instrumentation (BDMI)", as applicable.
| |
| ACTIONS A.1 and A.2 With only one required source range neutron flux monitor OPERABLE, redundancy has been lost. Since these instruments are the only direct means of monitoring core reactivity conditions, CORE ALTERATIONS and introduction of coolant into the RCS with boron concentration less than required to meet the minimum boron concentration of LCO 3.9.1 must be suspended immediately. Suspending positive reactivity additions that could result in failure to meet the minimum boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than that what would be required in the RCS for minimum refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. Performance of Required Action A.1 shall not preclude completion of movement of a component to a safe position.
| |
| B.1 With no required source range neutron flux monitor OPERABLE, action to restore a monitor to OPERABLE status shall be initiated immediately.
| |
| Once initiated, action shall be continued until a source range neutron flux monitor is restored to OPERABLE status.
| |
| B.2 With no required source range neutron flux monitor OPERABLE, there are no direct means of detecting changes in core reactivity. However, Cook Nuclear Plant Unit 2 B 3.9.2-2 Revision No. 56
| |
| | |
| Nuclear Instrumentation B 3.9.2 BASES ACTIONS (continued) since CORE ALTERATIONS and positive reactivity additions are not to be made, the core reactivity condition is stabilized until the source range neutron flux monitors are OPERABLE. This stabilized condition is determined by performing SR 3.9.1.1 to ensure that the required boron concentration exists.
| |
| The Completion Time of once per 12 hours is sufficient to obtain and analyze a reactor coolant sample for boron concentration and ensures that unplanned changes in boron concentration would be identified. The 12 hour Frequency is reasonable, considering the low probability of a change in core reactivity during this time period.
| |
| C.1 With no audible count rate OPERABLE, prompt and definite indication of a boron dilution event, consistent with the assumptions of the safety analysis, is lost. In this situation, the boron dilution event may not be detected quickly enough to assure sufficient time is available for operators to manually isolate the unborated water source and stop the dilution prior to the loss of SHUTDOWN MARGIN. Therefore, action must be taken to prevent an inadvertent boron dilution event from occurring.
| |
| This is accomplished by isolating all the unborated water flow paths to the Reactor Coolant System. Isolating these flow paths ensures that an inadvertent dilution of the reactor coolant boron concentration is prevented. The Completion Time of "Immediately" assures a prompt response by operations and requires an operator to initiate actions to isolate an affected flow path immediately. Once actions are initiated, they must be continued until all the necessary flow paths are isolated or the circuit is restored to OPERABLE status.
| |
| SURVEILLANCE SR 3.9.2.1 REQUIREMENTS SR 3.9.2.1 is the performance of a CHANNEL CHECK, which is normally a comparison of the parameter indicated on one channel to a similar parameter on another channel. It is based on the assumption that the two indication channels should be consistent with core conditions. Changes in fuel loading and core geometry can result in significant differences between source range channels, but each channel should be consistent with its local conditions.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Cook Nuclear Plant Unit 2 B 3.9.2-3 Revision No. 60
| |
| | |
| Nuclear Instrumentation B 3.9.2 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.9.2.2 SR 3.9.2.2 is the performance of a CHANNEL CALIBRATION.
| |
| CHANNEL CALIBRATION is a complete check of the instrument loop, except the detector. The CHANNEL CALIBRATION for the Westinghouse source range neutron flux monitors also includes obtaining the detector plateau or preamp discriminator curves, evaluating those curves, and comparing the curves to the manufacturer's data. In addition, the CHANNEL CALIBRATION includes verification of the audible count rate function for the required monitor. This SR is modified by a Note stating that neutron detectors are excluded from the CHANNEL CALIBRATION. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 1.4.5.
| |
| : 2. UFSAR, Section 14.1.5.
| |
| Cook Nuclear Plant Unit 2 B 3.9.2-4 Revision No. 60
| |
| | |
| Containment Penetrations B 3.9.3 B 3.9 REFUELING OPERATIONS B 3.9.3 Containment Penetrations BASES BACKGROUND During movement of irradiated fuel assemblies within containment, a release of fission product radioactivity within containment will be restricted from escaping to the environment when the LCO requirements are met.
