|
|
| (One intermediate revision by the same user not shown) |
| Line 15: |
Line 15: |
|
| |
|
| =Text= | | =Text= |
| {{#Wiki_filter:TABLE OF CONTENTS B 2.0 SAFETY LIMITS (SLs)B 2.1.1 Reactor Core SLs ......... | | {{#Wiki_filter:}} |
| ............................
| |
| B 2.1.1-1 B 2.1.2 Reactor Coolant System (RCS) Pressure SL ...................................
| |
| B 2.1.2-1 B 3.0 LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY
| |
| ........ B 3.0-1 B 3.0 SURVEILLANCE REQUIREMENT (SR) APPLICABILITY
| |
| .......................
| |
| B 3.0-9 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.1 SHUTDOWN MARGIN (SDM) .........................................................
| |
| B 3.1.1-1 B 3 .1.2 C ore R eactivity
| |
| ................................................................................
| |
| B 3.1.2-1 B 3.1.3 Moderator Temperature Coefficient (MTC) ......................................
| |
| B 3.1.3-1 B 3.1.4 Rod G roup Alignm ent Lim its ............................................................
| |
| B 3.1.4-1 B 3.1.5 Shutdow n Bank Insertion Lim its .......................................................
| |
| B 3.1.5-1 B 3.1.6 C ontrol Bank Insertion Lim its ...........................................................
| |
| B 3.1.6-1 B 3.1.7 R od P osition Indication
| |
| ....................................................................
| |
| B 3.1.7-1 B 3.1.8 PHYSICS TESTS Exceptions
| |
| ..........................................................
| |
| B 3.1.8-1 B 3.2 POWER DISTRIBUTION LIMITS B 3.2.1 Heat Flux Hot Channel Factor (FQ(X,Y,Z))
| |
| ......................................
| |
| B 3.2.1-1 B 3.2.2 Nuclear Enthalpy Rise Hot Channel Factor (FAH(X,Y))
| |
| ...................
| |
| B 3.2.2-1 B 3.2.3 AXIAL FLUX DIFFERENCE (AFD) ..................................................
| |
| B 3.2.3-1 B 3.2.4 QUADRANT POWER TILT RATIO (QPTR) ....................................
| |
| B 3.2.4-1 B 3.3 INSTRUMENTATION B 3.3.1 Reactor Trip System (RTS) Instrumentation
| |
| ....................................
| |
| B 3.3.1-1 B 3.3.2 Engineered Safety Feature Actuation System (ESFAS)Instrumentation
| |
| .................................
| |
| B 3.3.2-1 B 3.3.3 Post Accident Monitoring (PAM) Instrumentation
| |
| .............................
| |
| B 3.3.3-1 B 3.3.4 Remote Shutdown System .............................
| |
| B 3.3.4-1 B 3.3.5 Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation.B 3.3.5-1 B 3 .3 .6 N ot U sed .........................................................................................
| |
| B 3 .3 .6 -1 B 3.4 REACTOR COOLANT SYSTEM (RCS)B 3.4.1 RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB) Lim its ..................................................
| |
| B 3.4.1-1 B 3.4.2 RCS Minimum Temperature for Criticality
| |
| .......................................
| |
| B 3.4.2-1 B 3.4.3 RCS Pressure and Temperature (P/T) Limits ..................................
| |
| B 3.4.3-1 B 3.4.4 RCS Loops-MODES 1 and 2 .........................................................
| |
| B 3.4.4-1 B 3.4.5 RCS Loops- M O DE 3 .....................................................................
| |
| B 3.4.5-1 B 3.4.6 RCS Loops- M O DE 4 .....................................................................
| |
| B 3.4.6-1 B 3.4.7 RCS Loops-MODE 5, Loops Filled ................................................
| |
| B 3.4.7-1 B 3.4.8 RCS Loops-MODE 5, Loops Not Filled ..........................................
| |
| B 3.4.8-1 B 3 .4 .9 P ressurizer
| |
| ......................................................................................
| |
| B 3 .4 .9-1 B 3.4.10 Pressurizer Safety Valves ................................................................
| |
| B 3.4.10-1 B 3.4.11 Pressurizer Power Operated Relief Valves (PORVs) .......................
| |
| B 3.4.11-1 B 3.4.12 Low Temperature Overpressure Protection (LTOP) System ............
| |
| B 3.4.12-1 B 3.4.13 RCS O perational LEAKAG E ............................................................
| |
| B 3.4.13-1 McGuire Units 1 and 2 Revision No. 87 TABLE OF CONTENTS B 3.4 REACTOR COOLANT SYSTEM (RCS) (continued)
| |
| B 3.4.14 RCS Pressure Isolation Valve (PIV) Leakage ..................................
| |
| B 3.4.14-1 B 3.4.15 RCS Leakage Detection Instrumentation
| |
| .........................................
| |
| B 3.4.15-1 B 3.4.16 R C S S pecific A ctivity .......................................................................
| |
| B 3.4.16-1 B 3.4.17 RCS Loops-Test Exceptions
| |
| .........................................................
| |
| B 3.4.17-1 B 3.4.18 Steam Generator (SG) Tube Integrity
| |
| ...............................................
| |
| B 3.4.18-1 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)B 3.5.1 A ccum ulators ...................................................................................
| |
| B 3.5.1-1 B 3.5.2 EC C S- O perating ...........................................................................
| |
| B 3.5.2-1 B 3.5.3 EC C S- S hutdow n ...........................................................................
| |
| B 3.5.3-1 B 3.5.4 Refueling Water Storage Tank (RWST) ..........................................
| |
| B 3.5.4-1 B 3 .5.5 S eal Injection Flow ...........................................................................
| |
| B 3.5.5-1 B 3.6 CONTAINMENT SYSTEMS B 3 .6 .1 C o nta inm e nt ....................................................................................
| |
| B 3 .6 .1-1 B 3.6.2 C ontainm ent A ir Locks .....................................................................
| |
| B 3.6.2-1 B 3.6.3 Containm ent Isolation Valves ..........................................................
| |
| B 3.6.3-1 B 3.6.4 C ontainm ent Pressure .....................................................................
| |
| B 3.6.4-1 B 3.6.5 Containment Air Temperature
| |
| ..........................................................
| |
| B 3.6.5-1 B 3.6.6 Containm ent Spray System .............................................................
| |
| B 3.6.6-1 B 3 .6 .7 N o t U s e d .........................................................................................
| |
| B 3.6.8 Hydrogen Skimmer System (HSS) ...................................................
| |
| B 3.6.8-1 B 3.6.9 Hydrogen Mitigation System (HMS) .................................................
| |
| B 3.6.9-1 B 3.6.10 Annulus Ventilation System (AVS) ...................................................
| |
| B 3.6.10-1 B 3.6.11 A ir Return System (A RS) .................................................................
| |
| B 3.6.11-1 B 3 .6 .12 Ice B e d ............................................................................................
| |
| B 3 .6 .12 -1 B 3.6.13 Ice C ondenser D oors .......................................................................
| |
| B 3.6.13-1 B 3.6.14 D ivider Barrier Integrity
| |
| ....................................................................
| |
| B 3.6.14-1 B 3.6.15 Containment Recirculation Drains ....................................................
| |
| B 3.6.15-1 B 3 .6 .16 R eactor B uilding ..............................................................................
| |
| B 3.6 .16-1 B 3.7 PLANT SYSTEMS B 3.7.1 Main Steam Safety Valves (MSSVs) ................................................
| |
| B 3.7.1-1 B 3.7.2 Main Steam Isolation Valves (MSIVs) ..............................................
| |
| B 3.7.2-1 B 3.7.3 Main Feedwater Isolation Valves (MFIVs), Main Feedwater Control Valves (MFCVs), MFCV's Bypass Valves and Main Feedwater (MFW) to Auxiliary Feedwater (AFW)Nozzle Bypass Valves (MFW/AFW NBVs) ...............................
| |
| B 3.7.3-1 B 3.7.4 Steam Generator Power Operated Relief Valves (SG PORVs) ....... B 3.7.4-1 B 3.7.5 Auxiliary Feedwater (AFW) System .................................................
| |
| B 3.7.5-1 B 3.7.6 Component Cooling Water (CCW) System ......................................
| |
| B 3.7.6-1 B 3.7.7 Nuclear Service Water System (NSWS) ..........................................
| |
| B 3.7.7-1 B 3.7.8 Standby Nuclear Service Water Pond (SNSWP) .............................
| |
| B 3.7.8-1 B 3.7.9 Control Room Area Ventilation System (CRAVS) ............................
| |
| B 3.7.9-1 B 3.7.10 Control Room Area Chilled Water System (CRACWS) ....................
| |
| B 3.7.10-1 B 3.7.11 Auxiliary Building Filtered Ventilation Exhaust System (ABFVES) ...B 3.7.11-1 McGuire Units 1 and 2 ii Revision No. 87 TABLE OF CONTENTS B 3.7 PLANT SYSTEMS (continued)
| |
| B 3.7.12 Fuel Handling Ventilation Exhaust System (FHVES) .......................
| |
| B 3.7.12-1 B 3.7.13 Spent Fuel Pool Water Level ..........................................................
| |
| B 3.7.13-1 B 3.7.14 Spent Fuel Pool Boron Concentration
| |
| ..............................................
| |
| B 3.7.14-1 B 3.7.15 Spent Fuel Assembly Storage .........................................................
| |
| B 3.7.15-1 B 3.7.16 Secondary Specific Activity ..............................................................
| |
| B 3.7.16-1 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.1 AC Sources-Operating
| |
| ..................................................................
| |
| B 3.8.1-1 B 3.8.2 AC Sources-Shutdown
| |
| .................................................................
| |
| B 3.8.2-1 B 3.8.3 Diesel Fuel Oil and Starting Air ........................................................
| |
| B 3.8.3-1 B 3.8.4 DC Sources-Operating
| |
| ..................................................................
| |
| B 3.8.4-1 B 3.8.5 DC Sources-Shutdown
| |
| ..................................................................
| |
| B 3.8.5-1 B 3.8.6 Battery C ell Param eters ...................................................................
| |
| B 3.8.6-1 B 3.8.7 Inverters-O perating .......................................................................
| |
| B 3.8.7-1 B 3.8.8 Inverters-S hutdow n .......................................................................
| |
| B 3.8.8-1 B 3.8.9 Distribution Systems-Operating
| |
| .....................................................
| |
| B 3.8.9-1 B 3.8.10 Distribution Systems-Shutdown
| |
| .....................................................
| |
| B 3.8.10-1 B 3.9 REFUELING OPERATIONS B 3.9 .1 B oron C oncentration
| |
| ........................................................................
| |
| B 3 .9.1-1 B 3.9.2 Unborated Water Source Isolation Valves .......................................
| |
| B 3.9.2-1 B 3.9.3 N uclear Instrum entation ...................................................................
| |
| B 3.9.3-1 B 3.9.4 Containment Penetrations
| |
| ...............................................................
| |
| B 3.9.4-1 B 3.9.5 Residual Heat Removal (RHR) and Coolant Circulation
| |
| -H ig h W ater Level ..................................................................
| |
| B 3.9.5-1 B 3.9.6 Residual Heat Removal (RHR) and Coolant Circulation
| |
| -Low W ater Level ...................................................................
| |
| B 3.9.6-1 B 3.9.7 Refueling Cavity Water Level ...........................................................
| |
| B 3.9.7-1 McGuire Units 1 and 2 iii Revision No. 87 McGuire Nuclear Station Technical Specification Bases LOES TS Bases are revised by section Page Number Revision BASES Revision Date ii iii B 2.1.1 B 2.1.2 B 3.0 B 3.1.1 B 3.1.2 B 3.1.3 B 3.1.4 B 3.1.5 B 3.1.6 B 3.1.7 B 3.1.8 B 3.2.1 B 3.2.2 B 3.2.3 B 3.2.4 B 3.3.1 B 3.3.2 (Unit 1)B 3.3.2 (Unit 2)B 3.3.3 (Unit 1)B 3.3.3 (Unit 2)B 3.3.4 B 3.3.5 B 3.3.6 B 3.4.1 B 3.4.2 B 3.4.3 (Revised per section)Revision 87 Revision 87 Revisibn 87 Revision 51 Revision 109 Revision 81 Revision 115 Revision 115 Revision 10 Revision 115 Revision 115 Revision 115 Revision 58 Revision 115 Revision 115 Revision 115 Revision 115 Revision 115 Revision 119 Revision 119 Revision 119 Revision 117 Revision 115 Revision 115 Revision 115 Not Used -Revision 87 Revision 115 Revision 0 Revision 115 8/15/07 8115/07 8/15/07 01/14/04 9/20/10 3/29/07 3/29/11 3/29/11 9/22/00 3/29/11 3/29/11 3/29/11 06/23/04 3/29/11 3/29/11 3/29/11 3/29/11 3/29/11 11/9/11 11/9/11 11/9/11 9/12/11 3/29/11 3/29/11 3/29/11 6/29/06 3/29/11 9/30/98 3/29/11 McGuire Units I and 2 Page I Revision I 10 Page Number Amendment Revision Date B 3.4.4 B 3.4.5 B 3.4.6 B 3.4.7 B 3.4.8 B 3.4.9 B 3.4.10 B 3.4.11 B 3.4.12 B 3.4.13 B 3.4.14 B 3.4.15 B 3.4.16 B 3.4.17 B 3.4.18 B 3.5.1 B 3.5.2 B 3.5.3 B 3.5.4 (Unit 1)B 3.5.4 (Unit 2)B 3.5.5 B 3.6.1 B 3.6.2 B 3.6.3 B 3.6.4 B 3.6.5 B 3.6.6 (Unit 1)B 3.6.6 (Unit 2)B 3.6.7 B 3.6.8 B 3.6.9 B 3.6.10 B 3.6.11 (Unit 1)B 3.6.11 -(Unit 2)Revision 115 Revision 115 Revision 115 Revision 115 Revision 115 Revision 115 Revision 102 Revision 115 Revision 115 Revision 115 Revision 115 Revision 115 Revision 115 Revision 115 Revision 86 Revision 115 Revision 116 Revision 57 Revision 117 Revision 115 Revision 115 Revision 53 Revision 115 Revision 115 Revision 115 Revision 115 Revision 117 Revision 115 Not Used -Revision 63 Revision 115 Revision 115 Revision 115 Revision 117 Revision 115 3/29/11 3/29/11 3/29/11 3/29/11 3/29/11 3/29/11 8/17/09 3/29/11 3/29/11 3/29/11 3/29/11 3/29/11 3/29/11 3/29/11 6/25/07 3/29/11 8/18/11 4/29/04 9/1211 3/29/11 3/29/11 2/17/04 3/29/11 3/29/11 3/29/11 3/29/11 9/12/11 3/29/11 4/4/05 3/29/11 3/29/11 3/29/11 9/12/11 3/29/11 McGuire Units I and 2P Page 2 Revision I110 Page Number Amendment Revision Date B 3.6.12 Revision 115 3/29/11 B 3.6.13 Revision 115 3/29/11 B 3.6.14 Revision 115 3/29/11 B 3.6.15 Revision 115 3/29/11 B 3.6.16 Revision 115 3/29/11 B 3.7.1 Revision 102 8/17/09 B 3.7.2 Revision 105 2/22/10 B 3.7.3 Revision 102 8/17/09 B 3.7.4 Revision 115 3/29/11 B 3.7.5 Revision 115 3/29/11 B 3.7.6 Revision 115 3/29/11 B 3.7.7 Revision 115 3/29/11 B 3.7.8 Revision 115 3/29/11 B 3.7.9 Revision 115 3/29/11 B 3.7.10 Revision 115 3/29/11 B 3.7.11 Revision 115 3/29/11 B 3.7.12 Revision 115 3/29/11 B 3.7.13 Revision 115 3/29/11 B 3.7.14 Revision 115 3/29/11 B 3.7.15 Revision 66 6/30/05 B 3.7.16 Revision 115 3/29/11 B 3.8.1 Revision 115 3/29/11 B 3.8.2 Revision 92 1/28/08 B 3.8.3 Revision 115 3/29/11 B 3.8.4 Revision 115 3/29/11 B 3.8.5 Revision 41 7/29/03 B 3.8.6 Revision 115 3/29/11 B 3.8.7 Revision 115 3/29/11 B 3.8.8 Revision 115 3/29/11 B 3.8.9 Revision 115 3/29/11 B 3.8.10 Revision 115 3/29/11 B 3.9.1 Revision 115 3/29/11 B 3.9.2 Revision 115 3/29/11 B 3.9.3 Revision 115 3/29/11 McGuire Units 1 and 2 Page 3 Revision I 10 Page Number B 3.9.4 B 3.9.5 B 3.9.6 B 3.9.7 Amendment Revision 115 Revision 115 Revision 115 Revision 115 Revision Date 3/29/11 3/29/11 3/29/11 3/29/11 Revision 110 McGuire Units 1 and 2 Page 4 Reactor Core SLs B 2.1.1 BASES B 2.0 SAFETY LIMITS (SLs)B 2.1.1 Reactor Core SLs BASES BACKGROUND GDC 10 (Ref. 1) requires that specified acceptable fuel design limits are not exceeded during steady state operation, normal operational transients, and anticipated operational occurrences (AOOs). This is accomplished by having a departure from nucleate boiling (DNB) design basis, which corresponds to a 95% probability at a 95% confidence level (the 95/95 DNB criterion) that DNB will not occur and by requiring that fuel centerline temperature stays below the melting temperature.
| |
| The restrictions of this SL prevent overheating of the fuel and cladding, as well as possible cladding perforation, that would result in the release of fission products to the reactor coolant. Overheating of the fuel is prevented by maintaining the transient peak linear heat rate (LHR) below the level at which fuel centerline melting occurs. Overheating of the fuel cladding is prevented by restricting fuel operation to within the nucleate boiling regime, where the heat transfer coefficient is large and the cladding surface temperature is slightly above the coolant saturation temperature.
| |
| Fuel centerline melting occurs when the local LHR, or power peaking, in a region of the fuel is high enough to cause the fuel centerline temperature to reach the melting point of the fuel. Expansion of the pellet upon centerline melting may cause the pellet to stress the cladding to the point of failure, allowing an uncontrolled release of activity to the reactor coolant.Operation above the boundary of the nucleate boiling regime could result in excessive cladding temperature because of the onset of DNB and the resultant sharp reduction in heat transfer coefficient.
| |
| Inside the steam film, high cladding temperatures are reached, and a cladding water (zirconium water) reaction may take place. This chemical reaction results in oxidation of the fuel cladding to a structurally weaker form. This weaker form may lose its integrity, resulting in an uncontrolled release of activity to the reactor coolant.The proper functioning of the Reactor Protection System (RPS) and steam generator safety valves prevents violation of the reactor core SLs.(/McGuire Units 1 and 2 B 2.1.1-1 Revision No. 51 McGuire Units 1 and 2 B 2.1.1-1 Revision No. 51 Reactor Core SLs B 2.1.1 BASES APPLICABLE SAFETY ANALYSES The fuel cladding must not sustain damage as a result of normal operation and AQOs. The reactor core SLs are established to preclude violation of the following fuel design criteria: a. There must be at least 95% probability at a 95% confidence level (the 95/95 DNB criterion) that the hot fuel rod in the core does not experience DNB; and b. The hot fuel pellet in the core must not experience centerline fuel melting.The Reactor Trip System setpoints (Ref. 2), in combination with all the LCOs, are designed to prevent any anticipated combination of transient conditions for Reactor Coolant System (RCS) temperature, RCS Flow Rate, Al, pressure, and THERMAL POWER level that would result in a departure from nucleate boiling ratio (DNBR) of less than the DNBR limit and preclude the existence of flow instabilities.
| |
| Automatic enforcement of these reactor core SLs is provided by the appropriate operation of the RPS and the steam generator safety valves.The SLs represent a design requirement for establishing the RPS trip setpoints identified previously.
| |
| LCO 3.4.1, "RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB) Limits," or the assumed initial conditions of the safety analyses (as indicated in the UFSAR, Ref. 2) provide more restrictive limits to ensure that the SLs are not exceeded.SAFETY LIMITS The Figure provided in the COLR shows the loci of points of Fraction of Rated Thermal power, RCS Pressure, and average temperature for which the minimum DNBR is not less than the safety analyses limit, that fuel centerline temperature remains below melting, that the average enthalpy in the hot leg is less than or equal to the enthalpy of saturated liquid, and that the exit quality is within the limits defined by the DNBR correlation.
| |
| The reactor core SLs are established to preclude violation of the following fuel design criteria: a. There must be at least 95% probability at a 95% confidence level (the 95 / 95 DNB criteria) that the hot fuel rod in the core does not experience DNB; and b. There must be at least a 95% probability at a 95%.confidence level that the hot fuel pellet in the core does not experience centerline fuel melting.The reactor core SLs are used to define the various RPS functions such that the above criteria are satisfied during steady state operation, normal McGuire Units 1 and 2 B 2.1.1-2 Revision No. 51 Reactor Core SLs B 2.1.1 BASES SAFETY LIMITS (Continued) operational transients, and anticipated operational occurrences (AOOs).To ensure that he RPS precludes the violation of the above criteria, additional criteria are applied to the Over Temperature and Overpower AT reactor trip functions.
| |
| That is, it must be demonstrated that the average enthalpy in the hot leg is less than or equal to the saturation enthalpy and that the core exit quality is within the limits defined by the DNBR correlation.
| |
| Appropriate functioning of the RPS ensures that for variations in the THERMAL POWER, RCS Pressure, RCS average temperature, RCS flow rate, and Al that the reactor core SLs will be satisfied during steady state operation, normal operational transients, and AOOs.APPLICABILITY SL 2.1.1 only applies in MODES 1 and 2 because these are the only MODES in which the reactor is critical.
| |
| Automatic protection functions are required to be OPERABLE during MODES 1 and 2 to ensure operation within the reactor core SLs. The steam generator safety valves or automatic protection actions serve to prevent RCS heatup to the reactor core SL conditions or to initiate a reactor trip function, which forces the unit into MODE 3. Setpoints for the reactor trip functions are specified in LCO 3.3.1, "Reactor Trip System (RTS) Instrumentation." In MODES 3, 4, 5, and 6, Applicability is not required since the reactor is not generating significant THERMAL POWER.SAFETY LIMIT If SL 2.1.1 is violated, the requirement to go to MODE 3 VIOLATIONS places the unit in a MODE in which this SL is not applicable.
| |
| The allowed Completion Time of 1 hour recognizes the importance of bringing the unit to a MODE of operation where this SL is not applicable, and reduces the probability of fuel damage.REFERENCES
| |
| : 1. 10 CFR 50, Appendix A, GDC 10.2. UFSAR, Section 7.2.McGuire Units 1 and 2 B 2.1.1-3 Revision No. 51 RCS Pressure SL B 2.1.2 B 2.0 SAFETY LIMITS (SLs)B 2.1.2 Reactor Coolant System (RCS) Pressure SL BASES BACKGROUND The SL on RCS pressure protects the integrity of the RCS against overpressurization.
| |
| In the event of fuel cladding failure, fission products are released into the reactor coolant. The RCS then serves as the primary barrier in preventing the release of fission products into the atmosphere.
| |
| By establishing an upper limit on RCS pressure, the continued integrity of the RCS is ensured. According to 10 CFR 50, Appendix A, GDC 14, "Reactor Coolant Pressure Boundary," and GDC 15, "Reactor Coolant System Design" (Ref. 1), the reactor coolant pressure boundary (RCPB) design conditions are not to be exceeded during normal operation and anticipated operational occurrences (AOOs).Also, in accordance with GDC 28, "Reactivity Limits" (Ref. 1), reactivity accidents, including rod ejection, do not result in damage to the RCPB greater than limited local yielding.The design pressure of the RCS is 2500 psia. During normal operation and AOOs, RCS pressure is limited from exceeding the design pressure by more than 10%, in accordance with Section III of the ASME Code (Ref. 2). To ensure system integrity, all RCS components are hydrostatically tested at 125% of design pressure, according to the ASME Code requirements prior to initial operation when there is no fuel in the core. Following inception of unit operation, RCS components shall be pressure tested, in accordance with the requirements of the ASME OM Code (Ref. 3).Overpressurization of the RCS could result in a breach of the RCPB. If such a breach occurs in conjunction with a fuel cladding failure, fission products could enter the containment atmosphere, raising concerns relative to limits on radioactive releases specified in 10 CFR 50.67,"Accident Source Term" (Ref. 4).APPLICABLE SAFETY ANALYSES The RCS pressurizer safety valves, the main steam safety valves (MSSVs), and the reactor high pressure trip have settings established to ensure that the RCS pressure SL will not be exceeded.The RCS pressurizer safety valves are sized to prevent system pressure from exceeding the design pressure by more than 10%, as specified in Section III of the ASME Code for Nuclear Power Plant Components McGuire Units 1 and 2 B 2.1.2-1 Revision No. 109 RCS Pressure SL B 2.1.2 BASES APPLICABLE SAFETY ANALYSES (continued)(Ref. 2), for anticipated operational occurrences.
| |
| During the transient, no control actions are assumed, except that the safety valves on the secondary 1l1ant are assumed to open when the steam pressure reaches the secondary plant safety valve settings, and nominal feedwater supply is maintained.
| |
| The Reactor Trip System setpoints (Ref. 5), together with the settings of the MSSVs, provide pressure protection for normal operation and AQOs.The reactor high pressure trip setpoint is specifically set to provide protection against overpressurization (Ref. 5). The safety analyses for both the high pressure trip and the RCS pressurizer safety valves are performed using conservative assumptions relative to pressure control devices.More specifically, no credit is taken for operation of the following:
| |
| : a. Pressurizer power operated relief valves (PORVs);b. Steam Generator (SG) PORVs;c. Steam Dump System;d. Rod Control System;e. Pressurizer Level Control System; or f. Pressurizer spray valves.SAFETY LIMITS The maximum transient pressure allowed in the RCS pressure vessel under the ASME Code, Section III, is 110% of design pressure.
| |
| The maximum transient pressure allowed in the RCS piping, valves, and fittings under ASME Code Section III (Ref. 2) is 120% of design pressure.The most limiting of these two allowances is the 110% of design pressure; therefore, the SL on maximum allowable RCS pressure is 2735 psig.APPLICABILITY SL 2.1.2 applies in MODES 1, 2, 3, 4, and 5 because this SL could be approached or exceeded in these MODES due to overpressurization events. The SL is not applicable in MODE 6 because the reactor vessel head closure bolts are not fully tightened, making it unlikely that the RCS can be pressurized.
| |
| McGuire Units 1 and 2 B 2.1.2-2 Revision No. 109 RCS Pressure SL B 2.1.2 BASES SAFETY LIMIT If the RCS pressure SL is violated when the reactor is in MODE 1 or 2, VIOLATIONS the requirement is to restore compliance and be in MODE 3 within 1 hour.Exceeding the RCS pressure SL may cause immediate RCS failure and create a potential for radioactive releases in excess of 10 CFR 50.67,"Accident Source Term," limits (Ref. 4).The allowable Completion Time of 1 hour recognizes the importance of reducing power level to a MODE of operation where the potential for challenges to safety systems is minimized.
| |
| If the RCS pressure SL is exceeded in MODE 3, 4, or 5, RCS pressure must be restored to within the SL value within 5 minutes. Exceeding the RCS pressure SL in MODE 3, 4, or 5 is more severe than exceeding this SL in MODE 1 or 2, since the reactor vessel temperature may be lower and the vessel material, consequently, less ductile. As such, pressure must be reduced to less than the SL within 5 minutes. The action does not require reducing MODES, since this would require reducing temperature, which would compound the problem by adding thermal gradient stresses to the existing pressure stress.REFERENCES
| |
| : 1. 10 CFR 50, Appendix A, GDC 14, GDC 15, and GDC 28.2. ASME, Boiler and Pressure Vessel Code, Section III, 1971 Edition, Winter 1971 Addenda.3. ASME Code for Operation and Maintenance of Nuclear Power Plants.4. 10 CFR 50.67, "Accident Source Term." 5. UFSAR, Section 7.2.McGuire Units 1 and 2 B 2.1.2-3 Revision No. 109 LCO B 3.0 B 3.0 LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY BASES LCOs LCO 3.0.1 through LCO 3.0.9 establish the general requirements applicable to all Specifications and apply at all times, unless otherwise stated.LCO 3.0.1 LCO 3.0.1 establishes the Applicability statement within each individual Specification as the requirement for when the LCO is required to be met (i.e., when the unit is in the MODES or other specified conditions of the Applicability statement of each Specification).
| |
| i LCO 3.0.2 LCO 3.0.2 establishes that upon discovery of a failure to meet an LCO, the associated ACTIONS shall be met. The Completion Time of each Required Action for an ACTIONS Condition is applicable from the point in time that an ACTIONS Condition is entered. The Required Actions establish those remedial measures that must be taken within specified Completion Times when the requirements of an LCO are not met. This Specification establishes that: a. Completion of the Required Actions within the specified Completion Times constitutes compliance with a Specification; and b. Completion of the Required Actions is not required when an LCO is met within the specified Completion Time, unless otherwise specified.
| |
| There are two basic types of Required Actions. The first type of Required Action specifies a time limit in which the LCO must be met. This time limit is the Completion Time to restore an inoperable system or component to OPERABLE status or to restore variables to within specified limits. If this type of Required Action is not completed within the specified Completion Time, a shutdown may be required to place the unit in a MODE or condition in which the Specification is not applicable. (Whether stated as a Required Action or not, correction of the entered Condition is an action that may always be considered upon entering ACTIONS.)
| |
| The second type of Required Action specifies the remedial measures that permit continued operation of the unit that is not further restricted by the Completion Time. In this case, compliance with the Required Actions provides an acceptable level of safety for continued operation.
| |
| McGuire Units 1 and 2 B 3.0-1 Revision No. 81 LCO Applicability B 3.0 BASES LCO (continued)
| |
| Completing the Required Actions is not required when an LCO is met or is no longer applicable, unless otherwise stated in the individual Specifications.
| |
| The nature of some Required Actions of some Conditions necessitates that, once the Condition is entered, the Required Actions must be completed even though the associated Conditions no longer exist. The individual LCO's ACTIONS specify the Required Actions where this is the case. An example of this is in LCO 3.4.3, "RCS Pressure and Temperature (P/T) Limits." The Completion Times of the Required Actions are also applicable when a system or component is removed from service intentionally.
| |
| The reasons for intentionally relying on the ACTIONS include, but are not limited to, performance of Surveillances, preventive maintenance, corrective maintenance, modifications, or investigation of operational problems.
| |
| Entering ACTIONS for these reasons must be done in a manner that does not compromise safety. Intentional entry into ACTIONS should not be made for operational convenience.
| |
| Alternatives that would not result in redundant equipment being inoperable should be used instead. Doing so limits the time both subsystems/trains of a safety function are inoperable and limits the time other conditions exist which result in LCO 3.0.3 being entered. Individual Specifications may specify a time limit for performing an SR when equipment is removed from service or bypassed for testing. In this case, the Completion Times of the Required Actions are applicable when this time limit expires, if the equipment remains removed from service or bypassed.When a change in MODE or other specified condition is required to comply with Required Actions, the unit may enter a MODE or other specified condition in which another Specification becomes applicable.
| |
| In this case, the Completion Times of the associated Required Actions would apply from the point in time that the new Specification becomes applicable, and the ACTIONS Condition(s) are entered.LCO 3.0.3 LCO 3.0.3 establishes the actions that must be implemented when an LCO is not met and: a. An associated Required Action and Completion Time is not met and no other Condition applies; or McGuire Units 1 and 2 B 3.0-2 Revision No. 81 LCO Applicability B 3.0 BASES LCO (continued)
| |
| : b. The condition of the unit is not specifically addressed by the associated ACTIONS. This means that no combination of Conditions stated in the ACTIONS can be made that exactly corresponds to the actual condition of the unit. Sometimes, possible combinations of Conditions are such that entering LCO 3.0.3 is warranted; in such cases, the ACTIONS specifically state a Condition corresponding to such combinations and also that LCO 3.0.3 be entered immediately.
| |
| This Specification delineates the time limits for placing the unit in a safe MODE or other specified condition when operation cannot be maintained within the limits for safe operation as defined by the LCO and its ACTIONS. It is not intended to be used as an operational convenience that permits routine voluntary removal of redundant systems or components from service in lieu of other alternatives that would not result in redundant systems or components being inoperable.
| |
| Upon entering LCO 3.0.3, 1 hour is allowed to prepare for an orderly shutdown before initiating a change in unit operation.
| |
| This includes time to permit the operator to coordinate the reduction in electrical generation with the load dispatcher to ensure the stability and availability of the electrical grid. If at the end of 1 hour, corrective measures which would allow existing LCO 3.0.3 are not complete, but there is reasonable assurance that corrective measures will be completed in time to still allow for an orderly unit shutdown, commencing a load decrease may be delayed until that time. The time limits specified to reach lower MODES of operation permit the shutdown to proceed in a controlled and orderly manner that is well within the specified maximum cooldown rate and within the capabilities of the unit, assuming that only the minimum required equipment is OPERABLE.
| |
| This reduces thermal stresses on components of the Reactor Coolant System and the potential for a plant upset that could challenge safety systems under conditions to which this Specification applies. The use and interpretation of specified times to complete the actions of LCO 3.0.3 are consistent with the discussion of Section 1.3, Completion Times.A unit shutdown required in accordance with LCO 3.0.3 may be terminated and LCO 3.0.3 exited if any of the following occurs: a. The LCO is now met.b. A Condition exists for which the Required Actions have now been performed.
| |
| : c. ACTIONS exist that do not have expired Completion Times. These Completion Times are applicable from the point in time that the Condition is initially entered and not from the time LCO 3.0.3 is exited.McGuire Units I and 2 B 3.0-3 Revision No. 81 LCO Applicability B 3.0 BASES LCO (continued)
| |
| The time limits of Specification 3.0.3 allow 37 hours for the unit to be in MODE 5 when a shutdown is required during MODE 1 operation.
| |
| If the unit is in a lower MODE of operation when a shutdown is required, the time limit for reaching the next lower MODE applies. If a lower MODE is reached in less time than allowed, however, the total allowable time to reach MODE 5, or other applicable MODE, is not reduced. For example, if MODE 3 is reached in 2 hours, then the time allowed for reaching MODE 4 is the next 11 hours, because the total time for reaching MODE 4 is not reduced from the allowable limit of 13 hours. Therefore, if remedial measures are completed that would permit a return to MODE 1, a penalty is not incurred by having to reach a lower MODE of operation in less than the total time allowed.In MODES 1, 2, 3, and 4, LCO 3.0.3 provides actions for Conditions not covered in other Specifications.
| |
| The requirements of LCO 3.0.3 do not apply in MODES 5 and 6 because the unit is already in the most restrictive Condition required by LCO 3.0.3. The requirements of LCO 3.0.3 do not apply in other specified conditions of the Applicability (unless in MODE 1, 2, 3, or 4) because the ACTIONS of individual Specifications sufficiently define the remedial measures to be taken.Exceptions to LCO 3.0.3 are provided in instances where requiring a unit shutdown, in accordance with LCO 3.0.3, would not provide appropriate remedial measures for the associated condition of the unit. An example of this is in LCO 3.7.13, "Spent Fuel Pool (SFP) Water Level." LCO 3.7.13 has an Applicability of "During movement of irradiated fuel assemblies in the spent fuel pool." Therefore, this LCO can be applicable in any or all MODES. If the LCO and the Required Actions of LCO 3.7.13 are not met while in MODE 1, 2, or 3, there is no safety benefit to be gained by placing the unit in a shutdown condition.
| |
| The Required Action of LCO 3.7.13 of "Suspend movement of irradiated fuel assemblies in the spent fuel pool" is the appropriate Required Action to complete in lieu of the actions of LCO 3.0.3. These exceptions are addressed in the individual Specifications.
| |
| LCO 3.0.4 LCO 3.0.4 establishes limitations on changes in MODES or other specified conditions in the Applicability when an LCO is not met. It allows placing the unit in a MODE or other specified condition stated in that Applicability (e.g., the Applicability desired to be entered) when unit conditions are such that the requirements of the LCO would not be met, in accordance with LCO 3.0.4.a, LCO 3.0.4.b, or LCO 3.0.4.c.LCO 3.0.4.a allows entry into a MODE or other specified condition in the Applicability with the LCO not met when the associated ACTIONS to be McGuire Units 1 and 2 B 3.0-4 Revision No. 81 LCO Applicability B 3.0 BASES LCO (continued) entered permit continued operation in the MODE or other specified condition in the Applicability for an unlimited period of time. Compliance with Required Actions that permit continued operation of the unit for an unlimited period of time in a MODE or other specified condition provides an acceptable level of safety for continued operation.
| |
| This is without regard to the status of the unit before or after the MODE change.Therefore, in such cases, entry into a MODE or other specified condition in the Applicability may be made in accordance with the provisions of the Required Actions.LCO 3.0.4.b allows entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering the MODE or other specified condition in the Applicability, and establishment of risk management actions, if appropriate.
| |
| The risk assessment may use quantitative, qualitative, or blended approaches, and the risk assessment will be conducted using the plant program, procedures, and criteria in place to implement 10 CFR 50.65(a)(4), which requires that risk impacts of maintenance activities to be assessed and managed. The risk assessments, for the purposes of LCO 3.0.4.b, must take into account all inoperable Technical Specifications equipment regardless of whether the equipment is included in the normal 10 CFR 50.65(a)(4) risk assessment scope. The risk assessments will be conducted using the procedures and guidance endorsed by Regulatory Guide 1.182, "Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants." Regulatory Guide 1.182 endorses the guidance in Section 11 of NUMARC 93-01,"Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants." These documents address general guidance for conduct of the risk assessment, quantitative and qualitative guidelines for establishing risk management actions, and example risk management actions. These include actions to plan and conduct other activities in a manner that controls overall risk, increased risk awareness by shift and management personnel, actions to reduce the duration of the condition, actions to minimize the magnitude of risk increases (establishment of backup success paths or compensatory measures), and determination that the proposed MODE change is acceptable.
| |
| Consideration should also be given to the probability of completing restoration such that the requirements of the LCO would be met prior to the expiration of ACTIONS Completion Times that would require exiting the Applicability.
| |
| LCO 3.0.4.b may be used with single, or multiple systems and components unavailable.
| |
| NUMARC 93-01 provides guidance relative to consideration of simultaneous unavailability of multiple systems and components.
| |
| McGuire Units 1 and 2 B 3.0-5 Revision No. 81 LCO Applicability B 3.0 BASES LCO (continued)
| |
| The results of the risk assessment shall be considered in determining the acceptability of entering the MODE or other specified condition in the Applicability, and any corresponding risk management actions. The LCO 3.0.4.b risk assessments do not have to be documented.
| |
| The Technical Specifications allow continued operation with equipment unavailable in MODE 1 for the duration of the Completion Time. Since this is allowable, and since in general the risk impact in that particular MODE bounds the risk of transitioning into and through the applicable MODES or other specified conditions in the Applicability of the LCO, the use of the LCO 3.0.4.b allowance should be generally acceptable, as long as the risk is assessed and managed as stated above. However, there is a small subset of systems and components that have been determined to be more important to risk and use of the LCO 3.0.4.b allowance is prohibited.
| |
| The LCOs governing these system and components contain Notes prohibiting the use of LCO 3.0.4.b by stating that LCO 3.0.4.b is not applicable.
| |
| LCO 3.0.4.c allows entry into a MODE or other specified condition in the Applicability with the LCO not met based on a Note in the Specification which states LCO 3.0.4.c is applicable.
| |
| These specific allowances permit entry into MODES or other specified conditions in the Applicability when the associated ACTIONS to be entered do not provide for continued operation for an unlimited period of time and a risk assessment has not been performed.
| |
| This allowance may apply to all the ACTIONS or to a specific Required Action of a Specification.
| |
| The risk assessments performed to justify the use of LCO 3.0.4.b usually only consider systems and components.
| |
| For this reason, LCO 3.0.4.c is typically applied to Specifications which describe values and parameters (e.g., RCS Specific Activity).
| |
| The provisions of this Specification should not be interpreted as endorsing the failure to exercise the good practice of restoring systems or components to OPERABLE status before entering an associated MODE or other specified condition in the Applicability.
| |
| The provisions of LCO 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS. In addition, the provisions of LCO 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that result from any unit shutdown.
| |
| In this context, a unit shutdown is defined as a change in MODE or other specified condition in the Applicability associated with transitioning from MODE I to MODE 2, MODE 2 to MODE 3, MODE 3 to MODE 4, and MODE 4 to MODE 5.McGuire Units 1 and 2 B 3.0-6 Revision No. 81 LCO Applicability B 3.0 BASES LCO (continued)
| |
| Upon entry into a MODE or other specified condition in the Applicability with the LCO not met, LCO 3.0.1 and LCO 3.0.2 require entry into the applicable Conditions and Required Actions until the condition is resolved, until the LCO is met, or until the unit is not within the Applicability of the Technical Specification.
| |
| Surveillances do not have to be performed on the associated inoperable equipment (or on variables outside the specified limits), as permitted by SR 3.0.1. Therefore, utilizing LCO 3.0.4 is not a violation of SR 3.0.1 or SR 3.0.4 for any Surveillances that have not been performed on inoperable equipment.
| |
| However, SRs must be met to ensure OPERABILITY prior to declaring the associated equipment OPERABLE (or variable within limits) and restoring compliance with the affected LCO.LCO 3.0.5 LCO 3.0.5 establishes the allowance for restoring equipment to service under administrative controls when it has been removed from service or declared inoperable to comply with ACTIONS. The sole purpose of this Specification is to provide an exception to LCO 3.0.2 (e.g., to not comply with the applicable Required Action(s))
| |
| to allow the performance of SRs to demonstrate:
| |
| : a. The OPERABILITY of the equipment being returned to service; or b. The OPERABILITY of other equipment.
| |
| The administrative controls ensure the time the equipment is returned to service in conflict with the requirements of the ACTIONS is limited to the time absolutely necessary to perform the allowed SRs. This Specification does not provide time to perform any other preventive or corrective maintenance.
| |
| An example of demonstrating the OPERABILITY of the equipment being returned to service is reopening a containment isolation valve that has been closed to comply with Required Actions and must be reopened to perform the SRs.An example of demonstrating the OPERABILITY of other equipment is taking an inoperable channel or trip system out of the tripped condition to prevent the trip function from occurring during the performance of an SR on another channel in the other trip system. A similar example of demonstrating the OPERABILITY of other equipment is taking an inoperable channel or trip system out of the tripped condition to permit the logic to function and indicate the appropriate response during the performance of an SR on another channel in the same trip system.McGuire Units 1 and 2 B 3.0-7 Revision No. 81 LCO Applicability B 3.0 BASES LCO 3.0.6 LCO 3.0.6 establishes an exception to LCO 3.0.2 for support systems that have an LCO specified in the Technical Specifications (TS). This exception is provided because LCO 3.0.2 would require that the Conditions and Required Actions of the associated inoperable supported system LCO be entered solely due to the inoperability of the support system. This exception is justified because the actions that are required to ensure the unit is maintained in a safe condition are specified in the support system LCO's Required Actions. These Required Actions may include entering the supported system's Conditions and Required Actions or may specify other Required Actions.When a support system is inoperable and there is an LCO specified for it in the TS, the supported system(s) are required to be declared inoperable if determined to be inoperable as a result of the support system inoperability.
| |
| However, it is not necessary to enter into the supported systems' Conditions and Required Actions unless directed to do so by the support system's Required Actions. The potential confusion and inconsistency of requirements related to the entry into multiple support and supported systems' LCOs' Conditions and Required Actions are eliminated by providing all the actions that are necessary to ensure the unit is maintained in a safe condition in the support system's Required Actions.However, there are instances where a support system's Required Action may either direct a supported system to be declared inoperable or direct entry into Conditions and Required Actions for the supported system.This may occur immediately or after some specified delay to perform some other Required Action. Regardless of whether it is immediate or after some delay, when a support system's Required Action directs a supported system to be declared inoperable or directs entry into Conditions and Required Actions for a supported system, the applicable Conditions and Required Actions shall be entered in accordance with LCO 3.0.2.Specification 5.5.15, "Safety Function Determination Program (SFDP)," ensures loss of safety function is detected and appropriate actions are taken. Upon entry into LCO 3.0.6, an evaluation shall be made to determine if loss of safety function exists. Additionally, other limitations, remedial actions, or compensatory actions may be identified as a result of the support system inoperability and corresponding exception to entering supported system Conditions and Required Actions. The SFDP implements the requirements of LCO 3.0.6.Cross train checks to identify a loss of safety function for those support systems that support multiple and redundant safety systems are required.The cross train check verifies that the supported systems of the redundant OPERABLE support system are OPERABLE, thereby ensuring safety function is retained.
| |
| If this evaluation determines that a loss of McGuire Units 1 and 2 B 3.0-8 Revision No. 81 LCO Applicability B 3.0 BASES LCO (continued) safety function exists, the appropriate Conditions and Required Actions of the LCO in which the loss of safety function exists are required to be entered.LCO 3.0.7 There are certain special tests and operations required to be performed at various times over the life of the unit. These special tests and operations are necessary to demonstrate select unit performance characteristics, to perform special maintenance activities, and to perform special evolutions.
| |
| Test Exception LCOs 3.1.8 and 3.4.17 allow specified Technical Specification (TS) requirements to be changed to permit performances of these special tests and operations, which otherwise could not be performed if required to comply with the requirements of these TS.Unless otherwise specified, all the other TS requirements remain unchanged.
| |
| This will ensure all appropriate requirements of the MODE or other specified condition not directly associated with or required to be changed to perform the special test or operation will remain in effect.The Applicability of a Test Exception LCO represents a condition not necessarily in compliance with the normal requirements of the TS.Compliance with Test Exception LCOs is optional.
| |
| A special operation may be performed either under the provisions of the appropriate Test Exception LCO or under the other applicable TS requirements.
| |
| If it is desired to perform the special operation under the provisions of the Test Exception LCO, the requirements of the Test Exception LCO shall be followed.LCO 3.0.8 LCO 3.0.8 establishes conditions under which systems are considered to remain capable of performing their intended safety function when associated snubbers are not capable of providing their associated support function(s).
| |
| This LCO states that the supported system is not considered to be inoperable solely due to one or more required snubbers not capable of performing their associated support function(s).
| |
| This is appropriate because a limited length of time is allowed for maintenance, testing, or repair of one or more required snubbers not capable of performing their associated support function(s) and appropriate compensatory measures are specified in the snubber requirements, which are located outside of the Technical Specification (TS) under licensee control. The snubber requirements do not meet the criteria in 10 CFR 50.36(c)(2)(ii), and, as such, are appropriate for control by the licensee.If the allowed time expires and the required snubber(s) are unable to perform their associated support function(s), the affected supported system's LCO(s) must be declared not met and the Conditions and Required Actions entered in accordance with LCO 3.0.2.McGuire Units 1 and 2 B 3.0-9 Revision No. 81 LCO Applicability B 3.0 BASES LCO (continued)
| |
| LCO 3.0.8 a applies when one or more required snubbers are not capable of providing their associated support junction(s) to a single train or subsystem of a multiple train or subsystem supported system or to a single train or subsystem supported system. LCO 3.0.8.a allows 72 hours to restore the required snubber(s) before declaring the supported system inoperable.
| |
| The 72 hour Completion Time is reasonable based on the low probability of a seismic event concurrent with an event that would require operation of the supported system occurring while the required snubber(s) are not capable of performing their associated support function and due to the availability of the redundant train of the supported system.LCO 3.0.8.b applies when one or more required snubbers are not capable of providing their associated support function(s) to more than one train or subsystem of a multiple train or subsystem supported system. LCO 3.0.8.b allows 12 hours to restore the required snubber(s) before declaring the supported system inoperable.
| |
| The 12 hour Completion Time is reasonable based on the low probability of a seismic event concurrent with an event that would required operation of the supported system occurring while the required snubber(s) are not capable of performing their associated support function.LCO 3.0.8 requires that risk be assessed and managed. Industry and NRC guidance on the implementation of 10 CFR 50.65(a)(4) (the Maintenance Rule) does not address seismic risk. However, use of LCO 3.0.8 should be considered with respect to other plant maintenance activities, and integrated into the existing Maintenance Rule process to the extent possible so that maintenance on any unaffected train or subsystem is properly controlled, and emergent issues are properly addressed.
| |
| The risk assessment need not be quantified, but may be a qualitative awareness of the vulnerability of systems and components when one or more required snubbers are not able to perform their associated support function.LCO 3.0.9 LCO 3.0.9 delineates the applicability of each specification to Unit 1 and I Unit 2 operations.
| |
| McGuire Units 1 and 2 B 3.0-10 Revision No. 81 B 3.0 SURVEILLANCE REQUIREMENT (SR) APPLICABILITY BASES SRs SR 3.0.1 through SR 3.0.5 establish the general requirements applicable to all Specifications and apply at all times, unless otherwise stated.SR 3.0.1 SR 3.0.1 establishes the requirement that SRs must be met during the MODES or other specified conditions in the Applicability for which the requirements of the LCO apply, unless otherwise specified in the individual SRs. This Specification is to ensure that Surveillances are performed to verify the OPERABILITY of systems and components, and that variables are within specified limits. Failure to meet a Surveillance within the specified Frequency, in accordance with SR 3.0.2, constitutes a failure to meet an LCO.Systems and components are assumed to be OPERABLE when the associated SRs have been met. Nothing in this Specification, however, is to be construed as implying that systems or components are OPERABLE when: a. The systems or components are known to be inoperable, although still meeting the SRs; or b. The requirements of the Surveillance(s) are known not to be met between required Surveillance performances.
| |
| Surveillances do not have to be performed when the unit is in a MODE or other specified condition for which the requirements of the associated LCO are not applicable, unless otherwise specified.
| |
| The SRs associated with a test exception are only applicable when the test exception is used as an allowable exception to the requirements of a Specification.
| |
| Unplanned events may satisfy the requirements (including applicable acceptance criteria) for a given SR. In this case, the unplanned event may be credited as fulfilling the performance of the SR. This allowance includes those SRs whose performance is normally precluded in a given MODE or other specified condition.
| |
| Surveillances, including Surveillances invoked by Required Actions, do not have to be performed on inoperable equipment because the ACTIONS define the remedial measures that apply. Surveillances have to be met and performed in accordance with SR 3.0.2, prior to returning equipment to OPERABLE status.McGuire Units 1 and 2 B 3.0-11 Revision No. 81 SR Applicability B 3.0 BASES SURVEILLANCE REQUIREMENT (continued)
| |
| Upon completion of maintenance, appropriate post maintenance testing is required to declare equipment OPERABLE.
| |
| This includes ensuring applicable Surveillances are not failed and their most recent performance is in accordance with SR 3.0.2. Post maintenance testing may not be possible in the current MODE or other specified conditions in the Applicability due to the necessary unit parameters not having been established.
| |
| In these situations, the equipment may be considered OPERABLE provided testing has been satisfactorily completed to the extent possible and the equipment is not otherwise believed to be incapable of performing its function.
| |
| This will allow operation to proceed to a MODE or other specified condition where other necessary post maintenance tests can be completed.
| |
| SR 3.0.2 SR 3.0.2 establishes the requirements for meeting the specified Frequency for Surveillances and any Required Action with a Completion Time that requires the periodic performance of the Required Action on a"once per.. ." interval.SR 3.0.2 permits a 25% extension of the interval specified in the Frequency.
| |
| This extension facilitates Surveillance scheduling and considers plant operating conditions that may not be suitable for conducting the Surveillance (e.g., transient conditions or other ongoing Surveillance or maintenance activities).
| |
| The 25% extension does not significantly degrade the reliability that results from performing the Surveillance at its specified Frequency.
| |
| This is based on the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the SRs. The exceptions to SR 3.0.2 are those Surveillances for which the 25% extension of the interval specified in the Frequency does not apply.These exceptions are stated in the individual Specifications.
| |
| The requirements of regulations take precedence over the TS.An example of where SR 3.0.2 does not apply is in the Containment Leakage Rate Testing Program. This program establishes testing requirements and frequencies in accordance with requirements of regulations.
| |
| The TS cannot in and of themselves extend a test interval specified in regulations.
| |
| As stated in SR 3.0.2, the 25% extension also does not apply to the initial portion of a periodic Completion Time that requires performance on a McGuire Units 1 and 2 B 3.0-12 Revision No. 81 SR Applicability B 3.0 BASES SURVEILLANCE REQUIREMENT (continued)"lonce per ..." basis. The 25% extension applies to each performance after the initial performance.
| |
| The initial performance of the Required Action, whether it is a particular Surveillance or some other remedial action, is considered a single action with a single Completion Time. One reason for not allowing the 25%extension to this Completion Time is that such an action usually verifies that no loss of function has occurred by checking the status of redundant or diverse components or the action accomplishes the function of the inoperable equipment in an alternative manner.The provisions of SR 3.0.2 are not intended to be used repeatedly merely as an operational convenience to extend Surveillance intervals (other than those consistent with refueling intervals) or periodic Completion Time intervals beyond those specified.
| |
| SR 3.0.3 SR 3.0.3 establishes the flexibility to defer declaring affected equipment inoperable or an affected variable outside the specified limits when a Surveillance has not been completed within the specified Frequency.
| |
| A delay period of up to 24 hours or up to the limit of the specified Frequency, whichever is greater, applies from the point in time that it is discovered that the Surveillance has not been performed in accordance with SR 3.0.2, and not at the time that the specified Frequency was not met.This delay period provides adequate time to complete Surveillances that have been missed. This delay period permits the completion of a Surveillance before complying with Required Actions or other remedial measures that might preclude completion of the Surveillance.
| |
| The basis for this delay period includes consideration of unit conditions, adequate planning, availability of personnel, the time required to perform the Surveillance, the safety significance of the delay in completing the required Surveillance, and the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the requirements.
| |
| When a Surveillance with a Frequency based not on time intervals, but upon specified unit conditions, operating situations, or requirements of regulations (e.g., prior to entering MODE 1 after each fuel loading, or in accordance with 10 CFR 50, Appendix J, as modified by approved exemptions, etc.).is discovered to not have been performed when specified, SR 3.0.3 McGuire Units 1 and 2 B 3.0-13 Revision No. 81 SR Applicability B 3.0 BASES SURVEILLANCE REQUIREMENT (continued) allows for the full delay period of up to the specified Frequency to perform the Surveillance.
| |
| However, since there is not a time interval specified, the missed Surveillance should be performed at the first reasonable opportunity.
| |
| SR 3.0.3 provides a time limit for, and allowances for the performance of, Surveillances that become applicable as a consequence of MODE changes imposed by Required Actions.Failure to comply with specified Frequencies for SRs is expected to be an infrequent occurrence.
| |
| Use of the delay period established by SR 3.0.3 is a flexibility which is not intended to be used as an operational convenience to extend Surveillance intervals.
| |
| While up to 24 hours or the limit of the specified Frequency is provided to perform the missed Surveillance, it is expected that the missed Surveillance will be performed at the first reasonable opportunity.
| |
| The determination of the first reasonable opportunity should include consideration of the impact on plant risk (from delaying the Surveillance as well as any plant configuration changes required or shutting the plant down to perform the Surveillance) and impact on any analysis assumptions, in addition to unit conditions, planning, availability of personnel, and the time required to perform the Surveillance.
| |
| This risk impact should be managed through the program in place to implement 10 CFR 50.65(a)(4) and its implementation guidance, NRC Regulatory Guide 1.182, 'Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants.' This Regulatory Guide addresses consideration of temporary and aggregate risk impacts, determination of risk management action thresholds, and risk management action up to and including plant shutdown.
| |
| The missed Surveillance should be treated as an emergent condition as discussed in the Regulatory Guide. The risk evaluation may use quantitative, qualitative, or blended methods. The degree of depth and rigor of the evaluation should be commensurate with the importance of the component.
| |
| Missed Surveillances for important components should be analyzed quantitatively.
| |
| If the results of the risk evaluation determine the risk increase is significant, this evaluation should be used to determine the safest course of action. All missed Surveillances will be placed in the licensee's Corrective Action Program.If a Surveillance is not completed within the allowed delay period, then the equipment is considered inoperable or the variable is considered outside the specified limits and the Completion Times of the Required Actions for the applicable LCO Conditions begin immediately upon expiration of the delay period. If a Surveillance McGuire Units 1 and 2 B 3.0-14 Revision No. 81 SR Applicability B 3.0 BASES SURVEILLANCE REQUIREMENT (continued) is failed within the delay period, then the equipment is inoperable, or the variable is outside the specified limits and the Completion Times of the Required Actions for the applicable LCO Conditions begin immediately upon the failure of the Surveillance.
| |
| Completion of the Surveillance within the delay period allowed by this Specification, or within the Completion Time of the ACTIONS, restores compliance with SR 3.0.1.SR 3.0.4 SR 3.0.4 establishes the requirement that all applicable SRs must be met before entry into a MODE or other specified condition in the Applicability.
| |
| This Specification ensures that system and component OPERABILITY requirements and variable limits are met before entry into MODES or other specified conditions in the Applicability for which these systems and components ensure safe operation of the unit. The provisions of this Specification should not be interpreted as endorsing the failure to exercise the good practice of restoring systems or components to OPERABLE status before entering an associated MODE or other specified condition in the Applicability.
| |
| A provision is included to allow entry into a MODE or other specified condition in the Applicability when an LCO is not met due to Surveillance not being met in accordance with LCO 3.0.4.However, in certain circumstances, failing to meet an SR will not result in SR 3.0.4 restricting a MODE change or other specified condition change. When a system, subsystem, division, component, device, or variable is inoperable or outside its specified limits, the associated SR(s) are not required to be performed, per SR 3.0.1, which states that surveillances do not have to be performed on inoperable equipment.
| |
| When equipment is inoperable, SR 3.0.4 does not apply to the associated SR(s)since the requirement for the SR(s) to be performed is removed.Therefore, failing to perform the Surveillance(s) within the specified Frequency does not result in an SR 3.0.4 restriction to changing MODES or other specified conditions of the Applicability.
| |
| However, since the LCO is not met in this instance, LCO 3.0.4 will govern any restrictions that may (or may not) apply to MODE or other specified condition changes. SR 3.0.4 does not restrict changing MODES or other specified conditions of the Applicability when a Surveillance has not been performed within the specified Frequency, provided the requirement to declare the LCO not met has been delayed in accordance with SR 3.0.3.McGuire Units 1 and 2 B 3.0-15 Revision No. 81 SR Applicability B 3.0 BASES SURVEILLANCE REQUIREMENT (continued)
| |
| The provisions of SR 3.0.4 shall not prevent entry into MODES or other specified conditions in the Applicability that are required to comply with ACTIONS. In addition, the provisions of SR 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that result from any unit shutdown.
| |
| In this context, a unit shutdown is defined as a change in MODE or other specified condition in the Applicability associated with transitioning from MODE 1 to MODE 2, MODE 2 to MODE 3, MODE 3 to MODE 4, and MODE 4 to MODE 5.The precise requirements for performance of SRs are specified such that exceptions to SR 3.0.4 are not necessary.
| |
| The specific time frames and conditions necessary for meeting the SRs are specified in the Frequency, in the Surveillance, or both. This allows performance of Surveillances when the prerequisite condition(s) specified in a Surveillance procedure require entry into the MODE or other specified condition in the Applicability of the associated LCO prior to the performance or completion of a Surveillance.
| |
| A Surveillance that could not be performed until after entering the LCO's Applicability, would have its Frequency specified such that it is not "due" until the specific conditions needed are met. Alternately, the Surveillance may be stated in the form of a Note, as not required (to be met or performed) until a particular event, condition, or time has been reached. Further discussion of the specific formats of SRs' annotation is found in Section 1.4, Frequency.
| |
| SR 3.0.5 SR 3.0.5 delineates the applicability of the surveillance activities to Unit 1 and Unit 2 operations.
| |
| McGuire Units 1 and 2 B 3.0-16 Revision No- 81 SDM B 3.1.1 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.1 SHUTDOWN MARGIN (SDM)BASES BACKGROUND According to GDC 26 (Ref. 1), the reactivity control systems must be redundant and capable of holding the reactor core subcritical when shut down under cold conditions.
| |
| Maintenance of the SDM ensures that postulated reactivity events will not damage the fuel.SDM requirements provide sufficient reactivity margin to ensure that acceptable fuel design limits will not be exceeded for normal shutdown and anticipated operational occurrences (AOOs). As such, the SDM defines the degree of subcriticality that would be obtained immediately following the insertion or trip of all shutdown and control rods, assuming that the single rod cluster control assembly of highest reactivity worth is fully withdrawn.
| |
| However, with all rod cluster control assemblies verified fully inserted by two independent means, it is not necessary to account for a stuck rod cluster control assembly in the shutdown margin calculation.
| |
| The system design requires that two independent reactivity control systems be provided, and that one of these systems be capable of maintaining the core subcritical under cold conditions.
| |
| These requirements are provided by the use of movable control assemblies and soluble boric acid in the Reactor Coolant System (RCS). The Rod Control System can compensate for the reactivity effects of the fuel and water temperature changes accompanying power level changes over the range from full load to no load. In addition, the Rod Control System, together with the boration system, provides the SDM during power operation and is capable of making the core subcritical rapidly enough to prevent exceeding acceptable fuel damage limits, assuming that the rod of highest reactivity worth remains fully withdrawn.
| |
| The soluble boron system can compensate for fuel depletion during operation and all xenon burnout reactivity changes and maintain the reactor subcritical under cold conditions.
| |
| During power operation, SDM control is ensured by operating with the shutdown banks fully withdrawn and the control banks within the limits of LCO 3.1.6, "Control Bank Insertion Limits." When the unit is in the shutdown and refueling modes, the SDM requirements are met by means of adjustments to the RCS boron concentration.
| |
| McGuire Units 1 and 2 B 3.1.1-1 Revision No. 115 SDM B 3.1.1 BASES APPLICABLE The minimum required SDM is assumed as an initial condition in safety SAFETY ANALYSES analyses.
| |
| The safety analysis (Ref. 2) establishes an SDM that ensures specified acceptable fuel design limits are not exceeded for normal operation and AQOs, with the assumption of the highest worth rod stuck out on a reactor trip.The acceptance criteria for the SDM requirements are that specified acceptable fuel design limits are maintained.
| |
| This is done by ensuring that: a. The reactor can eventually be made subcritical from all operating conditions, transients, and Design Basis Events;b. The reactivity transients associated with postulated accident conditions are controllable within acceptable limits (departure from nucleate boiling ratio (DNBR), fuel centerline temperature limits for AQOs, and _ 280 cal/gm energy deposition for the rod ejection accident);
| |
| and c. The reactor will be maintained sufficiently subcritical to preclude inadvertent criticality in the shutdown condition.
| |
| One limiting accident for the SDM requirements is based on a main steam line break (MSLB) in Mode 2, as described in the accident analysis (Ref. 2). The increased steam flow resulting from a pipe break in the main steam system causes an increased energy removal from the affected steam generator (SG), and consequently the RCS. This results in a reduction of the reactor coolant temperature.
| |
| The resultant coolant shrinkage causes a reduction in pressure.
| |
| In the presence of a negative moderator temperature coefficient, this cooldown causes an increase in core reactivity.
| |
| As RCS temperature decreases, the severity of an MSLB decreases.
| |
| The most limiting MSLB, with respect to potential fuel damage before a reactor trip occurs, is a break of a main steam line upstream of the Main Steam Isolation Valve initiated at the end of core life. The positive reactivity addition from the moderator temperature decrease will terminate when the affected SG boils dry, thus terminating RCS heat removal and cooldown.
| |
| Following the MSLB, a post-trip return-to-power may occur; however, no fuel damage occurs as a result of the post-trip return-to-power, and THERMAL POWER does not violate the Safety Limit (SL) requirement of SL 2.1.1.A potentially more limiting MSLB accident could occur for a steam line break outside containment when in Mode 3 with the low pressurizer pressure signal for safety injection actuation blocked. In this scenario, feedwater would not automatically isolate and the peak heat fluxes associated with the return-to-power may increase to values significantly McGuire Units 1 and 2 B 3.1.1-2 Revision No. 115 SDM B 3.1.1 BASES APPLICABLE SAFETY ANALYSES (continued) greater than those in the accident analysis (Ref. 2). Therefore, when safety injection is blocked, administrative controls on boron concentration are required to prevent a return-to-power following a steam line break.In addition to the limiting MSLB transient, the SDM requirement must also protect against: a. Inadvertent boron dilution;b. An uncontrolled rod withdrawal from subcritical or low power condition; and c. Rod ejection.Each of these events is discussed below.In the boron dilution analysis, the required SDM defines the reactivity difference between an initial subcritical boron concentration and the corresponding critical boron concentration.
| |
| These values, in conjunction with the configuration of the RCS and the assumed dilution flow rate, directly affect the results of the analysis.
| |
| This event is most limiting at the beginning of core life, when critical boron concentrations are highest.Depending on the system initial conditions and reactivity insertion rate, the uncontrolled rod withdrawal transient is terminated by either a high power level trip or a high pressurizer pressure trip. In all cases, power level, RCS pressure, linear heat rate, and the DNBR do not exceed allowable limits.The ejection of a control rod rapidly adds reactivity to the reactor core, causing both the core power level and heat flux to increase with corresponding increases in reactor coolant temperatures and pressure.The ejection of a rod also produces a time dependent redistribution of core power. SDM satisfies Criterion 2 of 10 CFR 50.36 (Ref. 3). Even though it is not directly observed from the control room, SDM is considered an initial condition process variable because it is periodically monitored to ensure that the unit is operating within the bounds of accident analysis assumptions.
| |
| Transients which are made less severe by the rapid insertion of control rod negative reactivity are also affected by the magnitude of the SDM limit. This is because the safety analyses assume a change in the rate of insertion of this negative reactivity when the SDM limit is reached. While the SDM is less than the limit value, the negative reactivity from the McGuire Units 1 and 2 B 3.1.1-3 Revision No. 115 SDM B 3.1.1 BASES APPLICABLE SAFETY ANALYSES (continued) control rods is assumed to be inserted as quickly as the rod worth vs.time curves shown in Reference
| |
| : 5. When the SDM limit value is reached, the rate of negative reactivity insertion is decreased so that it is only fast enough to compensate for any positive reactivity insertion, e.g., from the cooling of the fuel and moderator (which normally have negative temperature coefficients).
| |
| This methodology is conservative in that it does not take credit in the safety analyses, even temporarily, for a SDM greater than the limit value.LCO SDM is a core design condition that can be ensured during operation through control rod positioning (control and shutdown banks) and through the soluble boron concentration.
| |
| The MSLB (Ref. 2) and the boron dilution (Ref. 4) accidents are the most limiting analyses that establish the SDM value of the LCO. For MSLB accidents, if the LCO is violated, there is a potential to exceed the DNBR limit and to exceed 10 CFR 100, "Reactor Site Criteria," limits (Ref. 5).For the boron dilution accident, if the LCO is violated, the minimum required time assumed for operator action to terminate dilution may no longer be applicable.
| |
| APPLICABILITY In MODE 2 with keff < 1.0 and in MODES 3, 4, and 5, the SDM requirements are applicable to provide sufficient negative reactivity to meet the assumptions of the safety analyses discussed above. In MODE 6, the shutdown reactivity requirements are given in LCO 3.9.1,"Boron Concentration." In MODES 1 and 2 with keff> 1.0, SDM is ensured by complying with LCO 3.1.5, "Shutdown Bank Insertion Limits," and LCO 3.1.6.ACTIONS A. 1 If the SDM requirements are not met, boration must be initiated promptly.A Completion Time of 15 minutes is adequate for an operator to correctly align and start the required systems and components.
| |
| It is assumed that boration will be continued until the SDM requirements are met.In the determination of the required combination of boration flow rate and boron concentration, there is no unique requirement that must be satisfied.
| |
| Since it is imperative to raise the boron concentration of the RCS as soon as possible, the boron concentration should be a highly concentrated solution, such as that normally found in the boric acid McGuire Units 1 and 2 B 3.1.1-4 Revision No. 115 SDM B 3.1.1 BASES ACTIONS (continued) storage tank, or the refueling water storage tank. The operator should borate with the best source available for the plant conditions.
| |
| In determining the boration flow rate, the time in core life must be considered.
| |
| For instance, the most difficult time in core life to increase the RCS boron concentration is at the beginning of cycle when the boron concentration may approach or exceed 2000 ppm. Using its normal makeup path, the Chemical and Volume Control System (CVCS) is capable of inserting negative reactivity at a rate of approximately 30 pcm/min when the RCS boron concentration is 1000 ppm and approximately 35 pcm/min when the RCS boron concentration is 100 ppm. If the emergency boration path is used, the CVCS is capable of inserting negative reactivity at the rate of 65 pcm/min when the RCS boron concentration is 1000 ppm and 75 pcm/min when the RCS boron concentration is 100 ppm. Therefore, if SDM had to be increased by 1%Ak/k or 1000 pcm, normal makeup path at 1000 ppm could restore SDM in approximately 33 minutes. At 100 ppm, SDM could be restored in approximately 29 minutes. In the emergency boration mode at 1000 ppm, the 1% Ak/k could be restored in approximately 15 minutes. With RCS boron concentration at 100 ppm, SDM could be increased by 1000 pcm in approximately 13 minutes using emergency boration.
| |
| These boration parameters represent typical values and are provided for the purpose of offering a specific example.SURVEILLANCE SR 3.1.1.1 REQUIREMENTS In MODES 1 and 2 with kef _> 1.0, SDM is verified by observing that the requirements of LCO 3.1.5 and LCO 3.1.6 are met. In the event that a rod is known to be untrippable, however, SDM verification must account for the worth of the untrippable rod as well as another rod of maximum worth.In MODE 2 with keff < 1.0 and MODES 3, 4, and 5, SDM is verified by performing a reactivity balance calculation, considering the listed reactivity effects: a. RCS boron concentration;
| |
| : b. Control bank position;c. RCS average temperature;
| |
| : d. Fuel burnup based on gross thermal energy generation;
| |
| : e. Xenon concentration; McGuire Units 1 and 2 B 3.1.1-5 Revision No. 115 SDM B 3.1.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| : f. Samarium concentration; and g. Isothermal temperature coefficient (ITC).Using the ITC accounts for Doppler reactivity in this calculation because the reactor is subcritical, and the fuel temperature will be changing at the same rate as the RCS.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. 10 CFR 50, Appendix A, GDC 26.2. UFSAR, Section 15.1.5.3. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| : 4. UFSAR, Section 15.4.6.5. 10 CFR 100.McGuire Units 1 and 2 B 3.1.1-6 Revision No. 115 Core Reactivity B 3.1.2 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.2 Core Reactivity-BASES BACKGROUND According to GDC 26, GDC 28, and GDC 29 (Ref. 1), reactivity shall be controllable, such that subcriticality is maintained under cold conditions, and acceptable fuel design limits are not exceeded during normal operation and anticipated operational occurrences.
| |
| Therefore, reactivity balance is used as a measure of the predicted versus measured core reactivity during power operation.
| |
| The periodic confirmation of core reactivity is necessary to ensure that Design Basis Accident (DBA) and transient safety analyses remain valid. A large reactivity difference could be the result of unanticipated changes in fuel, control rod worth, or operation at conditions not consistent with those assumed in the predictions of core reactivity, and could potentially result in a loss of SDM or violation of acceptable fuel design limits. Comparing predicted versus measured core reactivity validates the nuclear methods used in the safety analysis and supports the SDM demonstrations (LCO 3.1.1,"SHUTDOWN MARGIN (SDM)) in ensuring the reactor can be brought safely to cold, subcritical conditions.
| |
| When the reactor core is critical or in normal power operation, a reactivity balance exists and the net reactivity is zero. A comparison of predicted and measured reactivity is convenient under such a balance, since parameters are being maintained relatively stable under steady state power conditions.
| |
| The positive reactivity inherent in the core design is balanced by the negative reactivity of the control components, thermal feedback, neutron leakage, and materials in the core that absorb neutrons, such as burnable absorbers producing zero net reactivity.
| |
| Excess reactivity can be inferred from the boron letdown curve (or critical boron curve), which provides an indication of the soluble boron concentration in the Reactor Coolant System (RCS) versus cycle burnup.Periodic measurement of the RCS boron concentration for comparison with the predicted value with other variables fixed (such as rod height, temperature, pressure, and power), provides a convenient method of ensuring that core reactivity is within design expectations and that the calculational models used to generate the safety analysis are adequate.In order to achieve the required fuel cycle energy output, the uranium enrichment, in the new fuel loading and in the fuel remaining from the previous cycle, provides excess positive reactivity beyond that required to McGuire Units 1 and 2 B 3.1.2-1 Revision No. 115 Core Reactivity B 3.1.2 BASES BACKGROUND (continued) sustain steady state operation throughout the cycle. When the reactor is critical at RTP and moderator temperature, the excess positive reactivity is compensated by burnable absorbers (if any), control rods, whatever neutron poisons (mainly xenon and samarium)are present in the fuel, and the RCS boron concentration.
| |
| When the core is producing THERMAL POWER, the fuel and burnable absorber are being depleted and excess reactivity (except possibly near BOC) is decreasing.
| |
| As the fuel and burnable absorber deplete, the RCS boron concentration is adjusted to compensate for the net core reactivity change while maintaining constant THERMAL POWER. The boron letdown curve is based on steady state operation at RTP. Therefore, deviations from the predicted boron letdown curve may indicate deficiencies in the design analysis, deficiencies in the calculational models, or abnormal core conditions, and must be evaluated.
| |
| APPLICABLE The acceptance criteria for core reactivity are that the reactivity balance SAFETY ANALYSES limit ensures plant operation is maintained within the assumptions of the safety analyses.Accurate prediction of core reactivity is either an explicit or implicit assumption in the accident analysis evaluations.
| |
| Every accident evaluation (Ref. 2) is, therefore, dependent upon accurate evaluation of core reactivity.
| |
| In particular, SDM and reactivity transients, such as control rod withdrawal accidents or rod ejection accidents, are very sensitive to accurate prediction of core reactivity.
| |
| These accident analysis evaluations rely on computer codes that have been qualified against available test data, operating plant data, and analytical benchmarks.
| |
| Monitoring reactivity balance additionally ensures that the nuclear methods provide an accurate representation of the core reactivity.
| |
| Design calculations and safety analyses are performed for each fuel cycle for the purpose of predetermining reactivity behavior and the RCS boron concentration requirements for reactivity control during fuel depletion.
| |
| The comparison between measured and predicted initial core reactivity provides a normalization for the calculational models used to predict core reactivity.
| |
| If the measured and predicted RCS boron concentrations for identical core conditions at beginning of cycle (BOC) do not agree, then the assumptions used in the reload cycle design analysis or the calculational models used to predict soluble boron requirements may not be accurate.
| |
| If reasonable agreement between measured and predicted core reactivity exists at BOC, then the prediction may be normalized to McGuire Units 1 and 2 B 3.1.2-2 Revision No. 115 Core Reactivity B 3.1.2 BASES APPLICABLE SAFETY ANALYSES (continued) the measured boron concentration.
| |
| Thereafter, any significant deviations in the measured boron concentration from the predicted boron letdown curve that develop during fuel depletion may be an indication that the calculational model is not adequate for core burnups beyond BOC, or that an unexpected change in core conditions has occurred.The normalization of predicted RCS boron concentration to the measured value is typically performed after reaching RTP following startup from a refueling outage, with the control rods in their normal positions for power operation.
| |
| The normalization is performed near BOC conditions, so that core reactivity relative to predicted values can be continually monitored and evaluated as core conditions change during the cycle.Core reactivity satisfies Criterion 2 of 10 CFR 50.36 (Ref. 3).LCO Long term core reactivity behavior is a result of the core physics design and cannot be easily controlled once the core design is fixed. During operation, therefore, the LCO can only be ensured through measurement and tracking, and appropriate actions taken as necessary.
| |
| Large differences between actual and predicted core reactivity may indicate that the assumptions of the DBA and transient analyses are no longer valid, or that the uncertainties in the Nuclear Design Methodology are larger than expected.
| |
| A limit on the reactivity balance of +/- 1% Ak/k has been established based on engineering judgment.
| |
| A 1% deviation in reactivity from that predicted is larger than expected for normal operation and should therefore be evaluated.
| |
| When measured core reactivity is within 1% Ak/k of the predicted value at steady state thermal conditions, the core is considered to be operating within acceptable design limits. Since deviations from the limit are normally detected by comparing predicted and measured steady state RCS critical boron concentrations, the difference between measured and predicted values would be between approximately 100 -150 ppm (depending on the boron worth) before the limit is reached. These values are well within the uncertainty limits for analysis of boron concentration samples, so that spurious violations of the limit due to uncertainty in measuring the RCS boron concentration are unlikely.APPLICABILITY The limits on core reactivity must be maintained during MODES 1 and 2 because a reactivity balance must exist when the reactor is critical or producing THERMAL POWER. As the fuel depletes, core conditions are changing, and confirmation of the reactivity balance ensures the core is McGuire Units 1 and 2 B 3.1.2-3 Revision No. 115 Core Reactivity B 3.1.2 BASES APPLICABILITY (continued) operating as designed.
| |
| This Specification does not apply in MODES 3, 4, and 5 because the reactor is shut down and the reactivity balance is not changing.In MODE 6, fuel loading results in a continually changing core reactivity.
| |
| Boron concentration requirements (LCO 3.9.1, "Boron Concentration")
| |
| ensure that fuel movements are performed within the bounds of the safety analysis.
| |
| An SDM demonstration is required during the first startup following operations that could have altered core reactivity (e.g., fuel movement, control rod replacement, control rod shuffling).
| |
| ACTIONS A.1 and A.2 Should an anomaly develop between measured and predicted core reactivity, an evaluation of the core design and safety analysis must be performed.
| |
| Core conditions are evaluated to determine their consistency with input to design calculations.
| |
| Measured core and process parameters are evaluated to determine that they are within the bounds of the safety analysis, and safety analysis calculational models are reviewed to verify that they are adequate for representation of the core conditions.
| |
| The required Completion Time of 72 hours is based on the low probability of a DBA occurring during this period, and allows sufficient time to assess the physical condition of the reactor and complete the evaluation of the core design and safety analysis.Following evaluations of the core design and safety analysis, the cause of the reactivity anomaly may be resolved.
| |
| If the cause of the reactivity anomaly is a mismatch in core conditions at the time of RCS boron concentration sampling, then a recalculation of the RCS boron concentration requirements may be performed to demonstrate that core reactivity is behaving as expected.
| |
| If an unexpected physical change in the condition of the core has occurred, it must be evaluated and corrected, if possible.
| |
| If the cause of the reactivity anomaly is in the calculation technique, then the calculational models must be revised to provide more accurate predictions.
| |
| If any of these results are demonstrated, and it is concluded that the reactor core is acceptable for continued operation, then the boron letdown curve may be renormalized and power operation may continue.
| |
| If operational restriction or additional SRs are necessary to ensure the reactor core is acceptable for continued operation, then they must be defined.The required Completion Time of 72 hours is adequate for preparing whatever operating restrictions or Surveillances that may be required to allow continued reactor operation.
| |
| McGuire Units 1 and 2 B 3.1.2-4 Revision No. 115 Core Reactivity B 3.1.2 BASES ACTIONS (continued)
| |
| B. 1 If the core reactivity cannot be restored to within the 1% Ak/k limit, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours. If the SDM for MODE 3 is not met, then the boration required by SR 3.1.1.1 would occur. The allowed Completion Time is reasonable, based on operating experience, for reaching MODE 3 from full power conditions in an orderly manner and without challenging plant systems.SURVEILLANCE SR 3.1.2.1 REQUIREMENTS Core reactivity is verified by periodic comparisons of measured and predicted RCS boron concentrations.
| |
| The comparison is made, considering that other core conditions are fixed or stable, including control rod position, moderator temperature, fuel temperature, fuel depletion, xenon concentration, and samarium concentration.
| |
| The Surveillance is performed prior to entering MODE 1 as an initial check on core conditions and design calculations at BOC. The SR is modified by a Note. The Note indicates that the normalization of predicted core reactivity to the measured value must take place within the first 60 effective full power days (EFPD) after each fuel loading. This allows sufficient time for core conditions to reach steady state, but prevents operation for a large fraction of the fuel cycle without establishing a benchmark for the design calculations.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. 10 CFR 50, Appendix A, GDC 26, GDC 28, and GDC 29.2. UFSAR, Chapter 15.3. 10 CFR 50.36, Technical Specification, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.1.2-5 Revision No. 115 MTC B 3.1.3 BASES B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.3 Moderator Temperature Coefficient (MTC)BASES BACKGROUND According to GDC 11 (Ref. 1), the reactor core and its interaction with the Reactor Coolant System (RCS) must be designed for inherently stable power operation, even in the possible event of an accident.
| |
| In particular, the net reactivity feedback in the system must compensate for any unintended reactivity increases.
| |
| The MTC relates a change in core reactivity to a change in reactor coolant temperature (a positive MTC means that reactivity increases with increasing moderator temperature; conversely, a negative MTC means that reactivity decreases with increasing moderator temperature).
| |
| The reactor is designed to operate with a negative MTC over the largest possible range of fuel cycle operation.
| |
| Therefore, a coolant temperature increase will cause a reactivity decrease, so that the coolant temperature tends to return toward its initial value. Reactivity increases that cause a coolant temperature increase will thus be self limiting, and stable power operation will result.MTC values are predicted at selected burnups during the safety evaluation analysis and are confirmed to be acceptable by measurements.
| |
| Both initial and reload cores are designed so that the MTC is less than zero when THERMAL POWER is at RTP. The actual value of the MTC is dependent on core characteristics, such as fuel loading and reactor coolant soluble boron concentration.
| |
| The core design may require additional fixed distributed poisons to yield an MTC at or near BOC within the range analyzed in the plant accident analysis.
| |
| For some designs, the burnable absorbers may burn out faster than the fuel depletes early in the cycle. This may cause the boron concentration to increase with burnup early in the cycle and the most positive MTC not to occur at BOC but somewhat later in the cycle. For these core designs, the predicted diffierence between the BOC MTC, and the most positive MTC is used to adjust the BOC measured MTC to ensure that the MTC remains less than the limit during the entire cycle. The end of cycle (EOC)MTC is also limited by the requirements of the accident analysis.
| |
| Fuel cycles that are designed to achieve high burnups or that have changes to other characteristics are evaluated to ensure that the MTC does not exceed the EOC limit.The limitations on MTC are provided to ensure that the value of this coefficient remains within the limiting conditions assumed in the UFSAR accident and transient analyses.McGuire Units 1 and 2 B 3.1.3-1 Revision No. 10 MTC B 3.1.3 BASES BACKGROUND (continued)
| |
| If the LCO limits are not met, the unit response during transients may not be as predicted.
| |
| The core could violate criteria that prohibit a return to criticality, or the departure from nucleate boiling ratio criteria of the approved correlation may be violated, which could lead to a loss of the fuel cladding integrity.
| |
| The SRs for measurement of the MTC at the beginning and near the end of the fuel cycle are adequate to confirm that the MTC remains within its limits, since this coefficient changes slowly, due principally to changes in RCS boron concentration associated with fuel and burnable absorber depletion.
| |
| APPLICABLE The acceptance criteria for the specified MTC are: SAFETY ANALYSES a. The MTC values must remain within the bounds of those used in the accident analysis (Ref. 2); and b. The MTC must be such that inherently stable power operations result during normal operation and accidents, such as overheating and overcooling events.The UFSAR, Chapter 15 (Ref. 2), contains analyses of accidents that result in both overheating and overcooling of the reactor core. MTC is one of the controlling parameters for core reactivity in these accidents.
| |
| Both the most positive value and most negative value of the MTC are important to safety, and both values must be bounded. Values used in the analyses consider worst case conditions to ensure that the accident results are bounding (Ref. 2).The consequences of accidents that cause core overheating must be evaluated when the MTC is positive.
| |
| Such accidents include the rod withdrawal transient from any power level (Ref. 3), turbine trip, and loss of forced reactor coolant flow. The consequences of accidents that cause core overcooling must be evaluated when the MTC is negative.
| |
| Such accidents include sudden feedwater flow increase and steam line break.In order to ensure a bounding accident analysis, the MTC is assumed to be its most limiting value for the analysis conditions appropriate to each accident.
| |
| The bounding value is determined by considering rodded and unrodded conditions, whether the reactor is at full or zero power, and whether it is the BOC or EOC life. The most conservative combination appropriate to the accident is then used for the analysis (Ref. 2).MTC values are bounded in reload safety evaluations assuming steady state conditions at BOC and EOC. An EOC measurement is conducted McGuire Units 1 and 2 B 3.1.3-2 Revision No. 10 MTC B 3.1.3 BASES APPLICABLE SAFETY ANALYSES (continued) at conditions when the RCS boron concentration reaches approximately 300 ppm. The measured value may be extrapolated to project the EOC value, in order to confirm reload design predictions.
| |
| MTC satisfies Criterion 2 of 10 CFR 50.36 (Ref. 4). Even though it is not directly observed and controlled from the control room, MTC is considered an initial condition process variable because of its dependence on boron concentration.
| |
| LCO LCO 3.1.3 requires the MTC to be within specified limits of the COLR to ensure that the core operates within the assumptions of the accident analysis.
| |
| During the reload core safety evaluation, the MTC is analyzed to determine that its values remain within the bounds of the original accident analysis during operation.
| |
| Assumptions made in safety analyses require that the MTC be less positive than a given upper bound and more positive than a given lower bound. The MTC is most positive at or near BOC; this upper bound must not be exceeded.
| |
| This maximum upper limit occurs at or near BOC, all rods out (ARO), hot zero power conditions.
| |
| For some core deisgns, the burnable absorbers may burnout faster than the fuel depletes early in the cycle. This may cause the boron concentration to increase with burnup early in the cycle and the most positive MTC not occur at BOC, but somewhat later in the cycle. For these core designs, the predicted distance between the BOC MTC, and the most positive MTC is used to adjust the BOC measrued MTC to ensure that the MTC remains less than the limit during the entire cycle. At EOC the MTC takes on its most negative value, when the lower bound becomes important.
| |
| This LCO exists to ensure that both the upper and lower bounds are not exceeded.During operation, therefore, the conditions of the LCO can only be ensured through measurement.
| |
| The Surveillance checks at BOC and EOC on MTC provide confirmation that the MTC is behaving as anticipated so that the acceptance criteria are met.The LCO establishes a maximum positive value that cannot be exceeded.The BOC positive limit and the EOC negative limit are established in the COLR to allow specifying limits for each particular cycle. This permits the unit to take advantage of improved fuel management and changes in unit operating schedule.APPLICABILITY Technical Specifications place both LCO and SR values on MTC, based on the safety analysis assumptions described above.McGuire Units 1 and 2 B 3.1.3-3 Revision No. 10 MTC B 3.1.3 BASES In MODE 1, the limits on MTC must be maintained to ensure that any accident initiated from THERMAL POWER operation will not violate the design assumptions of the accident analysis.
| |
| In MODE 2 with the reactor critical, the upper limit must also be maintained to ensure that startup and subcritical accidents (such as the uncontrolled control rod assembly or group withdrawal) will not violate the assumptions of the accident analysis.
| |
| The lower MTC limit must be maintained in MODES 2 and 3, in addition to MODE 1, to ensure that cooldown accidents will not violate the assumptions of the accident analysis.
| |
| In MODES 4, 5, and 6, this LCO is not applicable, since no Design Basis Accidents using the MTC as an analysis assumption are limiting when initiated from these MODES.ACTIONS A._1 If the BOC MTC limit is violated, administrative withdrawal limits for control banks must be established to maintain the MTC within its limits.The MTC becomes more negative with control bank insertion and decreased boron concentration.
| |
| A Completion Time of 24 hours provides enough time for evaluating the MTC measurement and computing the required bank withdrawal limits.Using physics calculations, the time in cycle life at which the calculated MTC will meet the LCO requirement can be determined.
| |
| At this point in core life Condition A no longer exists. The unit is no longer in the Required Action, so the administrative withdrawal limits are no longer in effect.B. 1 If the required administrative withdrawal limits at BOC are not established within 24 hours, the unit must be brought to MODE 2 with kff < 1.0 to prevent operation with an MTC that is more positive than that assumed in safety analyses.The allowed Completion Time of 6 hours is reasonable, based on operating experience, for reaching the required MODE from full power conditions in an orderly manner and without challenging plant systems.C._1 Exceeding the EOC MTC limit means that the safety analysis assumptions for the EOC accidents that use a bounding negative MTC value may be invalid. If the EOC MTC limit is exceeded, the plant must be brought to a MODE or condition in which the LCO requirements are not applicable.
| |
| To achieve this status, the unit must be brought to at least MODE 4 within 12 hours.McGuire Units 1 and 2 B 3.1.3-4 Revision No. 10 MTC B 3.1.3 BASES The allowed Completion Time is reasonable, based on operating experience, for reaching the required MODE from full power conditions in an orderly manner and without challenging plant systems.SURVEILLANCE SR 3.1.3.1 REQUIREMENTS This SR requires measurement of the MTC at BOC prior to entering MODE 1 in order to demonstrate compliance with the positive MTC LCO.Meeting the limit prior to entering MODE 1 ensures that the limit will also be met at higher power levels.The BOC MTC value for ARO will be inferred from isothermal temperature coefficient measurements obtained during the physics tests after refueling.
| |
| If appropriate, the ARO value is adjusted to account for any increase in the MTC early in the cycle. The ARO value can then be directly compared to the BOC MTC limit of the LCO. If required, measurement results and predicted design values can be used to establish administrative withdrawal limits for control banks.SR 3.1.3.2 In similar fashion, the LCO demands that the MTC be less negative than the specified value for EOC full power conditions.
| |
| This measurement may be performed at any THERMAL POWER, but its results must be extrapolated to the conditions of RTP and all banks withdrawn in order to make a proper comparison with the LCO value. Because the RTP MTC value will gradually become more negative with further core depletion and boron concentration reduction, a 300 ppm SR value of MTC should necessarily be less negative than the EOC LCO limit. The 300 ppm SR value is sufficiently less negative than the EOC LCO limit value to ensure that the LCO limit will be met when the 300 ppm Surveillance criterion is met.SR 3.1.3.2 is modified by three Notes that include the following requirements:
| |
| : a. The SR must be performed within 7 effective full power days (EFPD) after reaching the equivalent of an equilibrium RTP all rods out (ARO) boron concentration of 300 ppm for the reasons discussed above.b. If the 300 ppm Surveillance limit is exceeded, it is possible that the EOC limit on MTC could be reached before the planned EOC.Because the MTC changes slowly with core depletion, the Frequency of 14 EFPD is sufficient to avoid exceeding the EOC limit.McGuire Units 1 and 2 B 3.1.3-5 Revision No. 10 MTC B 3.1.3 BASES c. The Surveillance limit for RTP boron concentration of 60 ppm is conservative.
| |
| If the measured MTC at 60 ppm is more positive than the 60 ppm Surveillance limit, the EOC limit will not be exceeded because of the gradual manner in which MTC changes with core burnup.REFERENCES
| |
| : 1. 10 CFR 50, Appendix A, GDC 11.2. UFSAR, Chapter 15.3. UFSAR, Section 15.4.4. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.1.3-6 Revision No. 10 Rod Group Alignment Limits B 3.1.4 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.4 Rod Group Alignment Limits BASES BACKGROUND The OPERABILITY (e.g., trippability) of the shutdown and control rods is an initial assumption in all safety analyses that assume rod insertion upon reactor trip. Maximum rod misalignment is an initial assumption in the safety analysis that directly affects core power distributions and assumptions of available SDM.The applicable criteria for these reactivity and power distribution design requirements are 10 CFR 50, Appendix A, GDC 10, "Reactor Design," GDC 26, "Reactivity Control System Redundancy and Protection" (Ref. 1), and 10 CFR 50.46, "Acceptance Criteria for Emergency Core Cooling Systems for Light Water Nuclear Power Plants" (Ref. 2).Mechanical or electrical failures may cause a control rod to become inoperable or to become misaligned from its group. Control rod inoperability or misalignment may cause increased power peaking, due to the asymmetric reactivity distribution and a reduction in the total available rod worth for reactor shutdown.
| |
| Therefore, control rod alignment and OPERABILITY are related to core operation in design power peaking limits and the core design requirement of a minimum SDM.Limits on control rod alignment have been established, and all rod positions are monitored and controlled during power operation to ensure that the power distribution and reactivity limits defined by the design power peaking and SDM limits are preserved.
| |
| Rod cluster control assemblies (RCCAs), or rods, are moved by their control rod drive mechanisms (CRDMs). Each CRDM moves its RCCA one step (approximately 5/8 inch) at a time, but at varying rates (steps per minute) depending on the signal output from the Rod Control System.The RCCAs are divided among control banks and shutdown banks. Each bank may be further subdivided into two groups to provide for precise reactivity control. A group consists of two or more RCCAs that are electrically paralleled to step simultaneously.
| |
| A bank of RCCAs consists of two groups that are moved in a staggered fashion, but always within one step of each other. The unit has four control banks and five shutdown banks.McGuire Units 1 and 2 B 3.1.4-1 Revision No. 115 Rod Group Alignment Limits B 3.1.4 BASES BACKGROUND (continued)
| |
| The shutdown banks are maintained either in the fully inserted or fully withdrawn position.
| |
| The control banks are moved in an overlap pattern as described in the Bases for LCO 3.1.6, "Control Bank Insertion Limits." The control rods are arranged in a radially symmetric pattern, so that control bank motion does not introduce radial asymmetries in the core power distributions.
| |
| The axial position of shutdown rods and control rods is indicated by two separate and independent systems, which are the Bank Demand Position Indication System (commonly called group step counters) and the Digital Rod Position Indication (DRPI) System.The Bank Demand Position Indication System counts the pulses from the rod control system that moves the rods. There is one step counter for each group of rods. Individual rods in a group all receive the same signal to move and should, therefore, all be at the same position indicated by the group step counter for that group. The Bank Demand Position Indication System is considered highly precise (+/- 1 step or +/- 5/8 inch). If a rod does not move one step for each demand pulse, the step counter will still count the pulse and incorrectly reflect the position of the rod.The DRPI System provides a highly accurate indication of actual control rod position, but at a lower precision than the step counters.
| |
| This system is based on inductive analog signals from a series of coils spaced along a hollow tube with a center to center distance of 3.75 inches, which is six steps. To increase the reliability of the system, the inductive coils are connected alternately to data system A or B. Thus, if one system fails, the DRPI will go on half-accuracy with an effective coil spacing of 7.5 inches, which is 12 steps. Therefore, the normal indication accuracy of the DRPI System is +/- 6 steps (+/- 3.75 inches), and the maximum uncertainty is+ 12 steps (+/- 7.5 inches). With an indicated deviation of 12 steps between the group step counter and DRPI, the maximum deviation between actual rod position and the demand position could be 24 steps, or 15 inches.McGuire Units 1 and 2 B 3.1.4-2 Revision No. 115 Rod Group Alignment Limits B 3.1.4 BASES APPLICABLE Control rod misalignment accidents are analyzed in the safety analysis SAFETY ANALYSES (Ref. 3). The acceptance criteria for addressing control rod inoperability or misalignment are that: a. There be no violations of: 1. specified acceptable fuel design limits, or 2. Reactor Coolant System (RCS) pressure boundary integrity; and b. The core remains subcritical after accident transients.
| |
| Two types of misalignment are distinguished.
| |
| During movement of a control rod group, one rod may stop moving, while the other rods in the group continue.
| |
| This condition may cause excessive power peaking.The second type of misalignment occurs if one rod fails to insert upon a reactor trip and remains stuck fully withdrawn.
| |
| This condition requires an evaluation to determine that sufficient reactivity worth is held in the control rods to meet the SDM requirement, with the maximum worth rod stuck fully withdrawn.
| |
| Analyses are performed in regard to static rod misalignment, single rod withdrawal, dropped rod, and dropped group of rods (Ref. 4). With control banks at their insertion limits, one type of analysis considers the case when any one rod is completely inserted into the core. The second type of analysis considers the case of a completely withdrawn single rod from a bank inserted to its insertion limit. Satisfying limits on departure from nucleate boiling ratio in both of these cases bounds the situation when a rod is misaligned from its group by 12 steps. Another type of misalignment occurs if one RCCA fails to insert upon a reactor trip and remains stuck fully withdrawn.
| |
| This condition is assumed in the evaluation to determine that the required SDM is met with the maximum worth RCCA also fully withdrawn (Ref. 5).The Required Actions in this LCO ensure that either deviations from the alignment limits will be corrected or that THERMAL POWER will be adjusted so that excessive local linear heat rates (LHRs) will not occur, and that the requirements on SDM and ejected rod worth are preserved.
| |
| Continued operation of the reactor with a misaligned control rod is allowed if the heat flux hot channel factor (Fo(X,Y,Z))
| |
| and the nuclear enthalpy hot channel factor (FNAH(X,Y))
| |
| are verified to be within their limits in the COLR and the safety analysis is verified to remain valid.When a control rod is misaligned, the assumptions that are used to determine the rod insertion limits, AFD limits, and quadrant power tilt limits are not preserved.
| |
| Therefore, the limits may not preserve the McGuire Units 1 and 2 B 3.1.4-3 Revision No. 115 Rod Group Alignment Limits B 3.1.4 BASES APPLICABLE SAFETY ANALYSES (continued) design peaking factors, and FQ(X,Y,Z) and FNAH(X,Y) must be verified directly by incore mapping. Bases Section 3.2 (Power Distribution Limits)contains more complete discussions of the relation of Fa(X,Y,Z) and FN H(X,Y) to the operating limits.Shutdown and control rod OPERABILITY and alignment are directly related to power distributions and SDM, which are initial conditions assumed in the safety analyses.
| |
| Therefore they satisfy Criterion 2 of 10 CFR 50.36 (Ref. 6).LCO The requirements on rod OPERABILITY ensure that upon reactor trip, the assumed reactivity will be available and will be inserted.
| |
| The limits on shutdown and control rod alignments ensure that the assumptions in the safety analysis will remain valid, and that the RCCAs and banks maintain the correct power distribution and rod alignments.
| |
| The requirement to maintain the alignment of any one rod to within plus or minus 12 steps is conservative.
| |
| The minimum misalignment assumed in safety analysis is 24 steps (15 inches), and in some cases a total misalignment from fully withdrawn to fully inserted is assumed. Failure to meet the requirements of this LCO may produce unacceptable power peaking factors and LHRs, or unacceptable SDMs, all of which may constitute initial conditions inconsistent with the safety analysis.APPLICABILITY The requirements on RCCA OPERABILITY and alignment are applicable in MODES 1 and 2 because these are the only MODES in which neutron (or fission) power is generated, and the OPERABILITY (i.e., trippability) and alignment of rods have the potential to affect the safety of the plant. In MODES 3, 4, 5, and 6, the alignment limits do not apply because the control rods are normally bottomed and the reactor is shut down and not producing fission power. In the shutdown MODES, the OPERABILITY of the shutdown and control rods has the potential to affect the required SDM, but this effect can be compensated for by an increase in the boron concentration of the RCS. See LCO 3.1.1, "SHUTDOWN MARGIN (SDM)," for SDM in MODES 3, 4, and 5 and LCO 3.9.1, "Boron Concentration," for boron concentration requirements during refueling.
| |
| ACTIONS A.1.1 and A.1.2 When one or more rods are untrippable, there is a possibility that the required SDM may be adversely affected.
| |
| Under these conditions, it is McGuire Units 1 and 2 B 3.1.4-4 Revision No. 115 Rod Group Alignment Limits B 3.1.4 BASES ACTIONS (continued) important to determine the SDM, and if it is less than the required value, initiate boration until the required SDM is recovered.
| |
| The Completion Time of 1 hour is adequate for determining SDM and, if necessary, for initiating boration to restore SDM.In this situation, SDM verification must include the worth of the untrippable rod, as well as a rod of maximum worth.A.2 If the untrippable rod(s) cannot be restored to OPERABLE status, the plant must be brought to a MODE or condition in which the LCO requirements are not applicable.
| |
| To achieve this status, the unit must be brought to at least MODE 3 within 6 hours.The allowed Completion Time is reasonable, based on operating experience, for reaching MODE 3 from full power conditions in an orderly manner and without challenging plant systems.B. 1 When a rod becomes misaligned, it can usually be moved and is still trippable.
| |
| If the rod can be realigned within the Completion Time of 1 hour and the rod was not misaligned for a significant period of time before being discovered, local xenon redistribution during this short interval will not be significant, and operation may proceed without further restriction.
| |
| An alternative to realigning a single misaligned RCCA to the group average position is to align the remainder of the group to the position of the misaligned RCCA. However, this must be done without violating the bank sequence, overlap, and insertion limits specified in LCO 3.1.5,"Shutdown Bank Insertion Limits," and LCO 3.1.6, "Control Bank Insertion Limits." The Completion Time of 1 hour gives the operator sufficient time to adjust the rod positions in an orderly manner.B.2.1.1 and B.2.1.2 With a misaligned rod, SDM must be verified to be within limit or boration must be initiated to restore SDM to within limit.McGuire Units 1 and 2 B 3.1.4-5 Revision No. 115 Rod Group Alignment Limits B 3.1.4 BASES ACTIONS (continued)
| |
| In many cases, realigning the remainder of the group to the misaligned rod may not be desirable.
| |
| For example, realigning control bank B to a rod that is misaligned 15 steps from the top of the core would require a significant power reduction, since control bank D must be moved fully in and control bank C must be moved in to approximately 100 to 115 steps.Power operation may continue with one RCCA trippable but misaligned, provided that SDM is verified within 1 hour.The Completion Time of 1 hour represents the time necessary for determining the actual unit SDM and, if necessary, aligning and starting the necessary systems and components to initiate boration.B.2.2, B.2.3, B.2.4, B.2.5, and B.2.6 For continued operation with a misaligned rod, RTP must be reduced, SDM must periodically be verified within limits, hot channel factors FQ(X,Y,Z) and FNAH(X,Y) must be verified within limits, and the safety analyses must be re-evaluated to confirm continued operation is permissible.
| |
| Reduction of power to 75% RTP ensures that local LHR increases due to a misaligned RCCA will not cause the core design criteria to be exceeded (Ref. 7). The Completion Time of 2 hours gives the operator sufficient time to accomplish an orderly power reduction without challenging the Reactor Protection System.When a rod is known to be misaligned, there is a potential to impact the SDM. Since the core conditions can change with time, periodic verification of SDM is required.
| |
| A Frequency of 12 hours is sufficient to ensure this requirement continues to be met.Verifying that FQ(X,Y,Z) and FNAH(X,Y) are within the required limits ensures that current operation at 75% RTP with a rod misaligned is not resulting in power distributions that may invalidate safety analysis assumptions at full power. The Completion Time of 72 hours allows sufficient time to obtain flux maps of the core power distribution using the incore flux mapping system and to calculate FQ(X,Y,Z) and FN H(X,Y).Once current conditions have been verified acceptable, time is available to perform evaluations of accident analysis to determine that core limits will not be exceeded during a Design Basis Event for the duration of McGuire Units 1 and 2 B 3.1.4-6 Revision No. 115 Rod Group Alignment Limits B 3.1.4 BASES ACTIONS (continued) operation under these conditions.
| |
| A Completion Time of 5 days is sufficient time to obtain the required input data and to perform the analysis.C.1 When Required Actions cannot be completed within their Completion Time, the unit must be brought to a MODE or Condition in which the LCO requirements are not applicable.
| |
| To achieve this status, the unit must be brought to at least MODE 3 within 6 hours, which obviates concerns about the development of undesirable xenon or power distributions.
| |
| The allowed Completion Time of 6 hours is reasonable, based on operating experience, for reaching MODE 3 from full power conditions in an orderly manner and without challenging the plant systems.D.1.1 and D.1.2 More than one control rod becoming misaligned from its group average position is not expected, and has the potential to reduce SDM. Therefore, SDM must be evaluated.
| |
| One hour allows the operator adequate time to determine SDM. Restoration of the required SDM, if necessary, requires increasing the RCS boron concentration to provide negative reactivity, as described in the Bases or LCO 3.1.1. The required Completion Time of 1 hour for initiating boration is reasonable, based on the time required for potential xenon redistribution, the low probability of an accident occurring, and the steps required to complete the action. This allows the operator sufficient time to align the required valves and start the boric acid pumps.Boration will continue until the required SDM is restored.D.2 If more than one rod is found to be misaligned or becomes misaligned because of bank movement, the unit conditions fall outside of the accident analysis assumptions.
| |
| The unit must be brought to a MODE or Condition in which the LCO requirements are not applicable.
| |
| To achieve this status, the unit must be brought to at least MODE 3 within 6 hours.The allowed Completion Time is reasonable, based on operating experience, for reaching MODE 3 from full power conditions in an orderly manner and without challenging plant systems.McGuire Units 1 and 2 B 3.1.4-7 Revision No. 115 Rod Group Alignment Limits B 3.1.4 BASES SURVEILLANCE SR 3.1.4.1 REQUIREMENTS The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program. If the rod position deviation monitor is inoperable, a Frequency of 4 hours is required.SR 3.1.4.2 Verifying each control rod is OPERABLE would require that each rod be tripped. However, in MODES 1 and 2, tripping each control rod would result in radial or axial power tilts, or oscillations.
| |
| Exercising each individual control rod provides increased confidence that all rods continue to be OPERABLE without exceeding the alignment limit, even if they are not regularly tripped.Moving each control rod by 10 steps will not cause radial or axial power tilts, or oscillations, to occur. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program. Between required performances of SR 3.1.4.2 (determination of control rod OPERABILITY by movement), if a control rod(s) is discovered to be immovable, but remains trippable and aligned, the control rod(s) is considered to be OPERABLE.
| |
| At any time, if a control rod(s) is immovable, a determination of the trippability (OPERABILITY) of the control rod(s) must be made, and appropriate action taken. This may be by verification of a control system failure, usually electrical in nature, or that the failure is associated with the control rod stepping mechanism.
| |
| During performance of the Control Rod Movement periodic test, there have been some "Control Malfunctions" that prohibited a control rod bank or group from moving when selected, as evidenced by the demand counters and DRPI. In all cases, when the control malfunctions were corrected, the rods moved freely (no excessive friction or mechanical interference) and were trippable.
| |
| SR 3.1.4.3 Verification of rod drop times allows the operator to determine that the maximum rod drop time permitted is consistent with the assumed rod drop time used in the safety analysis.
| |
| Since a removal of the reactor vessel head has the potential to change component alignments affecting McGuire Units 1 and 2 B 3.1.4-8 Revision No. 115 Rod Group Alignment Limits B 3.1.4 BASES SURVEILLANCE REQUIREMENTS (continued) rod drop times, measuring drop times prior to the next criticality following any such removal ensures that the reactor internals and rod drive mechanism will not interfere with rod motion or rod drop time, and that no degradation in these systems has occurred that would adversely affect control rod motion or drop time. This testing is performed with all RCPs operating and the average moderator temperature
| |
| > 551OF to simulate a reactor trip under actual conditions.
| |
| This Surveillance is performed during a plant outage, due to the plant conditions needed to perform the SR and the potential for an unplanned plant transient if the Surveillance were performed with the reactor at power.REFERENCES
| |
| : 1. 10 CFR 50, Appendix A, GDC 10 and GDC 26.2. 10 CFR 50.46.3. UFSAR, Section 15.4.3.4. UFSAR, Section 15.4.5. UFSAR, Section 4.3.1.5.6. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| : 7. UFSAR, Section 15.0.McGuire Units 1 and 2 B 3.1.4-9 Revision No. 115 Shutdown Bank Insertion Limits B 3.1.5 BASES B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.5 Shutdown Bank Insertion Limits BASES BACKGROUND The insertion limits of the shutdown and control rods are initial assumptions in all safety analyses that assume rod insertion upon reactor trip. The insertion limits directly affect core power and fuel burnup distributions and assumptions of available ejected rod worth, SDM and initial reactivity insertion rate.The applicable criteria for these reactivity and power distribution design requirements are 10 CFR 50, Appendix A, GDC 10, "Reactor Design," GDC 26, "Reactivity Control System Redundancy and Protection," GDC 28, "Reactivity Limits" (Ref. 1), and 10 CFR 50.46, "Acceptance Criteria for Emergency Core Cooling Systems for Light Water Nuclear Power Reactors" (Ref. 2). Limits on control rod insertion have been established, and all rod positions are monitored and controlled during power operation to ensure that the power distribution and reactivity limits defined by the design power peaking and SDM limits are preserved.
| |
| The rod cluster control assemblies (RCCAs) are divided among control banks and shutdown banks. Each bank may be further subdivided into two groups to provide for precise reactivity control. A group consists of two or more RCCAs that are electrically paralleled to step simultaneously.
| |
| A bank of RCCAs consists of two groups that are moved in a staggered fashion, but always within one step of each other. The plant has four control banks and five shutdown banks. See LCO 3.1.4, "Rod Group Alignment Limits," for control and shutdown rod OPERABILITY and alignment requirements, and LCO 3.1.7, "Rod Position Indication," for position indication requirements.
| |
| The shutdown banks must be maintained above designed shutdown bank insertion limits and are typically near the fully withdrawn position during normal full power operations.
| |
| Hence, they are not capable of adding a large amount of positive reactivity.
| |
| Boration or dilution of the Reactor Coolant System (RCS) compensates for the reactivity changes associated with large changes in RCS temperature.
| |
| The design calculations are performed with the assumption that the shutdown banks are withdrawn first. The shutdown banks can be fully withdrawn without the core going critical.
| |
| This provides available negative reactivity in the event of boration errors. The shutdown banks are controlled manually by the control room operator.
| |
| During normal unit operation, the shutdown McGuire Units 1 and 2 B 3.1.5-1 Revision No. 115 Shutdown Bank Insertion Limits B 3.1.5 BASES BACKGROUND (continued) banks are either fully withdrawn or fully inserted.
| |
| The shutdown banks are withdrawn above insertion limits specified in the COLR before withdrawing any control banks during an approach to criticality.
| |
| The shutdown banks remain above the insertion limits specified in the COLR until the reactor is shutdown, except for surveillance testing required by SR 3.1.4.2. Since the shutdown banks are fully withdrawn while this Specification is applicable, they do not affect core power and burnup distribution, but merely add negative reactivity to shut down the reactor upon receipt of a reactor trip signal.APPLICABLE SAFETY ANALYSES On a reactor trip, all RCCAs (shutdown banks and control banks), except the most reactive RCCA, are assumed to insert into the core. The shutdown banks shall be at or above their insertion limits and available to insert the maximum amount of negative reactivity on a reactor trip signal.The control banks may be partially inserted in the core, as allowed by LCO 3.1.6, "Control Bank Insertion Limits." The shutdown bank and control bank insertion limits are established to ensure that a sufficient amount of negative reactivity is available to shut down the reactor and maintain the required SDM (see LCO 3.1.1, "SHUTDOWN MARGIN (SDM)) following a reactor trip from full power. The combination of control banks and shutdown banks (less the most reactive RCCA, which is assumed to be fully withdrawn) is sufficient to take the reactor from full power conditions at rated temperature to zero power, and to maintain the required SDM at rated no load temperature (Ref. 3). The shutdown bank insertion limit also makes the reactivity worth of an ejected shutdown rod negligible.
| |
| The acceptance criteria for addressing shutdown and control rod bank insertion limits and inoperability or misalignment is that: a. There be no violations of: 1.2.specified acceptable fuel design limits, or RCS pressure boundary integrity; and b. The core remains subcritical after accident transients.
| |
| As such, the shutdown bank insertion limits affect safety analysis involving core reactivity and SDM (Ref. 3).The shutdown bank insertion limits preserve an initial condition assumed in the safety analyses and, as such, satisfy Criterion 2 of 10 CFR 50.36 (Ref. 4).McGuire Units 1 and 2 B 3.1.5-2 Revision No. 115 Shutdown Bank Insertion Limits B 3.1.5 BASES LCO The shutdown banks must be within their insertion limits any time the reactor is critical or approaching criticality.
| |
| This ensures that a sufficient amount of negative reactivity is available to shut down the reactor and maintain the required SDM following a reactor trip.The shutdown bank insertion limits are defined in the COLR.APPLICABILITY The shutdown banks must be within their insertion limits, with the reactor in MODES 1 and 2. The applicability in MODE 2 begins prior to initial control bank withdrawal, during an approach to criticality, and continues throughout MODE 2, until all control bank rods are again fully inserted by reactor trip or by shutdown.
| |
| This ensures that a sufficient amount of negative reactivity is available to shut down the reactor and maintain the required SDM following a reactor trip. The shutdown banks do not have to be within their insertion limits in MODE 3, unless an approach to criticality is being made. In MODE 3, 4, 5, or 6, the shutdown banks may be fully inserted in the core and contribute to the SDM. Refer to LCO 3.1.1 for SDM requirements in MODES 3, 4, and 5. LCO 3.9.1,"Boron Concentration," ensures adequate SDM in MODE 6.The Applicability requirements have been modified by a Note indicating the LCO requirement is suspended during SR 3.1.4.2. This SR verifies the freedom of the rods to move, and requires the shutdown bank to move below the LCO limits, which would normally violate the LCO.ACTIONS A.1.1, A.1.2 and A.2 When one or more shutdown banks is not within insertion limits, 2 hours is allowed to restore the shutdown banks to within the insertion limits.This is necessary because the available SDM may be significantly reduced, with one or more of the shutdown banks not within their insertion limits. Also, verification of SDM or initiation of boration within 1 hour is required, since the SDM in MODES 1 and 2 is ensured by adhering to the control and shutdown bank insertion limits (see LCO 3.1.1). If shutdown banks are not within their insertion limits, then SDM will be verified by performing a reactivity balance calculation, considering the effects listed in the BASES for SR 3.1.1.1.The allowed Completion Time of 2 hours provides an acceptable time for evaluating and repairing minor problems without allowing the plant to remain in an unacceptable condition for an extended period of time.McGuire Units 1 and 2 B 3.1.5-3 Revision No. 115 Shutdown Bank Insertion Limits B 3.1.5 BASES ACTIONS (continued)
| |
| B.1 If the shutdown banks cannot be restored to within their insertion limits within 2 hours, the unit must be brought to a MODE where the LCO is not applicable.
| |
| The allowed Completion Time of 6 hours is reasonable, based on operating experience, for reaching the required MODE from full power conditions in an orderly manner and without challenging plant systems.SURVEILLANCE SR 3.1.5.1 REQUIREMENTS Verification that the shutdown banks are within their insertion limits prior to an approach to criticality ensures that when the reactor is critical, or being taken critical, the shutdown banks will be available to shut down the reactor, and the required SDM will be maintained following a reactor trip.This SR and Frequency ensure that the shutdown banks are withdrawn before the control banks are withdrawn during a unit startup.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. 10 CFR 50, Appendix A, GDC 10, GDC 26, and GDC 28.2. 10 CFR 50.46.3. UFSAR, Section 15.4.4. 10 CFR 50.36, Technical Specification, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.1.5-4 Revision No. 115 Control Bank Insertion Limits B 3.1.6 BASES B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.6 Control Bank Insertion Limits BASES BACKGROUND The insertion limits of the shutdown and control rods are initial assumptions in all safety analyses that assume rod insertion upon reactor trip. The insertion limits directly affect core power and fuel burnup distributions and assumptions of available SDM, and initial reactivity insertion rate.The applicable criteria for these reactivity and power distribution design requirements are 10 CFR 50, Appendix A, GDC 10, "Reactor Design," GDC 26,"Reactivity Control System Redundancy and Protection," GDC 28, "Reactivity Limits" (Ref. 1), and 10 CFR 50.46, "Acceptance Criteria for Emergency Core Cooling Systems for Light Water Nuclear Power Reactors" (Ref. 2). Limits on control rod insertion have been established, and all rod positions are monitored and controlled during power operation to ensure that the power distribution and reactivity limits defined by the design power peaking and SDM limits are preserved.
| |
| The rod cluster control assemblies (RCCAs) are divided among control banks and shutdown banks. Each bank may be further subdivided into two groups to provide for precise reactivity control. A group consists of two or more RCCAs that are electrically paralleled to step simultaneously.
| |
| A bank of RCCAs consists of two groups that are moved in a staggered fashion, but always within one step of each other. The plant has four control banks and five shutdown banks. See LCO 3.1.4, "Rod Group Alignment Limits," for control and shutdown rod OPERABILITY and alignment requirements, and LCO 3.1.7,"Rod Position Indication," for position indication requirements.
| |
| The control bank insertion limits are specified in the COLR. The control banks are required to be at or above the insertion limit lines.The control banks are moved in an overlap pattern. When control bank A reaches a predetermined height in the core, control bank B begins to move out with control bank A. Control bank A stops at the position of maximum withdrawal, and control bank B continues to move out. When control bank B reaches a predetermined height, control bank C begins to move out with control bank B. This sequence continues until control banks A, B, and C are at the fully withdrawn position, and control bank D is approximately halfway withdrawn.
| |
| The insertion sequence is the opposite of the withdrawal sequence.The fully withdrawn position is defined in the COLR.McGuire Units 1 and 2 B 3.1.6-1 Revision No. 115 Control Bank Insertion Limits B 3.1.6 BASES BACKGROUND (continued)
| |
| The control banks are used for precise reactivity control of the reactor.The positions of the control banks are normally controlled automatically by the Rod Control System, but can also be manually controlled.
| |
| They are capable of adding reactivity very quickly (compared to borating or diluting).
| |
| The power density at any point in the core must be limited, so that the fuel design criteria are maintained.
| |
| Together, LCO 3.1.4, LCO 3.1.5,"Shutdown Bank Insertion Limits," LCO 3.1.6, LCO 3.2.3, "AXIAL FLUX DIFFERENCE (AFD)," and LCO 3.2.4, "QUADRANT POWER TILT RATIO (QPTR)," provide limits on control component operation and on monitored process variables, which ensure that the core operates within the fuel design criteria.The shutdown and control bank insertion and alignment limits, AFD, and QPTR are process variables that together characterize and control the three dimensional power distribution of the reactor core. Additionally, the control bank insertion limits control the reactivity that could be added in the event of a rod ejection accident, and the shutdown and control bank insertion limits ensure the required SDM is maintained.
| |
| Operation within the subject LCO limits will ensure that fuel cladding failures that would breach the primary fission product barrier and release fission products to the reactor coolant in the event of a loss of coolant accident (LOCA), ejected rod, or other accident requiring termination by a Reactor Trip System (RTS) trip function are no more than those predicted in and allowed by the safety analyses.APPLICABLE The shutdown and control bank insertion limits, AFD, and QPTR LCOs SAFETY ANALYSES are required to prevent power distributions that could result in excessive fuel cladding failures in the event of a LOCA, ejected rod, or other accident requiring termination by an RTS trip function.The acceptance criteria for addressing shutdown and control bank insertion limits and inoperability or misalignment are that: a. There be no violations of: 1. specified acceptable fuel design limits, or 2. Reactor Coolant System pressure boundary integrity; and b. The core remains subcritical after accident transients (except for steam line break accident).
| |
| McGuire Units 1 and 2 B 3.1.6-2 Revision No. 115 Control Bank Insertion Limits B 3.1.6 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| As such, the shutdown and control bank insertion limits affect safety analysis involving core reactivity and power distributions (Ref. 3).The SDM requirement is ensured by limiting the control and shutdown bank insertion limits so that allowable inserted worth of the RCCAs is such that sufficient reactivity is available in the rods to shut down the reactor to hot zero power with a reactivity margin that assumes the maximum worth RCCA remains fully withdrawn upon trip (Ref. 4).Operation at the insertion limits or AFD limits may approach the maximum allowable linear heat generation rate or peaking factor with the allowed QPTR present. Operation at the insertion limit may also indicate the maximum ejected RCCA worth could be equal to the limiting value in fuel cycles that have sufficiently high ejected RCCA worths.The control and shutdown bank insertion limits ensure that safety analyses assumptions for SDM, ejected rod worth, dropped rod or bank worth, withdrawable rod or bank worth and power distribution peaking factors are preserved (Ref. 5).The insertion limits satisfy Criterion 2 of 10 CFR 50.36 (Ref. 6), in that they are initial conditions assumed in the safety analysis.LCO The limits on control banks sequence, overlap, and physical insertion, as defined in the COLR, must be maintained because they serve the function of preserving power distribution, ensuring that the SDM is maintained, ensuring that ejected rod worth, dropped rod or bank worth, and withdrawable rod or bank worth is maintained, and ensuring adequate negative reactivity insertion is available on trip. The overlap between control banks provides more uniform rates of reactivity insertion and withdrawal and is imposed to maintain acceptable power peaking during control bank motion.APPLICABILITY The control bank sequence, overlap, and physical insertion limits shall be maintained with the reactor in MODES 1 and 2 with kff > 1.0. These limits must be maintained, since they preserve the assumed power distribution, ejected rod worth, SDM, and reactivity rate insertion assumptions.
| |
| Applicability in MODES 3, 4, and 5 is not required, since the consequences of the rod ejection or withdrawal accidents are less severe when initiated from these MODES.McGuire Units 1 and 2 B 3.1.6-3 Revision No. 115 Control Bank Insertion Limits B 3.1.6 BASES APPLICABILITY (continued)
| |
| The applicability requirements have been modified by a Note indicating the LCO requirements are suspended during the performance of SR 3.1.4.2. This SR verifies the freedom of the rods to move, and requires the control bank to move below the LCO limits, which would violate the LCO.ACTIONS A.1.1, A.1.2, A.2, B.1.1, B.1.2, and B.2 When the control banks are outside the acceptable insertion limits, they must be restored to within those limits. This restoration can occur in two ways: a. Reducing power to be consistent with rod position; or b. Moving rods to be consistent with power.Also, verification of SDM or initiation of boration to regain SDM is required within 1 hour, since the SDM in MODES 1 and 2 normally ensured by adhering to the control and shutdown bank insertion limits (see LCO 3.1.1, "SHUTDOWN MARGIN (SDM)) has been upset..If control banks are not within their insertion limits, then SDM will be verified by performing a reactivity balance calculation, considering the effects listed in the BASES for SR 3.1.1.1. Similarly, if the control banks are found to be out of sequence or in the wrong overlap configuration, they must be restored to meet the limits.Operation beyond the LCO limits is allowed for a short time period in order to take conservative action because the simultaneous occurrence of either a LOCA, loss of flow accident, ejected rod accident, or other accident during this short time period, together with an inadequate power distribution or reactivity capability, has an acceptably low probability.
| |
| The allowed Completion Time of 2 hours for restoring the banks to within the insertion, sequence, and overlaps limits provides an acceptable time for evaluating and repairing minor problems without allowing the plant to remain in an unacceptable condition for an extended period of time.McGuire Units 1 and 2 B 3.1.6-4 Revision No. 115 Control Bank Insertion Limits B 3.1.6 BASES ACTIONS (continued)
| |
| C.1 If Required Actions A.1 and A.2, or B.1 and B.2 cannot be completed within the associated Completion Times, the plant must be brought to MODE 3, where the LCO is not applicable.
| |
| The allowed Completion Time of 6 hours is reasonable, based on operating experience, for reaching the required MODE from full power conditions in an orderly manner and without challenging plant systems.SURVEILLANCE SR 3.1.6.1 REQUIREMENTS This Surveillance is required to ensure that the reactor does not achieve criticality with the control banks below their insertion limits.The estimated critical position (ECP) depends upon a number of factors, one of which is xenon concentration.
| |
| If the ECP was calculated long before criticality, xenon concentration could change to make the ECP substantially in error. Conversely, determining the ECP immediately before criticality could be an unnecessary burden. There are a number of unit parameters requiring operator attention at that point. Verifying the ECP calculation within 4 hours prior to criticality avoids a large error from changes in xenon concentration, but allows the operator some flexibility to schedule the ECP calculation with other startup activities.
| |
| SR 3.1.6.2 The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program. If the insertion limit monitor becomes inoperable, verification of the control bank position at a Frequency of 4 hours is sufficient to detect control banks that may be approaching the insertion limits.SR 3.1.6.3 When control banks are maintained within their insertion limits as checked by SR 3.1.6.2 above, it is unlikely that their sequence and overlap will not be in accordance with requirements provided in the COLR. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Units 1 and 2 B 3.1.6-5 Revision No. 115 Control Bank Insertion Limits B 3.1.6 BASES REFERENCES 1.2.3.4.5.6.10 CFR 50, Appendix A, GDC 10, GDC 26, GDC 28.10 CFR 50.46.UFSAR, Section 15.4.1.UFSAR, Section 15.0.UFSAR, Section 15.4.8.10 CFR 50.36, Technical Specification, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.1.6-6 Revision No. 115 Rod Position Indication B 3.1.7 B 3.1 REACTIVITY CONTROL SYSTEM B 3.1.7 Rod Position Indication BASES BACKGROUND According to GDC 13 (Ref. 1), instrumentation to monitor variables and systems over their operating ranges during normal operation, anticipated operational occurrences, and accident conditions must be OPERABLE.LCO 3.1.7 is required to ensure OPERABILITY of the control rod position indicators to determine control rod positions and thereby ensure compliance with the control rod alignment and insertion limits.The OPERABILITY, including position indication, of the shutdown and control rods is an initial assumption in all safety analyses that assume rod insertion upon reactor trip. Maximum rod misalignment is an initial assumption in the safety analysis that directly affects core power distributions and assumptions of available SDM. Rod position indication is required to assess OPERABILITY and misalignment.
| |
| Mechanical or electrical failures may cause a control rod to become inoperable or to become misaligned from its group. Control rod inoperability or misalignment may cause increased power peaking, due to the asymmetric reactivity distribution and a reduction in the total available rod worth for reactor shutdown.
| |
| Therefore, control rod alignment and OPERABILITY are related to core operation in design power peaking limits and the core design requirement of a minimum SDM.Limits on control rod alignment and OPERABILITY are established in LCO 3.1.4, "Rod Group Alignment Limits," and all rod positions are monitored and controlled during power operation to ensure that the power distribution and reactivity limits defined by the design power peaking and SDM limits are preserved.
| |
| Rod cluster control assemblies (RCCAs), or rods, are moved out of the core (up or withdrawn) or into the core (down or inserted) by their control rod drive mechanisms.
| |
| The RCCAs are divided among control banks and shutdown banks. Each bank may be further subdivided into two groups to provide for precise reactivity control.The axial position of shutdown rods and control rods are determined by two separate and independent systems: the Bank Demand Position Indication System (commonly called group step counters) and the Digital Rod Position Indication (DRPI) System.McGuire Units 1 and 2 B 3.1.7-1 Revision No. 58 Rod Position Indication B 3.1.7 BASES BACKGROUND (continued)
| |
| The Bank Demand Position Indication System counts the pulses from the Rod Control System that move the rods. There is one step counter for each group of rods. Individual rods in a group all receive the same signal to move and should, therefore, all be at the same position indicated by the group step counter for that group. The Bank Demand Position Indication System is considered highly precise (+/- 1 step or +/- 5/8 inch). If a rod does not move one step for each demand pulse, the step counter will still count the pulse and incorrectly reflect the position of the rod.The DRPI System provides a highly accurate indication of actual control rod position, but at a lower precision than the step counters.This system is based on inductive analog signals from a series of coils spaced along a hollow tube with a center to center distance of 3.75 inches, which is 6 steps. To increase the reliability of the system, the inductive coils are connected alternately to data channel A or B. Thus creating two separate and independent channels (Data A and Data B). Also, the coils are not placed at the reflected six step increments starting at rod bottom. Because of this arrangement, the nominal accuracy of the system is +/- 3 steps indicated versus true rod position.
| |
| Due to mechanical positioning of the coils on the rod position detector and expansion in containment atmosphere, another +/- 1 step is added to system accuracy making it+/- 4 steps.If one channel fails, the DRPI will go to half accuracy.
| |
| The accuracy will be -10, + 4 steps when either channel fails. Therefore, the maximum deviation between the group demand counters and DRPI could be 10 steps, or 6.25 inches.Gray code (A & B data from the data cabinets in containment) is sent to the DRPI equipment in the control room. The gray code is processed by the DRPI equipment and the rod position is displayed on the control board. The gray code is also sent from the DRPI equipment to the Operator Aid Computer (OAC), where it is processed by the OAC and the rod position is displayed on the OAC.The processing of the gray code by the DRPI equipment and the OAC are completely independent.
| |
| Therefore, both the DRPI display and the OAC DRPI indication are considered valid indications of control rod position.APPLICABLE Control and shutdown rod position accuracy is essential during SAFETY ANALYSES power operation.
| |
| Power peaking, ejected rod worth, or SDM limits may be violated in the event of a Design Basis Accident (Ref. 2), with control or shutdown rods operating outside their limits undetected.
| |
| Therefore, the acceptance criteria for rod position indication is that rod positions must be known with sufficient accuracy in order to verify McGuire Units 1 and 2 B 3.1.7-2 Revision No. 58 Rod Position Indication B 3.1.7 BASES APPLICABLE SAFETY ANALYSES (continued) the core is operating within the group sequence, overlap, design peaking limits, ejected rod worth, and with at least minimum SDM (LCO 3.1.5, "Shutdown Bank Insertion Limits," and LCO 3.1.6,"Control Bank Insertion Limits").
| |
| The rod positions must also be known in order to verify the alignment limits are preserved (LCO 3.1.4, "Rod Group Alignment Limits").
| |
| Control rod positions are continuously monitored to provide operators with information that ensures the plant is operating within the bounds of the accident analysis assumptions.
| |
| The control rod position indicator channels satisfy Criterion 2 of 10 CFR 50.36 (Ref. 3). The control rod position indicators monitor control rod position, which is an initial condition of the accident.LCO LCO 3.1.7 specifies that one DRPI System (either A or B Channel)and one Bank Demand Position Indication System be OPERABLE for each control rod. For the control rod position indicators to be OPERABLE requires meeting the SR of the LCO and the following:
| |
| : a. The DRPI System indicates within 12 steps of the group step counter demand position as required by LCO 3.1.4, "Rod Group Alignment Limits";b. For the DRPI System either Data A or Data B is operable for each rod; and c. The Bank Demand Indication System has been calibrated either in the fully inserted position or to the DRPI System.The 12 step agreement limit between the Bank Demand Position Indication System and the DRPI System indicates that the Bank Demand Position Indication System is adequately calibrated, and can be used for indication of the measurement of control rod bank position.A deviation of less than the allowable limit, given in LCO 3.1.4, in position indication for a single control rod, ensures high confidence that the position uncertainty of the corresponding control rod group is within the assumed values used in the analysis (that specified control rod group insertion limits).These requirements ensure that control rod position indication during power operation and PHYSICS TESTS is accurate, and that design assumptions are not challenged.
| |
| McGuire Units 1 and 2 B 3.1.7-3 Revision No. 58 Rod Position Indication B 3.1.7 BASES LCO (continued)
| |
| OPERABILITY of the position indicator systems ensures that inoperable, misaligned, or mispositioned control rods can be detected.
| |
| Therefore, power peaking, ejected rod worth, and SDM can be controlled within acceptable limits.APPLICABILITY The requirements on the DRPI and step counters are only applicable in MODES 1 and 2 (consistent with LCO 3.1.4, LCO 3.1.5, and LCO 3.1.6), because these are the only MODES in which power is generated, and the OPERABILITY and alignment of rods have the potential to affect the safety of the plant. In the shutdown MODES, the OPERABILITY of the shutdown and control banks has the potential to affect the required SDM, but this effect can be compensated for by an increase in the boron concentration of the Reactor Coolant System.ACTIONS The ACTIONS table is modified by a Note indicating that a separate Condition entry is allowed for each inoperable rod position indicator per group and each demand position indicator per bank. This is acceptable because the Required Actions for each Condition provide appropriate compensatory actions for each inoperable position indicator.
| |
| A._1 When the DRPI channels (Data A andd Data B) for one rod per group, for one or more groups fails, the position of the rods can still be determined by use of the incore movable detectors.
| |
| Based on experience, normal power operation does not require excessive movement of banks. If a bank has been significantly moved, the Required Action of B.1 or B.2 below is required.
| |
| Therefore, verification of RCCA position within the Completion Time of 8 hours is adequate for allowing continued full power operation, since the probability of simultaneously having a rod significantly out of position and an event sensitive to that rod position is small.A.2 Reduction of THERMAL POWER to 50% RTP puts the core into a condition where rod position is not significantly affecting core peaking factors (Ref. 4).The allowed Completion Time of 8 hours is reasonable, based on operating experience, for reducing power to < 50% RTP from full power conditions without challenging plant systems and allowing for rod position determination by Required Action A.1 above.McGuire Units 1 and 2 B 3.1.7-4 Revision No. 58 Rod Position Indication B 3.1.7 BASES ACTIONS (continued)
| |
| B.1 and B.2 These Required Actions clarify that when one or more rods with inoperable position indicators have been moved in excess of 24 steps in one direction, since the position was last determined, the Required Actions of A.1 and A.2 are still appropriate but must be initiated promptly under Required Action B.1 to begin verifying that these rods are still properly positioned, relative to their group positions.
| |
| If, within 4 hours, the rod positions have not been determined, THERMAL POWER must be reduced to < 50% RTP within 8 hours to avoid undesirable power distributions that could result from continued operation at > 50% RTP, if one or more rods are misaligned by more than 24 steps. The allowed Completion Time of 4 hours provides an acceptable period of time to verify the rod positions.
| |
| C.1.1 and C.1.2 With one demand position indicator per bank inoperable, the rod positions can be determined by the DRPI System. Since normal power operation does not require excessive movement of rods, verification by administrative means that the rod position indicators are OPERABLE and the most withdrawn rod and the least withdrawn rod are < 12 steps apart within the allowed Completion Time of once every 8 hours is adequate.
| |
| Since DRPI is the only operable rod position indication, administrative means are actions taken by the control room SRO to assure that the DRPI for the affected bank remains operable at all times. These administrative means would prevent any maintenance or testing of the operable DRPI for the affected bank until the inoperable demand position indicator is returned to operable status.C.2 Reduction of THERMAL POWER to < 50% RTP puts the core into a condition where rod position is not significantly affecting core peaking factor limits (Ref. 4). The allowed Completion Time of 8 hours provides an acceptable period of time to verify the rod positions per Required Actions C.1.1 and C.1.2 or reduce power to < 50% RTP.McGuire Units 1 and 2 B 3.1.7-5 Revision No. 58 Rod Position Indication B 3.1.7 BASES ACTIONS (continued)
| |
| D.1 If the Required Actions cannot be completed within the associated Completion Time, the plant must be brought to a MODE in which the requirement does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours. The allowed Completion Time is reasonable, based on operating experience, for reaching the required MODE from full power conditions in an orderly manner and without challenging plant systems.SURVEILLANCE SR 3.1.7.1 REQUIREMENTS Verification that the DRPI agrees with the demand position within 12 steps ensures that the DRPI is operating correctly.
| |
| This Surveillance is performed prior to reactor criticality after each removal of the reactor head as there is the potential for unnecessary plant transients if the SR were performed with the reactor at power.REFERENCES
| |
| : 1. 10 CFR 50, Appendix A, GDC 13.2. UFSAR, Section 15.0.3. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| : 4. UFSAR, Section 15.4 McGuire Units 1 and 2 B 3.1.7-6 Revision No. 58 PHYSICS TESTS Exceptions B 3.1.8 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.8 PHYSICS TESTS Exceptions BASES BACKGROUND The primary purpose of the PHYSICS TESTS exceptions is to permit relaxations of existing LCOs to allow PHYSICS TESTS to be performed.
| |
| Section XI of 10 CFR 50, Appendix B (Ref. 1), requires that a test program be established to ensure that structures, systems, and components will perform satisfactorily in service. All functions necessary to ensure that the specified design conditions are not exceeded during normal operation and anticipated operational occurrences must be tested.This testing is an integral part of the design, construction, and operation of the plant. Requirements for notification of the NRC, for the purpose of conducting tests and experiments, are specified in 10 CFR 50.59 (Ref. 2).The key objectives of a test program are to (Ref. 3): a. Ensure that the facility has been adequately designed;b. Validate the analytical models used in the design and analysis;c. Verify the assumptions used to predict unit response;d. Ensure that installation of equipment in the facility has been accomplished in accordance with the design; and e. Verify that the operating and emergency procedures are adequate.To accomplish these objectives, testing is performed prior to initial criticality, during startup, during low power operations, during power ascension, at high power, and after each refueling.
| |
| The PHYSICS TESTS requirements for reload fuel cycles ensure that the operating characteristics of the core are consistent with the design predictions and that the core can be operated as designed (Ref. 4).PHYSICS TESTS procedures are written and approved in accordance with established formats. The procedures include all information necessary to permit a detailed execution of the testing required to ensure that the design intent is met. PHYSICS TESTS are performed in accordance with these procedures and test results are approved prior to continued power escalation and long term power operation.
| |
| McGuire Units 1 and 2 B 3.1.8-1 Revision No. 115 PHYSICS TESTS Exceptions B 3.1.8 BASES BACKGROUND (continued)
| |
| The PHYSICS TESTS required for reload fuel cycles (Ref. 4) are listed below: a. Critical Boron Concentration-Control Rods Withdrawn;
| |
| : b. Control Rod Worth;c. Isothermal Temperature Coefficient (ITC); and These and other supplementary tests may be required to calibrate the nuclear instrumentation or to diagnose operational problems.
| |
| These tests may cause the operating controls and process variables to deviate from their LCO requirements during their performance.
| |
| APPLICABLE The fuel is protected by LCOs that preserve the initial conditions of the SAFETY ANALYSES core assumed during the safety analyses.
| |
| The methods for development of the LCOs that are excepted by this LCO are described in the Westinghouse Reload Safety Evaluation Methodology Report (Ref. 5).The above mentioned PHYSICS TESTS, and other tests that may be required to calibrate nuclear instrumentation or to diagnose operational problems, may require the operating control or process variables to deviate from their LCO limitations.
| |
| The UFSAR defines requirements for initial testing of the facility, including PHYSICS TESTS. UFSAR Section 14.3 summarizes the zero, low power, and power tests. Requirements for reload fuel cycle PHYSICS TESTS are defined in ANSI/ANS-19.6.1-1985 (Ref. 4). Although these PHYSICS TESTS are generally accomplished within the limits for all LCOs, conditions may occur when one or more LCOs must be suspended to make completion of PHYSICS TESTS possible or practical.
| |
| This is acceptable as long as the fuel design criteria are not violated.
| |
| When one or more of the requirements specified in LCO 3.1.3, "Moderator Temperature Coefficient (MTC)," LCO 3.1.4, LCO 3.1.5, LCO 3.1.6, and LCO 3.4.2 are suspended for PHYSICS TESTS, the fuel design criteria are preserved as long as the power level is limited to < 5% RTP, the reactor coolant temperature is kept _> 541°F, and SDM is within limit specified in the COLR.The PHYSICS TESTS include measurement of core nuclear parameters or the exercise of control components that affect process variables.
| |
| Among the process variables involved are AFD and QPTR, which represent initial conditions of the unit safety analyses.
| |
| Also involved are the movable control components (control and shutdown rods), which are required to shut down the reactor. The limits for these variables are McGuire Units 1 and 2 B 3.1.8-2 Revision No. 115 PHYSICS TESTS Exceptions B 3.1.8 BASES APPLICABLE SAFETY ANALYSES (continued) specified for each fuel cycle in the COLR. PHYSICS TESTS meet the criteria for inclusion in the Technical Specifications, since the components and process variable LCOs suspended during PHYSICS TESTS meet Criteria 1, 2, and 3 of 10 CFR 50.36 (Ref.6).Reference 7 allows special test exceptions (STEs) to be included as part of the LCO that they affect. It was decided, however, to retain this STE as a separate LCO because it was less cumbersome and provided additional clarity.LCO This LCO allows the reactor parameters of MTC and minimum temperature for criticality to be outside their specified limits. In addition, it allows selected control and shutdown rods to be positioned outside of their specified alignment and insertion limits. Operation beyond specified limits is permitted for the purpose of performing PHYSICS TESTS and poses no threat to fuel integrity, provided the SRs are met.The requirements of LCO 3.1.3, LCO 3.1.4, LCO 3.1.5, LCO 3.1.6, and LCO 3.4.2 may be suspended during the performance of PHYSICS TESTS provided: a. RCS lowest loop average temperature is > 541OF; and b. SDM is within limit specified in the COLR.APPLICABILITY This LCO is applicable in MODE 2 when performing low power PHYSICS TESTS. The applicable PHYSICS TESTS are performed in MODE 2 at HZP.ACTIONS A.1 and A.2 If the SDM requirement is not met, boration must be initiated promptly.
| |
| A Completion Time of 15 minutes is adequate for an operator to correctly align and start the required systems and components.
| |
| The operator should begin boration with the best source available for the plant conditions.
| |
| Boration will be continued until SDM is within limit.Suspension of PHYSICS TESTS exceptions requires restoration of each of the applicable LCOs to within specification.
| |
| McGuire Units 1 and 2 B 3.1.8-3 Revision No. 115 PHYSICS TESTS Exceptions B 3.1.8 BASES ACTIONS (continued)
| |
| B.1 When THERMAL POWER is > 5% RTP, the only acceptable action is to open the reactor trip breakers (RTBs) to prevent operation of the reactor beyond its design limits. Immediately opening the RTBs will shut down the reactor and prevent operation of the reactor outside of its design limits.C._1 When the RCS lowest Tavg is < 541OF, the appropriate action is to restore Tavg to within its specified limit. The allowed Completion Time of 15 minutes provides time for restoring Tavg to within limits without allowing the plant to remain in an unacceptable condition for an extended period of time. Operation with the reactor critical and with temperature below 541°F could violate the assumptions for accidents analyzed in the safety analyses.D. 1 If the Required Actions cannot be completed within the associated Completion Time, the plant must be brought to a MODE in which the requirement does not apply. To achieve this status, the plant must be brought to at least MODE 3 within an additional 15 minutes. The Completion Time of 15 additional minutes is reasonable, based on operating experience, for reaching MODE 3 in an orderly manner and without challenging plant systems.SURVEILLANCE SR 3.1.8.1 REQUIREMENTS The power range and intermediate range neutron detectors must be verified to be OPERABLE in MODE 2 by LCO 3.3.1, "Reactor Trip System (RTS) Instrumentation." A CHANNEL OPERATIONAL TEST is performed on each power range and intermediate range channel prior to initiation of the PHYSICS TESTS. This will ensure that the RTS is properly aligned to provide the required degree of core protection during the performance of the PHYSICS TESTS.McGuire Units 1 and 2 B 3.1.8-4 Revision No- 115 PHYSICS TESTS Exceptions B 3.1.8 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.1.8.2 Verification that the RCS lowest loop Tarv is >_ 541°F will ensure that the unit is not operating in a condition that could invalidate the safety analyses.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.1.8.3 Verification that THERMAL POWER is < 5% RTP will ensure that the plant is not operating in the condition that could invalidate the safety analyses.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.1.8.4 The SDM is verified by performing a reactivity balance calculation, considering the following reactivity effects: a. RCS boron concentration;
| |
| : b. Control bank position;c. RCS average temperature;
| |
| : d. Fuel burnup based on gross thermal energy generation;
| |
| : e. Xenon concentration;
| |
| : f. Samarium concentration; and g. Isothermal temperature coefficient (ITC).Using the ITC accounts for Doppler reactivity in this calculation because the reactor is subcritical, and the fuel temperature will be changing at the same rate as the RCS.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Units I and 2 B 3.1.8-5 Revision No. 115 PHYSICS TESTS Exceptions B 3.1.8 BASES REFERENCES 1.2.3.4.5.6.7.10 CFR 50, Appendix B, Section XI.10 CFR 50.59.Regulatory Guide 1.68, Revision 2, August, 1978.ANSI/ANS-19.6.1-1985, December 13, 1985.WCAP-9273-NP-A, Westinghouse Reload Safety Evaluation Methodology Report," July 1985.10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| WCAP-1 1618, including Addendum 1, April 1989.McGuire Units 1 and 2 B 3.1.8-6 Revision No. 115 FQ(X,Y,Z)B 3.2.1 B 3.2 POWER DISTRIBUTION LIMITS B 3.2.1 Heat Flux Hot Channel Factor (FQ(X,YZ))
| |
| BASES BACKGROUND The purpose of the limits on the values of Fa(X,Y,Z) is to limit the local (i.e., pellet) peak power density. The value of FQ(X,Y,Z) varies axially (Z)and radially (X,Y) in the core.FQ(X,Y,Z) is defined as the maximum local fuel rod linear power density divided by the average fuel rod linear power density, assuming nominal fuel pellet and fuel rod dimensions.
| |
| Therefore, FQ(X,Y,Z) is a measure of the peak fuel pellet power within the reactor core.During power operation, the global power distribution is limited by LCO 3.2.3, "AXIAL FLUX DIFFERENCE (AFD)," and LCO 3.2.4,"QUADRANT TILT POWER RATIO (QPTR)," which are directly and continuously measured process variables.
| |
| These LCOs, along with LCO 3.1.6, "Control Bank Insertion Limits," maintain the core limits on power distributions on a continuous basis.FQ(X,Y,Z) varies with fuel loading patterns, control bank insertion, fuel burnup, and changes in axial power distribution and to a lesser extent, with boron concentration and moderator temperature.
| |
| FQ(X,Y,Z) is measured periodically using the incore detector system.These measurements are generally taken with the core at, or near steady state conditions.
| |
| Using the measured three dimensional power distributions, it is possible to derive a measured value for FQ(X,Y,Z).
| |
| However, because this value represents a steady state condition, it does not include the variations in the value of FQ(X,Y,Z) that are present during nonequilibrium situations.
| |
| To account for these possible variations, the FQ(X,Y,Z) limit is reduced by precalculated factors to account for perturbations from steady state conditions to the operating limits.Core monitoring and control under nonsteady state conditions are accomplished by operating the core within the limits of the appropriate LCOs, including the limits on AFD, QPTR, and control rod insertion.
| |
| McGuire Units 1 and 2 B 3.2. 1-1 Revision No. 115 FQ(X,Y,Z)B 3.2.1 BASES APPLICABLE This LCO precludes core power distributions that violate SAFETY ANALYSES the following fuel design criteria: a. During a loss of coolant accident (LOCA), the peak cladding temperature must not exceed 2200°F for small breaks and there is a high level of probability that the peak cladding temperature does not exceed 2200°F for large breaks (Ref. 1);b. The DNBR calculated for the hottest fuel rod in the core must be above the approved DNBR limit. (The LCO alone is not sufficient to preclude DNB criteria violations for certain accidents, i.e., accidents in which the event itself changes the core power distribution.
| |
| For these events, additional checks are made in the core reload design process against the permissible statepoint power distributions.);
| |
| : c. During an ejected rod accident, the energy deposition to the fuel must not exceed 280 cal/gm (Ref. 2); and d. The control rods must be capable of shutting down the reactor with a minimum required SDM with the highest worth control rod stuck fully withdrawn (Ref. 3).Limits on FQ(X,Y,Z) ensure that the value of the initial total peaking factor assumed in the accident analyses remains valid. Other Reference 1 criteria must also be met in LOCAs (e.g., maximum cladding oxidation, maximum hydrogen generation, coolable geometry, transient strain, and long term cooling).
| |
| However, the peak cladding temperature is typically most limiting.FQ(X,Y,Z) limits assumed in the LOCA analysis are typically limiting relative to (i.e., lower than) the FQ(X,Y,Z) limit assumed in safety analyses for other postulated accidents.
| |
| Therefore, this LCO provides conservative limits for other postulated accidents.
| |
| FQ(X,Y,Z) satisfies Criterion 2 of 10 CFR 50.36 (Ref. 4).LCO The Heat Flux Hot Channel Factor, F 0 (X,Y,Z), shall be limited by the following relationships:
| |
| F RTP F,(X,Y,Z)
| |
| <' F K(Z) for P > 0.5 P F RTP(X,Y,Z) < K(Z) for P < 0.5 0.5 McGuire Units 1 and 2 B 3.2.1-2 Revision No. 115 FQ(X,Y,Z)B 3.2.1 BASES LCO (continued) where: FRTPQ is the FQ(X,Y,Z) limit at RTP provided in the COLR, and is reduced by measurement uncertainty, K(BU), and manufacturing tolerances provided in the COLR, K(Z) is the normalized FQ(X,Y,Z) as a function of core height provided in the COLR, and P THERMAL POWER RTP The actual values of FRTPQ, K(BU), and K(Z) are given in the COLR.For relaxed AFD limit operation, FMQ(X,Y,Z)(measured FQ(X,Y,Z))
| |
| is compared against three limits: " Steady state limit, (FRTPQ/P)
| |
| * K(Z),* Transient operational limit, FLQ(XY,Z)OP, and" Transient RPS limit, FLQ(X,Y,Z)RPS.
| |
| A steady state evaluation requires obtaining an incore flux map in MODE 1. From the incore flux map results we obtain the measured value FMQ(X,Y,Z) of FQ(X,Y,Z).
| |
| Then, FMQ(X,Y,Z) is adjusted by a radial local peaking factor and compared to FRTPQ which has been reduced by manufacturing tolerances, K(BU), and flux map measurement uncertainty.
| |
| K(BU) is the normalized FL 0 (X,Y,Z) as a function of burnup and is provided in the COLR.FLQ(X,Y,Z)OP and FLQ(X,Y,Z)RPs are cycle dependent design limits to ensure the FQ(X,Y,Z) is met during transients.
| |
| The expression for FLQ(X,Y,Z)OP is: (X,Y,Z) = F D(X,Y,Z)
| |
| * MQ_(X,Y,Z)/(UMT
| |
| * MT
| |
| * TILT)McGuire Units 1 and 2 B 3.2.1-3 Revision No. 115 FQ(X,Y,Z)B 3.2.1 BASES LCO (continued) where: FLa(X,Y,Z)oP is the cycle dependent maximum allowable design peaking factor which ensures that the FQ(X,Y,Z) limit will be preserved for operation within the LCO limits.FLQ(X,Y,Z)oP includes allowances for calculational and measurement uncertainties.
| |
| FD 0 (X,Y,Z) is the design power distribution for FQ provided in the COLR.MQ(X,Y,Z) is the margin remaining in core location X,Y,Z to the LOCA limit in the transient power distribution and is provided in the COLR for normal operating conditions and power escalation testing during startup operations.
| |
| UMT and MT are only included in the calculation of FL Q (X,Y,Z)OP if these factors were not included in the LOCA limit.UMT is the measurement uncertainty.
| |
| MT is the engineering hot channel factor.TILT is the peaking penalty that accounts for allowable quadrant power tilt ratio of 1.02 and is specified in the COLR.The expression for FLQ(X,Y,Z)RPs is: FQ (X,Y,Z)Is FQD (XY,Z)
| |
| * Mc (X,Y,Z)/(UMT
| |
| * MT
| |
| * TILT)where: FLQ(X,Y,Z)RPS is the cycle dependent maximum allowable design peaking factor which ensures that the center line fuel melt limit will be preserved for operation within the LCO limits. FL Q (X,Y,Z)RPS includes allowances for calculational and measurement uncertainties.
| |
| Mc(X,Y,Z) is the margin remaining to the center line fuel melt limit in core location X,Y,Z from the transient power distribution and is provided in the COLR for normal operating conditions and power escalation testing during startup operations.
| |
| UMT and MT are only included in the calculation of FLQ(X,Y,Z)RPs if these factors were not included in the fuel melt limit.McGuire Units 1 and 2 B 3.2.1-4 Revision No. 115 FQ(X,Y,Z)B 3.2.1 BASES LCO (continued)
| |
| The FQ(X,Y,Z) limits typically define limiting values for core power peaking that precludes peak cladding temperatures above 2200°F during a small break LOCA and a high level of probability that the peak cladding temperature does not exceed 2200°F for a large break LOCA.This LCO requires operation within the bounds assumed in the safety analyses.
| |
| Calculations are performed in the core design process to confirm that the core can be controlled in such a manner during operation that it can stay within the FQ(X,Y,Z) limits. If FQ(X,Y,Z) cannot be maintained within the steady state LOCA limits, reduction of the core power is required.Violating the steady state LOCA limits for FQ(X,Y,Z) produces unacceptable consequences if a design basis event occurs while FQ(X,Y,Z) is outside its specified limits.APPLICABILITY The FQ(X,Y,Z) limits must be maintained in MODE 1 to prevent core power distributions from exceeding the limits assumed in the safety analyses.
| |
| Applicability in other MODES is not required because there is either insufficient stored energy in the fuel or insufficient energy being transferred to the reactor coolant to require a limit on the distribution of core power. The exception to this is the steam line break event, which is assumed for analysis purposes to occur from very low power levels. At these low power levels, measurements of FQ(X,Y,Z) are not sufficiently reliable.
| |
| Operation within analysis limits at these conditions is inferred from startup physics testing verification of design predictions of core parameters in general.ACTIONS A.1 Reducing THERMAL POWER by _> 1% RTP for each 1% by which FMa(X,Y,Z) exceeds its steady state limit, maintains an acceptable absolute power density. FMQ(X,Y,Z) is the measured value of F 0 (X,Y,Z)and the steady state limit includes factors accounting for measurement uncertainty and manufacturing tolerances.
| |
| The Completion Time of 15 minutes provides an acceptable time to reduce power in an orderly manner and without allowing the plant to remain in an unacceptable condition for an extended period of time.McGuire Units 1 and 2 B 3.2.1-5 Revision No. 115 FQ(X,Y,Z)B 3.2.1 BASES ACTIONS (continued)
| |
| A.2 A reduction of the Power Range Neutron Flux-High trip setpoints by 2!1% for each 1% by which FMa(X,Y,Z) exceeds its steady state limit, is a conservative action for protection against the consequences of severe transients with unanalyzed power distributions.
| |
| The Completion Time of 72 hours is sufficient considering the small likelihood of a severe transient in this time period and the preceding prompt reduction in THERMAL POWER in accordance with Required Action A. 1.A.3 Reduction in the Overpower AT trip setpoints (value of K 4) by > 1% (in AT span) for each 1% by which FMQ(X,Y,Z) exceeds its steady state limit, is a conservative action for protection against the consequences of severe transients with unanalyzed power distributions since the transient response is limited by the setpoint reduction.
| |
| The Completion Time of 72 hours is sufficient considering the small likelihood of a severe transient in this time period, and the preceding prompt reduction in THERMAL POWER in accordance with Required Action A.1.A.4 Verification that FMQ(X,Y,Z) has been restored to within its steady state and transient limits, by performing SR 3.2.1.1, SR 3.2.1.2, and SR 3.2.1.3 prior to increasing THERMAL POWER above the limit imposed by Required Action A. 1, ensures that core conditions during operation at higher power levels are consistent with safety analyses assumptions.
| |
| Since FMQ(X,Y,Z) exceeds the steady state limit, the transient operational limit and possibly the transient RPS limit may be exceeded.By performing SR 3.2.1.2 and SR 3.2.1.3, appropriate actions with respect to reductions in AFD limits and OTAT trip setpoints will be performed ensuring that core conditions during operational and Condition 2 transients are maintained within the assumptions of the safety analysis.B.1 and B.2 The operational margin during transient operations is based on the relationship between FMQ(X,Y,Z) and the transient operational limit, FLa(X,Y,Z)OP, as follows: McGuire Units 1 and 2 B 3.2.1-6 Revision No. 115 FQ(X,Y,Z)B 3.2.1 BASES ACTIONS (continued)
| |
| % Operational Margin = 1
| |
| * 100%If the operational margin is less than zero, then FMQ(X,Y,Z) is greater than FLQ(X,Y,Z)oP and there exists a potential for exceeding the peak local power assumed in the core in a LOCA or in the loss of flow accidents.
| |
| Reducing the AFD by > 1% from the COLR limit for each 1%by which FMo(X,Y,Z) exceeds the operational limit within the allowed Completion Time of 4 hours restricts the axial flux distribution such that even if a transient occurred, core peaking factors are not exceeded.Adjusting the transient operational limit by the equivalent change in AFD limits establishes the appropriate revised surveillance limits.C.1 and C.2 The margin contained within the reactor protection system (RPS)Overtemperature AT setpoints during transient operations is based on the relationship between FMQ(X,Y,Z) and the RPS limit, FLQ(X,Y,Z)R1s, as follows:% RPS Margin = (F(XY,Z)R 10)FQL (X,y, Z)RPs *100 If the RPS margin is less than zero, then FMQ(X,Y,Z) is greater than FLQ(X,Y,Z)RPs and there exists a potential for FMQ(X,Y,Z) to exceed peak clad temperature limits during certain Condition 2 transients.
| |
| The Overtemperature AT K1 value is required to be reduced as follows: K1ADJUSTED
| |
| = K1 -I KSLOPE * % RPS Margin I Where K1ADJUSTED is the reduced Overtemperature AT K1 value KSLOPE is a penalty factor used to reduce K1 and is defined in the COLR% RPS Margin is the most negative margin determined above.McGuire Units 1 and 2 B 3.2.1-7 Revision No. 115 FQ(X,Y,Z)B 3.2.1 BASES ACTIONS (continued)
| |
| Reducing the Overtemperature AT trip setpoint from the COLR limit is a conservative action for protection against the consequences of transients since this adjustment limits the peak transient power level which can be achieved during an anticipated operational occurrence.
| |
| Once the OTAT trip setpoint is reduced, the available margin is increased.
| |
| An adjustment is then necessary in the FLQ(X,Y,Z)RPS limit, using the increased margin, in order to restore compliance with the LCO and exit the condition.
| |
| These adjustments maintain a constant margin and ensure that centerline fuel melt does not occur. The Completion Time of 72 hours is sufficient considering the small likelihood of a limiting transient in this time period. Adjusting the transient RPS limit by the equivalent change in OTAT trip setpoint establishes the appropriate revised surveillance limit.D.1 If Required Actions A.1 through A.4, B.1, or C.1 are not met within their associated Completion Times, the plant must be placed in a mode or condition in which the LCO requirements are not applicable.
| |
| This is done by placing the plant in at least MODE 2 within 6 hours.This allowed Completion Time is reasonable based on operating experience regarding the amount of time it takes to reach MODE 2 from full power operation in an orderly manner and without challenging plant systems.SURVEILLANCE REQUIREMENTS SR 3.2.1.1, SR 3.2.1.2, and SR 3.2.1.3 are modified by a Note. The Note applies during the first power ascension after a refueling.
| |
| It states that THERMAL POWER may be increased until an equilibrium power level has been achieved at which a power distribution map can be obtained.
| |
| This allowance is modified, however, by one of the Frequency conditions that requires verification that FMo(X,Y,Z) is within the specified limits after a power rise of > 10% RTP over the THERMAL POWER at which it was last verified to be within specified limits. Because FMo(X,Y,Z) could not have previously been measured in this reload core, power may be increased to RTP prior to an equilibrium verification of FMQ(X,Y,Z) provided nonequilibrium measurements of FMQ(X,Y,Z) are performed at various power levels during startup physics testing. This ensures that some determination of FMQ(X,Y,Z) is made at a lower power level at which adequate margin is available before going to 100% RTP.The Frequency condition is not intended to require verification of these parameters after every 10% increase in power level above the last McGuire Units 1 and 2 B 3.2.1-8 Revision No. 115 FQ(X,Y,Z)B 3.2.1 BASES SURVEILLANCE REQUIREMENTS (continued) verification.
| |
| It only requires verification after a power level is achieved for extended operation that is 10% higher than that power at which FQ was last measured.SR 3.2.1.1 Verification that FMQ(X,Y,Z) is within its specified steady state limits involves either increasing FMQ(X,Y,Z) to allow for manufacturing tolerance, K(BU), and measurement uncertainties for the case where these factors are not included in the FQ limit. For the case where these factors are included, a direct comparison of FmQ(X,Y,Z) to the FQ limit can be performed.
| |
| Specifically, FMQ(X,Y,Z) is the measured value of FQ(X,Y,Z) obtained from incore flux map results. Values for the manufacturing tolerance, K(BU), and measurement uncertainty are specified in the COLR.The limit with which FMQ(X,Y,Z) is compared varies inversely with power above 50% RTP and directly with functions called K(Z) and K(BU)provided in the COLR.If THERMAL POWER has been increased by > 10% RTP since the last determination of FMQ(X,Y,Z), another evaluation of this factor is required 12 hours after achieving equilibrium conditions at this higher power level (to ensure that FMa(X,Y,Z) values have decreased sufficiently with power increase to stay within the LCO limits).The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.2.1.2 and 3.2.1.3 The nuclear design process includes calculations performed to determine that the core can be operated within the FQ(X,Y,Z) limits.Because flux maps are taken in steady state conditions, the variations in power distribution resulting from normal operational maneuvers are not present in the flux map data. These variations are, however, conservatively calculated by considering a wide range of unit maneuvers in normal operation.
| |
| The maximum peaking factor increase over steady state values, is determined by a maneuvering analysis (Ref.5).McGuire Units 1 and 2 B 3.2.1-9 Revision No. 115 FQ(X,Y,Z)B 3.2.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| The limit with which FMQ(X,Y,Z) is compared varies and is provided in the COLR. No additional uncertainties are applied to the measured FQ(X,Y,Z)because the limits already include uncertainties.
| |
| FLQ(X,Y,Z)OP and FLQ(X,Y,Z)RPs limits are not applicable for the following axial core regions, measured in percent of core height: a. Lower core region, from 0 to 15% inclusive; and b. Upper core region, from 85 to 100% inclusive.
| |
| The top and bottom 15% of the core are excluded from the evaluation because of the low probability that these regions would be more limiting in the safety analyses and because of the difficulty of making a precise measurement in these regions.This Surveillance has been modified by a Note that may require that more frequent surveillances be performed.
| |
| If FMQ(X,Y,Z) is evaluated and found to be within the applicable transient limit, an evaluation is required to account for any increase to FMQ(X,Y,Z) that may occur and cause the FQ(X,Y,Z) limit to be exceeded before the next required FQ(X,Y,Z)evaluation.
| |
| In addition to ensuring via surveillance that the heat flux hot channel factor is within its limits when a measurement is taken, there are also requirements to extrapolate trends in both the measured hot channel factor and in its operational and RPS limits. Two extrapolations are performed for each of these two limits: 1. The first extrapolation determines whether the measured heat flux hot channel factor is likely to exceed its limit prior to the next performance of the SR.2. The second extrapolation determines whether, prior to the next performance of the SR, the ratio of the measured heat flux hot channel factor to the limit is likely to decrease below the value of that ratio when the measurement was taken.Each of these extrapolations is applied separately to each of the operational and RPS heat flux hot channel factor limits. If both of the extrapolations for a given limit are unfavorable, i.e., if the extrapolated factor is expected to exceed the extrapolated limit and the extrapolated factor is expected to become a larger fraction of the extrapolated limit McGuire Units 1 and 2 B 3.2.1 -10 Revision No. 115 FQ(XY,Z)B 3.2.1 BASES SURVEILLANCE REQUIREMENTS (continued) than the measured factor is of the current limit, additional actions must be taken. These actions are to meet the FQ(X,Y,Z) limit with the last FMQ(X,Y,Z) increased by the appropriate factor specified in the COLR or to evaluate FQ(X,Y,Z) prior to the projected point in time when the extrapolated values are expected to exceed the extrapolated limits.These alternative requirements attempt to prevent FQ(X,Y,Z) from exceeding its limit for any significant period of time without detection using the best available data. FMQ(X,Y,Z) is not required to be extrapolated for the initial flux map taken after reaching equilibrium conditions since the initial flux map establishes the baseline measurement for future trending.
| |
| Also, extrapolation of FMQ(X,Y,Z) limits are not valid for core locations that were previously rodded, or for core locations that were previously within +/-2% of the core height about the demand position of the rod tip.FQ(X,Y,Z) is verified at power levels > 10% RTP above the THERMAL POWER of its last verification, 12 hours after achieving equilibrium conditions to ensure that FQ(X,Y,Z) is within its limit at higher power levels.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. 10 CFR 50.46.2. UFSAR Section 15.4.8.3. 10 CFR 50, Appendix A, GDC 26.4. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| : 5. DPC-NE-201 I PA "Duke Power Company Nuclear Design Methodology for Core Operating Limits of Westinghouse Reactors".
| |
| McGuire Units 1 and 2 B 3.2.1-11 Revision No. 115 FAH(X,Y))B 3.2.2 B 3.2 POWER DISTRIBUTION LIMITS B 3.2.2 Nuclear Enthalpy Rise Hot Channel Factor (FAH(X,Y))
| |
| BASES BACKGROUND The purpose of this LCO is to establish limits on the power density at any point in the core so that the fuel design criteria are not exceeded and the accident analysis assumptions remain valid. The design limits on local (pellet) and integrated fuel rod peak power density are expressed in terms of hot channel factors. Control of the core power distribution with respect to these factors, along with the other applicable LCOs, ensures that local conditions in the fuel rods and coolant channels do not challenge core integrity at any location during either normal operation or a postulated accident analyzed in the safety analyses.FAH(X,Y) is defined as the ratio of the integral of the linear power along the fuel rod with the highest integrated power to the average integrated fuel rod power. Therefore, FH(X,Y) is a measure of the maximum total power produced in a fuel rod.FAH(X,Y) is sensitive to fuel loading patterns, bank insertion, and fuel burnup. FAH(X,Y) typically increases with control bank insertion and typically decreases with fuel burnup.FAH(X,Y) is not directly measurable but is inferred from a power distribution map obtained with the movable incore detector system.Specifically, the results of the three dimensional power distribution map are analyzed by a computer to determine FAH(X,Y).
| |
| This factor is calculated at least every 31 EFPD. However, during power operation, the global power distribution is monitored by LCO 3.2.3, "AXIAL FLUX DIFFERENCE (AFD)," and LCO 3.2.4, "QUADRANT POWER TILT RATIO (QPTR)," which address directly and continuously measured process variables.
| |
| The COLR provides peaking factor limits that ensure that the design basis value of the departure from nucleate boiling (DNB) is met for normal operation, operational transients, and any transient condition arising from events of moderate frequency for transients that do not alter the core power distribution.
| |
| The DNB design basis for operational transients and transients of moderate frequency preclude DNB and is met by limiting the minimum local DNB heat flux ratio to the design limit value using an NRC approved critical heat flux (CHF) correlation.
| |
| Operation transients and transients of moderate frequency that are DNB limited are assumed to begin with an FAH(X,Y) value that satisfies the LCO requirement, with the exception of accidents such as the uncontrolled RCCA bank withdrawal McGuire Units I and 2 B 3.2.2-1 Revision No. 115 (FA(X,Y))B 3.2.2 BASES BACKGROUND (continued)(UCBW). For these types of accidents, the event itself causes changes in the power distribution and this LCO alone is not sufficient to preclude DNB. The acceptability of analyses such as the UCBW accident analysis is ensured by LCO 3.2.3, "AXIAL FLUX DIFFERENCE (AFD)," LCO 3.1.6,"Control Bank Insertion Limits," LCO 3.2.4, "QUADRANT POWER TILT RATIO (QPTR)," LCO 3.4.1, "RCS Pressure, Temperature, and Flow Departure From Nucleate Boiling (DNB) Limits," in combination with cycle-specific analytical calculations." Operation outside the LCO limits may produce unacceptable consequences if a DNB limiting event occurs.APPLICABLE Limits on FAH(X,Y) preclude core power distributions that exceed the SAFETY ANALYSES following fuel design limits: a. The DNBR calculated for the hottest fuel rod in the core must be above the approved DNBR limit. (The LCO alone is not sufficient to preclude DNB criteria violations for certain accidents, i.e., accidents in which the event itself changes the core power distribution.
| |
| For these events, additional checks are made in the core reload design process against the permissible statepoint power distributions.);
| |
| : b. During a large break loss of coolant accident (LOCA), there must be a high level of probability that the peak cladding temperature (PCT) does not exceed 2200°F;c. During an ejected rod accident, the energy deposition to the fuel must not exceed 280 cal/gm (Ref. 1); and d. Fuel design limits required by GDC 26 (Ref. 2) for the condition when control rods must be capable of shutting down the reactor with a minimum required SDM with the highest worth control rod stuck fully withdrawn.
| |
| For transients that may be DNB limited, the Reactor Coolant System flow and FaH(X,Y) are the core parameters of most importance.
| |
| The limits on FAH(X,Y) ensure that the DNB design basis is met for normal operation, operational transients, and any transients arising from events of moderate frequency that do not alter the core power distribution.
| |
| For transients such as uncontrolled RCCA bank withdrawal, which are characterized by changes in the core power distribution, this LCO alone is not sufficient to preclude DNB. The acceptability of the accident analyses is ensured by McGuire Units 1 and 2 B 3.2.2-2 Revision No. 115 (FAH(X,Y))
| |
| B 3.2.2 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| LCO 3.2.3, "AXIAL FLUX DIFFERENCE (AFD)," LCO 3.1.6, "Control Bank Insertion Limits," LCO 3.2.4, "QUADRANT POWER TILT RATIO (QPTR)," and LCO 3.4.1, "RCS Pressure, Temperature, and Flow Departure From Nucleate Boiling (DNB) Limits," in combination with cycle-specific analytical calculations.
| |
| The DNB design basis is met by limiting the minimum DNBR to the design limit value using an NRC approved CHF correlation.
| |
| This value provides a high degree of assurance that the hottest fuel rod in the core does not experience a DNB.The allowable FAH(X,Y) limit increases with decreasing power level. This functionality in FAH(X,Y) is included in the analyses that provide the Reactor Core Safety Limits (SLs) of SL 2.1.1. Therefore, any DNB events in which the calculation of the core limits is modeled implicitly use this variable value of FAH(X,Y) in the analyses.The LOCA safety analysis models FAH(X,Y) as an input parameter.
| |
| The Nuclear Heat Flux Hot Channel Factor (FQ(X,Y,Z))
| |
| and the axial peaking factors are inserted directly into the LOCA safety analyses that verify the acceptability of the resulting peak cladding temperature (Ref. 3). The fuel is protected in part by Technical Specifications, which ensure that the initial conditions assumed in the safety and accident analyses remain valid. The following LCOs ensure this: LCO 3.2.3, "AXIAL FLUX DIFFERENCE (AFD)," LCO 3.2.4, "QUADRANT POWER TILT RATIO (QPTR)," LCO 3.1.6, "Control Bank Insertion Limits," LCO 3.2.2, "Nuclear Enthalpy Rise Hot Channel Factor (FAH)," and LCO 3.2.1, "Heat Flux Hot Channel Factor (FQ(X,Y,Z))." FAH(X,Y) and FQ(X,Y,Z) are measured periodically using the movable incore detector system. Measurements are generally taken with the core at, or near, steady state conditions.
| |
| Core monitoring and control under transient conditions (Condition 1 events) are accomplished by operating the core within the limits of the LCOs on AFD, QPTR, and Control Bank Insertion Limits.FAH(X,Y) satisfies Criterion 2 of 10 CFR 50.36 (Ref. 4).LCO FAH(X,Y) shall be limited by the following relationship:
| |
| FM LX"H _ (X, y)LCO where: FMAH(X,Y) is defined as the measured radial peak, and FLAH(X,Y)LCO is defined as the steady state maximum allowable radial peak defined in the COLR.McGuire Units 1 and 2 B 3.2.2-3 Revision No. 115 (FAH(X,Y))
| |
| B 3.2.2 BASES LCO (continued)
| |
| The FLAH(X,Y)LCO limit identifies the coolant flow channel with the maximum enthalpy rise. This channel has the least heat removal capability and thus the highest probability for DNB.FLAH(X,Y)LcO limits are maximum allowable radial peak (MARP) limits which are developed in accordance with the methodology outlined in Reference
| |
| : 5. MARP limits are constant DNBR limits which are a function of both the magnitude and location of the axial peak F(Z), therefore, justifying the X,Y dependence of the FLAH(X,Y)LCO limit.The limiting value, FLH(X,Y)LCO, is also power dependent and can be described by the following relationship:
| |
| FL (X,y)LCO = MARP (X, Y) * [1.0 + (1IRRH) * (1.0 -P)]where: MARP(X,Y) is the maximum allowable radial peaks provided in the COLR, P is the ratio of THERMAL POWER to RATED THERMAL POWER, and RRH is the amount by which allowable THERMAL POWER must be reduced for each 1% that FMAH(X,Y)exceeds the limit. The specific value is contained in the COLR.A power multiplication factor in this equation includes an additional margin for higher radial peaking from reduced thermal feedback and greater control rod insertion at low power levels. The limiting value, FLAH(X,Y)LC°, is allowed to increase approximately 0.3% for every 1% RTP reduction in THERMAL POWER. This increase in the FLAH(X,Y)LCO limit is due to the reduced amount of heat removal required at lower powers.APPLICABILITY The FAH(X,Y) limits must be maintained in MODE 1 to preclude core power distributions from exceeding the fuel design limits for DNBR and PCT.Applicability in other modes is not required because there is either insufficient stored energy in the fuel or insufficient energy being transferred to the coolant to require a limit on the distribution of core power.Specifically, the design bases events that might be expected to be sensitive to FAH(X,Y) in other modes (MODES 2 through 5) have significant margin to DNB, and therefore, there is no need to restrict FAH(X,Y) in these modes.The exceptions to this are the steam line break, APPLICABILITY (continued)
| |
| McGuire Units 1 and 2 B 3.2.2-4 Revision No. 115 (FAH(X,Y))
| |
| B 3.2.2 BASES uncontrolled RCCA bank withdrawal from zero power and rod ejection from zero power events, which are assumed, for analysis purposes, to occur from very low power levels. At these low power levels, measurements of FAH are not sufficiently reliable.
| |
| Operation within analysis limits at these conditions is inferred from startup physics testing verification of design predictions of core parameters in general.ACTIONS A..1 If FMAH(X,Y) is not within limit, THERMAL POWER must be reduced at least RRH% from RTP for each 1% FAH(X,Y) exceeds the limit. Reducing power increases the DNB margin and does not likely cause the DNBR limit to be violated in steady state operation.
| |
| The Completion Time of 2 hours provides an acceptable time to reach the required power level without allowing the plant to remain in an unacceptable condition for an extended period of time.Condition A is modified by a Note that requires that Required Actions A.3.2.2 and A.4 must be completed whenever Condition A is entered. Thus, if compliance with the LCO is restored, Required Action A.3.2.2 and A.4 nevertheless requires another measurement and calculation of FAH(X,Y) in accordance with SR 3.2.2.1.A.2.1 and A.2.2 Upon completion of the power reduction in Required Action A.1, the unit is allowed an additional 6 hours to restore FAH(X,Y) to within its RTP limits. This restoration may, for example, involve realigning any misaligned rods enough to bring FAH(X,Y) within its limit. When the FAH(X,Y) limit is exceeded, the DNBR limit is not likely violated in steady state operation, because events that could significantly perturb the FAH(X,Y) value (e.g., static control rod misalignment) are considered in the safety analyses.
| |
| However, the DNBR limit may be violated if a DNB limiting event occurs. Thus, the allowed Completion Time of 8 hours provides an acceptable time to restore FAH(X,Y) to within its RTP limits without allowing the plant to remain in an unacceptable condition for an extended period of time.If the value of FAH(X,Y) is not restored to within its specified RTP limit, the alternative option is to reduce the Power Range Neutron Flux-High Trip Setpoint >_ RRH% for each 1% FMAH(X,Y) exceeds the limit in accordance with Required Action A.2.2. The reduction in trip setpoints ensures that McGuire Units 1 and 2 B 3.2.2-5 Revision No. 115 (FAH(X,Y))
| |
| B 3.2.2 BASES ACTIONS (continued) continuing operation remains at an acceptable low power level with adequate DNBR margin and limits the consequences of a transient by limiting the transient power level which can be achieved during a postulated event.The allowed Completion Time of 8 hours to reset the trip setpoints per Required Action A.2.2 recognizes that, once power is reduced, the safety analysis assumptions are satisfied and there is no urgent need to reduce the trip setpoints.
| |
| This is a sensitive operation that may inadvertently trip the Reactor Protection System.A.3.1, A.3.2.1, and A.3.2.2 If FMAH(X,Y) was not restored to within the RTP limits, and the Power Range Neutron Flux-High Trip Setpoints were subsequently reduced, an additional 64 hours are provided to restore FMAH(X,Y) within the limit for RTP. Alternatively, the Overtemperature AT setpoint (K 1 term) must be reduced by > TRH for each 1% FMAH(X,Y) exceeds the limit. TRH is the amount of overtemperature AT K 1 setpoint reduction required to compensate for each 1% that FMAH(X,Y) exceeds the limit and is provided in the COLR. This action ensures that protection margin is maintained in the reduced power level for DNB related transients not covered by the reduction in the Power Range Neutron Flux-High Trip Setpoint.
| |
| Once the Overtemperature AT Trip Setpoint has been reduced per Required Action A.3.2.1, an incore flux map (SR 3.2.2.1) must be obtained and the measured value of FAH(X,Y) verified not to exceed the allowed limit at the lower power level.The unit is provided 64 additional hours to perform these tasks over and above the 8 hours allowed by either Action A.2.1 or Action A.2.2. The Completion Time of 72 hours is acceptable because of the increase in the DNB margin, which is obtained at lower power levels, and the low probability of having a DNB limiting event within this 72 hour period.Additionally, operating experience has indicated that this Completion Time is sufficient to obtain the incore flux map, perform the required calculations, and evaluate FAH(X,Y).A.4 Verification that FAH(X,Y) is within its specified limits after an out of limit occurrence ensures that the cause that led to the FAH(X,Y) exceeding its limit is corrected, and that subsequent operation proceeds within the LCO McGuire Units 1 and 2 B 3.2.2-6 Revision No. 115 (FAH(X,Y))
| |
| B 3.2.2 BASES ACTIONS (continued) limit. This Action demonstrates that the FAH(X,Y) limit is within the LCO limits prior to exceeding 50% RTP, again prior to exceeding 75% RTP, and within 24 hours after THERMAL POWER is > 95% RTP.This Required Action is modified by a Note that states that THERMAL POWER does not have to be reduced prior to performing this Action.B.1 When Required Actions A.1 through A.4 cannot be completed within their required Completion Times, the plant must be placed in a mode in which the LCO requirements are not applicable.
| |
| This is done by placing the plant in at least MODE 2 within 6 hours. The allowed Completion Time of 6 hours is reasonable, based on operating experience regarding the time required to reach MODE 2 from full power conditions in an orderly manner and without challenging plant systems.SURVEILLANCE REQUIREMENTS SR 3.2.2.1 and SR 3.2.2.2 are modified by a Note. The Note applies during the first power ascension after a refueling.
| |
| It states that THERMAL POWER may be increased until an equilibrium power level has been achieved at which a power distribution map can be obtained.
| |
| This allowance is modified, however, by one of the Frequency conditions that requires verification that FMAH(X,Y) is within the specified limits after a power rise of more than 10% RTP over the THERMAL POWER at which it was last verified to be within specified limits. Because FMAH(X,Y) could not have previously been measured in this reload core, power may be increased to RTP prior to an equilibrium verification of FAH(X,Y) provided nonequilibrium measurements of FAH(X,Y) are performed at various power levels during startup physics testing. This ensures that some determination of FAH(X,Y) is made at a lower power level at which adequate margin is available before going to 100% RTP. The Frequency condition is not intended to require verification of the parameter after every 10% increase in power level above the last verification.
| |
| It only requires verification after a power level is achieved for extended operation that is 10% higher than that power at which FAH(X,Y) was last measured.SR 3.2.2.1 The value of FMAH(X,Y) is determined by using the movable incore detector system to obtain a flux distribution map at any THERMAL POWER greater than 5% RTP. A computer program is used to process McGuire Units 1 and 2 B 3.2.2-7 Revision No. 115 (FH(X,Y))B 3.2.2 BASES SURVEILLANCE REQUIREMENTS (continued) the measured 3-D power distribution to calculate the steady state F LH(X,Y)LCO limit which is compared against FMAH(X,Y).
| |
| FMAH(X,Y) is verified at power levels > 10% RTP above the THERMAL POWER of its last verification, 12 hours after achieving equilibrium conditions to ensure that FMAH(X,Y) is within its limit at high power levels.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.2.2.2 The nuclear design process includes calculations performed to determine that the core can be operated within the FAH(X,Y) limits. Because flux maps are taken in steady state conditions, the variations in power distribution resulting from normal operational maneuvers are not present in the flux map data. These variations are, however, conservatively calculated by considering a wide range of unit maneuvers in normal operation.
| |
| The maximum peaking factor increase over steady state values is a limit called FLAH (X,Y)SuRV.
| |
| This Surveillance compares the measured FMAH(X,Y) to the Surveillance limit to ensure that safety analysis limits are maintained.
| |
| This Surveillance has been modified by a Note that may require that more frequent surveillances be performed.
| |
| If FMAH(X,Y) is evaluated and found to be within its surveillance limit, an evaluation is required to account for any increase to FMAH(X,Y) that may occur and cause the FAH(X,Y)SURV limit to be exceeded before the next required FAH(X,Y)suRv evaluation.
| |
| In addition to ensuring via surveillance that the enthalpy rise hot channel factor is within its steady state and surveillance limits when a measurement is taken, there are also requirements to extrapolate trends in both the measured hot channel factor and in its surveillance limit. Two extrapolations are performed for this limit: 1. The first extrapolation determines whether the measured enthalpy rise hot channel factor is likely to exceed its surveillance limit prior to the next performance of the SR.2. The second extrapolation determines whether, prior to the next performance of the SR, the ratio of the measured enthalpy rise hot McGuire Units 1 and 2 B 3.2.2-8 Revision No. 115 (FAH(X,Y))
| |
| B 3.2.2 BASES SURVEILLANCE REQUIREMENTS (continued) channel factor to the surveillance limit is likely to decrease below the value of that ratio when the measurement was taken.Each of these extrapolations is applied separately to the enthalpy rise hot channel factor surveillance limit. If both of the extrapolations are unfavorable, i.e., if the extrapolated factor is expected to exceed the extrapolated limit and the extrapolated factor is expected to become a larger fraction of the extrapolated limit than the measured factor is of the current limit, additional actions must be taken. These actions are to meet the FMAH(X,Y) limit with the last FMAH(X,Y) increased by the appropriate factor specified in the COLR, or to evaluate FMAH(X,Y) prior to the point in time when the extrapolated values are expected to exceed the extrapolated limits. These alternative requirements attempt to prevent FMAH(X,Y) from exceeding its limit for any significant period of time without detection using the best available data. FMAH(X,Y) is not required to be extrapolated for the initial flux map taken after reaching equilibrium conditions since the initial flux map establishes the baseline measurement for future trending.FMAH(X,Y) is verified at power levels 10% RTP above the THERMAL POWER of its last verification, 12 hours after achieving equilibrium conditions to ensure that FMAH(X,Y) is within its limit at high power levels.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. UFSAR Section 15.4.8 2. 10 CFR 50, Appendix A, GDC 26.3. 10 CFR 50.46.4. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| : 5. DPC-NE-2005P "Duke Power Company Thermal Hydraulic Statistical Core Design Methodology", September 1992.6. DPC-NE-2004P-A, Rev. 1, "Duke Power Company McGuire and Catawba Nuclear Statements Core Thermal -Hydraulic Methobology using VIPRE-01, "SER Dated February 20, 1987 (KCP Proprietary.