| |
| In MODES 1, 2, 3, and 4, this is accomplished by maintaining containment OPERABLE as described in LCO 3.6.1, "Containment." In MODE 6, the potential for containment pressurization as a result of an accident is not likely; therefore, requirements to isolate the containment from the outside atmosphere can be less stringent. The LCO requirements are referred to as "containment closure" rather than "containment OPERABILITY." Containment closure means that all potential escape paths are closed or capable of being closed. Since there is no potential for containment pressurization, the Appendix J leakage criteria and tests are not required.
| |
| The containment serves to contain fission product radioactivity that may be released from the reactor core following an accident, such that offsite radiation exposures are maintained well within the requirements of 10 CFR 50.67 (Ref. 2). Additionally, the containment provides radiation shielding from the fission products that may be present in the containment atmosphere following accident conditions.
| |
| The containment equipment hatch, which is part of the containment pressure boundary, provides a means for moving large equipment and components into and out of containment. During movement of irradiated fuel assemblies within containment, the equipment hatch must be held in place by at least four bolts. Good engineering practice dictates that the bolts required by this LCO be approximately equally spaced.
| |
| The containment air locks, which are also part of the containment pressure boundary, provide a means for personnel access during MODES 1, 2, 3, and 4 unit operation in accordance with LCO 3.6.2, "Containment Air Locks." Each air lock has a door at both ends. The doors are normally interlocked to prevent simultaneous opening when containment OPERABILITY is required. During periods of unit shutdown when containment closure is not required, the door interlock mechanism may be disabled, allowing both doors of an air lock to remain open for extended periods when frequent containment entry is necessary.
| |
| During movement of irradiated fuel assemblies within containment, containment closure is required; therefore, the door interlock mechanism may remain disabled, but at least one air lock door must always remain capable of being closed.
| |
| Cook Nuclear Plant Unit 2 B 3.9.3-1 Revision No. 59
| |
| | |
| Containment Penetrations B 3.9.3 BASES BACKGROUND (continued)
| |
| The requirements for containment penetration closure ensure that a release of fission product radioactivity within containment will be restricted to within regulatory limits.
| |
| The Containment Purge Supply and Exhaust System includes a 24 inch purge supply penetration and a 30 inch exhaust penetration. During MODES 1, 2, 3, and 4, the two valves in each of the purge supply and exhaust penetrations are normally maintained closed. The Containment Purge Supply and Exhaust System is not subject to a Specification in MODE 5.
| |
| In MODE 6, large air exchangers are necessary to conduct refueling operations. The Containment Purge Supply and Exhaust System is used for this purpose.
| |
| The containment penetrations that provide direct access from containment atmosphere to outside atmosphere must be isolated on at least one side.
| |
| Isolation may be achieved by an OPERABLE automatic isolation valve, or by a manual isolation valve, blind flange, or equivalent. Equivalent isolation methods must be approved and may include use of a material that can provide a temporary, atmospheric pressure, ventilation barrier for the other containment penetrations during irradiated fuel movements.
| |
| APPLICABLE The fuel handling accident is a postulated event that involves damage to SAFETY irradiated fuel (Ref. 1). Fuel handling accidents, analyzed in Reference 1, ANALYSES involve dropping a single irradiated fuel assembly and handling tool. The requirements of LCO 3.9.6, "Refueling Cavity Water Level," in conjunction with a minimum decay time of 120 hours prior to irradiated fuel movement with containment closure capability, ensures that the release of fission product radioactivity, subsequent to a fuel handling accident, results in doses that are less than the values specified in 10 CFR 50.67 (Ref. 2).
| |
| Containment Penetrations satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO This LCO limits the consequences of a fuel handling accident in containment by limiting the potential escape paths for fission product radioactivity released within containment. The LCO requires any penetration providing direct access from the containment atmosphere to the outside atmosphere to be closed except for the OPERABLE containment purge supply and exhaust penetrations and the containment personnel air locks. For the OPERABLE containment purge supply and exhaust penetrations, this LCO ensures that these penetrations are isolable by the Containment Purge Supply and Exhaust System. The OPERABILITY requirements for this LCO ensure that the automatic purge Cook Nuclear Plant Unit 2 B 3.9.3-2 Revision No. 59
| |
| | |
| Containment Penetrations B 3.9.3 BASES LCO (continued) and exhaust valve closure times specified in the UFSAR can be achieved and, therefore, meet the assumptions used in the safety analysis to ensure that releases through the valves are terminated, such that radiological doses are within the acceptance limit.
| |
| The LCO is modified by a Note allowing penetration flow paths with direct access from the containment atmosphere to the outside atmosphere to be unisolated under administrative controls. Administrative controls ensure that 1) appropriate personnel are aware of the open status of the penetration flow path during movement of irradiated fuel assemblies within containment, and 2) specified individuals are designated and readily available to isolate the flow path in the event of a fuel handling accident.
| |
| The containment personnel air lock doors may be open during movement of irradiated fuel in the containment provided that one door is capable of being closed in the event of a fuel handling accident. A designated individual shall be available at all times during movement of irradiated fuel to close an air lock door if required. Cables or hoses transversing the air lock shall be designed to allow for removal in a timely manner (e.g., quick disconnects). Should a fuel handling accident occur inside containment, one personnel air lock door will be closed following an evacuation of containment.
| |
| APPLICABILITY The containment penetration requirements are applicable during movement of irradiated fuel assemblies within containment because this is when there is a potential for the limiting fuel handling accident. In MODES 1, 2, 3, and 4, containment penetration requirements are addressed by LCO 3.6.1. In MODES 5 and 6, when movement of irradiated fuel assemblies within containment is not being conducted, the potential for a fuel handling accident does not exist. Therefore, under these conditions no requirements are placed on containment penetration status.
| |
| ACTIONS A.1 If the containment equipment hatch, air locks, or any containment penetration that provides direct access from the containment atmosphere to the outside atmosphere is not in the required status, including the Containment Purge Supply and Exhaust System not capable of automatic actuation when the purge supply and exhaust valves are open, the unit must be placed in a condition where the isolation function is not needed.
| |
| This is accomplished by immediately suspending movement of irradiated fuel assemblies within containment. Performance of these actions shall not preclude completion of movement of a component to a safe position.
| |
| Cook Nuclear Plant Unit 2 B 3.9.3-3 Revision No. 63
| |
| | |
| Containment Penetrations B 3.9.3 BASES SURVEILLANCE SR 3.9.3.1 REQUIREMENTS This Surveillance demonstrates that each of the containment penetrations is in its required status. The LCO 3.9.3.c.2 status requirement, which requires penetrations to be capable of being closed by an OPERABLE Containment Purge Supply and Exhaust System, can be verified by ensuring each required valve operator is capable of closing automatically if needed. This Surveillance does not require cycling of the valves since this is performed at the appropriate frequency in accordance with SR 3.9.3.2.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.9.3.2 This Surveillance demonstrates that each required containment purge supply and exhaust valve actuates to its isolation position on manual initiation or on an actual or simulated high radiation signal. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| The SR is modified by a Note stating that this Surveillance is not required to be met for valves in isolated penetrations. The LCO provides the option to close penetrations in lieu of requiring automatic actuation capability.
| |
| REFERENCES 1. UFSAR, Section 14.2.1.5.
| |
| : 2. 10 CFR 50.67.
| |
| Cook Nuclear Plant Unit 2 B 3.9.3-4 Revision No. 60
| |
| | |
| RHR and Coolant Circulation - High Water Level B 3.9.4 B 3.9 REFUELING OPERATIONS B 3.9.4 Residual Heat Removal (RHR) and Coolant Circulation - High Water Level BASES BACKGROUND The purpose of the RHR System in MODE 6 is to remove decay heat and sensible heat from the Reactor Coolant System (RCS) to provide mixing of borated coolant and to prevent boron stratification (Ref. 1). Heat is removed from the RCS by circulating reactor coolant through the RHR heat exchanger(s), where the heat is transferred to the Component Cooling Water System. The coolant is then returned to the RCS via the RCS cold leg(s). Operation of the RHR System for normal cooldown or decay heat removal is manually accomplished from the control room.
| |
| The heat removal rate is adjusted by controlling the flow of reactor coolant through the RHR heat exchanger(s) and the bypass, as well as adjustments in Component Cooling Water System temperature and flow.
| |
| Mixing of the reactor coolant is maintained by this continuous circulation of reactor coolant through the RHR System.