| |
| McGuire Units 1 and 2 B 3.2.2-9 Revision No. 115 AFD B 3.2.3 B 3.2 POWER DISTRIBUTION LIMITS B 3.2.3 AXIAL FLUX DIFFERENCE (AFD)BASES BACKGROUND The purpose of this LCO is to establish limits on the values of the AFD in order to limit the amount of axial power distribution skewing to either the top or bottom of the core. By limiting the amount of power distribution skewing, core peaking factors are consistent with the assumptions used in the safety analyses.
| |
| Limiting power distribution skewing over time also minimizes the xenon distribution skewing, which is a significant factor in axial power distribution control.The analysis performed to develop the AFD limits involves the generation and evaluation of several thousand, three dimensional power distributions which consider burnup, reactor power, coolant temperature, control bank position, and xenon. The generation of conservative limits is assured through the generation of power distributions which are more severe than expected to occur during normal or transient operation.
| |
| The selection of severe xenon distributions for the peaking analysis also adds another degree of conservatism to the analysis.
| |
| Subsequently, power peaking factors and power distributions are examined to ensure that the loss of coolant accident (LOCA), DNB limiting transients in which the power distribution remains unchanged during the transient, and anticipated transient limits are met. Violation of the AFD limits invalidate the conclusions of the accident and transient analyses with regard to fuel cladding integrity.
| |
| Although the maneuvering analysis defines limits that must be met to satisfy safety analyses, typically a target operating band is used to control axial power distribution in day to day operation.
| |
| This requires that the AFD be controlled within a narrow tolerance band around a burnup dependent target.The constant target band operating space is typically smaller and lies within the maneuvering analysis operating space. Control within the constant target band operating space constrains the variation of axial xenon distributions and axial power distributions during normal operation and unit maneuvers.
| |
| The maneuvering analysis calculations assume a wide range of xenon distributions and then cohfirm that the resulting power distributions satisfy the requirements of the accident analyses.McGuire Units 1 and 2 B 3.2.3-1 Revision No. 115 AFD B 3.2.3 BASES APPLICABLE The AFD is a measure of the axial power distribution skewing to either SAFETY ANALYSES the top or bottom half of the core. The AFD is sensitive to many core related parameters such as control bank positions, core power level, axial burnup, axial xenon distribution, and, to a lesser extent, reactor coolant temperature and boron concentration.
| |
| The allowed range of the AFD is used in the nuclear design process to confirm that operation within these limits produces core peaking factors and axial power distributions that meet safety analysis requirements.
| |
| The maneuvering analysis (Ref. 1) uses a three dimensional nodal reactor model to calculate a set of power distributions at several points in the core life. These power distributions are calculated with abnormal xenon distributions to ensure predicted power distributions are conservative with respect to those expected to occur. Peaking factors from these power distributions are then evaluated against various thermal limits. This evaluation then confirms the adequacy of current power dependent AFD limits, rod insertion limits, and the F(AI) penalty function, or provides the bases for establishing new limits. The development of operational AFD limits and the F(AI) function of either the Overpower AT or the Overtemperature AT RPS trip functions are established such to exclude the power distributions that exceed the respective thermal limits.The limits on the AFD ensure that the Heat Flux Hot Channel Factor (FQ(X,Y,Z))
| |
| is not exceeded during either normal operation or in the event of xenon redistribution following power changes. The limits on the AFD also restrict the range of power distributions that are used as initial conditions in the analyses of Condition 2, 3, or 4 events. This ensures that the fuel cladding integrity is maintained within respective limits for these postulated accidents.
| |
| The most important Condition 3 and 4 event is the LOCA. The most important Condition 2 events include loss of flow, uncontrolled bank withdrawal, and boration or dilution accidents.
| |
| Condition 2 and 3 accidents simulated to begin from within the AFD limits are used to confirm the adequacy of the Overpower AT and Overtemperature AT trip setpoints.
| |
| The limits on the AFD satisfy Criterion 2 of 10 CFR 50.36 (Ref. 2).LCO The shape of the power profile in the axial (i.e., the vertical) direction is largely under the control of the operator through the manual operation of the control banks or automatic motion of control banks. The automatic motion of the control banks is in response to temperature deviations resulting from manual operation of the Chemical and Volume Control System to change boron concentration or from power level changes.McGuire Units 1 and 2 B 3.2.3-2 Revision No. 115 AFD B 3.2.3 BASES LCO (continued)
| |
| Signals are available to the operator from the Nuclear Instrumentation System (NIS) excore neutron detectors (Ref. 3). Separate signals are taken from the top and bottom detectors.
| |
| The AFD is defined as the difference in normalized flux signals between the top and bottom excore detectors in each detector well. For convenience, this flux difference is converted to provide flux difference units expressed as a percentage and labeled as %A flux or %AI.The AFD limits are provided in the COLR. The AFD limits do not depend on the target flux difference.
| |
| However, the target flux difference may be used to minimize changes in the axial power distribution.
| |
| Violating this LCO on the AFD could produce unacceptable consequences if a Condition 2, 3, or 4 event occurs while the AFD is outside its specified limits.APPLICABILITY The AFD requirements are applicable in MODE 1 greater than or equal to 50% RTP when the combination of THERMAL POWER and core peaking factors are of primary importance in safety analysis.For AFD limits developed using maneuvering analysis methodology, the value of the AFD does not affect the limiting accident consequences with THERMAL POWER < 50% RTP and for lower operating power MODES.ACTIONS A.1 As an alternative to restoring the AFD to within its specified limits, Required Action A.1 requires a THERMAL POWER reduction to< 50% RTP. This places the core in a condition for which the value of the AFD is not important in the applicable safety analyses.
| |
| A Completion Time of 30 minutes is reasonable, based on operating experience, to reach 50% RTP without challenging plant systems.SURVEILLANCE REQUIREMENTS SR 3.2.3.1 The AFD is monitored on an automatic basis using the unit process computer, which has an AFD monitor alarm. The computer determines the 1 minute average of each of the OPERABLE excore detector outputs and provides an alarm message immediately if the AFD for two or more OPERABLE excore channels is outside its specified limits.McGuire Units 1 and 2 B 3.2.3-3 Revision No. 115 AFD B 3.2.3 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| This Surveillance verifies that the AFD, as indicated by the NIS excore channel, is within its specified limits and is consistent with the status of the AFD monitor alarm. With the AFD monitor alarm inoperable, the AFD is monitored every hour to detect operation outside its limit. The Frequency of 1 hour is based on operating experience regarding the amount of time required to vary the AFD, and the fact that the AFD is closely monitored.
| |
| With the AFD monitor alarm OPERABLE.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. DPC-NE-201 1 PA, "Duke Power Company Nuclear Design Methodology for Core Operating Limits of Westinghouse Reactors".
| |
| : 2. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| : 3. UFSAR, Chapter 7.McGuire Units 1 and 2 B83.2.3-4 Revision No. 115 33QPTR B 3.2.4 B 3.2 POWER DISTRIBUTION LIMITS B 3.2.4 QUADRANT POWER TILT RATIO (QPTR)BASES BACKGROUND The QPTR limit ensures that the gross radial power distribution remains consistent with the design values used in the safety analyses.
| |
| Precise radial power distribution measurements are made during startup testing, after refueling, and periodically during power operation.
| |
| The power density at any point in the core must be limited so that the fuel design criteria are maintained.
| |
| Together, LCO 3.2.3, "AXIAL FLUX DIFFERENCE (AFD)," LCO 3.2.4, and LCO 3.1.6, "Control Rod Insertion Limits," provide limits on process variables that characterize and control the three dimensional power distribution of the reactor core. Control of these variables ensures that the core operates within the fuel design criteria and that the power distribution remains within the bounds used in the safety analyses.APPLICABLE This LCO precludes core power distributions that violate the following SAFETY ANALYSES fuel design criteria: a. During a large break loss of coolant accident (LOCA), there must be a high level of probability that the peak cladding temperature does not exceed 2200°F (Ref. 1);b. The DNBR calculated for the hottest fuel rod in the core must be above the approved DNBR limit. (The LCO alone is not sufficient to preclude DNB criteria violations for certain accidents, i.e., accidents in which the event itself changes the core power distribution.
| |
| For these events, additional checks are made in the core reload design process against the permissible statepoint power distributions.);
| |
| : c. During an ejected rod accident, the energy deposition to the fuel must not exceed 280 cal/gm (Ref. 2); and d. The control rods must be capable of shutting down the reactor with a minimum required SDM with the highest worth control rod stuck fully withdrawn (Ref. 3).The LCO limits on the AFD, the QPTR, the Heat Flux Hot Channel Factor (FQ(X,Y,Z)), the Nuclear Enthalpy Rise Hot Channel Factor (FAH(X,Y)), and control bank insertion are established to preclude core power distributions that exceed the safety analyses limits.McGuire Units 1 and 2 B 3.2.4-1 Revision No. 115 QPTR B 3.2.4 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| The QPTR limits ensure that FAH(X,Y) and Fa(X,Y,Z) remain below their limiting values by preventing an undetected change in the gross radial power distribution.
| |
| In MODE 1, the FAH(X,Y) and FQ(X,Y,Z) limits must be maintained to preclude core power distributions from exceeding design limits assumed in the safety analyses.The QPTR satisfies Criterion 2 of 10 CFR 50.36 (Ref. 4).LCO The QPTR limit of 1.02, at which corrective action is required, provides a margin of protection for both the DNB ratio and linear heat generation rate contributing to excessive power peaks resulting from X-Y plane power tilts. A limiting QPTR of 1.02 can be tolerated before the margin for uncertainty in FQ(X,Y,Z) and FAH(X,Y), or safety analysis peaking assumptions are possibly challenged.
| |
| APPLICABILITY The QPTR limit must be maintained in MODE 1 with THERMAL POWER> 50% RTP to prevent core power distributions from exceeding the design limits.Applicability in MODE 1 _< 50% RTP and in other MODES is not required because there is either insufficient stored energy in the fuel or insufficient energy being transferred to the reactor coolant to require the implementation of a QPTR limit on the distribution of core power. The QPTR limit in these conditions is, therefore, not important.
| |
| Note that the FAH(X,Y) and FQ(X,Y,Z)
| |
| LCOs still apply, but allow progressively higher peaking factors at 50% RTP or lower.The Applicability is modified by a Note which states that the LCO is not applicable until the excore nuclear instrumentation is calibrated subsequent to a refueling.
| |
| ACTIONS A. 1 With the QPTR exceeding its limit, a power level reduction of 3% from RTP for each 1% by which the QPTR exceeds 1.02 is a conservative tradeoff of total core power with peak linear power. The Completion Time McGuire Units 1 and 2 B 3.2.4-2 Revision No. 115 QPTR B 3.2.4 BASES ACTIONS (continued) of 2 hours allows sufficient time to identify the cause and correct the tilt.Note that the power reduction itself may cause a change in the tilted condition.
| |
| A.2 After completion of Required Action A.1, the QPTR alarm may still be in its alarmed state. As such, any additional changes in the QPTR are detected by requiring a check of the QPTR once per 12 hours thereafter.
| |
| If the QPTR continues to increase, THERMAL POWER has to be reduced accordingly.
| |
| A 12 hour Completion Time is sufficient because any additional change in QPTR would be relatively slow.A.3 The peaking factors FAH(X,Y) and FQ(X,Y,Z) are of primary importance in ensuring that the power distribution remains consistent with the initial conditions used in the safety analyses.
| |
| Performing SRs on FAH(X,Y) and FQ(X,Y,Z) within the Completion Time of 24 hours ensures that these primary indicators of power distribution are within their respective limits.A Completion Time of 24 hours takes into consideration the rate at which peaking factors are likely to change, and the time required to stabilize the plant and perform a flux map. If these peaking factors are not within their limits, the Required Actions of these Surveillances provide an appropriate response for the abnormal condition.
| |
| If the QPTR remains above its specified limit, the peaking factor surveillances are required each 7 days thereafter to evaluate FH(X,Y) and FQ(X,Y,Z) with changes in power distribution.
| |
| Relatively small changes are expected due to either burnup and xenon redistribution or correction of the cause for exceeding the QPTR limit.A.4 If QPTR exceeds a value of 1.02, the Power Range Neutron Flux-High trip setpoint is reduced by 3% for each 1% QPTR exceeds 1.02.Lowering this setpoint maintains the same margin to trip by limiting the transient response of the core. The 72 hour Completion Time is sufficient for this activity to be performed and is acceptable based on the low probability of a transient occurring in this time frame.McGuire Units 1 and 2 B 3.2A4-3 Revision No. 115 QPTR B 3.2.4 BASES ACTIONS (continued)
| |
| A.5 Although FAH(X,Y) and FQ(X,Y,Z) are of primary importance as initial conditions in the safety analyses, other changes in the power distribution may occur as the QPTR limit is exceeded and may have an impact on the validity of the safety analysis.
| |
| A change in the power distribution can affect such reactor parameters as bank worths and peaking factors for rod malfunction accidents.
| |
| When the QPTR exceeds its limit, it does not necessarily mean a safety concern exists. It does mean that there is an indication of a change in the gross radial power distribution that requires an investigation and evaluation that is accomplished by examining the incore power distribution.
| |
| Specifically, the core peaking factors and the quadrant tilt must be evaluated because they are the factors that best characterize the core power distribution.
| |
| This re-evaluation is required to ensure that, before increasing THERMAL POWER to above the more restrictive limit of Required Action A. 1 or A.2, the reactor core conditions are consistent with the assumptions in the safety analyses.A.6.If the QPTR has exceeded the 1.02 limit and a re-evaluation of the safety analysis is completed and shows that safety requirements are met, the excore detectors are recalibrated to show a zero QPT prior to increasing THERMAL POWER to above the more restrictive limit of Required Action A.1 or A.2. This is done to detect any subsequent significant changes in QPTR.Required Action A.6 is modified by a Note that states that the QPT is not zeroed out until after the re-evaluation of the safety analysis has determined that core conditions at RTP are within the safety analysis assumptions (i.e., Required Action A.5). This Note is intended to prevent any ambiguity about the required sequence of actions.A.7 Once the flux tilt is zeroed out (i.e., Required Action A.6 is performed), it is acceptable to return to full power operation.
| |
| However, as an added check that the core power distribution at RTP is consistent with the safety analysis assumptions, Required Action A.7 requires verification that FQ(X,Y,Z) and FAH(X,Y) are within their specified limits within 24 hours of McGuire Units 1 and 2 B 3.2.4-4 Revision No. 115 QPTR B 3.2.4 BASES ACTIONS (continued) reaching RTP. As an added precaution, if the core power does not reach RTP within 24 hours, but is increased slowly, then the peaking factor surveillances must be performed within 48 hours of the time when the more restrictive of the power level limit determined by Required Action A.1 or A.2 is exceeded.
| |
| These Completion Times are intended to allow adequate time to increase THERMAL POWER to above the more restrictive limit of Required Action A.1 or A.2, while not permitting the core to remain with unconfirmed power distributions for extended periods of time.Required Action A.7 is modified by a Note that states that the peaking factor surveillances must be done after the excore detectors have been calibrated to show zero tilt (i.e., Required Action A.6). The intent of this Note is to have the peaking factor surveillances performed at operating power levels, which can only be accomplished after the excore detectors are calibrated to show zero tilt and the core returned to power.B.1 If Required Actions A.1 through A.7 are not completed within their associated Completion Times, the unit must be brought to a MODE or condition in which the requirements do not apply. To achieve this status, THERMAL POWER must be reduced to < 50% RTP within 4 hours. The allowed Completion Time of 4 hours is reasonable, based on operating experience regarding the amount of time required to reach the reduced power level without challenging plant systems.SURVEILLANCE SR 3.2.4.1 REQUIREMENTS SR 3.2.4.1 is modified by two Notes. Note 1 allows QPTR to be calculated with three power range channels if THERMAL POWER is <75% RTP and the input from one Power Range Neutron Flux channel is inoperable.
| |
| Note 2 allows performance of SR 3.2.4.2 in lieu of SR 3.2.4.1 if more than one input from Power Range Neutron Flux channels are inoperable.
| |
| This Surveillance verifies that the QPTR, as indicated by the Nuclear Instrumentation System (NIS) excore channels, is within its limits. When the QPTR alarm is OPERABLE, the Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Units 1 and 2 B 3.2-4-5 Revision No. 115 QPTR B 3.2.4 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| When the QPTR alarm is inoperable, the Frequency is increased to 12 hours. This Frequency is adequate to detect any relatively slow changes in QPTR, because for those causes of QPT that occur quickly (e.g., a dropped rod), there typically are other indications of abnormality that prompt a verification of core power tilt.SR 3.2.4.2 This Surveillance is modified by a Note, which states that it is required only when the input from one or more Power Range Neutron Flux channels are inoperable and the THERMAL POWER is _> 75% RTP.With an NIS power range channel inoperable, tilt monitoring for a portion of the reactor core becomes degraded.
| |
| Large tilts are likely detected with the remaining channels, but the capability for detection of small power tilts in some quadrants is decreased.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.For purposes of monitoring the QPTR when one power range channel is inoperable, the moveable incore detectors are used to confirm that the normalized symmetric power distribution is consistent with the indicated QPTR and any previous data indicating a tilt. The incore detector monitoring is performed with a full incore flux map or two sets of four thimble locations with quarter core symmetry.
| |
| The two sets of four symmetric thimbles is a set of eight unique detector locations.
| |
| These locations are C-8, E-5, E-1 1, H-3, H-1 3, L-5, L-1 1, and N-8.The symmetric thimble flux map can be used to generate symmetric thimble "tilt." This can be compared to a reference symmetric thimble tilt, from the most recent full core flux map, to generate an incore tilt.Therefore, incore tilt can be used to confirm that QPTR is within limits.With one or more NIS channel inputs to QPTR inoperable, the indicated tilt may be changed from the value indicated with all four channels OPERABLE.
| |
| To confirm that no change in tilt has actually occurred, which might cause the QPTR limit to be exceeded, the incore result may be compared against previous flux maps either using the symmetric thimbles as described above or a complete flux map. Nominally, quadrant tilt from the Surveillance should be within 2% of the tilt shown by the most recent flux map data.McGuire Units 1 and 2 B 3.2.4-6 Revision No. 115 QPTR B 3.2.4 BASES REFERENCES 1.2.3.4.10 CFR 50.46.UFSAR Section 15.4.8.10 CFR 50, Appendix A, GDC 26.10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.2.4-7 Revision No. 115 RTS Instrumentation B 3.3.1 B 3.3 INSTRUMENTATION B3.3.1 Reactor Trip System (RTS) Instrumentation BASES BACKGROUND The RTS initiates a unit shutdown, based on the values of selected unit parameters, to protect against violating the core fuel design limits and Reactor Coolant System (RCS) pressure boundary during anticipated operational occurrences (AOOs) and to assist the Engineered Safety Features (ESF) Systems in mitigating accidents.
| |
| The protection and monitoring systems have been designed to assure safe operation of the reactor. This is achieved by specifying limiting safety system settings (LSSS) in terms of parameters directly monitored by the RTS, as well as specifying LCOs on other reactor system parameters and equipment performance.
| |
| The LSSS, defined in this specification as the Allowable Values, in conjunction with the LCOs, establish the threshold for protective system action to prevent exceeding acceptable limits during Design Basis Accidents (DBAs).During AQOs, which are those events expected to occur one or more times during the unit life, the acceptable limits are: 1. The Departure from Nucleate Boiling Ratio (DNBR) shall be maintained above the Safety Limit (SL) value to prevent departure from nucleate boiling (DNB);2. Fuel centerline melt shall not occur; and 3. The RCS pressure SL of 2735 psig shall not be exceeded.Operation within the SLs of Specification 2.0, "Safety Limits (SLs)," also maintains the above values and assures that offsite dose will be within the 10 CFR 20 and 10 CFR 100 criteria during AOOs.Accidents are events that are analyzed even though they are not expected to occur during the unit life. The acceptable limit during accidents is that offsite dose shall be maintained within an acceptable fraction of 10 CFR 100 limits. Different accident categories are allowed a different fraction of these limits, based on probability of occurrence.
| |
| Meeting the acceptable dose limit for an accident category is considered having acceptable consequences for that event.McGuire Units 1 and 2 B 3.3. 1-1 Revision No. 119 RTS Instrumentation B 3.3.1 BASES BACKGROUND (continued)
| |
| The RTS instrumentation is segmented into four distinct but interconnected categories as illustrated in UFSAR, Chapter 7 (Ref. 1), and as identified below: 1. Field transmitters or process sensors: provide a measurable electronic signal based upon the physical characteristics of the parameter being measured;2. Process monitoring systems, including the Process Control System, the Nuclear Instrumentation System (NIS), and various field contacts and sensors: monitors various plant parameters, provides any required signal processing, and provides digital outputs when parameters exceed predetermined limits. They may also provide outputs for control, indication, alarm, computer input, and recording;
| |
| : 3. Solid State Protection System (SSPS), including input, logic, and output bays: combines the input signals from the process monitoring systems per predetermined logic and initiates a reactor trip and ESF actuation when warranted by the process monitoring systems inputs; and 4. Reactor trip switchgear, including reactor trip breakers (RTBs) and bypass breakers:
| |
| provides the means to interrupt power to the control rod drive mechanisms (CRDMs) and allows the rod cluster control assemblies (RCCAs), or "rods," to fall into the core and shut down the reactor. The bypass breakers allow testing of the RTBs at power.Field Transmitters or Sensors To meet the design demands for redundancy and reliability, more than one, and often as many as four, field transmitters or sensors are used to measure unit parameters.
| |
| To account for the calibration tolerances and instrument drift, which are assumed to occur between calibrations, statistical allowances are provided NOMINAL TRIP SETPOINT Values.The OPERABILITY of each transmitter or sensor can be evaluated when its "as found" calibration data are compared against its documented acceptance criteria.McGuire Units 1 and 2 B 3.3.1-2 Revision No. 119 RTS Instrumentation B 3.3.1 BASES BACKGROUND (continued)
| |
| Process Monitorinq Systems Generally, three or four channels of process control equipment are used for the signal processing of unit parameters measured by the field instruments.
| |
| The process control equipment provides signal conditioning, compatible output signals for instruments located on the main control board, and comparison of measured input signals with setpoints established by safety analyses.
| |
| These setpoints are defined in UFSAR, Chapter 7 (Ref. 1), Chapter 6 (Ref. 2), and Chapter 15 (Ref. 3). If the measured value of a unit parameter exceeds the predetermined setpoint, an output from a bistable is forwarded to the SSPS for decision logic processing.
| |
| Channel separation is maintained up to and through the input bays. However, not all unit parameters require four channels of sensor measurement and signal processing.
| |
| Some unit parameters provide input only to the SSPS, while others provide input to the SSPS, the main control board, the unit computer, and one or more control systems.Generally, if a parameter is used only for input to the protection circuits, three channels with a two-out-of-three logic are sufficient to provide the required reliability and redundancy.
| |
| If one channel fails in a direction that would not result in a partial Function trip, the Function is still OPERABLE with a two-out-of-two logic. If one channel fails, such that a partial Function trip occurs, a trip will not occur and the Function is still OPERABLE with a one-out-of-two logic.Generally, if a parameter is used for input to the SSPS and a control function, four channels with a two-out-of-four logic are sufficient to provide the required reliability and redundancy.
| |
| The circuit must be able to withstand both an input failure to the control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation.
| |
| Again, a single failure will neither cause nor prevent the protection function actuation.
| |
| These requirements are described in IEEE-279-1971 (Ref. 4). The actual number of channels required for each unit parameter is specified in Reference 1.Two logic channels are required to ensure no single random failure of a logic channel will disable the RTS. The logic channels are designed such that testing required while the reactor is at power may be accomplished without causing a trip. Provisions to allow removing logic channels from service during maintenance are unnecessary because of the logic system's designed reliability.
| |
| McGuire Units 1 and 2 B 3.3.1-3 Revision No. 119 RTS Instrumentation B 3.3.1 BASES BACKGROUND (continued)
| |
| Trip Setpoints and Allowable Values The NOMINAL TRIP SETPOINTS are the nominal values at which the bistables are set. Any bistable is considered to be properly adjusted when the "as left" value is within the band for CHANNEL CALIBRATION tolerance.
| |
| The NOMINAL TRIP SETPOINTS used in the bistables are based on the analytical limits (Ref. 1, 2, and 3). The selection of these NOMINAL TRIP SETPOINTS is such that adequate protection is provided when all sensor and processing time delays, calibration tolerances, instrumentation uncertainties, instrument drift, and severe environment errors for those RTS channels that must function in harsh environments as defined by 10 CFR 50.49 (Ref. 5) are taken into account. The actual as-left Setpoint of the bistable assures that the actual trip occurs in time to prevent an analytical limit from being exceeded.The Allowable Value accounts for changes in random measurement errors between COTs. One example of such a change in measurement error is drift during the surveillance interval.
| |
| If the COT demonstrates that the loop trips within the Allowable Value, the loop is OPERABLE.
| |
| A trip within the Allowable Value ensures that the predictions of equipment performance used to develop the NOMINAL TRIP SETPOINT are still valid, and that the equipment will initiate a trip in response to an AOO in time to prevent an analytical limit from being exceeded (and that the consequences of DBAs will be acceptable, providing the unit is operated from within the LCOs at the onset of the AOO or DBA and the equipment functions as designed).
| |
| Note that in the accompanying LCO 3.3.1, the Allowable Values of Table 3.3.1-1 are the LSSS.Each channel of the process control equipment can be tested on line to verify that the signal or setpoint accuracy is within the specified allowance requirements.
| |
| Once a designated channel is taken out of service for testing, a simulated signal is injected in place of the field instrument signal. The process equipment for the channel in test is then tested, verified, and calibrated.
| |
| SRs for the channels are specified in the SRs section.Determination of the NOMINAL TRIP SETPOINTS and Allowable Values listed in Table 3.3.1-1 incorporate all of the known uncertainties applicable for each channel. The magnitudes of these uncertainties are factored into the determination of each NOMINAL TRIP SETPOINT.
| |
| All field sensors and signal processing equipment for these channels are assumed to operate within the allowances of these uncertainty magnitudes.
| |
| McGuire Units 1 and 2 B 3.3.1-4 Revision No. 119 RTS Instrumentation B 3.3.1 BASES BACKGROUND (continued)
| |
| Solid State Protection System The SSPS equipment is used for the decision logic processing of outputs from the signal processing equipment bistables.
| |
| To meet the redundancy requirements, two trains of SSPS, each performing the same functions, are provided.
| |
| If one train is taken out of service for maintenance or test purposes, the second train will provide reactor trip and/or ESF actuation for the unit. If both trains are taken out of service or placed in test, a reactor trip will result. Each train is packaged in its own cabinet for physical and electrical separation to satisfy separation and independence requirements.
| |
| The system has been designed to trip the reactor in the event of a loss of power, directing the unit to a safe shutdown condition.
| |
| The SSPS performs the decision logic for actuating a reactor trip or ESF actuation, generates the electrical output signal that will initiate the required trip or actuation, and provides the status, permissive, and annunciator output signals to the main control room of the unit.The outputs from the process monitoring systems are sensed by the SSPS equipment and combined into logic matrices that represent combinations indicative of various unit upset and accident transients.
| |
| If a logic matrix combination is completed, the system will initiate a reactor trip or send actuation signals via master and slave relays to those components whose aggregate Function best serves to alleviate the condition and restore the unit to a stable condition.
| |
| Examples are given in the Applicable Safety Analyses, LCO, and Applicability sections of this Bases.Reactor Trip Switchgear The RTBs are in the electrical power supply line from the control rod drive motor generator set power supply to the CRDMs. Opening of the RTBs interrupts power to the CRDMs, which allows the shutdown rods and control rods to fall into the core by gravity. Each RTB is equipped with a bypass breaker to allow testing of the RTB while the unit is at power.During normal operation the output from the SSPS is a voltage signal that energizes the undervoltage coils in the RTBs and bypass breakers, if in use. When the required logic matrix combination is completed, the SSPS output voltage signal is removed, the undervoltage coils are de-energized, the breaker trip lever is actuated by a compressed spring that is released by de-energizing the undervoltage coil, and the RTBs and bypass breakers are tripped open. This allows the shutdown rods and control rods to fall into the core. In addition to the de-energization of the McGuire Units 1 and 2 B 3.3.1-5 Revision No. 119 RTS Instrumentation B 3.3.1 BASES BACKGROUND (continuedl) undervoltage coils, each breaker is also equipped with a shunt trip device that is energized to trip the breaker open upon receipt of a reactor trip signal from the SSPS. Either the undervoltage coil or the shunt trip mechanism is sufficient by itself, thus providing a diverse trip mechanism.
| |
| The decision logic matrix Functions are described in the functional diagrams included in Reference
| |
| : 1. In addition to the reactor trip or ESF, these diagrams also describe the various "permissive interlocks" that are associated with unit conditions.
| |
| Each train has a built in testing device that can test the decision logic matrix Functions and the actuation devices while the unit is at power. When any one train is taken out of service for testing, the other train is capable of providing unit monitoring and protection until the testing has been completed.
| |
| The testing device is semiautomatic to minimize testing time.APPLICABLE The RTS functions to maintain the SLs during all AOOs and mitigates SAFETY ANALYSES, the consequences of DBAs in all MODES in which the RTBs are closed.LCO, and APPLICABILITY Each of the analyzed accidents and transients can be detected by one or more RTS Functions.
| |
| The accident analysis described in Reference 3 takes credit for most RTS trip Functions.
| |
| RTS trip Functions not specifically credited in the accident analysis are qualitatively credited in the safety analysis and the NRC staff approved licensing basis for the unit. These RTS trip Functions may provide protection for conditions that do not require dynamic transient analysis to demonstrate Function performance.
| |
| They may also serve as backups to RTS trip Functions that were credited in the accident analysis.The LCO requires all instrumentation performing an RTS Function, listed in Table 3.3.1-1 in the accompanying LCO, to be OPERABLE.
| |
| Failure of any instrument renders the affected channel(s) inoperable and reduces the reliability of the affected Functions.
| |
| The LCO generally requires OPERABILITY of three or four channels in each instrumentation Function, two channels of Manual Reactor Trip in each logic Function, and two trains in each Automatic Trip Logic Function.Four OPERABLE instrumentation channels in a two-out-of-four configuration are required when one RTS channel is also used as a control system input. This configuration accounts for the possibility of the shared channel failing in such a manner that it creates a transient that requires RTS action. In this case, the RTS will still provide protection, McGuire Units 1 and 2 B 3.3.1-6 Revision No. 119 -
| |
| RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) even with random failure of one of the other three protection channels.Three operable instrumentation channels in a two-out-of-three configuration are generally required when there is no potential for control system and protection system interaction that could simultaneously create a need for RTS trip and disable one RTS channel. The two-out-of-three and two-out-of-four configurations allow one channel to be tripped during maintenance or testing without causing a reactor trip. Specific exceptions to the above general philosophy exist and are discussed below.Reactor Trip System Functions The safety analyses and OPERABILITY requirements applicable to each RTS Function are discussed below: 1 Manual Reactor Trip The Manual Reactor Trip ensures that the control room operator can initiate a reactor trip at any time by using either of two reactor trip switches in the control room. A Manual Reactor Trip accomplishes the same results as any one of the automatic trip Functions.
| |
| It may be used by the reactor operator to shut down the reactor whenever any parameter is rapidly trending toward its Trip Setpoint.The LCO requires two Manual Reactor Trip channels to be OPERABLE.
| |
| Each channel is controlled by a manual reactor trip switch. Each channel actuates one or more reactor trip breakers in both trains. Two independent channels are required to be OPERABLE so that no single random failure will disable the Manual Reactor Trip Function.In MODE 1 or 2, manual initiation of a reactor trip must be OPERABLE.
| |
| These are the MODES in which the shutdown rods and/or control rods are partially or fully withdrawn from the core. In MODE 3, 4, or 5, the manual initiation Function must also be OPERABLE if the shutdown rods or control rods are withdrawn or the Control Rod Drive (CRD) System is capable of withdrawing the shutdown rods or the control rods. In this condition, inadvertent control rod withdrawal is possible.
| |
| In MODE 3, 4, or 5, manual initiation of a reactor trip does not have to be OPERABLE if the CRD System is not capable of withdrawing the shutdown rods or control rods. If the rods cannot be withdrawn from the core, there McGuire Units 1 and 2 B 3.3.1-7 Revision No. 119 RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) is no need to be able to trip the reactor because all of the rods are inserted.
| |
| In MODE 6, the CRDMs are disconnected from the control rods and shutdown rods. Therefore, the manual initiation Function is not required.2. Power Range Neutron Flux The NIS power range detectors are located external to the reactor vessel and measure neutrons leaking from the core. The NIS power range detectors provide input to the Rod Control System and the Steam Generator (SG) Water Level Control System. Therefore, the actuation logic must be able to withstand an input failure to the control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation.
| |
| Note that this Function also provides a signal to prevent automatic and manual rod withdrawal prior to initiating a reactor trip. Limiting further rod withdrawal may terminate the transient and eliminate the need to trip the reactor.a. Power Range Neutron Flux-High The Power Range Neutron Flux-High trip Function ensures that protection is provided, from all power levels, against a positive reactivity excursion leading to DNB during power operations.
| |
| These can be caused by rod withdrawal or reductions in RCS temperature.
| |
| The LCO requires all four of the Power Range Neutron Flux-High channels to be OPERABLE.In MODE 1 or 2, when a positive reactivity excursion could occur, the Power Range Neutron Flux-High trip must be OPERABLE.
| |
| This Function will terminate the reactivity excursion and shut down the reactor prior to reaching a power level that could damage the fuel. In MODE 3, 4, 5, or 6, the NIS power range detectors cannot detect neutron levels in this range. In these MODES, the Power Range Neutron Flux-High does not have to be OPERABLE because the reactor is shut down and reactivity excursions into the power range are extremely unlikely.
| |
| Other RTS Functions and administrative controls provide protection against reactivity additions when in MODE 3, 4, 5, or 6.McGuire Units 1 and 2 B 3.3.1-8 Revision No. 119 RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO and APPLICABILITY (continued)
| |
| : b. Power Range Neutron Flux-Low The LCO requirement for the Power Range Neutron Flux-Low trip Function ensures that protection is provided against a positive reactivity excursion from low power or subcritical conditions.
| |
| The LCO requires all four of the Power Range Neutron Flux-Low channels to be OPERABLE.In MODE 1, below the Power Range Neutron Flux (P-10 setpoint), and in MODE 2, the Power Range Neutron Flux-Low trip must be OPERABLE.
| |
| This Function may be manually blocked by the operator when two out of four power range channels are greater than approximately 10% RTP (P-10 setpoint).
| |
| This Function is automatically unblocked when three out of four power range channels are below the P-10 setpoint.
| |
| Above the P-10 setpoint, positive reactivity additions are mitigated by the Power Range Neutron Flux-High trip Function.In MODE 3, 4, 5, or 6, the Power Range Neutron Flux-Low trip Function does not have to be OPERABLE because the reactor is shut down and the NIS power range detectors cannot detect neutron levels in this range. Other RTS trip Functions and administrative controls provide protection against positive reactivity additions or power excursions in MODE 3, 4, 5, or 6.3. Power Range Neutron Flux-High Positive Rate The Power Range Neutron Flux -High Positive Rate trip uses the same channels as discussed for Function 2 above.The Power Range Neutron Flux-High Positive Rate trip Function ensures that protection is provided against rapid increases in neutron flux that are characteristic of an RCCA drive rod housing rupture and the accompanying ejection of the RCCA. This Function complements the Power Range Neutron Flux-High and Low Setpoint trip Functions to ensure that the criteria are met for a rod ejection from the power range.° The LCO requires all four of the Power Range Neutron Flux-High Positive Rate channels to be OPERABLE.McGuire Units 1 and 2 B 3.3.1-9 Revision No. 119 RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| In MODE 1 or 2, when there is a potential to add a large amount of positive reactivity from a rod ejection accident (REA), the Power Range Neutron Flux-High Positive Rate trip must be OPERABLE.In MODE 3, 4, 5, or 6, the Power Range Neutron Flux--High Positive Rate trip Function does not have to be OPERABLE because other RTS trip Functions and administrative controls will provide protection against positive reactivity additions.
| |
| In MODE 6, no rods are withdrawn and the SDM is increased during refueling operations.
| |
| The reactor vessel head is also removed or the closure bolts are detensioned preventing any pressure buildup. In addition, the NIS power range detectors cannot detect neutron levels present in this mode.4A. Intermediate Range Neutron Flux (Westinghouse-supplied Instrumentation)
| |
| The Westinghouse-supplied Intermediate Range excore detector systems (utilizing compensated ion chamber detectors) are being replaced with Thermo Scientific-supplied 300i neutron flux monitoring systems (utilizing fission chamber detectors).
| |
| This section of the Bases applies to the Westinghouse-supplied instrumentation.
| |
| The next section of the Bases applies to the Thermo Scientific-supplied instrumentation.
| |
| The Intermediate Range Neutron Flux trip Function ensures that protection is provided against an uncontrolled RCCA bank rod withdrawal accident from a subcritical condition during startup. This trip Function provides redundant protection to the Power Range Neutron Flux-Low Setpoint trip Function.
| |
| The NIS intermediate range detectors are located external to the reactor vessel and measure neutrons leaking from the core. Note that this Function also provides a signal to prevent automatic and manual rod withdrawal prior to initiating a reactor trip. Limiting further rod withdrawal may terminate the transient and eliminate the need to trip the reactor.The LCO requires two channels of Intermediate Range Neutron Flux to be OPERABLE.
| |
| Two OPERABLE channels are sufficient to ensure no single random failure will disable this trip Function.Because this trip Function is important only during startup, there is generally no need to disable channels for testing while the Function is required to be OPERABLE.
| |
| Therefore, a third channel is unnecessary.
| |
| McGuire Units 1 and 2 8 3.3.1-10 Revision No. 119 RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| In MODE 1 below the P-10 setpoint, and in MODE 2, when there is a potential for an uncontrolled RCCA bank rod withdrawal accident during reactor startup, the Intermediate Range Neutron Flux trip must be OPERABLE.
| |
| Above the P-10 setpoint, the Power Range Neutron Flux-High Setpoint trip and the Power Range Neutron Flux-High Positive Rate trip provide core protection for a rod withdrawal accident.
| |
| In MODE 3, 4, or 5, the Intermediate Range Neutron Flux trip does not have to be OPERABLE because other RTS trip functions provide protection against positive reactivity additions.
| |
| The reactor cannot be started up in this condition.
| |
| The core also has the required SDM to mitigate the consequences of a positive reactivity addition accident.
| |
| In MODE 6, all rods are fully inserted and the core has a required increased SDM. Also, the NIS intermediate range detectors cannot detect neutron levels present in this MODE.4B. Intermediate Range Neutron Flux (Thermo Scientific-supplied Instrumentation)
| |
| The Westinghouse-supplied Intermediate Range excore detector systems (utilizing compensated ion chamber detectors) are being replaced with Thermo Scientific-supplied 300i neutron flux monitoring systems (utilizing fission chamber detectors).
| |
| This section of the Bases applies to the Thermo Scientific-supplied instrumentation.
| |
| The previous section of the Bases applies to the Westinghouse-supplied instrumentation.
| |
| The Intermediate Range Neutron Flux trip Function ensures that protection is provided against an uncontrolled RCCA bank rod withdrawal accident from a subcritical condition during startup. This trip Function provides redundant protection to the Power Range Neutron Flux-Low Setpoint trip Function.
| |
| The NIS intermediate range detectors are located external to the reactor vessel and measure neutrons leaking from the core. Note that this Function also provides a signal to prevent automatic and manual rod withdrawal prior to initiating a reactor trip. Limiting further rod withdrawal may terminate the transient and eliminate the need to trip the reactor.The LCO requires two channels of Intermediate Range Neutron Flux to be OPERABLE.
| |
| Two OPERABLE channels are sufficient to ensure no single random failure will disable this trip Function.Because this trip Function is important only during startup, there is generally no need to disable channels for testing while the Function McGuire Units I and 2 B 3.3.1-11 Revision No. 119 RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) is required to be OPERABLE.
| |
| Therefore, a third channel is unnecessary.
| |
| In MODE 1 below the P-1 0 setpoint, and in MODE 2, when there is a potential for an uncontrolled RCCA bank rod withdrawal accident during reactor startup, the Intermediate Range Neutron Flux trip must be OPERABLE.
| |
| Above the P-10 setpoint, the Power Range Neutron Flux-High Setpoint trip and the Power Range Neutron Flux-High Positive Rate trip provide core protection for a rod withdrawal accident.
| |
| In MODE 3, 4, or 5, the Intermediate Range Neutron Flux trip does not have to be OPERABLE because other RTS trip functions provide protection against positive reactivity additions.
| |
| The reactor cannot be started up in this condition.
| |
| The core also has the required SDM to mitigate the consequences of a positive reactivity addition accident.
| |
| In MODE 6, all rods are fully inserted and the core has a required increased SDM.5A. Source Range Neutron Flux (Westinghouse-supplied Instrumentation)
| |
| The Westinghouse-supplied Source Range excore detector systems (utilizing boron triflouride detectors) are being replaced with Thermo Scientific-supplied 300i neutron flux monitoring systems (utilizing fission chamber detectors).
| |
| This section of the Bases applies to the Westinghouse-supplied instrumentation.
| |
| The next section of the Bases applies to the Thermo Scientific-supplied instrumentation.
| |
| The LCO requirement for the Source Range Neutron Flux trip Function ensures that protection is provided against an uncontrolled RCCA bank rod withdrawal accident from a subcritical condition during startup. This trip Function provides redundant protection to the Power Range Neutron Flux-Low Setpoint and Intermediate Range Neutron Flux trip Functions.
| |
| In MODES 3, 4, and 5, administrative controls also prevent the uncontrolled withdrawal of rods. The NIS source range detectors are located external to the reactor vessel and measure neutrons leaking from the core. The NIS source range detectors do not provide any inputs to control systems. The source range trip is the only RTS automatic protection function required in MODES 3, 4, and 5 with the CRD System capable of rod withdrawal.
| |
| Therefore, the functional capability at the specified Trip Setpoint is assumed to be available.
| |
| McGuire Units 1 and 2 B 3.3.1-12 Revision No. 119 RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| The LCO requires two channels of Source Range.Neutron Flux to be OPERABLE.
| |
| Two OPERABLE channels are sufficient to ensure no single random failure will disable this trip Function.
| |
| The LCO also requires one channel of the Source Range Neutron Flux to be OPERABLE in MODE 3, 4, or 5 with RTBs open. In this case, the source range Function is to provide control room indication.
| |
| The outputs of the Function to RTS logic are not required OPERABLE when the RTBs are open.The Source Range Neutron Flux Function provides protection for control rod withdrawal from subcritical, boron dilution, and control rod ejection events. The Function also provides visual neutron flux indication in the control room.In MODE 2 when below the P-6 setpoint during a reactor startup, the Source Range Neutron Flux trip must be OPERABLE.
| |
| Above the P-6 setpoint, the Intermediate Range Neutron Flux trip and the Power Range Neutron Flux-Low Setpoint trip will provide core protection for reactivity accidents.
| |
| Above the P-6 setpoint, the NIS source range detectors are de-energized and inoperable.
| |
| In MODE 3, 4, or 5 with the reactor shut down, the Source Range Neutron Flux trip Function must also be OPERABLE.
| |
| If the CRD System is capable of rod withdrawal, the Source Range Neutron Flux trip must be OPERABLE to provide core protection against a rod withdrawal accident.
| |
| If the unit is to be in MODE 3 with the RTBs closed for > 4 hours the Surveillance requirement SR 3.3.1.7 must be completed within 4 hours after entry into MODE 3. The surveillance shall include verification of the high flux at shutdown alarm setpoint of less than or equal to five times background of the average CPS Neutron Level Reading (the average CPS Reading is the most consistent value between highest and lowest CPS Neutron Level Reading).If the CRD System is not capable of rod withdrawal, the source range detectors are not required to trip the reactor. However, their monitoring Function must be OPERABLE to monitor core neutron levels and provide indication of reactivity changes that may occur as a result of events like a boron dilution.The neutron detector's high flux at shutdown alarm setpoint of less than or equal to five times background, in Mode 3, 4, or 5, shall be verified.
| |
| Once the High Flux at Shutdown Alarm setpoints are set at five times background above steady state neutron count rate the re-verification/re-adjustment of the high flux at shutdown is not required.
| |
| The neutron count rate will decrease as Mode changes McGuire Units 1 and 2 B 3.3.1-13 Revision No. 119 RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) are made from 3 to 4 to 5 as the system temperature decreases.
| |
| Any subsequent changes in the count rate are an indication of gamma flux (due to movement of irradiated particles in the system)which may cause the source range response to vary. Upon increase in the neutron count rate due to activities that add positive reactivity to the core, the presence of gamma flux will cease to be a factor in detector count rate.A CHANNEL CHECK provides a comparison of the parameter indicated on one channel to a similar parameter on other channels.This is based on the assumption that the two indicating channels should be consistent.
| |
| Significant differences between the indicating source range channels can occur due to core geometry, decreasing neutron count rate as temperature is decreasing in the system, the location of the Source Assemblies (distance from the Source Detectors), and large amounts of gamma. Each channel should be consistent with its local condition.
| |
| The requirements for the NIS source range detectors in MODE 6 are addressed in LCO 3.9.3, "Nuclear Instrumentation." 5B. Source Range Neutron Flux (Thermo Scientific-supplied Instrumentation)
| |
| The Westinghouse-supplied Source Range excore detector systems (utilizing boron triflouride detectors) are being replaced with Thermo Scientific-supplied 300i neutron flux monitoring systems (utilizing fission chamber detectors).
| |
| This section of the Bases applies to the Thermo Scientific-supplied instrumentation.
| |
| The previous section of the Bases applies to the Westinghouse-supplied instrumentation.
| |
| The LCO requirement for the Source Range Neutron Flux trip Function ensures that protection is provided against an uncontrolled RCCA bank rod withdrawal accident from a subcritical condition during startup. This trip Function provides redundant protection to the Power Range Neutron Flux-Low Setpoint and Intermediate Range Neutron Flux trip Functions.
| |
| In MODES 3, 4, and 5, administrative controls also prevent the uncontrolled withdrawal of rods. The NIS source range detectors are located external to the reactor vessel and measure neutrons leaking from the core. The NIS source range detectors do not provide any inputs to control systems. The source range trip is the only RTS automatic protection function required in MODES 3, 4, and 5 with the CRD System capable of rod withdrawal.
| |
| Therefore, the McGuire Units 1 and 2 B 3.3.1-14 Revision No. 119 RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) functional capability at the specified Trip Setpoint is assumed to be available.
| |
| The LCO requires two channels of Source Range Neutron Flux to be OPERABLE.
| |
| Two OPERABLE channels are sufficient to ensure no single random failure will disable this trip Function.
| |
| The LCO also requires one channel of the Source Range Neutron Flux to be OPERABLE in MODE 3, 4, or 5 with RTBs open. In this case, the source range Function is to provide control room indication.
| |
| The outputs of the Function to RTS logic are not required OPERABLE when the RTBs are open.The Source Range Neutron Flux-Function provides protection for control rod withdrawal from subcritical, boron dilution, and control rod ejection events. The Function also provides visual neutron flux indication in the control room.In MODE 2 when below the P-6 setpoint during a reactor startup, the Source Range Neutron Flux trip must be OPERABLE.
| |
| Above the P-6 setpoint, the Intermediate Range Neutron Flux trip and the Power Range Neutron Flux-Low Setpoint trip will provide core protection for reactivity accidents.
| |
| Above the P-6 setpoint, the Source Range Neutron Flux trip is blocked.In MODE 3, 4, or 5 with the reactor shut down, the Source Range Neutron Flux trip Function must also be OPERABLE.
| |
| If the CRD System is capable of rod withdrawal, the Source Range Neutron Flux trip must be OPERABLE to provide core protection against a rod withdrawal accident.
| |
| If the unit is to be in MODE 3 with the RTBs closed for > 4 hours the Surveillance requirement SR 3.3.1.7 must be completed within 4 hours after entry into MODE 3.If the CRD System is not capable of rod withdrawal, the source range detectors are not required to trip the reactor. However, their monitoring Function must be OPERABLE to monitor core neutron levels and provide indication of reactivity changes that may occur as a result of events like a boron dilution.A CHANNEL CHECK provides a comparison of the parameter indicated on one channel to a similar parameter on other channels.This is based on the assumption that the two indicating channels should be consistent.
| |
| Significant differences between the indicating source range channels can occur due to core geometry, decreasing neutron count rate as temperature is decreasing in the system, the location of the Source Assemblies (distance from the Source McGuire Units 1 and 2 B 3.3.1-15 Revision No. 119 RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| Detectors), and large amounts of gamma. Each channel should be consistent with its local condition.
| |
| The requirements for the NIS source range detectors in MODE 6 are addressed in LCO 3.9.3, "Nuclear Instrumentation." 6. Overtemperature AT The Overtemperature AT trip Function is provided to ensure that the design limit DNBR is met. This trip Function also limits the range over which the Overpower AT trip Function must provide protection.
| |
| The inputs to the Overtemperature AT trip include pressurizer pressure, coolant temperature, axial power distribution, and reactor power as indicated by loop AT assuming full reactor coolant flow. Protection from violating the DNBR limit is assured for those transients that are slow with respect to delays from the core to the measurement system. The Function monitors both variation in power and flow since a decrease in flow has the same effect on AT as a power increase.
| |
| The Overtemperature AT trip Function uses each loop's AT as a measure of reactor power and is compared with a setpoint that is automatically varied with the following parameters:
| |
| reactor coolant average temperature-the Trip Setpoint is varied to crorrect for changes in coolant density and specific heat capacity with changes in coolant temperature; pressurizer pressure-the Trip Setpoint is varied to correct for changes in system pressure; and axial power distribution-f(AI), the Trip Setpoint is varied to account for imbalances in the axial power distribution as detected by the NIS upper and lower power range detectors.
| |
| If axial peaks are greater than the design limit, as indicated by the difference between the upper and lower NIS power range detectors, the Trip Setpoint is reduced in accordance with Note 1 of Table 3.3.1-1.Dynamic compensation is included for system piping delays from the core to the temperature measurement system.The Overtemperature AT trip Function is calculated for each loop as described in Note 1 of Table 3.3.1-1. Trip occurs if Overtemperature AT is indicated in two loops. The pressure and temperature signals are used for other control functions, therefore, the actuation logic must be able to withstand an input failure to the McGuire Units 1 and 2 B83.3.1-16 Revision No. 119 RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation.
| |
| Note that this Function also provides a signal to generate a turbine runback prior to reaching the Trip Setpoint.
| |
| A turbine runback will reduce turbine power and reactor power. A reduction in power will normally alleviate the Overtemperature AT condition and may prevent a reactor trip.The LCO requires all four channels of the Overtemperature AT trip Function to be OPERABLE.
| |
| Note that the Overtemperature AT Function receives input from channels shared with other RTS Functions.
| |
| Failures that affect multiple Functions require entry into the Conditions applicable to all affected Functions.
| |
| In MODE 1 or 2, the Overtemperature AT trip must be OPERABLE to prevent DNB. In MODE 3, 4, 5, or 6, this trip Function does not have to be OPERABLE because the reactor is not operating and there is insufficient heat production to be concerned about DNB.7. Overpower AT The Overpower AT trip Function ensures that protection is provided to ensure the integrity of the fuel (i.e., no fuel pellet melting and less than 1% cladding strain) under all possible overpower conditions.
| |
| This trip Function also limits the required range of the Overtemperature AT trip Function and provides a backup to the Power Range Neutron Flux-High Setpoint trip. The Overpower AT trip Function ensures that the allowable heat generation rate (kW/ft)of the fuel is not exceeded.
| |
| It uses the AT of each loop as a measure of reactor power with a setpoint that is automatically varied with the following parameters:
| |
| * reactor coolant average temperature-the Trip Setpoint is varied to correct for changes in coolant density and specific heat capacity with changes in coolant temperature; and* rate of change of reactor coolant average temperature-including dynamic compensation for the delays between the core and the temperature measurement system.The Overpower AT trip Function is calculated for each loop as per Note 2 of Table 3.3.1-1. Trip occurs if Overpower AT is indicated in two loops. The temperature signals are used for other control functions, therefore, the actuation logic must be able to withstand an input failure to the control system, which may then require the McGuire Units 1 and 2 B 3.3.1-17 Revision No. 119 RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) protection function actuation, and a single failure in the remaining channels providing the protection function actuation.
| |
| Note that this Function also provides a signal to generate a turbine runback prior to reaching the Trip Setpoint.
| |
| A turbine runback will reduce turbine power and reactor power. A reduction in power will normally alleviate the Overpower AT condition and may prevent a reactor trip.The LCO requires four channels of the Overpower AT trip Function to be OPERABLE.
| |
| Note that the Overpower AT trip Function receives input from channels shared with other RTS Functions.
| |
| Failures that affect multiple Functions require entry into the Conditions applicable to all affected Functions.
| |
| In MODE 1 or 2, the Overpower AT trip Function must be OPERABLE.
| |
| These are the only times that enough heat is generated in the fuel to be concerned about the heat generation rates and overheating of the fuel. In MODE 3, 4, 5, or 6, this trip Function does not have to be OPERABLE because the reactor is not operating and there is insufficient heat production to be concerned about fuel overheating and fuel damage.8. Pressurizer Pressure The same sensors provide input to the Pressurizer Pressure-High and -Low trips and the Overtemperature AT trip. The Pressurizer Pressure channels are also used to provide input to the Pressurizer Pressure Control System, therefore, the actuation logic must be able to withstand an input failure to the control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation.
| |
| McGuire Units 1 and 2 B 3.3.1-18 Revision No. 119 RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| : a. Pressurizer Pressure-Low The Pressurizer Pressure-Low trip Function ensures that protection is provided against violating the DNBR limit due to low pressure.The LCO requires four channels of Pressurizer Pressure-Low to be OPERABLE.In MODE 1, when DNB is a major concern, the Pressurizer Pressure-Low trip must be OPERABLE.
| |
| This trip Function is automatically enabled on increasing power by the P-7 interlock (NIS power range P-10 or turbine impulse pressure greater than approximately 10% of full power equivalent (P-13)). On decreasing power, this trip Function is automatically blocked below P-7. Below the P-7 setpoint, power distributions that would cause DNB concerns are unlikely.b. Pressurizer Pressure-High The Pressurizer Pressure-High trip Function ensures that protection is provided against overpressurizing the RCS.This trip Function operates in conjunction with the pressurizer relief and safety valves to prevent RCS overpressure conditions.
| |
| The LCO requires four channels of the Pressurizer Pressure-High to be OPERABLE.The Pressurizer Pressure-High LSSS is selected to be below the pressurizer safety valve actuation pressure and above the power operated relief valve (PORV) setting. This setting minimizes challenges to safety valves while avoiding unnecessary reactor trips for those pressure increases that can be controlled by the PORVs.In MODE 1 or 2, the Pressurizer Pressure-High trip must be OPERABLE to help prevent RCS overpressurization and minimize challenges to the safety valves. In MODE 3, 4, 5, or 6, the Pressurizer Pressure-High trip Function does not have to be OPERABLE because transients that could cause an overpressure condition will be slow to occur. Therefore, the operator will have sufficient time to evaluate unit McGuire Units 1 and 2 B 3.3.1-19 Revision No. 119 RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) conditions and take corrective actions. Additionally, low temperature overpressure protection systems provide overpressure protection when below MODE 4.9. Pressurizer Water Level-High The Pressurizer Water Level-High trip Function provides a backup signal for the Pressurizer Pressure-High trip and also provides protection against water relief through the pressurizer safety valves.These valves are designed to pass steam in order to achieve their design energy removal rate. A reactor trip is actuated prior to the pressurizer becoming water solid. The setpoints are based on percent of instrument span. The LCO requires three channels of Pressurizer Water Level-High to be OPERABLE.
| |
| The pressurizer level channels are used as input to the Pressurizer Level Control System. A fourth channel is not required to address control/protection interaction concerns.
| |
| The level channels do not actuate the safety valves, and the high pressure reactor trip is set below the safety valve setting. Therefore, with the slow rate of charging available, pressure overshoot due to level channel failure cannot cause the safety valve to lift before reactor high pressure trip.In MODE 1, when there is a potential for overfilling the pressurizer, the Pressurizer Water Level-High trip must be OPERABLE.
| |
| This trip Function is automatically enabled on increasing power by the P-7 interlock.
| |
| On decreasing power, this trip Function is automatically blocked below P-7. Below the P-7 setpoint, transients that could raise the pressurizer water level will be slow and the operator will have sufficient time to evaluate unit conditions and take corrective actions.10. Reactor Coolant Flow-Low a. Reactor Coolant Flow-Low (Single Loop)The Reactor Coolant Flow-Low (Single Loop) trip Function ensures that protection is provided against violating the DNBR limit due to low flow in one or more RCS loops, while avoiding reactor trips due to normal variations in loop flow.Above the P-8 setpoint, which is approximately 48% RTP, a loss of flow in any RCS loop will actuate a reactor trip. The setpoints are based on the minimum flow specified in the McGuire Units 1 and 2 B 3.3.1-20 Revision No. 119 RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| COLR. Each RCS loop has three flow detectors to monitor flow. The flow signals are not used for any control system input.The LCO requires three Reactor Coolant Flow-Low channels per loop to be OPERABLE in MODE 1 above P-8.In MODE 1 above the P-8 setpoint, a loss of flow in one RCS loop could result in DNB conditions in the core. In MODE 1 below the P-8 setpoint, a loss of flow in two or more loops is required to actuate a reactor trip (Function 10.b) because of the lower power level and the greater margin to the design limit DNBR.b. Reactor Coolant Flow-Low (Two Loops)The Reactor Coolant Flow-Low (Two Loops) trip Function ensures that protection is provided against violating the DNBR limit due to low flow in two or more RCS loops while avoiding reactor trips due to normal variations in loop flow.Above the P-7 setpoint and below the P-8 setpoint, a loss of flow in two or more loops will initiate a reactor trip. The setpoints are based on the minimum flow specified in the COLR. Each loop has three flow detectors to monitor flow.The flow signals are not used for any control system input.The LCO requires three Reactor Coolant Flow-Low channels per loop to be OPERABLE.In MODE 1 above the P-7 setpoint and below the P-8 setpoint, the Reactor Coolant Flow-Low (Two Loops) trip must be OPERABLE.
| |
| Below the P-7 setpoint, all reactor trips on low flow are automatically blocked since power distributions that would cause a DNB concern at this low power level are unlikely.
| |
| Above the P-7 setpoint, the reactor trip on low flow in two or more RCS loops is automatically enabled. Above the P-8 setpoint, a loss of flow in any one loop will actuate a reactor trip because of the higher power level and the reduced margin to the design limit DNBR.McGuire Units 1 and 2 B 3.3.1-21 Revision No. 119 RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| : 11. Undervoltaqe Reactor Coolant Pumps The Undervoltage RCPs reactor trip Function ensures that protection is provided against violating the DNBR limit due to a loss of flow in two or more RCS loops. The voltage to each RCP is monitored.
| |
| Above the P-7 setpoint, a loss of voltage detected on two or more RCP buses will initiate a reactor trip. This trip Function will generate a reactor trip before the Reactor Coolant Flow-Low (Two Loops) Trip Setpoint is reached. Time delays are incorporated into the Undervoltage RCPs channels to prevent reactor trips due to momentary electrical power transients.
| |
| The LCO requires a total of four Undervoltage RCPs channels (one per bus) to be OPERABLE.In MODE 1 above the P-7 setpoint, the Undervoltage RCP trip must be OPERABLE.
| |
| Below the P-7 setpoint, all reactor trips on loss of flow are automatically blocked since power distributions that would cause a DNB concern at this low power level are unlikely.
| |
| Above the P-7 setpoint, the reactor trip on loss of flow in two or more RCS loops is automatically enabled.12. Underfrequency Reactor Coolant Pumps The Underfrequency RCPs reactor trip Function ensures that protection is provided against violating the DNBR limit due to a loss of flow in two or more RCS loops from a major network frequency disturbance.
| |
| An underfrequency condition will slow down the pumps, thereby reducing their coastdown time following a pump trip. The proper coastdown time is required so that reactor heat can be removed immediately after reactor trip. The frequency of each RCP bus is monitored.
| |
| Above the P-7 setpoint, a loss of frequency detected on two or more RCP buses will initiate a reactor trip. This trip Function will generate a reactor trip before the Reactor Coolant Flow-Low (Two Loops) Trip Setpoint is reached.Time delays are incorporated into the Underfrequency RCPs channels to prevent reactor trips due to momentary electrical power transients.
| |
| The LCO requires a total of four Underfrequency RCPs channels (one per bus) to be OPERABLE.McGuire Units 1 and 2 B 3.3.1-22 Revision No. 119 RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| In MODE 1 above the P-7 setpoint, the Underfrequency RCPs trip must be OPERABLE.
| |
| Below the P-7 setpoint, all reactor trips on loss of flow are automatically blocked since power distributions that would cause a DNB concern at this low power level are unlikely.Above the P-7 setpoint, the reactor trip on loss of flow in two or more RCS loops is automatically enabled.13. Steam Generator Water Level-Low Low The SG Water Level-Low Low trip Function ensures that protection is provided against a loss of heat sink and actuates the AFW System prior to uncovering the SG tubes. The SGs are the heat sink for the reactor. In order to act as a heat sink, the SGs must contain a minimum amount of water. A narrow range low low level in any SG is indicative of a loss of heat sink for the reactor. The level transmitters provide input to the SG Level Control System.Therefore, the actuation logic must be able to withstand an input failure to the control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation.
| |
| This Function also performs the ESFAS function of starting the AFW pumps on low low SG level.The LCO requires four channels of SG Water Level-Low Low per SG to be OPERABLE since these channels are shared between protection and control.In MODE 1 or 2, when the reactor requires a heat sink, the SG Water Level-Low Low trip must be OPERABLE.
| |
| The normal source of water for the SGs is the Main Feedwater (MFW) System (not safety related).
| |
| The MFW System is normally in operation in MODES 1, 2, 3, or 4. The AFW System is the safety related backup source of water to ensure that the SGs remain the heat sink for the reactor. In MODE 3, 4, 5, or 6, the SG Water Level-Low Low Function does not have to be OPERABLE because the reactor is not operating or even critical.
| |
| Decay heat removal is accomplished by the steam generators in MODE 3 and 4 and by the Residual Heat Removal (RHR) System in MODE 4, 5, or 6.McGuire Units 1 and 2 B 3.3.1-23 Revision No. 119 RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| : 14. Turbine Trip a. Turbine Trip-Low Fluid Oil Pressure The Turbine Trip-Low Fluid Oil Pressure trip Function anticipates the loss of heat removal capabilities of the secondary system following a turbine trip. This trip Function acts to minimize the pressure/temperature transient on the reactor. Any turbine trip from a power level below the P-8 setpoint, approximately 48% power, will not actuate a reactor trip. Three pressure switches monitor the control oil pressure in the Turbine Electrohydraulic Control System. A low pressure condition sensed by two-out-of-three pressure switches will actuate a reactor trip. These pressure switches do not provide any input to the control system. The unit is designed to withstand a complete loss of load and not sustain core damage or challenge the RCS pressure limitations.
| |
| Core protection is provided by the Pressurizer Pressure-High trip Function and RCS integrity is ensured by the pressurizer safety valves. Turbine Trip-Low fluid oil pressure is diverse to the Turbine Trip-Turbine Stop Valve Closure Function.The LCO requires three channels of Turbine Trip-Low Fluid Oil Pressure to be OPERABLE in MODE 1 above P-8.Below the P-8 setpoint, a turbine trip does not actuate a reactor trip. In MODE 2, 3, 4, 5, or 6, there is no potential for a turbine trip, and the Turbine Trip-Low Fluid Oil Pressure trip Function does not need to be OPERABLE.b. Turbine Trip-Turbine Stop Valve Closure The Turbine Trip-Turbine Stop Valve Closure trip Function anticipates the loss of heat removal capabilities of the secondary system following a turbine trip from a power level above the P-8 setpoint, approximately 48% power. The trip Function anticipates the loss of secondary heat removal capability that occurs when the stop valves close. Tripping the reactor in anticipation of loss of secondary heat removal acts to minimize the pressure and temperature transient on the reactor. This trip Function will not and is not required to operate in the presence of a single channel failure. The unit is designed to withstand a complete loss of load and not McGuire Units 1 and 2 B 3.3.1-24 Revision No. 119 RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) sustain core damage or challenge the RCS pressure limitations.
| |
| Core protection is provided by the Pressurizer Pressure-High trip Function, and RCS integrity is ensured by the pressurizer safety valves. This trip Function is diverse to the Turbine Trip-Low Fluid Oil Pressure trip Function.Each turbine stop valve is equipped with one limit switch that inputs to the RTS. If all four limit switches indicate that the stop valves are closed, a reactor trip is initiated.
| |
| The LSSS for this Function is set to assure channel trip occurs when the associated stop valve is completely closed.The LCO requires four Turbine Trip-Turbine Stop Valve Closure channels, one per valve, to be OPERABLE in MODE 1 above P-8. All four channels must trip to cause reactor trip.Below the P-8 setpoint, a load rejection can be accommodated by the Steam Dump System. In MODE 2, 3, 4, 5, or 6, there is no potential for a load rejection, and the Turbine Trip-Stop Valve Closure trip Function does not need to be OPERABLE.15. Safety Iniection Input from Engineered Safety Feature Actuation System The SI Input from ESFAS ensures that if a reactor trip has not already been generated by the RTS, the ESFAS automatic actuation logic will initiate a reactor trip upon any signal that initiates SI. This is a condition of acceptability for the LOCA.However, other transients and accidents take credit for varying levels of ESF performance and rely upon rod insertion, except for the most reactive rod that is assumed to be fully withdrawn, to ensure reactor shutdown.
| |
| Therefore, a reactor trip is initiated every time an SI signal is present.Trip Setpoint and Allowable Values are not applicable to this Function.
| |
| The SI Input is provided by a manual switch or by the automatic actuation logic. Therefore, there is no measurement signal with which to associate an LSSS.The LCO requires two trains of SI Input from ESFAS to be OPERABLE in MODE 1 or 2.McGuire Units 1 and 2 B 3.3.1-25 Revision No. 119 RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| A reactor trip is initiated every time an SI signal is present.Therefore, this trip Function must be OPERABLE in MODE 1 or 2, when the reactor is critical, and must be shut down in the event of an accident.
| |
| In MODE 3, 4, 5, or 6, the reactor is not critical, and this trip Function does not need to be OPERABLE.16. Reactor Trip System Interlocks Reactor protection interlocks are provided to ensure reactor trips are in the correct configuration for the current unit status. They back up operator actions to ensure protection system Functions are not bypassed during unit conditions under which the safety analysis assumes the Functions are not bypassed.
| |
| Therefore, the interlock Functions do not need to be OPERABLE when the associated reactor trip functions are outside the applicable MODES. These are: al. Intermediate Range Neutron Flux, P-6 (Westinghouse-supplied Instrumentation)
| |
| The Westinghouse-supplied Intermediate Range excore detector systems (utilizing compensated ion chamber detectors) are being replaced with Thermo Scientific-supplied 300i neutron flux monitoring systems (utilizing fission chamber detectors).
| |
| This section of the Bases applies to the Westinghouse-supplied instrumentation.
| |
| The next section of the Bases applies to the Thermo Scientific-supplied instrumentation.
| |
| The Intermediate Range Neutron Flux, P-6 interlock is actuated when any NIS intermediate range channel goes approximately one decade above the minimum channel reading. If both channels drop below the setpoint, the permissive will automatically be defeated.
| |
| The LCO requirement for the P-6 interlock ensures that the following Functions are performed:
| |
| on increasing power, the P-6 interlock allows the manual block of the NIS Source Range, Neutron Flux reactor trip. This prevents a premature block of the source range trip and allows the operator to ensure that the intermediate range is OPERABLE prior to leaving the source range. When the source range trip is blocked, the high voltage to the detectors is also removed; and McGuire Units 1 and 2 B 3.3.1-26 Revision No. 119 RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) on decreasing power, the P-6 interlock automatically energizes the NIS source range detectors and enables the NIS Source Range Neutron Flux reactor trip.The LCO requires two channels of Intermediate Range Neutron Flux, P-6 interlock to be OPERABLE in MODE 2 when below the P-6 interlock setpoint.Above the P-6 interlock setpoint, the NIS Source Range Neutron Flux reactor trip will be blocked, and this Function will no longer be necessary.
| |
| In MODE 3, 4, 5, or 6, the P-6 interlock does not have to be OPERABLE because the NIS Source Range is providing core protection.
| |
| a2. Intermediate Range Neutron Flux, P-6 (Thermo Scientific-supplied Instrumentation)
| |
| The Westinghouse-supplied Intermediate Range excore detector systems (utilizing compensated ion chamber detectors) are being replaced with Thermo Scientific-supplied 300i neutron flux monitoring systems (utilizing fission chamber detectors).
| |
| This section of the Bases applies to the Thermo Scientific-supplied instrumentation.
| |
| The previous section of the Bases applies to the Westinghouse-supplied instrumentation.
| |
| The Intermediate Range Neutron Flux, P-6 interlock is actuated when any NIS intermediate range channel goes approximately three decades above the minimum channel reading. If both channels drop below the setpoint, the permissive will automatically be defeated.
| |
| The LCO requirement for the P-6 interlock ensures that the following Functions are performed:
| |
| McGuire Units I and 2 B 3.3.1-27 Revision No. 119 RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 0 on increasing power, the P-6 interlock allows the manual block of the NIS Source Range, Neutron Flux reactor trip.This prevents a premature block of the source range trip and allows the operator to ensure that the intermediate range is OPERABLE prior to leaving the source range;and* on decreasing power, the P-6 interlock automatically enables the NIS Source Range Neutron Flux reactor trip.The LCO requires two channels of Intermediate Range Neutron Flux, P-6 interlock to be OPERABLE in MODE 2 when below the P-6 interlock setpoint.Above the P-6 interlock setpoint, the NIS Source Range Neutron Flux reactor trip will be blocked, and this Function will no longer be necessary.
| |
| In MODE 3, 4, 5, or 6, the P-6 interlock does not have to be OPERABLE because the NIS Source Range is providing core protection.
| |
| : b. Low Power Reactor Trips Block, P-7 The Low Power Reactor Trips Block, P-7 interlock is actuated by input from either the. Power Range Neutron Flux, P-1 0, or the Turbine Impulse Pressure, P-13 interlock.
| |
| The LCO requirement for the P-7 interlock ensures that the following Functions are performed:
| |
| (1) on increasing power, the P-7 interlock automatically enables reactor trips on the following Functions:
| |
| 0 Pressurizer Pressure-Low;
| |
| * Pressurizer Water Level-High; 4 Reactor Coolant Flow-Low (Two Loops);* Undervoltage RCPs; and* Underfrequency RCPs.McGuire Units 1 and 2 B 3.3.1-28 Revision No. 119 RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| These reactor trips are only required when operating above the P-7 setpoint (approximately 10% power).The reactor trips provide protection against violating the DNBR limit. Below the P-7 setpoint, the RCS is capable of providing sufficient natural circulation without any RCP running.(2) on decreasing power, the P-7 interlock automatically blocks reactor trips on the following Functions:
| |
| * Pressurizer Pressure-Low; Pressurizer Water Level-High; Reactor Coolant Flow-Low (Two Loops);Undervoltage RCPs; and Underfrequency RCPs.Trip Setpoint and Allowable Value are not applicable to the P-7 interlock because it is a logic Function and thus has no parameter with which to associate an LSSS.The P-7 interlock is a logic Function with train and not channel identity.
| |
| Therefore, the LCO requires one channel per train of Low Power Reactor Trips Block, P-7 interlock to be OPERABLE in MODE 1.The low power trips are blocked below the P-7 setpoint and unblocked above the P-7 setpoint.
| |
| In MODE 2, 3, 4, 5, or 6, this Function does not have to be OPERABLE because the interlock performs its Function when power level drops below 10% power, which is in MODE 1.McGuire Units 1 and 2 B 3.3.1-29 Revision No. 119 RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| : c. Power Rangqe Neutron Flux, P-8 The Power Range Neutron Flux, P-8 interlock is actuated at approximately 48% power as determined by two-out-of-four NIS power range detectors.
| |
| The P-8 interlock automatically enables the Reactor Coolant Flow-Low (Single Loop)reactor trip on low flow in one or more RCS loops, and the Turbine Trip-Low Fluid Oil Pressure and Turbine Trip-Turbine Stop Valve Closure reactor trips on increasing power. The LCO requirement for the Reactor Coolant Flow -Low Function ensures that protection is provided against a loss of flow in any RCS loop that could result in DNB conditions in the core when greater than approximately 48% power.Above the P-8 setpoint, a turbine trip will cause a load rejection beyond the capacity of the Steam Dump System. A reactor trip is automatically initiated on a turbine trip when it is above the P-8 setpoint, to minimize the transient on the reactor. On decreasing power below the P-8 setpoint, the reactor trip on low flow in any loop is automatically blocked.The LCO requires four channels of Power Range Neutron Flux, P-8 interlock to be OPERABLE in MODE 1.In MODE 1, a loss of flow in one RCS loop could result in DNB conditions and, a turbine trip could cause a load rejection beyond the capacity of the Steam Dump System, so the Power Range Neutron Flux, P-8 interlock must be OPERABLE.
| |
| In MODE 2, 3, 4, 5, or 6, this Function does not have to be OPERABLE because the core is not producing sufficient power to be concerned about DNB conditions and the reactor is not at a power level sufficient to have a load rejection beyond the capacity of the Steam Dump System.McGuire Units 1 and 2 B 3.3.1-30 Revision No. 119 RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| : d. Power Range Neutron Flux, P-10 The Power Range Neutron Flux, P-1 0 interlock is actuated at approximately 10% power, as determined by two-out-of-four NIS power range detectors.
| |
| If power level falls below 10% RTP on 3 of 4 channels, the nuclear instrument trips will be automatically unblocked.
| |
| The LCO requirement for the P-10 interlock ensures that the following Functions are performed: " on increasing power, the P-10 interlock allows the operator to manually block the Intermediate Range Neutron Flux reactor trip. Note that blocking the reactor trip also blocks the signal to prevent automatic and manual rod withdrawal;
| |
| * on increasing power, the P-10 interlock allows the operator to manually block the Power Range Neutron Flux-Low reactor trip;* on increasing power, the P-10 interlock automatically provides a backup signal to block the Source Range Neutron Flux reactor trip, and also to de-energize the NIS Westinghouse-supplied source range detectors (the Westinghouse-supplied source range detectors are being replaced with Thermo Scientific-supplied detectors that remain energized);
| |
| * the P-10 interlock provides one of the two inputs to the P-7 interlock; and* on decreasing power, the P-10 interlock automatically enables the Power Range Neutron Flux-Low reactor trip and the Intermediate Range Neutron Flux reactor trip (and rod stop).McGuire Units 1 and 2 B 3.3.1-31 Revision No. 119 RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| The LCO requires four channels of Power Range Neutron Flux, P-10 interlock to be OPERABLE in MODE 1 or 2.OPERABILITY in MODE 1 ensures the Function is available to perform its decreasing power Functions in the event of a reactor shutdown.
| |
| This Function must be OPERABLE in MODE 2 to ensure that core protection is provided during a startup or shutdown by the Power Range Neutron Flux-Low and Intermediate Range Neutron Flux reactor trips. In MODE 3, 4, 5, or 6, this Function does not have to be OPERABLE because the reactor is not at power and the Source Range Neutron Flux reactor trip provides core protection.
| |
| : e. Turbine Impulse Pressure, P-13 The Turbine Impulse Pressure, P-13 interlock is actuated when the pressure in the first stage of the high pressure turbine is greater than approximately 10% of the rated full power pressure.
| |
| This is determined by one-out-of-two pressure detectors.
| |
| The LCO requirement for this Function ensures that one of the inputs to the P-7 interlock is available.
| |
| The LCO requires two channels of Turbine Impulse Pressure, P-1 3 interlock to be OPERABLE in MODE 1.The Turbine Impulse Chamber Pressure, P-13 interlock must be OPERABLE when the turbine generator is operating.
| |
| The interlock Function is not required OPERABLE in MODE 2, 3, 4, 5, or 6 because the turbine generator is not operating.
| |
| : 17. Reactor Trip Breakers This trip Function applies to the RTBs exclusive of individual trip mechanisms.
| |
| The LCO requires two OPERABLE trains of trip breakers.
| |
| A trip breaker train consists of all trip breakers associated with a single RTS logic train that are racked in, closed, and capable of supplying power to the CRD System. Thus, the McGuire Units 1 and 2 B 3.3.1-32 Revision No. 119 RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) train may consist of the main breaker, bypass breaker, or main breaker and bypass breaker, depending upon the system configuration.
| |
| Two OPERABLE trains ensure no single random failure can disable the RTS trip capability.
| |
| These trip Functions must be OPERABLE in MODE 1 or 2 when the reactor is critical.
| |
| In MODE 3, 4, or 5, these RTS trip Functions must be OPERABLE when the RTBs or associated bypass breakers are closed, and the CRD System is capable of rod withdrawal.
| |
| : 18. Reactor Trip Breaker Undervoltaqe and Shunt Trip Mechanisms The LCO requires both the Undervoltage and Shunt Trip Mechanisms to be OPERABLE for each RTB that is in service. The trip mechanisms are not required to be OPERABLE for trip breakers that are open, racked out, incapable of supplying power to the CRD System, or declared inoperable under Function 17 above.OPERABILITY of both trip mechanisms on each breaker ensures that no single trip mechanism failure will prevent opening any breaker on a valid signal.These trip Functions must be OPERABLE in MODE 1 or 2 when the reactor is critical.
| |
| In MODE 3, 4, or 5, these RTS trip Functions must be OPERABLE when the RTBs or associated bypass breakers are closed, and the CRD System is capable of rod withdrawal.
| |
| : 19. Automatic Trip Logic The LCO requirement for the RTBs (Functions 17 and 18) and Automatic Trip Logic (Function
| |
| : 19) ensures that means are provided to interrupt the power to allow the rods to fall into the reactor core. Each RTB is equipped with an undervoltage coil and a shunt trip coil to trip the breaker open when needed. Each train RTB has a bypass breaker to allow testing of the trip breaker while the unit is at power. The reactor trip signals generated by the RTS Automatic Trip Logic cause the RTBs and associated bypass breakers to open and shut down the reactor.The LCO requires two trains of RTS Automatic Trip Logic to be OPERABLE.
| |
| Having two OPERABLE channels ensures that random failure of a single logic channel will not prevent reactor trip.McGuire Units 1 and 2 B 3.3.1-33 Revision No. 119 RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| These trip Functions must be OPERABLE in MODE 1 or 2 when the reactor is critical.
| |
| In MODE 3, 4, or 5, these RTS trip Functions must be OPERABLE when the RTBs and associated bypass breakers are closed, and the CRD System is capable of rod withdrawal.
| |
| The RTS instrumentation satisfies Criterion 3 of 10 CFR 50.36 (Ref. 6).ACTIONS A Note has been added to the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed in Table 3.3.1-1. When the Required Channels in Table 3.3.1-1 are specified (e.g., on a per steam line, per loop, per SG, etc., basis), then the Condition may be entered separately for each steam line, loop, SG, etc., as appropriate.
| |
| A channel shall be OPERABLE if the point at which the channel trips is found equal to or more conservative than the Allowable Value. In the event a channel's trip setpoint is found less conservative than the Allowable Value, or the transmitter, instrument loop, signal processing electronics, or bistable is found inoperable, then all affected Functions provided by that channel must be declared inoperable and the LCO Condition(s) entered for the protection Function(s) affected.
| |
| Unless otherwise specified, if plant conditions warrant, the trip setpoint may be set outside the NOMINAL TRIP SETPOINT calibration tolerance band as long as the trip setpoint is conservative with respect to the NOMINAL TRIP SETPOINTS.
| |
| If the trip setpoint is found outside the NOMINAL TRIP SETPOINT calibration tolerance band and non-conservative with respect to the NOMINAL TRIP SETPOINT, the setpoint shall be re-adjusted.When the number of inoperable channels in a trip Function exceed those specified in one or other related Conditions associated with a trip Function, then the unit is outside the safety analysis.
| |
| Therefore, LCO 3.0.3 must be immediately entered if applicable in the current MODE of operation.
| |
| A.1 Condition A applies to all RTS protection Functions.
| |
| Condition A.addresses the situation where one or more required channels for one or more Functions are inoperable at the same time. The Required Action is to refer to Table 3.3.1-1 and to take the Required Actions for the protection functions affected.
| |
| The Completion Times are those from the referenced Conditions and Required Actions.McGuire Units 1 and 2 B 3.3.1-34 Revision No. 119 RTS Instrumentation B 3.3.1 BASES ACTIONS (continued)
| |
| B.1 and B.2 Condition B applies to the Manual Reactor Trip in MODE 1 or 2. This action addresses the train orientation of the SSPS for this Function.
| |
| With one channel inoperable, the inoperable channel must be restored to OPERABLE status within 48 hours. In this Condition, the remaining OPERABLE channel is adequate to perform the safety function.The Completion Time of 48 hours is reasonable considering that there are two automatic actuation trains and another manual initiation channel OPERABLE, and the low probability of an event occurring during this interval.If the Manual Reactor Trip Function cannot be restored to OPERABLE status within the allowed 48 hour Completion Time, the unit must be brought to a MODE in which the requirement does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 additional hours (54 hours total time). The 6 additional hours are reasonable, based on operating experience, to reach MODE 3 from full power operation in an orderly manner and without challenging unit systems. With the unit in MODE 3, the MODES 1 and 2 requirements for this trip Function ate no longer required and Condition C is entered.C.1 and C.2 Condition C applies to the following reactor trip Functions in MODE 3, 4, or 5 with the RTBs closed and the CRD System capable of rod withdrawal: " Manual Reactor Trip;* RTBs;* RTB Undervoltage and Shunt Trip Mechanisms; and* Automatic Trip Logic.This action addresses the train orientation of the SSPS for these Functions.
| |
| With one channel or train inoperable, the inoperable channel or train must be restored to OPERABLE status within 48 hours. If the affected Function(s) cannot be restored to OPERABLE status within the allowed 48 hour Completion Time, the unit must be placed in a condition in which the requirement does not apply. To achieve this status, the RTBs must be opened within the next hour. The additional hour provides McGuire Units 1 and 2 B 3.3.1-35 Revision No. 119 RTS Instrumentation B 3.3.1 BASES -ACTIONS (continued) sufficient time to accomplish the action in an orderly manner. With the RTBs open, these Functions are no longer required.The Completion Time is reasonable considering that in this Condition, the remaining OPERABLE train is adequate to perform the safety function, and given the low probability of an event occurring during this interval.D.1.1, D.1.2, and D.2 Condition D applies to the Power Range Neutron Flux-High and Power Range Neutron Flux-High Positive Rate Functions.
| |
| The NIS power range detectors provide input to the CRD System and the SG Water Level Control System and, therefore, have a two-out-of-four trip logic. A known inoperable channel must be placed in the tripped condition.
| |
| This results in a partial trip condition requiring only one-out-of-three logic for actuation.
| |
| The 72 hours allowed to place the inoperable channel in the tripped condition is justified in WCAP-14333-P-A (Ref. 10).With one of the NIS power range detectors inoperable, 1/4 of the radial power distribution monitoring capability is lost. Therefore, SR 3.2.4.2 must be performed (Required Action D.1.1) within 12 hours of THERMAL POWER exceeding 75% RTP and once per 12 hours thereafter.
| |
| Calculating QPTR every 12 hours compensates for the lost monitoring capability due to the inoperable NIS power range channel and allows continued unit operation at power levels > 75% RTP. At power levels <75% RTP, operation of the core with radial power distributions beyond the design limits, at a power level where DNB conditions may exist, is prevented.
| |
| The 12 hour Completion Time is consistent with the surveillance Requirement Frequency in LCO 3.2.4, "QUADRANT POWER TILT RATIO (QPTR)." Required Action D.1.1 has been modified by a Note which only requires SR 3.2.4.2 to be performed if the Power Range Neutron Flux input to QPTR becomes inoperable.
| |
| Failure of a component in the Power Range Neutron Flux Channel which renders the High Flux Trip Function inoperable may not affect the capability to monitor QPTR. As such, determining QPTR using movable incore detectors may not be necessary.
| |
| As an alternative to the above Actions, the plant must be placed in a MODE where this Function is no longer required OPERABLE.
| |
| Seventy eight (78) hours are allowed to place the plant in MODE 3. The 78 hour completion time includes 72 hours for channel corrective maintenance and an additional 6 hours for the MODE reduction as required by Required Action D.2. This is a reasonable time, based on operating experience, to reach MODE 3 from full power in an orderly manner and McGuire Units 1 and 2 B 3.3.1-36 Revision No. 119 RTS Instrumentation B 3.3.1 BASES ACTIONS (continued) without challenging plant systems. If Required Actions cannot be completed within their allowed Completion Times, LCO 3.0.3 must be entered.The Required Actions have been modified by a Note that allows placing the inoperable channel in the bypass condition for up to 12 hours while performing routine surveillance testing of other channels.
| |
| The Note also allows placing the inoperable channel in the bypass condition to allow setpoint adjustments of other channels when required to reduce the setpoint in accordance with other Technical Specifications.
| |
| The note also allows an OPERABLE channel to be placed in bypass for up to 12 hours for testing of the bypassed channel. However, only one channel may be placed in bypass at any one time. The 12 hour time limit is justified in Reference 10.E.1 and E.2 Condition E applies to. the following reactor trip Functions:
| |
| Power Range Neutron Flux-Low;Overtemperature AT;Overpower ATT;Pressurizer Pressure-High; and* SG Water Level-Low Low.A known inoperable channel must be placed in the tripped condition within 72 hours. Placing the channel in the tripped condition results in a partial trip condition requiring only one-out-of-three logic for actuation of the two-out-of-four trips. The 72 hours allowed to place the inoperable channel in the tripped condition is justified in Reference 10.If the operable channel cannot be placed in the trip condition within the specified Completion Time, the unit must be placed in a MODE where these Functions are not required OPERABLE.
| |
| An additional 6 hours is allowed to place the unit in MODE 3. Six hours is a reasonable time, based on operating experience, to place the unit in MODE 3 from full power in an orderly manner and without challenging unit systems.McGuire Units 1 and 2 B 3.3.1-37 Revision No. 119 RTS Instrumentation B 3.3.1 BASES ACTIONS (continued)
| |
| The Required Actions have been modified by a Note that allows placing the inoperable channel in the bypassed condition for up to 12 hours while performing routine surveillance testing of the other channels.
| |
| The note also allows an OPERABLE channel to be placed in bypass for up to 12 hours forl testing of the bypassed channel. However, only one channel may be placed in bypass at any one time. The 12 hour time limit is justified in Reference 10.F.1 and F.2 Condition F applies to the Intermediate Range Neutron Flux trip when THERMAL POWER is above the P-6 setpoint and below the P-10 setpoint and one channel is inoperable.
| |
| Above the P-6 setpoint and below the P-10 setpoint, the NIS intermediate range detector performs the monitoring Functions.
| |
| If THERMAL POWER is greater than the P-6 setpoint but less than the P-10 setpoint, 24 hours is allowed to reduce THERMAL POWER below the P-6 setpoint or increase to THERMAL POWER above the P-1 0 setpoint.
| |
| The NIS Intermediate Range Neutron Flux channels must be OPERABLE when the power level is above the capability of the source range, P-6, and below the capability of the power range, P-10. If THERMAL POWER is greater than the P-10 setpoint, the NIS power range detectors perform the monitoring and protection functions and the intermediate range is not required.
| |
| The Completion Times allow for a slow and controlled power adjustment above P-10 or below P-6 and take into account the redundant capability afforded by the redundant OPERABLE channel, and the low probability of its failure during this period. This action does not require the inoperable channel to be tripped because the Function uses one-out-of-two logic. Tripping one channel would trip the reactor.Thus, the Required Actions specified in this Condition are only applicable when channel failure does not result in reactor trip.G.1 and G.2 Condition G applies to two inoperable Intermediate Range Neutron Flux trip channels in MODE 2 when THERMAL POWER is above the P-6 setpoint and below the P-10 setpoint.
| |
| Required Actions specified in this Condition are only applicable when channel failures do not result in reactor trip.Above the P-6 setpoint and below the P-10 setpoint, the NIS intermediate range detector performs the monitoring Functions.
| |
| With no intermediate range channels OPERABLE, the Required Actions are to suspend operations involving positive reactivity additions immediately.
| |
| This will preclude any power level increase since there are no McGuire Units 1 and 2 B 3.3.1-38 Revision No. 119 RTS Instrumentation B 3.3.1 BASES ACTIONS (continued)
| |
| OPERABLE Intermediate Range Neutron Flux channels.
| |
| The operator must also reduce THERMAL POWER below the P-6 setpoint within two hours. Below P-6, the Source Range Neutron Flux channels will be able to monitor the core power level. The Completion Time of 2 hours will allow a slow and controlled power reduction to less than the P-6 setpoint and takes into account the low probability of occurrence of an event during this period that may require the protection afforded by the NIS Intermediate Range Neutron Flux trip. Required Action G.1 is modified by a note to indicate that normal plant control operations that individually add limited positive reactivity (e.g., temperature or boron fluctuations associated with RCS inventory management or temperature control) are not precluded by this Action.H.1 Condition H applies to the Intermediate Range Neutron Flux trip when THERMAL POWER is below the P-6 setpoint and one or two channels are inoperable.
| |
| Below the P-6 setpoint, the NIS source range performs the monitoring and protection functions.
| |
| The inoperable NIS intermediate range channel(s) must be returned to OPERABLE status prior to increasing power above the P-6 setpoint.
| |
| The NIS intermediate range channels must be OPERABLE when the power level is above the capability of the source range, P-6, and below the capability of the power range, P-10.1.1 Condition I applies to one inoperable Source Range Neutron Flux trip channel when in MODE 2, below the P-6 setpoint, and performing a reactor startup. With the unit in this Condition, below P-6, the NIS source range performs the monitoring and protection functions.
| |
| With one of the two channels inoperable, operations involving positive reactivity additions shall be suspended immediately.
| |
| This will preclude any power escalation.
| |
| With only one source range channel OPERABLE, core protection is severely reduced and any actions that add positive reactivity to the core must be suspended immediately.
| |
| Required Action 1. 1 is modified by a note to indicate that normal plant control operations that individually add limited positive reactivity (e.g., temperature or boron fluctuations associated with RCS inventory management or temperature control) are not precluded by this Action.McGuire Units 1 and 2 B 3.3.1-39 Revision No. 119 RTS Instrumentation B 3.3.1 BASES ACTIONS (continued)
| |
| J. 1 Condition J applies to two inoperable Source Range Neutron Flux trip channels when in MODE 2, below the P-6 setpoint, and performing a reactor startup, or in MODE 3, 4, or 5 with the RTBs closed and the CRD System capable of rod withdrawal.
| |
| With the unit in this Condition, below P-6, the NIS source range performs the monitoring and protection functions.
| |
| With both source range channels inoperable, the RTBs must be opened immediately.
| |
| With the RTBs open, the core is in a more stable condition and the unit enters Condition L.K.1 and K.2 Condition K applies to one inoperable source range channel in MODE 3, 4, or 5 with the RTBs closed and the CRD System capable of rod withdrawal.
| |
| With the unit in this Condition, below P-6, the NIS source range performs the monitoring and protection functions.
| |
| With one of the source range channels inoperable, 48 hours is allowed to restore it to an OPERABLE status. If the channel cannot be returned to an OPERABLE status, 1 additional hour is allowed to open the RTBs. Once the RTBs are open, the core is in a more stable condition and the unit enters Condition L. The allowance of 48 hours to restore the channel to OPERABLE status, and the additional hour to open the RTBs, are justified in Reference 7.L.1, L.2, and L.3 Condition L applies when the required number of OPERABLE Source Range Neutron Flux channels is not met in MODE 3, 4, or 5 with the RTBs open. With the unit in this Condition, the NIS source range performs a monitoring function.
| |
| With less than the required number of source range channels OPERABLE, operations involving positive reactivity additions shall be suspended immediately.
| |
| In addition to suspension of positive reactivity additions, all valves that could add unborated water to the RCS must be closed within 1 hour as specified in LCO 3.9.2. The isolation of unborated water sources will preclude a boron dilution accident.Also, the SDM must be verified within 1 hour and once every 12 hours thereafter as per SR 3.1.1.1, SDM verification.
| |
| With no source range channels OPERABLE, core monitoring is severely reduced. Verifying the SDM within 1 hour allows sufficient time to perform the calculations and determine that the SDM requirements are met. The SDM must also be verified once per 12 hours thereafter to ensure that the core reactivity has not changed. Required Action L.1 precludes any positive reactivity McGuire Units 1 and 2 B 3.3.1-40 Revision No. 119 RTS Instrumentation B 3.3.1 BASES ACTIONS (continued) additions; therefore, core reactivity should not be increasing, and a 12 hour Frequency is adequate.
| |
| The Completion Times of within 1 hour and once per 12 hours are based on operating experience in performing the Required Actions and the knowledge that unit conditions will change slowly. Required Action L. 1 is modified by a note which permits plant temperature changes provided the temperature change is accounted for in the calculated SDM and that Keff remains < 0.99. Introduction of temperature changes including temperature increases when a positive MTC exists, must be evaluated to ensure they do not result in a loss of required SDM or adequate margin to criticality.
| |
| M.1 and M.2 Condition M applies to the following reactor trip Functions:
| |
| * Pressurizer Pressure-Low; 0 Pressurizer Water Level-High; 0 Reactor Coolant Flow-Low (Two Loops);* Undervoltage RCPs; and* Underfrequency RCPs.With one channel inoperable, the inoperable channel must be placed in the tripped condition within 72 hours. Placing the channel in the tripped condition results in a partial trip condition requiring only one additional channel to initiate a reactor trip above the P-7 setpoint (and below the P-8 setpoint for the Reactor Coolant Flow-Low (Two Loops) Function).
| |
| These Functions do not have to be OPERABLE below the P-7 setpoint because, for the Pressurizer Water Level-High function, transients are slow enough for manual action; and for the other functions, power distributions that would cause a DNB concern at this low power level are unlikely.
| |
| The 72 hours allowed to place the channel in the tripped condition is justified in Reference
| |
| : 10. An additional 6 hours is allowed to reduce THERMAL POWER to below P-7 if the inoperable channel cannot be restored to OPERABLE status or placed in trip within the specified Completion Time.Allowance of this time interval takes into consideration the redundant capability provided by the remaining redundant OPERABLE channel, and the low probability of occurrence of an event during this period that may require the protection afforded by the Functions associated with Condition M.McGuire Units 1 and 2 B 3.3.1-41 Revision No. 119 RTS Instrumentation B 3.3.1 BASES ACTIONS (continued)
| |
| The Required Actions have been modified by a Note that allows placing the inoperable channel in the bypassed condition for up to 12 hours while performing routine surveillance testing of the other channels.
| |
| The note also allows an OPERABLE channel to be placed in bypass for up to 12 hours for testing of the bypassed channel. However, only one channel may be placed in bypass at any one time. The 12 hour time limit is justified in Reference 10.N.1 and N.2 Condition N applies to the Reactor Coolant Flow-Low (Single Loop)reactor trip Function.
| |
| With one channel inoperable, the inoperable channel must be placed in trip within 72 hours. If the channel cannot be restored to OPERABLE status or the channel placed in trip within the 72 hours, then THERMAL POWER must be reduced below the P-8 setpoint within the next 4 hours. This places the unit in a MODE where the LCO is no longer applicable.
| |
| This trip Function does not have to be OPERABLE below the P-8 setpoint because other RTS trip Functions provide core protection below the P-8 setpoint.
| |
| The 72 hours allowed to restore the channel to OPERABLE status or place in trip and the 4 additional hours allowed to reduce THERMAL POWER to below the P-8 setpoint are justified in Reference 10.The Required Actions have been modified by a Note that allows placing the inoperable channel in the bypassed condition for up to 12 hours while performing routine surveillance testing of the other channels.
| |
| The note also allows an OPERABLE channel to be placed in bypass for up to 12 hours for testing of the bypassed channel. However, only one channel may be placed in bypass at any one time. The 12 hour time limit is justified in Reference 10.0.1, 0.2, P.1, and P.2 Condition 0 and P apply to Turbine Trip on Low Fluid Oil Pressure or on Turbine Stop Valve Closure. With a channel inoperable, the inoperable channel must be placed in the trip condition within 72 hours. If placed in the tripped condition, this results in a partial trip condition requiring fewer additional channel to initiate a reactor trip. If the channel cannot be restored to OPERABLE status or placed in the trip condition, then power must be reduced below the P-8 setpoint within the next 4 hours. The 72 hours allowed to place the inoperable channel in the tripped condition and the 4 hours allowed for reducing power are justified in Reference 10.McGuire Units 1 and 2 B 3.3.1-42 Revision No. 119 RTS Instrumentation B 3.3.1 BASES -ACTIONS (continued)
| |
| The Required Actions of Condition 0 have been modified by a Note that allows placing the inoperable channel in the bypassed condition for up to 12 hours while performing routine surveillance testing of the other channels.
| |
| The note also allows an OPERABLE channel to be placed in bypass for up to 12 hours for testing of the bypassed channel. However, only one channel may be placed in bypass at any one time. The 12 hour time limit is justified in Reference 10.Q.1 and Q.2 Condition Q applies to the SI Input from ESFAS reactor trip and the RTS Automatic Trip Logic in MODES 1 and 2. These actions address the train orientation of the RTS for these Functions.
| |
| With one train inoperable, 24 hours are allowed to restore the train to OPERABLE status (Required Action Q. 1) or the unit must be placed in MODE 3 within the next 6 hours.The Completion Time of 24 hours (Required Action Q.1) is reasonable considering that in this Condition, the remaining OPERABLE train is adequate to perform the safety function and given the low probability of an event during this interval.
| |
| The 24 hours allowed to restore the inoperable RTS Automatic Trip Logic train to OPERABLE status is justified in Reference
| |
| : 10. The additional Completion Time of 6 hours (Required Action Q.2) is reasonable, based on operating experience, to reach MODE 3 from full power in an orderly manner and without challenging unit systems.The Required Actions have been modified by a Note that allows bypassing one train up to 4 hours for surveillance testing, provided the other train is OPERABLE.
| |
| The 4 hour time limit for testing the RTS Automatic Trip Logic train may include testing the RTB also, if both the Logic test and RTB test are conducted within the 4 hour time limit. The 4 hour time limit is justified in Reference 10.R.1 and R.2 Condition R applies to the RTBs in MODES 1 and 2. These actions address the train orientation of the RTS for the RTBs. With one train inoperable, 24 hours is allowed for train corrective maintenance to restore the train to OPERABLE status or the unit must be placed in MODE 3 within the next 6 hours. The 24 hour Completion Time is justified in Reference
| |
| : 11. The Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 3 from full power in an orderly manner and without challenging unit systems. Placing the unit in MODE 3 removes the requirement for this particular Function.McGuire Units 1 and 2 B 3.3.1-43 Revision No- 119 RTS Instrumentation B 3.3.1 BASES ACTIONS (continued)
| |
| The Required Actions have been modified by a Note. The Note allows one RTB to be bypassed for up to 4 hours for surveillance testing, provided the other RTB is OPERABLE.
| |
| The 4 hour time limit is justified in Reference 11.S.1 and S.2 Condition S applies to the P-6 and P-10 interlocks.
| |
| With one or more channel(s) inoperable for one-out-of-two or two-out-of-four coincidence logic, the associated interlock must be verified to be in its required state for the existing unit condition within 1 hour or the unit must be placed in MODE 3 within the next 6 hours. Verifying the interlock status, by visual observation of the control room status lights, manually accomplishes the interlock's Function.
| |
| The Completion Time of 1 hour is based on operating experience and the minimum amount of time allowed for manual operator actions. The Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 3 from full power in an orderly manner and without challenging unit systems. The 1 hour and 6 hour Completion Times are equal to the time allowed by LCO 3.0.3 for shutdown actions in the event of a complete loss of RTS Function.T.1 and T.2 Condition T applies to the P-7, P-8, and P-13 interlocks.
| |
| With one or more channel(s) inoperable for one-out-of-two or two-out-of-four coincidence logic, the associated interlock must be verified to be in its required state for the existing unit condition within 1 hour or the unit must be placed in MODE 2 within the next 6 hours. These actions are conservative for the case where power level is being raised. Verifying the interlock status, by visual observation of the control room status lights, manually accomplishes the interlock's Function.
| |
| The Completion Time of 1 hour is based on operating experience and the minimum amount of time allowed for manual operator actions. The Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 2 from full power in an orderly manner and without challenging unit systems.McGuire Units 1 and 2 B 3.3.1-44 Revision No. 119 RTS Instrumentation B 3.3.1 BASES ACTIONS (continued)
| |
| U.1 and U.2 Condition U applies to the RTB Undervoltage and Shunt Trip Mechanisms, or diverse trip features, in MODES 1 and 2. With one of the diverse trip features inoperable, it must be restored to an OPERABLE status within 48 hours or the unit must be placed in a MODE where the requirement does not apply. This is accomplished by placing the unit in MODE 3 within the next 6 hours (54 hours total time). With both diverse trip features inoperable, the reactor trip breaker is inoperable and Condition R is entered. The Completion Time of 6 hours is a reasonable time, based on operating experience, to reach MODE 3 from full power in an orderly manner and without challenging unit systems.With the unit in MODE 3, the MODES 1 and 2 requirement for this function is no longer required and Condition C is entered. The affected RTB shall not be bypassed while one of the diverse features is inoperable except for the time required to perform maintenance to one of the diverse features.
| |
| The allowable time for performing maintenance of the diverse features is 2 hours for the reasons stated under Condition R.The Completion Time of 48 hours for Required Action U.1 is reasonable considering that in this Condition there is one remaining diverse feature for the affected RTB, and one OPERABLE RTB capable of performing the safety function and given the low probability of an event occurring during this interval.V.1 With two RTS trains inoperable, no automatic capability is available to shut down the reactor, and immediate plant shutdown in accordance with LCO 3.0.3 is required.SURVEILLANCE The SRs for each RTS Function are identified by the SRs column of REQUIREMENTS Table 3.3.1-1 for that Function.A Note has been added to the SR Table stating that Table 3.3.1-1 determines which SRs apply to which RTS Functions.
| |
| Note that each channel of process protection supplies both trains of the RTS. When testing Channel I, Train A and Train B must be examined.Similarly, Train A and Train B must be examined when testing Channel II, McGuire Units 1 and 2 B 3.3.1-45 Revision No. 119 RTS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| Channel III, and Channel IV (if applicable).
| |
| The CHANNEL CALIBRATION and COTs are performed in a manner that is consistent with the assumptions used in analytically calculating the required channel accuracies.
| |
| Performing the Neutron Flux Instrumentation surveillances meets the License Renewal Commitments for License Renewal Program for Neutron Flux Instrumentation Circuits per UFSAR Chapter 18, Table 18-1 and License Renewal Commitments Specification MCS-1274.00-00-0016, Section 4.44.SR 3.3.1.1 Performance of the CHANNEL CHECK ensures that gross failure of instrumentation has not occurred.
| |
| A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels.
| |
| It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
| |
| Agreement criteria are determined by the unit staff based on a combination of the channel instrument uncertainties, including indication and readability.
| |
| If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.1.2 SR 3.3.1.2 compares the calorimetric heat balance calculation to the NIS channel output. If the calorimetric exceeds the NIS channel output by> 2% RTP, the NIS is not declared inoperable, but must be adjusted.
| |
| If the NIS channel output cannot be properly adjusted, the channel is declared inoperable.
| |
| McGuire Units 1 and 2 B 3.3.1-46 Revision No. 119 RTS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| Two Notes modify SR 3.3.1.2. The first Note indicates that the NIS channel output shall be adjusted consistent with the calorimetric results if the absolute difference between the NIS channel output and the calorimetric is > 2% RTP. The second Note clarifies that this Surveillance is required only if reactor power is _ 15% RTP and that 12 hours is allowed for completing the first Surveillance after reaching 15% RTP. At lower power levels, calorimetric data are inaccurate.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.1.3 SR 3.3.1.3 compares the incore system to the NIS channel output. If the absolute difference in AFD is > 3%, the NIS channel is still OPERABLE, but must be readjusted.
| |
| If the NIS channel cannot be properly readjusted, the channel is declared inoperable.
| |
| This Surveillance is performed to verify the f(AI) input to the overtemperature AT Function and overpower AT Function.Two Notes modify SR 3.3.1.3. Note 1 indicates that the excore NIS channel shall be adjusted if the absolute difference between the incore and excore AFD is > 3%. Note 2 clarifies that the Surveillance is required only if reactor power is 2! 15% RTP and that 24 hours is allowed for completing the first Surveillance after reaching 15% RTP.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.1.4 SR 3.3.1.4 is the performance of a TADOT. This test shall verify OPERABILITY by actuation of the end devices.The RTB test shall include separate verification of the undervoltage and shunt trip mechanisms.
| |
| Independent verification of RTB undervoltage and shunt trip Function is not required for the bypass breakers.
| |
| No capability is provided for performing such a test at power. The independent test for bypass breakers is included in SR 3.3.1.14.
| |
| The bypass breaker test shall include a local shunt trip. A Note has been added to indicate that this test must be performed on the bypass breaker prior to placing it in service.McGuire Units 1 and 2 B 3.3.1-47 Revision No. 119 RTS Instrumentation B 3.3.1 BASES -SURVEILLANCE REQUIREMENTS (continued)
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.1.5 SR 3.3.1.5 is the performance of an ACTUATION LOGIC TEST. The SSPS is tested using the semiautomatic tester. The train being tested is placed in the bypass condition, thus preventing inadvertent actuation.
| |
| Through the semiautomatic tester, all possible logic combinations, with and without applicable permissives, are tested for each protection function.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.1.6 SR 3.3.1.6 is a calibration of the excore channels to the incore channels.If the measurements do not agree, the excore channels are not declared inoperable but must be calibrated to agree with the incore detector measurements.
| |
| If the excore channels cannot be adjusted, the channels are declared inoperable.
| |
| This Surveillance is performed to verify the f(AI)input to the overtemperature AT Function and overpower AT Function.At Beginning of Cycle (BOC), the excore channels are compared to the incore detector measurements.
| |
| This comparison is typically performed prior to exceeding 75% power. Excore detectors are adjusted as necessary.
| |
| This low power surveillance satisfies the initial performance of SR 3.3.1.6.At BOC, after reaching full power steady state conditions, additional incore and excore measurements are taken and excore detectors are adjusted as necessary.
| |
| The M factors are normally only determined at BOC, but they may be changed at other points in the fuel cycle if the relationship between excore and incore measurements changes significantly.
| |
| McGuire Units 1 and 2 B 3.3.1-48 Revision No. 119 RTS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| A Note modifies SR 3.3.1.6. The Note states that this Surveillance is required only if reactor power is > 75% RTP and that 24 hours is allowed for completing the first surveillance after reaching 75% RTP.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.1.7 SR 3.3.1.7 is the performance of a COT.A COT is performed on each required channel to ensure the channel will perform the intended Function.The tested portion of the Loop must trip within the Allowable Values specified in Table 3.3.1-1.The setpoint shall be left set consistent with the assumptions of the setpoint methodology.
| |
| SR 3.3.1.7 is modified by a Note that provides a 4 hour delay in the requirement to perform this Surveillance for source range instrumentation when entering MODE 3 from MODE 2. This Note allows a normal shutdown to proceed without a delay for testing in MODE 2 and for a short time in MODE 3 until the RTBs are open and SR 3.3.1.7 is no longer required to be performed.
| |
| If the unit is to be in MODE 3 with the RTBs closed for > 4 hours this Surveillance must be completed within 4 hours after entry into MODE 3. The surveillance shall include verification of the high flux at shutdown alarm setpoint of less than or equal to the average CPS Neutron Level reading (most consistent value between highest and lowest CPS Neutron Level reading) at five times background.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.For Functions for which TSTF-493, "Clarify Application of Setpoint Methodology for LSSS Functions" (Reference
| |
| : 12) has been implemented, this SR is modified by two Notes as identified in Table 3.3.1-1. The first Note requires evaluation of channel performance for the condition where the as-found setting for the channel setpoint is outside its as-found tolerance but conservative with respect to the Allowable Value.Evaluation of channel performance will verify that the channel will continue to behave in accordance with safety analysis assumptions and McGuire Units 1 and 2 B 3.3.1-49 Revision No. 119 RTS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS (continued) the channel performance assumptions in the setpoint methodology.
| |
| The purpose of the assessment is to ensure confidence in the channel performance prior to returning the channel to service. The performance of these channels will be evaluated under the station's Corrective Action Program. Entry into the Corrective Action Program will ensure required review and documentation of the condition for continued OPERABILITY.
| |
| The second Note requires that the as-left setting for the channel be returned to within the as-left tolerance of the Nominal Trip Setpoint (NTSP). Where a setpoint more conservative than the NTSP is used in the plant surveillance procedures (field setting), the as-left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint.
| |
| This will ensure that sufficient margin to the Safety Limit and/or Analytical Limit is maintained.
| |
| If the as-left channel setting cannot be returned to a setting within the as-left tolerance of the NTSP, then the channel shall be declared inoperable.
| |
| The second Note also requires that the methodologies for calculating the as-left and the as-found tolerances be in the UFSAR. The NOMINAL TRIP SETPOINT definition includes a provision that would allow the as-left setting for the channel to be outside the tolerance band, provided the setting is conservative with respect to the NTSP. This provision is not applicable to Functions for which the second NOTE applies.SR 3.3.1.8 SR 3.3.1.8 is the performance of a COT as described in SR 3.3.1.7, except it is modified by a Note that this test shall include verification that the P-6, during the Intermediate Range COT, and P-1O, during the Power Range COT, interlocks are in their required state for the existing unit condition.
| |
| The verification is performed by visual observation of the permissive status light in the unit control room. The Frequency is modified by a Note that allows this surveillance to be satisfied if it has been performed within the frequency specified in the Surveillance Frequency Control Program or 184 days of the Frequencies prior to reactor startup and four hours after reducing power below P-10 and P-6.The Frequency of "prior to startup" ensures this surveillance is performed prior to critical operations and applies to the source, intermediate and power range low instrument channels.
| |
| The Frequency of "4 hours after reducing power below P-10" (applicable to intermediate and power range low channels) and "4 hours after reducing power below P-6" (applicable to source range channels) allows a normal shutdown to be completed and the unit removed from the MODE of Applicability for this surveillance without a delay to perform the testing required by this surveillance.
| |
| The Frequency thereafter applies if the plant remains in the MODE of Applicability after the initial performances of prior to reactor startup and four hours after reducing power below P-10 or P-6. The MODE of McGuire Units 1 and 2 B 3.3.1-50 Revision No. 119 RTS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| Applicability for this surveillance is < P-1 0 for the power range low and intermediate range channels and < P-6 for the source range channels.Once the unit is in MODE 3, this surveillance is no longer required.
| |
| If power is to be maintained
| |
| < P-10 or < P-6 for more than 4 hours, then the testing required by this surveillance must be performed prior to the expiration of the 4 hour limit. Four hours is a reasonable time to complete the required testing or place the unit in a MODE where this surveillance is no longer required.
| |
| This test ensures that the NIS source, intermediate, and power range low channels are OPERABLE prior to taking the reactor critical and after reducing power into the applicable MODE (< P-10 or < P-6) for periods > 4 hours. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.For Functions for which TSTF-493, "Clarify Application of Setpoint Methodology for LSSS Functions" (Reference
| |
| : 12) has been implemented, this SR is modified by two Notes as identified in Table 3.3.1-1. The first Note requires evaluation of channel performance for the condition where the as-found setting for the channel setpoint is outside its as-found tolerance but conservative with respect to the Allowable Value.Evaluation of channel performance will verify that the channel will continue to behave in accordance with safety analysis assumptions and the channel performance assumptions in the setpoint methodology.
| |
| The purpose of the assessment is to ensure confidence in the channel performance prior to returning the channel to service. The performance of these channels will be evaluated under the station's Corrective Action Program. Entry into the Corrective Action Program will ensure required review and documentation of the condition for continued OPERABILITY.
| |
| The second Note requires that the as-left setting for the channel be returned to within the as-left tolerance of the Nominal Trip Setpoint (NTSP). Where a setpoint more conservative than the NTSP is used in the plant surveillance procedures (field setting), the as-left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint.
| |
| This will ensure that sufficient margin to the Safety Limit and/or Analytical Limit is maintained.
| |
| If the as-left channel setting cannot be returned to a setting within the as-left tolerance of the NTSP, then the channel shall be declared inoperable.
| |
| The second Note also requires that the methodologies for calculating the as-left and the as-found tolerances be in the UFSAR. The NOMINAL TRIP SETPOINT definition includes a provision that would allow the as-left setting for the channel to be outside the tolerance band, provided the setting is conservative with respect to the NTSP. This provision is not applicable to Functions for which the second NOTE applies.McGuire Units 1 and 2 B 3.3.1-51 Revision No. 119 RTS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.3.1.9 SR 3.3.1.9 is the performance of a TADOT. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.The SR is modified by a Note that excludes verification of setpoints from the TADOT. Since this SR applies to RCP undervoltage and underfrequency relays, setpoint verification is accomplished during the CHANNEL CALIBRATION.
| |
| SR 3.3.1.10 The CHANNEL CALIBRATION may be performed at power or during refueling based on testing capability.
| |
| Channel unavailability evaluations in References 10 and 11 have conservatively assumed that the CHANNEL CALIBRAITON is performed at power with the channel in bypass.CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy.CHANNEL CALIBRATIONS must be performed consistent with the assumptions of the setpoint methodology.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.1.10 is modified by a Note stating that this test shall include verification that the time constants are adjusted to the prescribed values where applicable.
| |
| The applicable time constants are shown in Table 3.3.1-1.SR 3.3.1.11 SR 3.3.1.11 is the performance of a CHANNEL CALIBRATION, as described in SR 3.3.1.10.
| |
| Two notes modify this SR. Note 1 states that neutron detectors are excluded from the CHANNEL CALIBRATION.
| |
| The CHANNEL CALIBRATION for the power range neutron detectors consists of a normalization of the detectors based on a power calorimetric and flux map performed above 15% RTP. The high McGuire Units 1 and 2 B 3.3.1-52 Revision No. 119 RTS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS (continued) voltage detector saturation curve is evaluated and compared to the manufacturer's data. The Westinghouse-supplied boron-triflouride (BF 3)source range neutron detectors and compensated ion chamber intermediate range neutron detectors are being replaced with Thermo Scientific-supplied fission chamber source and intermediate range neutron detectors.
| |
| The CHANNEL CALIBRATION for the BF 3 source range neutron detectors consists of two methods. Method 1 consists of obtaining the discriminator curves for source range, evaluating those curves, and comparing the curves to the manufacturer's data (adjustments to the discriminator voltage are performed as required).
| |
| Method 2 consists of performing waveform analysis.
| |
| This analysis process monitors the actual number and amplitude of the Neutron/Gamma pulses being generated by the SR detector.
| |
| The high voltage is adjusted to optimize the amplitude of the pulses while maintaining as low as possible high voltage value in order to prolong the detector life. The discriminator voltage is then adjusted, as required, to reasonably ensure that the neutron pulses are being counted by the source range instrumentation and the unwanted gamma pulses are not being counted as neutron pulses.The CHANNEL CALIBRATION for the compensated ion chamber intermediate range neutron detectors consists of the high voltage detector plateau for intermediate range, evaluating those curves, and comparing the curves to the manufacturer's data. The CHANNEL CALIBRATION for the fission chamber source and intermediate range neutron detectors consists of verifying that the channels respond correctly to test inputs with the necessary range and accuracy.Note 2 states that this Surveillance is not required for the NIS power range detectors for entry into MODE 2 or 1. Note 3 applies to the compensated ion chamber intermediate range neutron detectors, and states that this Surveillance is not required to be performed for entry into MODE 2 or 1. Notes 2 and 3 are required because the unit must be in at least MODE 2 to perform the test for the compensated ion chamber intermediate range detectors and MODE 1 for the power range detectors.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.For Functions for which TSTF-493, "Clarify Application of Setpoint Methodology for LSSS Functions" (Reference
| |
| : 12) has been implemented, this SR is modified by two Notes as identified in Table 3.3.1-1. The first Note requires evaluation of channel performance for the condition where the as-found setting for the channel setpoint is outside its as-found tolerance but conservative with respect to the Allowable Value.McGuire Units 1 and 2 B 3.3.1-53 Revision No. 119 RTS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| Evaluation of channel performance will verify that the channel will continue to behave in accordance with safety analysis assumptions and the channel performance assumptions in the setpoint methodology.
| |
| The purpose of the assessment is to ensure confidence in the channel performance prior to returning the channel to service. The performance of these channels will be evaluated under the station's Corrective Action Program. Entry into the Corrective Action Program will ensure required review and documentation of the condition for continued OPERABILITY.
| |
| The second Note requires that the as-left setting for the channel be returned to within the as-left tolerance of the Nominal Trip Setpoint (NTSP). Where a setpoint more conservative than the NTSP is used in the plant surveillance procedures (field setting), the as-left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint.
| |
| This will ensure that sufficient margin to the Safety Limit and/or Analytical Limit is maintained.
| |
| If the as-left channel setting cannot be returned to a setting within the as-left tolerance of the NTSP, then the channel shall be declared inoperable.
| |
| The second Note also requires that the methodologies for calculating the as-left and the as-found tolerances be in the UFSAR. The NOMINAL TRIP SETPOINT definition includes a provision that would allow the as-left setting for the channel to be outside the tolerance band, provided the setting is conservative with respect to the NTSP. This provision is not applicable to Functions for which the second NOTE applies.SR 3.3.1.12 SR 3.3.1.12 is the performance of a CHANNEL CALIBRATION, as described in SR 3.3.1.10.
| |
| Calibration of the AT channels is required at the beginning of each cycle upon completion of the precision heat balance. RCS loop AT values shall be determined by precision heat balance measurements at the beginning of each cycle.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.1.13 SR 3.3.1.13 is the performance of a COT of RTS interlocks.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Units 1 and 2 B 3.3.1-54 Revision No. 119 RTS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.3.1.14 SR 3.3.1.14 is the performance of a TADOT of the Manual Reactor Trip and the SI Input from ESFAS. The test shall independently verify the OPERABILITY of the undervoltage and shunt trip mechanisms for the Manual Reactor Trip Function for the Reactor Trip Breakers and Reactor Trip Bypass Breakers.
| |
| The Reactor Trip Bypass Breaker test shall include testing of the automatic undervoltage trip.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.The SR is modified by a Note that excludes verification of setpoints from the TADOT. The Functions affected have no setpoints associated with them.SR 3.3.1.15 SR 3.3.1.15 is the performance of a TADOT of Turbine Trip Functions.
| |
| This TADOT is as described in SR 3.3.1.4, except that this test is performed prior to reactor startup. A Note states that this Surveillance is not required if it has been performed within the previous 31 days.Verification of the Trip Setpoint does not have to be performed for this Surveillance.
| |
| Performance of this test will ensure that the turbine trip Function is OPERABLE prior to taking the reactor critical.
| |
| This test cannot be performed with the reactor at power and must therefore be performed prior to reactor startup.SR 3.3.1.16 and SR 3.3.1.17 SR 3.3.1.16 and SR 3.3.1.17 verify that the individual channel/train actuation response times are less than or equal to the maximum values assumed in the accident analysis.
| |
| Response time testing acceptance criteria are included in the UFSAR (Ref. 1). Individual component response times are not modeled in the analyses.The analyses model the overall or total elapsed time, from the point at which the parameter exceeds the trip setpoint value at the sensor to the point at which the equipment reaches the required functional state (i.e., control and shutdown rods fully inserted in the reactor core).For channels that include dynamic transfer Functions (e.g., lag, lead/lag, rate/lag, etc.), the response time test may be performed with the transfer McGuire Units 1 and 2 B 3.3.1-55 Revision No. 119 RTS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| Function set to one, with the resulting measured response time compared to the appropriate UFSAR response time. Alternately, the response time test can be performed with the time constants set to their nominal value, provided the required response time is analytically calculated assuming the time constants are set at their nominal values. The response time may be measured by a series of overlapping tests such that the entire response time is measured.Response time may be verified by actual response time tests in any series of sequential, overlapping or total channel measurements, or by the summation of allocated sensor, signal processing and actuation logic response times with actual response time tests on the remainder of the channel. Allocations for sensor response times may be obtained from: (1) historical records based on acceptable response time tests (hydraulic, noise, or power interrupt tests), (2) in place, onsite, or offsite (e.g., vendor) test measurements, or (3) utilizing vendor engineering specifications.
| |
| WCAP-13632-P-A, Revision 2, "Elimination of Pressure Sensor Response Time Testing Requirements" provides the basis and methodology for using allocated sensor response times in the overall verification of the channel response time for specific sensors identified in the WCAP. Response time verification for other sensor types must be either demonstrated by test, or their equivalency to those listed in WCAP-13632-P-A, Revision 2. Any demonstration of equivalency must have been determined to be acceptable by NRC staff review.WCAP-14036-P-A, Revision 1, "Elimination of Periodic Protection Channel Response Time Tests' provides the basis and methodology for using allocated signal processing and actuation logic response times in the overall verification of the protection system channel response time.The allocations for sensor, signal conditioning, and actuation logic response times must be verified prior to placing the component in operational service and re-verified following maintenance that may adversely affect response time. In general, electrical repair work does not impact response time provided the parts used for repair are of the same type and value. Specific components identified in the WCAP may be replaced without verification testing. One example where response time could be affected is replacing the sensing assembly of a transmitter.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Units 1 and 2 ,13 3.3.1-56 Revision No. 119 RTS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.3.1.16 is modified by a Note stating that neutron detectors are excluded from RTS RESPONSE TIME testing. This Note is necessary because of the difficulty in generating an appropriate detector input signal. Excluding the detectors is acceptable because the principles of detector operation ensure a virtually instantaneous response.
| |
| The response time of the neutron flux signal portion of the channel shall be measured from detector output or input of the first electronic component in the channel.REFERENCES
| |
| : 1. UFSAR, Chapter 7.2. UFSAR, Chapter 6.3. UFSAR, Chapter 15.4. IEEE-279-1971.
| |
| : 5. 10 CFR 50.49.6. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| : 7. WCAP-10271-P-A, Supplement 2, Rev. 1, June 1990.8. WCAP 13632-P-A, Revision 2, "Elimination of Pressure Sensor Response Time Testing Requirements" Sep., 1995.9. WCAP-14036-P-A, Revision 1, "Elimination of Periodic Protection Channel Response Time Tests" Oct., 1998.10. WCAP-14333-P-A, Revision 1, October 1998.11. WCAP-15376-P-A, Revision 1, March 2003.12. Technical Specification Task Force, Improved Standard Technical Specifications Change Traveler, TSTF-493, "Clarify Application of Setpoint Methodology for LSSS Functions", Revision 4.McGuire Units 1 and 2 B 3.3.1-57 Revision No. 119 UNIT 1 BASES 3.3.2 License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during IEOC21. Until the ECCS amendment can be implemented on Unit 2, there will be separate documents for Unit 1 and Unit 2 Bases 3.3.2.ECCS Water Management Modification is scheduled to be implemented on Unit 2 during the fall 2012 outage.
| |
| UNIT 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during I EOC21.Until the ECCS amendment can be implemented on Unit 2, there will be separate Bases documents for Unit I and Unit 2 for Bases 3.3.2, 3.3.3, 3.5.4, 3.6.6, and 3.6.11. ECCS Water Management Modification is scheduled to be implemented on Unit 2 during the fall 2012 outage.ESFAS Instrumentation B 3.3.2 B 3.3 INSTRUMENTATION B 3.3.2 Engineered Safety Feature Actuation System (ESFAS) Instrumentation BASES BACKGROUND The ESFAS initiates necessary safety systems, based on the values of selected unit parameters, to protect against violating core design limits and the Reactor Coolant System (RCS) pressure boundary, and to mitigate accidents.
| |
| The ESFAS instrumentation is segmented into three distinct but interconnected modules as identified below: Field transmitters or process sensors and instrumentation:
| |
| provide a measurable electronic signal based on the physical characteristics of the parameter being measured;Signal processing equipment including analog protection system, field contacts, and protection channel sets: provide signal conditioning, bistable setpoint comparison, process algorithm actuation, compatible electrical signal output to protection system devices, and control board/control room/miscellaneous indications; and Solid State Protection System (SSPS) including input, logic, and output bays: initiates the proper unit shutdown or engineered safety feature (ESF) actuation in accordance with the defined logic and based on the bistable outputs from the signal process control and protection system.Field Transmitters or Sensors To meet the design demands for redundancy and reliability, more than one, and often as many as four, field transmitters or sensors are used to measure unit parameters.
| |
| In many cases, field transmitters or sensors that input to the ESFAS are shared with the Reactor Trip System (RTS).In some cases, the same channels also provide control system inputs.To account for calibration tolerances and instrument drift, which is assumed to occur between calibrations, statistical allowances are provided in the NOMINAL TRIP SETPOINT and Allowable Values. The OPERABILITY of each transmitter or sensor can be evaluated when its"as found" calibration data are compared against its documented acceptance criteria.McGuire Unit 1 B 3.3.2-1 Revision No. 119 UNIT 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I nly during IEOC21. It is scheduled to be implemented on Unit 2 during the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES BACKGROUND (continued)
| |
| Signal Processing Equipment Generally, three or four channels of process control equipment are used for the signal processing of unit parameters measured by the field instruments.
| |
| The process control equipment provides signal conditioning, comparable output signals for instruments located on the main control board, and comparison of measured input signals with setpoints established by safety analyses.
| |
| These setpoints are defined in UFSAR, Chapter 6 (Ref. 1), Chapter 7 (Ref. 2), and Chapter 15 (Ref. 3). If the measured value of a unit parameter exceeds the predetermined setpoint, an output from a bistable is forwarded to the SSPS for decision logic processing.
| |
| Channel separation is maintained up to and through the input bays. However, not all unit parameters require four channels of sensor measurement and signal processing.
| |
| Some unit parameters provide input only to the SSPS, while others provide input to the SSPS, the main control board, the unit computer, and one or more control systems.Generally, if a parameter is used only for input to the protection circuits, three channels with a two-out-of-three logic are sufficient to provide the required reliability and redundancy.
| |
| If one channel fails in a direction that would not result in a partial Function trip, the Function is still OPERABLE with a two-out-of-two logic. If one channel fails such that a partial Function trip occurs, a trip will not occur and the Function is still OPERABLE with a one-out-of-two logic.Generally, if a parameter is used for input to the SSPS and a control function, four channels with a two-out-of-four logic are sufficient to provide the required reliability and redundancy.
| |
| The circuit must be able to withstand both an input failure to the control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation.
| |
| Again, a single failure will neither cause nor prevent the protection function actuation.
| |
| These requirements are described in IEEE-279-1971 (Ref. 4). The actual number of channels required for each unit parameter is specified in the UFSAR.Trip Setpoints and Allowable Values The NOMINAL TRIP SETPOINTS are the nominal values at which the bistables are set. Any bistable is considered to be properly adjusted when the "as left" value is within the band for CHANNEL CALIBRATION tolerance.
| |
| McGuire Unit 1 B 3.3.2-2 Revision No. 119 UNI'I 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during I EOC21. It is scheduled to be implemented on Unit 2 during the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES BACKGROUND (continued)
| |
| The NOMINAL TRIP SETPOINTS used in the bistables are based on the analytical limits (Ref. 1, 2, and 3). The selection of these NOMINAL TRIP SETPOINTS is such that adequate protection is provided when all sensor and processing time delays, calibration tolerances, instrumentation uncertainties, instrument drift, and severe environment errors for those ESFAS channels that must function in harsh environments as defined by 10 CFR 50.49 (Ref. 5) are taken into account. The actual as-left Setpoint entered into the bistable assures that the actual trip occurs before the Allowable Value is reached. The Allowable Value accounts for changes in random measurement errors detectable by a COT. One example of such a change in measurement error is drift during the surveillance interval.
| |
| If the point at which the loop trips does not exceed the Allowable Value, the loop is considered OPERABLE.A trip within the Allowable Value ensures that the consequences of Design Basis Accidents (DBAs) will be acceptable, providing the unit is operated from within the LCOs at the onset of the DBA and the equipment functions as designed.Each channel can be tested on line to verify that the signal processing equipment and setpoint accuracy is within the specified allowance requirements.
| |
| Once a designated channel is taken out of service for testing, a simulated signal is injected in place of the field instrument signal. The process equipment for the channel in test is then tested, verified, and calibrated.
| |
| SRs for the channels are specified in the SR section.The NOMINAL TRIP SETPOINTS and Allowable Values listed in Table 3.3.2-1 incorporates all of the known uncertainties applicable for each channel. The magnitudes of these uncertainties are factored into the determination of each NOMINAL TRIP SETPOINT.
| |
| All field sensors and signal processing equipment for these channels are assumed to operate within the allowances of these uncertainty magnitudes.
| |
| Solid State Protection System The SSPS equipment is used for the decision logic processing of outputs from the signal processing equipment bistables.
| |
| To meet the redundancy requirements, two trains of SSPS, each performing the same functions, are provided.
| |
| If one train is taken out of service for maintenance or test purposes, the second train will provide ESF actuation for the unit. If both trains are taken out of service or placed in test, a reactor trip will result.Each train is packaged in its own cabinet for physical and electrical separation to satisfy separation and independence requirements.
| |
| McGuire Unit 1 B 3.3.2-3 Revision No. 119 UNIV I -License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during IEOC21. It is scheduled to be implemented on Unit 2 during the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES BACKGROUND (continued)
| |
| The SSPS performs the decision logic for most ESF equipment actuation; generates the electrical output signals that initiate the required actuation; and provides the status, permissive, and annunciator output signals to the main control room of the unit.The bistable outputs from the signal processing equipment are sensed by the SSPS equipment and combined into logic matrices that represent combinations indicative of various transients.
| |
| If a required logic matrix combination is completed, the system will send actuation signals via master and slave relays to those components whose aggregate Function best serves to alleviate the condition and restore the unit to a safe condition.
| |
| Examples are given in the Applicable Safety Analyses, LCO, and Applicability sections of this Bases.Each SSPS train has a built in testing device that can test the decision logic matrix functions and the actuation devices while the unit is at power.When any one train is taken out of service for testing, the other train is capable of providing unit monitoring and protection until the testing has been completed.
| |
| The testing device is semiautomatic to minimize testing time.The actuation of ESF components is accomplished through master and slave relays. The SSPS energizes the master relays appropriate for the condition of the unit. Each master relay then energizes one or more slave relays, which then cause actuation of the end devices. The master and slave relays are routinely tested to ensure operation.
| |
| The test of the master relays energizes the relay, which then operates the contacts and applies a low voltage to the associated slave relays. The low voltage is not sufficient to actuate the slave relays but only demonstrates signal path continuity.
| |
| The SLAVE RELAY TEST actuates the devices if their operation will not interfere with continued unit operation.
| |
| For the latter case, actual component operation is prevented by the SLAVE RELAY TEST circuit, and slave relay contact operation is verified by a continuity check of the circuit containing the slave relay.APPLICABLE Each of the analyzed accidents can be detected by one or more ESFAS SAFETY ANALYSES, Functions.
| |
| One of the ESFAS Functions is the primary actuation signal LCO, and for that accident.
| |
| An ESFAS Function may be the primary actuation APPLICABILITY signal for more than one type of accident.
| |
| An ESFAS Function may also be a secondary, or backup, actuation signal for one or more other accidents.
| |
| Functions such as manual initiation, not specifically credited in the accident safety analysis, McGuire Unit 1 B 3.3.2-4 Revision No. 119 UNIT I -License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during IEOC21. It is scheduled to be implemented on Unit 2 during the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) are qualitatively credited in the safety analysis and the NRC staff approved licensing basis for the unit. These Functions may provide protection for conditions that do not require dynamic transient analysis to demonstrate Function performance.
| |
| These Functions may also serve as backups to Functions that were credited in the accident analysis (Ref. 3).The LCO requires all instrumentation performing an ESFAS Function to be OPERABLE.
| |
| Failure of any instrument renders the affected channel(s) inoperable and reduces the reliability of the affected Functions.
| |
| The LCO generally requires OPERABILITY of three or four channels in each instrumentation function and two channels in each logic and manual initiation function.
| |
| The two-out-of-three and the two-out-of-four configurations allow one channel to be tripped during maintenance or testing without causing an ESFAS initiation.
| |
| Two logic or manual initiation channels are required to ensure no single random failure disables the ESFAS.The required channels of ESFAS instrumentation provide unit protection in the event of any of the analyzed accidents.
| |
| ESFAS protection functions are as follows: 1. Safety Injection Safety Injection (SI) provides two primary functions:
| |
| : 1. Primary side water addition to ensure maintenance or recovery of reactor vessel water level (coverage of the active fuel for heat removal, clad integrity, and for limiting peak clad temperature to < 22001F); and 2. Boration to ensure recovery and maintenance of SDM (keff < 1.0).These functions are necessary to mitigate the effects of high energy line breaks (HELBs) both inside and outside of containment.
| |
| The SI signal is also used to initiate other Functions such as: Phase A Isolation;
| |
| * Containment Purge and Exhaust Isolation; McGuire Unit 1 B 3.3.2-5 Revision No. 119 UNII' 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during I EOC21. It is scheduled to be implemented on Unit 2 during the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| * Reactor Trip;* Turbine Trip;* Feedwater Isolation;
| |
| * Start of motor driven auxiliary feedwater (AFW) pumps;* Control room area ventilation isolation;
| |
| * Enabling automatic switchover of Emergency Core Cooling Systems (ECCS) suction to containment sump;* Start of annulus ventilation system filtration trains;* Start of auxiliary building filtered ventilation exhaust system trains;* Start of diesel generators;
| |
| * Start of nuclear service water system pumps; and* Start of component cooling water system pumps.These other functions ensure: 0 Isolation of nonessential systems through containment penetrations; 0 Trip of the turbine and reactor to limit power generation; 0 Isolation of main feedwater (MFW) to limit secondary side mass losses;* Start of AFW to ensure secondary side cooling capability;
| |
| * Isolation of the control room to ensure habitability;
| |
| * Enabling ECCS suction from the refueling water storage tank (RWST) switchover on low RWST level to ensure continued cooling via use of the containment sump;* Starting of annulus ventilation and auxiliary building filtered ventilation to limit offsite releases;McGuire Unit 1 B 3.3.2-6 Revision No. 119 UNII I -License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during IEOC21. It is scheduled to be implemented on Unit 2 during the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| Starting of diesel generators for loss of offsite power considerations; and Starting of component cooling water and nuclear service water systems for heat removal.a. Safety Iniection-Manual Initiation The LCO requires one channel per train to be OPERABLE.The operator can initiate SI at any time by using either of two switches in the control room. This action will cause actuation of all components in the same manner as any of the automatic actuation signals.The LCO for the Manual Initiation Function ensures the proper amount of redundancy is maintained in the manual ESFAS actuation circuitry to ensure the operator has manual ESFAS initiation capability.
| |
| Each train consists of one push button and the interconnecting wiring to the actuation logic cabinet. This configuration does not allow testing at power.b. Safety Iniection-Automatic Actuation Logic and Actuation Relays This LCO requires two trains to be OPERABLE.
| |
| Actuation logic consists of all circuitry housed within the actuation subsystems, including the initiating relay contacts responsible for actuating the ESF equipment.
| |
| Manual and automatic initiation of SI must be OPERABLE in MODES 1, 2, and 3. In these MODES, there is sufficient energy in the primary and secondary systems to warrant automatic initiation of ESF systems. In MODE 4, adequate time is available to manually actuate required components in the event of a DBA, but because of the large number of components actuated on a SI, actuation is simplified by the use of the manual actuation push buttons. Automatic actuation logic and actuation relays must be OPERABLE in MODE 4 to support system level manual initiation.
| |
| McGuire Unit 1 B 3.3.2-7 Revision No. 119 UNI4i I -License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during IEOC21. It is scheduled to be implemented on Unit 2 during the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| These Functions are not required to be OPERABLE in MODES 5 and 6 because there is adequate time for the operator to evaluate unit conditions and respond by manually starting individual systems, pumps, and other equipment to mitigate the consequences of an abnormal condition or accident.
| |
| Unit pressure and temperature are very low and many ESF components are administratively locked out or otherwise prevented from actuating to prevent inadvertent overpressurization of unit systems.c. Safety Iniection-Containment Pressure-High This signal provides protection against the following accidents:
| |
| SLB inside containment;
| |
| * LOCA; and Feed line break inside containment.
| |
| Containment Pressure-High provides no input to any control functions.
| |
| Thus, three OPERABLE channels are sufficient to satisfy protective requirements with a two-out-of-three logic.Containment Pressure-High must be OPERABLE in MODES 1, 2, and 3 when there is sufficient energy in the primary and secondary systems to pressurize the containment following a pipe break. In MODES 4, 5, and 6, there is insufficient energy in the primary or secondary systems to pressurize the containment.
| |
| : d. Safety Iniection-Pressurizer Pressure-Low Low This signal provides protection against the following accidents:
| |
| Inadvertent opening of a steam generator (SG) relief or safety valve;* SLB;A spectrum of rod cluster control assembly ejection accidents (rod ejection);
| |
| McGuire Unit 1 B 3.3.2-8 Revision No. 119 UNII 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit 1 only during I EOC2 1. It is scheduled to be implemented on Unit 2 during the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| Inadvertent opening of a pressurizer relief or safety valve;LOCAs; and SG Tube Rupture.Pressurizer pressure provides both control and protection functions:
| |
| input to the Pressurizer Pressure Control System, reactor trip, and SI. Therefore, the actuation logic must be able to withstand both an input failure to control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation.
| |
| Thus, four OPERABLE channels are required to satisfy the requirements with a two-out-of-four logic.This Function must be OPERABLE in MODES 1, 2, and 3 (above P-11) to mitigate the consequences of an HELB inside containment.
| |
| This signal may be manually blocked by the operator below the P-1 1 setpoint.
| |
| Automatic SI actuation below this pressure setpoint is then performed by the Containment Pressure-High signal.This Function is not required to be OPERABLE in MODE 3 below the P-1 1 setpoint.
| |
| Other ESF functions are used to detect accident conditions and actuate the ESF systems in this MODE. In MODES 4, 5, and 6, this Function is not needed for accident detection and mitigation.
| |
| : 2. Containment Spray Containment Spray provides two primary functions:
| |
| : 1. Lowers containment pressure and temperature after an HELB in containment; and 2. Reduces the amount of radioactive iodine in the containment atmosphere.
| |
| These functions are necessary to: Ensure the pressure boundary integrity of the containment structure; and McGuire Unit 1 B 3.3.2-9 Revision No. 119 UNII 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during IEOC21. It is scheduled to be implemented on Unit 2 during the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| Limit the release of radioactive iodine to the environment in the event of a failure of the containment structure.
| |
| After the RHR pumps have been aligned for containment sump recirculation, containment spray pumps are aligned to the sump.Once adequate sump level and containment pressure above 3 PSIG have been confirmed, one spray pump is manually started.The second train of containment spray is available in the event of the failure of the first train.3. Containment Isolation Containment Isolation provides isolation of the containment atmosphere, and all process systems that penetrate containment, from the environment.
| |
| This Function is necessary to prevent or limit the release of radioactivity to the environment in the event of a large break LOCA.There are two separate Containment Isolation signals, Phase A and Phase B. Phase A isolation isolates all automatically isolable process lines, except component cooling water (CCW) and Nuclear Service Water System (NSWS) to RCP motor air coolers, at a relatively low containment pressure indicative of primary or secondary system leaks. For these types of events, forced circulation cooling using the reactor coolant pumps (RCPs) and SGs is the preferred (but not required) method of decay heat removal. Since CCW and NSWS are required to support RCP operation, not isolating CCW and NSWS on the low pressure Phase A signal enhances unit safety by allowing operators to use forced RCS circulation to cool the unit. Isolating CCW and NSWS on the low pressure signal may force the use of feed and bleed cooling, which could prove more difficult to control.Phase A containment isolation is actuated automatically by SI, or manually via the actuation circuitry.
| |
| All process lines penetrating containment, with the exception of CCW and NSWS are isolated.CCW is not isolated at this time to permit continued operation of the RCPs with cooling water flow to the thermal barrier heat exchangers and air or oil coolers. All process lines not equipped with remote operated isolation valves are manually closed, or otherwise isolated, prior to reaching MODE 4.McGuire Unit 1 B 3.3.2-10 Revision No. 119 UN11 1 -License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during I EOC2 1. It is scheduled to be implemented on Unit 2 during the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| Manual Phase A Containment Isolation is accomplished by either of two switches in the control room. Either switch actuates its associated train.The Phase B signal isolates CCW and NSWS. This occurs at a relatively high containment pressure that is indicative of a large break LOCA or an SLB. For these events, forced circulation using the RCPs is no longer desirable.
| |
| Isolating the CCW and NSWS at the higher pressure does not pose a challenge to the containment boundary because the CCW System and NSWS are closed loops inside containment.
| |
| Although some system components do not meet all of the ASME Code requirements applied to the containment itself, the systems are continuously pressurized to a pressure greater than the Phase B setpoint.
| |
| Thus, routine operation demonstrates the integrity of the system pressure boundary for pressures exceeding the Phase B setpoint.Furthermore, because system pressure exceeds the Phase B setpoint, any system leakage prior to initiation of Phase B isolation would be into containment.
| |
| Therefore, the combination of CCW System and NSWS design and Phase B isolation ensures there is not a potential path for radioactive release from containment.
| |
| Phase B containment isolation is actuated by Containment Pressure-High High, or manually, via the automatic actuation logic, as previously discussed.
| |
| For containment pressure to reach a value high enough to actuate Containment Pressure-High High, a LOCA or SLB must have occurred.
| |
| RCP operation will no longer be required and CCW to the RCPs and NSWS to the RCP motor coolers is, therefore, no longer necessary.
| |
| The RCPs can be operated with seal injection flow alone and without CCW flow to the thermal barrier heat exchanger.
| |
| McGuire Unit 1 B 3.3.2-11 Revision No. 119 UNHI I -License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during IEOC21. It is scheduled to be implemented on Unit 2 during the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| Manual Phase B Containment Isolation is accomplished by pushbuttons on the Main Control Board.a. Containment Isolation-Phase A Isolation (1) Phase A Isolation-Manual Initiation Manual Phase A Containment Isolation is actuated by either of two switches in the control room. Either switch actuates both trains.(2) Phase A Isolation-Automatic Actuation Logic and Actuation Relays Automatic Actuation Logic and Actuation Relays consist of the same features and operate in the same manner as described for ESFAS Function 1 .b.Manual and automatic initiation of Phase A Containment Isolation must be OPERABLE in MODES 1, 2, and 3, when there is a potential for an accident to occur. In MODE 4, adequate time is available to manually actuate required components in the event of a DBA, but because of the large number of components actuated on a Phase A Containment Isolation, actuation is simplified by the use of the manual actuation push buttons. Automatic actuation logic and actuation relays must be OPERABLE in MODE 4 to support system level manual initiation.
| |
| In MODES 5 and 6, there is insufficient energy in the primary or secondary systems to pressurize the containment to require Phase A Containment Isolation.
| |
| There also is adequate time for the operator to evaluate unit conditions and manually actuate individual isolation valves in response to abnormal or accident conditions.
| |
| McGuire Unit 1 B 3.3.2-12 Revision No. 119 UNI'fI 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during I EOC21. It is scheduled to be implemented on Unit 2 during the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| (3) Phase A Isolation-Safety Injection Phase A Containment Isolation is also initiated by all Functions that initiate SI. The Phase A Containment Isolation requirements for these Functions are the same as the requirements for their Sl function.Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all initiating Functions and requirements.
| |
| : b. Containment Isolation-Phase B Isolation Phase B Containment Isolation is accomplished by Manual Initiation, Automatic Actuation Logic and Actuation Relays, and by Containment Pressure channels The Containment Pressure trip of Phase B Containment Isolation is energized to trip in order to minimize the potential of spurious trips that may damage the RCPs.(1) Phase B Isolation-Manual Initiation (2) Phase B Isolation-Automatic Actuation Logic and Actuation Relays Manual and automatic initiation of Phase B containment isolation must be OPERABLE in MODES 1, 2, and 3, when there is a potential for an accident to occur. In MODE 4, adequate time is available to manually actuate required components in the event of a DBA. However, because of the large number of components actuated on a Phase B containment isolation, actuation is simplified by the use of the manual actuation push buttons. Automatic actuation logic and actuation relays must be OPERABLE in MODE 4 to support system level manual initiation.
| |
| In MODES 5 and 6, there is insufficient energy in the primary or secondary systems to pressurize the containment to require McGuire Unit 1 B 3.3.2-13 Revision No. 119 UNJ'I 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during I EOC2 1. It is scheduled to be implemented on Unit 2 during the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| Phase B containment isolation.
| |
| There also is adequate time for the operator to evaluate unit conditions and manually actuate individual isolation valves in response to abnormal or accident conditions.
| |
| (3) Phase B Isolation-Containment Pressure -High High The basis for containment pressure MODE applicability is as discussed for ESFAS Function 2.c above.4. Steam Line Isolation Isolation of the main steam lines provides protection in the event of an SLB inside or outside containment.
| |
| Rapid isolation of the steam lines will limit the steam break accident to the blowdown from one SG, at most. For an SLB upstream of the main steam isolation valves (MSIVs), inside or outside of containment, closure of the MSIVs limits the accident to the blowdown from only the affected SG. For an SLB downstream of the MSIVs, closure of the MSIVs terminates the accident as soon as the steam lines depressurize.
| |
| Steam Line Isolation also mitigates the effects of a feed line break and ensures a source of steam for the turbine driven AFW pump during a feed line break.a. Steam Line Isolation-Manual Initiation Manual initiation of Steam Line Isolation can be accomplished from the control room. There are two system level switches in the control room and either switch can initiate action to immediately close all MSIVs. The LCO requires two channels to be OPERABLE.
| |
| Individual valves may also be closed using individual hand switches in the control room. The LCO requires four individual channels to be OPERABLE.b. Steam Line Isolation-Automatic Actuation Logic and Actuation Relays Automatic actuation logic and actuation relays consist of the same features and operate in the same manner as described for ESFAS Function 1.b.McGuire Unit 1 B 3.3.2-14 Revision No. 119 UNI' I -License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during IEOC21. It is scheduled to be implemented on Unit 2 during the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| Manual and automatic initiation of steam line isolation must be OPERABLE in MODES 1, 2, and 3 when there is sufficient energy in the RCS and SGs to have an SLB or other accident.
| |
| This could result in the release of significant quantities of energy and cause a cooldown of the primary system. The Steam Line Isolation Function is required in MODES 2 and 3 unless all MSIVs are closed and de-activated.
| |
| In MODES 4, 5, and 6, there is insufficient energy in the RCS and SGs to experience an SLB or other accident releasing significant quantities of energy.c. Steam Line Isolation-Containment Pressure-High Hiqh This Function actuates closure of the MSIVs in the event of a LOCA or an SLB inside containment to maintain three unfaulted SGs as a heat sink for the reactor, and to limit the mass and energy release to containment.
| |
| The Containment Pressure -High High function is described in ESFAS Function 2.C.Containment Pressure-High High must be OPERABLE in MODES 1, 2, and 3, when there is sufficient energy in the primary and secondary side to pressurize the containment following a pipe break. This would cause a significant increase in the containment pressure, thus allowing detection and closure of the MSIVs. The Steam Line Isolation Function remains OPERABLE in MODES 2 and 3 unless all MSIVs are closed and de-activated.
| |
| In MODES 4, 5, and 6, there is not enough energy in the primary and secondary sides to pressurize the containment to the Containment Pressure-High High setpoint.d. Steam Line Isolation-Steam Line Pressure (1) Steam Line Pressure-Low Steam Line Pressure-Low provides closure of the MSIVs in the event of an SLB to maintain three unfaulted SGs as a heat sink for the reactor, and to limit the mass and energy release to containment.
| |
| This Function provides closure of the MSIVs in the event of a feed line break to ensure a supply of steam for the turbine driven AFW pump.McGuire Unit 1 B 3.3.2-15 Revision No. 119 UNIT I -License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during I EOC2 I. It is scheduled to be implemented on Unit 2 during the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| Steam Line Pressure-Low Function must be OPERABLE in MODES 1, 2, and 3 (above P-11), with any main steam valve open, when a secondary side break or stuck open valve could result in the rapid depressurization of the steam lines. This signal may be manually blocked by the operator below the P-11 setpoint.
| |
| Below P-1 1, an inside containment SLB will be terminated by automatic actuation via Containment Pressure-High High. Stuck valve transients and outside containment SLBs will be terminated by the Steam Line Pressure-Negative Rate-High signal for Steam Line Isolation below P-1 1 when Steam Line Isolation Steam Line Pressure-Low has been manually blocked. The Steam Line Isolation Function is required in MODES 2 and 3 unless all MSIVs are closed and de-activated.
| |
| This Function is not required to be OPERABLE in MODES 4, 5, and 6 because there is insufficient energy in the secondary side of the unit to have an accident.(2) Steam Line Pressure-Negative Rate-High Steam Line Pressure-Negative Rate-High provides closure of the MSIVs for an SLB when less than the P-1 1 setpoint, to maintain at least one unfaulted SG as a heat sink for the reactor, and to limit the mass and energy release to containment.
| |
| When the operator manually blocks the Steam Line Pressure-Low main steam isolation signal when less than the P-1 1 setpoint, the Steam Line Pressure-Negative Rate-High signal is automatically enabled. Steam Line Pressure-Negative Rate-High provides no input to any control functions.
| |
| Thus, three OPERABLE channels are sufficient to satisfy requirements with a two-out-of-three logic on each steam line.Steam Line Pressure-Negative Rate-High must be OPERABLE in MODE 3 when less than the P-1 1 setpoint, when a secondary side break or stuck open valve could result in the rapid depressurization of the steam line(s). In MODES 1 and 2, and in MODE 3, when above the P-i 1 setpoint, this signal is automatically disabled and the Steam Line Pressure-Low signal is automatically enabled. The Steam Line Isolation Function is required to be OPERABLE in McGuire Unit 1 B 3.3.2-16 Revision No. 119 UNII I -License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during I EOC21. It is scheduled to be implemented on Unit 2 during the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| MODES 2 and 3 unless all MSIVs are closed and de-activated.
| |
| In MODES 4, 5, and 6, there is insufficient energy in the primary and secondary sides to have an SLB or other accident that would result in a release of significant enough quantities of energy to cause a cooldown of the RCS.5. Turbine Trip and Feedwater Isolation The primary functions of the Turbine Trip and Feedwater Isolation signals are to prevent damage to the turbine due to water in the steam lines, stop the excessive flow of feedwater into the SGs, and to limit the energy released into containment.
| |
| These Functions are necessary to mitigate the effects of a high water level in the SGs, which could result in carryover of water into the steam lines and excessive cooldown of the primary system. The SG high water level is due to excessive feedwater flows. Feedwater isolation serves to limit the energy released into containment upon a feedwater line or steam line break inside containment.
| |
| The Functions are actuated when the level in any SG exceeds the high high setpoint, and performs the following functions:
| |
| * Trips the main turbine;* Trips the MFW pumps; and Initiates feedwater isolation (shuts the MFW control valves, bypass feedwater control valves, feedwater isolation valves, and the MFW to AFW nozzle bypass valves).Turbine Trip and Feedwater Isolation signals are both actuated by SG Water Level-High High, or by an SI signal. The RTS also initiates a turbine trip signal whenever a reactor trip (P-4) is generated.
| |
| A Feedwater Isolation signal is also generated by a reactor trip (P-4)coincident with Tavg-Low and on a high water level in the reactor building doghouse.
| |
| The MFW System is also taken out of operation and the AFW System is automatically started. The SI signal was discussed previously.
| |
| : a. Turbine Trip (1) Turbine Trip-Automatic Actuation Logic and Actuation Relays Automatic Actuation Logic and Actuation Relays consist of McGuire Unit 1 B 3.3.2-17 Revision No. 119 UNII 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit 1 only during I EOC2 1. It is scheduled to be implemented on Unit 2 during the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) the same features and operate in the same manner as described for ESFAS Function 1.b.(2) Turbine Trip-Steam Generator Water Level-High High (P-14)This signal prevents damage to the turbine due to water in the steam lines. The ESFAS SG water level instruments provide input to the SG Water Level Control System. Therefore, the actuation logic must be able to withstand both an input failure to the control system (which may then require the protection function actuation) and a single failure in the other channels providing the protection function actuation.
| |
| Only three protection channels are necessary to satisfy the protective requirements.
| |
| The setpoints are based on percent of narrow range instrument span.(3) Turbine Trip-Safety Injection Turbine Trip is also initiated by all Functions that initiate SI. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead Function 1, SI, is referenced for all initiating functions and requirements.
| |
| Item 5.a.(1) is referenced for the applicable MODES.The Turbine Trip Function must be OPERABLE in MODES 1 and 2. In lower MODES, the turbine generator is not in service and this Function is not required to be OPERABLE.b. Feedwater Isolation (1) Feedwater Isolation-Automatic Actuation Logic and Actuation Relays Automatic Actuation Logic and Actuation Relays consist of the same features and operate in the same APPLICABLE manner as described for ESFAS Function 1.b.McGuire Unit 1 B 3.3.2-18 Revision No. 119 UNII 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during 1EOC21. It is scheduled to be implemented on Unit 2 during the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| (2) Feedwater Isolation-Steam Generator Water Level-High High (P-14)This signal provides protection against excessive feedwater flow. The ESFAS SG water level instruments provide input to the SG Water Level Control System. Therefore, the actuation logic must be able to withstand both an input failure to the control system (which may then require the protection function actuation) and a single failure in the other channels providing the protection function actuation.
| |
| Only three protection channels are necessary to satisfy the protective requirements.
| |
| The setpoints are based on percent of narrow range instrument span.(3) Feedwater Isolation-Safety Iniection Feedwater Isolation is also initiated by all Functions that initiate SI. The Feedwater Isolation Function requirements for these Functions are the same as the requirements for their SI function.
| |
| Therefore, the requirements are not repeated in Table 3.3.2-1.Instead Function 1, SI, is referenced for all initiating functions and requirements.
| |
| Item 5.b.(1) is referenced for the applicable MODES.(4) Feedwater Isolation
| |
| -RCS TVa-Low Coincident With Reactor Trip (P-4)This signal provides protection against excessive cooldown, which could subsequently introduce a positive reactivity excursion after a plant trip. There are four channels of RCS Tavg-Low (one per loop), with a two-out-of-four logic required coincident with a reactor trip signal (P-4) to initiate a feedwater isolation.
| |
| The P-4 interlock is discussed in Function 8.a.(5) Turbine Trip and Feedwater Isolation
| |
| -Doghouse Water Level -High High This signal initiates a Feedwater Isolation.
| |
| The signal terminates forward feedwater flow in the event of a postulated pipe break in the main feedwater piping in the doghouses to prevent flooding safety related equipment essential to the safe shutdown of the plant.McGuire Unit 1 B 3.3.2-19 Revision No. 119 UNIT 1 -License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during IEOC21. It is scheduled to be implemented on Unit 2 during, the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| The level instrumentation consists of six level switches (three per train) in each of the two reactor building doghouses.
| |
| A high-high level detected by two-out-of-three switches in either train in the inboard or outboard doghouse will initiate a feedwater isolation.
| |
| This signal initiates Feedwater Isolation for the specific doghouse where the High-High level is detected and trips both main feedwater pumps thus causing a main turbine trip.The Feedwater Isolation Function must be OPERABLE in MODES 1 and 2 and also in MODE 3 (except for the functions listed in Table 3.3.2-1).Feedwater Isolation is not required OPERABLE when all MFIVs, MFCVs, and associated bypass valves are closed and de-activated or isolated by a closed manual valve. In lower MODES, the MFW System is not in service and this Function is not required to be OPERABLE.6. Auxiliary Feedwater The AFW System is designed to provide a secondary side heat sink for the reactor in the event that the MFW System is not available.
| |
| The system has two motor driven pumps and a turbine driven pump, making it available during normal and accident operation.
| |
| The normal source of water for the AFW System is the non-safety related AFW Storage Tank (Water Tower). A low suction pressure to the AFW pumps will automatically realign the pump suctions to the Nuclear Service Water System (NSWS)(safety related).
| |
| The AFW System is aligned so that upon a pump start, flow is initiated to the respective SGs immediately.
| |
| : a. Auxiliary Feedwater-Automatic Actuation Logic and Actuation Relays Automatic actuation logic and actuation relays consist of the same features and operate in the same manner as described for ESFAS Function 1.b.b. Auxiliary Feedwater-Steam Generator Water Level-Low Low SG Water Level-Low Low provides protection against a loss of heat sink. A feed line break, inside or outside of containment, or a loss of MFW, would result in a loss of SG water level. SG Water Level-Low Low provides input to the SG Level Control System.McGuire Unit 1 B 3.3.2-20 Revision No. 119 UNII I -License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during I EOC2 1. It is scheduled to be implemented on Unit 2 during the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| Therefore, the actuation logic must be able to withstand both an input failure to the control system which may then require a protectionfunction actuation and a single failure in the other channels providing the protection function actuation.
| |
| Thus, four OPERABLE channels are required to satisfy the requirements with two-out-of-four logic. The setpoints are based on percent of narrow range instrument span.SG Water Level -Low Low in any operating SG will cause the motor driven AFW pumps to start. The system is aligned so that upon a start of the pump, water immediately begins to flow to the SGs. SG Water Level -Low Low in any two operating SGs will cause the turbine driven pumps to start.c. Auxiliary Feedwater-Safety Iniection An SI signal starts the motor driven AFW pumps. The AFW initiation functions are the same as the requirements for their SI function.
| |
| Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all initiating functions and requirements.
| |
| : d. Auxiliary Feedwater-Station Blackout A loss of power or degraded voltage to the service buses will be accompanied by a loss of reactor coolant pumping power and the subsequent need for some method of decay heat removal. The loss of power or degraded voltage is detected by a voltage drop on each essential service bus. Loss of power or degraded voltage to either essential service bus will start the turbine driven and motor driven AFW pumps to ensure that at least two SGs contain enough water to serve as the heat sink for reactor decay heat and sensible heat removal following the reactor trip. The turbine driven pump does not start on a loss of power coincident with a SI signal.Functions 6.a through 6.d must be OPERABLE in MODES 1, 2, and 3 to ensure that the SGs remain the heat sink for the reactor. These Functions do not have to be OPERABLE in MODES 5 and 6 because there is not enough heat being generated in the reactor to require the SGs as a heat sink. In MODE 4, AFW actuation does not need to be OPERABLE because either AFW or residual heat removal (RHR) will already be in operation to remove decay heat or sufficient time is available to manually place either system in operation.
| |
| McGuire Unit 1 B 3.3.2-21 Revision No. 119 UNII 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during IEOC21. It is scheduled to be implemented on Unit 2 during the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| : e. Auxiliary Feedwater-Trip of All Main Feedwater Pumps A Trip of all MFW pumps is an indication of a loss of MFW and the subsequent need for some method of decay heat and sensible heat removal to bring the reactor back to no load temperature and pressure.
| |
| Two contacts are provided in series (one from each MFW pump) in the starting circuit for each AFW pump. A trip of all MFW pumps closes both contacts and starts the motor driven AFW pumps to ensure that at least two SGs are available with water to act as the heat sink for the reactor. This function must be OPERABLE in MODES 1 and 2. This ensures that at least two SGs are provided with water to serve as the heat sink to remove reactor decay heat and sensible heat in the event of an accident.In MODES 3, 4, and 5, the MFW pumps are normally shut down, and thus neither pump trip is indicative of a condition requiring automatic AFW initiation.
| |
| : f. Auxiliary Feedwater-Pump Suction Transfer on Suction Pressure-Low A low pressure signal in the AFW pump suction line protects the AFW pumps against a loss of the normal supply of water for the pumps, the non-safety related AFW Storage Tank (Water Tower).Two pressure switches per train are located on the AFW pump suction line. The turbine driven AFW pump has a total of four switches.
| |
| A low pressure signal sensed by two-out-of-two switches on either train will cause the emergency supply of water for the pump to be aligned. The NSWS (safety grade) is then lined up to supply the AFW pumps to ensure an adequate supply of water for the AFW System to maintain at least two of the SGs as the heat sink for reactor decay heat and sensible heat removal.This Function must be OPERABLE in MODES 1, 2, and 3 to ensure a safety grade supply of water for the AFW System to maintain the SGs as the heat sink for the reactor. This Function does not have to be OPERABLE in MODES 5 and 6 because there is not enough heat being generated in the reactor to require the SGs as a heat sink. In MODE 4, AFW automatic suction transfer does not need to be OPERABLE because RHR will already be in operation, or sufficient time is available to place RHR in operation, to remove decay heat.McGuire Unit 1 B 3.3.2-22 Revision No. 119 UNIHI 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during IEOC21. It is scheduled to be implemented on Unit 2 during the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| : 7. Automatic Switchover to Containment Sump At the end of the injection phase of a LOCA, the RWST will be nearly empty. Continued cooling must be provided by the ECCS to remove decay heat. The source of water for the ECCS pumps is automatically switched to the containment recirculation sump. The low head residual heat removal (RHR) pumps and containment spray pumps draw the water from the containment recirculation sump, the RHR pumps pump the water through the RHR heat exchanger, inject the water back into the RCS, and supply the cooled water to the other ECCS pumps.Switchover from the RWST to the containment sump must occur before the RWST empties to prevent damage to the RHR pumps and a loss of core cooling capability.
| |
| : a. Automatic Switchover to Containment Sump-Refueling Water Storage Tank (RWST)Level-Low Coincident With Safety Iniection During the injection phase of a LOCA, the RWST is the source of water for all ECCS pumps. A low level in the RWST coincident with an SI signal provides protection against a loss of water for the ECCS pumps and indicates the end of the injection phase of the LOCA. The RWST is equipped with three level transmitters.
| |
| These transmitters provide no control functions.
| |
| Therefore, a two-out-of-three logic is adequate to initiate the protection function actuation.
| |
| Automatic switchover occurs only if the RWST low level signal is coincident with SI. This prevents accidental switchover during normal operation.
| |
| Accidental switchover could damage ECCS pumps if they are attempting to take suction from an empty sump.The automatic switchover Function requirements for the SI Functions are the same as the requirements for their SI function.Therefore, the requirements are not repeated in Table 3.3.2-1.Instead, Function 1, SI, is referenced for all initiating Functions and requirements.
| |
| These Functions must be OPERABLE in MODES 1, 2, and 3 when there is a potential for a LOCA to occur, to ensure a continued supply of water for the ECCS pumps. These Functions are not required to be OPERABLE in MODES 4, 5, and 6 because McGuire Unit 1 B 3.3.2-23 Revision No. 119 UNII 1 -License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I pol during IEOC21. It is scheduled to be implemented on Unit 2 during the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) there is adequate time for the operator to evaluate unit conditions and respond by manually starting systems, pumps, and other equipment to mitigate the consequences of an abnormal condition or accident.
| |
| System pressure and temperature are very low and many ESF components are administratively locked out or otherwise prevented from actuating to prevent inadvertent overpressurization of unit systems.8. Enqineered Safety Feature Actuation System Interlocks To allow some flexibility in unit operations, several interlocks are included as part of the ESFAS. These interlocks permit the operator to block some signals, automatically enable other signals, prevent some actions from occurring, and cause other actions to occur. The interlock Functions back up manual actions to ensure bypassable functions are in operation under the conditions assumed in the safety analyses.a. Engqineered Safety Feature Actuation System Interlocks-Reactor Trip, P-4 The P-4 interlock is enabled when a reactor trip breaker (RTB) and its associated bypass breaker is open. Operators are able to reset SI 60 seconds after initiation.
| |
| If a P-4 is present when SI is reset, subsequent automatic SI initiation will be blocked until the RTBs have been manually closed. This Function allows operators to take manual control of SI systems after the initial phase of injection is complete while avoiding multiple SI initiations.
| |
| The functions of the P-4 interlock are:* Trip the main turbine;* Isolate MFW with coincident low Tavg;0 Prevent reactuation of SI after a manual reset of SI; and* Prevent opening of the MFW isolation valves if they were closed on SI or SG Water Level-High High.McGuire Unit 1 B 3.3.2-24 Revision No. 119 UNI4' I -License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during I EOC2 1. It is scheduled to be implemented on Unit 2 during the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| Each of the above Functions is interlocked with P-4 to avert or reduce the continued cooldown of the RCS following a reactor trip.An excessive cooldown of the RCS following a reactor trip could cause an insertion of positive reactivity with a subsequent increase in generated power. To avoid such a situation, the noted Functions have been interlocked with P-4 as part of the design of the unit control and protection system.None of the noted Functions serves a mitigation function in the unit licensing basis safety analyses.
| |
| Only the turbine trip Function is explicitly assumed since it is an immediate consequence of the reactor trip Function.
| |
| Neither turbine trip, nor any of the other three Functions associated with the reactor trip signal, is required to show that the unit licensing basis safety analysis acceptance criteria are not exceeded.The RTB position switches that provide input to the P-4 interlock only function to energize or de-energize or open or close contacts.Therefore, this Function has no adjustable trip setpoint with which to associate a Trip Setpoint and Allowable Value.This Function must be OPERABLE in MODES 1, 2, and 3 when the reactor may be critical or approaching criticality.
| |
| This Function does not have to be OPERABLE in MODE 4, 5, or 6 because the main turbine, the MFW System are not in operation.
| |
| : b. Engqineered Safety Feature Actuation System Interlocks-Pressurizer Pressure, P-i 1 The P-11 interlock permits a normal unit cooldown and depressurization without actuation of SI or main steam line isolation.
| |
| With two-out-of-three pressurizer pressure channels (discussed previously) less than the P-1 1 setpoint, the operator can manually block the Pressurizer Pressure-Low SI signal and the Steam Line Pressure-Low steam line isolation signal (previously discussed).
| |
| McGuire Unit I B 3.3.2-25 Revision No. 119 UNII I -License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during IEOC21. It is scheduled to be implemented on Unit 2 during the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| When the Steam Line Pressure-Low steam line isolation signal is manually blocked, a main steam isolation signal on Steam Line Pressure-Negative Rate-High is enabled. This provides protection for an SLB by closure of the MSIVs. With two-out-of-three pressurizer pressure channels above the P-1 1 setpoint, the Pressurizer Pressure-Low SI signal and the Steam Line Pressure-Low steam line isolation signal are automatically enabled. The operator can also enable these trips by use of the respective manual reset buttons. When the Steam Line Pressure-Low steam line isolation signal is enabled, the main steam isolation on Steam Line Pressure-Negative Rate-High is disabled.This Function must be OPERABLE in MODES 1, 2, and 3 to allow an orderly cooldown and depressurization of the unit without the actuation of SI or main steam isolation.
| |
| This Function does not have to be OPERABLE in MODE 4, 5, or 6 because system pressure must already be below the P-1 1 setpoint for the requirements of the heatup and cooldown curves to be met.c. Engineered Safety Feature Actuation System Interlocks-Tavo-Low Low, P-12 On increasing reactor coolant temperature, the P-12 interlock provides an arming signal to the Steam Dump System. On a decreasing temperature, the P-12 interlock removes the arming signal to the Steam Dump System to prevent an excessive cooldown of the RCS due to a malfunctioning Steam Dump System.Since Tavg is used as an indication of bulk RCS temperature, this Function meets redundancy requirements with one OPERABLE channel in each loop. These channels are used in two-out-of-four logic.This Function must be OPERABLE in MODES 1, 2, and 3 when a secondary side break or stuck open valve could result in the rapid depressurization of the steam lines. This Function does not have to be OPERABLE in MODE 4, 5, or 6 because there is insufficient energy in the secondary side of the unit to have an accident.McGuire Unit 1 B 3.3.2-26 Revision No. 119 UNIH I -License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during I EOC2 1. It is scheduled to be implemented on Unit 2 durina the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| : 9. Containment Pressure Control System Permissives The Containment Pressure Control System (CPCS) protects the Containment Building from excessive depressurization by preventing inadvertent actuation or continuous operation of the Containment Spray and Containment Air Return Systems when containment pressure is at or less than the CPCS permissive setpoint.
| |
| The control scheme of CPCS is comprised of eight independent control circuits (4 per train), each having a separate and independent pressure transmitter and current alarm module. Each pressure transmitter monitors the containment pressure and provides input to its respective current alarm. The current alarms are set to inhibit or terminate containment spray and containment air return fan operation when containment pressure falls below the setpoint.The alarm modules switch back to the permissive state (allowing the systems to operate) when containment pressure is greater than or equal to the setpoint.This function must be OPERABLE in MODES 1, 2, 3, and 4 when there is sufficient energy in the primary and secondary sides to pressurize containment following a pipe break. In MODES 5 and 6, there is insufficient energy in the primary and secondary sides to significantly pressurize the containment.
| |
| The ESFAS instrumentation satisfies Criterion 3 of 10 CFR 50.36 (Ref. 6).ACTIONS A Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed on Table 3.3.2-1. When the Required Channels in Table 3.3.2-1 are specified (e.g., on a per steam line, per loop, per SG, etc., basis), then the Condition may be entered separately for each steam line, loop, SG, etc., as appropriate.
| |
| A channel shall be OPERABLE if the point at which the channel trips is found equal to or more conservative than the Allowable Value. In the event a channel's trip setpoint is found less conservative than the Allowable Value, or the transmitter, instrument loop, signal processing electronics, or bistable is found inoperable, then all affected Functions provided by the channel must be declared inoperable and the LCO Condition(s) entered for the protection Function(s) affected.
| |
| If plant conditions warrant, the trip setpoint may be set outside the NOMINAL TRIP SETPOINT calibration tolerance band as long as the trip setpoint is conservative with respect to the NOMINAL TRIP SETPOINT.If the trip setpoint is found outside the NOMINAL TRIP SETPINT calibration tolerance band and non-conservative with respect to the NOMINAL TRIP SETPOINT, the setpoint shall be re-adjusted.
| |
| McGuire Unit 1 B 3.3.2-27 Revision No. 119 UNIV 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during IEOC21. It is scheduled to be implemented on Unit 2 during the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued)
| |
| When the number of inoperable channels in a trip function exceed those specified in one or other related Conditions associated with a trip function, then the unit is outside the safety analysis.
| |
| Therefore, LCO 3.0.3 should be immediately entered if applicable in the current MODE of operation.
| |
| A.1 Condition A applies to all ESFAS protection functions.
| |
| Condition A addresses the situation where one or more channels or trains for one or more Functions are inoperable at the same time. The Required Action is to refer to Table 3.3.2-1 and to take the Required Actions for the protection functions affected.
| |
| The Completion Times are those from the referenced Conditions and Required Actions.B.1, B.2.1 and B.2.2 Condition B applies to manual initiation of:* SI;Phase A Isolation; and Phase B Isolation.
| |
| This action addresses the train orientation of the SSPS for the functions listed above. If a channel or train is inoperable, 48 hours is allowed to return it to an OPERABLE status. Note that for containment spray and Phase B isolation, failure of one or both channels in one train renders the train inoperable.
| |
| Condition B, therefore, encompasses both situations.
| |
| The specified Completion Time is reasonable considering that there are two automatic actuation trains and another manual initiation train OPERABLE for each Function, and the low probability of an event occurring during this interval.
| |
| If the train cannot be restored to OPERABLE status, the unit must be placed in a MODE in which the LCO does not apply. This is done by placing the unit in at least MODE 3 within an additional 6 hours (54 hours total time) and in MODE 5 within an additional 30 hours (84 hours total time). The allowable Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.McGuire Unit 1 B 3.3.2-28 Revision No. 119 UNIV I -License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during I EOC21. It is scheduled to be implemented on Unit 2 during the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued)
| |
| C.1, C.2.1 and C.2.2 Condition C applies to the automatic actuation logic and actuation relays for the following functions:
| |
| * SI;Phase A Isolation; and Phase B Isolation.
| |
| This action addresses the train orientation of the SSPS and the master and slave relays. If one train is inoperable, 24 hours are allowed to restore the train to OPERABLE status. The 24 hours allowed for restoring the inoperable train to OPERABLE status is justified in Reference
| |
| : 10. The specified Completion Time is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this interval.
| |
| If the train cannot be restored to OPERABLE status, the unit must be placed in a MODE in which the LCO does not apply. This is done by placing the unit in at least MODE 3 within an additional 6 hours (30 hours total time) and in MODE 5 within an additional 30 hours (60 hours total time). The Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.The Required Actions are modified by a Note that allows one train to be bypassed for up to 4 hours for surveillance testing, provided the other train is OPERABLE.
| |
| The Required Actions are not required to be met during this time, unless the train is discovered inoperable during the testing. This allowance is based on the reliability analysis assumption of WCAP-1 0271-P-A (Ref. 7) that 4 hours is the average time required to perform train surveillance.
| |
| If an individual SSPS slave relay or slave relay contact is incapable of actuating, then the equipment operated by the slave relay or slave relay contact is inoperable.
| |
| An SSPS train is not inoperable due to an individual SSPS slave relay or slave relay contact being incapable of actuating.
| |
| D.1, D.2.1, and D.2.2 Condition D applies to: Containment Pressure-High; Pressurizer Pressure-Low Low;Steam Line Pressure-Low; McGuire Unit 1 B 3.3.2-29 Revision No. 119 UNIV I -License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit 1 only during I EOC2 I. It is scheduled to be implemented on Unit 2 during the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued)
| |
| * Steam Line Pressure-Negative Rate-High;
| |
| * SG Water Level -High High (P-14) for the Feedwater Isolation Function.* SG Water level-Low Low, and* Loss of offsite power.If one channel is inoperable, 72 hours are allowed to restore the channel to OPERABLE status or to place it in the tripped condition.
| |
| Generally this Condition applies to functions that operate on two-out-of-three logic.Therefore, failure of one channel places the Function in a two-out-of-two configuration.
| |
| One channel must be tripped to place the Function in a one-out-of-two configuration that satisfies redundancy requirements.
| |
| The 72 hours allowed to restore the channel to OPERABLE status or placed in the tripped condition is justified in Reference 10.Failure to restore the inoperable channel to OPERABLE status or place it in the tripped condition within 72 hours requires the unit be placed in MODE 3 within the following 6 hours and MODE 4 within the next 6 hours.The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 4, these Functions are no longer required OPERABLE.The Required Actions are modified by a Note that allows the inoperable channel to be bypassed for up to 12 hours for surveillance testing of other channels.
| |
| The note also allows an OPERABLE channel to be placed in bypass for up to 12 hours for testing of the bypassed channel. However, only one channel may be placed in bypass at any one time. The 12 hours allowed for testing, are justified in Reference 10.E.1, E.2.1, and E.2.2 Condition E applies to:* Containment Phase B Isolation Containment Pressure -High-High, and* Steam Line Isolation Containment Pressure -High High.McGuire Unit 1 B 3.3.2-30 Revision No. 119 UNII' I- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during IEOC21. It is scheduled to be implemented on Unit 2 during the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued)
| |
| Neither of these signals has input to a control function.
| |
| Thus, two-out-of-three logic is necessary to meet acceptable protective requirements.
| |
| However, a two-out-of-three design would require tripping a failed channel. This is undesirable because a single failure would then cause spurious isolation initiation.
| |
| Therefore, these channels are designed with two-out-of-four logic so that a failed channel may be bypassed rather than tripped. Note that one channel may be bypassed and still satisfy the single failure criterion.
| |
| Furthermore, with one channel bypassed, a single instrumentation channel failure will not spuriously initiate isolation.
| |
| To avoid the inadvertent actuation of Phase B containment isolation, the inoperable channel should not be placed in the tripped condition.
| |
| Instead it is bypassed.
| |
| Restoring the channel to OPERABLE status, or placing the inoperable channel in the bypass condition within 72 hours, is sufficient to assure that the Function remains OPERABLE and minimizes the time that the Function may be in a partial trip condition (assuming the inoperable channel has failed high). The Completion Time is further justified based on the low probability of an event occurring during this interval.
| |
| Failure to restore the inoperable channel to OPERABLE status, or place it in the bypassed condition within72 hours, requires the unit be placed in MODE 3 within the following 6 hours and MODE 4 within the next 6 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 4, these Functions are no longer required OPERABLE.The Required Actions are modified by a Note that allows one additional channel to be bypassed for up to 12 hours for surveillance testing. Placing a second channel in the bypass condition for up to 12 hours for testing purposes is acceptable based on the results of Reference 10.F.1, F.2.1, and F.2.2 Condition F applies to:* Manual Initiation of Steam Line Isolation; and* P-4 Interlock.
| |
| McGuire Unit 1 B 3.3.2-31 Revision No. 119 UNI' 1 -License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during IEOC21. It is scheduled to be implemented on Unit 2 during the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued)
| |
| For the Manual Initiation and the P-4 Interlock Functions, this action addresses the train orientation of the SSPS. If a train or channel is inoperable, 48 hours is allowed to return it to OPERABLE status. The specified Completion Time is reasonable considering the nature of these Functions, the available redundancy, and the low probability of an event occurring during this interval.
| |
| If the Function cannot be returned to OPERABLE status, the unit must be placed in MODE 3 within the next 6 hours and MODE 4 within the following 6 hours.The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power in an orderly manner and without challenging unit systems. In MODE 4, the unit does not have any analyzed transients or conditions that require the explicit use of the protection functions noted above.G.1 and G.2 Condition G applies to manual initiation of Steam Line Isolation.
| |
| This action addresses the operability of the manual steam line isolation function for each individual main steam isolation valve. If a channel is inoperable, 48 hours is allowed to return it to an OPERABLE status. If the train cannot be restored to OPERABLE status, the Conditions and Required Actions of LCO 3.7.2, "Main Steam Isolation Valves," must be entered for the associated inoperable valve. The specified Completion Time is reasonable considering that there is a system level manual initiation train for this Function and the low probability of an event occurring during this interval.H.1, H.2.1 and H.2.2 Condition H applies to the automatic actuation logic and actuation relays for the Steam Line Isolation, Feedwater Isolation, and AFW actuation Functions.
| |
| The action addresses the train orientation of the SSPS and the master and slave relays for these functions.
| |
| If one train is inoperable, 24 hours are allowed to restore the train to OPERABLE status. The 24 hours allowed for restoring the inoperable train to OPERABLE status is justified in Reference
| |
| : 10. The Completion Time for restoring a train to OPERABLE status is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this interval.
| |
| If the train cannot be returned to OPERABLE status, the unit must be brought to MODE 3 within the next 6 hours and MODE 4 within the following 6 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.McGuire Unit 1 B 3.3.2-32 Revision No. 119 UNIT I -License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during 1EOC21. It is scheduled to be implemented on Unit 2 during the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued)
| |
| Placing the unit in MODE 4 removes all requirements for OPERABILITY of the protection channels and actuation functions.
| |
| In this MODE, the unit does not have analyzed transients or conditions that require the explicit use of the protection functions noted above.The Required Actions are modified by a Note that allows one train to be bypassed for up to 4 hours for surveillance testing provided the other train is OPERABLE.
| |
| This allowance is based on the reliability analysis (Ref. 7)assumption that 4 hours is the average time required to perform channel surveillance.
| |
| If an individual SSPS slave relay or slave relay contact is incapable of actuating, then the equipment operated by the slave relay or slave relay contact is inoperable.
| |
| An SSPS train is not inoperable due to an individual SSPS slave relay or slave relay contact being incapable of actuating.
| |
| 1.1 and 1.2 Condition I applies to the automatic actuation logic and actuation relays for the Turbine Trip Function.This action addresses the train orientation of the SSPS and the master and slave relays for this Function.
| |
| If one train is inoperable, 24 hours are allowed to restore the train to OPERABLE status or the unit must be placed in MODE 3 within the following 6 hours. The 24 hours allowed for restoring the inoperable train to OPERABLE status is justified in Reference
| |
| : 10. The Completion Time for restoring a train to OPERABLE status is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this interval.
| |
| The allowed Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems. These Functions are no longer required in MODE 3. Placing the unit in MODE 3 removes all requirements for OPERABILITY of the protection channels and actuation functions.
| |
| In this MODE, the unit does not have analyzed transients or conditions that require the explicit use of the protection functions noted above.The Required Actions are modified by a Note that allows one train to be bypassed for up to 4 hours for surveillance testing provided the other train is OPERABLE.
| |
| This allowance is based on the reliability analysis (Ref. 7)assumption that 4 hours is the average time required to perform channel surveillance.
| |
| If an individual SSPS slave relay or slave relay contact is incapable of actuating, then the equipment operated by the slave relay or slave relay McGuire Unit 1 B 3.3.2-33 Revision No. 119 UNI' I -License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during IEOC21. It is scheduled to be implemented on Unit 2 during the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) contact is inoperable.
| |
| An SSPS train is not inoperable due to an individual SSPS slave relay or slave relay contact being incapable of actuating.
| |
| J.1 and J.2 Condition J applies to: " SG Water Level-High High (P-14) for the Turbine Trip Function; and* Tavg-LOW.If one channel is inoperable, 72 hours are allowed to restore one channel to OPERABLE status or to place it in the tripped condition.
| |
| If placed in the tripped condition, the Function is then in a partial trip condition where one-out-of-two logic will result in actuation.
| |
| The 72 hours allowed to restore the channel to OPERABLE status or to place it in the tripped condition is justified in Reference 10. Failure to restore the inoperable channel to OPERABLE status or place it in the tripped condition within 72 hours requires the unit to be placed in MODE 3 within the following 6 hours. The allowed Completion Time of 78 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems. In MODE 3, these Functions are no longer required OPERABLE.The Required Actions are modified by a Note that allows the inoperable channel to be bypassed for up to 12 hours for surveillance testing of other channels.
| |
| The note also allows an OPERABLE channel to be placed in bypass for up to 12 hours for testing of the bypassed channel. However, only one channel may be placed in bypass at any one time. The 72 hours allowed to place the inoperable channel in the tripped condition, and the 12 hours allowed for a channel to be in the bypassed condition for testing, are justified in Reference 10.K.1 and K.2 Condition K applies to the AFW pump start on trip of all MFW pumps.This action addresses the relay contact orientation for the auto start function of the AFW System on loss of all MFW pumps. The OPERABILITY of the AFW System must be assured by allowing automatic start of the AFW System pumps. If a channel is inoperable, 1 hour is allowed to place the channel in trip. If placed in the tripped condition, the function is then in a partial trip condition where a one-out-of-one logic will result in actuation.