| |
| APPLICABLE If the reactor coolant temperature is not maintained below 200°F, boiling SAFETY of the reactor coolant could result. This could lead to a loss of coolant in ANALYSES the reactor vessel. Additionally, boiling of the reactor coolant could lead to a reduction in boron concentration in the coolant due to boron plating out on components near the areas of the boiling activity. The loss of reactor coolant and the reduction of boron concentration in the reactor coolant would eventually challenge the integrity of the fuel cladding, which is a fission product barrier. One loop of the RHR System is required to be operational in MODE 6, with the water level 23 ft above the top of the reactor vessel flange, to prevent this challenge. The LCO does permit the RHR pump to be removed from operation for short durations, under the condition that the boron concentration is not diluted. This conditional stopping of the RHR pump does not result in a challenge to the fission product barrier.
| |
| The RHR System satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO Only one RHR loop is required for decay heat removal in MODE 6, with the water level 23 ft above the top of the reactor vessel flange. Only one RHR loop is required to be OPERABLE, because the volume of water above the reactor vessel flange provides backup decay heat removal capability. At least one RHR loop must be OPERABLE and in operation to provide:
| |
| : a. Removal of decay heat; and
| |
| : b. Mixing of borated coolant to minimize the possibility of criticality.
| |
| Cook Nuclear Plant Unit 2 B 3.9.4-1 Revision No. 0
| |
| | |
| RHR and Coolant Circulation - High Water Level B 3.9.4 BASES LCO (continued)
| |
| An OPERABLE RHR loop includes an RHR pump, a heat exchanger, valves, piping, instruments, and controls to ensure an OPERABLE flow path. The flow path starts in one of the RCS hot legs and is returned to at least one of the RCS cold legs. Management of gas voids is important to RHR System OPERABILITY.
| |
| The LCO is modified by a Note that allows the required operating RHR loop to be removed from operation for up to 1 hour per 8 hour period, provided no operations are permitted that would dilute the RCS boron concentration by introduction of coolant into the RCS with boron concentration less than required to meet the minimum boron concentration of LCO 3.9.1, "Boron Concentration." Boron concentration reduction with coolant at boron concentrations less than required to assure the RCS boron concentration is maintained is prohibited because uniform concentration distribution cannot be ensured without forced circulation. This permits operations such as core mapping or alterations in the vicinity of the reactor vessel hot leg nozzles and RCS to RHR isolation valve testing. During this 1 hour period, decay heat is removed by natural convection to the large mass of water in the refueling cavity.
| |
| APPLICABILITY One RHR loop must be OPERABLE and in operation in MODE 6, with the water level 23 ft above the top of the reactor vessel flange, to provide decay heat removal. The 23 ft water level was selected because it corresponds to the 23 ft requirement established for fuel movement in LCO 3.9.6, "Refueling Cavity Water Level." Requirements for the RHR System in other MODES are covered by LCOs in Section 3.4, "Reactor Coolant System (RCS)." RHR loop requirements in MODE 6 with the water level < 23 ft are located in LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation - Low Water Level."
| |
| ACTIONS RHR loop requirements are met by having one RHR loop OPERABLE and in operation, except as permitted in the Note to the LCO.
| |
| A.1 If RHR loop requirements are not met, there will be no forced circulation to provide mixing to establish uniform boron concentrations. Suspending positive reactivity additions that could result in failure to meet the minimum boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than that what would be required in the RCS for minimum refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation.
| |
| Cook Nuclear Plant Unit 2 B 3.9.4-2 Revision No. 57
| |
| | |
| RHR and Coolant Circulation - High Water Level B 3.9.4 BASES ACTIONS (continued)
| |
| A.2 If RHR loop requirements are not met, actions shall be taken immediately to suspend loading of irradiated fuel assemblies in the core. With no forced circulation cooling, decay heat removal from the core occurs by natural convection to the heat sink provided by the water above the core.
| |
| A minimum refueling water level of 23 ft above the reactor vessel flange provides an adequate available heat sink. Suspending any operation that would increase decay heat load, such as loading a fuel assembly, is a prudent action under this condition.
| |
| A.3 If RHR loop requirements are not met, actions shall be initiated and continued in order to satisfy RHR loop requirements. With the unit in MODE 6 and the refueling water level 23 ft above the top of the reactor vessel flange, corrective actions shall be initiated immediately.