| |
| If the channel is not placed in trip within 1 hour, 6 hours are McGuire Unit 1 B 3.3.2-34 Revision No. 119 UNIt 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during I EOC21. It is scheduled to be implemented on Unit 2 durina the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) allowed to place the unit in MODE 3. The allowed Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems. In MODE 3, the unit does not have any analyzed transients or conditions that require the explicit use of the protection function noted above.L. 1 Condition L applies to the Doghouse Water Level -High High.The failure of one required channel in one train in either reactor building doghouse results in a loss of redundancy for the function.
| |
| The function can still be initiated by the remaining operable train. The inoperable train is, required to be restored to OPERABLE status within 72 hours, or continuous visual monitoring of the doghouse water level must be implemented in the following hour.The allowed Completion Time is reasonable considering that the redundant train remains OPERABLE to initiate the function if required.M.1, M.2.1 and M.2.2 Condition M applies to the Doghouse Water Level -High High.The failure of two trains in either reactor building doghouse results in a loss of the function.
| |
| Continuous visual monitoring of the doghouse water level must be implemented in the following hour.The allowed Completion Time provides sufficient time for the operating staff to establish the required monitoring..
| |
| N.1 and N.2 Condition N applies to the Auxiliary Feedwater Pumps Suction Transfer on Suction Pressure Low.If one or more channels on a single AFW pump is inoperable, 48 hours is allowed to restore the channel(s) to OPERABLE status or to declare the associated AFW pump inoperable.
| |
| The failure of one or more channels on one pump disables the ability for the suction transfer on that pump.The allowed Completion Times are reasonable, considering the remaining redundant pumps and transfer instrumentation.
| |
| McGuire Unit 1 B 3.3.2-35 Revision No. 119 UNIT 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during I EOC2 1. It is scheduled to be implemented on Unit 2 during the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) 0.1 Condition 0 applies to the Auxiliary Feedwater Pumps Suction Transfer on Suction Pressure Low.If one or more channels on more than one AFW pumps are inoperable, the ability for the suction transfer has been lost on multiple pumps. In this case, the associated AFW pumps must be declared inoperable immediately.
| |
| P.1 and P.2 Condition P applies to RWST Level-Low Coincident with Safety Injection.
| |
| RWST Level-Low Coincident with SI provides actuation of switchover to the containment sump. The inoperable channel shall be returned to OPERABLE status or placed in the trip condition within 1 hour. This Condition applies to a function that operates on two-out-or-three logic. Therefore, failure of one channel places the Function in a two-out-or-two configuration.
| |
| The channel must be tripped to place the Function in a one-out-of-two configuration that satisfies redundancy requirements.
| |
| A channel placed in the trip condition shall be restored to OPERABLE status within 48 hours. With one channel in the trip condition, a single failure of another channel coincident with a design basis Loss of Coolant Accident (LOCA) could result in premature automatic swapover of ECCS pumps to the containment recirculation sump. For a failure leading to early swapover, plant analyses assume operators do not have sufficient time to resolve the problem prior to ECCS pump damage.Consequently, as a result of this premature swapover, both trains of ECCS pumps could fail due to insufficient sump water level. This could prevent the ECCS pumps from performing their post-LOCA cooling function.
| |
| The allowed Completion Time of 48 hours is reasonable since, based on operating experience, there is a very small probability of a random failure of another RWST level channel in a given 48 hour period.Q.1, Q.2.1 and Q.2.2 Condition Q applies to the P-1 1 and P-1 2 interlocks.
| |
| With one channel inoperable, the operator must verify that the interlock is in the required state for the existing unit condition.
| |
| The verification is performed by visual observation of the permissive status light in the unit control room. This action manually accomplishes the function of the interlock.
| |
| Determination must be made within 1 hour. The 1 hour Completion Time is equal to the time allowed by LCO 3.0.3 to initiate shutdown actions in the event of a complete McGuire Unit 1 B 3.3.2-36 Revision No. 119 UNIt 1 -License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during I EOC2 1. It is scheduled to be implemented on Unit 2 durinp the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) loss of ESFAS function.
| |
| If the interlock is not in the required state (or placed in the required state) for the existing unit condition, the unit must be placed in MODE 3 within the next 6 hours and MODE 4 within the following 6 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. Placing the unit in MODE 4 removes all requirements for OPERABILITY of these interlocks.
| |
| R. 1 Condition R applies to the Containment Pressure Control System Start and Terminate Permissives.
| |
| With one or more channels inoperable, the affected containment spray, containment air return fans, and hydrogen skimmer fans must be declared inoperable immediately.
| |
| The supported system LCOs provide the appropriate Required Actions and Completion Times for the equipment made inoperable by the inoperable channel. The immediate Completion Time is appropriate since the inoperable channel could prevent the supported equipment from starting when required.
| |
| Additionally, protection from an inadvertent actuation may not be provided if the terminate function is not OPERABLE.S.1 and S.2 Condition S applies to RWST Level-Low Coincident with Safety Injection.
| |
| When Required Actions cannot be completed within their Completion Time, the unit must be brought to a MODE or Condition in which the LCO requirements are not applicable.
| |
| To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and MODE 4 within 12 hours of entering the Condition.
| |
| The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 4, the unit does not have any analyzed transients of conditions that require the explicit use of the protection functions noted above.SURVEILLANCE The SRs for each ESFAS Function are identified by the SRs column of REQUIREMENTS Table 3.3.2-1.A Note has been added to the SR Table to clarify that Table 3.3.2-1 determines which SRs apply to which ESFAS Functions.
| |
| Note that each channel of process protection supplies both trains of the ESFAS. When testing channel I, train A and train B must be examined.McGuire Unit 1 B 3.3.2-37 Revision No. 119 UNII I -License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during I EOC21. It is scheduled to be implemented on Unit 2 during the fall 2012 outa.Re.ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| Similarly, train A and train B must be examined when testing channel II, channel III, and channel IV (if applicable).
| |
| The CHANNEL CALIBRATION and COTs are performed in a manner that is consistent with the assumptions used in analytically calculating the required channel accuracies.
| |
| SR 3.3.2.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred.
| |
| A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels.
| |
| It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure;thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
| |
| Agreement criteria are determined by the unit staff, based on a combination of the channel instrument uncertainties, including indication and reliability.
| |
| If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.2.2 SR 3.3.2.2 is the performance of an ACTUATION LOGIC TEST using the semiautomatic tester. The train being tested is placed in the bypass condition, thus preventing inadvertent actuation.
| |
| Through the semiautomatic tester, all possible logic combinations, with and without applicable permissives, are tested for each protection function.
| |
| In addition, the master relay coil is pulse tested for continuity.
| |
| This verifies that the logic modules are OPERABLE and that there is an intact voltage signal path to the master relay coils. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.2.3 SR 3.3.2.3 is the performance of a COT on the RWST level and Containment Pressure Control Start and Terminate Permissives.
| |
| McGuire Unit 1 B 3.3.2-38 Revision No. 119 UNII' 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during 1EOC21. It is scheduled to be implemented on Unit 2 during the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| A COT is performed on each required channel to ensure the entire channel will perform the intended Function.
| |
| Setpoints must be found conservative with respect to the Allowable Values specified in-Table 3.3. 2-1. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.For Functions for which TSTF-493, "Clarify Application of Setpoint Methodology for LSSS Functions," has been implemented; this SR is modified by two (2)Notes as identified in Table 3.3.2-1. The first Note requires evaluation of channel performance for the condition where the as-found setting for the channel setpoint is outside its as-found tolerance but conservative with respect to the Allowable Value. Evaluation of channel performance will verify that the channel will continue to behave in accordance with safety analysis assumptions and the channel performance assumptions in the setpoint methodology.
| |
| The purpose of the assessment is to ensure confidence in the channel performance prior to returning the channel to service. For channels determined to be OPERABLE but degraded, after returning the channel to service the performance of these channels will be evaluated under the plant Corrective Action Program. Entry into the Corrective Action Program will ensure required review and documentation of the condition.
| |
| The second Note requires that the as-left setting for the channel be returned to within the as-left tolerance of the Nominal Trip Setpoint (NTSP). Where a setpoint more conservative than the NTSP is used in the plant surveillance procedures (field setting), the as-left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint.
| |
| This will ensure that sufficient margin to the Safety Limit and/or Analytical Limit is maintained.
| |
| If the as-left channel setting cannot be returned to a setting within the as-left tolerance of the NTSP, then the channel shall be declared inoperable.
| |
| The second Note also requires that the methodologies for calculating the as-left and the as-found tolerances by in the UFSAR.SR 3.3.2.4 SR 3.3.2.4 is the performance of a MASTER RELAY TEST. The MASTER RELAY TEST is the energizing of the master relay, verifying contact operation and a low voltage continuity check of the slave relay coil. Upon master relay contact operation, a low voltage is injected to the slave relay coil. This voltage is insufficient to pick up the slave relay, but large enough to demonstrate signal path continuity.
| |
| The time allowed for the testing (4 hours) is justified in Reference
| |
| : 7. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Unit 1 B 3.3.2-39 Revision No. 119 UNJII 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during I EOC2 1. It is scheduled to be implemented on Unit 2 during the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.3.2.5 SR 3.3.2.5 is the performance of a COT.A COT is performed on each required channel to ensure the channel will perform the intended Function.
| |
| The tested portion of the loop must trip within the Allowable Values specified in Table 3.3. 2-1.The setpoint shall be left set consistent with the assumptions of the setpoint methodology.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.2.6 SR 3.3.2.6 is the performance of a SLAVE RELAY TEST. The SLAVE RELAY TEST is the energizing of the slave relays. Contact operation is verified in one of two ways. Actuation equipment that may be operated in the design mitigation MODE is either allowed to function, or is placed in a condition where the relay contact operation can be verified without operation of the equipment.
| |
| Actuation equipment that may not be operated in the design mitigation MODE is prevented from operation by the SLAVE RELAY TEST circuit. For this latter case, contact operation is verified by a continuity check of the circuit containing the slave relay. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.2.7 SR 3.3.2.7 is the performance of a TADOT. This test is a check of the Manual Actuation Functions, AFW pump start, Reactor Trip (P-4) Interlock and Doghouse Water Level -High High feedwater isolation.
| |
| Each Manual Actuation Function is tested up to, and including, the master relay coils. In some instances, the test includes actuation of the end device (i.e., pump starts, valve cycles, etc.). The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program. The SR is modified by a Note that excludes verification of setpoints during the TADOT for manual initiation Functions.
| |
| The manual initiation Functions have no associated setpoints.
| |
| McGuire Unit 1 B 3.3.2-40 Revision No. 119 UNII 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during IEOC21. It is scheduled to be implemented on Unit 2 during the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.3.2.8 SR 3.3.2.8 is the performance of a CHANNEL CALIBRATION.
| |
| The CHANNEL CALIBRATION may be performed at power or during refueling based on bypass testing capability.
| |
| Channel unavailability evaluations in References 10 and 11 have conservatively assumed that the CHANNEL CALIBRATION is performed at power with the channel in bypass.CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to measured parameter within the necessary range and accuracy.CHANNEL CALIBRATIONS must be performed consistent with the assumptions of the unit specific setpoint methodology.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.This SR is modified by a Note stating that this test should include verification that the time constants are adjusted to the prescribed values where applicable.
| |
| The applicable time constants are shown in Table 3.3.2-1.For Functions for which TSTF-493, "Clarify Application of Setpoint Methodology for LSSS Functions," has been implemented; this SR is modified by two (2)Notes as identified in Table 3.3.2-1. The first Note requires evaluation of channel performance for the condition where the as-found setting for the channel setpoint is outside its as-found tolerance but conservative with respect to the Allowable Value. Evaluation of channel performance will verify that the channel will continue to behave in accordance with safety analysis assumptions and the channel performance assumptions in the setpoint methodology.
| |
| The purpose of the assessment is to ensure confidence in the channel performance prior to returning the channel to service. For channels determined to be OPERABLE but degraded, after returning the channel to service the performance of these channels will be evaluated under the plant Corrective Action Program. Entry into the Corrective Action Program will ensure required review and documentation of the condition.
| |
| The second Note requires that the as-left setting for the channel be returned to within the as-left tolerance of the Nominal Trip Setpoint (NTSP). Where a setpoint more conservative than the NTSP is used in the plant surveillance procedures (field setting), the as-left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint.
| |
| This will ensure that sufficient margin to the Safety Limit and/or Analytical Limit is maintained.
| |
| If the as-left channel setting cannot be returned to a setting within the as-left tolerance of the NTSP, McGuire Unit 1 B 3.3.2-41 Revision No. 119 UNITI 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during IEOC21. It is scheduled to be implemented on Unit 2 during the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued) then the channel shall be declared inoperable.
| |
| The second Note also requires that the methodologies for calculating the as-left and the as-found tolerances by in the UFSAR.SR 3.3.2.9 This SR ensures the individual channel ESF RESPONSE TIMES are less than or equal to the maximum values assumed in the accident analysis.
| |
| Response Time testing acceptance criteria are included in the UFSAR (Ref. 2). Individual component response times are not modeled in the analyses.
| |
| The analyses model the overall or total elapsed time, from the point at which the parameter exceeds the Trip Setpoint value at the sensor, to the point at which the equipment in both trains reaches the required functional state (e.g., pumps at rated discharge pressure, valves in full open or closed position).
| |
| For channels that include dynamic transfer functions (e.g., lag, lead/lag, rate/lag, etc.), the response time test may be performed with the transfer functions set to one with the resulting measured response time compared to the appropriate UFSAR response time. Alternately, the response time test can be performed with the time constants set to their nominal value provided the required response time is analytically calculated assuming the time constants are set at their nominal values. The response time may be measured by a series of overlapping tests such that the entire response time is measured.Response time may be verified by actual response time tests in any series of sequential, overlapping or total channel measurements, or by the summation of allocated sensor, signal processing and actuation logic response times with actual response time tests on the remainder of the channel. Allocations for sensor response times may be obtained from: (1) historical records based on acceptable response time tests (hydraulic, noise, or power interrupt tests), (2)in place, onsite, or offsite (e.g., vendor) test measurements, or (3) utilizing vendor engineering specifications.
| |
| WCAP-1 3632-P-A, Revision 2, "Elimination of Pressure Sensor Response Time Testing Requirements" provides the basis and methodology for using allocated sensor response times in the overall verification of the channel response time for specific sensors identified in the WCAP. Response time verification for other sensor types must be either demonstrated by test or their equivalency to those listed in WCAP-1 3632-P-A, Revision 2. Any demonstration of equivalency must have been determined to be acceptable by NRC staff review.WCAP-14036-P-A, Revision 1, "Elimination of Periodic Protection Channel Response Time Tests' provides the basis and methodology for using allocated signal processing and actuation logic response times in the overall verification McGuire Unit 1 B 3.3.2-42 Revision No. 119 UN I I -License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during I EOC2 1. It is scheduled to be implemented on Unit 2 during the fall 2012 outage.ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued) of the protection system channel response time. The allocations for sensor, signal conditioning, and actuation logic response times must be verified prior to placing the component in operational service and re-verified following maintenance that may adversely affect response time. In general, electrical repair work does not impact response time provided the parts used for repair are of the same type and value. Specific components identified in the WCAP may be replaced without verification testing. One example where response time could be affected is replacing the sensing assembly of a transmitter.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.This SR is modified by a Note that clarifies that the turbine driven AFW pump is tested within 24 hours after reaching 900 psig in the SGs.REFERENCES
| |
| : 1. UFSAR, Chapter 6.2. UFSAR, Chapter 7.3. UFSAR, Chapter 15.4. IEEE-279-1971.
| |
| : 5. 10 CFR 50.49.6. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| : 7. WCAP-10271-P-A, Supplement 1 and Supplement 2, Rev. 1, May 1986 and June 1990.8. WCAP 13632-P-A, Revision 2, "Elimination of Pressure Sensor Response Time Testing Requirements" Sep., 1995.9. WCAP-14036-P-A, Revision 1, "Elimination of Periodic Protection Channel Response Time Tests" Oct., 1998.10. WCAP-14333-P-A, Revision 1, October 1998.11. WCAP-15376-P-A, Revision 1, March 2003.McGuire Unit 1 B 3.3.2-43 Revision No. 119
| |
| | |
| UNIT 2 BASES 3.3.2 Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012, there will be separate documents for Unit 1 and Unit 2 Bases 3.3.2.ECCS Water Management Modification was implemented on Unit I during the 1 EOC21 outage.
| |
| UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012, there will be separate documents for Unit I and Unit 2 Bases: 3.3.2, 3.3.3, 3.5.4, 3.6.6, and 3.6.11 ESFAS Instrumentation B 3.3.2 B 3.3 INSTRUMENTATION B 3.3.2 Engineered Safety Feature Actuation System (ESFAS) Instrumentation BASES BACKGROUND The ESFAS initiates necessary safety systems, based on the values of selected unit parameters, to protect against violating core design limits and the Reactor Coolant System (RCS) pressure boundary, and to mitigate accidents.
| |
| The ESFAS instrumentation is segmented into three distinct but interconnected modules as identified below: Field transmitters or process sensors and instrumentation:
| |
| provide a measurable electronic signal based on the physical characteristics of the parameter being measured;Signal processing equipment including analog protection system, field contacts, and protection channel sets: provide signal conditioning, bistable setpoint comparison, process algorithm actuation, compatible electrical signal output to protection system devices, and control board/control room/miscellaneous indications; and Solid State Protection System (SSPS) including input, logic, and output bays: initiates the proper unit shutdown or engineered safety feature (ESF) actuation in accordance with the defined logic and based on the bistable outputs from the signal process control and protection system.Field Transmitters or Sensors To meet the design demands for redundancy and reliability, more than one, and often as many as four, field transmitters or sensors are used to measure unit parameters.
| |
| In many cases, field transmitters or sensors that input to the ESFAS are shared with the Reactor Trip System (RTS).In some cases, the same channels also provide control system inputs.To account for calibration tolerances and instrument drift, which is assumed to occur between calibrations, statistical allowances are provided in the NOMINAL TRIP SETPOINT and Allowable Values. The OPERABILITY of each transmitter or sensor can be evaluated when its".as found" calibration data are compared against its documented acceptance criteria.McGuire Unit 2 B 3.3.2-1 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES BACKGROUND (continued)
| |
| Signal Processing Equipment Generally, three or four channels of process control equipment are used for the signal processing of unit parameters measured by the field instruments.
| |
| The process control equipment provides signal conditioning, comparable output signals for instruments located on the main control board, and comparison of measured input signals with setpoints established by safety analyses.
| |
| These setpoints are defined in UFSAR, Chapter 6 (Ref. 1), Chapter 7 (Ref. 2), and Chapter 15 (Ref. 3). If the measured value of a unit parameter exceeds the predetermined setpoint, an output from a bistable is forwarded to the SSPS for decision logic processing.
| |
| Channel separation is maintained up to and through the input bays. However, not all unit parameters require four channels of sensor measurement and signal processing.
| |
| Some unit parameters provide input only to the SSPS, while others provide input to the SSPS, the main control board, the unit computer, and one or more control systems.Generally, if a parameter is used only for input to the protection circuits, three channels with a two-out-of-three logic are sufficient to provide the required reliability and redundancy.
| |
| If one channel fails in a direction that would not result in a partial Function trip, the Function is still OPERABLE with a two-out-of-two logic. If one channel fails such that a partial Function trip occurs, a trip will not occur and the Function is still OPERABLE with a one-out-of-two logic.Generally, if a parameter is used for input to the SSPS and a control function, four channels with a two-out-of-four logic are sufficient to provide the required reliability and redundancy.
| |
| The circuit must be able to withstand both an input failure to the control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation.
| |
| Again, a single failure will neither cause nor prevent the protection function actuation.
| |
| These requirements are described in IEEE-279-1971 (Ref. 4). The actual number of channels required for each unit parameter is specified in the UFSAR.Trip Setpoints and Allowable Values The NOMINAL TRIP SETPOINTS are the nominal values at which the bistables are set. Any bistable is considered to be properly adjusted when the "as left" value is within the band for CHANNEL CALIBRATION tolerance.
| |
| McGuire Unit 2 B 3.3.2-2 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES BACKGROUND (continued)
| |
| The NOMINAL TRIP SETPOINTS used in the bistables are based on the analytical limits (Ref. 1, 2, and 3). The selection of these NOMINAL TRIP SETPOINTS is such that adequate protection is provided when all sensor and processing time delays, calibration tolerances, instrumentation uncertainties, instrument drift, and severe environment errors for those ESFAS channels that must function in harsh environments as defined by 10 CFR 50.49 (Ref. 5) are taken into account. The actual as-left Setpoint entered into the bistable assures that the actual trip occurs before the Allowable Value is reached. The Allowable Value accounts for changes in random measurement errors detectable by a COT. One example of such a change in measurement error is drift during the surveillance interval.
| |
| If the point at which the loop trips does not exceed the Allowable Value, the loop is considered OPERABLE.A trip within the Allowable Value ensures that the consequences of Design Basis Accidents (DBAs) will be acceptable, providing the unit is operated from within the LCOs at the onset of the DBA and the equipment functions as designed.Each channel can be tested on line to verify that the signal processing equipment and setpoint accuracy is within the specified allowance requirements.
| |
| Once a designated channel is taken out of service for testing, a simulated signal is injected in place of the field instrument signal. The process equipment for the channel in test is then tested, verified, and calibrated.
| |
| SRs for the channels are specified in the SR section.The NOMINAL TRIP SETPOINTS and Allowable Values listed in Table 3.3.2-1 incorporates all of the known uncertainties applicable for each channel. The magnitudes of these uncertainties are factored into the determination of each NOMINAL TRIP SETPOINT.
| |
| All field sensors and signal processing equipment for these channels are assumed to operate within the allowances of these uncertainty magnitudes.
| |
| Solid State Protection System The SSPS equipment is used for the decision logic processing of outputs from the signal processing equipment bistables.
| |
| To meet the redundancy requirements, two trains of SSPS, each performing the same functions, are provided.
| |
| If one train is taken out of service for maintenance or test purposes, the second train will provide ESF actuation for the unit. If both trains are taken out of service or placed in test, a reactor trip will result.Each train is packaged in its own cabinet for physical and electrical separation to satisfy separation and independence requirements.
| |
| McGuire Unit 2 B 3.3.2-3 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES BACKGROUND (continued)
| |
| The SSPS performs the decision logic for most ESF equipment actuation; generates the electrical output signals that initiate the required actuation; and provides the status, permissive, and annunciator output signals to the main control room of the unit.The bistable outputs from the signal processing equipment are sensed by the SSPS equipment and combined into logic matrices that represent combinations indicative of various transients.
| |
| If a required logic matrix combination is completed, the system will send actuation signals via master and slave relays to those components whose aggregate Function best serves to alleviate the condition and restore the unit to a safe condition.
| |
| Examples are given in the Applicable Safety Analyses, LCO, and Applicability sections of this Bases.Each SSPS train has a built in testing device that can test the decision logic matrix functions and the actuation devices while the unit is at power.When any one train is taken out of service for testing, the other train is capable of providing unit monitoring and protection until the testing has been completed.
| |
| The testing device is semiautomatic to minimize testing time.The actuation of ESF components is accomplished through master and slave relays. The SSPS energizes the master relays appropriate for the condition of the unit. Each master relay then energizes one or more slave relays, which then cause actuation of the end devices. The master and slave relays are routinely tested to ensure operation.
| |
| The test of the master relays energizes the relay, which then operates the contacts and applies a low voltage to the associated slave relays. The low voltage is not sufficient to actuate the slave relays but only demonstrates signal path continuity.
| |
| The SLAVE RELAY TEST actuates the devices if their operation will not interfere with continued unit operation.
| |
| For the latter case, actual component operation is prevented by the SLAVE RELAY TEST circuit, and slave relay contact operation is verified by a continuity check of the circuit containing the slave relay.APPLICABLE Each of the analyzed accidents can be detected by one or more ESFAS SAFETY ANALYSES, Functions.
| |
| One of the ESFAS Functions is the primary actuation signal LCO, and for that accident.
| |
| An ESFAS Function may be the primary actuation APPLICABILITY signal for more than one type of accident.
| |
| An ESFAS Function may also be a secondary, or backup, actuation signal for one or more other accidents.
| |
| Functions such as manual initiation, not specifically credited in the accident safety analysis, McGuire Unit 2 B 3.3.2-4 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) are qualitatively credited in the safety analysis and the NRC staff approved licensing basis for the unit. These Functions may provide protection for conditions that do not require dynamic transient analysis to demonstrate Function performance.
| |
| These Functions may also serve as backups to Functions that were credited in the accident analysis (Ref. 3).The LCO requires all instrumentation performing an ESFAS Function to be OPERABLE.
| |
| Failure of any instrument renders the affected channel(s) inoperable and reduces the reliability of the affected Functions.
| |
| The LCO generally requires OPERABILITY of three or four channels in each instrumentation function and two channels in each logic and manual initiation function.
| |
| The two-out-of-three and the two-out-of-four configurations allow one channel to be tripped during maintenance or testing without causing an ESFAS initiation.
| |
| Two logic or manual initiation channels are required to ensure no single random failure disables the ESFAS.The required channels of ESFAS instrumentation provide unit protection in the event of any of the analyzed accidents.
| |
| ESFAS protection functions are as follows: 1. Safety Iniection Safety Injection (SI) provides two primary functions:
| |
| : 1. Primary side water addition to ensure maintenance or recovery of reactor vessel water level (coverage of the active fuel for heat removal, clad integrity, and for limiting peak clad temperature to < 22001F); and 2. Boration to ensure recovery and maintenance of SDM (keff < 1.0).These functions are necessary to mitigate the effects of high energy line breaks (HELBs) both inside and outside of containment.
| |
| The SI signal is also used to initiate other Functions such as: Phase A Isolation; Containment Purge and Exhaust Isolation; McGuire Unit 2 B 3.3.2-5 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| * Reactor Trip;0 Turbine Trip;0 Feedwater Isolation;
| |
| * Start of motor driven auxiliary feedwater (AFW) pumps;* Control room area ventilation isolation;
| |
| * Enabling automatic switchover of Emergency Core Cooling Systems (ECCS) suction to containment sump;* Start of annulus ventilation system filtration trains;* Start of auxiliary building filtered ventilation exhaust system trains;* Start of diesel generators;
| |
| * Start of nuclear service water system pumps; and* Start of component cooling water system pumps.These other functions ensure:* Isolation of nonessential systems through containment penetrations;
| |
| * Trip of the turbine and reactor to limit power generation;
| |
| * Isolation of main feedwater (MFW) to limit secondary side mass losses;* Start of AFW to ensure secondary side cooling capability;
| |
| * Isolation of the control room to ensure habitability;
| |
| * Enabling ECCS suction from the refueling water storage tank (RWST) switchover on low RWST level to ensure continued cooling via use of the containment sump;Starting of annulus ventilation and auxiliary building filtered ventilation to limit offsite releases;McGuire Unit 2 B 3.3.2-6 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| Starting of diesel generators for loss of offsite power considerations; and Starting of component cooling water and nuclear service water systems for heat removal.a. Safety Injection-Manual Initiation The LCO requires one channel per train to be OPERABLE.The operator can initiate SI at any time by using either of two switches in the control room. This action will cause actuation of all components in the same manner as any of the automatic actuation signals.The LCO for the Manual Initiation Function ensures the proper amount of redundancy is maintained in the manual ESFAS actuation circuitry to ensure the operator has manual ESFAS initiation capability.
| |
| Each train consists of one push button and the interconnecting wiring to the actuation logic cabinet. This configuration does not allow testing at power.b. Safety Iniection-Automatic Actuation Logic and Actuation Relays This LCO requires two trains to be OPERABLE.
| |
| Actuation logic consists of all circuitry housed within the actuation subsystems, including the initiating relay contacts responsible for actuating the ESF equipment.
| |
| Manual and automatic initiation of SI must be OPERABLE in MODES 1, 2, and 3. In these MODES, there is sufficient energy in the primary and secondary systems to warrant automatic initiation of ESF systems. In MODE 4, adequate time is available to manually actuate required components in the event of a DBA, but because of the large number of components actuated on a SI, actuation is simplified by the use of the manual actuation push buttons. Automatic actuation logic and actuation relays must be OPERABLE in MODE 4 to support system level manual initiation.
| |
| McGuire Unit 2 B 3.3.2-7 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| These Functions are not required to be OPERABLE in MODES 5 and 6 because there is adequate time for the operator to evaluate unit conditions and respond by manually starting individual systems, pumps, and other equipment to mitigate the consequences of an abnormal condition or accident.
| |
| Unit pressure and temperature are very low and many ESF components are administratively locked out or otherwise prevented from actuating to prevent inadvertent overpressurization of unit systems.c. Safety Injection-Containment Pressure-HiQh This signal provides protection against the following accidents:
| |
| SLB inside containment;
| |
| * LOCA; and Feed line break inside containment.
| |
| Containment Pressure-High provides no input to any control functions.
| |
| Thus, three OPERABLE channels are sufficient to satisfy protective requirements with a two-out-of-three logic.Containment Pressure-High must be OPERABLE in MODES 1, 2, and 3 when there is sufficient energy in the primary and secondary systems to pressurize the containment following a pipe break. In MODES 4, 5, and 6, there is insufficient energy in the primary or secondary systems to pressurize the containment.
| |
| : d. Safety Injection-Pressurizer Pressure-Low Low This signal provides protection against the following accidents:
| |
| Inadvertent opening of a steam generator (SG) relief or safety valve;* SLB;A spectrum of rod cluster control assembly ejection accidents (rod ejection);
| |
| McGuire Unit 2 B 3.3.2-8 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| Inadvertent opening of a pressurizer relief or safety valve;* LOCAs; and* SG Tube Rupture.Pressurizer pressure provides both control and protection functions:
| |
| input to the Pressurizer Pressure Control System, reactor trip, and SI. Therefore, the actuation logic must be able to withstand both an input failure to control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation.
| |
| Thus, four OPERABLE channels are required to satisfy the requirements with a two-out-of-four logic.This Function must be OPERABLE in MODES 1, 2, and 3 (above P-1 1) to mitigate the consequences of an HELB inside containment.
| |
| This signal may be manually blocked by the operator below the P-1 1 setpoint.
| |
| Automatic SI actuation below this pressure setpoint is then performed by the Containment Pressure-High signal.This Function is not required to be OPERABLE in MODE 3 below the P-1 1 setpoint.
| |
| Other ESF functions are used to detect accident conditions and actuate the ESF systems in this MODE. In MODES 4, 5, and 6, this Function is not needed for accident detection and mitigation.
| |
| : 2. Containment Spray Containment Spray provides two primary functions:
| |
| : 1. Lowers containment pressure and temperature after an HELB in containment; and 2. Reduces the amount of radioactive iodine in the containment atmosphere.
| |
| These functions are necessary to: Ensure the pressure boundary integrity of the containment structure; and McGuire Unit 2 B 3.3.2-9 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| Limit the release of radioactive iodine to the environment in the event of a failure of the containment structure.
| |
| The containment spray actuation signal starts the containment spray pumps and aligns the discharge of the pumps to the containment spray nozzle headers in the upper levels of containment.
| |
| Water is initially drawn from the RWST by the containment spray pumps. When the RWST reaches the low low level setpoint, the spray pump suctions are manually shifted to the containment sump if continued containment spray is required.Containment spray is actuated manually or by Containment Pressure-High High.a. Containment Spray-Manual Initiation there are two manual containment spray switches, one per train, in the control room. Turning the switch will actuate the associated containment spray train in the same manner as the automatic actuation signal. Two Manual Initiation switches, one per train, are required to be OPERABLE to ensure no single failure disables the Manual Initiation Function.
| |
| Note that Manual Initiation of containment spray also actuates Phase B containment isolation.
| |
| Two train actuation requires operation of both Train A andTrain B manual containment spray switches.b. Containment Spray-Automatic Actuation Logic and Actuation Relays Automatic actuation logic and actuation relays consist of the same features and operate in the same manner as described for ESFAS Function 1 .b.Manual and automatic initiation of containment spray must be OPERABLE in MODES 1, 2, and 3 when there is a potential for an accident to occur, and sufficient energy in the primary or secondary systems to pose a threat to containment integrity due to overpressure conditions.
| |
| In MODE 4, adequate time is available to manually actuate required components in the event of a DBA. However, because of the large number of components actuated on a containment spray, actuation is simplified by the use of the manual actuation push buttons. Automatic actuation logic and actuation relays must be OPERABLE in Mode 4 to McGuire Unit 2 B 3.3.2-10 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) support system level manual initiation.
| |
| In MODES 5 and 6 there is insufficient energy in the primary and secondary systems to result in containment overpressure.
| |
| In MODES 5 and 6, there is also adequate time for the operators to evaluate unit conditions and respond, to mitigate the consequences of abnormal conditions by manually starting individual components.
| |
| : c. Containment Spray-Containment Pressure -High High This signal provides protection against a LOCA or an SLB inside containment.
| |
| This is one of the only Functions that requires the bistable output to energize to perform its required action. It is not desirable to have a loss of power actuate containment spray, since the consequences of an inadvertent actuation of containment spray could be serious. Note that this Function also has the inoperable channel placed in bypass rather than trip to decrease the probability of an inadvertent actuation.
| |
| Containment Pressure-High High uses four channels in a two-out-of-four logic configuration.
| |
| Since containment pressure is not used for control, this arrangement exceeds the minimum redundancy requirements.
| |
| Additional redundancy is warranted because this Function is energize to trip. Containment Pressure-High High must be OPERABLE in Modes 1, 2, and 3 when there is sufficient energy in the primary and secondary sides to pressurize the containment following a pipe break. In MODES 4, 5, and 6 there is insufficient energy in the primary and secondary sides to pressurize the containment and reach the Containment Pressure-High High setpoints.
| |
| : 3. Containment Isolation Containment Isolation provides isolation of the containment atmosphere, and all process systems that penetrate containment, from the environment.
| |
| This Function is necessary to prevent or limit the release of radioactivity to the environment in the event of a large break LOCA.McGuire Unit 2 B 3.3.2-11 Revision No. 119 LNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| There are two separate Containment Isolation signals, Phase A and Phase B. Phase A isolation isolates all automatically isolable process lines, except component cooling water (CCW) and Nuclear Service Water System (NSWS) to RCP motor air coolers, at a relatively low containment pressure indicative of primary or secondary system leaks. For these types of events, forced circulation cooling using the reactor coolant pumps (RCPs) and SGs is the preferred (but not required) method of decay heat removal. Since CCW and NSWS are required to support RCP operation, not isolating CCW and NSWS on the low pressure Phase A signal enhances unit safety by allowing operators to use forced RCS circulation to cool the unit. Isolating CCW and NSWS on the low pressure signal may force the use of feed and bleed cooling, which could prove more difficult to control.Phase A containment isolation is actuated automatically by SI, or manually via the actuation circuitry.
| |
| All process lines penetrating containment, with the exception of CCW and NSWS are isolated.CCW is not isolated at this time to permit continued operation of the RCPs with cooling water flow to the thermal barrier heat exchangers and air or oil coolers. All process lines not equipped with remote operated isolation valves are manually closed, or otherwise isolated, prior to reaching MODE 4.Manual Phase A Containment Isolation is accomplished by either of two switches in the control room. Either switch actuates its associated train.The Phase B signal isolates CCW and NSWS. This occurs at a relatively high containment pressure that is indicative of a large break LOCA or an SLB. For these events, forced circulation using the RCPs is no longer desirable.
| |
| Isolating the CCW and NSWS at the higher pressure does not pose a challenge to the containment boundary because the CCW System and NSWS are closed loops inside containment.
| |
| Although some system components do not meet all of the ASME Code requirements applied to the containment itself, the systems are continuously pressurized to a pressure greater than the Phase B setpoint.
| |
| Thus, routine operation demonstrates the integrity of the system pressure boundary for pressures exceeding the Phase B setpoint.Furthermore, because system pressure exceeds the Phase B setpoint, any system leakage prior to initiation of Phase B isolation would be into containment.
| |
| Therefore, the combination of CCW System and NSWS design and Phase B isolation ensures there is not a potential path for radioactive release from containment.
| |
| McGuire Unit 2 B 3.3.2-12 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| Phase B containment isolation is actuated by Containment Pressure-High High, or manually, via the automatic actuation logic, as previously discussed.
| |
| For containment pressure to reach a value high enough to actuate Containment Pressure-High High, a large break LOCA or SLB must have occurred and containment spray must have been actuated.
| |
| RCP operation will no longer be required and CCW to the RCPs and NSWS to the RCP motor coolers is, therefore, no longer necessary.
| |
| The RCPs can be operated with seal injection flow alone and without CCW flow to the thermal barrier heat exchanger.
| |
| Manual Phase B Containment Isolation is accomplished by the same switches that actuate Containment Spray. When the two switches in either set are turned simultaneously, Phase B Containment Isolation and Containment Spray will be actuated in both trains.a. Containment Isolation-Phase A Isolation (1) Phase A Isolation-Manual Initiation Manual Phase A Containment Isolation is actuated by either of two switches in the control room. Either switch actuates both trains.(2) Phase A Isolation-Automatic Actuation Logic and Actuation Relays Automatic Actuation Logic and Actuation Relays consist of the same features and operate in the same manner as described for ESFAS Function 1 .b.Manual and automatic initiation of Phase A Containment Isolation must be OPERABLE in MODES 1, 2, and 3, when there is a potential for an accident to occur. In MODE 4, adequate time is available to manually actuate required components in the event of a DBA, but because of the large number of components actuated on a Phase A Containment Isolation, actuation is simplified by the use of the manual actuation push buttons. Automatic actuation logic and actuation relays must be OPERABLE in MODE 4 to support system level manual initiation.
| |
| In MODES-5 and 6, there is insufficient energy in the primary or secondary systems to pressurize the containment to require Phase A Containment McGuire Unit 2 B 3.3.2-13 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| Isolation.
| |
| There also is adequate time for the operator to evaluate unit conditions and manually actuate individual isolation valves in response to abnormal or accident conditions.
| |
| (3) Phase A Isolation-Safety Injection Phase A Containment Isolation is also initiated by all Functions that initiate SI. The Phase A Containment Isolation requirements for these Functions are the same as the requirements for their SI function.Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all initiating Functions and requirements.
| |
| : b. Containment Isolation-Phase B Isolation Phase B Containment Isolation is accomplished by Manual Initiation, Automatic Actuation Logic and Actuation Relays, and by Containment Pressure channels (the same channels that actuate Containment Spray, Function 2). The Containment Pressure trip of Phase B Containment Isolation is energized to trip in order to minimize the potential of spurious trips that may damage the RCPs.(1) Phase B Isolation-Manual Initiation (2) Phase B Isolation-Automatic Actuation Lo-gic and Actuation Relays Manual and automatic initiation of Phase B containment isolation must be OPERABLE in MODES 1, 2, and 3, when there is a potential for an accident to occur. In MODE 4, adequate time is available to manually actuate required components in the event of a DBA. However, because of the large number of components actuated on a Phase B containment isolation, actuation is simplified by the use of the manual actuation push buttons. Automatic actuation logic and actuation relays must be OPERABLE in MODE 4 to support system level manual initiation.
| |
| In MODES 5 and 6, there is insufficient energy in the primary or secondary systems to pressurize the containment to require McGuire Unit 2 B 3.3.2-14 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| Phase B containment isolation.
| |
| There also is adequate time for the operator to evaluate unit conditions and manually actuate individual isolation valves in response to abnormal or accident conditions.
| |
| (3) Phase B Isolation-Containment Pressure -High Higqh The basis for containment pressure MODE applicability is as discussed for ESFAS Function 2.c above.4. Steam Line Isolation Isolation of the main steam lines provides protection in the event of an SLB inside or outside containment.
| |
| Rapid isolation of the steam lines will limit the steam break accident to the blowdown from one SG, at most. For an SLB upstream of the main steam isolation valves (MSIVs), inside or outside of containment, closure of the MSIVs limits the accident to the blowdown from only the affected SG. For an SLB downstream of the MSIVs, closure of the MSIVs terminates the accident as soon as the steam lines depressurize.
| |
| Steam Line Isolation also mitigates the effects of a feed line break and ensures a source of steam for the turbine driven AFW pump during a feed line break.a. Steam Line Isolation-Manual Initiation Manual initiation of Steam Line Isolation can be accomplished from the control room. There are two system level switches in the control room and either switch can initiate action to immediately close all MSIVs. The LCO requires two channels to be OPERABLE.
| |
| Individual valves may also be closed using individual hand switches in the control room. The LCO requires four individual channels to be OPERABLE.b. Steam Line Isolation-Automatic Actuation Logic and Actuation Relays Automatic actuation logic and actuation relays consist of the same features and operate in the same manner as described for ESFAS Function 1.b.McGuire Unit 2 B 3.3.2-15 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| Manual and automatic initiation of steam line isolation must be OPERABLE in MODES 1, 2, and 3 when there is sufficient energy in the RCS and SGs to have an SLB or other accident.
| |
| This could result in the release of significant quantities of energy and cause a cooldown of the primary system. The Steam Line Isolation Function is required in MODES 2 and 3 unless all MSIVs are closed and de-activated.
| |
| In MODES 4, 5, and 6, there is insufficient energy in the RCS and SGs to experience an SLB or other accident releasing significant quantities of energy.c. Steam Line Isolation-Containment Pressure-High Hiqgh This Function actuates closure of the MSIVs in the event of a LOCA or an SLB inside containment to maintain three unfaulted SGs as a heat sink for the reactor, and to limit the mass and energy release to containment.
| |
| The Containment Pressure -High High function is described in ESFAS Function 2.C.Containment Pressure-High High must be OPERABLE in MODES 1, 2, and 3, when there is sufficient energy in the primary and secondary side to pressurize the containment following a pipe break. This would cause a significant increase in the containment pressure, thus allowing detection and closure of the MSIVs. The Steam Line Isolation Function remains OPERABLE in MODES 2 and 3 unless all MSIVs are closed and de-activated.
| |
| In MODES 4, 5, and 6, there is not enough energy in the primary and secondary sides to pressurize the containment to the Containment Pressure-High High setpoint.d. Steam Line Isolation-Steam Line Pressure (1) Steam Line Pressure-Low Steam Line Pressure-Low provides closure of the MSIVs in the event of an SLB to maintain three unfaulted SGs as a heat sink for the reactor, and to limit the mass and energy release to containment.
| |
| This Function provides closure of the MSIVs in the event of a feed line break to ensure a supply of steam for the turbine driven AFW pump.McGuire Unit 2 B 3.3.2-16 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| Steam Line Pressure-Low Function must be OPERABLE in MODES 1, 2, and 3 (above P-11), with any main steam valve open, when a secondary side break or stuck open valve could result in the rapid depressurization of the steam lines. This signal may be manually blocked by the operator below the P-11 setpoint.
| |
| Below P-1i1, an inside containment SLB will be terminated by automatic actuation via Containment Pressure-High High. Stuck valve transients and outside containment SLBs will be terminated by the Steam Line Pressure-Negative Rate-High signal for Steam Line Isolation below P-1 1 when Steam Line Isolation Steam Line Pressure-Low has been manually blocked. The Steam Line Isolation Function is required in MODES 2 and 3 unless all MSIVs are closed and de-activated.
| |
| This Function is not required to be OPERABLE in MODES 4, 5, and 6 because there is insufficient energy in the secondary side of the unit to have an accident.(2) Steam Line Pressure-Negative Rate-High Steam Line Pressure-Negative Rate-High provides closure of the MSIVs for an SLB when less than the P-1 1 setpoint, to maintain at least one unfaulted SG as a heat sink for the reactor, and to limit the mass and energy release to containment.
| |
| When the operator manually blocks the Steam Line Pressure-Low main steam isolation signal when less than the P-1 1 setpoint, the Steam Line Pressure-Negative Rate-High signal is automatically enabled. Steam Line Pressure-Negative Rate-High provides no input to any control functions.
| |
| Thus, three OPERABLE channels are sufficient to satisfy requirements with a two-out-of-three logic on each steam line.Steam Line Pressure-Negative Rate-High must be OPERABLE in MODE 3 when less than the P-1 1 setpoint, when a secondary side break or stuck open valve could result in the rapid depressurization of the steam line(s). In MODES 1 and 2, and in MODE 3, when above the P-11 setpoint, this signal is automatically disabled and the Steam Line Pressure-Low signal is automatically enabled. The Steam Line Isolation Function is required to be OPERABLE in McGuire Unit 2 B 3.3.2-17 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| MODES 2 and 3 unless all MSIVs are closed and de-activated.
| |
| In MODES 4, 5, and 6, there is insufficient energy in the primary and secondary sides to have an SLB or other accident that would result in a release of significant enough quantities of energy to cause a cooldown of the RCS.5. Turbine Trip and Feedwater Isolation The primary functions of the Turbine Trip and Feedwater Isolation signals are to prevent damage to the turbine due to water in the steam lines, stop the excessive flow of feedwater into the SGs, and to limit the energy released into containment.
| |
| These Functions are necessary to mitigate the effects of a high water level in the SGs, which could result in carryover of water into the steam lines and excessive cooldown of the primary system. The SG high water level is due to excessive feedwater flows. Feedwater isolation serves to limit the energy released into containment upon a feedwater line or steam line break inside containment.
| |
| The Functions are actuated when the level in any SG exceeds the high high setpoint, and performs the following functions:
| |
| * Trips the main turbine;* Trips the MFW pumps; and Initiates feedwater isolation (shuts the MFW control valves, bypass feedwater control valves, feedwater isolation valves, and the MFW to AFW nozzle bypass valves).Turbine Trip and Feedwater Isolation signals are both actuated by SG Water Level-High High, or by an SI signal. The RTS also initiates a turbine trip signal whenever a reactor trip (P-4) is generated.
| |
| A Feedwater Isolation signal is also generated by a reactor trip (P-4)coincident with Tavg-Low and on a high water level in the reactor building doghouse.
| |
| The MFW System is also taken out of operation and the AFW System is automatically started. The SI signal was discussed previously.
| |
| : a. Turbine Trip (1) Turbine Trip-Automatic Actuation LoQic and Actuation Relays Automatic Actuation Logic and Actuation Relays consist of McGuire Unit 2 B 3.3.2-18 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) the same features and operate in the same manner as described for ESFAS Function 1.b.(2) Turbine Trip-Steam Generator Water Level-High High (P-14)This signal prevents damage to the turbine due to water in the steam lines. The ESFAS SG water level instruments provide input to the SG Water Level Control System. Therefore, the actuation logic must be able to withstand both an input failure to the control system (which may then require the protection function actuation) and a single failure in the other channels providing the protection function actuation.
| |
| Only three protection channels are necessary to satisfy the protective requirements.
| |
| The setpoints are based on percent of narrow range instrument span.(3) Turbine Trip-Safety Injection Turbine Trip is also initiated by all Functions that initiate SI. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead Function 1, SI, is referenced for all initiating functions and requirements.
| |
| Item 5.a.(1) is referenced for the applicable MODES.The Turbine Trip Function must be OPERABLE in MODES 1 and 2. In lower MODES, the turbine generator is not in service and this Function is not required to be OPERABLE.b. Feedwater Isolation (1) Feedwater Isolation-Automatic Actuation Logic and Actuation Relays Automatic Actuation Logic and Actuation Relays consist of the same features and operate in the same APPLICABLE manner as described for ESFAS Function 1.b.McGuire Unit 2 B 3.3.2-19 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| (2) Feedwater Isolation-Steam Generator Water Level-High High (P-14)This signal provides protection against excessive feedwater flow. The ESFAS SG water level instruments provide input to the SG Water Level Control System. Therefore, the actuation logic must be able to withstand both an input failure to the control system (which may then require the protection function actuation) and a single failure in the other channels providing the protection function actuation.
| |
| Only three protection channels are necessary to satisfy the protective requirements.
| |
| The setpoints are based on percent of narrow range instrument span.(3) Feedwater Isolation-Safety Iniection Feedwater Isolation is also initiated by all Functions that initiate SI. The Feedwater Isolation Function requirements for these Functions are the same as the requirements for their SI function.
| |
| Therefore, the requirements are not repeated in Table 3.3.2-1.Instead Function 1, SI, is referenced for all initiating functions and requirements.
| |
| Item 5.b.(1) is referenced for the applicable MODES.(4) Feedwater Isolation
| |
| -RCS TaQ-Low Coincident With Reactor Trip (P-4)This signal provides protection against excessive cooldown, which could subsequently introduce a positive reactivity excursion after a plant trip. There are four channels of RCS Tavg-Low (one per loop), with a two-out-of-four logic required coincident with a reactor trip signal (P-4) to initiate a feedwater isolation.
| |
| The P-4 interlock is discussed in Function 8.a.(5) Turbine Trip and Feedwater Isolation
| |
| -Doghouse Water Level -High High This signal initiates a Feedwater Isolation.
| |
| The signal terminates forward feedwater flow in the event of a postulated pipe break in the main feedwater piping in the doghouses to prevent flooding safety related equipment essential to the safe shutdown of the plant.McGuire Unit 2 B 3.3.2-20 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| The level instrumentation consists of six level switches (three per train) in each of the two reactor building doghouses.
| |
| A high-high level detected by two-out-of-three switches in either train in the inboard or outboard doghouse will initiate a feedwater isolation.
| |
| This signal initiates Feedwater Isolation for the specific doghouse where the High-High level is detected and trips both main feedwater pumps thus causing a main turbine trip.The Feedwater Isolation Function must be OPERABLE in MODES 1 and 2 and also in MODE 3 (except for the functions listed in Table 3.3.2-1).Feedwater Isolation is not required OPERABLE when all MFIVs, MFCVs, and associated bypass valves are closed and de-activated or isolated by a closed manual valve. In lower MODES, the MFW System is not in service and this Function is not required to be OPERABLE.6. Auxiliary Feedwater The AFW System is designed to provide a secondary side heat sink for the reactor in the event that the MFW System is not available.
| |
| The system has two motor driven pumps and a turbine driven pump, making it available during normal and accident operation.
| |
| The normal source of water for the AFW System is the non-safety related AFW Storage Tank (Water Tower). A low suction pressure to the AFW pumps will automatically realign the pump suctions to the Nuclear Service Water System (NSWS)(safety related).
| |
| The AFW System is aligned so that upon a pump start, flow is initiated to the respective SGs immediately.
| |
| : a. Auxiliary Feedwater-Automatic Actuation Logic and Actuation Relays Automatic actuation logic and actuation relays consist of the same features and operate in the same manner as described for ESFAS Function 1.b.b. Auxiliary Feedwater-Steam Generator Water Level-Low Low SG Water Level-Low Low provides protection against a loss of heat sink. A feed line break, inside or outside of containment, or a loss of MFW, would result in a loss of SG water level. SG Water Level-Low Low provides input to the SG Level Control System.McGuire Unit 2 B 3.3.2-21 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| Therefore, the actuation logic must be able to withstand both an input failure to the control system which may then require a protection function actuation and a single failure in the other channels providing the protection function actuation.
| |
| Thus, four OPERABLE channels are required to satisfy the requirements with two-out-of-four logic. The setpoints are based on percent of narrow range instrument span.SG Water Level -Low Low in any operating SG will cause the motor driven AFW pumps to start. The system is aligned so that upon a start of the pump, water immediately begins to flow to the SGs. SG Water Level -Low Low in any two operating SGs will cause the turbine driven pumps to start.c. Auxiliary Feedwater-Safety Iniection An SI signal starts the motor driven AFW pumps. The AFW initiation functions are the same as the requirements for their SI function.
| |
| Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all initiating functions and requirements.
| |
| : d. Auxiliary Feedwater-Station Blackout A loss of power or degraded voltage to the service buses will be accompanied by a loss of reactor coolant pumping power and the subsequent need for some method of decay heat removal. The loss of power or degraded voltage is detected by a voltage drop on each essential service bus. Loss of power or degraded voltage to either essential service bus will start the turbine driven and motor driven AFW pumps to ensure that at least two SGs contain enough water to serve as the heat sink for reactor decay heat and sensible heat removal following the reactor trip. The turbine driven pump does not start on a loss of power coincident with a SI signal.Functions 6.a through 6.d must be OPERABLE in MODES 1, 2, and 3 to ensure that the SGs remain the heat sink for the reactor. These Functions do not have to be OPERABLE in MODES 5 and 6 because there is not enough heat being generated in the reactor to require the SGs as a heat sink. In MODE 4, AFW actuation does not need to be OPERABLE because either AFW or residual heat removal (RHR) will already be in operation to remove decay heat or sufficient time is available to manually place either system in operation.
| |
| McGuire Unit 2 B 3.3.2-22 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| : e. Auxiliary Feedwater-Trip of All Main Feedwater Pumps A Trip of all MFW pumps is an indication of a loss of MFW and the subsequent need for some method of decay heat and sensible heat removal to bring the reactor back to no load temperature and pressure.
| |
| Two contacts are provided in series (one from each MFW pump) in the starting circuit for each AFW pump. A trip of all MFW pumps closes both contacts and starts the motor driven AFW pumps to ensure that at least two SGs are available with water to act as the heat sink for the reactor. This function must be OPERABLE in MODES 1 and 2. This ensures that at least two SGs are provided with water to serve as the heat sink to remove reactor decay heat and sensible heat in the event of an accident.In MODES 3, 4, and 5, the MFW pumps are normally shut down, and thus neither pump trip is indicative of a condition requiring automatic AFW initiation.
| |
| : f. Auxiliary Feedwater-Pump Suction Transfer on Suction Pressure-Low A low pressure signal in the AFW pump suction line protects the AFW pumps against a loss of the normal supply of water for the pumps, the non-safety related AFW Storage Tank (Water Tower).Two pressure switches per train are located on the AFW pump suction line. The turbine driven AFW pump has a total of four switches.
| |
| A low pressure signal sensed by two-out-of-two switches on either train will cause the emergency supply of water for the pump to be aligned. The NSWS (safety grade) is then lined up to supply the AFW pumps to ensure an adequate supply of water for the AFW System to maintain at least two of the SGs as the heat sink for reactor decay heat and sensible heat removal.This Function must be OPERABLE in MODES 1, 2, and 3 to ensure a safety grade supply of water for the AFW System to maintain the SGs as the heat sink for the reactor. This Function does not have to be OPERABLE in MODES 5 and 6 because there is not enough heat being generated in the reactor to require the SGs as a heat sink. In MODE 4, AFW automatic suction transfer does not need to be OPERABLE because RHR will already be in operation, or sufficient time is available to place RHR in operation, to remove decay heat.McGuire Unit 2 B 3.3.2-23 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| : 7. Automatic Switchover to Containment Sump At the end of the injection phase of a LOCA, the RWST will be nearly empty. Continued cooling must be provided by the ECCS to remove decay heat. The source of water for the ECCS pumps is automatically switched to the containment recirculation sump. The low head residual heat removal (RHR) pumps and containment spray pumps draw the water from the containment recirculation sump, the RHR pumps pump the water through the RHR heat exchanger, inject the water back into the RCS, and supply the cooled water to the other ECCS pumps.Switchover from the RWST to the containment sump must occur before the RWST empties to prevent damage to the RHR pumps and a loss of core cooling capability.
| |
| : a. Automatic Switchover to Containment Sump-Refueling Water Storage Tank (RWST)Level-Low Coincident With Safety Iniection During the injection phase of a LOCA, the RWST is the source of water for all ECCS pumps. A low level in the RWST coincident with an SI signal provides protection against a loss of water for the ECCS pumps and indicates the end of the injection phase of the LOCA. The RWST is equipped with three level transmitters.
| |
| These transmitters provide no control functions.
| |
| Therefore, a two-out-of-three logic is adequate to initiate the protection function actuation.
| |
| Automatic switchover occurs only if the RWST low level signal is coincident with SI. This prevents accidental switchover during normal operation.
| |
| Accidental switchover could damage ECCS pumps if they are attempting to take suction from an empty sump.The automatic switchover Function requirements for the SI Functions are the same as the requirements for their SI function.Therefore, the requirements are not repeated in Table 3.3.2-1.Instead, Function 1, SI, is referenced for all initiating Functions and requirements.
| |
| These Functions must be OPERABLE in MODES 1, 2, and 3 when there is a potential for a LOCA to occur, to ensure a continued supply of water for the ECCS pumps. These Functions are not required to be OPERABLE in MODES 4, 5, and 6 because McGuire Unit 2 B 3.3.2-24 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) there is adequate time for the operator to evaluate unit conditions and respond by manually starting systems, pumps, and other equipment to mitigate the consequences of an abnormal condition or accident.
| |
| System pressure and temperature are very low and many ESF components are administratively locked out or otherwise prevented from actuating to prevent inadvertent overpressurization of unit systems.8. Engineered Safety Feature Actuation System Interlocks To allow some flexibility in unit operations, several interlocks are included as part of the ESFAS. These interlocks permit the operator to block some signals, automatically enable other signals, prevent some actions from occurring, and cause other actions to occur. The interlock Functions back up manual actions to ensure bypassable functions are in operation under the conditions assumed in the safety analyses.a. Engineered Safety Feature Actuation System Interlocks-Reactor Trip, P-4 The P-4 interlock is enabled when a reactor trip breaker (RTB) and its associated bypass breaker is open. Operators are able to reset SI 60 seconds after initiation.
| |
| If a P-4 is present when SI is reset, subsequent automatic SI initiation will be blocked until the RTBs have been manually closed. This Function allows operators to take manual control of SI systems after the initial phase of injection is complete while avoiding multiple SI initiations.
| |
| The functions of the P-4 interlock are:* Trip the main turbine;* Isolate MFW with coincident low Tavg;* Prevent reactuation of SI after a manual reset of SI; and* Prevent opening of the MFW isolation valves if they were closed on SI or SG Water Level-High High.McGuire Unit 2 B 3.3.2-25 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| Each of the above Functions is interlocked with P-4 to avert or reduce the continued cooldown of the RCS following a reactor trip.An excessive cooldown of the RCS following a reactor trip could cause an insertion of positive reactivity with a subsequent increase in generated power. To avoid such a situation, the noted Functions have been interlocked with P-4 as part of the design of the unit control and protection system.None of the noted Functions serves a mitigation function in the unit licensing basis safety analyses.
| |
| Only the turbine trip Function is explicitly assumed since it is an immediate consequence of the reactor trip Function.
| |
| Neither turbine trip, nor any of the other three Functions associated with the reactor trip signal, is required to show that the unit licensing basis safety analysis acceptance criteria are not exceeded.The RTB position switches that provide input to the P-4 interlock only function to energize or de-energize or open or close contacts.Therefore, this Function has no adjustable trip setpoint with which to associate a Trip Setpoint and Allowable Value.This Function must be OPERABLE in MODES 1, 2, and 3 when the reactor may be critical or approaching criticality.
| |
| This Function does not have to be OPERABLE in MODE 4, 5, or 6 because the main turbine, the MFW System are not in operation.
| |
| : b. Engineered Safety Feature Actuation System Interlocks-Pressurizer Pressure, P-i 1 The P-1 1 interlock permits a normal unit cooldown and depressurization without actuation of SI or main steam line isolation.
| |
| With two-out-of-three pressurizer pressure channels (discussed previously) less than the P-1 1 setpoint, the operator can manually block the Pressurizer Pressure-Low SI signal and the Steam Line Pressure-Low steam line isolation signal (previously discussed).
| |
| McGuire Unit 2 B 3.3.2-26 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| When the Steam Line Pressure-Low steam line isolation signal is manually blocked, a main steam isolation signal on Steam Line Pressure-Negative Rate-High is enabled. This provides protection for an SLB by closure of the MSIVs. With two-out-of-three pressurizer pressure channels above the P-1 1 setpoint, the Pressurizer Pressure-Low SI signal and the Steam Line Pressure-Low steam line isolation signal are automatically enabled. The operator can also enable these trips by use of the respective manual reset buttons. When the Steam Line Pressure-Low steam line isolation signal is enabled, the main steam isolation on Steam Line Pressure-Negative Rate-High is disabled.This Function must be OPERABLE in MODES 1, 2, and 3 to allow an orderly cooldown and depressurization of the unit without the actuation of SI or main steam isolation.
| |
| This Function does not have to be OPERABLE in MODE 4, 5, or 6 because system pressure must already be below the P-1 1 setpoint for the requirements of the heatup and cooldown curves to be met.c. Enqineered Safety Feature Actuation System Interlocks-Tava-Low Low, P-12 On increasing reactor coolant temperature, the P-12 interlock provides an arming signal to the Steam Dump System. On a decreasing temperature, the P-12 interlock removes the arming signal to the Steam Dump System to prevent an excessive cooldown of the RCS due to a malfunctioning Steam Dump System.Since Tavg is used as an indication of bulk RCS temperature, this Function meets redundancy requirements with one OPERABLE channel in each loop. These channels are used in two-out-of-four logic.This Function must be OPERABLE in MODES 1, 2, and 3 when a secondary side break or stuck open valve could result in the rapid depressurization of the steam lines. This Function does not have to be OPERABLE in MODE 4, 5, or 6 because there is insufficient energy in the secondary side of the unit to have an accident.McGuire Unit 2 B 3.3.2-27 Revision No. 119 LNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
| |
| : 9. Containment Pressure Control System Permissives The Containment Pressure Control System (CPCS) protects the Containment Building from excessive depressurization by preventing inadvertent actuation or continuous operation of the Containment Spray and Containment Air Return Systems when containment pressure is at or less than the CPCS permissive setpoint.
| |
| The control scheme of CPCS is comprised of eight independent control circuits (4 per train), each having a separate and independent pressure transmitter and current alarm module. Each pressure transmitter monitors the containment pressure and provides input to its respective current alarm. The current alarms are set to inhibit or terminate containment spray and containment air return fan operation when containment pressure falls below the setpoint.The alarm modules switch back to the permissive state (allowing the systems to operate) when containment pressure is greater than or equal to the setpoint.This function must be OPERABLE in MODES 1, 2, 3, and 4 when there is sufficient energy in the primary and secondary sides to pressurize containment following a pipe break. In MODES 5 and 6, there is insufficient energy in the primary and secondary sides to significantly pressurize the containment.
| |
| The ESFAS instrumentation satisfies Criterion 3 of 10 CFR 50.36 (Ref. 6).ACTIONS A Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed on Table 3.3.2-1. When the Required Channels in Table 3.3.2-1 are specified (e.g., on a per steam line, per loop, per SG, etc., basis), then the Condition may be entered separately for each steam line, loop, SG, etc., as appropriate.
| |
| A channel shall be OPERABLE if the point at which the channel trips is found equal to or more conservative than the Allowable Value. In the event a channel's trip setpoint is found less conservative than the Allowable Value, or the transmitter, instrument loop, signal processing electronics, or bistable is found inoperable, then all affected Functions provided by the channel must be declared inoperable and the LCO Condition(s) entered for the protection Function(s) affected.
| |
| If plant conditions warrant, the trip setpoint may be set outside the NOMINAL TRIP SETPOINT calibration tolerance band as long as the trip setpoint is conservative with respect to the NOMINAL TRIP SETPOINT.If the trip setpoint is found outside the NOMINAL TRIP SETPINT calibration tolerance band and non-conservative with respect to the NOMINAL TRIP SETPOINT, the setpoint shall be re-adjusted.
| |
| McGuire Unit 2 B 3.3.2-28 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued)
| |
| When the number of inoperable channels in a trip function exceed those specified in one or other related Conditions associated with a trip function, then the unit is outside the safety analysis.
| |
| Therefore, LCO 3.0.3 should be immediately entered if applicable in the current MODE of operation.
| |
| A.1 Condition A applies to all ESFAS protection functions.
| |
| Condition A addresses the situation where one or more channels or trains for one or more Functions are inoperable at the same time. The Required Action is to refer to Table 3.3.2-1 and to take the Required Actions for the protection functions affected.
| |
| The Completion Times are those from the referenced Conditions and Required Actions.B.1, B.2.1 and B.2.2 Condition B applies to manual initiation of:* SI;* Containment Spray;* Phase A Isolation; and 0 Phase B Isolation.
| |
| This action addresses the train orientation of the SSPS for the functions listed above. If a channel or train is inoperable, 48 hours is allowed to return it to an OPERABLE status. Note that for containment spray and Phase B isolation, failure of one or both channels in one train renders the train inoperable.
| |
| Condition B, therefore, encompasses both situations.
| |
| The specified Completion Time is reasonable considering that there are two automatic actuation trains and another manual initiation train OPERABLE for each Function, and the low probability of an event occurring during this interval.
| |
| If the train cannot be restored to OPERABLE status, the unit must be placed in a MODE in which the LCO does not apply. This is done by placing the unit in at least MODE 3 within an additional 6 hours (54 hours total time) and in MODE 5 within an additional 30 hours (84 hours total time). The allowable Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.McGuire Unit 2 B 3.3.2-29 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued)
| |
| C.1, C.2.1 and C.2.2 Condition C applies to the automatic actuation logic and actuation relays for the following functions:
| |
| 0 SI;* Containment Spray;* Phase A Isolation; and* Phase B Isolation.
| |
| This action addresses the train orientation of the SSPS and the master and slave relays. If one train is inoperable, 24 hours are allowed to restore the train to OPERABLE status. The 24 hours allowed for restoring the inoperable train to OPERABLE status is justified in Reference
| |
| : 10. The specified Completion Time is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this interval.
| |
| If the train cannot be restored to OPERABLE status, the unit must be placed in a MODE in which the LCO does not apply. This is done by placing the unit in at least MODE 3 within an additional 6 hours (30 hours total time) and in MODE 5 within an additional 30 hours (60 hours total time). The Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.The Required Actions are modified by a Note that allows one train to be bypassed for up to 4 hours for surveillance testing, provided the other train is OPERABLE.
| |
| The Required Actions are not required to be met during this time, unless the train is discovered inoperable during the testing. This allowance is based on the reliability analysis assumption of WCAP-10271-P-A (Ref. 7) that 4 hours is the average time required to perform train surveillance.
| |
| If an individual SSPS slave relay or slave relay contact is incapable of actuating, then the equipment operated by the slave relay or slave relay contact is inoperable.
| |
| An SSPS train is not inoperable due to an individual SSPS slave relay or slave relay contact being incapable of actuating.
| |
| D.1, D.2.1, and D.2.2 Condition D applies to:* Containment Pressure-High;
| |
| * Pressurizer Pressure-Low Low;* Steam Line Pressure-Low; McGuire Unit 2 B 3.3.2-30 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued)
| |
| * Steam Line Pressure-Negative Rate-High;
| |
| * SG Water Level -High High (P-14) for the Feedwater Isolation Function.* SG Water level-Low Low, and* Loss of offsite power.If one channel is inoperable, 72 hours are allowed to restore the channel to OPERABLE status or to place it in the tripped condition.
| |
| Generally this Condition applies to functions that operate on two-out-of-three logic.Therefore, failure of one channel places the Function in a two-out-of-two configuration.
| |
| One channel must be tripped to place the Function in a one-out-of-two configuration that satisfies redundancy requirements.
| |
| The 72 hours allowed to restore the channel to OPERABLE status or placed in the tripped condition is justified in Reference 10.Failure to restore the inoperable channel to OPERABLE status or place it in the tripped condition within 72 hours requires the unit be placed in MODE 3 within the following 6 hours and MODE 4 within the next 6 hours.The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 4, these Functions are no longer required OPERABLE.The Required Actions are modified by a Note that allows the inoperable channel to be bypassed for up to 12 hours for surveillance testing of other channels.
| |
| The note also allows an OPERABLE channel to be placed in bypass for up to 12 hours for testing of the bypassed channel. However, only one channel may be placed in bypass at any one time. The 12 hours allowed for testing, are justified in Reference 10.E.1, E.2.1, and E.2.2 Condition E applies to:* Containment Spray Containment Pressure -High High;* Containment Phase B Isolation Containment Pressure -High-High, and* Steam Line Isolation Containment Pressure -High High.McGuire Unit 2 B 3.3.2-31 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued)
| |
| None of these signals has input to a control function.
| |
| Thus, two-out-of-three logic is necessary to meet acceptable protective requirements.
| |
| However, a two-out-of-three design would require tripping a failed channel. This is undesirable because a single failure would then cause spurious containment spray initiation.
| |
| Spurious spray actuation is undesirable because of the cleanup problems presented.
| |
| Therefore, these channels are designed with two-out-of-four logic so that a failed channel may be bypassed rather than tripped.Note that one channel may be bypassed and still satisfy the single failure criterion.
| |
| Furthermore, with one channel bypassed, a single instrumentation channel failure will not spuriously initiate containment spray.To avoid the inadvertent actuation of containment spray and Phase B containment isolation, the inoperable channel should not be placed in the tripped condition.
| |
| Instead it is bypassed.
| |
| Restoring the channel to OPERABLE status, or placing the inoperable channel in the bypass condition within 72 hours, is sufficient to assure that the Function remains OPERABLE and minimizes the time that the Function may be in a partial trip condition (assuming the inoperable channel has failed high). The Completion Time is further justified based on the low probability of an event occurring during this interval.
| |
| Failure to restore the inoperable channel to OPERABLE status, or place it in the bypassed condition within72 hours, requires the unit be placed in MODE 3 within the following 6 hours and MODE 4 within the next 6 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 4, these Functions are no longer required OPERABLE.The Required Actions are modified by a Note that allows one additional channel to be bypassed for up to 12 hours for surveillance testing. Placing a second channel in the bypass condition for up to 12 hours for testing purposes is acceptable based on the results of Reference 10.F.1, F.2.1, and F.2.2 Condition F applies to:* Manual Initiation of Steam Line Isolation; and* P-4 Interlock.
| |
| McGuire Unit 2 B 3.3.2-32 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued)
| |
| For the Manual Initiation and the P-4 Interlock Functions, this action addresses the train orientation of the SSPS. If a train or channel is inoperable, 48 hours is allowed to return it to OPERABLE status. The specified Completion Time is reasonable considering the nature of these Functions, the available redundancy, and the low probability of an event occurring during this interval.
| |
| If the Function cannot be returned to OPERABLE status, the unit must be placed in MODE 3 within the next 6 hours and MODE 4 within the following 6 hours.The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power in an orderly manner and without challenging unit systems. In MODE 4, the unit does not have any analyzed transients or conditions that require the explicit use of the protection functions noted above.G.1 and G.2 Condition G applies to manual initiation of Steam Line Isolation.
| |
| This action addresses the operability of the manual steam line isolation function for each individual main steam isolation valve. If a channel is inoperable, 48 hours is allowed to return it to an OPERABLE status. If the train cannot be restored to OPERABLE status, the Conditions and Required Actions of LCO 3.7.2, "Main Steam Isolation Valves," must be entered for the associated inoperable valve. The specified Completion Time is reasonable considering that there is a system level manual initiation train for this Function and the low probability of an event occurring during this interval.H.1, H.2.1 and H.2.2 Condition H applies to the automatic actuation logic and actuation relays for the Steam Line Isolation, Feedwater Isolation, and AFW actuation Functions.
| |
| The action addresses the train orientation of the SSPS and the master and slave relays for these functions.
| |
| If one train is inoperable, 24 hours are allowed to restore the train to OPERABLE status. The 24 hours allowed for restoring the inoperable train to OPERABLE status is justified in Reference
| |
| : 10. The Completion Time for restoring a train to OPERABLE status is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this interval.
| |
| If the train cannot be returned to OPERABLE status, the unit must be brought to MODE 3 within the next 6 hours and MODE 4 within the following 6 hours. The allowed Co mpletion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.McGuire Unit 2 B 3.3.2-33 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued)
| |
| Placing the unit in MODE 4 removes all requirements for OPERABILITY of the protection channels and actuation functions.
| |
| In this MODE, the unit does not have analyzed transients or conditions that require the explicit use of the protection functions noted above.The Required Actions are modified by a Note that allows one train to be bypassed for up to 4 hours for surveillance testing provided the other train is OPERABLE.
| |
| This allowance is based on the reliability analysis (Ref. 7)assumption that 4 hours is the average time required to perform channel surveillance.
| |
| If an individual SSPS slave relay or slave relay contact is incapable of actuating, then the equipment operated by the slave relay or slave relay contact is inoperable.
| |
| An SSPS train is not inoperable due to an individual SSPS slave relay or slave relay contact being incapable of actuating.
| |
| 1.1 and 1.2 Condition I applies to the automatic actuation logic and actuation relays for the Turbine Trip Function.This action addresses the train orientation of the SSPS and the master and slave relays for this Function.
| |
| If one train is inoperable, 24 hours are allowed to restore the train to OPERABLE status or the unit must be placed in MODE 3 within the following 6 hours. The 24 hours allowed for restoring the inoperable train to OPERABLE status is justified in Reference
| |
| : 10. The Completion Time for restoring a train to OPERABLE status is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this interval.
| |
| The allowed Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems. These Functions are no longer required in MODE 3. Placing the unit in MODE 3 removes all requirements for OPERABILITY of the protection channels and actuation functions.
| |
| In this MODE, the unit does not have analyzed transients or conditions that require the explicit use of the protection functions noted above.The Required Actions are modified by a Note that allows one train to be bypassed for up to 4 hours for surveillance testing provided the other train is OPERABLE.
| |
| This allowance is based on the reliability analysis (Ref. 7)assumption that 4 hours is the average time required to perform channel surveillance.
| |
| If an individual SSPS slave relay or slave relay contact is incapable of actuating, then the equipment operated by the slave relay or slave relay McGuire Unit 2 B 3.3.2-34 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) contact is inoperable.
| |
| An SSPS train is not inoperable due to an individual SSPS slave relay or slave relay contact being incapable of actuating.
| |
| J.1 and J.2 Condition J applies to:* SG Water Level-High High (P-14) for the Turbine Trip Function; and" Tavg-LOW.If one channel is inoperable, 72 hours are allowed to restore one channel to OPERABLE status or to place it in the tripped condition.
| |
| If placed in the tripped condition, the Function is then in a partial trip condition where one-out-of-two logic will result in actuation.
| |
| The 72 hours allowed to restore the channel to OPERABLE status or to place it in the tripped condition is justified in Reference 10. Failure to restore the inoperable channel to OPERABLE status or place it in the tripped condition within 72 hours requires the unit to be placed in MODE 3 within the following 6 hours. The allowed Completion Time of 78 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems. In MODE 3, these Functions are no longer required OPERABLE.The Required Actions are modified by a Note that allows the inoperable channel to be bypassed for up to 12 hours for surveillance testing of other channels.
| |
| The note also allows an OPERABLE channel to be placed in bypass for up to 12 hours for testing of the bypassed channel. However, only one channel may be placed in bypass at any one time. The 72 hours allowed to place the inoperable channel in the tripped condition, and the 12 hours allowed for a channel to be in the bypassed condition for testing, are justified in Reference 10.K.1 and K.2 Condition K applies to the AFW pump start on trip of all MFW pumps.This action addresses the relay contact orientation for the auto start function of the AFW System on loss of all MFW pumps. The OPERABILITY of the AFW System must be assured by allowing automatic start of the AFW System pumps. If a channel is inoperable, 1 hour is allowed to place the channel in trip. If placed in the tripped condition, the function is then in a partial trip condition where a one-out-of-one logic will result in actuation.
| |
| If the channel is not placed in trip within 1 hour, 6 hours are McGuire Unit 2 B 3.3.2-35 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) allowed to place the unit in MODE 3. The allowed Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems. In MODE 3, the unit does not have any analyzed transients or conditions that require the explicit use of the protection function noted above.L. 1 Condition L applies to the Doghouse Water Level -High High.The failure of one required channel in one train in either reactor building doghouse results in a loss of redundancy for the function.
| |
| The function can still be initiated by the remaining operable train. The inoperable train is, required to be restored to OPERABLE status within 72 hours, or continuous visual monitoring of the doghouse water level must be implemented in the following hour.The allowed Completion Time is reasonable considering that the redundant train remains OPERABLE to initiate the function if required.M.1, M.2.1 and M.2.2 Condition M applies to the Doghouse Water Level -High High.The failure of two trains in either reactor building doghouse results in a loss of the function.
| |
| Continuous visual monitoring of the doghouse water level must be implemented in the following hour.The allowed Completion Time provides sufficient time for the operating staff to establish the required monitoring..
| |
| N.1 and N.2 Condition N applies to the Auxiliary Feedwater Pumps Suction Transfer on Suction Pressure Low.If one or more channels on a single AFW pump is inoperable, 48 hours is allowed to restore the channel(s) to OPERABLE status or to declare the associated AFW pump inoperable.
| |
| The failure of one or more channels on one pump disables the ability for the suction transfer on that pump.The allowed Completion Times are reasonable, considering the remaining redundant pumps and transfer instrumentation.
| |
| McGuire Unit 2 B 3.3.2-36 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) 0.1 Condition 0 applies to the Auxiliary Feedwater Pumps Suction Transfer on Suction Pressure Low.If one or more channels on more than one AFW pumps are inoperable, the ability for the suction transfer has been lost on multiple pumps. In this case, the associated AFW pumps must be declared inoperable immediately.
| |
| P.1 and P.2 Condition P applies to RWST Level-Low Coincident with Safety Injection.
| |
| RWST Level-Low Coincident with SI provides actuation of switchover to the containment sump. The inoperable channel shall be returned to OPERABLE status or placed in the trip condition within 1 hour. This Condition applies to a function that operates on two-out-or-three logic. Therefore, failure of one channel places the Function in a two-out-or-two configuration.
| |
| The channel must be tripped to place the Function in a one-out-of-two configuration that satisfies redundancy requirements.
| |
| A channel placed in the trip condition shall be restored to OPERABLE status within 48 hours. With one channel in the trip condition, a single failure of another channel coincident with a design basis Loss of Coolant Accident (LOCA) could result in premature automatic swapover of ECCS pumps to the containment recirculation sump. For a failure leading to early swapover, plant analyses assume operators do not have sufficient time to resolve the problem prior to ECCS pump damage.Consequently, as a result of this premature swapover, both trains of ECCS pumps could fail due to insufficient sump water level. This could prevent the ECCS pumps from performing their post-LOCA cooling function.
| |
| The allowed Completion Time of 48 hours is reasonable since, based on operating experience, there is a very small probability of a random failure of another RWST level channel in a given 48 hour period.Q.1, Q.2.1 and Q.2.2 Condition Q applies to the P-1 1 and P-1 2 interlocks.
| |
| With one channel inoperable, the operator must verify that the interlock is in the required state for the existing unit condition.
| |
| The verification is performed by visual observation of the permissive status light in the unit control room. This action manually accomplishes the function of the interlock.
| |
| Determination must be made within 1 hour. The 1 hour Completion Time is equal to the time allowed by LCO 3.0.3 to initiate shutdown actions in the event of a complete McGuire Unit 2 B 3.3.2-37 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) loss of ESFAS function.
| |
| If the interlock is not in the required state (or placed in the required state) for the existing unit condition, the unit must be placed in MODE 3 within the next 6 hours and MODE 4 within the following 6 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. Placing the unit in MODE 4 removes all requirements for OPERABILITY of these interlocks.
| |
| R. 1 Condition R applies to the Containment Pressure Control System Start and Terminate Permissives.
| |
| With one or more channels inoperable, the affected containment spray, containment air return fans, and hydrogen skimmer fans must be declared inoperable immediately.
| |
| The supported system LCOs provide the appropriate Required Actions and Completion Times for the equipment made inoperable by the inoperable channel. The immediate Completion Time is appropriate since the inoperable channel could prevent the supported equipment from starting when required.
| |
| Additionally, protection from an inadvertent actuation may not be provided if the terminate function is not OPERABLE.S.1 and S.2 Condition S applies to RWST Level-Low Coincident with Safety Injection.
| |
| When Required Actions cannot be completed within their Completion Time, the unit must be brought to a MODE or Condition in which the LCO requirements are not applicable.
| |
| To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and MODE 4 within 12 hours of entering the Condition.
| |
| The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 4, the unit does not have any analyzed transients of conditions that require the explicit use of the protection functions noted above.SURVEILLANCE The SRs for each ESFAS Function are identified by the SRs column of REQUIREMENTS Table 3.3.2-1.A Note has been added to the SR Table to clarify that Table 3.3.2-1 determines which SRs apply to which ESFAS Functions.
| |
| Note that each channel of process protection supplies both trains of the ESFAS. When testing channel I, train A and train B must be examined.McGuire Unit 2 B 3.3.2-38 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| Similarly, train A and train B must be examined when testing channel II, channel Ill, and channel IV (if applicable).
| |
| The CHANNEL CALIBRATION and COTs are performed in a manner that is consistent with the assumptions used in analytically calculating the required channel accuracies.
| |
| SR 3.3.2.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred.
| |
| A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels.
| |
| It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure;thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
| |
| Agreement criteria are determined by the unit staff, based on a combination of the channel instrument uncertainties, including indication and reliability.
| |
| If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.2.2 SR 3.3.2.2 is the performance of an ACTUATION LOGIC TEST using the semiautomatic tester. The train being tested is placed in the bypass condition, thus preventing inadvertent actuation.
| |
| Through the semiautomatic tester, all possible logic combinations, with and without applicable permissives, are tested for each protection function.
| |
| In addition, the master relay coil is pulse tested for continuity.
| |
| This verifies that the logic modules are OPERABLE and that there is an intact voltage signal path to the master relay coils. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.2.3 SR 3.3.2.3 is the performance of a COT on the RWST level and Containment Pressure Control Start and Terminate Permissives.
| |
| McGuire Unit 2 B 3.3.2-39 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| A COT is performed on each required channel to ensure the entire channel will perform the intended Function.
| |
| Setpoints must be found within the Allowable Values specified in Table 3.3.2-1. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.2.4 SR 3.3.2.4 is the performance of a MASTER RELAY TEST. The MASTER RELAY TEST is the energizing of the master relay, verifying contact operation and a low voltage continuity check of the slave relay coil. Upon master relay contact operation, a low voltage is injected to the slave relay coil. This voltage is insufficient to pick up the slave relay, but large enough to demonstrate signal path continuity.
| |
| The time allowed for the testing (4 hours) is justified in Reference
| |
| : 7. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.2.5 SR 3.3.2.5 is the performance of a COT.A COT is performed on each required channel to ensure the channel will perform the intended Function.
| |
| The tested portion of the loop must trip within the Allowable Values specified in Table 3.3. 2-1.The setpoint shall be left set consistent with the assumptions of the setpoint methodology.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.2.6 SR 3.3.2.6 is the performance of a SLAVE RELAY TEST. The SLAVE RELAY TEST is the energizing of the slave relays. Contact operation is verified in one of two ways. Actuation equipment that may be operated in the design mitigation MODE is either allowed to function, or is placed in a condition where the relay contact operation can be verified without operation of the equipment.
| |
| Actuation equipment that may not be operated in the design mitigation MODE is prevented from operation by the SLAVE RELAY TEST circuit. For this latter case, contact operation is verified by a continuity check of the circuit containing McGuire Unit 2 B 3.3.2-40 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued) the slave relay. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.2.7 SR 3.3.2.7 is the performance of a TADOT. This test is a check of the Manual Actuation Functions, AFW pump start, Reactor Trip (P-4) Interlock and Doghouse Water Level -High High feedwater isolation.
| |
| Each Manual Actuation Function is tested up to, and including, the master relay coils. In some instances, the test includes actuation of the end device (i.e., pump starts, valve cycles, etc.). The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program. The SR is modified by a Note that excludes verification of setpoints during the TADOT for manual initiation Functions.
| |
| The manual initiation Functions have no associated setpoints.
| |
| SR 3.3.2.8 SR 3.3.2.8 is the performance of a CHANNEL CALIBRATION.
| |
| The CHANNEL CALIBRATION may be performed at power or during refueling based on bypass testing capability.
| |
| Channel unavailability evaluations in References 10 and 11 have conservatively assumed that the CHANNEL CALIBRATION is performed at power with the channel in bypass.CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to measured parameter within the necessary range and accuracy.CHANNEL CALIBRATIONS must be performed consistent with the assumptions of the unit specific setpoint methodology.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.This SR is modified by a Note stating that this test should include verification that the time constants are adjusted to the prescribed values where applicable.
| |
| The applicable time constants are shown in Table 3.3.2-1.McGuire Unit 2 B 3.3.2-41 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.3.2.9 This SR ensures the individual channel ESF RESPONSE TIMES are less than or equal to the maximum values assumed in the accident analysis.
| |
| Response Time testing acceptance criteria are included in the UFSAR (Ref. 2). Individual component response times are not modeled in the analyses.
| |
| The analyses model the overall or total elapsed time, from the point at which the parameter exceeds the Trip Setpoint value at the sensor, to the point at which the equipment in both trains reaches the required functional state (e.g., pumps at rated discharge pressure, valves in full open or closed position).
| |
| For channels that include dynamic transfer functions (e.g., lag, lead/lag, rate/lag, etc.), the response time test may be performed with the transfer functions set to one with the resulting measured response time compared to the appropriate UFSAR response time. Alternately, the response time test can be performed with the time constants set to their nominal value provided the required response time is analytically calculated assuming the time constants are set at their nominal values. The response time may be measured by a series of overlapping tests such that the entire response time is measured.Response time may be verified by actual response time tests in any series of sequential, overlapping or total channel measurements, or by the summation of allocated sensor, signal processing and actuation logic response times with actual response time tests on the remainder of the channel. Allocations for sensor response times may be obtained from: (1) historical records based on acceptable response time tests (hydraulic, noise, or power interrupt tests), (2)in place, onsite, or offsite (e.g., vendor) test measurements, or (3) utilizing vendor engineering specifications.
| |
| WCAP-13632-P-A, Revision 2, "Elimination of Pressure Sensor Response Time Testing Requirements" provides the basis and methodology for using allocated sensor response times in the overall verification of the channel response time for specific sensors identified in the WCAP. Response time verification for other sensor types must be either demonstrated by test or their equivalency to those listed in WCAP-1 3632-P-A, Revision 2. Any demonstration of equivalency must have been determined to be acceptable by NRC staff review.WCAP-14036-P-A, Revision 1, "Elimination of Periodic Protection Channel Response Time Tests' provides the basis and methodology for using allocated signal processing and actuation logic response times in the overall verification of the protection system channel response time. The allocations for sensor, signal conditioning, and actuation logic response times must be verified prior to placing the component in operational service and re-verified following maintenance that may adversely affect response time. In general, electrical repair work does not impact response time provided the parts used for repair are of the same type and value. Specific components identified in the WCAP McGuire Unit 2 B 3.3.2-42 Revision No. 119 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012.ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued) may be replaced without verification testing. One example where response time could be affected is replacing the sensing assembly of a transmitter.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.This SR is modified by a Note that clarifies that the turbine driven AFW pump is tested within 24 hours after reaching 900 psig in the SGs.REFERENCES
| |
| : 1. UFSAR, Chapter 6.2. UFSAR, Chapter 7.3. UFSAR, Chapter 15.4. IEEE-279-1971.
| |
| : 5. 10 CFR 50.49.6. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| : 7. WCAP-10271-P-A, Supplement 1 and Supplement 2, Rev. 1, May 1986 and June 1990.8. WCAP 13632-P-A, Revision 2, "Elimination of Pressure Sensor Response Time Testing Requirements" Sep., 1995.9. WCAP-14036-P-A, Revision 1, "Elimination of Periodic Protection Channel Response Time Tests" Oct., 1998.10. WCAP-14333-P-A, Revision 1, October 1998.11. WCAP-15376-P-A, Revision 1, March 2003.McGuire Unit 2 B 3.3.2-43 Revision No. 119 UNIT 1 BASES 3.3.3 License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during 1 EOC2 1. Until the ECCS amendment can be implemented on Unit 2, there will be separate documents for Unit 1 and Unit 2 Bases 3.3.3.ECCS Water Management Modification is scheduled to be implemented on Unit 2 during the fall 2012 outage.
| |
| UNIT 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during I EOC2 1.Until the ECCS amendment can be implemented on Unit 2, there will be separate Bases documents for Unit I and Unit 2 for Bases 3.3.2, 3.3.3, 3.5.4, 3.6.6, and 3.6.11. ECCS Water Managzement Modification is scheduled to be implemented on Unit 2 during the fall 2012 outage.PAM Instrumentation B 3.3.3 B 3.3 INSTRUMENTATION B 3.3.3 Post Accident Monitoring (PAM) Instrumentation BASES BACKGROUND The primary purpose of the PAM instrumentation is to display unit variables that provide information required by the control room operators during accident situations.
| |
| This information provides the necessary support for the operator to take the manual actions for which no automatic control is provided and that are required for safety systems to accomplish their safety functions for Design Basis Accidents (DBAs).The OPERABILITY of the accident monitoring instrumentation ensures that there is sufficient information available on selected unit parameters to monitor and to assess unit status and behavior following an accident.The availability of accident monitoring instrumentation is important so that responses to corrective actions can be observed and the need for, and magnitude of, further actions can be determined.
| |
| These essential instruments are identified by unit specific documents (Ref. 1) addressing the recommendations of Regulatory Guide 1.97 (Ref. 2) as required by Supplement 1 to NUREG-0737 (Ref. 3).The instrument channels required to be OPERABLE by this LCO include two classes of parameters identified during unit specific implementation of Regulatory Guide 1.97 as Type A and Category I variables.
| |
| Type A variables are included in this LCO because they provide the primary information required for the control room operator to take specific manually controlled actions for which no automatic control is provided, and that are required for safety systems to accomplish their safety functions for DBAs.Category I variables are the key variables deemed risk significant because they are needed to: Determine whether other systems important to safety are performing their intended functions; Provide information to the operators that will enable them to determine the likelihood of a gross breach of the barriers to radioactivity release; and McGuire Unit 1 B 3.3.3-1 Revision No. 117 UNIT 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during I EOC21.ECCS. The Water Manapement Modification is scheduled to be imrlemented on Unit 2 durin, the fall 2012 outae.PAM Instrumentation B 3.3.3 BASES BACKGROUND (continued)
| |
| Provide information regarding the release of radioactive materials to allow for early indication of the need to initiate action necessary to protect the public, and to estimate the magnitude of any impending threat.These key variables are identified by the unit specific Regulatory Guide 1.97 analyses (Ref. 1). These analyses identify the unit specific Type A and Category I variables and provide justification for deviating from the NRC proposed list of Category I variables.
| |
| The specific instrument Functions listed in Table 3.3.3-1 are discussed in the LCO section.APPLICABLE The PAM instrumentation ensures the operability of Regulatory Guide SAFETY ANALYSES 1.97 Type A and Category I variables so that the control room operating staff can: Perform the diagnosis specified in the emergency operating procedures (these variables are restricted to preplanned actions for the primary success path of DBAs), e.g., loss of coolant accident (LOCA);* Take the specified, pre-planned, manually controlled actions, for which no automatic control is provided, and that are required for safety systems to accomplish their safety function;* Determine whether systems important to safety are performing their intended functions;
| |
| * Determine the likelihood of a gross breach of the barriers to radioactivity release;0 Determine if a gross breach of a barrier has occurred; and 0 Initiate action necessary to protect the public and to estimate the magnitude of any impending threat.PAM instrumentation that meets the definition of Type A in Regulatory Guide 1.97 satisfies Criterion 3 of 10 CFR 50.36 (Ref. 4). Category I, non-Type A, instrumentation must be retained in TS because it is intended to assist operators in minimizing the consequences of accidents.
| |
| Therefore, Category I, non-Type A, variables are important for reducing public risk.McGuire Unit 1 B 3.3.3-2 Revision No. 117 UNIT 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during I EOC2 1.ECCS. The Water Manaaement Modification is scheduled to be imDlemented on Unit'2 durin2 the fall 2012 outape.PAM Instrumentation B 3.3.3 BASES LCO The PAM instrumentation LCO provides OPERABILITY requirements for Regulatory Guide 1.97 Type A monitors, which provide information required by the control room operators to perform certain manual actions specified in the unit Emergency Operating Procedures.
| |
| These manual actions ensure that a system can accomplish its safety function, and are credited in the safety analyses.
| |
| Additionally, this LCO addresses Regulatory Guide 1.97 instruments that have been designated Category I, non-Type A.The OPERABILITY of the PAM instrumentation ensures there is sufficient information available on selected unit parameters to monitor and assess unit status following an accident.
| |
| This capability is consistent with the recommendations of Reference 1.LCO 3.3.3 requires two OPERABLE channels for most Functions.
| |
| Two OPERABLE channels ensure no single failure prevents operators from getting the information necessary for them to determine the safety status of the unit, and to bring the unit to and maintain it in a safe condition following an accident.Furthermore, OPERABILITY of two channels allows a CHANNEL CHECK during the post accident phase to confirm the validity of displayed information.
| |
| In some cases, the total number of channels exceeds the number of required channels, e.g., pressurizer level has a total of three channels, however only two channels are required OPERABLE.
| |
| This provides additional redundancy beyond that required by this LCO, i.e., when one channel of pressurizer level is inoperable, the required number of two channels can still be met. The ACTIONS of this LCO are only entered when the required number of channels cannot be met.Category I variables are required to meet Regulatory Guide 1.97 Category I (Ref. 2) design and qualification requirements for seismic and environmental qualification, single failure criterion, utilization of emergency standby power, immediately accessible display, continuous readout, and recording of display.Listed below are discussions of the specified instrument Functions listed in Table 3.3.3-1.1. Neutron Flux -(Wide Ranqe)Wide Range Neutron Flux indication is provided to verify reactor shutdown.McGuire Unit 1 B 3.3.3-3 Revision No. 117 UNIT I -License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during I EOC2 1.ECCS. The Water Management Modification is scheduled to be imtlemented on Unit 2 during the fall 2012 outage.PAM Instrumentation B 3.3.3 BASES LCO (continued)
| |
| Neutron flux is used for accident diagnosis, verification of subcriticality, and diagnosis of positive reactivity insertion.
| |
| Two channels of wide range neutron flux are required OPERABLE.2, 3. Reactor Coolant System (RCS) Hot and Cold Leq Temperatures RCS Hot and Cold Leg Temperatures are Category I variables provided for verification of core cooling and long term surveillance.
| |
| RCS hot and cold leg temperatures are used to determine RCS subcooling margin. RCS subcooling margin will allow termination of safety injection (SI), if still in progress, or reinitiation of SI if it has been stopped. RCS subcooling margin is also used for unit stabilization and cooldown control.In addition, RCS cold leg temperature is used in conjunction with RCS hot leg temperature to verify the unit conditions necessary to establish natural circulation in the RCS.Reactor coolant hot and cold leg temperature inputs are provided by fast response resistance elements and associated transmitters in each loop.Two channels of RCS Hot Leg Temperature and two channels of RCS Cold Leg Temperature are required OPERABLE by the LCO.RCS Hot Leg and Cold Leg Temperature are diverse indications of RCS temperature.
| |
| Core exit thermocouples also provide diverse indication of RCS temperature.
| |
| : 4. Reactor Coolant System Pressure (Wide Range)RCS wide range pressure is a Category I variable provided for verification of core cooling and RCS integrity long term surveillance.
| |
| RCS pressure is used to verify delivery of SI flow to RCS from at least one train when the RCS pressure is below the pump shutoff head. RCS pressure is also used to verify closure of manually closed spray line valves and pressurizer power operated relief valves (PORVs).McGuire Unit 1 B 3.3.3-4 Revision No. 117 UNIT 1 -License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during I EOC2 1.ECCS. The Water Management Modification is scheduled to be implernented on Unit 2 during the fall 2012 outage.PAM Instrumentation B 3.3.3 BASES LCO (continued)
| |
| In addition to these verifications, RCS pressure is used for determining RCS subcooling margin. RCS pressure can also be used: to determine whether to terminate actuated SI or to reinitiate stopped SI;to determine when to reset SI and shut off low head SI;to manually restart low head SI;as reactor coolant pump (RCP) trip criteria; and to make a determination on the nature of the accident in progress and where to go next in the procedure.
| |
| RCS pressure is also related to three decisions about depressurization.
| |
| They are: to determine whether to proceed with primary system depressurization; to verify termination of depressurization; and to determine whether to close accumulator isolation valves during a controlled cooldown/depressurization.
| |
| A final use of RCS pressure is to determine whether to operate the pressurizer heaters.RCS pressure is a Type A variable because the operator uses this indication to monitor the cooldown of the RCS following a steam generator tube rupture (SGTR) or small break LOCA. Operator actions to maintain a controlled cooldown, such as adjusting steam generator (SG) pressure or level, would use this indication.
| |
| Furthermore, RCS pressure is one factor that may be used in decisions to terminate RCP operation.
| |
| Two channels of wide range RCS pressure are required OPERABLE.McGuire Unit 1 B 3.3.3-5 Revision No. 117 UNIT 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during I EOC21.ECCS. The Water Management Modification is scheduled to be imolemented on Unit 2 during the fall 2012 outage.PAM Instrumentation B 3.3.3 BASES LCO (continued) 5, 6. Reactor Vessel Water Level Reactor Vessel Water Level is provided for verification and long term surveillance of core cooling. It is also used for accident diagnosis and to determine reactor coolant inventory adequacy.The Reactor Vessel Water Level Monitoring System provides a direct measurement of the collapsed liquid level above the fuel alignment plate. The collapsed level represents the amount of liquid mass that is in the reactor vessel above the core.Measurement of the collapsed water level is selected because it is a direct indication of the water inventory.
| |
| Two channels of Reactor Vessel Water Level are provided in both the core region (lower range) and the head region (wide range) with indication in the unit control room. Each channel uses differential pressure transmitters and a microprocessor to calculate true vessel level or relative void content of the primary coolant.7. Containment Sump Water Level (Wide Range)Containment Sump Water Level is provided for verification and long term surveillance of RCS integrity.
| |
| Containment Sump Water Level is used to determine:
| |
| * containment sump level accident diagnosis; and* when to continue the recirculation procedure.
| |
| Two channels of wide range level are required OPERABLE.
| |
| Each channel consists of wide range level indication and two level switches.8. Containment Pressure (Wide Range)Containment Pressure (Wide Range) is provided for verification of RCS and containment OPERABILITY.
| |
| Containment pressure is used to verify closure of main steam isolation valves (MSIVs), containment spray operation, and Phase B containment isolation when Containment Pressure -High High is reached.McGuire Unit 1 B 3.3.3-6 Revision No. 117 UNIT 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during I EOC2 1.ECCS. The Water Management Modification is scheduled to be imolemented on Unit 2 durine the fall 2012 outape.PAM Instrumentation B 3.3.3 BASES LCO (continued)
| |
| Two channels of wide range containment pressure are required OPERABLE.9. Containment Atmosphere Radiation (High Range)Containment Atmosphere Radiation is provided to monitor for the potential of significant radiation releases and to provide release assessment for use by operators in determining the need to invoke site emergency plans. Containment radiation level is used to determine if a high energy line break (HELB) has occurred, and whether the event is inside or outside of containment.
| |
| Two channels of high range containment atmosphere radiation are provided.
| |
| One channel is required OPERABLE.
| |
| Diversity is provided by portable instrumentation or by sampling and analysis.10. Not Used 11. Pressurizer Level Pressurizer Level is used to determine whether to terminate SI, if still in progress, or to reinitiate SI if it has been stopped.Knowledge of pressurizer water level is also used to verify the unit conditions necessary to establish natural circulation in the RCS and to verify that the unit is maintained in a safe shutdown condition.
| |
| Three channels of pressurizer level are provided.
| |
| Two channels are required OPERABLE.12. Steam Generator Water Level (Narrow Range)SG Water Level is provided to monitor operation of decay heat removal via the SGs. The Category I indication of SG level is the narrow range level instrumentation.
| |
| McGuire Unit 1 B 3.3.3-7 Revision No. 117 UNIT 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during I EOC21.ECCS. The Water Manapement Modification is scheduled to be imolemented on Unit 2 during the fall 2012 outage.PAM Instrumentation B 3.3.3 BASES LCO (continued)
| |
| SG Water Level (Narrow Range) is used to: " identify the faulted SG following a tube rupture;" verify that the intact SGs are an adequate heat sink for the reactor;" determine the nature of the accident in progress (e.g., verify an SGTR); and* verify unit conditions for termination of SI during secondary unit HELBs outside containment.
| |
| Four channels per SG of narrow range water level are provided.Only two channels are required OPERABLE by the LCO.13, 14, 15, 16. Core Exit Temperature Core Exit Temperature is provided for verification and long term surveillance of core cooling.Adequate core cooling is ensured with two valid Core Exit Temperature channels per quadrant with two CETs per required channel. Core inlet temperature data is used with core exit temperature to give radial distribution of coolant enthalpy rise across the core. Core Exit Temperature is used to determine whether to terminate SI, if still in progress, or to reinitiate SI if it has been stopped. Core Exit Temperature is also used for unit stabilization and cooldown control.Two OPERABLE channels of Core Exit Temperature are required in each quadrant to provide indication of radial distribution of the coolant temperature rise across representative regions of the core.Two sets of two thermocouples (1 set from each redundant power train) ensure a single failure will not disable the ability to determine the radial temperature gradient.17. Auxiliary Feedwater Flow AFW Flow is provided to monitor operation of decay heat removal via the SGs.McGuire Unit 1 B 3.3.3-8 Revision No. 117 UNIT 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during I EOC21.ECCS. The Water Management Modification is scheduled to be imDlemented on Unit 2 durine the fall 2012 outage.PAM Instrumentation B 3.3.3 BASES LCO (continued)
| |
| The AFW Flow to each SG is determined by flow indicators, pump operational status indicators, and NSWS and condensate supply valve indicators in the control room. The AFW flow indicators are category 2, type D variables which are used to demonstrate the category 1 variable of AFW assured source.AFW flow is used three ways: to verify delivery of AFW flow to the SGs;to determine whether to terminate SI if still in progress, in conjunction with SG water level (narrow range); and to regulate AFW flow so that the SG tubes remain covered.18. RCS Subcoolincq Margin Monitor RCS subcooling is provided to allow unit stabilization and cooldown control. RCS subcooling will allow termination of SI, if still in progress, or reinitiation of SI if it has been stopped.The margin to saturation is calculated from RCS pressure and temperature measurements.
| |
| Display of the RCS subcooling margin values is provided via the Inadequate Core Cooling Monitor Subcooling Margin Monitor (ICCM SMM) and the Plant Computer.The plant computer is the primary indication for RCS subcooling margin. Backup indication of the RCS subcooling margin consists of two qualified redundant channels each consisting of one ICCM plasma display and one ICCM cabinet, with each ICCM cabinet receiving inputs from 20 core exit thermocouples, one wide range RCS pressure transmitter, and two wide range hot leg RTDs all associated with that channel (train) of ICCM SMM. Therefore, a single train of ICCM SMM including the associated RCS subcooling margin field inputs is equivalent to a single channel of the "RCS Subcooling Margin Monitor" technical specifications function.Each train of ICCM SMM uses the average of the five highest core exit thermocouples and the wide range RCS pressure for that train to determine primary system conditions.
| |
| The primary system conditions are then compared to saturation curves to calculate and display the margin to subcooling.
| |
| Each train of ICCM SMM also calculates subcooling values for each of the two wide range hot leg temperature RTDs associated with that train.McGuire Unit 1 B 3.3.3-9 Revision No. 117 UNIT I -License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during I EOC2 1.ECCS. The Water Manaement Modification is scheduled to be imolemented on Unit 2 durine the fall 2012 outape.PAM Instrumentation B 3.3.3 BASES LCO (continued)
| |
| Therefore, a single train (channel) of SMM provides three diverse subcooling margin values. The diversity of temperature inputs for a channel (train) of the RCS Subcooling Margin Monitor function minimizes the impact to this function resulting from the failure of a single field input.A graphic display on the ICCM over the required range gives the operator a representation of primary system conditions compared to various curved of importance (saturation, etc.).Note: Each train's RCS Subcooling Margin values are displayed on the respective train's ICCM SMM display and the Plant Computer.In addition to displaying the subcooling values received from the ICCM SMM, the plant computer performs independent RCS Subcooling Margin calculations using the average of the five highest core exit thermocouples and wide range RCS pressure to determine primary system conditions.
| |
| The plant computer compares the primary system conditions to plant computer saturation curves to calculate and display the core margin to subcooling.
| |
| The plant computer also calculates and displays subcooling values based on the wide range hot leg and cold leg temperature RTDs.A graphic display on the plant computer over the required range gives the operator a representation of primary system conditions compared to various curves of importance (saturation, NDT, etc.).A backup program exists to ensure the capability to accurately monitor RCS subcooling.
| |
| The program includes training and a procedure to manually calculate subcooling margin, using control room pressure and temperature instruments.
| |
| : 19. Steam Line Pressure Steam Line Pressure is provided to monitor operation of decay heat removal via the SGs. Steam line pressure is also used to determine if a high energy secondary line rupture occurred and which SG is faulted.Two channels of Steam Line Pressure are required OPERABLE.McGuire Unit 1 B 3.3.3-10 Revision No. 117 UNIT 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I pol during I EOC2 1.ECCS. The Water Management Modification is scheduled to be imDlemented on Unit 2 during the fall 2012 outage.PAM Instrumentation B 3.3.3 BASES LCO (continued)
| |
| : 20. Refueling Water Storage Tank Level RWST level monitoring is provided to ensure an adequate supply of water to the ECCS pumps during the switchover to cold leg recirculation.
| |
| Three channels of RWST level are provided.
| |
| Two channels are required OPERABLE by the LCO.21. DG Heat Exchanger NSWS Flow Flow indicators are provided in each of the NSWS trains to indicate cooling water flow through the respective train DG. These indicators are provided for operators to manually control flow to the DG heat exchanger.
| |
| One flow indicator is required OPERABLE on each train.22. Containment Spray Heat Exchanger NSWS Flow Flow indicators are provided in each of the NSWS trains to indicate cooling water flow through the respective train containment spray heat exchangers.
| |
| These indicators are provided for operators to manually control flow to the heat exchanger.
| |
| One flow indicator is required OPERABLE on each train.APPLICABILITY The PAM instrumentation LCO is applicable in MODES 1, 2, and 3.These variables are related to the diagnosis and pre-planned actions required to mitigate DBAs. The applicable DBAs are assumed to occur in MODES 1, 2, and 3. In MODES 4, 5, and 6, unit conditions are such that the likelihood of an event that would require PAM instrumentation is low;therefore, the PAM instrumentation is not required to be OPERABLE in these MODES.ACTIONS A Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed on Table 3.3.3-1. When the Required Channels in Table 3.3.3-1 are specified (e.g., on a per steam line, per loop, per SG, etc., basis), then the Condition may be entered separately for each steam line, loop, SG, etc., as appropriate.
| |
| The Completion Time(s) of the inoperable channel(s) of a Function will be ACTIONS (continued)
| |
| McGuire Unit 1 B 3.3.3-11 Revision No. 117 UNIT 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during I EOC21.ECCS. The Water Manaeement Modification is scheduled to be imilemented on Unit 2 during the fall 2012 outaae.PAM Instrumentation B 3.3.3 BASES tracked separately for each Function starting from the time the Condition was entered for that Function.A.1 Condition A applies to all PAM instrument Functions.
| |
| Condition A addresses the situation when one or more required channels for one or more Functions are inoperable.
| |
| The Required Action is to refer to Table 3.3.3-1 and take the appropriate Required Actions for the PAM instrumentation affected.
| |
| The Completion Times are those from the referenced Conditions and Required Actions.B. 1 Condition B applies when one or more Functions have one required channel that is inoperable.
| |
| Required Action B.1 requires restoring the inoperable channel to OPERABLE status within 30 days. The 30 day Completion Time is based on operating experience and takes into account the remaining OPERABLE channel, the passive nature of the instrument (no critical automatic action is assumed to occur from these instruments), and the low probability of an event requiring PAM instrumentation during this interval.
| |
| Condition B is not applicable to functions with a single required channel.C.1 Condition C applies when the Required Action and associated Completion Time for Condition B are not met. This Required Action specifies initiation of actions in Specification 5.6.7, which requires a written report to be submitted to the NRC immediately.
| |
| This report discusses the results of the root cause evaluation of the inoperability and identifies proposed restorative actions. This action is appropriate in lieu of a shutdown requirement since alternative actions are identified before loss of functional capability, and given the likelihood of unit conditions that would require information provided by this instrumentation.
| |
| McGuire Unit 1 B 3.3.3-12 Revision No. 117 UNIT 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during I EOC2 1.ECCS. The Water Management Modification is scheduled to be imDlemented on Unit 2 during the fall 2012 outage.PAM Instrumentation B 3.3.3 BASES ACTIONS (continued)
| |
| D. 1 Condition D applies when a single require channel is inoperable.
| |
| Required Action D.A requires restoring the required channel to OPERABLE status within 7 days. The Completion Time of 7 days is based on the relatively low probability of an event requiring PAM instrument operation and the availability of alternate means to obtain the required information.
| |
| Continuous operation with the required channel inoperable is not acceptable.
| |
| Therefore, requiring restoration of the required channel to OPERABLE status limits the risk that the PAM function will be in a degraded condition should an event occur.E. 1 Condition E applies when one or more Functions have two inoperable required channels (i.e., two channels inoperable in the same Function).
| |
| Required Action E.1 requires restoring one channel in the Function(s) to OPERABLE status within 7 days. The Completion Time of 7 days is based on the relatively low probability of an event requiring PAM instrument operation and the availability of alternate means to obtain the required information.
| |
| Continuous operation with two required channels inoperable in a Function is not acceptable because the alternate indications may not fully meet all performance qualification requirements applied to the PAM instrumentation.
| |
| Therefore, requiring restoration of one inoperable channel of the Function limits the risk that the PAM Function will be in a degraded condition should an accident occur.Condition E does not apply to hydrogen monitor channels and functions with single channels.F. 1 Not Used G.1 and G.2 If the Required Action and associated Completion Time of Conditions D or E are not met, the unit must be brought to a MODE where the requirements of this LCO do not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and MODE 4 within 12 hours.The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.McGuire Unit 1 B 3.3.3-13 Revision No. 117 UNIT 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during I EOC2 1.ECCS. The Water Management Modification is scheduled to be imDlemented on Unit 2 durin, the fall 2012 outage.PAM Instrumentation B 3.3.3 BASES ACTIONS (continued)
| |
| H.1 Alternate means of monitoring Containment Area Radiation have been developed and tested. These alternate means may be temporarily installed if the normal PAM channel cannot be restored to OPERABLE status within the allotted time. If these alternate means are used, the Required Action is not to shut down the unit but rather to follow the directions of Specification 5.6.7, in the Administrative Controls section of the TS. The report provided to the NRC should discuss the alternate means used, describe the degree to which the alternate means are equivalent to the installed PAM channels, justify the areas in which they are not equivalent, and provide a schedule for restoring the normal PAM channels.SURVEILLANCE A Note has been added to the SR Table to clarify that REQUIREMENTS SR 3.3.3.1 and SR 3.3.3.3 apply to each PAM instrumentation Function in Table 3.3.3-1.Performing the Neutron Flux Instrumentation and Containment Atmosphere Radiation (High-Range) surveillances meets the License Renewal Commitments for License Renewal Program for High-Range Radiation and Neutron Flux Instrumentation Circuits per UFSAR Chapter 18, Table 18-1 and License Renewal Commitments Specification MCS-1274.00-00-0016, Section 4.44.SR 3.3.3.1 Performance of the CHANNEL CHECK ensures that a gross instrumentation failure has not occurred.
| |
| A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels.
| |
| It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
| |
| The high radiation instrumentation should be compared to similar unit instruments located throughout the unit.McGuire Unit 1 B 3.3.3-14 Revision No. 117 UNIT 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I 9nly during I EOC2 1.ECCS. The Water Mana2ement Modification is scheduled to be imolemented on Unit 2 durino the fall 2012 outage.PAM Instrumentation B 3.3.3 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| Agreement criteria are determined by the unit staff, based on a combination of the channel instrument uncertainties, including isolation, indication, and readability.
| |
| If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit. If the channels are within the criteria, it is an indication that the channels are OPERABLE.As specified in the SR, a CHANNEL CHECK is only required for those channels that are normally energized.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.3.2 Not Used SR 3.3.3.3 CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to measured parameter with the necessary range and accuracy.
| |
| This SR is modified by a Note that excludes neutron detectors.
| |
| The calibration method for neutron detectors is specified in the Bases of LCO 3.3.1,"Reactor Trip System (RTS) Instrumentation." The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. UFSAR Section 1.8.2. Regulatory Guide 1.97, Rev. 2.3. NUREG-0737, Supplement 1, "TMI Action Items." 4. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Unit 1 B 3.3.3-15 Revision No. 117 UNIT 2 BASES 3.3.3 Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012, there will be separate documents for Unit I and Unit 2 Bases 3.3.3.ECCS Water Management Modification was implemented on Unit 1 during the IEOC21 outage.
| |
| UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012, there will be separate documents for Unit I and Unit 2 Bases: 3.3.2, 3.3.3, 3.5.4, 3.6.6, and 3.6.11 PAM Instrumentation B 3.3.3 B 3.3 INSTRUMENTATION B 3.3.3 Post Accident Monitoring (PAM) Instrumentation BASES BACKGROUND The primary purpose of the PAM instrumentation is to display unit variables that provide information required by the control room operators during accident situations.
| |
| This information provides the necessary support for the operator to take the manual actions for which no automatic control is provided and that are required for safety systems to accomplish their safety functions for Design Basis Accidents (DBAs).The OPERABILITY of the accident monitoring instrumentation ensures that there is sufficient information available on selected unit parameters to monitor and to assess unit status and behavior following an accident.The availability of accident monitoring instrumentation is important so that responses to corrective actions can be observed and the need for, and magnitude of, further actions can be determined.
| |
| These essential instruments are identified by unit specific documents (Ref. 1) addressing the recommendations of Regulatory Guide 1.97 (Ref. 2) as required by Supplement 1 to NUREG-0737 (Ref. 3).The instrument channels required to be OPERABLE by this LCO include two classes of parameters identified during unit specific implementation of Regulatory Guide 1.97 as Type A and Category I variables.
| |
| Type A variables are included in this LCO because they provide the primary information required for the control room operator to take specific manually controlled actions for which no automatic control is provided, and that are required for safety systems to accomplish their safety functions for DBAs.Category I variables are the key variables deemed risk significant because they are needed to: Determine whether other systems important to safety are performing their intended functions; Provide information to the operators that will enable them to determine the likelihood of a gross breach of the barriers to radioactivity release; and McGuire Unit 2 B 3.3.3-1 Revision No. 115 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012, there will be separate documents for Unit I and Unit 2 Bases.PAM Instrumentation B 3.3.3 BASES BACKGROUND (continued)
| |
| Provide information regarding the release of radioactive materials to allow for early indication of the need to initiate action necessary to protect the public, and to estimate the magnitude of any impending threat.These key variables are identified by the unit specific Regulatory Guide 1.97 analyses (Ref. 1). These analyses identify the unit specific Type A and Category I variables and provide justification for deviating from the NRC proposed list of Category I variables.
| |
| The specific instrument Functions listed in Table 3.3.3-1 are discussed in the LCO section.APPLICABLE The PAM instrumentation ensures the operability of Regulatory Guide SAFETY ANALYSES 1.97 Type A and Category I variables so that the control room operating staff can: Perform the diagnosis specified in the emergency operating procedures (these variables are restricted to preplanned actions for the primary success path of DBAs), e.g., loss of coolant accident (LOCA);Take the specified, pre-planned, manually controlled actions, for which no automatic control is provided, and that are required for safety systems to accomplish their safety function;Determine whether systems important to safety are performing their intended functions; Determine the likelihood of a gross breach of the barriers to radioactivity release;Determine if a gross breach of a barrier has occurred; and Initiate action necessary to protect the public and to estimate the magnitude of any impending threat.PAM instrumentation that meets the definition of Type A in Regulatory Guide 1.97 satisfies Criterion 3 of 10 CFR 50.36 (Ref. 4). Category I, non-Type A, instrumentation must be retained in TS because it is intended to assist operators in minimizing the consequences of accidents.
| |
| Therefore, Category I, non-Type A, variables are important for reducing public risk.McGuire Unit 2 B 3.3.3-2 Revision No. 115 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012, there will be separate documents for Unit I and Unit 2 Bases.PAM Instrumentation B 3.3.3 BASES LCO The PAM instrumentation LCO provides OPERABILITY requirements for Regulatory Guide 1.97 Type A monitors, which provide information required by the control room operators to perform certain manual actions specified in the unit Emergency Operating Procedures.
| |
| These manual actions ensure that a system can accomplish its safety function, and are credited in the safety analyses.
| |
| Additionally, this LCO addresses Regulatory Guide 1.97 instruments that have been designated Category I, non-Type A.The OPERABILITY of the PAM instrumentation ensures there is sufficient information available on selected unit parameters to monitor and assess unit status following an accident.
| |
| This capability is consistent with the recommendations of Reference 1.LCO 3.3.3 requires two OPERABLE channels for most Functions.
| |
| Two OPERABLE channels ensure no single failure prevents operators from getting the information necessary for them to determine the safety status of the unit, and to bring the unit to and maintain it in a safe condition following an accident.Furthermore, OPERABILITY of two channels allows a CHANNEL CHECK during the post accident phase to confirm the validity of displayed information.
| |
| In some cases, the total number of channels exceeds the number of required channels, e.g., pressurizer level has a total of three channels, however only two channels are required OPERABLE.
| |
| This provides additional redundancy beyond that required by this LCO, i.e., when one channel of pressurizer level is inoperable, the required number of two channels can still be met. The ACTIONS of this LCO are only entered when the required number of channels cannot be met.Category I variables are required to meet Regulatory Guide 1.97 Category I (Ref. 2) design and qualification requirements for seismic and environmental qualification, single failure criterion, utilization of emergency standby power, immediately accessible display, continuous readout, and recording of display.Listed below are discussions of the specified instrument Functions listed in Table 3.3.3-1.1. Neutron Flux -(Wide Ranqe)Wide Range Neutron Flux indication is provided to verify reactor shutdown.McGuire Unit 2 B 3.3.3-3 Revision No. 115 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012, there will be separate documents for Unit I and Unit 2 Bases.PAM Instrumentation B 3.3.3 BASES LCO (continued)
| |
| Neutron flux is used for accident diagnosis, verification of subcriticality, and diagnosis of positive reactivity insertion.
| |
| Two channels of wide range neutron flux are required OPERABLE.2, 3. Reactor Coolant System (RCS) Hot and Cold Leg Temperatures RCS Hot and Cold Leg Temperatures are Category I variables provided for verification of core cooling and long term surveillance.
| |
| RCS hot and cold leg temperatures are used to determine RCS subcooling margin. RCS subcooling margin will allow termination of safety injection (SI), if still in progress, or reinitiation of SI if it has been stopped. RCS subcooling margin is also used for unit stabilization and cooldown control.In addition, RCS cold leg temperature is used in conjunction with RCS hot leg temperature to verify the unit conditions necessary to establish natural circulation in the RCS.Reactor coolant hot and cold leg temperature inputs are provided by fast response resistance elements and associated transmitters in each loop.Two channels of RCS Hot Leg Temperature and two channels of RCS Cold Leg Temperature are required OPERABLE by the LCO.RCS Hot Leg and Cold Leg Temperature are diverse indications of RCS temperature.
| |
| Core exit thermocouples also provide diverse indication of RCS temperature.
| |
| : 4. Reactor Coolant System Pressure (Wide Range)RCS wide range pressure is a Category I variable provided for verification of core cooling and RCS integrity long term surveillance.
| |
| RCS pressure is used to verify delivery of SI flow to RCS from at least one train when the RCS pressure is below the pump shutoff head. RCS pressure is also used to verify closure of manually closed spray line valves and pressurizer power operated relief valves (PORVs).McGuire Unit 2 B 3.3.3-4 Revision No. 115 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012, there will be separate documents for Unit I and Unit 2 Bases.PAM Instrumentation B 3.3.3 BASES LCO (continued)
| |
| In addition to these verifications, RCS pressure is used for determining RCS subcooling margin. RCS pressure can also be used:* to determine whether to terminate actuated SI or to reinitiate stopped SI;* to determine when to reset SI and shut off low head SI;* to manually restart low head SI;0 as reactor coolant pump (RCP) trip criteria; and* to make a determination on the nature of the accident in progress and where to go next in the procedure.
| |
| RCS pressure is also related to three decisions about depressurization.
| |
| They are: to determine whether to proceed with primary system depressurization; to verify termination of depressurization; and to determine whether to close accumulator isolation valves during a controlled cooldown/depressurization.
| |
| A final use of RCS pressure is to determine whether to operate the pressurizer heaters.RCS pressure is a Type A variable because the operator uses this indication to monitor the cooldown of the RCS following a steam generator tube rupture (SGTR) or small break LOCA. Operator actions to maintain a controlled cooldown, such as adjusting steam generator (SG) pressure or level, would use this indication.
| |
| Furthermore, RCS pressure is one factor that may be used in decisions to terminate RCP operation.
| |
| Two channels of wide range RCS pressure are required OPERABLE.McGuire Unit 2 B 3.3.3-5 Revision No. 115 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012, there will be separate documents for Unit I and Unit 2 Bases.PAM Instrumentation B 3.3.3 BASES LCO (continued) 5, 6. Reactor Vessel Water Level Reactor Vessel Water Level is provided for verification and long term surveillance of core cooling. It is also used for accident diagnosis and to determine reactor coolant inventory adequacy.The Reactor Vessel Water Level Monitoring System provides a direct measurement of the collapsed liquid level above the fuel alignment plate. The collapsed level represents the amount of liquid mass that is in the reactor vessel above the core.Measurement of the collapsed water level is selected because it is a direct indication of the water inventory.
| |
| Two channels of Reactor Vessel Water Level are provided in both the core region (lower range) and the head region (wide range) with indication in the unit control room. Each channel uses differential pressure transmitters and a microprocessor to calculate true vessel level or relative void content of the primary coolant.7. Containment Sump Water Level (Wide Ranqe)Containment Sump Water Level is provided for verification and long term surveillance of RCS integrity.
| |
| Containment Sump Water Level is used to determine:
| |
| * containment sump level accident diagnosis; and* when to continue the recirculation procedure.
| |
| Two channels of wide range level are required OPERABLE.
| |
| Each channel consists of wide range level indication and two level switches.8. Containment Pressure (Wide Range)Containment Pressure (Wide Range) is provided for verification of RCS and containment OPERABILITY.
| |
| Containment pressure is used to verify closure of main steam isolation valves (MSIVs), and containment spray Phase B isolation when Containment Pressure -High High is reached.McGuire Unit 2 B 3.3.3-6 Revision No. 115 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012, there will be separate documents for Unit I and Unit 2 Bases.PAM Instrumentation B 3.3.3 BASES LCO (continued)
| |
| Two channels of wide range containment pressure are required OPERABLE.9. Containment Atmosphere Radiation (Higqh Range)Containment Atmosphere Radiation is provided to monitor for the potential of significant radiation releases and to provide release assessment for use by operators in determining the need to invoke site emergency plans. Containment radiation level is used to determine if a high energy line break (HELB) has occurred, and whether the event is inside or outside of containment.
| |
| Two channels of high range containment atmosphere radiation are provided.
| |
| One channel is required OPERABLE.
| |
| Diversity is provided by portable instrumentation or by sampling and analysis.10. Not Used 11. Pressurizer Level Pressurizer Level is used to determine whether to terminate SI, if still in progress, or to reinitiate SI if it has been stopped.Knowledge of pressurizer water level is also used to verify the unit conditions necessary to establish natural circulation in the RCS and to verify that the unit is maintained in a safe shutdown condition.
| |
| Three channels of pressurizer level are provided.
| |
| Two channels are required OPERABLE.12. Steam Generator Water Level (Narrow Range)SG Water Level is provided to monitor operation of decay heat removal via the SGs. The Category I indication of SG level is the narrow range level instrumentation.
| |
| McGuire Unit 2 B 3.3.3-7 Revision No. 115 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outagze of 2012, there will be separate documents for Unit I and Unit 2 Bases.PAM Instrumentation B 3.3.3 BASES LCO (continued)
| |
| SG Water Level (Narrow Range) is used to: " identify the faulted SG following a tube rupture;* verify that the intact SGs are an adequate heat sink for the reactor;* determine the nature of the accident in progress (e.g., verify an SGTR); and* verify unit conditions for termination of SI during secondary unit HELBs outside containment.
| |
| Four channels per SG of narrow range water level are provided.Only two channels are required OPERABLE by the LCO.13, 14, 15, 16. Core Exit Temperature Core Exit Temperature is provided for verification and long term surveillance of core cooling.Adequate core cooling is ensured with two valid Core Exit Temperature channels per quadrant with two CETs per required channel. Core inlet temperature data is used with core exit temperature to give radial distribution of coolant enthalpy rise across the core. Core Exit Temperature is used to determine whether to terminate SI, if still in progress, or to reinitiate SI if it has been stopped. Core Exit Temperature is also used for unit stabilization and cooldown control.Two OPERABLE channels of Core Exit Temperature are required in each quadrant to provide indication of radial distribution of the coolant temperature rise across representative regions of the core.Two sets of two thermocouples (1 set from each redundant power train) ensure a single failure will not disable the ability to determine the radial temperature gradient.17. Auxiliary Feedwater Flow AFW Flow is provided to monitor operation of decay heat removal via the SGs.McGuire Unit 2 B 3.3.3-8 Revision No. 115 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012, there will be separate documents for Unit I and Unit 2 Bases.PAM Instrumentation B 3.3.3 BASES LCO (continued)
| |
| The AFW Flow to each SG is determined by flow indicators, pump operational status indicators, and NSWS and condensate supply valve indicators in the control room. The AFW flow indicators are category 2, type D variables which are used to demonstrate the category 1 variable of AFW assured source.AFW flow is used three ways: to verify delivery of AFW flow to the SGs;to determine whether to terminate SI if still in progress, in conjunction with SG water level (narrow range); and to regulate AFW flow so that the SG tubes remain covered.18. RCS Subcoolinq Marqin Monitor RCS subcooling is provided to allow unit stabilization and cooldown control. RCS subcooling will allow termination of SI, if still in progress, or reinitiation of SI if it has been stopped.The margin to saturation is calculated from RCS pressure and temperature measurements.
| |
| Display of the RCS subcooling margin values is provided via the Inadequate Core Cooling Monitor Subcooling Margin Monitor (ICCM SMM) and the Plant Computer.The plant computer is the primary indication for RCS subcooling margin. Backup indication of the RCS subcooling margin consists of two qualified redundant channels each consisting of one ICCM plasma display and one ICCM cabinet, with each ICCM cabinet receiving inputs from 20 core exit thermocouples, one wide range RCS pressure transmitter, and two wide range hot leg RTDs all associated with that channel (train) of ICCM SMM. Therefore, a single train of ICCM SMM including the associated RCS subcooling margin field inputs is equivalent to a single channel of the "RCS Subcooling Margin Monitor" technical specifications function.Each train of ICCM SMM uses the average of the five highest core exit thermocouples and the wide range RCS pressure for that train to determine primary system conditions.
| |
| The primary system conditions are then compared to saturation curves to calculate and display the margin to subcooling.
| |
| Each train of ICCM SMM also calculates subcooling values for each of the two wide range hot leg temperature RTDs associated with that train.McGuire Unit 2 B 3.3.3-9 Revision No. 115 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012, there will be separate documents for Unit I and Unit 2 Bases.PAM Instrumentation B 3.3.3 BASES LCO (continued)
| |
| Therefore, a single train (channel) of SMM provides three diverse subcooling margin values. The diversity of temperature inputs for a channel (train) of the RCS Subcooling Margin Monitor function minimizes the impact to this function resulting from the failure of a single field input.A graphic display on the ICCM over the required range gives the operator a representation of primary system conditions compared to various curved of importance (saturation, etc.).Note: Each train's RCS Subcooling Margin values are displayed on the respective train's ICCM SMM display and the Plant Computer.In addition to displaying the subcooling values received from the ICCM SMM, the plant computer performs independent RCS Subcooling Margin calculations using the average of the five highest core exit thermocouples and wide range RCS pressure to determine primary system conditions.
| |
| The plant computer compares the primary system conditions to plant computer saturation curves to calculate and display the core margin to subcooling.
| |
| The plant computer also calculates and displays subcooling values based on the wide range hot leg and cold leg temperature RTDs.A graphic display on the plant computer over the required range gives the operator a representation of primary system conditions compared to various curves of importance (saturation, NDT, etc.).A backup program exists to ensure the capability to accurately monitor RCS subcooling.
| |
| The program includes training and a procedure to manually calculate subcooling margin, using control room pressure and temperature instruments.
| |
| : 19. Steam Line Pressure Steam Line Pressure is provided to monitor operation of decay heat removal via the SGs. Steam line pressure is also used to determine if a high energy secondary line rupture occurred and which SG is faulted.Two channels of Steam Line Pressure are required OPERABLE.McGuire Unit 2 B 3.3.3-10 Revision No. 115 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012, there will be separate documents for Unit I and Unit 2 Bases.PAM Instrumentation B 3.3.3 BASES LCO (continued)
| |
| : 20. Refueling Water Storage Tank Level RWST level monitoring is provided to ensure an adequate supply of water to the safety injection and spray pumps during the switchover to cold leg recirculation.
| |
| Three channels of RWST level are provided.
| |
| Two channels are required OPERABLE by the LCO.21. DG Heat Exchanger NSWS Flow Flow indicators are provided in each of the NSWS trains to indicate cooling water flow through the respective train DG. These indicators are provided for operators to manually control flow to the DG heat exchanger.
| |
| One flow indicator is required OPERABLE on each train.22. Containment Spray Heat Exchanger NSWS Flow Flow indicators are provided in each of the NSWS trains to indicate cooling water flow through the respective train containment spray heat exchangers.
| |
| These indicators are provided for operators to manually control flow to the heat exchanger.
| |
| One flow indicator is required OPERABLE on each train.APPLICABILITY The PAM instrumentation LCO is applicable in MODES 1, 2, and 3.These variables are related to the diagnosis and pre-planned actions required to mitigate DBAs. The applicable DBAs are assumed to occur in MODES 1, 2, and 3. In MODES 4, 5, and 6, unit conditions are such that the likelihood of an event that would require PAM instrumentation is low;therefore, the PAM instrumentation is not required to be OPERABLE in these MODES.ACTIONS A Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed on Table 3.3.3-1. When the Required Channels in Table 3.3.3-1 are specified (e.g., on a per steam line, per loop, per SG, etc., basis), then the Condition may be entered separately for each steam line, loop, SG, etc., as appropriate.
| |
| The Completion Time(s) of the inoperable channel(s) of a Function will be McGuire Unit 2 B 3.3.3-11 Revision No. 115 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 1012, there will be separate documents for Unit I and Unit 2 Bases.PAM Instrumentation B 3.3.3 BASES ACTIONS (continued) tracked separately for each Function starting from the time the Condition was entered for that Function.A.1 Condition A applies to all PAM instrument Functions.
| |
| Condition A addresses the situation when one or more required channels for one or more Functions are inoperable.
| |
| The Required Action is to refer to Table 3.3.3-1 and take the appropriate Required Actions for the PAM instrumentation affected.
| |
| The Completion Times are those from the referenced Conditions and Required Actions.B. 1 Condition B applies when one or more Functions have one required channel that is inoperable.
| |
| Required Action B.1 requires restoring the inoperable channel to OPERABLE status within 30 days. The 30 day Completion Time is based on operating experience and takes into account the remaining OPERABLE channel, the passive nature of the instrument (no critical automatic action is assumed to occur from these instruments), and the low probability of an event requiring PAM instrumentation during this interval.
| |
| Condition B is not applicable to functions with a single required channel.C.1 Condition C applies when the Required Action and associated Completion Time for Condition B are not met. This Required Action specifies initiation of actions in Specification 5.6.7, which requires a written report to be submitted to the NRC immediately.
| |
| This report discusses the results of the root cause evaluation of the inoperability and identifies proposed restorative actions. This action is appropriate in lieu of a shutdown requirement since alternative actions are identified before loss of functional capability, and given the likelihood of unit conditions that would require information provided by this instrumentation.
| |
| McGuire Unit 2 B 3.3.3-12 Revision No. 115 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012, there will be separate documents for Unit I and Unit 2 Bases.PAM Instrumentation B 3.3.3 BASES ACTIONS (continued)
| |
| D. 1 Condition D applies when a single require channel is inoperable.
| |
| Required Action D.1 requires restoring the required channel to OPERABLE status within 7 days. The Completion Time of 7 days is based on the relatively low probability of an event requiring PAM instrument operation and the availability of alternate means to obtain the required information.
| |
| Continuous operation with the required channel inoperable is not acceptable.
| |
| Therefore, requiring restoration of the required channel to OPERABLE status limits the risk that the PAM function will be in a degraded condition should an event occur.E.1 Condition E applies when one or more Functions have two inoperable required channels (i.e., two channels inoperable in the same Function).
| |
| Required Action E.1 requires restoring one channel in the Function(s) to OPERABLE status within 7 days. The Completion Time of 7 days is based on the relatively low probability of an event requiring PAM instrument operation and the availability of alternate means to obtain the required information.
| |
| Continuous operation with two required channels inoperable in a Function is not acceptable because the alternate indications may not fully meet all performance qualification requirements applied to the PAM instrumentation.
| |
| Therefore, requiring restoration of one inoperable channel of the Function limits the risk that the PAM Function will be in a degraded condition should an accident occur.Condition E does not apply to hydrogen monitor channels and functions with single channels.F. 1 Not Used G.1 and G.2 If the Required Action and associated Completion Time of Conditions D or E are not met, the unit must be brought to a MODE where the requirements of this LCO do not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and MODE 4 within 12 hours.The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.McGuire Unit 2 B 3.3.3-13 Revision No. 115 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012, there will be separate documents for Unit I and Unit 2 Bases.PAM Instrumentation B 3.3.3 BASES ACTIONS (continued)
| |
| H.1 Alternate means of monitoring Containment Area Radiation have been developed and tested. These alternate means may be temporarily installed if the normal PAM channel cannot be restored to OPERABLE status within the allotted time. If these alternate means are used, the Required Action is not to shut down the unit but rather to follow the directions of Specification 5.6.7, in the Administrative Controls section of the TS. The report provided to the NRC should discuss the alternate means used, describe the degree to which the alternate means are equivalent to the installed PAM channels, justify the areas in which they are not equivalent, and provide a schedule for restoring the normal PAM channels.SURVEILLANCE A Note has been added to the SR Table to clarify that REQUIREMENTS SR 3.3.3.1 and SR 3.3.3.3 apply to each PAM instrumentation Function in Table 3.3.3-1.Performing the Neutron Flux Instrumentation and Containment Atmosphere Radiation (High-Range) surveillances meets the License Renewal Commitments for License Renewal Program for High-Range Radiation and Neutron Flux Instrumentation Circuits per UFSAR Chapter 18, Table 18-1 and License Renewal Commitments Specification MCS-1274.00-00-0016, Section 4.44.SR 3.3.3.1 Performance of the CHANNEL CHECK ensures that a gross instrumentation failure has not occurred.
| |
| A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels.
| |
| It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
| |
| The high radiation instrumentation should be compared to similar unit instruments located throughout the unit.McGuire Unit 2 B 3.3.3-14 Revision No. 115 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012, there will be separate documents for Unit I and Unit 2 Bases.PAM Instrumentation B 3.3.3 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| Agreement criteria are determined by the unit staff, based on a combination of the channel instrument uncertainties, including isolation, indication, and readability.
| |
| If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit. If the channels are within the criteria, it is an indication that the channels are OPERABLE.As specified in the SR, a CHANNEL CHECK is only required for those channels that are normally energized.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.3.2 Not Used SR 3.3.3.3 CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to measured parameter with the necessary range and accuracy.
| |
| This SR is modified by a Note that excludes neutron detectors.
| |
| The calibration method for neutron detectors is specified in the Bases of LCO 3.3.1,"Reactor Trip System (RTS) Instrumentation." The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. UFSAR Section 1.8.2. Regulatory Guide 1.97, Rev. 2.3. NUREG-0737, Supplement 1, "TMI Action Items." 4. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Unit 2 B 3.3.3-15 Revision No. 115 Remote Shutdown System B 3.3.4 BASES B 3.3 INSTRUMENTATION B 3.3.4 Remote Shutdown System BASES BACKGROUND The Remote Shutdown System provides the control room operator with sufficient instrumentation and controls to place and maintain the unit in a safe shutdown condition from a location other than the control room. This capability is necessary to protect against the possibility that the control room becomes inaccessible.
| |
| A safe shutdown condition is defined as MODE 3. With the unit in MODE 3, the Auxiliary Feedwater (AFW)System and the steam generator (SG) safety valves or the SG power operated relief valves (SG PORVs) can be used to remove core decay heat and meet all safety requirements.
| |
| The long term supply of water for the AFW System and the ability to borate the Reactor Coolant System (RCS) from outside the control room allows extended operation in MODE 3.If the control room becomes inaccessible due to reasons other than fire or security, the operators can establish control at the remote shutdown panel, and place and maintain the unit in MODE 3. The safe shutdown facility provides shutdown capability during a fire in the control room or security events. Not all controls and necessary transfer switches are located at the remote shutdown panel. Some controls and transfer switches will have to be operated locally at the switchgear, motor control panels, or other local stations.
| |
| The unit automatically reaches MODE 3 following a unit shutdown and can be maintained safely in MODE 3 for an extended period of time.The OPERABILITY of the remote shutdown control and instrumentation functions ensures there is sufficient information available on selected unit parameters to place and maintain the unit in MODE 3 should the control room become inaccessible.
| |
| APPLICABLE The Remote Shutdown System is required to provide equipment at SAFETY ANALYSES appropriate locations outside the control room with a capability to promptly shut down and maintain the unit in a safe condition in MODE 3.The criteria governing the design and specific system requirements of the Remote Shutdown System are located in 10 CFR 50, Appendix A, GDC 19 (Ref. 1).McGuire Units 1 and 2 B 3.3.4-1 Revision No. 115 Remote Shutdown System B 3.3.4 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| The Remote Shutdown System is considered an important contributor to the reduction of unit risk to accidents and as such it has been retained in the Technical Specifications as indicated in the NRC Policy Statement.
| |
| LCO The Remote Shutdown System LCO provides the OPERABILITY requirements of the instrumentation and controls necessary to place and maintain the unit in MODE 3 from a location other than the control room.The instrumentation and controls required are listed in Table 3.3.4-1 in the accompanying LCO.The controls, instrumentation, and transfer switches are required for:* Core reactivity control;* RCS pressure control;* Decay heat removal via the AFW System and the SG safety valves or SG PORVs; and* RCS inventory control.A Function of a Remote Shutdown System is OPERABLE if all instrument and control channels needed to support the Remote Shutdown System Function are OPERABLE.
| |
| In some cases, Table 3.3.4-1 may indicate that the required information or control capability is available from several alternate sources. In these cases, the Function is OPERABLE as long as one channel of any of the alternate information or control sources is OPERABLE.The remote shutdown instrument and control circuits covered by this LCO do not need to be energized to be considered OPERABLE.
| |
| This LCO is intended to ensure the instruments and control circuits will be OPERABLE if unit conditions require that the Remote Shutdown System be placed in operation.
| |
| APPLICABILITY The Remote Shutdown System LCO is applicable in MODES 1, 2, and 3.This is required so that the unit can be placed and maintained in MODE 3 for an extended period of time from a location other than the control room.McGuire Units 1 and 2 B 3.3.4-2 Revision No. 115 Remote Shutdown System B 3.3.4 BASES APPLICABILITY (continued)
| |
| This LCO is not applicable in MODE 4, 5, or 6. In these MODES, the facility is already subcritical and in a condition of reduced RCS energy.Under these conditions, considerable time is available to restore necessary instrument control functions if control room instruments or controls become unavailable.
| |
| ACTIONS A Note has been added to the ACTIONS to clarify the application of Completion Time rules. Separate Condition entry is allowed for each Function listed on Table 3.3.4-1. The Completion Time(s) of the inoperable channel(s)ltrain(s) of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.A.1 Condition A addresses the situation where one or more required Functions of the Remote Shutdown System are inoperable.
| |
| This includes any Function listed in Table 3.3.4-1 as well as the control and transfer switches.The Required Action is to restore the required Function to OPERABLE status within 30 days. The Completion Time is based on operating experience and the low probability of an event that would require evacuation of the control room.B.1 and B.2 If the Required Action and associated Completion Time of Condition A is not met, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.McGuire Units 1 and 2 B 3.3.4-3 Revision No. 115 Remote Shutdown System B 3.3.4 BASES SURVEILLANCE SR 3.3.4.1 REQUIREMENTS Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred.
| |
| A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels.
| |
| It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
| |
| Agreement criteria are determined by the unit staff, based on a combination of the channel instrument uncertainties, including indication and readability.
| |
| If the channels are within the criteria, it is an indication that the channels are OPERABLE.
| |
| If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.As specified in the Surveillance, a CHANNEL CHECK is only required for those channels which are normally energized.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.4.2 SR 3.3.4.2 verifies each required Remote Shutdown System control circuit and transfer switch performs the intended function.
| |
| This verification is performed from the remote shutdown panel and locally, as appropriate.
| |
| Operation of the equipment from the remote shutdown panel is not necessary.
| |
| The Surveillance can be satisfied by performance of a continuity check. This will ensure that if the control room becomes inaccessible, the unit can be placed and maintained in MODE 3 from the remote shutdown panel and the local control stations.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Units 1 and 2 B 3.3.4-4 Revision No. 115 Remote Shutdown System B 3.3.4 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.3.4.3 CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. 10 CFR 50, Appendix A, GDC 19.McGuire Units 1 and 2 B 3.3.4-5 Revision No. 115 LOP DG Start Instrumentation B 3.3.5 B 3.3 INSTRUMENTATION B 3.3.5 Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation BASES BACKGROUND The DGs provide a source of emergency power when offsite power is either unavailable or is insufficiently stable to allow safe unit operation.
| |
| Undervoltage protection will generate an LOP start if a loss of voltage or degraded voltage condition occurs in the switchyard.
| |
| There are two LOP start signals, one for each 4.16 kV vital bus.There is one undervoltage relay per phase connected in a two-out-of-three logic scheme on the 4160 V essential bus. For an actual loss of voltage to the bus, the normal incoming breaker is tripped, the 4160 volt essential bus is load shed, and the diesel generator breaker is closed provided the diesel generating unit has attained at least 95% speed.There is one degraded voltage relay per phase connected in a two-out-of-three logic scheme. Once the undervoltage is detected, two time delay relays begin timing to verify the event is sustained.
| |
| If the first timer completes its cycle, an alarm will be initiated in the control room. The second time delay relay is provided to allow additional time following the first time delay for the operators to improve voltage. If the undervoltage condition is still present when the second timing cycle is complete, the normal and standby incoming circuit breakers are tripped. The LOP start actuation is described in UFSAR, Section 8.3 (Ref. 1).Trip Setpoints and Allowable Values The NOMINAL TRIP SETPOINTS used in the relays are based on the analytical limits presented in UFSAR, Chapter 15 (Ref. 2). The selection of these NOMINAL TRIP SETPOINTS is such that adequate protection is provided when all sensor and processing time delays are taken into account.The actual as-left setpoint of the relays is normally still more conservative than that required by the Allowable Value. If the measured setpoint does not exceed the Allowable Value, the relay is considered OPERABLE.Setpoints adjusted in accordance with the Allowable Value ensure that the consequences of accidents will be acceptable, providing the unit is operated from within the LCOs at the onset of the accident and that the equipment functions as designed.McGuire Units 1 and 2 B 3.3.5-1 Revision No. 115 LOP DG Start Instrumentation B 3.3.5 BASES BACKGROUND (continued)
| |
| Allowable Values and NOMINAL TRIP SETPOINTS are specified for each Function in the LCO. The NOMINAL TRIP SETPOINTS are selected to ensure that the setpoint measured by the surveillance procedure does not exceed the Allowable Value if the relay is performing as required.
| |
| A relay shall be OPERABLE if the point at which the relay trips is found equal to or more conservative than the Allowable Value. If the point at which the relay trips is found outside of the NOMINAL TRIP SETPOINT calibration tolerance band in a conservative direction, the relaying shall be checked to verify that it will not render the offsite power system INOPERABLE due to premature actuation.
| |
| If the trip setpoint is found outside of the NOMINAL TRIP SETPOINT calibration tolerance band, the setpoint shall be re-adjusted.
| |
| In the event a relay's trip setpoint is found less conservative than the Allowable Value, or the transmitter, instrument loop, signal processing electronics, or bistable is found inoperable, then all affected Functions provided by that relay must be declared inoperable and the LCO Condition(s) entered for the protection Function(s) affected.
| |
| Each Allowable Value and NOMINAL TRIP SETPOINT specified is more conservative than the analytical limit assumed in the transient and accident analyses in order to account for instrument uncertainties appropriate to the trip function.
| |
| These uncertainties are defined in setpoint calculations (Ref.3).APPLICABLE The LOP DG start instrumentation is required for the Engineered Safety SAFETY ANALYSES Features (ESF) Systems to function in any accident with a loss of offsite power. Its design basis is that of the ESF Actuation System (ESFAS).Accident analyses credit the loading of the DG based on the loss of offsite power during a loss of coolant accident (LOCA). The actual DG start has historically been associated with the ESFAS actuation.
| |
| The DG loading has been included in the delay time associated with each safety system component requiring DG supplied power following a loss of offsite power.The analyses assume a non- mechanistic DG loading, which does not explicitly account for each individual component of loss of power detection and subsequent actions.The required channels of LOP DG start instrumentation, in conjunction with the ESF systems powered from the DGs, provide unit protection in the event of any of the analyzed accidents discussed in Reference 2, in which a loss of offsite power is assumed.McGuire Units 1 and 2 B 3.3.5-2 Revision No. 115 LOP DG Start Instrumentation B 3.3.5 BASES APPLICABLE SAFETY ANALYSIS (continued)
| |
| The delay times assumed in the safety analysis for the ESF equipment include the 10 second DG start delay, and the appropriate sequencing delay, if applicable.
| |
| The response times for ESFAS actuated equipment in LCO 3.3.2, "Engineered Safety Feature Actuation System (ESFAS)Instrumentation," include the appropriate DG loading and sequencing delay.The LOP DG start instrumentation channels satisfy Criterion 3 of 10 CFR 50.36 (Ref. 4).LCO The LCO for LOP DG start instrumentation requires that three channels per bus of both the loss of voltage and degraded voltage Functions shall be OPERABLE in MODES 1, 2, 3, and 4 when the LOP DG start instrumentation supports safety systems associated with the ESFAS. In MODES 5 and 6, the three channels must be OPERABLE whenever the associated DG is required to be OPERABLE to ensure that the automatic start of the DG is available when needed. Loss of the LOP DG Start Instrumentation Function could result in the delay of safety systems initiation when required.
| |
| This could lead to unacceptable consequences during accidents.
| |
| During the loss of offsite power the DG powers the motor driven auxiliary feedwater pumps. Failure of these pumps to start would leave only one turbine driven pump, as well as an increased potential for a loss of decay heat removal through the secondary system.APPLICABILITY The LOP DG Start Instrumentation Functions are required in MODES 1, 2, 3, and 4 because ESF Functions are designed to provide protection in these MODES. Actuation in MODE 5 or 6 is required whenever the required DG must be OPERABLE so that it can perform its function on an LOP or degraded power to the vital bus.ACTIONS A channel shall be OPERABLE if the point at which the relay trips is found equal to or more conservative than the Allowable Value. If the point at which the channel trips is found outside of the NOMINAL TRIP SETPOINT calibration tolerance band in a conservative direction, the channel shall be checked to verify that it will not render the offsite power system INOPERABLE due to premature actuation.
| |
| If the trip setpoint is found outside of the NOMINAL TRIP SETPOINT calibration tolerance band, the setpoint shall be re-adjusted.
| |
| In the event a relay's trip setpoint is found less conservative than the Allowable Value, or the transmitter, instrument loop, signal processing electronics, or bistable is found inoperable, then all affected Functions provided by that relay must be declared inoperable and the LCO Condition(s) entered for the protection Function(s) affected.Because the required channels are specified on a per bus basis, the Condition may be entered separately for each bus as appropriate.
| |
| McGuire Units 1 and 2 B 3.3.5-3 Revision No. 115 LOP DG Start Instrumentation B 3.3.5 BASES ACTIONS (continued)
| |
| A Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed in the LCO. The Completion Time(s) of the inoperable channel(s) of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.A.1 Condition A applies to the LOP DG start Function with one loss of voltage or degraded voltage channel per bus inoperable.
| |
| If one channel is inoperable, Required Action A.1 requires that channel to be placed in trip within 6 hours. With a channel in trip, the LOP DG start instrumentation channels are configured to provide a one-out-of-two logic to initiate a trip of the incoming offsite power.The specified Completion Time is reasonable considering the Function remains fully OPERABLE on every bus and the low probability of an event occurring during these intervals.
| |
| B.1 Condition B applies when more than one loss of voltage or more than one degraded voltage channel on a single bus is inoperable.
| |
| Required Action B.1 requires restoring all but one channel to OPERABLE status. The 1 hour Completion Time should allow ample time to repair most failures and takes into account the low probability of an event requiring an LOP start occurring during this interval.C.1 Condition C applies to each of the LOP DG start Functions when the Required Action and associated Completion Time for Condition A or B are not met.In these circumstances the Conditions specified in LCO 3.8.1, "AC Sources-Operating," or LCO 3.8.2, "AC Sources-Shutdown," for the DG made inoperable by failure of the LOP DG start instrumentation are required to be entered immediately.
| |
| The actions of those LCOs provide for adequate compensatory actions to assure unit safety.McGuire Units 1 and 2 B 3.3.5-4 Revision No. 115 LOP DG Start Instrumentation B 3.3.5 BASES SURVEILLANCE SR 3.3.5.1 REQUIREMENTS SR 3.3.5.1 is the performance of a TADOT. The test checks trip devices that provide actuation signals directly, bypassing the analog process control equipment.
| |
| For these tests, the relay NOMINAL TRIP SETPOINTS are verified and adjusted as necessary.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.Testing consists of voltage sensor relay testing only. Actuation of load shedding and time delay timers is not required.SR 3.3.5.2 SR 3.3.5.2 is the performance of a CHANNEL CALIBRATION.
| |
| The setpoints, as well as the response to a loss of voltage and a degraded voltage test, shall include a single point verification that the trip occurs within the required time delay, as shown in Reference 1.CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.If plant conditions warrant, the definition of NOMINAL TRIP SETPOINT provides an option for setting a trip setpoint in plant hardware outside the NOMINAL TRIP SETPOINT calibration tolerance band as long as the trip setpoint is conservative with respect to the NOMINAL TRIP SETPOINT.Application of that provision to this SR could result in premature separation of safety related equipment from offsite power during switchyard voltage fluctuations.
| |
| Consequently, this SR has been modified by a Note stating that a NOMINAL TRIP SETPOINT shall be set within the channel's calibration tolerance band.REFERENCES
| |
| : 1. UFSAR, Section 8.3.2. UFSAR, Chapter 15.3. Loss of Voltage Relay Setting Calculation, MCC-1 381.05-00-0094.
| |
| : 4. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.3.5-5 Revision No. 115 B 3.3.6 B 3.3 INSTRUMENTATION B 3.3.6 Not Used McGuire Units 1 and 2 B 3.3.6-1 Revision No. 87 RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 B 3.4 REACTOR COOLANT SYSTEM (RCS)B 3.4.1 RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB) Limits BASES BACKGROUND These Bases address requirements for maintaining RCS pressure, temperature, and flow rate within limits assumed in the safety analyses.
| |
| The safety analyses (Ref. 1) of normal operating conditions and anticipated operational occurrences assume initial conditions within the normal steady state envelope.
| |
| The limits placed on RCS pressure, temperature, and flow rate ensure that the minimum departure from nucleate boiling ratio (DNBR)will be met for each of the transients analyzed.The RCS pressure limit is consistent with operation within the nominal operational envelope.
| |
| Pressurizer pressure indications are averaged to come up with a value for comparison to the limit. A lower pressure will cause the reactor core to approach DNB limits.The RCS coolant average temperature limit is consistent with full power operation within the nominal operational envelope.
| |
| Indications of temperature are averaged to determine a value for comparison to the limit.A higher average temperature will cause the core to approach DNB limits.The RCS volumetric flow rate normally remains constant during an operational fuel cycle with all pumps running. Flow rate indications are averaged within a loop and then summed among the four loops to come up with a value for comparison to the limit. A lower RCS flow will cause the core to approach DNB limits. RCS flow rate may be slightly reduced provided THERMAL POWER is also reduced to ensure that the calculated DNBR will not be below the design DNBR value.Operation outside these DNB limits increases the likelihood of a fuel cladding failure in a DNB limited event.APPLICABLE SAFETY ANALYSES The requirements of this LCO represent the initial conditions for transients analyzed in the plant safety analyses (Ref. 1). The safety analyses have shown that transients initiated from the limits of this LCO will result in meeting the acceptance criteria, including the DNBR criterion.
| |
| This is the acceptance limit for the RCS DNB parameters.
| |
| Changes to the unit that could impact these parameters must be McGuire Units 1 and 2 B 3.4.1 -1 Revision No. 115 RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 BASES APPLICABLE SAFETY ANALYSES (continued) assessed for their impact on the acceptance criteria.
| |
| A key assumption for the analysis of these events is that the core power distribution is within the limits of LCO 3.1.6, "Control Bank Insertion Limits"; LCO 3.2.3, "AXIAL FLUX DIFFERENCE (AFD)"; and LCO 3.2.4, "QUADRANT POWER TILT RATIO (QPTR)." The pressurizer pressure limits and the RCS average temperature limits specified in the COLR correspond to analytical limits used in the safety analyses, with allowance for measurement uncertainty.
| |
| The RCS DNB parameters satisfy Criterion 2 of 10 CFR 50.36 (Ref. 2).LCO This LCO specifies limits on the monitored process variables-pressurizer pressure, RCS average temperature, and RCS total flow rate-to ensure the core operates within the limits assumed in the safety analyses.
| |
| The numerical limits of these variables are contained in the COLR to provide operating and analysis flexibility from cycle to cycle. However, the minimum RCS flow, based on previously analyzed maximum steam generator tube plugging, is retained in the TS LCO. Operating within these limits will result in meeting the acceptance criteria, including the DNBR criterion.
| |
| RCS total flow rate contains a measurement error based on the performance of past precision heat balances and using the result to calibrate the RCS flow rate indicators.
| |
| Sets of elbow tap coefficients, as determined during these heat balances, were averaged for each elbow tap to provide a single set of elbow tap coefficients for use in calculating RCS flow. This set of coefficients establishes the calibration of the RCS flow rate indicators and becomes the set of elbow tap coefficients used for RCS flow measurement.
| |
| Potential fouling of the feedwater venturi, which might not have been detected, could have biased the result from these past precision heat balances in a nonconservative manner. Therefore, a penalty for undetected fouling of the feedwater venturi raises the nominal flow measurement allowance for no fouling.The numerical values for pressure and average temperature specified in the COLR are given for the measurement location with adjustments for the indication instruments.
| |
| APPLICABILITY In MODE 1, the limits on pressurizer pressure, RCS coolant average temperature, and RCS flow rate must be maintained during steady state operation in order to ensure DNBR criteria will be met in the event of an unplanned loss of forced coolant flow or other DNB limited transient.
| |
| In McGuire Units 1 and 2 B 3.4.1-2 Revision No. 115 RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 BASES APPLICABILITY (continued) all other MODES, the power level is low enough that DNB is not a concern.A Note has been added to indicate the limit on pressurizer pressure is not applicable during short term operational transients such as a THERMAL POWER ramp increase > 5% RTP per minute or a THERMAL POWER step increase > 10% RTP. These conditions represent short term perturbations where actions to control pressure variations might be counterproductive.
| |
| Also, since they represent transients initiated from power levels< 100% RTP, an increased DNBR margin exists to offset the temporary pressure variations.
| |
| The DNBR Limit is provided in SL 2.1.1, "Reactor Core SLs." The conditions which define the DNBR Limit are less restrictive than the limits of this LCO, but violation of a Safety Limit (SL) merits a stricter, more severe Required Action. Should a violation of this LCO occur, the operator must check whether or not an SL may have been exceeded.ACTIONS A.1 Pressurizer pressure and RCS average temperature are controllable and measurable parameters.
| |
| With one or both of these parameters not within LCO limits, action must be taken to restore parameter(s).
| |
| The 2 hour Completion Time for restoration of the parameters provides sufficient time to adjust plant parameters, to determine the cause for the off normal condition, and to restore the readings within limits, and is based on plant operating experience.
| |
| B.1 and B.2 RCS total flow rate is not a controllable parameter and is not expected to vary during steady state operation.
| |
| If the indicated RCS total flow rate is >99%, but < 100% of the limit specified in the COLR, then THERMAL POWER may not exceed 98% RTP. THERMAL POWER must be reduced within 2 hours. The completion time of 2 hours is consistent with Required Action A.1. In addition, the Power Range Neutron Flux -High Trip Setpoint must be reduced from the nominal setpoint by 2% RTP within 6 hours. The Completion Time of 6 hours to reset the trip setpoints recognizes that, with power reduced, the safety analysis assumptions are satisfied and there is no urgent need to reduce the trip setpoints.
| |
| This is a sensitive operation that may inadvertently trip the Reactor Protection System.McGuire Units 1 and 2 B 3.4.1-3 Revision No. 115 RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 BASES ACTIONS (continued)
| |
| C.1, C.2.1, C.2.2, and C.2.3 If the indicated RCS total flow rate is less than 99% of the value specified in the COLR, then RCS total flow must be restored to greater than or equal to 99% of the value specified in the COLR within 2 hours or power must be reduced to less than 50% RTP. The Completion Time of 2 hours is consistent with Required Action A.I. If THERMAL POWER is reduced to less than 50% RTP, the Power Range Neutron Flux -High Trip Setpoint must also be reduced to < 55% RTP. The Completion Time of 6 hours to reset the trip setpoints is consistent with Required Action B.2. This is a sensitive operation that may inadvertently trip the Reactor Protection System. Operation is permitted to continue provided the RCS total flow is restored to greater than or equal to 99% of the value specified in the COLR within 24 hours. The Completion Time of 24 hours is reasonable considering the increased margin to DNB at power levels below 50% and the fact that power increases associated with a transient are limited by the reduced trip setpoint.D.1 If the Required Actions are not met within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 2 within 6 hours. The Completion Time of 6 hours is reasonable to reach the required plant conditions in an orderly manner.SURVEILLANCE SR 3.4.1.1 REQUIREMENTS This surveillance demonstrates that the pressurizer pressure remains within the required limits. Alarms and other indications are available to alert operators if this limit is approached or exceeded.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.4.1.2 This surveillance demonstrates that the average RCS temperature remains within the required limits. Alarms and other indications are available to alert operators if this limit is approached or exceeded.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Units 1 and 2 B 3.4.1-4 Revision No. 115 RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.4.1.3 This surveillance demonstrates that the RCS total flow rate remains within the required limits. Alarms and other indications are available to alert operators if this limit is approached or exceeded.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.4.1.4 Calibration of the installed RCS flow instrumentation permits verification that the actual RCS flow rate is greater than or equal to the minimum required RCS flow rate.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. UFSAR, Section 15.2. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.4.1-5 Revision No. 115 RCS Minimum Temperature for Criticality B 3.4.2 B 3.4 REACTOR COOLANT SYSTEM (RCS)B 3.4.2 RCS Minimum Temperature for Criticality BASES BACKGROUND This LCO is based upon meeting several major considerations before the reactor can be made critical and while the reactor is critical.The first consideration is moderator temperature coefficient (MTC), LCO 3.1.3, "Moderator Temperature Coefficient (MTC)." In the transient and accident analyses, the MTC is assumed to be in a range from slightly positive to negative and the operating temperature is assumed to be within the nominal operating envelope while the reactor is critical.
| |
| The LCO on minimum temperature for criticality helps ensure the plant is operated consistent with these assumptions.
| |
| The second consideration is the protective instrumentation.
| |
| Because certain protective instrumentation (e.g., excore neutron detectors) can be affected by moderator temperature, a temperature value within the nominal operating envelope is chosen to ensure proper indication and response while the reactor is critical.The third consideration is the pressurizer operating characteristics.
| |
| The transient and accident analyses assume that the pressurizer is within its normal startup and operating range (i.e., saturated conditions and steam bubble present).
| |
| It is also assumed that the RCS temperature is within its normal expected range for startup and power operation.
| |
| Since the density of the water, and hence the response of the pressurizer to transients, depends upon the initial temperature of the moderator, a minimum value for moderator temperature within the nominal operating envelope is chosen.The fourth consideration is that the reactor vessel is above its minimum nil ductility reference temperature when the reactor is critical.APPLICABLE SAFETY ANALYSES Although the RCS minimum temperature for criticality is not itself an initial condition assumed in Design Basis Accidents (DBAs), the closely aligned temperature for hot zero power (HZP) is a process variable that is an initial condition of DBAs, such as the rod cluster control assembly (RCCA) withdrawal, RCCA ejection, and main steam line break accidents performed at zero power that either assumes the failure of, or presents a challenge to, the integrity of a fission product barrier.McGuire Units 1 and 2 B 3.4.2-1 Revision No- 0 RCS Minimum Temperature for Criticality B 3.4.2 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| All low power safety analyses assume initial RCS loop temperatures
| |
| >2 the HZP temperature of 557 0 F (Ref. 1). The minimum temperature for criticality limitation provides a small band, 6 0 F, for critical operation below HZP. This band allows critical operation below HZP during plant startup and does not adversely affect any safety analyses since the MTC is not significantly affected by the small temperature difference between HZP and the minimum temperature for criticality.
| |
| The RCS minimum temperature for criticality satisfies Criterion 2 of 10 CFR 50.36 (Ref. 2).LCO Compliance with the LCO ensures that the reactor will not be made or maintained critical (keff_ 1.0) at a temperature less than a small band below the HZP temperature, which is assumed in the safety analysis.Failure to meet the requirements of this LCO may produce initial conditions inconsistent with the initial conditions assumed in the safety analysis.APPLICABILITY In MODE 1 and MODE 2 with keff, 1.0, LCO 3.4.2 is applicable since the reactor can only be critical (keff > 1.0) in these MODES.The special test exception of LCO 3.1.8, "PHYSICS TESTS Exceptions," permits PHYSICS TESTS to be performed at 5% RTP with RCS loop average temperatures slightly lower than normally allowed so that fundamental nuclear characteristics of the core can be verified.
| |
| In order for nuclear characteristics to be accurately measured, it may be necessary to operate outside the normal restrictions of this LCO. For example, to measure the MTC at beginning of cycle, it is necessary to allow RCS loop average temperatures to fall below Too load, which may cause RCS loop average temperatures to fall below the temperature limit of this LCO.ACTIONS A.1 If the parameters that are outside the limit cannot be restored, the plant must be brought to a MODE in which the LCO does not apply.To achieve this status, the plant must be brought to MODE 2 with keff< 1.0 within 30 minutes. Rapid reactor shutdown can be readily and practically achieved within a 30 minute period. The allowed time is reasonable, based on operating experience, to reach MODE 2 with ke,< 1.0 in an orderly manner and without challenging plant systems.McGuire Units 1 and 2 B 3.4.2-2 Revision No. 0 RCS Minimum Temperature for Criticality B 3.4.2 BASES SURVEILLANCE SR 3.4.2.1 REQUIREMENTS RCS loop average temperature is required to be verified at or above 551°F every 30 minutes when Tav, -Tref deviation alarm not reset and any RCS loop Tavg < 561OF.The Note modifies the SR. When any RCS loop average temperature is < 561OF and the Tavg -Tref deviation alarm is alarming or inoperable, RCS loop average temperatures could fall below the LCO requirement without additional warning. The SR to verify RCS loop average temperatures every 30 minutes is frequent enough to prevent the inadvertent violation of the LCO.REFERENCES
| |
| : 1. UFSAR, Section 15.2. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.4.2-3 Revision No. 0 RCS P/T Limits B 3.4.3 B 3.4 REACTOR COOLANT SYSTEM (RCS)B 3.4.3 RCS Pressure and Temperature (P/T) Limits BASES BACKGROUND All components of the RCS are designed to withstand effects of cyclic loads due to system pressure and temperature changes. These loads are introduced by startup (heatup) and shutdown (cooldown) operations, power transients, and reactor trips. This LCO limits the pressure and temperature changes during RCS heatup and cooldown, within the design assumptions and the stress limits for cyclic operation.
| |
| This Specification contains P/T limit curves for heatup, cooldown, inservice leak and hydrostatic (ISLH) testing, and data for the maximum rate of change of reactor coolant temperature.
| |
| Each PIT limit curve defines an acceptable region for normal operation.
| |
| The usual use of the curves is operational guidance during heatup or cooldown maneuvering, when pressure and temperature indications are monitored and compared to the applicable curve to determine that operation is within the allowable region.The LCO establishes operating limits that provide a margin to brittle failure of the reactor vessel and piping of the reactor coolant pressure boundary (RCPB). The vessel is the component most subject to brittle failure, and the LCO limits apply mainly to the vessel. The limits do not apply to the pressurizer, which has different design characteristics and operating functions.
| |
| 10 CFR 50, Appendix G (Ref. 1), requires the establishment of P/T limits for specific material fracture toughness requirements of the RCPB materials.
| |
| Reference 1 requires an adequate margin to brittle failure during normal operation, anticipated operational occurrences, and system hydrostatic tests. It mandates the use of the American Society of Mechanical Engineers (ASME) Code, Section III, Appendix G (Ref. 2).The neutron embrittlement effect on the material toughness is reflected by increasing the nil ductility reference temperature (RTND-T) as exposure to neutron fluence increases.
| |
| The actual shift in the RTNDT of the vessel material will be established periodically by removing and evaluating the irradiated reactor vessel material specimens, in accordance with ASTM E 185 (Ref. 3) and McGuire Units 1 and 2 B 3.4.3-1 Revision No. 115 RCS P/T Limits B 3.4.3 BASES BACKGROUND (continued)
| |
| Appendix H of 10 CFR 50 (Ref. 4). The operating P/T limit curves will be adjusted, as necessary, based on the evaluation findings and the recommendations of Regulatory Guide 1.99 (Ref. 5).A second program that employs excore cavity dosimetry to monitor the reactor vessel neutron fluence has been installed in both units. This program meets the requirements of 10 CFR 50 Appendix H (Ref. 4).The P/T limit curves are composite curves established by superimposing limits derived from stress analyses of those portions of the reactor vessel and head that are the most restrictive.
| |
| At any specific pressure, temperature, and temperature rate of change, one location within the reactor vessel will dictate the most restrictive limit. Across the span of the P/T limit curves, different locations are more restrictive, and, thus, the curves are composites of the most restrictive regions.The heatup curve represents a different set of restrictions than the cooldown curve because the directions of the thermal gradients through the vessel wall are reversed.
| |
| The thermal gradient reversal alters the location of the tensile stress between the outer and inner walls.The criticality limit curve includes the Reference 1 requirement that it be> 40°F above the heatup curve or the cooldown curve, and not less than the minimum permissible temperature for ISLH testing. However, the criticality curve is not operationally limiting; a more restrictive limit exists in LCO 3.4.2, "RCS Minimum Temperature for Criticality." The consequence of violating the LCO limits is that the RCS has been operated under conditions that can result in brittle failure of the RCPB, possibly leading to a nonisolable leak or loss of coolant accident.
| |
| In the event these limits are exceeded, an evaluation must be performed to determine the effect on the structural integrity of the RCPB components.
| |
| The ASME Code, Section XI, Appendix E (Ref. 6), provides a recommended methodology for evaluating an operating event that causes an excursion outside the limits.APPLICABLE The P/T limits are not derived from Design Basis Accident (DBA)SAFETY ANALYSES analyses.
| |
| They are prescribed during normal operation to avoid encountering pressure, temperature, and temperature rate of change conditions that might cause undetected flaws to propagate and cause nonductile failure of the RCPB, an unanalyzed condition.
| |
| Although the P/T limits are not derived from any DBA, the P/T limits are acceptance limits since they preclude operation in an unanalyzed condition.
| |
| RCS P/T limits satisfy Criterion 2 of 10 CFR 50.36 (Ref. 7).McGuire Units 1 and 2 B 3.4.3-2 Revision No. 115 RCS P/T Limits B 3.4.3 BASES LCO The two elements of this LCO are: a. The limit curves for heatup, cooldown, and ISLH testing; and b. Limits on the rate of change of temperature.
| |
| The LCO limits apply to all components of the RCS, except the pressurizer.
| |
| These limits define allowable operating regions and permit a large number of operating cycles while providing a wide margin to nonductile failure.The limits for the rate of change of temperature control the thermal gradient through the vessel wall and are used as inputs for calculating the heatup, cooldown, and ISLH testing P/T limit curves. Thus, the LCO for the rate of change of temperature restricts stresses caused by thermal gradients and also ensures the validity of the P/T limit curves.Violating the LCO limits places the reactor vessel outside of the bounds of the stress analyses and can increase stresses in other RCPB components.
| |
| The consequences depend on several factors, as follows: a. The severity of the departure from the allowable operating P/IT regime or the severity of the rate of change of temperature;
| |
| : b. The length of time the limits were violated (longer violations allow the temperature gradient in the thick vessel walls to become more pronounced);
| |
| and c. The existences, sizes, and orientations of flaws in the vessel material.APPLICABILITY The RCS P/T limits LCO provides a definition of acceptable operation for prevention of nonductile failure in accordance with 10 CFR 50, Appendix G (Ref. 1). Although the P/T limits were developed to provide guidance for operation during heatup or cooldown (MODES 3, 4, and 5)or ISLH testing, their Applicability is at all times in keeping with the concern for nonductile failure. The limits do not apply to the pressurizer.
| |
| During MODES I and 2, other Technical Specifications provide limits for operation that can be more restrictive than or can supplement these P/T limits. LCO 3.4.1, "RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB) Limits"; LCO 3.4.2, "RCS Minimum Temperature for Criticality";
| |
| and Safety Limit 2.1, "Safety Limits," also provide operational restrictions for pressure and temperature and McGuire Units 1 and 2 B 3.4.3-3 Revision No. 115 RCS P/T Limits B 3.4.3 BASES APPLICABILITY (continued) maximum pressure.
| |
| Furthermore, MODES 1 and 2 are above the temperature range of concern for nonductile failure, and stress analyses have been performed for normal maneuvering profiles, such as power ascension or descent.ACTIONS A.1 and A.2 Operation outside the P/T limits during MODE 1, 2, 3, or 4 must be corrected so that the RCPB is returned to a condition that has been verified by stress analyses.The 30 minute Completion Time reflects the urgency of restoring the parameters to within the analyzed range. Most violations will not be severe, and the activity can be accomplished in this time in a controlled manner.Besides restoring operation within limits, an evaluation is required to determine if RCS operation can continue.
| |
| The evaluation must verify the RCPB integrity remains acceptable and must be completed before continuing operation.
| |
| Several methods may be used, including comparison with pre-analyzed transients in the stress analyses, new analyses, or inspection of the components.
| |
| ASME Code, Section XI, Appendix E (Ref. 6), may be used to support the evaluation.
| |
| However, its use is restricted to evaluation of the vessel beltline.The 72 hour Completion Time is reasonable to accomplish the evaluation.
| |
| The evaluation for a mild violation is possible within this time, but more severe violations may require special, event specific stress analyses or inspections.
| |
| A favorable evaluation must be completed before continuing to operate.Condition A is modified by a Note requiring Required Action A.2 to be completed whenever the Condition is entered. The Note emphasizes the need to perform the evaluation of the effects of the excursion outside the allowable limits. Restoration alone per Required Action A.1 is insufficient because higher than analyzed stresses may have occurred and may have affected the RCPB integrity.
| |
| McGuire Units 1 and 2 B 3.4.3-4 Revision No. 115 RCS P/T Limits B 3.4.3 BASES ACTIONS (continued)
| |
| B.1 and B.2 If a Required Action and associated Completion Time of Condition A are not met, the plant must be placed in a lower MODE because either the RCS remained in an unacceptable P/T region for an extended period of increased stress or a sufficiently severe event caused entry into an unacceptable region. Either possibility indicates a need for more careful examination of the event, best accomplished with the RCS at reduced pressure and temperature.
| |
| In reduced pressure and temperature conditions, the possibility of propagation with undetected flaws is decreased.
| |
| If the required restoration activity cannot be accomplished within 30 minutes, Required Action B.1 and Required Action B.2 must be implemented to reduce pressure and temperature.
| |
| If the required evaluation for continued operation cannot be accomplished within 72 hours or the results are indeterminate or unfavorable, action must proceed to reduce pressure and temperature as specified in Required Action B.1 and Required Action B.2. A favorable evaluation must be completed and documented before returning to operating pressure and temperature conditions.
| |
| Pressure and temperature are reduced by bringing the plant to MODE 3 within 6 hours and to MODE 5 with RCS pressure < 500 psig within 36 hours.The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.C.1 and C.2 Actions must be initiated immediately to correct operation outside of the P/T limits at times other than when in MODE 1, 2, 3, or 4, so that the RCPB is returned to a condition that has been verified by stress analysis.The immediate Completion Time reflects the urgency of initiating action to restore the parameters to within the analyzed range. Most violations will not be severe, and the activity can be accomplished in this time in a controlled manner.McGuire Units 1 and 2 B 3.4.3-5 Revision No. 115 RCS P/T Limits B 3.4.3 BASES ACTIONS (continued)
| |
| Besides restoring operation within limits, an evaluation is required to determine if RCS operation can continue.
| |
| The evaluation must verify that the RCPB integrity remains acceptable and must be completed prior to entry into MODE 4. Several methods may be used, including comparison with pre-analyzed transients in the stressanalyses, or inspection of the components.
| |
| ASME Code, Section XI, Appendix E (Ref. 6), may be used to support the evaluation.
| |
| However, its use is restricted to evaluation of the vessel beltline.Condition C is modified by a Note requiring Required Action C.2 to be completed whenever the Condition is entered. The Note emphasizes the need to perform the evaluation of the effects of the excursion outside the allowable limits. Restoration alone per Required Action C.1 is insufficient because higher than analyzed stresses may have occurred and may have affected the RCPB integrity.
| |
| SURVEILLANCE SR 3.4.3.1 REQUIREMENTS Verification that operation is within the specified limits is required when RCS pressure and temperature conditions are undergoing planned changes. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.Surveillance for heatup, cooldown, or ISLH testing may be discontinued when the definition given in the relevant plant procedure for ending the activity is satisfied.
| |
| This SR is modified by a Note that only requires this SR to be performed during system heatup, cooldown, and ISLH testing. No SR is given for criticality operations because LCO 3.4.2 contains a more restrictive requirement.
| |
| McGuire Units 1 and 2 B 3.4.3-6 Revision No. 115 RCS P/T Limits B 3.4.3 BASES REFERENCES I.2.3.4.5.6.7.10 CFR 50, Appendix G.ASME, Boiler and Pressure Vessel Code, Section III, Appendix G.ASTM E 185-82, July 1982.10 CFR 50, Appendix H.Regulatory Guide 1.99, Revision 2, May 1988.ASME, Boiler and Pressure Vessel Code, Section XI, Appendix E.10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.4.3-7 Revision No. 115 RCS Loops-MODES I and 2 B 3.4.4 B 3.4 REACTOR COOLANT SYSTEM (RCS)B 3.4.4 RCS Loops-MODES 1 and 2 BASES BACKGROUND The primary function of the RCS is removal of the heat generated in the fuel due to the fission process, and transfer of this heat, via the steam generators (SGs), to the secondary plant.The secondary functions of the RCS include: a. Moderating the neutron energy level to the thermal state, to increase the probability of fission;b. Improving the neutron economy by acting as a reflector;
| |
| : c. Carrying the soluble neutron poison, boric acid;d. Providing a second barrier against fission product release to the environment; and e. Removing the heat generated in the fuel due to fission product decay following a unit shutdown.The reactor coolant is circulated through four loops connected in parallel to the reactor vessel, each containing an SG, a reactor coolant pump (RCP), and appropriate flow and temperature instrumentation for both control and protection.
| |
| The reactor vessel contains the clad fuel. The SGs provide the heat sink to the isolated secondary coolant. The RCPs circulate the coolant through the reactor vessel and SGs at a sufficient rate to ensure proper heat transfer and prevent fuel damage. This forced circulation of the reactor coolant ensures mixing of the coolant for proper boration and chemistry control.APPLICABLE Safety analyses contain various assumptions for the design bases SAFETY ANALYSES accident initial conditions including RCS pressure, RCS temperature, reactor power level, core parameters, and safety system setpoints.
| |
| The important aspect for this LCO is the reactor coolant forced flow rate, which is represented by the number of RCS loops in service.Both transient and steady state analyses have been performed to establish the effect of flow on the departure from nucleate boiling (DNB). The transient and accident analyses for the plant have been performed McGuire Units 1 and 2 B 3.4.4-1 Revision No. 115 RCS Loops -MODES 1 and 2 B 3.4.4 BASES APPLICABLE SAFETY ANALYSES (continued) assuming the number of RCS loops in operation is consistent with the Technical Specifications.
| |
| The majority of the plant safety analyses are based on initial conditions at high core power or zero power. The primary coolant flowrate, and thus the number of RCPs in operation is an important assumption in all accident analyses (Ref. 1).Steady state DNB analysis has been performed for the four RCS loop operation.
| |
| For four RCS loop operation, the steady state DNB analysis, which generates the pressure and temperature Safety Limit (SL) (i.e., the departure from nucleate boiling ratio (DNBR) limit) assumes a maximum power level of 118% RTP. This is the design overpower condition for four RCS loop operation.
| |
| The DNBR limit defines a locus of pressure and temperature points that result in a minimum DNBR greater than or equal to the critical heat flux correlation limit.The plant is designed to operate with all RCS loops in operation to maintain DNBR above the SL, during all normal operations and anticipated transients.
| |
| By ensuring heat transfer in the nucleate boiling region, adequate heat transfer is provided between the fuel cladding and the reactor coolant.RCS Loops-MODES 1 and 2 satisfy Criterion 2 of 10 CFR 50.36 (Ref.2).LCO The purpose of this LCO is to require an adequate forced flow rate for core heat removal. Flow is represented by the number of RCPs in operation for removal of heat by the SGs. To meet safety analysis acceptance criteria for DNB, four pumps are required in MODES 1 and 2.An OPERABLE RCS loop consists of an OPERABLE RCP in operation providing forced flow for heat transport and an OPERABLE SG.APPLICABILITY In MODES 1 and 2, the reactor is critical and thus has the potential to produce maximum THERMAL POWER. Thus, to ensure that the assumptions of the accident analyses remain valid, all RCS loops are required to be OPERABLE and in operation in these MODES to prevent DNB and core damage.The decay heat production rate is much lower than the full power heat rate. As such, the forced circulation flow and heat sink requirements are reduced for lower, noncritical MODES as indicated by the LCOs for MODES 3, 4, and 5.McGuire Units 1 and 2 B 3.4.4-2 Revision No. 115 RCS Loops -MODES 1 and 2 B 3.4.4 BASES APPLICABILITY (continued)
| |
| Operation in other MODES is covered by: LCO 3.4.5, "RCS Loops-MODE 3";LCO 3.4.6, "RCS Loops-MODE 4";LCO 3.4.7, "RCS Loops-MODE 5, Loops Filled";LCO 3.4.8, "RCS Loops-MODE 5, Loops Not Filled";LCO 3.4.17, "RCS Loops-Test Exceptions";
| |
| LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation-High Water Level" (MODE 6); and LCO 3.9.6, "Residual Heat Removal (RHR) and Coolant Circulation-Low Water Level" (MODE 6).ACTIONS A.1 If the requirements of the LCO are not met, the Required Action is to reduce power and bring the plant to MODE 3. This lowers power level and thus reduces the core heat removal needs and minimizes the possibility of violating DNB limits.The Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging safety systems.SURVEILLANCE SR 3.4.4.1 REQUIREMENTS This SR requires verification that each RCS loop is in operation.
| |
| Verification includes flow rate, temperature, or pump status monitoring, which help ensure that forced flow is providing heat removal while maintaining the margin to DNB. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. UFSAR, Section 15.2. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.4.4-3 Revision No. 115 RCS Loops-MODE 3 B 3.4.5 B 3.4 REACTOR COOLANT SYSTEM (RCS)B 3.4.5 RCS Loops-MODE 3 BASES BACKGROUND In MODE 3, the primary function of the reactor coolant is removal of decay heat and transfer of this heat, via the steam generator (SG), to the secondary plant fluid. The secondary function of the reactor coolant is to act as a carrier for soluble neutron poison, boric acid.The reactor coolant is circulated through four RCS loops, connected in parallel to the reactor vessel, each containing an SG, a reactor coolant pump (RCP), and appropriate flow, pressure, level, and temperature instrumentation for control, protection, and indication.
| |
| The reactor vessel contains the clad fuel. The SGs provide the heat sink. The RCPs circulate the water through the reactor vessel and SGs at a sufficient rate to ensure proper heat transfer and prevent fuel damage.In MODE 3, RCPs are used to provide forced circulation for heat removal during heatup and cooldown.
| |
| The MODE 3 decay heat removal requirements are low enough that a single RCS loop with one RCP running is sufficient to remove core decay heat. Two RCS loops are sufficient to ensure redundant capability for decay heat removal, however, three RCS loops are required to be OPERABLE to meet the accident analysis assumptions for an inadvertent rod withdrawal from subcritical.
| |
| APPLICABLE SAFETY ANALYSES Whenever the reactor trip breakers (RTBs) are in the closed position and the control rod drive mechanisms (CRDMs) are energized, an inadvertent rod withdrawal from subcritical, resulting in a power excursion, is possible.
| |
| Such a transient could be caused by a malfunction of the rod control system.Therefore, in MODE 3 with RTBs in the closed position and Rod Control System capable of rod withdrawal, accidental control rod withdrawal from subcritical is postulated and requires at least three RCS loops to be OPERABLE and in operation to ensure that the accident analyses limits are met. For those conditions when the Rod Control System is not capable of rod withdrawal, two RCS loops are sufficient to meet redundancy requirements for decay heat removal, however the LCO requires three loops to be OPERABLE.
| |
| Only one RCS loop is required to be in operation to be consistent with MODE 3 accident analyses.McGuire Units 1 and 2 B 3.4.5-1 Revision No. 115 RCS Loops -MODE 3 B 3.4.5 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| Failure to provide decay heat removal may result in challenges to a fission product barrier. The RCS loops are part of the primary success path that functions or actuates to prevent or mitigate a Design Basis Accident or transient that either assumes the failure of, or presents a challenge to, the integrity of a fission product barrier.RCS Loops-MODE 3 satisfy Criterion 3 of 10 CFR 50.36 (Ref. 1).LCO The purpose of this LCO is to require that at least three RCS loops be OPERABLE.
| |
| In MODE 3 with the RTBs in the closed position and Rod Control System capable of rod withdrawal, three RCS loops must be in operation due to the postulation of a power excursion because of an inadvertent control rod withdrawal.
| |
| The required number of RCS loops in operation ensures that the Safety Limit criteria will be met for all of the postulated accidents.
| |
| With the RTBs in the open position, or the CRDMs de-energized, the Rod Control System is not capable of rod withdrawal; therefore, only one RCS loop in operation is necessary to ensure removal of decay heat from the core and homogenous boron concentration throughout the RCS. Two additional RCS loops are required to be OPERABLE to ensure that safety analyses limits are met.The Note permits all RCPs to be de-energized for < 1 hour per 8 hour period. The purpose of the Note is to perform tests that are designed to validate various accident analyses values. One of these tests is validation of the pump coastdown curve used as input to a number of accident analyses including a loss of flow accident.