| |
| A.4, A.5, and A.6 If no RHR is in operation, the following actions must be taken:
| |
| : a. The equipment hatch must be closed and secured with four bolts;
| |
| : b. One door in each air lock must be closed; and
| |
| : c. Each penetration providing direct access from the containment atmosphere to the outside atmosphere must be either closed by a manual or automatic isolation valve, blind flange, or equivalent, or verified to be capable of being closed by an OPERABLE Containment Purge Supply and Exhaust System.
| |
| With RHR loop requirements not met, the potential exists for the coolant to boil and release radioactive gas to the containment atmosphere.
| |
| Performing the actions described above ensures that all containment penetrations are either closed or can be closed so that the dose limits are not exceeded.
| |
| The Completion Time of 4 hours allows fixing of most RHR problems and is reasonable, based on the low probability of the coolant boiling in that time.
| |
| Cook Nuclear Plant Unit 2 B 3.9.4-3 Revision No. 0
| |
| | |
| RHR and Coolant Circulation - High Water Level B 3.9.4 BASES SURVEILLANCE SR 3.9.4.1 REQUIREMENTS This Surveillance demonstrates that the RHR loop is in operation and circulating reactor coolant. The flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability and to prevent thermal and boron stratification in the core. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.9.4.2 RHR System piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the RHR loops and may also prevent water hammer, pump cavitation, and pumping of noncondensible gas into the reactor vessel.
| |
| Selection of RHR System locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.
| |
| The RHR System is OPERABLE when it is sufficiently filled with water.
| |
| Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criterion for gas volume at the suction or discharge of a pump), the Surveillance is not met. If it is determined by subsequent evaluation that the RHR System is not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water), the Surveillance may be declared met. Accumulated gas should be eliminated or brought within the acceptance criteria limits.
| |
| RHR System locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative sub-set of susceptible locations.
| |
| Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible Cook Nuclear Plant Unit 2 B 3.9.4-4 Revision No. 60
| |
| | |
| RHR and Coolant Circulation - High Water Level B 3.9.4 BASES SURVEILLANCE REQUIREMENT (continued) location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 9.3.2.
| |
| Cook Nuclear Plant Unit 2 B 3.9.4-5 Revision No. 60
| |
| | |
| RHR and Coolant Circulation - Low Water Level B 3.9.5 B 3.9 REFUELING OPERATIONS B 3.9.5 Residual Heat Removal (RHR) and Coolant Circulation - Low Water Level BASES BACKGROUND The purpose of the RHR System in MODE 6 is to remove decay heat and sensible heat from the Reactor Coolant System (RCS) to provide mixing of borated coolant, and to prevent boron stratification (Ref. 1). Heat is removed from the RCS by circulating reactor coolant through the RHR heat exchangers where the heat is transferred to the Component Cooling Water System. The coolant is then returned to the RCS via the RCS cold leg(s). Operation of the RHR System for normal cooldown decay heat removal is manually accomplished from the control room. The heat removal rate is adjusted by controlling the flow of reactor coolant through the RHR heat exchanger(s) and the bypass lines, as well as adjustments in Component Cooling Water System temperature and flow. Mixing of the reactor coolant is maintained by this continuous circulation of reactor coolant through the RHR System.
| |
| APPLICABLE If the reactor coolant temperature is not maintained below 200°F, boiling SAFETY of the reactor coolant could result. This could lead to a loss of coolant in ANALYSES the reactor vessel. Additionally, boiling of the reactor coolant could lead to a reduction in boron concentration in the coolant due to the boron plating out on components near the areas of the boiling activity. The loss of reactor coolant and the reduction of boron concentration in the reactor coolant will eventually challenge the integrity of the fuel cladding, which is a fission product barrier. Two loops of the RHR System are required to be OPERABLE, and one loop in operation, in order to prevent this challenge.
| |
| The RHR System satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO In MODE 6, with the water level < 23 ft above the top of the reactor vessel flange, both RHR loops must be OPERABLE. Additionally, one loop of RHR must be in operation in order to provide:
| |
| : a. Removal of decay heat; and
| |
| : b. Mixing of borated coolant to minimize the possibility of criticality.
| |
| This LCO is modified by a Note that permits the RHR pumps to be removed from operation for 15 minutes when switching from one loop to another. The circumstances for stopping both RHR pumps are to be limited to situations when the outage time is short and the core outlet temperature is maintained at least 10°F below saturation temperature.