| |
| This test is generally performed in MODE 3 during the initial startup testing program, and as such should only be performed once.If, however, changes are made to the RCS that would cause a change to the flow characteristics of the RCS, the input values of the coastdown curve must be revalidated by conducting the test again. Another test performed during the startup testing program is the validation of rod drop times during cold conditions, both with and without flow.The no flow test may be performed in MODE 3, 4, or 5 and requires that the pumps be stopped for a short period of time. The Note permits the de-energizing of the pumps in order to perform this test and validate the assumed analysis values. As with the validation of the pump coastdown curve, this test should be performed only once unless the flow McGuire Units 1 and 2 B 3.4.5-2 Revision No. 115 RCS Loops -MODE 3 B 3.4.5 BASES LCO (continued) characteristics of the RCS are changed. The 1 hour time period specified is adequate to perform the desired tests, and operating experience has shown that boron stratification is not a problem during this short period with no forced flow.Utilization of the Note is permitted provided the following conditions are met, along with any other conditions imposed by initial startup test procedures:
| |
| : a. No operations are permitted that would dilute the RCS boron concentration with coolant at boron concentration less than required to assure the SDM of LCO 3.1.1 and maintain Keff < 0.99, thereby maintaining an adequate margin to criticality.
| |
| Boron reduction with coolant at boron concentration less than required to assure SDM and Keff < 0.99 is prohibited because a uniform concentration distribution throughout the RCS cannot be ensured when in natural circulation; and b. Core outlet temperature is maintained at least 10OF below saturation temperature, so that no vapor bubble may form and possibly cause a natural circulation flow obstruction.
| |
| An OPERABLE RCS loop consists of one OPERABLE RCP and one OPERABLE SG, which has the minimum water level specified in SR 3.4.5.2. An RCP is OPERABLE if it is capable of being powered and is able to provide forced flow if required.APPLICABILITY In MODE 3, this LCO ensures forced circulation of the reactor coolant to remove decay heat from the core and to provide proper boron mixing.The most stringent condition of the LCO, that is, three RCS loops OPERABLE and three RCS loops in operation, applies to MODE 3 with RTBs in the closed position.
| |
| The least stringent condition, that is, three RCS loops OPERABLE and one RCS loop in operation, applies to MODE 3 with the RTBs open.Operation in other MODES is covered by: LCO 3.4.4, "RCS Loops-MODES 1 and 2";LCO 3.4.6, "RCS Loops-MODE 4";LCO 3.4.7, "RCS Loops-MODE 5, Loops Filled";LCO 3.4.8, "RCS Loops-MODE 5, Loops Not Filled";LCO 3.4.17, "RCS Loops-Test Exceptions";
| |
| LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation-High Water Level" (MODE 6); and LCO 3.9.6, "Residual Heat Removal (RHR) and Coolant Circulation-Low Water Level" (MODE 6).McGuire Units 1 and 2 B 3.4.5-3 Revision No. 115 RCS Loops -MODE 3 B 3.4.5 BASES ACTIONS A.1 If one or two required RCS loop(s) are inoperable, redundancy for heat removal is lost. The Required Action is restoration of the required RCS loop to OPERABLE status within the Completion Time of 72 hours. This time allowance is a justified period to be without the redundant, nonoperating loop because a single loop in operation has a heat transfer capability greater than that needed to remove the decay heat produced in the reactor core and because of the low probability of a failure in the remaining loop occurring during this period.B.1 If restoration is not possible within 72 hours, the unit must be brought to MODE 4. In MODE 4, the unit may be placed on the Residual Heat Removal System. The additional Completion Time of 12 hours is compatible with required operations to achieve cooldown and depressurization from the existing plant conditions in an orderly manner and without challenging plant systems.C.1 and C.2 If one or two required RCS loop(s) are not in operation, and the Rod Control System is capable of rod withdrawal, the Required Action is either to restore the required RCS loop(s) to operation or to de-energize all CRDMs by opening the RTBs or de-energizing the motor generator (MG)sets. When the Rod Control System is capable of rod withdrawal, it is postulated that a power excursion could occur in the event of an inadvertent control rod withdrawal.
| |
| This mandates having the heat transfer capacity of three RCS loops in operation.
| |
| If only one or two loop(s) are in operation, the CRDMs must be deenergized.
| |
| The Completion Times of 1 hour to restore the required RCS loop(s) to operation or de-energize all CRDMs is adequate to perform these operations in an orderly manner without exposing the unit to risk for an undue time period.D.1, D.2, and D.3 If three required RCS loops are inoperable or no RCS loop is in operation, except as during conditions permitted by the Note in the LCO section, all CRDMs must be de-energized by opening the RTBs or de-energizing the MG sets. All operations involving introduction of coolant into the RCS with boron concentration less than required to meet SDM of LCO 3.1.1 must be suspended, and action to restore one of the RCS loops McGuire Units 1 and 2 B 3.4.5-4 Revision No. 115 RCS Loops -MODE 3 B 3.4.5 BASES ACTIONS (continued) to OPERABLE status and operation must be initiated.
| |
| Boron dilution requires forced circulation for proper mixing, and opening the RTBs or de-energizing the MG sets removes the possibility of an inadvertent rod withdrawal.
| |
| Suspending the introduction of coolant into the RCS of coolant with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 is required to assure continued safe operation.
| |
| With coolant added without forced circulation, unmixed coolant could be introduced to the core, however, coolant added with boron concentration meeting the minimum SDM maintains acceptable margin to criticality.
| |
| The immediate Completion Time reflects the importance of maintaining operation for heat removal. The action to restore must be continued until one loop is restored to OPERABLE status and operation.
| |
| SURVEILLANCE SR 3.4.5.1 REQUIREMENTS This SR requires verification that the required loops are in operation.
| |
| Verification includes flow rate, temperature, and pump status monitoring, which help ensure that forced flow is providing heat removal. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.4.5.2 SR 3.4.5.2 requires verification of SG OPERABILITY.
| |
| SG OPERABILITY is verified by ensuring that the secondary side narrow range water level is> 12% for required RCS loops. If the SG secondary side narrow range water level is < 12%, the tubes may become uncovered and the associated loop may not be capable of providing the heat sink for removal of the decay heat. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.4.5.3 Verification that the required RCPs are OPERABLE ensures that safety analyses limits are met. The requirement also ensures that an additional RCP can be placed in operation, if needed, to maintain decay heat removal and reactor coolant circulation.
| |
| Verification is performed by verifying proper breaker alignment and power availability to the required RCPs. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Units 1 and 2 B 3.4.5-5 Revision No. 115 RCS Loops -MODE 3 B 3.4.5 BASES REFERENCES
| |
| : 1. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.4.5-6 Revision No. 115 RCS Loops-MODE 4 B 3.4.6 B 3.4 REACTOR COOLANT SYSTEM (RCS)B 3.4.6 RCS Loops-MODE 4 BASES BACKGROUND In MODE 4, the primary function of the reactor coolant is the removal of decay heat and the transfer of this heat to either the steam generator (SG) secondary side coolant or the component cooling water via the residual heat removal (RHR) heat exchangers.
| |
| The secondary function of the reactor coolant is to act as a carrier for soluble neutron poison, boric acid.The reactor coolant is circulated through four RCS loops connected in parallel to the reactor vessel, each loop containing an SG, a reactor coolant pump (RCP), and appropriate flow, pressure, level, and temperature instrumentation for control, protection, and indication.
| |
| The RCPs circulate the coolant through the reactor vessel and SGs at a sufficient rate to ensure proper heat transfer and to prevent boric acid stratification.
| |
| In MODE 4, either RCPs or RHR loops can be used to provide forced circulation.
| |
| The intent of this LCO is to provide forced flow from at least one RCP or one RHR loop for decay heat removal and transport.
| |
| The flow provided by one RCP loop or RHR loop is adequate for decay heat removal. The other intent of this LCO is to require that two paths be available to provide redundancy for decay heat removal.APPLICABLE In MODE 4, RCS circulation is considered in the determination of the SAFETY ANALYSES time available for mitigation of the accidental boron dilution event. The RCS and RHR loops provide this circulation.
| |
| RCS Loops-MODE 4 satisfy Criterion 4 of 10 CFR 50.36 (Ref. 1).LCO The purpose of this LCO is to require that at least two loops be OPERABLE in MODE 4 and that one of these loops be in operation.
| |
| The LCO allows the two loops that are required to be OPERABLE to consist of any combination of RCS loops and RHR loops. Any one loop in operation provides enough flow to remove the decay heat from the core with forced circulation.
| |
| An additional loop is required to be OPERABLE to provide redundancy for heat removal.McGuire Units 1 and 2 B 3.4.6-1 Revision No. 115 RCS Loops -MODE 4 B 3.4.6 BASES LCO (continued)
| |
| Note 1 permits all RCPs or RHR pumps to be de-energized for < 1 hour per 8 hour period. The purpose of the Note is to permit tests that are designed to validate various accident analyses values. One of the tests performed during the startup testing program is the validation of rod drop times during cold conditions, both with and without flow. The no flow test may be performed in MODE 3, 4, or 5 and requires that the pumps be stopped for a short period of time. The Note permits the de-energizing of the pumps in order to perform this test and validate the assumed analysis values. If changes are made to the RCS that would cause a change to the flow characteristics of the RCS, the input values must be revalidated by conducting the test again. The 1 hour time period is adequate to perform the test, and operating experience has shown that boron stratification is not a problem during this short period with no forced flow.Utilization of Note 1 is permitted provided the following conditions are met along with any other conditions imposed by initial startup test procedures:
| |
| : a. No operations are permitted that would dilute the RCS boron concentration with coolant with boron concentrations less than required to meet SDM of LCO 3.1.1 and maintain Keff < 0.99, therefore maintaining an adequate margin to criticality.
| |
| Boron reduction with coolant of boron concentrations less than required to assure SDM and maintain Keff < 0.99 is prohibited because a uniform concentration distribution throughout the RCS cannot be ensured when in natural circulation; and b. Core outlet temperature is maintained at least 10OF below saturation temperature, so that no vapor bubble may form and possibly cause a natural circulation flow obstruction.
| |
| Note 2 requires that the secondary side water temperature of each SG be< 50°F above each of the RCS cold leg temperatures or that pressurizer water volume be < 92% (1600 ft 3) before the start of an RCP with any RCS cold leg temperature
| |
| _< 300 0 F. This restraint is to prevent a low temperature overpressure event due to a thermal transient when an RCP is started.An OPERABLE RCS loop comprises an OPERABLE RCP and an OPERABLE SG, which has the minimum water level specified in SR 3.4.6.2. The water level is maintained by an OPERABLE AFW train in accordance with LCO 3.7.5, "Auxiliary Feedwater System." Similarly for the RHR System, an OPERABLE RHR loop comprises an OPERABLE RHR pump capable of providing forced flow to an OPERABLE RHR heat exchanger.
| |
| RCPs and RHR pumps are McGuire Units 1 and 2 B 3.4.6-2 Revision No. 115 RCS Loops -MODE 4 B 3.4.6 BASES LCO (continued)
| |
| OPERABLE if they are capable of being powered and are able to provide forced flow if required.APPLICABILITY In MODE 4, this LCO ensures forced circulation of the reactor coolant to remove decay heat from the core and to provide proper boron mixing.One loop of either RCS or RHR provides sufficient circulation for these purposes.
| |
| However, two loops consisting of any combination of RCS and RHR loops are required to be OPERABLE to meet single failure considerations.
| |
| Operation in other MODES is covered by: LCO 3.4.4, "RCS Loops-MODES 1 and 2";LCO 3.4.5, "RCS Loops-MODE 3";LCO 3.4.7, "RCS Loops-MODE 5, Loops Filled";LCO 3.4.8, "RCS Loops-MODE 5, Loops Not Filled";LCO 3.4.17, "RCS Loops-Test Exceptions";
| |
| LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation-High Water Level" (MODE 6); and LCO 3.9.6, "Residual Heat Removal (RHR) and Coolant Circulation-Low Water Level" (MODE 6).ACTIONS A._1 If only one RCS loop is OPERABLE and two RHR loops are inoperable, redundancy for heat removal is lost. Action must be initiated to restore a second RCS or RHR loop to OPERABLE status. The immediate Completion Time reflects the importance of maintaining the availability of two paths for heat removal.B.I If only one RHR loop is OPERABLE and in operation and there are no RCS loops OPERABLE, an inoperable RCS or RHR loop must be restored to OPERABLE status to provide a redundant means for decay heat removal.If the parameters that are outside the limits cannot be restored, the unit must be brought to MODE 5-within 24 hours. Bringing the unit to MODE 5 is a conservative action with regard to decay heat removal. With only one RHR loop OPERABLE, redundancy for decay heat removal is lost and, in the event of a loss of the remaining RHR loop, it would be safer to initiate that loss from MODE 5 (< 200 0 F) rather than MODE 4 (200 to < 350 0 F). The Completion Time of 24 hours is a reasonable time, based on operating experience, to reach MODE 5 from MODE 4 in an orderly manner and without challenging plant systems.McGuire Units 1 and 2 B 3.4.6-3 Revision No. 115 RCS Loops -MODE 4 B 3.4.6 BASES ACTIONS (continued)
| |
| C.1 and C.2 If no loop is OPERABLE or in operation, except during conditions permitted by Note 1 in the LCO section, all operations involving introduction of coolant into the RCS with boron concentration less than required to meet SDM of LCO 3.1.1 and maintain Keff < 0.99 must be suspended and action to restore one RCS or RHR loop to OPERABLE status and operation must be initiated.
| |
| The required margin to criticality must not be reduced in this type of operation.
| |
| Suspending the introduction of coolant into the RCS of coolant with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 and maintains Keff < 0.99 is required to assure continued safe operation.
| |
| With coolant added without forced circulation, unmixed coolant could be introduced to the core, however, coolant added with boron concentration meeting the minimum SDM and Keff requirements maintains acceptable margin to criticality.
| |
| The immediate Completion Times reflect the importance of maintaining operation for decay heat removal. The action to restore must be continued until one loop is restored to OPERABLE status and operation.
| |
| SURVEILLANCE SR 3.4.6.1 REQUIREMENTS This SR requires verification that one RCS or RHR loop is in operation.
| |
| Verification includes flow rate, temperature, or pump status monitoring, which help ensure that forced flow is providing heat removal. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.4.6.2 SR 3.4.6.2 requires verification of SG OPERABILITY.
| |
| SG OPERABILITY is verified by ensuring that the secondary side narrow range water level is_ 12%. If the SG secondary side narrow range water level is < 12%, the tubes may become uncovered and the associated loop may not be capable of providing the heat sink necessary for removal of decay heat.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.4.6.3 Verification that the required pump is OPERABLE ensures that an additional RCS or RHR pump can be placed in operation, if needed, to McGuire Units 1 and 2 B 3.4.6-4 Revision No. 115 RCS Loops -MODE 4 B 3.4.6 BASES SURVEILLANCE REQUIREMENTS (continued) maintain decay heat removal and reactor coolant circulation.
| |
| Verification is performed by verifying proper breaker alignment and power available to the required pump. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.4.6-5 Revision No. 115 RCS Loops-MODE 5, Loops Filled B 3.4.7 B 3.4 REACTOR COOLANT SYSTEM (RCS)B 3.4.7 RCS Loops-MODE 5, Loops Filled BASES BACKGROUND In MODE 5 with the RCS loops filled, the primary function of the reactor coolant is the removal of decay heat and transfer this heat either to the steam generator (SG) secondary side coolant or the component cooling water via the residual heat removal (RHR) heat exchangers.
| |
| While the principal means for decay heat removal is via the RHR System, the SGs are specified as a backup means for redundancy.
| |
| Even though the SGs cannot produce steam in this MODE, they are capable of being a heat sink due to their large contained volume of secondary water. As long as the SG secondary side water is at a lower temperature than the reactor coolant, heat transfer will occur. The rate of heat transfer is directly proportional to the temperature difference.
| |
| The secondary function of the reactor coolant is to act as a carrier for soluble neutron poison, boric acid.In MODE 5 with RCS loops filled, the reactor coolant is circulated by means of two RHR loops connected to the RCS, each loop containing an RHR heat exchanger, an RHR pump, and appropriate flow and temperature instrumentation for control, protection, and indication.
| |
| One RHR pump circulates the water through the RCS at a sufficient rate to prevent boric acid stratification.
| |
| The number of loops in operation can vary to suit the operational needs.The intent of this LCO is to provide forced flow from at least one RHR loop for decay heat removal and transport.
| |
| The flow provided by one RHR loop is adequate for decay heat removal. The other intent of this LCO is to require that a second path be available to provide redundancy for heat removal.The LCO provides for redundant paths of decay heat removal capability.
| |
| The first path can be an RHR loop that must be OPERABLE and in operation.
| |
| The second path can be another OPERABLE RHR loop or maintaining two SGs with secondary side narrow range water levels >12% to provide an alternate method for decay heat removal.APPLICABLE SAFETY ANALYSES In MODE 5, RCS circulation is considered in the determination of the time available for mitigation of the accidental boron dilution event. The RHR loops provide this circulation.
| |
| McGuire Units 1 and 2 B 3.4.7-1 Revision No. 115 RCS Loops -MODE 5, Loops Filled B 3.4.7 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| RCS Loops-MODE 5 (Loops Filled) satisfy Criterion 4 of 10 CFR 50.36 (Ref. 1).LCO The purpose of this LCO is to require that at least one of the RHR loops be OPERABLE and in operation with an additional RHR loop OPERABLE or two SGs with secondary side narrow range water level -a 12%. One RHR loop provides sufficient forced circulation to perform the safety functions of the reactor coolant under these conditions.
| |
| An additional RHR loop is required to be OPERABLE to meet single failure considerations.
| |
| However, if the standby RHR loop is not OPERABLE, an acceptable alternate method is two SGs with their secondary side narrow range water levels _> 12%. Should the operating RHR loop fail, the SGs could be used to remove the decay heat.Note 1 permits all RHR pumps to be de-energized
| |
| < 1 hour per 8 hour period. The purpose of the Note is to permit tests designed to validate various accident analyses values. One of the tests performed during the startup testing program is the validation of rod drop times during cold conditions, both with and without flow. The no flow test may be performed in MODE 3, 4, or 5 and requires that the pumps be stopped for a short period of time. The Note permits de-energizing of the pumps in order to perform this test and validate the assumed analysis values. If changes are made to the RCS that would cause a change to the flow characteristics of the RCS, the input values must be revalidated by conducting the test again. The 1 hour time period is adequate to perform the test, and operating experience has shown that boron stratification is not likely during this short period with no forced flow.Utilization of Note 1 is permitted provided the following conditions are met, along with any other conditions imposed by initial startup test procedures:
| |
| : a. No operations are permitted that would dilute the RCS boron concentration with coolant with boron concentration less than required to meet SDM of LCO 3.1.1, therefore maintaining an adequate margin to criticality.
| |
| Boron reduction with coolant at boron concentrations less than required to assure SDM is maintained is prohibited because a uniform concentration distribution throughout the RCS cannot be ensured when in natural circulation; and b. Core outlet temperature is maintained at least 10°F below saturation temperature, so that no vapor bubble may form and possibly cause a natural circulation flow obstruction.
| |
| McGuire Units 1 and 2 B 3.4.7-2 Revision No. 115 RCS Loops -MODE 5, Loops Filled B 3.4.7 BASES LCO (continued)
| |
| Note 2 allows one RHR loop to be inoperable for a period of up to 2 hours, provided that the other RHR loop is OPERABLE and in operation.
| |
| This permits periodic surveillance tests to be performed on the inoperable loop during the only time when such testing is safe and possible.Note 3 requires that the secondary side water temperature of each SG be_: 50°F above each of the RCS cold leg temperatures or that pressurizer water volume be < 92% (1600 ft 3) before the start of a reactor coolant pump (RCP) with an RCS cold leg temperature
| |
| < 300 0 F. This restriction is to prevent a low temperature overpressure event due to a thermal transient when an RCP is started.Note 4 provides for an orderly transition from MODE 5 to MODE 4 during a planned heatup by permitting removal of RHR loops from operation when at least one RCS loop is in operation.
| |
| This Note provides for the transition to MODE 4 where an RCS loop is permitted to be in operation and replaces the RCS circulation function provided by the RHR loops.RHR pumps are OPERABLE if they are capable of being powered and are able to provide flow if required.
| |
| An OPERABLE SG can perform as a heat sink when it has an adequate water level.APPLICABILITY In MODE 5 with RCS loops filled, this LCO requires forced circulation of the reactor coolant to remove decay heat from the core and to provide proper boron mixing. One loop of RHR provides sufficient circulation for these purposes.
| |
| However, one additional RHR loop is required to be OPERABLE, or the secondary side narrow range water level of at least two SGs is required to be > 12%.Operation in other MODES is covered by: LCO 3.4.4, "RCS Loops-MODES 1 and 2";LCO 3.4.5, "RCS Loops-MODE 3";LCO 3.4.6, "RCS Loops-MODE 4";LCO 3.4.8, "RCS Loops-MODE 5, Loops Not Filled";LCO 3.4.17 "RCS Loops-Test Exceptions";
| |
| LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation-High Water Level" (MODE 6); and LCO 3.9.6, "Residual Heat Removal (RHR) and Coolant Circulation-Low Water Level" (MODE 6).McGuire Units 1 and 2 B 3.4.7-3 Revision No. 115 RCS Loops -MODE 5, Loops Filled B 3.4.7 BASES ACTIONS A.1 and A.2 If one RHR loop is inoperable and the required SGs have secondary side narrow range water levels < 12%, redundancy for heat removal is lost.Action must be initiated immediately to restore a second RHR loop to OPERABLE status or to restore the required SG secondary side water levels. Either Required Action A.1 or Required Action A.2 will restore redundant heat removal paths. The immediate Completion Time reflects the importance of maintaining the availability of two paths for heat removal.B.1 and B.2 If no RHR loop is in operation, except during conditions permitted by Note 1, or if no loop is OPERABLE, all operations involving introduction of coolant into the RCS with boron concentration less than required to meet SDM of LCO 3.1.1 must be suspended and action to restore one RHR loop to OPERABLE status and operation must be initiated.
| |
| Suspending the introduction of coolant into the RCS of coolant with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 is required to assure continued safe operation.
| |
| With coolant added without forced circulation, unmixed coolant could be introduced to the core, however, coolant added with boron concentration meeting the minimum SDM maintains acceptable margin to criticality.
| |
| The immediate Completion Times reflect the importance of maintaining operation for heat removal.SURVEILLANCE SR 3.4.7.1 REQUIREMENTS This SR requires verification that the required loop is in operation.
| |
| Verification includes flow rate, temperature, or pump status monitoring, which help ensure that forced flow is providing heat removal. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.4.7.2 Verifying that at least two SGs are OPERABLE by ensuring their secondary side narrow range water levels are > 12% ensures an alternate decay heat removal method in the event that the second RHR loop is not OPERABLE.
| |
| If both RHR loops are OPERABLE, this Surveillance is not needed. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Units 1 and 2 B 3.4.7-4 Revision No. 115 RCS Loops -MODE 5, Loops Filled B 3.4.7 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.4.7.3 Verification that a second RHR pump is OPERABLE ensures that an additional pump can be placed in operation, if needed, to maintain decay heat removal and reactor coolant circulation.
| |
| Verification is performed by verifying proper breaker alignment and power available to the RHR pump.If secondary side narrow range water level is > 12% in at least two SGs, this Surveillance is not needed. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.4.7-5 Revision No. 115 RCS Loops-MODE 5, Loops Not Filled B 3.4.8 B 3.4 REACTOR COOLANT SYSTEM (RCS)B 3.4.8 RCS Loops-MODE 5, Loops Not Filled BASES BACKGROUND In MODE 5 with the RCS loops not filled, the primary function of the reactor coolant is the removal of decay heat generated in the fuel, and the transfer of this heat to the component cooling water via the residual heat removal (RHR) heat exchangers.
| |
| The steam generators (SGs) are not available as a heat sink when the loops are not filled. The secondary function of the reactor coolant is to act as a carrier for the soluble neutron poison, boric acid.In MODE 5 with loops not filled, only RHR pumps can be used for coolant circulation.
| |
| The number of pumps in operation can vary to suit the operational needs. The intent of this LCO is to provide forced flow from at least one RHR pump for decay heat removal and transport and to require that two paths be available to provide redundancy for heat removal.APPLICABLE In MODE 5, RCS circulation is considered in the determination of the SAFETY ANALYSES time available for mitigation of the accidental boron dilution event. The RHR loops provide this circulation.
| |
| The flow provided by one RHR loop is adequate for heat removal and for boron mixing.RCS loops in MODE 5 (loops not filled) satisfy Criterion 4 of 10 CFR 50.36 (Ref. 1).LCO The purpose of this LCO is to require that at least two RHR loops be OPERABLE and one of these loops be in operation.
| |
| An OPERABLE loop is one that has the capability of transferring heat from the reactor coolant at a controlled rate. Heat cannot be removed via the RHR System unless forced flow is used. A minimum of one running RHR pump meets the LCO requirement for one loop in operation.
| |
| An additional RHR loop is required to be OPERABLE to meet single failure considerations.
| |
| Note 1 permits all RHR pumps to be de-energized for < 15 minutes when switching from one loop to another. The circumstances for stopping both RHR pumps are to be limited to situations when the outage time is short McGuire Units 1 and 2 B 3.4.8-1 Revision No. 115 RCS Loops -MODE 5, Loops Not Filled B 3.4.8 BASES LCO (continued) and core outlet temperature is maintained at least 1 0°F below saturation temperature.
| |
| The Note prohibits boron dilution with coolant at boron concentration less than required to assure SDM of LCO 3.1.1 is maintained or draining operations when RHR forced flow is stopped.Note 2 allows one RHR loop to be inoperable for a period of < 2 hours, provided that the other loop is OPERABLE and in operation.
| |
| This permits periodic surveillance tests to be performed on the inoperable loop during the only time when these tests are safe and possible.An OPERABLE RHR loop is comprised of an OPERABLE RHR pump capable of providing forced flow to an OPERABLE RHR heat exchanger.
| |
| RHR pumps are OPERABLE if they are capable of being powered and are able to provide flow if required.APPLICABILITY In MODE 5 with loops not filled, this LCO requires core heat removal and coolant circulation by the RHR System.Operation in other MODES is covered by: LCO 3.4.4, "RCS Loops-MODES 1 and 2";LCO 3.4.5, "RCS Loops-MODE 3";LCO 3.4.6, "RCS Loops-MODE 4";LCO 3.4.7, "RCS Loops-MODE 5, Loops Filled";LCO 3.4.17, "RCS Loops-Test Exceptions";
| |
| LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation-High Water Level" (MODE 6); and LCO 3.9.6, "Residual Heat Removal (RHR) and Coolant Circulation-Low Water Level" (MODE 6).ACTIONS A..1 If only one RHR loop is OPERABLE and in operation, redundancy for RHR is lost. Action must be initiated to restore a second loop to OPERABLE status. The immediate Completion Time reflects the importance of maintaining the availability of two paths for heat removal.B.1 and B.2 If no required RHR loops are OPERABLE or in operation, except during conditions permitted by Note 1, all operations involving introduction of coolant into the RCS with boron concentration less than required to meet SDM of LCO 3.1.1 must be suspended and action must be McGuire Units 1 and 2 B 3.4.8-2 Revision No. 115 RCS Loops -MODE 5, Loops Not Filled B 3.4.8 BASES ACTIONS (continued) initiated immediately to restore an RHR loop to OPERABLE status and operation.
| |
| The required margin to criticality must not be reduced in this type of operation.
| |
| Suspending the introduction of coolant into the RCS of coolant with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 is required to assure continued safe operation.
| |
| With coolant added without forced circulation, unmixed coolant could be introduced to the core, however, coolant added with boron concentration meeting the minimum SDM maintains acceptable margin to criticality.
| |
| The immediate Completion Time reflects the importance of maintaining operation for heat removal. The action to restore must continue until one loop is restored to OPERABLE status and operation.
| |
| SURVEILLANCE SR 3.4.8.1 REQUIREMENTS This SR requires verification that one loop is in operation.
| |
| Verification includes flow rate, temperature, or pump status monitoring, which help ensure that forced flow is providing heat removal. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.4.8.2 Verification that the required number of pumps are OPERABLE ensures that an additional pump can be placed in operation, if needed, to maintain decay heat removal and reactor coolant circulation.
| |
| Verification is performed by verifying proper breaker alignment and power available to the required pumps. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.4.8-3 Revision No. 115 Pressurizer B 3.4.9 B 3.4 REACTOR COOLANT SYSTEM (RCS)B 3.4.9 Pressurizer BASES BACKGROUND The pressurizer provides a point in the RCS where liquid and vapor are maintained in equilibrium under saturated conditions for pressure control purposes to prevent bulk boiling in the remainder of the RCS. Key functions include maintaining required primary system pressure during steady state operation, and limiting the pressure changes caused by reactor coolant thermal expansion and contraction during normal load transients.
| |
| The pressure control components addressed by this LCO include the pressurizer water level, the required heaters, and their controls and power supplies.
| |
| Pressurizer safety valves and pressurizer power operated relief valves are addressed by LCO 3.4.10, "Pressurizer Safety Valves," and LCO 3.4.11, "Pressurizer Power Operated Relief Valves (PORVs)," respectively.
| |
| The intent of the LCO is to ensure that a steam bubble exists in the pressurizer prior to power operation to minimize the consequences of potential overpressure transients.
| |
| The LCO also ensures that the initial pressurizer level assumed in the safety analysis remains valid. Relatively small amounts of noncondensible gases can inhibit the condensation heat transfer between the pressurizer spray and the steam, and diminish the spray effectiveness for pressure control.Electrical immersion heaters, located in the lower section of the pressurizer vessel, keep the water in the pressurizer at saturation temperature and maintain a constant operating pressure.
| |
| A minimum required available capacity of pressurizer heaters ensures that the RCS pressure can be maintained.
| |
| The capability to maintain and control system pressure is important for maintaining subcooled conditions in the RCS and ensuring the capability to remove core decay heat by either forced or natural circulation of reactor coolant. Unless adequate heater capacity is available, the hot, high pressure condition cannot be maintained indefinitely and still provide the required subcooling margin in the primary system. Inability to control the system pressure and maintain subcooling under conditions of natural circulation flow in the primary system could lead to a loss of single phase natural circulation and decreased capability to remove core decay heat.McGuire Units 1 and 2 B 3.4.9-1 Revision No. 115 Pressurizer B 3.4.9 BASES APPLICABLE SAFETY ANALYSES In MODES 1, 2, and 3, the LCO requirement for pressurizer level to remain within the required range is consistent with the accident analyses.Safety analyses performed for lower MODES are not limiting.
| |
| All analyses performed from a critical reactor condition assume the existence of a steam bubble and saturated conditions in the pressurizer.
| |
| In making this assumption, the analyses neglect the small fraction of noncondensible gases normally present.Safety analyses presented in the UFSAR (Ref. 1) do not take credit for pressurizer heater operation; however, an initial condition assumption of the safety analyses is that the RCS is operating at normal pressure.The maximum pressurizer water level limit satisfies Criterion 2 of 10 CFR 50.36 (Ref. 2). Although the heaters are not specifically used in accident analysis, the need to maintain subcooling in the long term during loss of-offsite power, as indicated in NUREG-0737 (Ref. 3), is the reason for providing an LCO.LCO The LCO requirement for the pressurizer to be OPERABLE with a water volume _ 1600 cubic feet, which is equivalent to 92%, ensures that a steam bubble exists. Limiting the LCO maximum operating water level preserves the steam space for pressure control. The LCO has been established to ensure the capability to establish and maintain pressure control for steady state operation and to minimize the consequences of potential overpressure transients.
| |
| Requiring the presence of a steam bubble is also consistent with safety analysis analytical assumptions.
| |
| The LCO requires two groups of OPERABLE pressurizer heaters, each with a capacity > 150 kW, capable of being powered from either the offsite power source or the emergency power supply. Only heater groups A and B are capable of being powered from the emergency power supply.The minimum heater capacity required is sufficient to maintain the RCS near normal operating pressure when accounting for heat losses through the pressurizer insulation.
| |
| By maintaining the pressure near the operating conditions, a wide margin to subcooling can be obtained in the loops. The amount needed to maintain pressure is dependent on the heat losses.APPLICABILITY The need for pressure control is most pertinent when core heat can cause the greatest effect on RCS temperature, resulting in the greatest effect on pressurizer level and RCS pressure control. Thus, applicability has been designated for MODES 1 and 2. The applicability is also provided for MODE 3. The purpose is to prevent solid water RCS McGuire Units 1 and 2 B 3.4.9-2 Revision No. 115 Pressurizer B 3.4.9 BASES APPLICABILITY (continued) operation during heatup and cooldown to avoid rapid pressure rises caused by normal operational perturbation, such as reactor coolant pump startup.In MODES 1, 2, and 3, there is need to maintain the availability of pressurizer heaters, capable of being powered from an offsite or emergency power supply. In the event of a loss of offsite power, the initial conditions of these MODES give the greatest demand for maintaining the RCS in a hot pressurized condition with loop subcooling for an extended period. For MODE 4, 5, or 6, it is not necessary to control pressure (by heaters) to ensure loop subcooling for heat transfer when the Residual Heat Removal (RHR) System is in service, and therefore, the LCO is not applicable.
| |
| ACTIONS A.1 and A.2 Pressurizer water level control malfunctions or other plant evolutions may result in a pressurizer water level above the nominal upper limit, even with the plant at steady state conditions.
| |
| Normally the plant will trip in this event since the upper limit of this LCO is the same as the Pressurizer Water Level-High Trip.If the pressurizer water level is not within the limit, action must be taken to restore the plant to operation within the bounds of the safety analyses.To achieve this status, the unit must be brought to MODE 3, with the reactor trip breakers open, within 6 hours and to MODE 4 within 12 hours.This takes the unit out of the applicable MODES and restores the unit to operation within the bounds of the safety analyses.The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.B.1 If one required group of pressurizer heaters is inoperable, restoration is required within 72 hours. The Completion Time of 72 hours is reasonable considering the anticipation that a demand caused by loss of offsite power would be unlikely in this period. Pressure control may be maintained during this time using normal station powered heaters.McGuire Units 1 and 2 B 3.4.9-3 Revision No. 115 Pressurizer B 3.4.9 BASES ACTIONS (continued)
| |
| C.1 and C.2 If one group of pressurizer heaters are inoperable and cannot be restored in the allowed Completion Time of Required Action B.1, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours and to MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.SURVEILLANCE SR 3.4.9.1 REQUIREMENTS This SR requires that during steady state operation, pressurizer level is maintained below the nominal upper limit to provide a minimum space for a steam bubble. The Surveillance is performed by observing the indicated level. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.4.9.2 The SR is satisfied when the power supplies are demonstrated to be capable of producing the minimum power and the associated pressurizer heaters are verified to be at their design rating. This may be done by testing the power supply output and by performing an electrical check on heater element continuity and resistance.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. UFSAR, Section 15.2. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| : 3. NUREG-0737, November 1980.McGuire Units 1 and 2 B 3.4.9-4 Revision No. 115 Pressurizer Safety Valves B 3.4.10 B 3.4 REACTOR COOLANT SYSTEM (RCS)B 3.4.10 Pressurizer Safety Valves BASES BACKGROUND The pressurizer safety valves provide, in conjunction with the Reactor Protection System, overpressure protection for the RCS.The pressurizer safety valves are totally enclosed pop type, spring loaded, self actuated valves with backpressure compensation.
| |
| The safety valves are designed to prevent the system pressure from exceeding the system Safety Limit (SL), 2735 psig, which is 110% of the design pressure.Because the safety valves are totally enclosed and self actuating, they are considered independent components.
| |
| The relief capacity for each valve, 420,000 lb/hr, is based on postulated overpressure transient conditions resulting from a locked rotor. This event results in the maximum surge rate into the pressurizer, which specifies the minimum relief capacity for the safety valves. The discharge flow from the pressurizer safety valves is directed to the pressurizer relief tank. This discharge flow is indicated by an increase in temperature downstream of the pressurizer safety valves or increase in the pressurizer relief tank temperature or level.Overpressure protection is required in MODES 1, 2, 3, 4, and 5;however, in MODE 4, with one or more RCS cold leg temperatures
| |
| < 300 0 F, and MODE 5 and MODE 6 with the reactor vessel head on, overpressure protection is provided by operating procedures and by meeting the requirements of LCO 3.4.12, "Low Temperature Overpressure Protection (LTOP) System." The upper pressure limit of +3% is consistent with the ASME requirement (Ref. 1) for lifting pressures above 1000 psig. The lower pressure limit of -2% is selected such that the minimum LCO lift pressure remains above the uncertainty adjusted high pressure reactor trip setpoint.
| |
| The lift setting is for the ambient conditions associated with MODES 1, 2, and 3. This requires either that the valves be set hot or that a correlation between hot and cold settings be established.
| |
| The pressurizer safety valves are part of the primary success path and mitigate the effects of postulated accidents.
| |
| OPERABILITY of McGuire Units 1 and 2 B 3.4. 10-1 Revision No. 102 Pressurizer Safety Valves B 3.4.10 BASES BACKGROUND (continued) the safety valves ensures that the RCS pressure will be limited to 110% of design pressure.
| |
| The consequences of exceeding the American Society of Mechanical Engineers (ASME) pressure limit (Ref. 1) could include damage to RCS components, increased leakage, or a requirement to perform additional stress analyses prior to resumption of reactor operation.
| |
| APPLICABLE All accident and safety analyses in the UFSAR (Ref. 2) that require SAFETY ANALYSES safety valve actuation assume operation of three pressurizer safety valves to limit increases in RCS pressure.
| |
| The overpressure protection analysis (Ref. 3) is also based on operation of three safety valves. Accidents that could result in overpressurization if not properly terminated include: a. Uncontrolled rod withdrawal;
| |
| : b. Loss of reactor coolant flow;c. Loss of external electrical load;d. Loss of normal feedwater;
| |
| : e. Loss of all AC power to station auxiliaries;
| |
| : f. Locked rotor; and g. Turbine trip.Detailed analyses of the above transients are contained in Reference
| |
| : 2. Compliance with this LCO is consistent with the design bases and accident analyses assumptions.
| |
| Pressurizer safety valves satisfy Criterion 3 of 10 CFR 50.36 (Ref.5).LCO The three pressurizer safety valves are set to open at the RCS design pressure 2485 psig, and within the ASME specified tolerance, to avoid exceeding the maximum design pressure SL, to maintain accident analyses assumptions, and to comply with ASME requirements.
| |
| The upper pressure tolerance limit of +3% is consistent with the ASME requirements (Ref. 1) for lifting pressures above 1000 psig. The lower pressure limit of -2% is selected such that the minimum LCO lift pressure remains above the uncertainty adjusted high pressure reactor trip setpoint.McGuire Units 1 and 2 B 3.4.10-2 Revision No. 102 Pressurizer Safety Valves B 3.4.10 BASES LCO (continued)
| |
| The limit protected by this Specification is the reactor coolant pressure boundary (RCPB) SL of 110% of design pressure.Inoperability of one or more valves could result in exceeding the SL if a transient were to occur. The consequences of exceeding the ASME pressure limit could include damage to one or more RCS components, increased leakage, or additional stress analysis being required prior to resumption of reactor operation.
| |
| APPLICABILITY In MODES 1, 2, and 3, and portions of MODE 4 above the LTOP arming temperature, OPERABILITY of three valves is required because the combined capacity is required to keep reactor coolant pressure below 110% of its design value during certain accidents.
| |
| MODE 3 and portions of MODE 4 are conservatively included, although the listed accidents may not require the safety valves for protection.
| |
| The LCO is not applicable in MODE 4 when all RCS cold leg temperatures are _< 300'F or in MODE 5 because LTOP is provided.
| |
| Overpressure protection is not required in MODE 6 with the reactor vessel head removed.The Note allows entry into MODES 3 and 4 with the lift settings outside the LCO limits. This permits testing and examination of the safety valves at high pressure and temperature near their normal operating range, but only after the valves have had a preliminary cold setting. The cold setting gives assurance that the valves are OPERABLE near their design condition.
| |
| Only one valve at a time will be removed from service for testing. The 54 hour exception is based on 18 hour outage time for each of the three valves. The 18 hour period is derived from operating experience that hot testing can be performed in this timeframe.
| |
| ACTIONS A.1 With one pressurizer safety valve inoperable, restoration must take place within 15 minutes. The Completion Time of 15 minutes reflects the importance of maintaining the RCS Overpressure Protection System. An inoperable safety valve coincident with an RCS overpressure event could challenge the integrity of the pressure boundary.McGuire Units 1 and 2 B 3.4.10-3 Revision No. 102 Pressurizer Safety Valves B 3.4.10 BASES ACTIONS (continued)
| |
| B.1 and B.2 If the Required Action of A.1 cannot be met within the required Completion Time or if two or more pressurizer safety valves are inoperable, the plant must be brought to a MODE in which the requirement does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 4 with any RCS cold leg temperatures
| |
| < 300OF within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. With any RCS cold leg temperatures at or below 300 0 F, overpressure protection is provided by the LTOP System. The change from MODE 1, 2, or 3 to MODE 4 reduces the RCS energy (core power and pressure), lowers the potential for large pressurizer insurges, and thereby removes the need for overpressure protection by three pressurizer safety valves.SURVEILLANCE SR 3.4.10.1 REQUIREMENTS SRs are specified in the Inservice Testing Program. Pressurizer safety valves are to be tested in accordance with the requirements of the ASME OM Code (Ref. 4), which provides the activities and Frequencies necessary to satisfy the SRs. No additional requirements are specified.
| |
| The pressurizer safety valve setpoint is + 3% and -2% of the nominal setpoint of 2485 psig for OPERABILITY; however, the valves are reset to +/- 1% during the Surveillance to allow for drift.REFERENCES
| |
| : 1. ASME, Boiler and Pressure Vessel Code, Section Il.2. UFSAR, Chapter 15.3. UFSAR Section 5.2.4. ASME Code for Operation and Maintenance of Nuclear Power Plants.5. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.4.10-4 Revision No. 102 Pressurizer PORVs B 3.4.11 B 3.4 REACTOR COOLANT SYSTEM (RCS)B 3.4.11 Pressurizer Power Operated Relief Valves (PORVs)BASES BACKGROUND The pressurizer is equipped with two types of devices for pressure relief: pressurizer safety valves and PORVs. The PORVs are air operated valves that are controlled to open at a specific set pressure when the pressurizer pressure increases and close when the pressurizer pressure decreases.
| |
| The PORVs may also be manually operated from the control room.Block valves, which are normally open, are located between the pressurizer and the PORVs. The block valves are used to isolate the PORVs in case of excessive leakage or a stuck open PORV. Block valve closure is accomplished manually using controls in the control room. A stuck open PORV is, in effect, a small break loss of coolant accident (LOCA). As such, block valve closure terminates the RCS depressurization and coolant inventory loss.The PORVs and their associated block valves may be used by plant operators to depressurize the RCS to recover from certain transients if normal pressurizer spray is not available.
| |
| Additionally, the series arrangement of the PORVs and their block valves permit performance of surveillances on the valves during power operation.
| |
| The PORVs may also be used for feed and bleed core cooling in the case of multiple equipment failure events that are not within the design basis, such as a total loss of feedwater.
| |
| The PORVs, their block valves, and their controls are powered from the vital buses that normally receive power from offsite power sources, but are also capable of being powered from emergency power sources in the event of a loss of offsite power. Three PORVs and their associated block valves are powered from two separate safety trains (Ref. 1).The plant has three PORVs, each having a relief capacity of 210,000 lb/hr at 2335 psig. The functional design of the PORVs is based on maintaining pressure below the Pressurizer Pressure-High reactor trip setpoint following a step reduction of 50% of full load with steam dump.In addition, the PORVs minimize challenges to the pressurizer safety valves and also may be used for low temperature overpressure protection (LTOP). See LCO 3.4.12, "Low Temperature Overpressure Protection (LTOP) System." McGuire Units 1 and 2 B 3.4.11 -1 Revision No. 115 Pressurizer PORVs B 3.4.11 BASES APPLICABLE SAFETY ANALYSES Plant operators employ the PORVs to depressurize the RCS in response to certain plant transients if normal pressurizer spray is not available.
| |
| For the Steam Generator Tube Rupture (SGTR) event, the safety analysis assumes that manual operator actions are required to mitigate the event.A loss of offsite power is assumed to accompany the event, and thus, normal pressurizer spray is unavailable to reduce RCS pressure.
| |
| The PORVs are assumed to be used for manual RCS depressurization, which is one of the steps performed to equalize the primary and secondary pressures in order to terminate the primary to secondary break flow and the radioactive releases from the affected steam generator.
| |
| The PORVs are assumed to operate in safety analyses for events that result in increasing RCS pressure for which departure from nucleate boiling ratio (DNBR) criteria are critical.
| |
| By assuming PORV automatic actuation, the primary pressure remains below the high pressurizer pressure trip setpoint; thus, the DNBR calculation is more conservative.
| |
| Events that assume this condition include uncontrolled bank withdrawal at power, uncontrolled bank withdrawal from subcritical, and single rod withdrawal at power (Ref. -2).Pressurizer PORVs satisfy Criterion 3 of 10 CFR 50.36 (Ref. 3).LCO The LCO requires the PORVs and their associated block valves to be OPERABLE for manual operation to mitigate the effects associated with an SGTR.By maintaining two PORVs and their associated block valves OPERABLE, the single failure criterion is satisfied.
| |
| Three PORVs are required to be OPERABLE to meet RCS pressure boundary requirements.
| |
| The block valves are available to isolate the flow path through either a failed open PORV or a PORV with excessive leakage.Satisfying the LCO helps minimize challenges to fission product barriers.APPLICABILITY In MODES 1, 2, and 3, the PORV and its block valve are required to be OPERABLE to limit the potential for a small break LOCA through the flow path. The most likely cause for a PORV small break LOCA is a result of a pressure increase transient that causes the PORV to open. Imbalances in the energy output of the core and heat removal by the secondary system can cause the RCS pressure to increase to the PORV opening setpoint.
| |
| The most rapid increases will occur at the higher operating power and pressure conditions of MODES 1 and 2.McGuire Units 1 and 2 B 3.4.11-2 Revision No. 115 Pressurizer PORVs B 3.4.11 BASES APPLICABILITY (continued)
| |
| Pressure increases are less prominent in MODE 3 because the core input energy is reduced, but the RCS pressure is high. Therefore, the LCO is applicable in MODES 1, 2, and 3. The LCO is not applicable in MODE 4 when both pressure and core energy are decreased and the pressure surges become much less significant.
| |
| The PORV setpoint is reduced for LTOP in MODES 4 < 300 0 F, 5, and 6 with the reactor vessel head in place. LCO 3.4.12 addresses the PORV requirements in these MODES.ACTIONS A Note has been added to clarify that all pressurizer PORVs are treated as separate entities, each with separate Completion Times (i.e., the Completion Time is on a component basis).A..1 With the PORVs inoperable and capable of being manually cycled, either the PORVs must be restored or the flow path isolated within 1 hour. The block valves should be closed but power must be maintained to the associated block valves, since removal of power would render the block valve inoperable.
| |
| Although a PORV may be designated inoperable, it may be able to be manually opened and closed, and therefore, able to perform its function.
| |
| PORV inoperability may be due to seat leakage or other causes that do not prevent manual use and do not create a possibility for a small break LOCA. For these reasons, the block valve may be closed but the Action requires power be maintained to the valve.This Condition is only intended to permit operation of the plant for a limited period of time not to exceed the next refueling outage (MODE 6)so that maintenance can be performed on the PORVs to eliminate the problem condition.
| |
| Normally, the PORVs should be available for automatic mitigation of overpressure events and should be returned to OPERABLE status prior to entering startup (MODE 2).Quick access to the PORV for pressure control can be made when power remains on the closed block valve. The Completion Time of 1 hour is based on plant operating experience that has shown that minor problems can be corrected or closure accomplished in this time period.McGuire Units 1 and 2 B 3.4.11-3 Revision No. 115 Pressurizer PORVs B 3.4.11 BASES ACTIONS (continued)
| |
| B.1, B.2, and B.3 If one or two PORVs are inoperable and not capable of being manually cycled, it must be either restored or isolated by closing the associated block valve and removing the power to the associated block valve. If one PORV is inoperable as a result of the Required Action C.2, then Required Actions B.1 and B.2 are not applicable.
| |
| The Completion Times of 1 hour are reasonable, based on challenges to the PORVs during this time period, and provide the operator adequate time to correct the situation.
| |
| If the inoperable valve cannot be restored to OPERABLE status, it must be isolated within the specified time. Because there is one PORV that remains OPERABLE, an additional 72 hours is provided to restore an additional PORV to OPERABLE status when two PORVs are inoperable.
| |
| If the PORV cannot be restored within this additional time, the plant must be brought to a MODE in which the LCO does not apply, as required by Condition D. With only one PORV inoperable, operation may continue provided Required Actions B.1 and B.2 are met.C.1 and C.2 If one block valve is inoperable, then it is necessary to either restore the block valve to OPERABLE status within the Completion Time of 1 hour or place the associated PORV in the closed position.
| |
| The prime importance for the capability to close the block valve is to isolate a stuck open PORV.Therefore, if the block valve cannot be restored to OPERABLE status within 1 hour, the Required Action is to place the PORV in the closed position and remove power from the solenoid to preclude its automatic opening for an overpressure event and to avoid the potential for a stuck open PORV at a time that the block valve is inoperable.
| |
| The actions for an inoperable PORV are not entered due to these actions, however, the associated PORV is inoperable and must be included in subsequent inoperability determinations.
| |
| The Completion Time of 1 hour is reasonable, based on the small potential for challenges to the system during this time period, and provides the operator time to correct the situation.
| |
| D.1 and D.2 If the Required Action of Condition A, B, or C is not met, then the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 4 within 12 hours. The allowed Completion Times McGuire Units 1 and 2 B 3.4.11-4 Revision No. 115 Pressurizer PORVs B 3.4.11 BASES ACTIONS (continued) are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. In MODES 4 and 5, maintaining PORV OPERABILITY may be required.
| |
| See LCO 3.4.12.E.1, E.2, E.3, and E.4 If three PORVs are inoperable and not capable of being manually cycled, it is necessary to either restore at least one valve within the Completion Time of 1 hour or isolate the flow path by closing and removing the power to the associated block valves. The Completion Time of 1 hour is reasonable, based on the small potential for challenges to the system during this time and provides the operator time to correct the situation.
| |
| If one PORV is restored and two PORVs remain inoperable, then the plant will be in Condition B with the time clock started at the original declaration of having two PORVs inoperable.
| |
| If no PORVs are restored within the Completion Time, then the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.In MODES 4 and 5, maintaining PORV OPERABILITY may be required.See LCO 3.4.12.F.1 and F.2 If two block valves are inoperable, it is necessary to either restore one block valve within the Completion Time of 1 hour, or place the associated PORVs in the closed position and restore one block valve within 72 hours. The Completion Times are reasonable, based on the small potential for challenges to the system during this time and provide the operator time to correct the situation.
| |
| G.1 and G.2 If three block valves are inoperable, it is necessary to place the associated PORVs in the closed position and verify the PORVs closed within 1 hour and restore at least one block valve within 2 hours. The Completion Times are reasonable, based on the small potential for challenges to the system during this time and provide the operator time to correct the situation.
| |
| McGuire Units 1 and 2 B 3.4.11-5 Revision No. 115 Pressurizer PORVs B 3.4.11 BASES ACTIONS (continued)
| |
| H.1 and H.2 If the Required Actions of Condition F or G are not met, then the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. In MODES 4 and 5, maintaining PORV OPERABILITY may be required.
| |
| See LCO 3.4.12.SURVEILLANCE SR 3.4.11.1 REQUIREMENTS Block valve cycling verifies that the valve(s) can be closed if needed. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program. If the block valve is closed to isolate a PORV that is capable of being manually cycled, the OPERABILITY of the block valve is of importance, because opening the block valve is necessary to permit the PORV to be used for manual control of reactor pressure.
| |
| If the block valve is closed to isolate an otherwise inoperable PORV, the maximum Completion Time to restore the PORV and open the block valve is 72 hours. Furthermore, these test requirements would be completed by the reopening of a recently closed block valve upon restoration of the PORV to OPERABLE status (i.e., completion of the Required Actions fulfills the SR).The Note modifies this SR by stating that it is not required to be met with the block valve closed, in accordance with the Required Action of this LCO.SR 3.4.11.2 SR 3.4.11.2 requires a complete cycle of each PORV. Operating a PORV through one complete cycle ensures that the PORV can be manually actuated for mitigation of an SGTR. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.The SR is modified by a Note which states that the SR is required to be performed in MODE 3 or 4 when the temperature of the RCS cold legs is> 300OF consistent with Generic Letter 90-06 (Ref. 5).McGuire Units 1 and 2 B 3.4.11-6 Revision No. 115 Pressurizer PORVs B 3.4.11 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.4.11.3 The Surveillance dem6nstrates that the emergency nitrogen supply can be provided and is performed by transferring power from normal air supply to emergency nitrogen-supply and cycling the valves. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. Regulatory Guide 1.32, February 1977.2. UFSAR, Section 15.4.3. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| : 4. ASME Code for Operation and Maintenance of Nuclear Power Plants.5. Resolution of Generic Issue 70, "Power-Operated Relief Valve and Block Valve Reliability," and Generic Issue 94, "Additional Low-Temperature Overpressure Protection for Light-Water Reactors," Pursuant to 10 CFR 50.54(f) (Generic Letter 90-06).McGuire Units 1 and 2 B 3.4.11-7 Revision No. 115 LTOP System B 3.4.12 B 3.4 REACTOR COOLANT SYSTEM (RCS)B 3.4.12 Low Temperature Overpressure Protection (LTOP) System BASES BACKGROUND The LTOP System controls RCS pressure at low temperatures so the integrity of the reactor coolant pressure boundary (RCPB) is not compromised by violating the pressure and temperature (P/T) limits of 10 CFR 50, Appendix G (Ref. 1). The reactor vessel is the limiting RCPB component for demonstrating such protection.
| |
| This specification provides the maximum allowable actuation logic setpoints for the power operated relief valves (PORVs) and LCO 3.4.3, "RCS Pressure and Temperature (P/T) Limits," provides the maximum RCS pressure for the existing RCS cold leg temperature during cooldown, shutdown, and heatup to meet the Reference 1 requirements during the LTOP MODES.The reactor vessel material is less tough at low temperatures than at normal operating temperature.
| |
| As the vessel neutron exposure accumulates, the material toughness decreases and becomes less resistant to pressure stress at low temperatures (Ref. 2). RCS pressure, therefore, is maintained low at low temperatures and is increased only as temperature is increased.
| |
| The potential for vessel overpressurization is most acute when the RCS is water solid, occurring only while shutdown; a pressure fluctuation can occur more quickly than an operator can react to relieve the condition.
| |
| Exceeding the RCS P/T limits by a significant amount could cause brittle cracking of the reactor vessel. LCO 3.4.3 requires administrative control of RCS pressure and temperature during heatup and cooldown to prevent exceeding the specified limits.This LCO provides RCS overpressure protection by having a minimum coolant input capability and having adequate pressure relief capacity.Limiting coolant input capability requires all but one centrifugal charging pump or one safety injection pump incapable of injection into the RCS and isolating the accumulators.
| |
| The pressure relief capacity requires either two redundant PORVs or a depressurized RCS and an RCS vent of sufficient size. One PORV or the open RCS vent is the overpressure protection device that acts to terminate an increasing pressure event.With minimum coolant input capability, the ability to provide core coolant addition is restricted.
| |
| The LCO does not require the makeup control McGuire Units 1 and 2 B 3.4.12-1 Revision No. 115 LTOP System B 3.4.12 BASES BACKGROUND (continued) system deactivated or the safety injection (SI) actuation circuits blocked.Due to the lower pressures in the LTOP MODES and the expected core decay heat levels, the makeup system can provide adequate flow via the makeup control valve. If conditions require the use of more than one centrifugal charging pump for makeup in the event of loss of inventory, then pumps can be made available through manual actions.PORV Requirements As designed for the LTOP System, each PORV is signaled to open if the RCS pressure reaches 385 psig when the PORVS are in the "lo-press" mode of operation.
| |
| If the PORVs are being used to meet the requirements of this specification, then RCS cold leg temperature is limited in accordance with the LTOP analysis.
| |
| For cases where no reactor coolant pumps are in operation, this temperature limit is met by monitoring of BOTH the Wide Range Cold Leg temperatures and Residual Heat Removal Heat Exchanger discharge temperature.
| |
| These temperatures are the most representative of the fluid in the reactor vessel downcomer region. The LTOP actuation logic monitors both RCS temperature and RCS pressure.
| |
| The signals used to generate the pressure setpoints originate from the safety related narrow range pressure transmitters.
| |
| The signals used to generate the temperature permissives originate from the wide range RTDs on cold leg C and hot leg D. Each signal is input to the appropriate NSSS protection system cabinet where it is converted to an internal signal and then input to a comparator to generate an actuation signal. If the indicated pressure meets or exceeds the bistable setpoint, a PORV is signaled to open.This Specification presents the PORV setpoints for LTOP. Having the setpoints of both valves within the limits ensures that the Reference 1 limits will not be exceeded in any analyzed event.When a PORV is opened in an increasing pressure transient, the release of coolant will cause the pressure increase to slow and reverse. As the PORV releases coolant, the RCS pressure decreases until a reset pressure is reached and the valve is signaled to close. The pressure continues to decrease below the reset pressure as the valve closes.RCS Vent Requirements Once the RCS is depressurized, a vent exposed to the containment atmosphere will maintain the RCS at containment ambient pressure in an RCS overpressure transient, if the relieving requirements of the transient do not exceed the capabilities of the vent. Thus, the vent path must be McGuire Units 1 and 2 B 3.4.12-2 Revision No. 115 LTOP System B 3.4.12 BASES BACKGROUND (continued) capable of relieving the flow resulting from the limiting LTOP mass or heat input transient, and maintaining pressure below the P/T limits. The required vent capacity may be provided by one or more vent paths.The vent path(s) must be above the level of reactor coolant, so as not to drain the RCS when open.APPLICABLE Safety analyses (Ref. 4) demonstrate that the reactor vessel is SAFETY ANALYSES adequately protected against exceeding the Reference 1 P/T limits. In MODES 1, 2, and 3, and in MODE 4 with RCS cold leg temperature exceeding 300 0 F, the pressurizer safety valves will prevent RCS pressure from exceeding the Reference 1 limits. At about 300OF and below, overpressure prevention falls to two OPERABLE PORVs or to a depressurized RCS and a sufficient sized RCS vent. Each of these means has a limited overpressure relief capability.
| |
| The actual temperature at which the pressure in the P/T limit curve falls below the pressurizer safety valve setpoint increases as the reactor vessel material toughness decreases due to neutron embrittlement.
| |
| Each time the P/T curves are revised, the LTOP System must be re-evaluated to ensure its functional requirements can still be met using the PORV method or the depressurized and vented RCS condition.
| |
| Any change to the RCS must be evaluated against the Reference 4 analyses to determine the impact of the change on the LTOP acceptance limits.Transients that are capable of overpressurizing the RCS are categorized as either mass or heat input transients, examples of which follow: Mass Input Type Transients
| |
| : a. Inadvertent safety injection; or b. Charging/letdown flow mismatch.Heat Input Type Transients
| |
| : a. Inadvertent actuation of pressurizer heaters;b. Loss of RHR cooling; or McGuire Units 1 and 2 B 3.4.12-3 Revision No. 115 LTOP System B 3.4.12 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| : c. Reactor coolant pump (RCP) startup with temperature asymmetry within the RCS or between the RCS and steam generators.
| |
| The following are required during the LTOP MODES to ensure that mass and heat input transients do not occur, which either of the LTOP overpressure protection means cannot handle: a. Rendering all but one centrifugal charging pump or one safety injection pump incapable of injection;
| |
| : b. Deactivating the accumulator discharge isolation valves in their closed positions; and c. Disallowing start of an RCP if secondary temperature is more than 50°F above primary temperature in any one loop. LCO 3.4.6, "RCS Loops-MODE 4," and LCO 3.4.7, "RCS Loops-MODE 5, Loops Filled," provide this protection.
| |
| The Reference 4 analyses demonstrate that either one PORV or the depressurized RCS and RCS vent can maintain RCS pressure below limits when only one centrifugal charging pump or one safety injection pump are actuated.
| |
| Thus, the LCO allows only one centrifugal charging pump or one safety injection pump OPERABLE during the LTOP MODES. Since neither one PORV nor the RCS vent can handle the pressure transient from accumulator injection when RCS temperature is low the LCO also requires the accumulators isolation when accumulator pressure is greater than or equal to the maximum RCS pressure for the existing RCS cold leg temperature allowed in LCO 3.4.3.The isolated accumulators must have their discharge valves closed and power removed.Fracture mechanics analyses established the temperature of LTOP Applicability at 300 0 F.The consequences of a small break loss of coolant accident (LOCA) in LTOP MODE 4 conform to 10 CFR 50.46 and 10 CFR 50, Appendix K (Refs. 5 and 6), requirements by having a maximum of one centrifugal charging pump OPERABLE and SI actuation enabled.McGuire Units 1 and 2 B 3.4.12-4 Revision No. 115 LTOP System B 3.4.12 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| PORV Performance The fracture mechanics analyses show that the vessel is protected when the PORVs are set to open at or below the specified limit. The setpoints are derived by analyses that model the performance of the LTOP System, assuming the limiting LTOP transient of one centrifugal charging pump or one safety injection pump injecting into the RCS. These analyses consider pressure overshoot and undershoot beyond the PORV opening and closing, resulting from signal processing and valve stroke times. The PORV setpoints at or below the derived limit ensures the Reference 1 P/T limits will be met.The PORV setpoints will be updated when the revised P/T limits conflict with the LTOP analysis limits. The P/T limits are periodically modified as the reactor vessel material toughness decreases due to neutron embrittlement caused by neutron irradiation.
| |
| Revised limits are determined using neutron fluence projections and the results of examinations of the reactor vessel material irradiation surveillance specimens.
| |
| The Bases for LCO 3.4.3, "RCS Pressure and Temperature (P/T) Limits," discuss these examinations.
| |
| The PORVs are considered active components.
| |
| Thus, the failure of one PORV is assumed to represent the worst case, single active failure.RCS Vent Performance With the RCS depressurized, analyses show a vent size of 2.75 square inches is capable of mitigating the allowed LTOP overpressure transient.
| |
| The capacity of a vent this size is greater than the flow of the limiting transient for the LTOP configuration, one centrifugal charging pump or one safety injection pump OPERABLE, maintaining RCS pressure less than the maximum pressure on the P/T limit curve.The RCS vent size will be re-evaluated for compliance each time the P/T limit curves are revised based on the results of the vessel material surveillance.
| |
| The RCS vent is passive and is not subject to active failure.The LTOP System satisfies Criterion 2 of 10 CFR 50.36 (Ref. 7).McGuire Units 1 and 2 B 3.4.12-5 Revision No. 115 LTOP System B 3.4.12 BASES LCO This LCO requires that the LTOP System is OPERABLE.
| |
| The LTOP System is OPERABLE when the minimum coolant input and pressure relief capabilities are OPERABLE.
| |
| Violation of this LCO could lead to the loss of low temperature overpressure mitigation and violation of the Reference 1 limits as a result of an operational transient.
| |
| To limit the coolant input capability, the LCO permits a maximum of one centrifugal charging pump or one safety injection pump capable of injecting into the RCS and requires all accumulator discharge isolation valves closed and immobilized when accumulator pressure is greater than or equal to the maximum RCS pressure for the existing RCS cold leg temperature allowed in LCO 3.4.3.The elements of the LCO that provide low temperature overpressure mitigation through pressure relief are: a. Two OPERABLE PORVs (NC-32B and NC-34A); or A PORV is OPERABLE for LTOP when its block valve is open, its lift setpoint is set to the specified limit and testing proves its automatic ability to open at this setpoint, and motive power is available to the valve and its control circuit.b. A depressurized RCS and an RCS vent.An RCS vent is OPERABLE when open with an area of> 2.75 square inches.Each of these methods of overpressure prevention is capable of mitigating the limiting LTOP transient.
| |
| The LCO is modified with a note that specifies that a PORV secured in the open position may be used to meet the RCS vent requirement provided that its associated block valve is open and power removed.With the PORV physically secured or locked in the open position with its associated block valve open and power removed, this vent path is passive and is not subject to active failure.APPLICABILITY This LCO is applicable in MODE 4 when any RCS cold leg temperature is< 3001F, in MODE 5, and in MODE 6 when the reactor vessel head is on.The pressurizer safety valves provide overpressure protection that meets the Reference 1 P/T limits above 300 0 F. When the reactor vessel head is off, overpressurization cannot occur.LCO 3.4.3 provides the operational P/T limits for all MODES.LCO 3.4.10, "Pressurizer Safety Valves," requires the OPERABILITY of McGuire Units 1 and 2 B 3.4.12-6 Revision No. 115 LTOP System B 3.4.12 BASES APPLICABILITY (continued) the pressurizer safety valves that provide overpressure protection during MODES 1, 2, and 3, and MODE 4 above 300 0 F.Low temperature overpressure prevention is most critical during shutdown when the RCS is water solid, and a mass or heat input transient can cause a very rapid increase in RCS pressure when little or no time allows operator action to mitigate the event.The Applicability is modified by a Note stating that accumulator isolation is only required when the accumulator pressure is more than or at the maximum RCS pressure for the existing temperature, as allowed by the P/T limit curves. This Note permits the accumulator discharge isolation valve Surveillance to be performed only under these pressure and temperature conditions.
| |
| ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable LTOP system. There is an increased risk associated with entering MODE 4 from MODE 5 with LTOP inoperable and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.
| |
| A.1, A.2.1, A.2.2.1, A.2.2.2, A.3, A.4, A.5.1, and A.5.2 With two centrifugal charging pumps, safety injection pumps, or a combination of each, capable of injecting into the RCS, RCS overpressurization is possible.To immediately initiate action to restore restricted coolant input capability to the RCS reflects the urgency of removing the RCS from this condition.
| |
| Two pumps may be capable of injecting into the RCS provided the RHR suction relief valve is OPERABLE with: 1. RCS cold leg temperature
| |
| > 174 0 F (Unit 1), or 2. RCS cold leg temperature
| |
| > 89 0 F (Unit 2), or 3. RCS cold leg temperature
| |
| > 74 0 F and cooldown rate < 2 0'F/hr (Unit 1), or 4. RCS cold leg temperature
| |
| > 74 0 F and cooldown rate < 60 0 F/hr (Unit 2), or 5. two PORVs secured open with associated block valves open and power removed, or 6. a RCS vent of> 4.5 square inches, or McGuire Units 1 and 2 B 3.4.12-7 Revision No. 115 LTOP System B 3.4.12 BASES ACTIONS (continued)
| |
| : 7. a RCS vent of > 2.75 square inches and two OPERABLE PORVs (the RCS vent shall not be one of the two OPERABLE PORVs).For cases where no reactor coolant pumps are in operation, RCS cold leg temperature limits are to be met by monitoring of BOTH the WR Cold Leg temperatures and Residual Heat Removal Heat Exchanger discharge temperature.
| |
| With both PORVS and block valves secured open, or with an RCS vent of 4.5 square inches, there are no credible single failures to limit the flow relief capacity.
| |
| For the RHR relief valve to be OPERABLE, the RHR suction isolation valves must be open and the relief valve setpoint at 450 psig consistent with the safety analysis.
| |
| The RHR suction relief valves are spring loaded, bellows type water relief valves with pressure tolerances and accumulation limits established by Section III of the American Society of Mechanical Engineers (ASME) Code (Ref. 3) for Class 2 relief valves.Required Action A.1 is modified by a Note that permits two centrifugal charging pumps capable of RCS injection for < 15 minutes to allow for pump swaps.B.1, C.1, and C.2 An unisolated accumulator requires isolation within 1 hour. This is only required when the accumulator pressure is at or more than the maximum RCS pressure for the existing temperature allowed by the P/T limit curves.If isolation is needed and cannot be accomplished in 1 hour, Required Action C.1 and Required Action C.2 provide two options, either of which must be performed in the next 12 hours. By increasing the RCS temperature to > 300 0 F, an accumulator pressure of 639 psig cannot exceed the LTOP limits if the accumulators are fully injected.Depressurizing the accumulators below the LTOP limit also gives this protection.
| |
| The Completion Times are based on operating experience that these activities can be accomplished in these time periods and on engineering evaluations indicating that an event requiring LTOP is not likely in the allowed times.D.1 In MODE 4 when any RCS cold leg temperature is < 300°F, with one PORV inoperable, the PORV must be restored to OPERABLE status McGuire Units 1 and 2 B 3.4.12-8 Revision No. 115 LTOP System B 3.4.12 BASES ACTIONS (continued) within a Completion Time of 7 days. Two PORVS are required to provide low temperature overpressure mitigation while withstanding a single failure of an active component.
| |
| The Completion Time considers the facts that only one of the PORVs is required to mitigate an overpressure transient and that the likelihood of an active failure of the remaining valve path during this time period is very low.E.1 and E.2 The consequences of operational events that will overpressurize the RCS are more severe at lower temperature (Ref. 8). Thus, with one of the two PORVs inoperable in MODE 5 or in MODE 6 with the head on, all operations which could lead to a water solid pressurizer must be suspended immediately and the Completion Time to restore two valves to OPERABLE status is 24 hours.The Completion Time represents a reasonable time to investigate and repair several types of relief valve failures without exposure to a lengthy period with only one OPERABLE PORV to protect against overpressure events.F.1 and F.2 If the Required Actions and associated Completion Times of Condition E are not met, then alternative actions are necessary to establish the required redundancy in relief capacity.
| |
| This is accomplished by verifying that the RHR relief valve is OPERABLE and the RHR suction isolation valves open and the RCS cold leg temperature
| |
| > 174 0 F (Unit 1) or > 89 0 F (Unit 2). For cases where no reactor coolant pumps are in operation, RCS cold leg temperature limits are to be met by monitoring of BOTH the WR Cold Leg temperatures and Residual Heat Removal Heat Exchanger discharge temperature.
| |
| The Completion Time of 1 hour reflects the importance of restoring the required redundancy at lower RCS temperatures.
| |
| G.1 The RCS must be depressurized and a vent must be established within 8 hours when: McGuire Units 1 and 2 B 3.4.12-9 Revision No. 115 LTOP System B 3.4.12 BASES ACTIONS (continued)
| |
| : a. Both required PORVs are inoperable; or b. A Required Action and associated Completion Time of Condition C, D, E, or F is not met; or c. The LTOP System is inoperable for any reason other than Condition A, B, C, D, E, or F.The vent must be sized > 2.75 square inches to ensure that the flow capacity is greater than that required for the worst case mass input transient reasonable during the applicable MODES. This action is needed to protect the RCPB from a low temperature overpressure event and a possible brittle failure of the reactor vessel.The Completion Time considers the time required to place the plant in this Condition and the relatively low probability of an overpressure event during this time period due to increased operator awareness of administrative control requirements.
| |
| SURVEILLANCE SR 3.4.12.1 and SR 3.4.12.2 REQUIREMENTS To minimize the potential for a low temperature overpressure event by limiting the mass input capability, all but one centrifugal charging pump or one safety injection pump are verified incapable of injecting into the RCS and the accumulator discharge isolation valves are verified closed and power removed (See Ref. 10).The centrifugal charging pump and safety injection pump are rendered incapable of injecting into the RCS through removing the power from the pumps by racking the breakers out under administrative control. An alternate method of LTOP control may be employed using at least two independent means to prevent a pump start such that a single failure or single action will not result in an injection into the RCS. This may be accomplished through two valves in the discharge flow path being closed.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.4.12.3 The RHR suction relief valve shall be demonstrated OPERABLE by verifying the RHR suction isolation valves are open and by testing it in McGuire Units 1 and 2 B 3.4.12-10 Revision No. 115 LTOP System B 3.4.12 BASES SURVEILLANCE REQUIREMENTS (continued) accordance with the Inservice Testing Program. This Surveillance is only required to be performed if the RHR suction relief valve is being used to meet the Required Actions of this LCO.The RHR suction valves are verified to be opened. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.The ASME OM Code (Ref. 9), test per Inservice Testing Program, verifies OPERABILITY by proving proper relief valve mechanical motion and by measuring and, if required, adjusting the lift setpoint.SR 3.4.12.4 The RCS vent of _> 2.75 square inches is proven OPERABLE by verifying its open condition.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.The passive vent arrangement must only be open to be OPERABLE.This Surveillance is required to be performed if the vent is being used to satisfy the pressure relief requirements of the LCO 3.4.12b.SIR 3.4.12.5 The PORV block valve must be verified open to provide the flow path for each required PORV to perform its function when actuated.
| |
| The valve must be remotely verified open in the main control room. This Surveillance is performed if the PORV satisfies the LCO.The block valve is a remotely controlled, motor operated valve. The power to the valve operator is not required removed, and the manual operator is not required locked in the inactive position.
| |
| Thus, the block valve can be closed in the event the PORV develops excessive leakage or does not close (sticks open) after relieving an overpressure situation.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Units 1 and 2 B 3.4.12-11 Revision No. 115 LTOP System B 3.4.12 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.4.12.6 Performance of a COT is required within 12 hours after decreasing RCS temperature to _ 3001F and periodically on each required PORV to verify and, as necessary, adjust its lift setpoint.
| |
| The COT will verify the setpoint is within the allowed maximum limits. PORV actuation could depressurize the RCS and is not required.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.The 12 hour Frequency considers the unlikelihood of a low temperature overpressure event during this time.A Note has been added indicating that this SR is required to be met 12 hours after decreasing RCS cold leg temperature to < 300 0 F. The test must be performed within 12 hours after entering the LTOP MODES.SR 3.4.12.7 Performance of a CHANNEL CALIBRATION on each required PORV actuation channel is required to adjust the whole channel so that it responds and the valve opens within the required range and accuracy to known input. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Units 1 and 2 B 3.4.12-12 Revision No. 115 LTOP System B 3.4.12 BASES REFERENCES
| |
| : 1. 10 CFR 50, Appendix G.2. Generic Letter 88-11.3. ASME, Boiler and Pressure Vessel Code, Section III.4. UFSAR, Section 5.2.5. 10 CFR 50, Section 50.46.6. 10 CFR 50, Appendix K.7. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| : 8. Generic Letter 90-06.9. ASME Code for Operation and Maintenance of Nuclear Power Plants.10. Duke letter to NRC, "Cold Leg Accumulator Isolation Valves", dated September 8, 1987.McGuire Units 1 and 2 B 3.4.12-13 Revision No. 115 RCS Operational LEAKAGE B 3.4.13 B 3.4 REACTOR COOLANT SYSTEM (RCS)B 3.4.13 RCS Operational LEAKAGE BASES BACKGROUND Components that contain or transport the coolant to or from the reactor core make up the RCS. Component joints are made by welding, bolting, rolling, or pressure loading, and valves isolate connecting systems from the RCS.During plant life, the joint and valve interfaces can produce varying amounts of reactor coolant LEAKAGE, through either normal operational wear or mechanical deterioration.
| |
| The purpose of the RCS Operational LEAKAGE LCO is to limit system operation in the presence of LEAKAGE from these sources to amounts that do not compromise safety. This LCO specifies the types and amounts of LEAKAGE.10 CFR 50, Appendix A, GDC 30 (Ref. 1), requires means for detecting and, to the extent practical, identifying the source of reactor coolant LEAKAGE. Regulatory Guide 1.45 (Ref. 2) describes acceptable methods for selecting leakage detection systems.The safety significance of RCS LEAKAGE varies widely depending on its source, rate, and duration.
| |
| Therefore, detecting and monitoring reactor coolant LEAKAGE into the containment area is necessary.
| |
| Quickly separating the identified LEAKAGE from the unidentified LEAKAGE is necessary to provide quantitative information to the operators, allowing them to take corrective action should a leak occur that is detrimental to the safety of the facility and the public.A limited amount of leakage inside containment is expected from auxiliary systems that cannot be made 100% leaktight.
| |
| Leakage from these systems should be detected, located, and isolated from the containment atmosphere, if possible, to not interfere with RCS leakage detection.
| |
| This LCO deals with protection of the reactor coolant pressure boundary (RCPB) from degradation and the core from inadequate cooling, in addition to preventing the accident analyses radiation release assumptions from being exceeded.
| |
| The consequences of violating this LCO include the possibility of a loss of coolant accident (LOCA).Per 10 CFR 50.2, RCPB means all those pressure-containing components of pressurized water-cooled nuclear power reactors, such as McGuire Units 1 and 2 B 3.4.13-1 Revision No. 115 RCS Operational LEAKAGE B 3.4.13 BASES BACKGROUND (Continued) pressure vessels, piping, pumps, and valves, which are: (1) Part of the reactor coolant system, or (2) Connected to the reactor coolant system, up to and including any and all of the following: (a) The outermost containment isolation valve in system piping which penetrates primary reactor containment, (b) The second of two valves normally closed during normal reactor operation in system piping which does not penetrate primary reactor containment, (c) The reactor coolant system safety and relief valves.APPLICABLE Except for primary to secondary LEAKAGE, the safety analyses do not SAFETY ANALYSES address operational LEAKAGE. However, other operational LEAKAGE is related to the safety analyses for LOCA; the amount of leakage can affect the probability of such an event. The safety analysis (Ref. 3) for an event resulting in steam discharge to the atmosphere assumes a 389 gpd primary to secondary leakage as the initial condition (limited to 135 gpd per SG). Any event in which the reactor coolant system will continue to leak water inventory to the secondary side, and in which there will be a postulated source term associated with the accident, utilizes this leakage value as an input in the analysis.
| |
| These accidents include the rod ejection accident, locked rotor accident, main steam line break, steam generator tube rupture and uncontrolled rod withdrawal accident.
| |
| The rod ejection accident, locked rotor accident and uncontrolled rod withdrawal accident yield a source term due to postulated fuel failure as a result of the accident.
| |
| The main steam line break and the steam generator tube rupture yield a source term due to perforations in fuel pins causing an iodine spike. Primary to secondary side leakage may escape the secondary side due to flashing or atomization of the coolant, or it may mix with the secondary side SG water inventory and be released due to steaming of the SGs. The rod ejection accident is limiting compared to the remainder of the accidents with respect to dose results. The dose results for each of the accidents delineated above are well within the 10 CFR 100 limits for the rod ejection accident, and below a small fraction of 10 CFR 100 limits for the remainder of the accidents.
| |
| The RCS operational LEAKAGE satisfies Criterion 2 of 10 CFR 50.36 (Ref. 4).LCO RCS operational LEAKAGE shall be limited to: a. Pressure Boundary LEAKAGE No pressure boundary LEAKAGE is allowed, being indicative of material deterioration.
| |
| LEAKAGE of this type is unacceptable as the leak itself could cause further deterioration, resulting in higher McGuire Units 1 and 2 B 3.4.13-2 Revision No. 115 RCS Operational LEAKAGE B 3.4.13 BASES LCO (continued) effective measure for minimizing the frequency of steam generator tube ruptures.APPLICABILITY In MODES 1, 2, 3, and 4, the potential for RCPB LEAKAGE is greatest when the RCS is pressurized.
| |
| In MODES 5 and 6, LEAKAGE limits are not required because the reactor coolant pressure is far lower, resulting in lower stresses and reduced potentials for LEAKAGE.LCO 3.4.14, "RCS Pressure Isolation Valve (PIV) Leakage," measures leakage through each individual PIV and can impact this LCO. Of the two PIVs in series in each isolated line, leakage measured through one PIV does not result in RCS LEAKAGE when the other is leak tight. If both valves leak and result in a loss of mass from the RCS, the loss must be included in the allowable unidentified LEAKAGE.ACTIONS A.1 Unidentified LEAKAGE or identified LEAKAGE in excess of the LCO limits must be reduced to within limits within 4 hours. This Completion Time allows time to verify leakage rates and either identify unidentified LEAKAGE or reduce LEAKAGE to within limits before the reactor must be shut down. This action is necessary to prevent further deterioration of the RCPB.B.1 and B.2 If any pressure boundary LEAKAGE exists, or primary to secondary LEAKAGE is not within limits, or if unidentified LEAKAGE, or identified LEAKAGE cannot be reduced to within limits within 4 hours, the reactor must be brought to lower pressure conditions to reduce the severity of the LEAKAGE and its potential consequences.
| |
| It should be noted that LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE.The reactor must be brought to MODE 3 within 6 hours and MODE 5 within 36 hours. This action reduces the LEAKAGE and also reduces the factors that tend to degrade the pressure boundary.The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.In MODE 5, the pressure stresses acting on the RCPB are much lower, and further deterioration is much less likely.McGuire Units 1 and 2 B 3.4.13-4 Revision No. 115 RCS Operational LEAKAGE B 3.4.13 BASES SURVEILLANCE SR 3.4.13.1 REQUIREMENTS Verifying RCS LEAKAGE to be within the LCO limits ensures the integrity of the RCPB is maintained.
| |
| Pressure boundary LEAKAGE would at first appear as unidentified LEAKAGE and can only be positively identified by inspection.
| |
| It should be noted that LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE. Unidentified LEAKAGE and identified LEAKAGE are determined by performance of an RCS water inventory balance.The RCS water inventory balance must be performed with the reactor at steady state operating conditions and near operating pressure.
| |
| The surveillance is modified by two Notes. Note 1 states that this SR is not required to be performed until 12 hours after establishment of steady state operation.
| |
| Steady state operation is required to perform a proper inventory balance;calculations during maneuvering are not useful and a Note requires the Surveillance to be met when steady state is established.
| |
| For RCS operational LEAKAGE determination by water inventory balance, steady state is defined as stable RCS pressure, temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection and return flows.An early warning of pressure boundary LEAKAGE or unidentified LEAKAGE is provided by the automatic systems that monitor the containment atmosphere radioactivity and the containment sump level. It should be noted that LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE. These leakage detection systems are specified in LCO 3.4.15, "RCS Leakage Detection Instrumentation." Note 2 states that this SR is not applicable to primary to secondary LEAKAGE because LEAKAGE of 135 gallons per day cannot be measured accurately by an RCS water inventory balance.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.4.13.2 This SR verifies that primary to secondary LEAKAGE is less than or equal to 135 gallons per day through any one SG and less than or equal to 389 gallons per day total through all SGs. Satisfying the primary to secondary LEAKAGE limit ensures that the assumptions of the safety analyses are McGuire Units 1 and 2 B 3.4.13-5 Revision No. 115 RCS Operational LEAKAGE B 3.4.13 BASES SURVEILLANCE (continued) met (Ref. 3). If this SR is not met, compliance with this LCO, as well as LCO 3.4.18, "Steam Generator Tube Integrity," should be evaluated.
| |
| The 135 and 389 gallons per day limits are measured at a temperature of 585°F as described in Ref. 3. The operational LEAKAGE rate limit applies to LEAKAGE through any one SG. If it is not practical to assign the LEAKAGE to an individual SG, all the primary to secondary LEAKAGE should be conservatively assumed to be from one SG.The Surveillance is modified by a Note which states that the Surveillance is not required to be performed until 12 hours after establishment of steady state operation.
| |
| For RCS primary to secondary LEAKAGE determination, steady state is defined as stable RCS pressure, temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection and return flows.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program. The primary to secondary LEAKAGE is determined using continuous process radiation monitors or radiochemical grab sampling in accordance with the EPRI guidelines (Ref. 8).REFERENCES
| |
| : 1. 10 CFR 50, Appendix A, GDC 30.2. Regulatory Guide 1.45, May 1973.3. UFSAR, Section 15.4. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| : 5. UFSAR, Table 18-1.6. McGuire License Renewal Commitments MCS-1274.00-00-0016, Section 4.29, RCS Operational Leakage Monitoring Program.7. NEI 97-06, "Steam Generator Program Guidelines".
| |
| : 8. EPRI, "Pressurized Water Reactor Primary-to-Secondary Leak Guidelines." 9. UFSAR, Table 15-24.McGuire Units 1 and 2 B 3.4. 13-6 Revision No. 115 RCS PIV Leakage B 3.4.14 B 3.4 REACTOR COOLANT SYSTEM (RCS)B 3.4.14 RCS Pressure Isolation Valve (PIV) Leakage BASES BACKGROUND 10 CFR 50.2, 10 CFR 50.55a(c), and GDC 55 of 10 CFR 50, Appendix A (Refs. 1, 2, and 3), define RCS PIVs as any two normally closed valves in series within the reactor coolant pressure boundary (RCPB), which separate the high pressure RCS from an attached low pressure system.During their lives, these valves can produce varying amounts of reactor coolant leakage through either normal operational wear or mechanical deterioration.
| |
| The RCS PIV Leakage LCO allows RCS high pressure operation when leakage through these valves exists in amounts that do not compromise safety.The PIV leakage limit applies to each individual valve. Leakage through two or more valves in series in a line will be measured during unit operation by the unidentified and total RCS LEAKAGE calculations, measured by a water inventory balance (SR 3.4.13.1).
| |
| Although this specification provides a limit on allowable PIV leakage rate, its main purpose is to prevent overpressure failure of the low pressure portions of connecting systems. The low pressure system interfaces (RHR and Safety Injection Systems) are provided with low capacity relief valves sufficient to relieve valve leakage considerably greater than allowed by this specification.
| |
| The leakage limit is an indication that the PIVs between the RCS and the connecting systems are degraded or degrading.
| |
| PIV leakage could lead to overpressure of the low pressure piping or components.
| |
| Failure consequences could be a loss of coolant accident (LOCA) outside of containment, an unanalyzed accident, that could degrade the ability for low pressure injection.
| |
| The basis for this LCO is the 1975 NRC "Reactor Safety Study" (Ref. 4)that identified potential intersystem LOCAs as a significant contributor to the risk of core melt. A subsequent study (Ref. 5) evaluated various PIV configurations to determine the probability of intersystem LOCAs.PIVs are provided to isolate the RCS from the following typically connected systems: a. Residual Heat Removal (RHR) System;b. Safety Injection System; and c. Chemical and Volume Control System.McGuire Units 1 and 2 B 3.4.14-1 Revision No. 115 RCS PIV Leakage B 3.4.14 BASES BACKGROUND (continued)
| |
| The PIVs are listed in the UFSAR, Table 5-50 (Ref. 6).Violation of this LCO could result in continued degradation of a PIV, which could lead to overpressurization of a low pressure system and the loss of the integrity of a fission product barrier.APPLICABLE SAFETY ANALYSES Reference 4 identified potential intersystem LOCAs as a significant contributor to the risk of core melt. The dominant accident sequence in the intersystem LOCA category is the failure of the low pressure portion of the RHR System outside of containment.
| |
| The accident is the result of a postulated failure of the PIVs, which are part of the RCPB, and the subsequent pressurization of the RHR System downstream of the PIVs from the RCS. Because the low pressure portion of the RHR System is designed for 600 psig, overpressurization failure of the RHR low pressure line would result in a LOCA outside containment and subsequent risk of core melt.Reference 5 evaluated various PIV configurations, leakage testing of the valves, and operational changes to determine the effect on the probability of intersystem LOCAs. This study concluded that periodic leakage testing of the PIVs can substantially reduce the probability of an intersystem LOCA.RCS PIV leakage satisfies Criterion 2 of 10 CFR 50.36 (Ref. 7).LCO RCS PIV leakage is unidentified LEAKAGE into closed systems connected to the RCS. Isolation valve leakage is usually on the order of drops per minute. Leakage that increases significantly suggests that something is operationally wrong and corrective action must be taken.The LCO PIV leakage limit is 0.5 gpm per nominal inch of valve size with a maximum limit of 5 gpm. The previous criterion of 1 gpm for all valve sizes imposed an unjustified penalty on the larger valves without providing information on potential valve degradation and resulted in higher personnel radiation exposures.
| |
| A study concluded a leakage rate limit based on valve size was superior to a single allowable value.Reference 8 permits leakage testing at a lower pressure differential than between the specified maximum RCS pressure and the normal pressure of the connected system during RCS operation (the maximum pressure differential) in those types of valves in which the higher service pressure McGuire Units 1 and 2 B 3.4.14-2 Revision No. 115 RCS PIV Leakage B 3.4.14 BASES LCO (continued) will tend to diminish the overall leakage channel opening. In such cases, the observed rate may be adjusted to the maximum pressure differential by assuming leakage is directly proportional to the pressure differential to the one half power.APPLICABILITY In MODES 1, 2, 3, and 4, this LCO applies because the PIV leakage potential is greatest when the RCS is pressurized.
| |
| In MODE 4, valves in the RHR flow path are not required to meet the requirements of this LCO when in, or during the transition to or from, the RHR mode of operation.
| |
| In MODES 5 and 6, leakage limits are not provided because the lower reactor coolant pressure results in a reduced potential for leakage and for a LOCA outside the containment.
| |
| ACTIONS The Actions are modified by two Notes. Note 1 provides clarification that each flow path allows separate entry into a Condition.
| |
| This is allowed based upon the functional independence of the flow path. Note 2 requires an evaluation of affected systems if a PIV is inoperable.
| |
| The leakage may have affected system operability, or isolation of a leaking flow path with an alternate valve may have degraded the ability of the interconnected system to perform its safety function.A.1 and A.2 The flow path must be isolated by two valves. Required Action A.1 is modified by a Note that the valves used for isolation must meet the same leakage requirements as the PIVs and must be within the RCPB or the high pressure portion of the system.Required Action A.1 requires that the isolation with one valve must be performed within 4 hours. Four hours provides time to reduce leakage in excess of the allowable limit and to isolate the affected system if leakage cannot be reduced. The 4 hour Completion Time allows the actions and restricts the operation with leaking isolation valves.Required Action A.2 specifies that the double isolation barrier of two valves be restored by restoring one leaking PIV. The 72 hour Completion Time after exceeding the limit allows for the restoration of the leaking PIV to OPERABLE status. This timeframe considers the time required to complete this Action and the low probability of a second valve failing during this period.McGuire Units 1 and 2 B 3.4.14-3 Revision No. 115 RCS PIV Leakage B 3.4.14 BASES ACTIONS (continued)
| |
| B.1 and B.2 If leakage cannot be reduced, or the other Required Actions accomplished, the plant must be brought to a MODE in which the requirement does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours and MODE 5 within 36 hours. This Action may reduce the leakage and also reduces the potential for a LOCA outside the containment.
| |
| The allowed Completion Times are reasonable based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.C.1 The RHR interlock prevents the RHR suction isolation valves inadvertent opening at RCS pressures in excess of the RHR systems design pressure.
| |
| If the RHR interlock is inoperable, operation may continue as long as the affected RHR suction penetration is closed by at least one closed manual or deactivated automatic valve within 4 hours. This Action accomplishes the purpose of the interlock function.SURVEILLANCE SR 3.4.14.1 REQUIREMENTS Performance of leakage testing on each RCS PIV or isolation valve used to satisfy Required Action A.1 is required to verify that leakage is below the specified limit and to identify each leaking valve. The leakage limit of 0.5 gpm per inch of nominal valve diameter up to 5 gpm maximum applies to each valve. Leakage testing requires a stable pressure condition.
| |
| For the two PIVs in series, the leakage requirement applies to each valve individually and not to the combined leakage across both valves. If the PIVs are not individually leakage tested, one valve may have failed completely and not be detected if the other valve in series meets the leakage requirement.