| |
| The Note prohibits boron dilution or draining operations when RHR forced flow is stopped.
| |
| Cook Nuclear Plant Unit 2 B 3.9.5-1 Revision No. 0
| |
| | |
| RHR and Coolant Circulation - Low Water Level B 3.9.5 BASES LCO (continued)
| |
| This LCO is modified by a Note that allows one RHR loop to be inoperable for a period of 2 hours provided the other loop is OPERABLE and in operation. Prior to declaring the loop inoperable, consideration should be given to the existing plant configuration. This consideration should include time to core boiling, potential for RCS draindown, and RCS makeup capability. This permits surveillance tests to be performed on the inoperable loop during a time when these tests are safe and possible.
| |
| An OPERABLE RHR loop consists of an RHR pump, a heat exchanger, valves, piping, instruments and controls to ensure an OPERABLE flow path. The flow path starts in one of the RCS hot legs and is returned to at least one of the RCS cold legs. Management of gas voids is important to RHR System OPERABILITY.
| |
| APPLICABILITY Two RHR loops are required to be OPERABLE, and one RHR loop must be in operation in MODE 6, with the water level < 23 ft above the top of the reactor vessel flange, to provide decay heat removal. Requirements for the RHR System in other MODES are covered by LCOs in Section 3.4, "Reactor Coolant System (RCS)." RHR loop requirements in MODE 6 with the water level 23 ft are located in LCO 3.9.4, "Residual Heat Removal (RHR) and Coolant Circulation - High Water Level."
| |
| ACTIONS A.1 and A.2 If less than the required number of RHR loops are OPERABLE, action shall be immediately initiated and continued until the RHR loop is restored to OPERABLE status and to operation or until 23 ft of water level is established above the reactor vessel flange. When the water level is 23 ft above the reactor vessel flange, the Applicability changes to that of LCO 3.9.4, and only one RHR loop is required to be OPERABLE and in operation. An immediate Completion Time is necessary for an operator to initiate corrective actions.
| |
| B.1 If no RHR loop is in operation, there will be no forced circulation to provide mixing to establish uniform boron concentrations. Suspending positive reactivity additions that could result in failure to meet the minimum boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than that what would be required in the RCS for minimum refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation.
| |
| Cook Nuclear Plant Unit 2 B 3.9.5-2 Revision No. 57
| |
| | |
| RHR and Coolant Circulation - Low Water Level B 3.9.5 BASES ACTIONS (continued)
| |
| B.2 If no RHR loop is in operation, actions shall be initiated immediately, and continued, to restore one RHR loop to operation. Since the unit is in Conditions A and B concurrently, the restoration of two OPERABLE RHR loops and one operating RHR loop should be accomplished expeditiously.
| |
| B.3, B.4, and B.5 If no RHR is in operation, the following actions must be taken:
| |
| : a. The equipment hatch must be closed and secured with four bolts;
| |
| : b. One door in each air lock must be closed; and
| |
| : c. Each penetration providing direct access from the containment atmosphere to the outside atmosphere must be either closed by a manual or automatic isolation valve, blind flange, or equivalent, or verified to be capable of being closed by an OPERABLE Containment Purge Supply and Exhaust System.
| |
| With RHR loop requirements not met, the potential exists for the coolant to boil and release radioactive gas to the containment atmosphere.
| |
| Performing the actions stated above ensures that all containment penetrations are either closed or can be closed so that the dose limits are not exceeded.
| |
| The Completion Time of 4 hours allows fixing of most RHR problems and is reasonable, based on the low probability of the coolant boiling in that time.
| |
| SURVEILLANCE SR 3.9.5.1 REQUIREMENTS This Surveillance demonstrates that one RHR loop is in operation and circulating reactor coolant. The flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability and to prevent thermal and boron stratification in the core. In addition, during operation of the RHR loop with the water level in the vicinity of the reactor vessel nozzles, the RHR pump suction requirements must be met. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Cook Nuclear Plant Unit 2 B 3.9.5-3 Revision No. 60
| |
| | |
| RHR and Coolant Circulation - Low Water Level B 3.9.5 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.9.5.2 Verification that the required pump is OPERABLE ensures that an additional RHR pump can be placed in operation, if needed, to maintain decay heat removal and reactor coolant circulation. Verification is performed by verifying proper breaker alignment and power available to the required pump. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by a Note that states the SR is not required to be performed until 24 hours after a required pump is not in operation.
| |
| SR 3.9.5.3 RHR System piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the RHR loops and may also prevent water hammer, pump cavitation, and pumping of noncondensible gas into the reactor vessel.
| |
| Selection of RHR System locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.
| |
| The RHR System is OPERABLE when it is sufficiently filled with water.
| |
| Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criterion for gas volume at the suction or discharge of a pump), the Surveillance is not met. If it is determined by subsequent evaluation that the RHR System is not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water), the Surveillance may be declared met. Accumulated gas should be eliminated or brought within the acceptance criteria limits.
| |
| RHR System locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance Cook Nuclear Plant Unit 2 B 3.9.5-4 Revision No. 60
| |
| | |
| RHR and Coolant Circulation - Low Water Level B 3.9.5 BASES SURVEILLANCE REQUIREMENTS (continued) criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative sub-set of susceptible locations.
| |
| Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 9.3.2.
| |
| Cook Nuclear Plant Unit 2 B 3.9.5-5 Revision No. 60
| |
| | |
| Refueling Cavity Water Level B 3.9.6 B 3.9 REFUELING OPERATIONS B 3.9.6 Refueling Cavity Water Level BASES BACKGROUND The movement of irradiated fuel assemblies within containment requires a minimum water level of 23 ft above the top of the reactor vessel flange.
| |
| During refueling, this maintains sufficient water level in the containment, refueling canal, fuel transfer canal, refueling cavity, and spent fuel pool.
| |
| Sufficient water is necessary to retain iodine fission product activity in the water in the event of a fuel handling accident (Ref. 1). Sufficient iodine activity would be retained to limit offsite doses from the accident to less than the of 10 CFR 50.67 limits.
| |
| APPLICABLE During movement of irradiated fuel assemblies, the water level in the SAFETY refueling canal and the refueling cavity is an initial condition design ANALYSES parameter in the analysis of a fuel handling accident in containment, as described in the UFSAR (Ref. 1). A minimum water level of 23 ft assures an acceptable decontamination factor for iodine.
| |
| The fuel handling accident analysis inside containment is described in Reference 1. With a minimum water level of 23 ft and a minimum decay time of 120 hours prior to fuel handling, the analysis and test programs demonstrate that the iodine release due to a postulated fuel handling accident is adequately captured by the water and offsite doses are maintained within allowable limits (Ref. 2).
| |
| Refueling cavity water level satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO A minimum refueling cavity water level of 23 ft above the reactor vessel flange is required to ensure that the radiological consequences of a postulated fuel handling accident inside containment are within acceptable limits.
| |
| APPLICABILITY LCO 3.9.6 is applicable when moving irradiated fuel assemblies within containment. The LCO minimizes the possibility of a fuel handling accident in containment that is beyond the assumptions of the safety analysis. If irradiated fuel assemblies are not being moved in containment, there can be no significant radioactivity release as a result of a postulated fuel handling accident. Requirements for fuel handling accidents in the spent fuel pool are covered by LCO 3.7.14, "Fuel Storage Pool Water Level."
| |
| Cook Nuclear Plant Unit 2 B 3.9.6-1 Revision No. 59
| |
| | |
| Refueling Cavity Water Level B 3.9.6 BASES ACTIONS A.1 With a water level of < 23 ft above the top of the reactor vessel flange, all operations involving movement of irradiated fuel assemblies within the containment shall be suspended immediately to ensure that a fuel handling accident cannot occur.
| |
| The suspension of fuel movement shall not preclude completion of movement of a component to a safe position.
| |
| SURVEILLANCE SR 3.9.6.1 REQUIREMENTS Verification of a minimum water level of 23 ft above the top of the reactor vessel flange ensures that the design basis for the analysis of the postulated fuel handling accident during refueling operations is met.
| |
| Water at the required level above the top of the reactor vessel flange limits the consequences of damaged fuel rods that are postulated to result from a fuel handling accident inside containment (Ref. 1).
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 14.2.1.
| |
| : 2. 10 CFR 50.67.
| |
| Cook Nuclear Plant Unit 2 B 3.9.6-2 Revision No. 60}}
| |