| |
| In this situation, the protection provided by redundant valves would be lost.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Units 1 and 2 B 3.4.14-4 Revision No. 115 RCS PIV Leakage B 3.4.14 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| In addition, testing must be performed once after the valve has been opened by flow or exercised to ensure tight reseating.
| |
| PIVs disturbed in the performance of this Surveillance should also be tested unless documentation shows that an infinite testing loop cannot practically be avoided. Testing must be performed within 24 hours after the valve has been reseated.
| |
| Within 24 hours is a reasonable and practical time limit for performing this test after opening or reseating a valve.The leakage limit is to be met at the RCS pressure associated with MODES 1 and 2. This permits leakage testing at high differential pressures with stable conditions not possible in the MODES with lower pressures.
| |
| Entry into MODES 3 and 4 is allowed to establish the necessary differential pressures and stable conditions to allow for performance of this Surveillance.
| |
| The Note that allows this provision is complementary to the Frequency of prior to entry into MODE 2 whenever the unit has been in MODE 5 for 7 days or more, if leakage testing has not been performed in the previous 9 months. In addition, this Surveillance is not required to be performed on the RHR System when the RHR System is aligned to the RCS in the shutdown cooling mode of operation.
| |
| PIVs contained in the RHR shutdown cooling flow path must be leakage rate tested after RHR is secured and stable unit conditions and the necessary differential pressures are established.
| |
| SR 3.4.14.2 Verifying that the RHR interlock is OPERABLE ensures that RCS pressure will not pressurize the RHR system beyond its design pressure of 600 psig. The interlock setpoint that prevents the valves from being opened is set so the actual RCS pressure must be < 425 psig to open the valves. This setpoint ensures the RHR design pressure will not be exceeded and the RHR relief valves will not lift. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Units 1 and 2 B 3.4.14-5 Revision No. 115 RCS PIV Leakage B 3.4.14 BASES REFERENCES
| |
| : 1. 10 CFR 50.2.2. 10 CFR 50.55a(c).
| |
| : 3. 10 CFR 50, Appendix A, Section V, GDC 55.4. WASH-1400 (NUREG-75/014), Appendix V, October 1975.5. NUREG-0677, May 1980.6. UFSAR Table 5-50.7. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| : 8. ASME Code for Operation and Maintenance of Nuclear Power Plants.9. 10 CFR 50.55a(g).
| |
| McGuire Units 1 and 2 B 3.4.14-6 Revision No. 115 RCS Leakage Detection Instrumentation B 3.4.15 B 3.4 REACTOR COOLANT SYSTEM (RCS)B 3.4.15 RCS Leakage Detection Instrumentation BASES BACKGROUND GDC 30 of Appendix A to 10 CFR 50 (Ref. 1) requires means for detecting and, to the extent practical, identifying the location of the source of RCS LEAKAGE. Regulatory Guide 1.45 (Ref. 2) describes acceptable methods for selecting leakage detection systems.Leakage detection systems must have the capability to detect significant reactor coolant pressure boundary (RCPB) degradation as soon after occurrence as practical to minimize the potential for propagation to a gross failure. Thus, an early indication or warning signal is necessary to permit proper evaluation of all unidentified LEAKAGE.One method of detecting leakage into the containment is the level instrumentation in containment floor and equipment (CFAE) sump A and CFAE sump B (Refs 3 and 7) and in the incore instrument sump (Ref 3).The CFAE sumps are small sumps located on opposite sides of the containment and outside of the crane wall. Any leakage in the lower containment inside the crane wall that falls to the floor will drain through crane wall penetrations at floor level to one of the two sumps. Any leakage outside the crane wall would fall to the floor and gravity drain to these sumps. The sump level rate of change, as calculated by the plant computer, would indicate the input rate. This method of detection would indicate in the Control Room a leak from any liquid system including the Reactor Coolant System and the Main Steam and Feedwater Systems.As leakage may go to either or both of the two CFAE sumps, a 1 gpm sump input (cumulative between sumps A and B) is detectable in 1 hour after leakage has reached the sumps (Ref 8). During periods of pump-down of the CFAE sumps, the CFAE level instrumentation remains operable since operating experience has shown that this process typically takes only minutes to complete.
| |
| The incore instrument sump level alarm offers another means of detecting leakage into the containment (Ref 3).The incore instrument sump level instrumentation provides a control room alarm and an alarm on the plant computer when the sump level increases to the Hi level. The incore instrument sump level instrumentation is capable of detecting 1 gpm input within four hours after leakage has reached the sump (Ref 8).McGuire Units 1 and 2 B 3.4-15-1 Revision No. 115 RCS Leakage Detection Instrumentation B 3.4.15 BASES BACKGROUND (continued)
| |
| The environmental conditions during plant power operations and the physical configuration of lower containment will delay the total reactor coolant system leakage (including steam) from directly entering the CFAE sump and subsequently, will lengthen the sump's level response time.Therefore, leakage detection by the CFAE sump will typically occur following other means of leakage detection.
| |
| Operating experience with high enthalpy primary and secondary water leaks indicates that flashing of high temperature liquid produces steam and hot water mist that is readily absorbed in the containment air. Much of the hot water that initially reaches the containment floor will evaporate in a low relative humidity environment as it migrates towards a sump. Local low points along the containment floor provide areas for water to form shallow pools that increase transport time to one or more building sumps. The net effect is that only a fraction of any high enthalpy water leakage will eventually collect in a sump and early leak detection may rely on alternate methods.The containment ventilation unit condensate drain tank (CVUCDT) level monitor offers another means of detecting leakage into the containment.
| |
| An abnormal level increase would indicate removal of moisture from the containment by the containment air coolers. The plant computer calculates the rate of change in level to detect a tank input of 1 gpm after condensate has reached the tank.The reactor coolant contains radioactivity that, when released to the containment, can be detected by radiation monitoring instrumentation.
| |
| U.S. NRC Regulatory Guide (RG) 1.45, "Reactor Coolant Pressure Boundary Leakage Detection Systems," (Ref. 2), describes acceptable methods of implementing the requirements for leakage detection systems. Although RG 1.45 is not a license condition, it is generally accepted for use to support licensing basis. RG 1.45 states that instrument sensitivities of 10-9 pCi/cc radioactivity for air particulate monitoring are practical for leakage detection systems. The containment atmosphere particulate radioactivity monitor at McGuire meets or exceeds this accepted sensitivity.
| |
| RG 1.45 also states that detector systems should be able to respond to a one gpm leak, or its equivalent, in one hour or less. The containment atmosphere particulate radioactivity monitor at McGuire has demonstrated capabilities of detecting a 1.0 gpm leak within one hour at the sensitivity recommended in Regulatory Guide 1.45 using the RCS corrosion product activities from the UFSAR. Lower RCS activities will result in an increased detection time. Since the containment atmosphere particulate radioactivity monitor meets the specified 10.9 pCi/cc sensitivity, they are designed in accordance with RG 1.45.McGuire Units 1 and 2 S3.4-15-2 Revision No. 115 RCS Leakage Detection Instrumentation B 3.4.15 BASES BACKGROUND (continued)
| |
| The containment atmosphere particulate radioactivity monitor collects airborne particulate activity on a fixed filter monitored by a gross beta detector.
| |
| The collected activity is referred to as background and is displayed as gross counts per minute (CPM). Background is a combination of collected beta activity from various sources that may include natural decay products, airborne contamination and any small RCS leakage. To detect changes in the containment airborne activity, the containment atmosphere particulate radioactivity monitor utilizes a differential algorithm that calculates an increasing accumulation of containment particulate activity.
| |
| The control room readout module displays this increasing accumulation rate as counts per minute accumulating each minute (CMM). The alarm for leakage detection is based upon this positive accumulation rate above background activity on the fixed filter.The actual alarm setpoints are set as low as practicable, considering the actual concentration of radioactivity in the RCS and the containment background radiation concentration.
| |
| As low as practicable alarm setpoint is a balance between sufficiently high enough above typical background radiation variations to preclude spurious alarms while sufficiently low enough to assure reasonable sensitivity for early detection of an RCS leak. The alarm setpoint is based upon detected increasing accumulate rate of containment particulate activity above background.
| |
| Variations in background of containment radiation do occur, and the containment atmosphere particulate radioactivity monitor compensates for these changes once the background radiation reaches equilibrium.
| |
| At the background threshold of collected containment particulate activity that affects detector operability, a failure alarm is actuated for high background on the detector.
| |
| The alarm setpoint (for detector operability) will be less than or equal to the projected containment activity accumulation rate following a one gpm leak.The particulate radioactivity monitor obtains its sample from three possible locations:
| |
| incore area, lower containment, and upper containment, which are selectable from the control room. For the purpose of RCS leakage detection, a sample from the lower containment region is required, because the RCS is physically located within the lower containment region. The incore area and lower containment samples are both obtained from the lower containment region.The operability of the containment atmosphere particulate radioactivity monitor is based upon an instrument sensitivity
| |
| > 10-9 pCi/cc, a Channel Check performed at a frequency of every 12 hours, a Channel Operational Test performed at a frequency of every 92 days, and a Channel Calibration performed at a frequency of every 18 months.McGuire Units 1 and 2 B 3.4.15-3 Revision No. 115 RCS Leakage Detection Instrumentation B 3.4.15 BASES BACKGROUND (continued)
| |
| An increase in humidity of the containment atmosphere would indicate release of water vapor to the containment.
| |
| Dew point temperature measurements can thus be used to monitor humidity levels of the containment atmosphere as an indicator of potential RCS LEAKAGE. A 1 OF increase in dew point is well within the sensitivity range of available instruments.
| |
| Since the humidity level is influenced by several factors, a quantitative evaluation of an indicated leakage rate by this means may be questionable and should be compared to observed increases in liquid level into the CFAE sumps and condensate level from the air coolers.Humidity level monitoring is considered most useful as an indirect alarm or indication to alert the operator to a potential problem. Humidity monitors are not required by this LCO.Air temperature and pressure monitoring methods may also be used to infer unidentified LEAKAGE to the containment.
| |
| Containment temperature and pressure fluctuate slightly during plant operation, but a rise above the normally indicated range of values may indicate RCS leakage into the containment.
| |
| The relevance of temperature and pressure measurements are affected by containment free volume and, for temperature, detector location.
| |
| Alarm signals from these instruments can be valuable in recognizing rapid and sizable leakage to the containment.
| |
| Temperature and pressure monitors are not required by this LCO.The volume control tank (VCT) level change offers another means of detecting leakage into containment (Ref 3). This enhances the diversity of the leakage detection function as recommended in RG 1.45. The VCT level instrumentation is not required by, nor can be credited for, this LCO.Once any alarm or indication of leakage is received from the RCS leakage detection instrumentation, control room operators quickly evaluate all available system parameters to assess RCS pressure boundary integrity.
| |
| These include VCT and pressurizer level indications and, if appropriate, the RCS mass balance calculation.
| |
| Response to RCS leakage is addressed by LCO 3.4.13, "RCS Operational LEAKAGE." APPLICABLE The need to evaluate the severity of an alarm or an indication is important SAFETY ANALYSES to the operators, and the ability to compare and verify with indications from other systems is necessary.
| |
| The system response times and sensitivities are described in the UFSAR (Refs. 3 and 8). Multiple instrument locations are utilized, if needed, to ensure that the transport delay time of the leakage from its source to an instrument location yields an acceptable overall response time.The safety significance of RCS LEAKAGE varies widely depending on its source, rate, and duration.
| |
| Therefore, detecting and monitoring RCS LEAKAGE into the containment area is necessary.
| |
| Quickly separating the McGuire Units 1 and 2 B 3.4.15-4 Revision No. 115 RCS Leakage Detection Instrumentation B 3.4.15 BASES APPLICABLE SAFETY ANALYSES (continued) identified LEAKAGE from the unidentified LEAKAGE provides quantitative information to the operators, allowing them to take corrective action should a leakage occur detrimental to the safety of the unit and the public.RCS leakage detection instrumentation satisfies Criterion 1 of 10 CFR 50.36 (Ref. 4).LCO One method of protecting against large RCS leakage derives from the ability of instruments to rapidly detect extremely small leaks. This LCO requires instruments of diverse monitoring principles to be OPERABLE to provide a high degree of confidence that extremely small leaks are detected in time to allow actions to place the plant in a safe condition, when RCS LEAKAGE indicates possible RCPB degradation.
| |
| The LCO is satisfied when monitors of diverse measurement means are available.
| |
| Thus, the CFAE sump level monitors and the incore instrument sump level alarm, the containment atmosphere particulate radioactivity monitor, and the CVUCDT level monitor provide an acceptable minimum.APPLICABILITY Because of elevated RCS temperature and pressure in MODES 1, 2, 3, and 4, RCS leakage detection instrumentation is required to be OPERABLE.Since RCS radioactivity level is significantly lower in MODES 2, 3, and 4, the containment atmosphere particulate radioactivity monitor is not a reliable means of detecting RCS leakage in these MODES. Thus the LCO applies to this monitor in MODE 1 only and leakage detection capability in MODES 2, 3, and 4 is accomplished by the diverse means provided by the CFAE sump level monitors, the incore instrument sump level alarm, and the CVUCDT level monitor.In MODE 5 or 6, the temperature is to be < 200°F and pressure is maintained low or at atmospheric pressure.
| |
| Since the temperatures and pressures are far lower than those for MODES 1, 2, 3, and 4, the likelihood of leakage and crack propagation are much smaller. Therefore, the requirements of this LCO are not applicable in MODES 5 and 6.ACTIONS A note has been added to the ACTIONS to clarify the application of Completion Time rules. Separate Condition entry is allowed for each instrument.
| |
| The Completion Time of the inoperable instrument will be tracked separately for each instrument starting from the time the Condition was entered for that instrument.
| |
| McGuire Units 1 and 2 B 3.4.15-5 Revision No. 115 RCS Leakage Detection Instrumentation B 3.4.15 BASES ACTIONS (continued)
| |
| A.1 and A.2 With the containment floor and equipment sump level monitors inoperable, no other form of sampling can provide the equivalent information; however, the containment atmosphere particulate radioactivity monitor will provide indications of changes in leakage.Together with the atmosphere monitor, the periodic surveillance for RCS water inventory balance, SR 3.4.13.1, must be performed at an increased frequency of 24 hours to provide information that is adequate to detect leakage.Required Action A.1 is modified by a Note that states the RCS water inventory balance is not required to be performed until 12 hours after establishment of steady state operation in accordance with SR 3.4.13.1.This Note allows exceeding the 24-hour completion time during non-steady state operation.
| |
| Restoration of the containment floor and equipment sump level monitor to OPERABLE status within a Completion Time of 30 days is required to regain the function after the monitor's failure. This time is acceptable, considering the Frequency and adequacy of the RCS water inventory balance required by Required Action A.1.B.1 and B.2 With the containment atmosphere particulate radioactivity monitor inoperable, alternative action is required.
| |
| Either water inventory balances, in accordance with SR 3.4.13.1 must be performed, or grab samples of the containment atmosphere must be taken and analyzed, to provide alternate periodic information.
| |
| Required Action B.1 is modified by a Note that states the RCS water inventory balance is not required to be performed until 12 hours after establishment of steady state operation in accordance with SR 3.4.13.1.This Note allows exceeding the 24-hour completion time during non-steady state operation.
| |
| With a water inventory balance performed or grab samples obtained and analyzed every 24 hours, continued operation is allowed since diverse indications of RCS LEAKAGE remain OPERABLE.
| |
| The 24 hour interval provides periodic information that is adequate to detect leakage.C.1, C.2, and C. 3 With the CVUCDT level monitor inoperable, alternative action is again required.
| |
| Either a water inventory balance, in accordance with SR 3.4.13.1; or grab samples obtained and analyzed at a frequency of 24 McGuire Units 1 and 2 B 3.4.15-6 Revision No. 115 RCS Leakage Detection Instrumentation B 3.4.15 BASES ACTIONS (continued) hours; or SR 3.4.15.1, CHANNEL CHECK, of the containment atmosphere particulate radioactivity monitor at 8-hour intervals, must be performed to provide alternate periodic information.
| |
| Required Action C. 1.1 is modified by a Note that states the RCS water inventory balance is not required to be performed until 12 hours after establishment of steady state operation in accordance with SR 3.4.13.1.
| |
| This Note allows exceeding the 24-hour completion time during non-steady state operation.
| |
| Provided a water inventory balance is performed every 24 hours; or grab samples taken and analyzed every 24 hours; or a CHANNEL CHECK of the containment atmosphere particulate radioactivity monitor is performed every 8 hours, reactor operation may continue while awaiting restoration of the CVUCDT level monitor to OPERABLE status. The 24 and 8 hour intervals provide periodic information that is adequate to detect RCS LEAKAGE.During Modes 2, 3, and 4, restoration of the CVUCDT level monitor to OPERABLE status within a Completion Time of 30 days is required to regain the function after the monitor's failure. This time is acceptable, considering the Frequency and adequacy of the alternative actions required by Actions C. 1.1, C. 1.2, or C. 1.3.During Modes 2, 3, and 4, the two required leakage detection instrumentation systems are the CVUCDT level monitor and the CFAE sump level monitors.
| |
| When the CVUCDT level monitor is inoperable, a plant shutdown after 30 days will ensure the plant will not operate with less than two leakage detection systems operable for an extended period of time. During Mode 1, the addition of the third leakage monitoring system from the containment atmosphere particulate radioactivity monitor provides additional leakage detection capability and no longer requires plant shutdown except as described in Condition D.D.1 and D.2 With the containment atmosphere particulate radioactivity monitor inoperable in MODE 1 and the containment ventilation unit condensate drain tank level monitor inoperable in MODE 1, the only means of detecting leakage is the containment floor and equipment sump level monitor and the incore sump level alarm. This Condition does not provide the required diverse means of leakage detection.
| |
| The Required Action is to restore either of the inoperable monitors to OPERABLE status within 30 days to regain the intended leakage detection diversity.
| |
| The 30 day Completion Time ensures that the plant will not be operated in a reduced configuration for a lengthy time period.McGuire Units 1 and 2 B 3.4.15-7 Revision No. 115 RCS Leakage Detection Instrumentation B 3.4.15 BASES ACTIONS (continued)
| |
| E.1.With the incore sump level alarm inoperable, a water inventory balance, in accordance with SR 3.4.13.1, must be performed at an increased frequency of 24 hours to provide alternate periodic information that is adequate to detect leakage. Required Action E.1 is modified by a Note that states the RCS water inventory balance is not required to be performed until 12 hours after establishment of steady state operation in accordance with SR 3.4.13.1.
| |
| This Note allows exceeding the 24-hour completion time during non-steady state operation.
| |
| F.1 and F.2 If a Required Action of Condition A, B, C, or D cannot be met, the plant must be brought to a MODE in which the requirement does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.G.1 With all required monitors inoperable, no automatic means of monitoring leakage are available, and immediate plant shutdown in accordance with LCO 3.0.3 is required.
| |
| The required monitors during MODE 1 for LCO 3.0.3 entry are defined as the simultaneous inoperability of one CFAE level monitor, the containment atmosphere particulate radioactivity monitor, and the CVUCDT level monitor. The required monitors during MODES 2, 3, and 4 for LCO 3.0.3 entry are defined as the simultaneous inoperability of one CFAE level monitor and the CVUCDT level monitor.This Condition does not apply to the incore instrument sump level alarm.SURVEILLANCE REQUIREMENTS SR 3.4.15.1 SR 3.4.15.1 requires the performance of a CHANNEL CHECK of the containment atmosphere particulate radioactivity monitor. The check gives reasonable confidence that the channel is operating properly.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Units 1 and 2 B 3.4.15-8 Revision No. 115 RCS Leakage Detection Instrumentation B 3.4.15 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.4.15.2 SR 3.4.15.2 requires the performance of a COT on the containment atmosphere particulate radioactivity monitor. The test ensures that the monitor can perform its function in the desired manner. The test verifies the alarm setpoint and relative accuracy of the instrument string. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.4.15.3, SR 3.4.15.4.
| |
| SR 3.4.15.5, and SR 3. 4.15.6 These SRs require the performance of a CHANNEL CALIBRATION for each of the RCS leakage detection instrumentation channels.
| |
| The calibration verifies the accuracy of the instrument string, including the instruments located inside containment.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. 10 CFR 50, Appendix A, Section IV, GDC 30.2. Regulatory Guide 1.45.3. UFSAR, Section 5.2.7.4. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| : 5. UFSAR, Table 18-1.6. McGuire License Renewal Commitments MCS-1274.00-00-0016, Section 4.29, RCS Operational Leakage Monitoring Program.7. McGuire Safety Evaluation Report, Section 5.2.5.8. UFSAR, Table 5-30.McGuire Units 1 and 2 B 3.4.15-9 Revision No. 115 RCS Specific Activity B 3.4.16 B 3.4 REACTOR COOLANT SYSTEM (RCS)B 3.4.16 RCS Specific Activity BASES BACKGROUND The maximum dose to the whole body and the thyroid that an individual at the site boundary can receive for 2 hours during an accident is specified in 10 CFR 100 (Ref. 1). The limits on specific activity ensure that the doses are held to a small fraction of the 10 CFR 100 limits during analyzed transients and accidents.
| |
| The RCS specific activity LCO limits the allowable concentration level of radionuclides in the reactor coolant. The LCO limits are established to minimize the offsite radioactivity dose consequences in the event of a steam generator tube rupture (SGTR) accident.The LCO contains specific activity limits for both DOSE EQUIVALENT 1-131 and gross specific activity.
| |
| The allowable levels are intended to limit the 2 hour dose at the site boundary to a small fraction of the 10 CFR 100 dose guideline limits. The limits in the LCO are standardized, based on parametric evaluations of offsite radioactivity dose consequences for typical site locations.
| |
| The parametric evaluations showed the potential offsite dose levels for a SGTR accident were an appropriately small fraction of the 10 CFR 100 dose guideline limits. Each evaluation assumes a broad range of site applicable atmospheric dispersion factors in a parametric evaluation.
| |
| APPLICABLE SAFETY ANALYSES The LCO limits on the specific activity of the reactor coolant ensures that the resulting 2 hour doses at the site boundary will not exceed a small fraction of the 10 CFR 100 dose guideline limits following a SGTR accident.
| |
| The SGTR safety analysis (Ref. 2) assumes the specific activity of the reactor coolant at the LCO limit and an existing reactor coolant steam generator (SG) tube leakage rate of 389 gpd. The safety analysis assumes the specific activity of the secondary coolant at its limit of 0.1 pCi/gm DOSE EQUIVALENT 1-131 from LCO 3.7.16, "Secondary Specific Activity." The analysis for the SGTR accident establishes the acceptance limits for RCS specific activity.
| |
| Reference to this analysis is used to assess changes to the unit that could affect RCS specific activity, as they relate to the acceptance limits.McGuire Units 1 and 2 B 3.4.16-1 Revision No. 115 RCS Specific Activity B 3.4.16 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| The analysis is for two cases of reactor coolant specific activity.One case assumes specific activity at 1.0 pCi/gm DOSE EQUIVALENT 1-131 with a concurrent large iodine spike that increases the 1-131 activity in the reactor coolant by a factor of about 50 immediately after the accident.
| |
| The second case assumes the initial reactor coolant iodine activity at 60.0 pCi/gm DOSE EQUIVALENT 1-131 due to a pre-accident iodine spike caused by an RCS transient.
| |
| In both cases, the noble gas activity in the reactor coolant assumes 1% failed fuel, which closely equals the LCO limit of 100/E pCi/gm for gross specific activity.The analysis also assumes a loss of offsite power at the same time as the SGTR event. The SGTR causes a reduction in reactor coolant inventory.
| |
| The reduction initiates a reactor trip from a low pressurizer pressure signal or an RCS overtemperature AT signal if the leakage continues for a long enough time, although a manual trip is also credited after a conservatively long delay.The coincident loss of offsite power causes the steam dump valves to close to protect the condenser.
| |
| The rise in pressure in the ruptured SG discharges radioactively contaminated steam to the atmosphere through the SG power operated relief valves and the main steam safety valves. The unaffected SGs remove core decay heat by venting steam to the atmosphere until the cooldown ends.The safety analysis shows the radiological consequences of an SGTR accident are within a small fraction of the Reference I dose guideline limits. Operation with iodine specific activity levels greater than the LCO limit is permissible, if the activity levels do not exceed the limits shown in Figure 3.4.16-1, in the applicable specification, for more than 48 hours. The safety analysis has concurrent and pre-accident iodine spiking levels up to 60.0 pCi/gm DOSE EQUIVALENT 1-131.The remainder of the above limit permissible iodine levels shown in Figure 3.4.16-1 are acceptable because of the low probability of a SGTR accident occurring during the established 48 hour time limit. The occurrence of an SGTR accident at these permissible levels could increase the site boundary dose levels, but still be within 10 CFR 100 dose guideline limits.The limits on RCS specific activity are also used for establishing standardization in radiation shielding and plant personnel radiation protection practices.
| |
| RCS specific activity satisfies Criterion 2 of 10 CFR 50.36 (Ref. 3).McGuire Units 1 and 2 B 3.4.16-2 Revision No. 115 RCS Specific Activity B 3.4.16 BASES LCO The specific iodine activity is limited to 1.0 pCi/gm DOSE EQUIVALENT 1-131, and the gross specific activity in the reactor coolant is limited to the number of pCi/gm equal to 100 divided by E (average disintegration energy of the sum of the average beta and gamma energies of the coolant nuclides).
| |
| The limit on DOSE EQUIVALENT 1-131 ensures the 2 hour thyroid dose to an individual at the site boundary during the Design Basis Accident (DBA) will be a small fraction of the allowed thyroid dose. The limit on gross specific activity ensures the 2 hour whole body dose to an individual at the site boundary during the DBA will be a small fraction of the allowed whole body dose.The SGTR accident analysis (Ref. 2) shows that the 2 hour site boundary dose levels are within acceptable limits. Violation of the LCO may result in reactor coolant radioactivity levels that could, in the event of an SGTR, lead to site boundary doses that exceed the 10 CFR 100 dose guideline limits.APPLICABILITY In MODES 1 and 2, and in MODE 3 with RCS average temperature
| |
| > 500 0 F, operation within the LCO limits for DOSE EQUIVALENT 1-131 and gross specific activity are necessary to contain the potential consequences of an SGTR to within the acceptable site boundary dose values.For operation in MODE 3 with RCS average temperature
| |
| < 500 0 F, and in MODES 4 and 5, the release of radioactivity in the event of a SGTR is unlikely since the saturation pressure of the reactor coolant is below the lift pressure settings of the main steam safety valves.ACTIONS A.1 and A.2 With the DOSE EQUIVALENT 1-131 greater than the LCO limit, samples at intervals of 4 hours must be taken to demonstrate that the limits of Figure 3.4.16-1 are not exceeded.
| |
| The Completion Time of 4 hours is required to obtain and analyze a sample.Sampling is done to continue to provide a trend.The DOSE EQUIVALENT 1-131 must be restored to within limits within 48 hours. The Completion Time of 48 hours is required, if the limit violation resulted from normal iodine spiking.A Note permits the use of the provisions of LCO 3.0.4.c. This allowance permits entry into the applicable MODE(S) while relying on the ACTIONS.McGuire Units 1 and 2 B 3.4.16-3 Revision No. 115 RCS Specific Activity B 3.4.16 BASES ACTIONS (continued)
| |
| B. 1 With the gross specific activity in excess of the allowed limit, the unit must be placed in a MODE in which the requirement does not apply.The change within 6 hours to MODE 3 and RCS average temperature
| |
| < 500OF lowers the saturation pressure of the reactor coolant below the setpoints of the main steam safety valves and prevents venting the SG to the environment in an SGTR event.The allowed Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 3 below 500OF from full power conditions in an orderly manner and without challenging plant systems.C._1 If a Required Action and the associated Completion Time of Condition A is not met or if the DOSE EQUIVALENT 1-131 is in the unacceptable region of Figure 3.4.16-1, the reactor must be brought to MODE 3 with RCS average temperature
| |
| < 500OF within 6 hours. The Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 3 below 500OF from full power conditions in an orderly manner and without challenging plant systems.SURVEILLANCE SR 3.4.16.1 REQUIREMENTS SR 3.4.16.1 requires performing a gamma isotopic analysis as a measure of the gross specific activity of the reactor coolant. A gross radioactivity analysis shall consist of the quantitative measurement of the total specific activity of the reactor coolant except for radionuclides with half-lives less than 10 minutes and all radioiodines.
| |
| The total specific activity shall be the sum of the beta-gamma activity in the sample within 2 hours after the sample is taken and extrapolated back to when the sample was taken.Determination of the contributors to the gross specific activity shall be based upon those energy peaks identifiable with a 95%confidence level. The latest available data may be used for pure beta-emitting radionuclides.
| |
| This Surveillance provides an indication of any increase in gross specific activity.McGuire Units 1 and 2 B 3.4.16-4 Revision No. 115 RCS Specific Activity B 3.4.16 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| Trending the results of this Surveillance allows proper remedial action to be taken before reaching the LCO limit under normal operating conditions.
| |
| The Surveillance is applicable in MODES 1 and 2, and in MODE 3 with Tavg at least 5001F. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.4.16.2 This Surveillance is performed in MODE 1 only to ensure iodine remains within limit during normal operation and following fast power changes when fuel failure is more apt to occur. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program. The Frequency, between 2 and 6 hours after a power change _> 15% RTP within a 1 hour period, is established because the iodine levels peak during this time following fuel failure; samples at other times would provide inaccurate results.SR 3.4.16.3 A radiochemical analysis for E determination is required with the plant operating in MODE 1 equilibrium conditions.
| |
| The E determination directly relates to the LCO and is required to verify plant operation within the specified gross activity LCO limit. The analysis for E is a measurement of the average energies per disintegration for isotopes with half lives longer than 10 minutes, excluding iodines. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.This SR has been modified by a Note that indicates sampling is required to be performed within 31 days after a minimum of 2 effective full power days and 20 days of MODE 1 operation have elapsed since the reactor was last subcritical for at least 48 hours.This ensures that the radioactive materials are at equilibrium so the analysis for E is representative and not skewed by a crud burst or other similar abnormal event.McGuire Units 1 and 2 B 3.4.16-5 Revision No. 115 RCS Specific Activity B 3.4.16 BASES REFERENCES 1.2.3.10 CFR 100.11, 1973.UFSAR, Section 15.6.3.10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.4.16-6 Revision No. 115 RCS Loops-Test Exceptions B 3.4.17 B 3.4 REACTOR COOLANT SYSTEM (RCS)B 3.4.17 RCS Loops-Test Exceptions BASES BACKGROUND The primary purpose of this test exception is to provide an exception to LCO 3.4.4, "RCS Loops-MODES 1 and 2," to permit reactor criticality under no flow conditions during certain PHYSICS TESTS (natural circulation demonstration, station blackout, and loss of offsite power) to be performed while at low THERMAL POWER levels. Section XI of 10 CFR 50, Appendix B (Ref. 1), requires that a test program be established to ensure that structures, systems, and components will perform satisfactorily in service. All functions necessary to ensure that the specified design conditions are not exceeded during normal operation and anticipated operational occurrences must be tested. This testing is an integral part of the design, construction, and operation of the power plant as specified in GDC 1, "Quality Standards and Records" (Ref. 2).The key objectives of a test program are to provide assurance that the facility has been adequately designed to validate the analytical models used in the design and analysis, to verify the assumptions used to predict plant response, to provide assurance that installation of equipment at the unit has been accomplished in accordance with the design, and to verify that the operating and emergency procedures are adequate.
| |
| Testing is performed prior to initial criticality, during startup, and following low power operations.
| |
| The tests will include verifying the ability to establish and maintain natural circulation following a plant trip between 10% and 20% RTP, performing natural circulation cooldown on emergency power, and during the cooldown, showing that adequate boron mixture occurs and that pressure can be controlled using auxiliary spray and pressurizer heaters powered from the emergency power sources.APPLICABLE SAFETY ANALYSES The tests described above require operating the plant without forced convection flow and as such are not bounded by any safety analyses.However, operating experience has demonstrated this exception to be safe under the present applicability.
| |
| RCS Loops-Test Exceptions satisfy Criterion 3 of 10 CFR 50.36 (Ref.3).McGuire Units 1 and 2 B 3.4.17-1 Revision No. 115 RCS Loops -Test Exceptions B 3.4.17 BASES LCO This LCO provides an exemption to the requirements of LCO 3.4.4.The LCO is provided to allow for the performance of PHYSICS TESTS in MODE 2 (after a refueling), where the core cooling requirements are significantly different than after the core has been operating.
| |
| Without the LCO, plant operations would be held bound to the normal operating LCOs for reactor coolant loops and circulation (MODES 1 and 2), and the appropriate tests could not be performed.
| |
| In MODE 2, where core power level is considerably lower and the associated PHYSICS TESTS must be performed, operation is allowed under no flow conditions provided THERMAL POWER is < P-7 and the reactor trip setpoints of the OPERABLE power level channels are set< 25% RTP. This ensures, if some problem caused the plant to enter MODE 1 and start increasing plant power, the Reactor Trip System (RTS)would automatically shut it down before power became too high, and thereby prevent violation of fuel design limits.The exemption is allowed even though there are no bounding safety analyses.
| |
| However, these tests are performed under close supervision during the test program and provide valuable information on the plant's capability to cool down without offsite power available to the reactor coolant pumps.APPLICABILITY This LCO is applicable when performing low power PHYSICS TESTS without any forced convection flow. This testing is performed to establish that heat input from nuclear heat does not exceed the natural circulation heat removal capabilities.
| |
| Therefore, no safety or fuel design limits will be violated as a result of the associated tests.ACTIONS A.1 When THERMAL POWER is >_ the P-7 interlock setpoint 10%, the only acceptable action is to ensure the reactor trip breakers (RTBs) are opened immediately in accordance with Required Action A. 1 to prevent operation of the fuel beyond its design limits. Opening the RTBs will shut down the reactor and prevent operation of the fuel outside of its design limits.McGuire Units 1 and 2 B 3.4.17-2 Revision No. 115 RCS Loops -Test Exceptions B 3.4.17 BASES SURVEILLANCE SR 3.4.17.1 REQUIREMENTS Verification that the power level is < the P-7 interlock setpoint (10%) will ensure that the fuel design criteria are not violated during the performance of the PHYSICS TESTS. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.4.17.2 The power range and intermediate range neutron detectors and the P-7 interlock setpoint must be verified to be OPERABLE and adjusted to the proper value. A COT is performed prior to initiation of the PHYSICS TESTS. This will ensure that the RTS is properly aligned to provide the required degree of core protection during the performance of the PHYSICS TESTS.REFERENCES
| |
| : 1. 10 CFR 50, Appendix B, Section XI.2. 10 CFR 50, Appendix A, GDC 1, 1988.3. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.4.17-3 Revision No. 115 SG Tube Integrity B 3.4.18 B 3.4 REACTOR COOLANT SYSTEM (RCS)B 3.4.18 Steam Generator (SG) Tube Integrity BASES BACKGROUND Steam generator (SG) tubes are small diameter, thin walled tubes that carry primary coolant through the primary to secondary heat exchangers.
| |
| The SG tubes have a number of important safety functions.
| |
| Steam generator tubes are an integral part of the reactor coolant pressure boundary (RCPB) and, as such, are relied on to maintain the primary system's pressure and inventory.
| |
| The SG tubes isolate the radioactive fission products in the primary coolant from the secondary system. In addition, as part of the RCPB, the SG tubes are unique in that they act as the heat transfer surface between the primary and secondary systems to remove heat from the primary system. This Specification addresses only the RCPB integrity function of the SG. The SG heat removal function is addressed by LCO 3.4.4, "RCS Loops -MODES 1 and 2," LCO 3.4.5,"RCS Loops -MODE 3," LCO 3.4.6, "RCS Loops -MODE 4," and LCO 3.4.7, "RCS Loops -MODE 5, Loops Filled." SG tube integrity means that the tubes are capable of performing their intended RCPB safety function consistent with the licensing basis, including applicable regulatory requirements.
| |
| Steam generator tubing is subject to a variety of degradation mechanisms.
| |
| Steam generator tubes may experience tube degradation related to corrosion phenomena, such as wastage, pitting, intergranular attack, and stress corrosion cracking, along with other mechanically induced phenomena such as denting and wear. These degradation mechanisms can impair tube integrity if they are not managed effectively.
| |
| The SG performance criteria are used to manage SG tube degradation.
| |
| Specification 5.5.9, "Steam Generator (SG) Program," requires that a program be established and implemented to ensure that SG tube integrity is maintained.
| |
| Pursuant to Specification 5.5.9, tube integrity is maintained when the SG performance criteria are met. There are three SG performance criteria:
| |
| structural integrity, accident induced leakage, and operational LEAKAGE. The SG performance criteria are described in Specification 5.5.9. Meeting the SG performance criteria provides reasonable assurance of maintaining tube integrity at normal and accident conditions.
| |
| The processes used to meet the SG performance criteria are defined by the Steam Generator Program Guidelines (Ref. 1).McGuire Units 1 and 2 B 3.4.18-1 Revision No. 86 McGuire Units 1 and 2 B 3.4.18-1 Revision No. 86 SG Tube Integrity B 3.4.18 BASES APPLICABLE The steam generator tube rupture (SGTR) accident is the limiting design SAFETY basis event for SG tubes and avoiding an SGTR is the basis for this ANALYSES Specification.
| |
| The analysis of a SGTR event assumes a bounding primary to secondary LEAKAGE rate equal to the operational LEAKAGE rate limits in LCO 3.4.13, "RCS Operational LEAKAGE," plus the leakage rate associated with a double-ended rupture of a single tube. The accident analysis for a SGTR assumes main steam isolation valve closure and cooldown via the SG safety valves or blowdown through the SG PORVs.The analysis for design basis accidents and transients other than a SGTR assume the SG tubes retain their structural integrity (i.e., they are assumed not to rupture.)
| |
| In these analyses, the steam discharge to the atmosphere is based on primary to secondary leakage from any one SG of 135 gallons per day and 389 gallons per day total from all SGs. For accidents that do not involve fuel damage, the primary coolant activity level of DOSE EQUIVALENT 1-131 is assumed to be equal to the LCO 3.4.16, "RCS Specific Activity," limits. For accidents that assume fuel damage, the primary coolant activity is a function of the amount of activity released from the damaged fuel. The dose consequences of these events are within the limits of GDC 19 (Ref. 2), 10 CFR 100 (Ref. 3) or the NRC approved licensing basis (e.g., a small fraction of these limits).Steam generator tube integrity satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The LCO requires that SG tube integrity be maintained.
| |
| The LCO also requires that all SG tubes that satisfy the repair criteria be plugged in accordance with the Steam Generator Program.During an SG inspection, any inspected tube that satisfies the Steam Generator Program repair criteria is removed from service by plugging.
| |
| If a tube was determined to satisfy the repair criteria but was not plugged, the tube may still have tube integrity.
| |
| In the context of this Specification, a SG tube is defined as the entire length of the tube, including the tube wall, between the tube-to-tubesheet weld at the tube inlet and the tube-to-tubesheet weld at the tube outlet.The tube-to-tubesheet weld is not considered part of the tube.A SG tube has tube integrity when it satisfies the SG performance criteria.The SG performance criteria are defined in Specification 5.5.9, "Steam Generator Program," and describe acceptable SG tube performance.
| |
| The Steam Generator Program also provides the evaluation process for determining conformance with the SG performance criteria.McGuire Units 1 and 2 B 3.4.18-2 Revision No. 86 McGuire Units 1 and 2 B 3.4.18-2 Revision No. 86 SG Tube Integrity B 3.4.18 BASES LCO (continued)
| |
| There are three SG performance criteria:
| |
| structural integrity, accident induced leakage, and operational LEAKAGE. Failure to meet any one of these criteria is considered failure to meet the LCO.The structural integrity performance criterion provides a margin of safety against tube burst or collapse under normal and accident conditions, and ensures structural integrity of the SG tubes under all anticipated transients included in the design specification.
| |
| Tube burst is defined as,"The gross structural failure of the tube wall. The condition typically corresponds to an unstable opening displacement (e.g., opening area increased in response to constant pressure) accompanied by ductile (plastic) tearing of the tube material at the ends of the degradation." Tube collapse is defined as, "For the load displacement curve for a given structure, collapse occurs at the top of the load versus displacement curve where the slope of the curve becomes zero." The structural integrity performance criterion provides guidance on assessing loads that have a significant effect on burst or collapse.
| |
| In that context, the term"significant" is defined as "An accident loading condition other than differential pressure is considered significant when the addition of such loads in the assessment of the structural integrity performance criterion could cause a lower structural limit or limiting burst/collapse condition to be established." For tube integrity evaluations, except for circumferential degradation, axial thermal loads are classified as secondary loads. For circumferential degradation, the classification of axial thermal loads as primary or secondary loads will be evaluated on a case-by-case basis.The division between primary and secondary classifications will be based on detailed analysis and/or testing.Structural integrity requires that the primary membrane stress intensity in a tube not exceed the yield strength for all ASME Code, Section 11I, Service Level A (normal operating conditions) and Service Level B (upset or abnormal conditions) transients included in the design specification.
| |
| This includes safety factors and applicable design basis loads based on ASME Code, Section III, Subsection NB (Ref. 4) and Draft Regulatory Guide 1.121 (Ref. 5).The accident induced leakage performance criterion ensures that the primary to secondary LEAKAGE caused by a design basis accident, other than a SGTR, is within the accident analysis assumptions.
| |
| The accident analysis assumes that accident induced leakage does not exceed 0.27 gallons per minute total. The accident induced leakage rate includes any primary to secondary LEAKAGE existing prior to the accident in addition to primary to secondary LEAKAGE induced during the accident.McGuire Units I and 2 B 3.4.18-3 Revision No. 86 McGuire Units 1 and 2 B 3.4.18-3 Revision No. 86 SG Tube Integrity B 3.4.18 BASES LCO (continued)
| |
| The operational LEAKAGE performance criterion provides an observable indication of SG tube conditions during plant operation.
| |
| The limit on operational LEAKAGE is contained in LCO 3.4.13, "RCS Operational LEAKAGE," and limits primary to secondary LEAKAGE through any one SG to 135 gallons per day and 389 gallons per day total through all SGs.This limit is based on the assumption that a single crack leaking this amount would not propagate to a SGTR under the stress conditions of a LOCA or a main steam line break. If this amount of LEAKAGE is due to more than one crack, the cracks are very small, and the above assumption is conservative.
| |
| APPLICABILITY Steam generator tube integrity is challenged when the pressure differential across the tubes is large. Large differential pressures across SG tubes can only be experienced in MODE 1, 2, 3, or 4.RCS conditions are far less challenging in MODES 5 and 6 than during MODES 1, 2, 3, and 4. In MODES 5 and 6, primary to secondary differential pressure is low, resulting in lower stresses and reduced potential for LEAKAGE.ACTIONS The ACTIONS are modified by a Note clarifying that the Conditions may be entered independently for each SG tube. This is acceptable because the Required Actions provide appropriate compensatory actions for each affected SG tube. Complying with the Required Actions may allow for continued operation, and subsequent affected SG tubes are governed by subsequent Condition entry and application of associated Required Actions.A.1 and A.2 Condition A applies if it is discovered that one or more SG tubes examined in an inservice inspection satisfy the tube repair criteria but were not plugged in accordance with the Steam Generator Program as required by SR 3.4.18.2.
| |
| An evaluation of SG tube integrity of the affected tube(s) must be made. Steam generator tube integrity is based on meeting the SG performance criteria described in the Steam Generator Program. The SG repair criteria define limits on SG tube degradation that allow for flaw growth between inspections while still providing assurance that the SG performance criteria will continue to be met. In order to determine if a SG tube that should have been plugged has tube integrity, an evaluation must be completed that demonstrates that the SG performance criteria will continue to be met until the next refueling outage or SG tube inspection, which ever is shorter. The tube integrity determination is based on the estimated condition of the tube at the time the situation is discovered and the estimated growth of the degradation prior to the next SG tube inspection.
| |
| If it is determined that tube integrity is not being maintained, Condition B applies.McGuire Units 1 and 2 B 3.4.18-4 Revision No. 86 SG Tube Integrity B 3.4.18 BASES Actions (continued)
| |
| A Completion Time of 7 days is sufficient to complete the evaluation while minimizing the risk of plant operation with a SG tube that may not have tube integrity.
| |
| If the evaluation determines that the affected tube(s) have tube integrity, Required Action A.2 allows plant operation to continue until the next refueling outage or SG inspection provided the inspection interval continues to be supported by an operational assessment that reflects the affected tubes. However, the affected tube(s) must be plugged prior to entering MODE 4 following the next refueling outage or SG inspection.
| |
| This Completion Time is acceptable since operation until the next inspection is supported by the operational assessment.
| |
| B.1 and B.2 If the Required Actions and associated Completion Times of Condition A are not met or if SG tube integrity is not being maintained, the reactor must be brought to MODE 3 within 6 hours and MODE 5 within 36 hours.The allowed Completion Times are reasonable, based on operating experience, to reach the desired plant conditions from full power conditions in an orderly manner and without challenging plant systems, SURVEILLANCE SR 3.4.18.1 REQUIREMENTS During shutdown periods the SGs are inspected as required by this SR and the Steam Generator Program. NEI 97-06, Steam Generator Program Guidelines (Ref. 1), and its referenced EPRI Guidelines, establish the content of the Steam Generator Program. Use of the Steam Generator Program ensures that the inspection is appropriate and consistent with accepted industry practices.
| |
| During SG inspections a condition monitoring assessment of the SG tubes is performed.
| |
| The condition monitoring assessment determines the"as found" condition of the SG tubes. The purpose of the condition monitoring assessment is to ensure that the SG performance criteria have been met for the previous operating period.McGuire Units 1 and 2 B 3.4.18-5 Revision No. 86 SG Tube Integrity B 3.4.18 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| The Steam Generator Program determines the scope of the inspection and the methods used to determine whether the tubes contain flaws satisfying the tube repair criteria.
| |
| Inspection scope (i.e., which tubes or areas of tubing within the SG are to be inspected) is a function of existing and potential degradation locations.
| |
| The Steam Generator Program also specifies the inspection methods to be used to find potential degradation.
| |
| Inspection methods are a function of degradation morphology, non-destructive examination (NDE) technique capabilities, and inspection locations.
| |
| The Steam Generator Program defines the Frequency of SR 3.4.18.1.The Frequency is determined by the operational assessment and other limits in the SG examination guidelines (Ref. 6). The Steam Generator Program uses information on existing degradations and growth rates to determine an inspection Frequency that provides reasonable assurance that the tubing will meet the SG performance criteria at the next scheduled inspection.
| |
| In addition, Specification 5.5.9 contains prescriptive requirements concerning inspection intervals to provide added assurance that the SG performance criteria will be met between scheduled inspections.
| |
| SR 3.4.18.2 During an SG inspection, any inspected tube that satisfies the Steam Generator Program repair criteria is removed from service by plugging.The tube repair criteria delineated in Specification 5.5.9 are intended to ensure that tubes accepted for continued service satisfy the SG performance criteria with allowance for error in the flaw size measurement and for future flaw growth. In addition, the tube repair criteria, in conjunction with other elements of the Steam Generator Program, ensure that the SG performance criteria will continue to be met until the next inspection of the subject tube(s). Reference 1 provides guidance for performing operational assessments to verify that the tubes remaining in service will continue to meet the SG performance criteria.The Frequency of prior to entering MODE 4 following a SG inspection ensures that the Surveillance has been completed and all tubes meeting the repair criteria are plugged prior to subjecting the SG tubes to significant primary to secondary pressure differential.
| |
| McGuire Units I and 2 B 3.4.18-6 Revision No. 86 SG Tube Integrity B 3.4.18 REFERENCES
| |
| : 1. NEI 97-06, "Steam Generator Program Guidelines." 2. 10 CFR 50 Appendix A, GDC 19.3. 10CFR100.4. ASME Boiler and Pressure Vessel Code, Section III, Subsection NB.5. Draft Regulatory Guide 1.121, "Basis for Plugging Degraded Steam Generator Tubes," August 1976.6. EPRI, "Pressurized Water Reactor Steam Generator Examination Guidelines." McGuire Units 1 and 2 B 3.4.18-7 Revision No. 86 McGuire Units 1 and 2 B 3.4.18-7 Revision No. 86 Accumulators B 3.5.1 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)B 3.5.1 Accumulators BASES BACKGROUND The functions of the ECCS accumulators are to supply water to the reactor vessel during the blowdown phase of a loss of coolant accident (LOCA), to provide inventory to help accomplish the refill phase that follows thereafter, and to provide Reactor Coolant System (RCS) makeup for a small break LOCA.The blowdown phase of a large break LOCA is the initial period of the transient during which the RCS departs from equilibrium conditions, and heat from fission product decay, hot internals, and the vessel continues to be transferred to the reactor coolant. The blowdown phase of the transient ends when the RCS pressure falls to a value approaching that of the containment atmosphere.
| |
| In the refill phase of a LOCA, which immediately follows the blowdown phase, reactor coolant inventory has vacated the core through steam flashing and ejection out through the break. The core is essentially in adiabatic heatup. The balance of accumulator inventory is then available to help fill voids in the lower plenum and reactor vessel downcomer so as to establish a recovery level at the bottom of the core and ongoing reflood of the core with the addition of safety injection (SI) water.The accumulators are pressure vessels partially filled with borated water and pressurized with nitrogen gas. The accumulators are passive components, since no operator or control actions are required in order for them to perform their function.
| |
| Internal accumulator tank pressure is sufficient to discharge the accumulator contents to the RCS, if RCS pressure decreases below the accumulator pressure.Each accumulator is piped into an RCS cold leg via an accumulator line and is isolated from the RCS by a motor operated isolation valve and two check valves in series. The motor operated isolation valves are interlocked by P-1 1 with the pressurizer pressure measurement channels to ensure that the valves will automatically open as RCS pressure increases to above the permissive circuit P-11 setpoint.This interlock also prevents inadvertent closure of the valves during normal operation prior to an accident.
| |
| The valves will automatically open, however, as a result of an SI signal. The isolation valves between the accumulators and the Reactor Coolant System are required to be open McGuire Units 1 and 2 B 3.5.1 -1 Revision No. 115 Accumulators B 3.5.1 BASES BACKGROUND (continued) and power removed during unit operation.
| |
| In that the subject valves are normally open and do not serve as an active device during a LOCA, the requirements of the Institute of Electrical and Electronic Engineers (IEEE)Standard 279-1971 (Ref. 1) is not applicable in this situation.
| |
| Therefore, the subject valve control circuit is not designed to this standard.The accumulator size, water volume, and nitrogen cover pressure are selected so that three of the four accumulators are sufficient to partially cover the core before significant clad melting or zirconium water reaction can occur following a LOCA. The need to ensure that three accumulators are adequate for this function is consistent with the LOCA assumption that the entire contents of one accumulator will be lost via the RCS pipe break during the blowdown phase of the LOCA.APPLICABLE The accumulators are assumed OPERABLE in both the large and SAFETY ANALYSES small break LOCA analyses at full power (Ref. 2). These are the Design Basis Accidents (DBAs) that establish the acceptance limits for the accumulators.
| |
| Reference to the analyses for these DBAs is used to assess changes in the accumulators as they relate to the acceptance limits.In performing the LOCA calculations, conservative assumptions are made concerning the availability of ECCS flow. No credit is taken for control rod assembly insertion, except for post-LOCA subcriticality calculation during the sump recirculation phase. In the early stages of a LOCA, with or without a loss of offsite power, the accumulators provide the sole source of makeup water to the RCS. The assumption of loss of offsite power is required by regulations and conservatively imposes a delay wherein the ECCS pumps cannot deliver flow until the emergency diesel generators start, come to rated speed, and go through their timed loading sequence.In cold leg break scenarios, the entire contents of one accumulator are assumed to be lost through the break.The limiting large break LOCA is a double ended guillotine break at the discharge of the reactor coolant pump. During this event, the accumulators discharge to the RCS as soon as RCS pressure decreases to below accumulator pressure.As a conservative estimate, no credit is taken for ECCS pump flow until an effective delay has elapsed. This delay accounts for the diesels starting, the valves opening, and the pumps being loaded and delivering full flow. The delay time is conservatively set with an additional 2 seconds to account for SI signal generation.
| |
| During this time, the accumulators are analyzed as providing the sole source of emergency McGuire Units I and 2 B 3.5.1-2 Revision No. 115 Accumulators B 3.5.1 BASES APPLICABLE SAFETY ANALYSES (continued) core cooling. No operator action is assumed during the blowdown stage of a large break LOCA.The worst case small break LOCA analyses also assume a time delay before pumped flow reaches the core. For the larger range of small breaks, the rate of blowdown is such that the increase in fuel clad temperature is terminated solely by the accumulators, with pumped flow then providing continued cooling. As break size decreases, the accumulators, safety injection pumps, and centrifugal charging pumps all play a part in terminating the rise in clad temperature.
| |
| As break size continues to decrease, the role of the accumulators continues to decrease until they are not required and the centrifugal charging pumps become solely responsible for terminating the temperature increase.This LCO helps to ensure that the following acceptance criteria established for the ECCS by 10 CFR 50.46 (Ref. 3) will be met following a small break LOCA and there is a high probability that the criteria are met following a large break LOCA: a. Maximum fuel element cladding temperature is < 2200°F;b. Maximum cladding oxidation is < 0.17 times the total cladding thickness before oxidation;
| |
| : c. Maximum hydrogen generation from a zirconium water reaction is <0.01 times the hypothetical amount that would be generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react; and d. Core is maintained in a coolable geometry.Since the accumulators discharge during the blowdown phase of a LOCA, they do not contribute directly to the long term cooling requirements of 10 CFR 50.46. However, the boron content of the accumulator water helps to maintain the reactor core subcritical after reflood, thereby eliminating fission heat as an energy source for which cooling must be provided.For both the large and small break LOCA analyses, a nominal contained accumulator water volume is used. The contained water volume is the same as the deliverable volume for the accumulators, since the accumulators are emptied, once discharged.
| |
| The large and small break LOCA analyses are performed with accumulator volumes that are consistent with the LOCA evaluation models. To allow for operating margin, values of +/- 31.5 ft 3 are specified.
| |
| McGuire Units 1 and 2 B 3.5.1-3 Revision No. 115 Accumulators B 3.5.1 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| The minimum boron concentration setpoint is used in the post-LOCA subcriticality verification during the injection phase. For each reload cycle, the all rods out (ARO, no credit for control rod assembly insertion) critical boron concentration is verified to be less than the minimum allowed cold leg accumulator boron concentration.
| |
| No credit is taken for control rod assembly insertion when verifying subcriticality during the injection phase, but credit is taken for control rod assembly insertion in the post-LOCA subcriticality calculation during the sump recirculation phase to offset the boron diluted sump condition described below.The minimum boron concentration setpoint is also used in the post LOCA sump boron concentration calculation.
| |
| The calculation is performed to assure reactor subcriticality in a post LOCA environment, with all rods in (crediting control rod assembly insertion), minus the highest worth rod out (ARI N-i). Of particular interest is the large cold leg break LOCA, since boron accumulation in the core will be maximized during the cold leg recirculation phase due to core boiling. The accumulation of boron in the core prevents the boron from returning to the sump, which leads to a boron diluted sump condition.
| |
| A reduction in the accumulator minimum boron concentration would produce a subsequent reduction in the available containment sump concentration for post LOCA shutdown, potentially causing the core to become re-critical by injecting boron diluted sump water into the core when switching over to hot leg recirculation.
| |
| A reduction in the accumulator minimum boron concentration would also increase the maximum sump pH. The maximum boron concentration is used in determining the cold leg to hot leg recirculation injection switchover time and minimum sump pH.The large and small break LOCA analyses are performed with accumulator pressures that are consistent with the LOCA evaluation models. To allow for operating margin and accumulator design limits, a range from 585 psig to 639 psig is specified.
| |
| The maximum nitrogen cover pressure limit prevents accumulator relief valve actuation, and ultimately preserves accumulator integrity.
| |
| The effects on containment mass and energy releases from the accumulators are accounted for in the appropriate analyses (Ref. 4).The accumulators satisfy Criterion 3 of 10 CFR 50.36 (Ref. 5).McGuire Units 1 and 2 B 3.5.1-4 Revision No. 115 Accumulators B 3.5.1 BASES LCO The LCO establishes the minimum conditions required to ensure that the accumulators are available to accomplish their core cooling safety function following a LOCA. Four accumulators are required to ensure that 100% of the contents of three of the accumulators will reach the core during a LOCA. This is consistent with the assumption that the contents of one accumulator spill through the break. If less than three accumulators are injected during the blowdown phase of a LOCA, the ECCS acceptance criteria of 10 CFR 50.46 (Ref. 3) could be violated.For an accumulator to be considered OPERABLE, the isolation valve must be fully open, power removed above 1000 psig, and the limits established in the SRs for contained volume, boron concentration, and nitrogen cover pressure must be met. Additionally, the nitrogen and liquid volumes between accumulators must be physically separate.APPLICABILITY In MODES 1 and 2, and in MODE 3 with RCS pressure > 1000 psig, the accumulator OPERABILITY requirements are based on full power operation.
| |
| Although cooling requirements decrease as power decreases, the accumulators are still required to provide core cooling as long as elevated RCS pressures and temperatures exist.This LCO is only applicable at pressures
| |
| > 1000 psig. At pressures< 1000 psig, the rate of RCS blowdown is such that the ECCS pumps can provide adequate injection to ensure that peak clad temperature remains below the 10 CFR 50.46 (Ref. 3) limit of 2200°F for small break LOCAs and there is a high level of probability that the peak cladding temperature does not exceed 2200°F for large break LOCAs.In MODE 3, with RCS pressure < 1000 psig, and in MODES 4, 5, and 6, the accumulator motor operated isolation valves are closed to isolate the accumulators from the RCS. This allows RCS cooldown and depressurization without discharging the accumulators into the RCS or requiring depressurization of the accumulators.
| |
| ACTIONS A.1 If the boron concentration of one accumulator is not within limits, it must be returned to within the limits within 72 hours. In this Condition, ability to maintain subcriticality or minimum boron precipitation time may be reduced. The boron in the accumulators contributes to the assumption that the combined ECCS water in the partially recovered core during the early reflooding phase of a large break LOCA is sufficient to keep that portion of the core subcritical.
| |
| One accumulator below the minimum boron concentration limit, however, will have no effect on available ECCS McGuire Units 1 and 2 B 3.5.1-5 Revision No. 115 Accumulators B 3.5.1 BASES ACTIONS (continued) water and an insignificant effect on core subcriticality during reflood.Boiling of ECCS water in the core during reflood concentrates boron in the saturated liquid that remains in the core. In addition, current analysis techniques demonstrate that the accumulators do not discharge following a large main steam line break for the plant. Even if they do discharge, their impact is minor and not a design limiting event. Thus, 72 hours is allowed to return the boron concentration to within limits.B.1 If one accumulator is inoperable for a reason other than boron concentration, the accumulator must be returned to OPERABLE status within 24 hours. In this Condition, the required contents of three accumulators cannot be assumed to reach the core during a LOCA. Due to the severity of the consequences should a LOCA occur in these conditions, the 24 hours Completion Time to open the valve, remove power to the valve, or restore the proper water volume or nitrogen cover pressure ensures that prompt action will be taken to return the inoperable accumulator to OPERABLE status. The Completion Time minimizes the potential for exposure of the plant to a LOCA under these conditions.
| |
| The 24 hours allowed to restore an inoperable accumulator to operable status is justified in WCAP-1 5049-A, Rev. 1 (Ref. 6)C.1 and C.2 If the accumulator cannot be returned to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours and RCS pressure reduced to <1000 psig within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.D.1 If more than one accumulator is inoperable, the plant is in a condition outside the accident analyses; therefore, LCO 3.0.3 must be entered immediately.
| |
| McGuire Units 1 and 2 B 3.5.1-6 Revision No. 115 Accumulators B 3.5.1 BASES SURVEILLANCE SR 3.5.1.1 REQUIREMENTS Each accumulator valve should be verified to be fully open. This verification ensures that the accumulators are available for injection and ensures timely discovery if a valve should be less than fully open. If an isolation valve is not fully open, the rate of injection to the RCS would be reduced. Although a motor operated valve position should not change with power removed, a closed valve could result in not meeting accident analyses assumptions.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.5.1.2 and SR 3.5.1.3 Borated water volume and nitrogen cover pressure are verified for each accumulator.
| |
| This is typically performed using the installed control room indication.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.5.1.4 The boron concentration should be verified to be within required limits for each accumulator since the static design of the accumulators limits the ways in which the concentration can be changed The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program. Sampling the affected accumulator within 6 hours after a 1%tank volume increase will identify whether inleakage has caused a reduction in boron concentration to below the required limit. It is not necessary to verify boron concentration if the added water inventory is from the refueling water storage tank (RWST), because the water contained in the RWST is within the accumulator boron concentration requirements.
| |
| This is consistent with the recommendation of NUREG-1366 (Ref. 7).SR 3.5.1.5 Verification that power is removed from each accumulator isolation valve operator (see Ref. 8) when the RCS pressure is > 1000 psig ensures that an active failure could not result in the undetected closure of an accumulator motor operated isolation valve. If this were to McGuire Units 1 and 2 B 3.5.1-7 Revision No. 115 Accumulators B 3.5.1 BASES SURVEILLANCE REQUIREMENTS (continued) occur, only two accumulators would be available for injection given a single failure coincident with a LOCA. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.This SR allows power to be supplied to the motor operated isolation valves when RCS pressure is <_ 1000 psig, thus allowing operational flexibility by avoiding unnecessary delays to manipulate the breakers during plant startups or shutdowns.
| |
| Even with power supplied to the valves, inadvertent closure is prevented by the RCS pressure interlock associated with the valves.Should closure of a valve occur in spite of the interlock, the Sl signal provided to the valves would open a closed valve in the event of a LOCA.REFERENCES
| |
| : 1. IEEE Standard 279-1971.2. UFSAR, Chapter 6.3. 10 CFR 50.46.4. DPC-NE-3004.
| |
| : 5. 10 CFR 50.36, Technical Specification, (c)(2)(ii).
| |
| : 6. WCAP -15049-A, Rev. 1, April 1999 7. NUREG-1366, February 1990.8. Duke letter to NRC, "Cold Leg Accumulator Isolation Valves", dated September 8, 1987 McGuire Units 1 and 2 B 3.5.1-8 Revision No. 115 ECCS-Operating B 3.5.2 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)B 3.5.2 ECCS-Operating BASES BACKGROUND The function of the ECCS is to provide core cooling and negative reactivity to ensure that the reactor core is protected after any of the following accidents:
| |
| : a. Loss of coolant accident (LOCA), coolant leakage greater than the capability of the normal charging system;b. Rod ejection accident;c. Loss of secondary coolant accident, including uncontrolled steam or feedwater release; and d. Steam generator tube rupture (SGTR).The addition of negative reactivity is designed primarily for the loss of secondary coolant accident where primary cooldown could add enough positive reactivity to achieve criticality and return to significant power.There are three phases of ECCS operation:
| |
| injection, cold leg recirculation, and hot leg recirculation.
| |
| In the injection phase, water is taken from the refueling water storage tank (RWST) and injected into the Reactor Coolant System (RCS) through the cold legs. When sufficient water is removed from the RWST to ensure that enough boron has been added to maintain the reactor subcritical and the containment sumps have enough water to supply the required net positive suction head to the ECCS pumps, suction is switched to the containment sump for cold leg recirculation.
| |
| When the core decay heat has decreased to a level low enough to be successfully removed without direct RHR pump injection flow, the RHR cold leg injection path is realigned to discharge to the auxiliary containment spray header. After approximately 7 hours, part of the ECCS flow is shifted to the hot leg recirculation phase to provide a backflush which, for a cold leg break, would reduce the boiling in the top of the core and prevent excessive boron concentration.
| |
| The ECCS consists of three separate subsystems:
| |
| centrifugal charging (high head), safety injection (SI) (intermediate head), and residual heat removal (RHR) (low head). Each subsystem consists of two redundant, 100% capacity trains. The ECCS accumulators and the RWST are also part of the ECCS, but are not considered part of an ECCS flow path as described by this LCO.McGuire Units 1 and 2 B 3.5.2-1 Revision No. 116 ECCS-Operating B 3.5.2 BASES BACKGROUND (continued)
| |
| The ECCS flow paths consist of piping, valves, heat exchangers, and pumps such that water from the RWST can be injected into the RCS following the accidents described in this LCO. The major components of each subsystem are the centrifugal charging pumps, the RHR pumps, heat exchangers, and the SI pumps. Each of the three subsystems consists of two 100% capacity trains that are interconnected and redundant such that either train is capable of supplying 100% of the flow required to mitigate the accident consequences.
| |
| This interconnecting and redundant subsystem design provides the operators with the ability to utilize components from opposite trains to achieve the required 100% flow to the core.During the injection phase of LOCA recovery, a suction header supplies water from the RWST to the ECCS pumps. Mostly separate piping supplies each subsystem and each train within the subsystem.
| |
| The discharge from the centrifugal charging pumps combines, then divides again into four supply lines, each of which feeds the injection line to one RCS cold leg. The discharge from the SI and RHR pumps divides and feeds an injection line to each of the RCS cold legs. Throttle valves in the SI lines are set to balance the flow to the RCS. This balance ensures sufficient flow to the core to meet the analysis assumptions following a LOCA in one of the RCS cold legs. The flow split from the RHR lines cannot be adjusted.
| |
| Although much of the two ECCS trains are composed of completely separate piping, certain areas are shared between trains. The most important of these are 1) where both trains flow through a single physical pipe, and 2) at the injection connections to the RCS cold legs. Since each train must supply sufficient flow to the RCS to be considered 100% capacity, credit is taken in the safety analyses for flow to three intact cold legs. Any configuration which, when combined with a single active failure, prevents the flow from either ECCS pump in a given train from reaching all four cold legs injection points on that train is unanalyzed and might render both trains of that ECCS subsystem inoperable.
| |
| For LOCAs that are too small to depressurize the RCS below the shutoff head of the SI pumps, the centrifugal charging pumps supply water until the RCS pressure decreases below the SI pump shutoff head. During this period, the steam generators are used to provide part of the core cooling function.During the recirculation phase of LOCA recovery, RHR pump suction is transferred to the containment sump. The RHR pumps then supply the other ECCS pumps. Initially, recirculation is through the same paths as the injection phase. Subsequently, for large LOCAs, the recirculation phase includes injection into both the hot and cold legs.McGuire Units 1 and 2 B 3.5.2-2 Revision No. 116 ECCS-Operating B 3.5.2 BASES BACKGROUND (continued)
| |
| The high and intermediate head subsystems of the ECCS also functions to supply borated water to the reactor core following increased heat removal events, such as a main steam line break (MSLB). The limiting design conditions occur when the moderator temperature coefficient is highly negative, such as at the end of each cycle.During low temperature conditions in the RCS, limitations are placed on the maximum number of ECCS pumps that may be OPERABLE.
| |
| Refer to the Bases for LCO 3.4.12, "Low Temperature Overpressure Protection (LTOP) System," for the basis of these requirements.
| |
| The ECCS subsystems are actuated upon receipt of an SI signal. The actuation of safeguard loads is accomplished in a programmed time sequence.
| |
| If offsite power is available, the safeguard loads start immediately in the programmed sequence.
| |
| If offsite power is not available, the Engineered Safety Feature (ESF) buses shed normal operating loads and are connected to the emergency diesel generators (EDGs). Safeguard loads are then actuated in the programmed time sequence.
| |
| The time delay associated with diesel starting, sequenced loading, and pump starting determines the time required before pumped flow is available to the core following a safety injection actuation.
| |
| The active ECCS components, along with the passive accumulators and the RWST covered in LCO 3.5.1, "Accumulators," and LCO 3.5.4,"Refueling Water Storage Tank (RWST)," provide the cooling water necessary to meet GDC 35 (Ref. 1).APPLICABLE The LCO helps to ensure that the following acceptance criteria for the SAFETY ANALYSES ECCS, established by 10 CFR 50.46 (Ref. 2), will be met following a small break LOCA and there is a high level of probability that the criteria are met following a large break LOCA: a. Maximum fuel element cladding temperature is < 2200°F;b. Maximum cladding oxidation is < 0.17 times the total cladding thickness before oxidation;.
| |
| : c. Maximum hydrogen generation from a zirconium water reaction is_< 0.01 times the hypothetical amount generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react;McGuire Units 1 and 2 B 3.5.2-3 Revision No. 116 McGuire Units 1 and 2 B 3.5.2-3 Revision No. 116 ECCS-Operating B 3.5.2 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| : d. Core is maintained in a coolable geometry; and e. Adequate long term core cooling capability is maintained.
| |
| The LCO also limits the potential for a post trip return to power following an MSLB event and ensures that containment pressure and temperature limits are met.Each ECCS subsystem is taken credit for in a large break LOCA event at full power (Refs. 3 and 4). This event has the greatest potential to challenge the limits on runout flow set by the manufacturer of the ECCS pumps. It also sets the maximum response time for their actuation.
| |
| Direct flow from the centrifugal charging pumps and SI pumps is credited in a small break LOCA event. The RHR pumps are also credited, for larger small break LOCAs, as the means of supplying suction to these higher head ECCS pumps after the switch to sump recirculation.
| |
| This event establishes the flow and discharge head at the design point for the centrifugal charging pumps. The MSLB analysis also credits the SI and centrifugal charging pumps. Although some ECCS flow is necessary to mitigate a SGTR event, a single failure disabling one ECCS train is not the limiting single failure for this transient.
| |
| The SGTR analysis primary to secondary break flow is increased by the availability of both centrifugal charging and SI trains. Therefore, the SGTR analysis is penalized by assuming both ECCS trains are operable as required by the LCO. The OPERABILITY requirements for the ECCS are based on the following LOCA analysis assumptions:
| |
| : a. A large break LOCA event, with loss of offsite power and a single failure disabling one ECCS train; and b. A small break LOCA event, with a loss of offsite power and a single failure disabling one ECCS train.During the blowdown stage of a LOCA, the RCS depressurizes as primary coolant is ejected through the break into the containment.
| |
| The nuclear reaction is terminated either by moderator voiding during large breaks or control rod insertion for small breaks. Following depressurization, emergency cooling water is injected into the cold legs, flows into the downcomer, fills the lower plenum, and refloods the core.The effects on containment mass and energy releases are accounted for in appropriate analyses (Ref. 3). The LCO ensures that an ECCS train will deliver sufficient water to match boiloff rates soon enough to minimize the consequences of the core being uncovered following a large LOCA.McGuire Units 1 and 2.B 3.5.2-4 Revision No. 116 ECCS-Operating B 3.5.2 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| It also ensures that the centrifugal charging and SI pumps will deliver sufficient water and boron during a small LOCA to maintain core subcriticality.
| |
| For smaller LOCAs, the centrifugal charging pump delivers sufficient fluid to maintain RCS inventory.
| |
| For a small break LOCA, the steam generators continue to serve as the heat sink, providing part of the required core cooling.The ECCS trains satisfy Criterion 3 of 10 CFR 50.36 (Ref. 5).LCO In MODES 1, 2, and 3, two independent (and redundant)
| |
| ECCS trains are required to ensure that sufficient ECCS flow is available, assuming a single failure affecting either train. Additionally, individual components within the ECCS trains may be called upon to mitigate the consequences of other transients and accidents.
| |
| In MODES 1, 2, and 3, an ECCS train consists of a centrifugal charging subsystem, an SI subsystem, and an RHR subsystem.
| |
| Each train includes the piping, instruments, and controls to ensure an OPERABLE flow path capable of taking suction from the RWST upon an SI signal and automatically transferring suction to the containment sump.During an event requiring ECCS actuation, a flow path is required to provide an abundant supply of water from the RWST to the RCS via the ECCS pumps and their respective supply headers to each of the four cold leg injection nozzles. In the long term, this flow path may be switched to take its supply from the containment sump and to supply its flow to the RCS hot and cold legs. The flow path for each train must maintain its designed independence to ensure that no single failure can disable both ECCS trains.APPLICABILITY In MODES 1, 2, and 3, the ECCS OPERABILITY requirements for the limiting Design Basis Accident, a large break LOCA, are based on full power operation.
| |
| Although reduced power would not require the same level of performance, the accident analysis does not provide for reduced cooling requirements in the lower MODES. The centrifugal charging pump performance is based on a small break LOCA, which establishes the pump performance curve and has less dependence on power. The SI pump performance requirements are based on a small break LOCA. For both of these types of pumps, the large break LOCA analysis depends only on the flow value at containment pressure, not on the shape of the flow versus pressure curve at higher pressures.
| |
| MODE 2 and MODE 3 requirements are bounded by the MODE 1 analysis.McGuire Units 1 and 2 B 3.5.2-5 Revision No. 116 ECCS-Operating B 3.5.2 BASES APPLICABILITY (continued)
| |
| This LCO is only applicable in MODE 3 and above. Below MODE 3, the SI signal setpoint is manually bypassed by operator control, and system functional requirements are relaxed as described in LCO 3.5.3, "ECCS-Shutdown." As indicated in the Note, the flow path may be isolated for 2 hours in MODE 3, under controlled conditions, to perform pressure isolation valve testing per SR 3.4.14.1.
| |
| The flow path is readily restorable from the control room.In MODES 5 and 6, plant conditions are such that the probability of an event requiring ECCS injection is extremely low. Core cooling requirements in MODE 5 are addressed by LCO 3.4.7, "RCS Loops-MODE 5, Loops Filled," and LCO 3.4.8, "RCS Loops-MODE 5, Loops Not Filled." MODE 6 core cooling requirements are addressed by LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation-High Water Level," and LCO 3.9.6, "Residual Heat Removal (RHR) and Coolant Circulation-Low Water Level." ACTIONS A. 1 With one or more trains inoperable and at least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train available, the inoperable components must be returned to OPERABLE status within 72 hours. The 72 hour Completion Time is based on an NRC reliability evaluation (Ref. 6) and is a reasonable time for repair of many ECCS components.
| |
| An ECCS train is inoperable if it is not capable of delivering design flow to the RCS. Individual components are inoperable if they are not capable of performing their design function or supporting systems are not available.
| |
| The LCO requires the OPERABILITY of a number of independent subsystems.
| |
| Due to the redundancy of trains and the diversity of subsystems, the inoperability of one component in a train does not render the ECCS incapable of performing its function.
| |
| Neither does the inoperability of two different components, each in a different train, necessarily result in a loss of function for the ECCS. The intent of this Condition is to maintain a combination of equipment such that 100% of the ECCS flow equivalent to a single OPERABLE ECCS train remains available.
| |
| This allows increased flexibility in plant operations under circumstances when components in opposite trains are inoperable.
| |
| McGuire Units 1 and 2 B 3.5.2-6 Revision No. 116 McGuire Units 1 and 2 B 3.5.2-6 Revision No. 116 ECCS-Operating B 3.5.2 BASES ACTIONS (continued)
| |
| An event accompanied by a loss of offsite power and the failure of an EDG can disable one ECCS train until power is restored.
| |
| A reliability analysis (Ref. 6) has shown that the impact of having one full ECCS train inoperable is sufficiently small to justify continued operation for 72 hours.Reference 7 describes situations in which one component, such as an RHR crossover valve, can disable both ECCS trains. With one or more component(s) inoperable such that 100% of the flow equivalent to a single OPERABLE ECCS train is not available, the facility is in a condition outside the accident analysis.
| |
| Therefore, LCO 3.0.3 must be immediately entered.B.1 and B.2 If the inoperable trains cannot be returned to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours and MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.SURVEILLANCE SR 3.5.2.1 REQUIREMENTS Verification of proper valve position ensures that the flow path from the ECCS pumps to the RCS is maintained.
| |
| Misalignment of these valves could render both ECCS trains inoperable.
| |
| Securing these valves using the power disconnect switches in the correct position ensures that they cannot change position as a result of an active failure or be inadvertently misaligned.
| |
| These valves are of the type, described in Reference 7, that can disable the function of both ECCS trains and invalidate the accident analyses.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.5.2.2 Verifying the correct alignment for manual, power operated, and automatic valves in the ECCS flow paths provides assurance that the proper flow paths will exist for ECCS operation.
| |
| This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these were verified to be in the correct position prior to locking, sealing, McGuire Units 1 and 2 B 3.5.2-7 Revision No. 116 ECCS-Operating B 3.5.2 BASES SURVEILLANCE REQUIREMENTS (continued) or securing.
| |
| A valve that receives an actuation signal is allowed to be in a nonaccident position provided the valve will automatically reposition within the proper stroke time. This Surveillance does not require any testing or valve manipulation.
| |
| Rather, it involves verification that those valves capable of being mispositioned are in the correct position.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.5.2.3 ECCS piping is verified to be water-filled by venting to remove gas from accessible locations susceptible to gas accumulation.
| |
| Alternative means may be used to verify water-filled conditions (e.g., ultrasonic testing or high point sightglass observation).
| |
| Maintaining the ECCS pumps and piping full of water ensures that the system will perform properly, injecting its full capacity into the RCS upon demand. This will also prevent water hammer, pump cavitation, and pumping of noncondensible gas (e.g., air, nitrogen, or hydrogen) into the reactor vessel following an SI signal or during shutdown cooling. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.5.2.4 Periodic surveillance testing of ECCS pumps to detect gross degradation caused by impeller structural damage or other hydraulic component problems is required by the ASME OM Code. This type of testing may be accomplished by measuring the pump developed head at only one point of the pump characteristic curve. This verifies both that the measured performance is within an acceptable tolerance of the original pump baseline performance and that the performance at the test flow is greater than or equal to the performance assumed in the plant safety analysis.SRs are specified in the Inservice Testing Program, which encompasses the ASME OM Code. The ASME Code provides the activities and Frequencies necessary to satisfy the requirements.
| |
| McGuire Units 1 and 2 B 3.5.2-8 Revision No. 116 ECCS-Operating B 3.5.2 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.5.2.5 and SR 3.5.2.6 These Surveillances demonstrate that each automatic ECCS valve actuates to the required position on an actual or simulated SI signal and that each ECCS pump starts on receipt of an actual or simulated SI signal. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.5.2.7 The position of throttle valves in the flow path on an SI signal is necessary for proper ECCS performance.
| |
| These valves have mechanical locks to ensure proper positioning for restricted flow to a ruptured cold leg, ensuring that the other cold legs receive at least the required minimum flow. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.5.2.8 Periodic inspections of the ECCS containment sump strainer assembly (consisting of modular tophats, grating, plenums and waterboxes) and the associated enclosure (the stainless steel structure surrounding the strainer assembly located inside the crane wall) ensure they are unrestricted and stay in proper operating condition.
| |
| Inspections will consist of a visual examination of the exterior surfaces of the strainer assembly and interior and exterior surfaces of the enclosure for any evidence of debris, structural distress, or abnormal corrosion.
| |
| The intent of the surveillance is to ensure the absence of any condition which could adversely affect strainer functionality.
| |
| Surveillance performance will not require removal of any tophat modules, but the strainer assembly exterior shall be visually inspected.
| |
| This inspection will necessarily entail opening the top of the enclosure to allow access for inspection of the strainers, and to verify cleanliness of the enclosure interior space. A detailed inspection of the enclosure and exterior strainer assembly surfaces is required to establish a high confidence that no adverse conditions are present. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Units 1 and 2 B 3.5.2-9 Revision No. 116 ECCS-Operating B 3.5.2 BASES REFERENCES
| |
| : 1. 10 CFR 50, Appendix A, GDC 35.2. 10 CFR 50.46.3. UFSAR, Section 6.2.1.4. UFSAR, Chapter 15.5. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| : 6. NRC Memorandum to V. Stello, Jr., from R.L. Baer,"Recommended Interim Revisions to LCOs for ECCS Components," December 1, 1975.7. IE Information Notice No. 87-01.McGuire Units 1 and 2 B 3.5.2-10 Revision No. 116 ECCS-Shutdown B 3.5.3 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)B 3.5.3 ECCS-Shutdown BASES BACKGROUND The Background section for Bases 3.5.2, "ECCS--Operating," is applicable to these Bases, with the following modifications.
| |
| In MODE 4, the required ECCS train consists of two separate subsystems:
| |
| centrifugal charging (high head) and residual heat removal (RHR) (low head).The ECCS flow paths consist of piping, valves, heat exchangers, and pumps such that water from the refueling water storage tank (RWST) can be injected into the Reactor Coolant System (RCS) following the accidents described in Bases 3.5.2.APPLICABLE The Applicable Safety Analyses section of Bases 3.5.2 also applies SAFETY ANALYSES to this Bases section.Due to the stable conditions associated with operation in MODE 4 and the reduced probability of occurrence of a Design Basis Accident (DBA), the ECCS operational requirements are reduced. It is understood in these reductions that certain automatic safety injection (SI) actuation is not available.
| |
| In this MODE, sufficient time exists for manual actuation of the required ECCS to mitigate the consequences of a DBA.Only one train of ECCS is required for MODE 4. This requirement dictates that single failures are not considered during this MODE of operation.
| |
| The ECCS trains satisfy Criterion 3 of 10 CFR 50.36.LCO In MODE 4, one of the two independent (and redundant)
| |
| ECCS trains is required to be OPERABLE to ensure that sufficient ECCS flow is available to the core following a DBA.In MODE 4, an ECCS train consists of a centrifugal charging subsystem and an RHR subsystem.
| |
| Each train includes the piping, instruments, and controls to ensure an OPERABLE flow path capable of taking suction from the RWST and transferring suction to the containment sump. During an event requiring ECCS actuation, a flow path is required to provide an abundant supply of water from the RWST to the RCS via the McGuire Units 1 and 2 B 3.5.3-1 Revision No. 57 ECCS -Shutdown B 3.5.3 BASES LCO (continued)
| |
| ECCS pumps and their respective supply headers to each of the four cold leg injection nozzles. In the long term, this flow path may be switched to take its supply from the containment sump and to deliver its flow to the RCS hot and cold legs.APPLICABILITY In MODES 1, 2, and 3, the OPERABILITY requirements for ECCS are covered by LCO 3.5.2.In MODE 4 with RCS temperature below 350 0 F, one OPERABLE ECCS train is acceptable without single failure consideration, on the basis of the stable reactivity of the reactor and the limited core cooling requirements.
| |
| In MODES 5 and 6, plant conditions are such that the probability of an event requiring ECCS injection is extremely low. Core cooling requirements in MODE 5 are addressed by LCO 3.4.7, "RCS Loops-MODE 5, Loops Filled," and LCO 3.4.8, "RCS Loops-MODE 5, Loops Not Filled." MODE 6 core cooling requirements are addressed by LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation-High Water Level," and LCO 3.9.6, "Residual Heat Removal (RHR) and Coolant Circulation-Low Water Level." ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable ECCS centrifugal charging subsystem when entering MODE 4. There is an increased risk associated with entering MODE 4 from MODE 5 with an inoperable ECCS centrifugal charging subsystem and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.
| |
| A.1 With no ECCS RHR subsystem OPERABLE, the plant is not prepared to respond to a loss of coolant accident or to continue a cooldown using the RHR pumps and heat exchangers.
| |
| The Completion Time of immediately to initiate actions that would restore at least one ECCS RHR subsystem to OPERABLE status ensures that prompt action is taken to restore the required cooling capacity.
| |
| Normally, in MODE 4, reactor decay heat is removed from the RCS by an RHR loop. If no RHR loop is OPERABLE for this function, reactor decay heat must be removed by some alternate method, such as use of the steam generators.
| |
| The alternate means of heat removal must continue until the inoperable RHR loop components can be restored to operation so that decay heat removal is continuous.
| |
| McGuire Units 1 and 2 B 3.5.3-2 Revision No. 57 ECCS -Shutdown B 3.5.3 BASES ACTIONS (continued)
| |
| With both RHR pumps and heat exchangers inoperable, it would be unwise to require the plant to go to MODE 5, where the only available heat removal system is the RHR. Therefore, the appropriate action is to initiate measures to restore one ECCS RHR subsystem and to continue the actions until the subsystem is restored to OPERABLE status.B .. _ , With no ECCS high head subsystem OPERABLE, due to the inoperability of the centrifugal charging pump or flow path from the RWST, the plant is not prepared to provide high pressure response to Design Basis Events requiring SI. The 1 hour Completion Time to restore at least one ECCS high head subsystem to OPERABLE status ensures that prompt action is taken to provide the required cooling capacity or to initiate actions to place the plant in MODE 5, where an ECCS train is not required.C.1.When the Required Actions of Condition B cannot be completed within the required Completion Time, a controlled shutdown should be initiated.
| |
| Twenty-four hours is a reasonable time, based on operating experience, to reach MODE 5 in an orderly manner and without challenging plant systems or operators.
| |
| SURVEILLANCE SR 3.5.3.1 REQUIREMENTS The applicable Surveillance descriptions from Bases 3.5.2 apply. This SR is modified by a Note that allows an RHR train to be considered OPERABLE during PIV testing and alignment and operation for decay heat removal, if capable of being manually realigned (remote or local) to the ECCS mode of operation and not otherwise inoperable.
| |
| This allows operation in the RHR mode during MODE 4, if necessary.
| |
| REFERENCES The applicable references from Bases 3.5.2 apply.McGuire Units 1 and 2 B 3.5.3-3 Revision No. 57 UNIT 1 BASES 3.5.4 License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit 1 only during 1 EOC2 1. Until the ECCS amendment can be implemented on Unit 2, there will be separate documents for Unit I and Unit 2 Bases 3.5.4.ECCS Water Management Modification is scheduled to be implemented on Unit 2 during the fall 2012 outage.
| |
| UNIT 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during IEOC2l.Until the ECCS amendment can be implemented on Unit 2, there will be separate Bases documents for Unit I and Unit 2 for Bases 3.3.2, 3.3.3, 3.5.4, 3.6.6, and 3.6.11. ECCS Water Management Modification is scheduled to be implemented on Unit 2 during the fall 2012 outage.RWST B 3.5.4 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)B 3.5.4 Refueling Water Storage Tank (RWST)BASES BACKGROUND The RWST supplies borated water to the Chemical and Volume Control System (CVCS) during abnormal operating conditions, to the refueling pool during refueling and makeup operations, and to the ECCS during accident conditions.
| |
| The RWST supplies both trains of the ECCS through separate supply headers during the injection phase of a loss of coolant accident (LOCA)recovery.
| |
| A motor operated isolation valve is provided in each header to isolate the RWST once the system has been transferred to the recirculation mode. The recirculation mode is entered when pump suction is transferred to the containment sump following receipt of the RWST-Low Level signal. Use of a single RWST to supply both trains of the ECCS is acceptable since the RWST is a passive component, and since injection phase passive failures are not required to be assumed to occur coincidentally with Design Basis Events.The switchover from normal operation to the injection phase of ECCS operation requires changing centrifugal charging pump suction from the CVCS volume control tank (VCT) to the RWST through the use of isolation valves.During normal operation in MODES 1, 2, and 3, the safety injection (SI)and residual heat removal (RHR) pumps are aligned to take suction from the RWST.The ECCS pumps are provided with recirculation lines that ensure each pump can maintain minimum flow requirements when operating at or near shutoff head conditions.
| |
| When the suction for the ECCS pumps is transferred to the containment sump, the RWST flow paths must be isolated to prevent a release of the containment sump contents to the RWST, which could result in a release of contaminants to the atmosphere and the eventual loss of suction head for the ECCS pumps.This LCO ensures that: a. The RWST contains sufficient borated water to support the ECCS during the injection phase;McGuire Unit 1 B 3.5.4-1 Revision No. 117 UNIT 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit 1 only during I EOC2 i.ECCS Water Manauement Modification is scheduled to be imolemented on Unit 2 durin2 the fall 2012 outaoe.RWST B 3.5.4 BASES BACKGROUND (continued)
| |
| : b. Sufficient water volume exists in the containment sump to support continued operation of the ECCS and Containment Spray System pumps at the time of transfer to the recirculation mode of cooling;and c. The reactor remains subcritical following a LOCA.Insufficient water in the RWST could result in insufficient cooling capacity when the transfer to the recirculation mode occurs. Improper boron concentrations could result in a reduction of SDM or excessive boric acid precipitation in the core following the LOCA, as well as excessive caustic stress corrosion of mechanical components and systems inside the containment.
| |
| APPLICABLE During accident conditions, the RWST provides a source of borated SAFETY ANALYSES water to the ECCS pumps. As such, it provides containment cooling and depressurization, core cooling, and replacement inventory and is a source of negative reactivity for reactor shutdown (Ref. 1). The design basis transients and applicable safety analyses concerning each of these systems are discussed in the Applicable Safety Analyses section of B 3.5.2, "ECCS-Operating";
| |
| B 3.5.3, "ECCS-Shutdown".
| |
| These analyses are used to assess changes to the RWST in order to evaluate their effects in relation to the acceptance limits in the analyses.The RWST must also meet volume, boron concentration, and temperature requirements for non-LOCA events. The volume is not an explicit assumption in non-LOCA events since the required volume is a small fraction of the available volume. The deliverable volume limit is set by the LOCA and containment analyses.
| |
| For the RWST, the deliverable volume is different from the total volume contained due to the location of the piping connection.
| |
| The ECCS water boron concentration is an explicit assumption in the main steam line break (MSLB) analysis to ensure the required shutdown capability.
| |
| This assumption is important in ensuring the required shutdown capability.
| |
| Although the maximum temperature is a conservative assumption in the feedwater line break analysis, SI termination occurs very quickly in this analysis and long before significant RCS heatup occurs. The minimum temperature is an assumption in the MSLB actuation analyses.For a large break LOCA analysis, the RWST level setpoint equivalent to the minimum water volume limit of 382,146 gallons and the lower boron concentration limits listed in the COLR are used to compute the post McGuire Unit 1 B 3.5.4-2 Revision No. 117 UNIT 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during I EOC2 1.ECCS Water Management Modification is scheduled to be imolemented on Unit 2 during the fall 2012 outage.RWST B 3.5.4 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| LOCA sump boron concentration necessary to assure subcriticality, with all rods in (crediting control rod assembly insertion), minus the highest worth rod out (ARI N-i). The large cold leg break LOCA is the limiting case since boron accumulation in the core will be maximized during the cold leg recirculation phase due to core boiling. The accumulation of boron in the core prevents the boron from returning to the sump, which leads to a boron diluted sump condition.
| |
| A reduction in the RWST minimum boron concentration would produce a subsequent reduction in the available containment sump concentration for post LOCA shutdown, potentially causing the core to become re-critical by injecting boron diluted sump water into the core when switching over to hot leg recirculation.
| |
| The RWST minimum boron concentration is also used in the post-LOCA subcriticality verification during the injection phase. For each reload cycle, the all rods out (ARO, no credit for control rod assembly insertion) critical boron concentration is verified to be less than the minimum allowed RWST boron concentration.
| |
| No credit is taken for control rod assembly insertion when verifying subcriticality during the injection phase, but credit is taken for control rod assembly insertion in the post-LOCA subcriticality calculation during the sump recirculation phase to offset the boron diluted sump condition described above.The upper limit on boron concentration as listed in the COLR is used to determine the maximum allowable time to switch to hot leg recirculation following a LOCA. The purpose of switching from cold leg to hot leg injection is to avoid boron precipitation in the core following the accident.The RWST temperature limits were originally established with containment spray aligned to the RWST and were not revised when the Containment Spray System became a manually actuated system with the initial suction source changed to the Containment Sump. The RWST temperature limits are contained within additional analyses and remain valid, although the basis is historical and no longer relevant.
| |
| The following paragraph is retained for historical purposes only.In the ECCS analysis, the containment spray temperature is assumed to be equal to the RWST lower temperature limit of 70 0 F. If the lower temperature limit is violated, the containment spray could further reduce containment pressure, which decreases the saturated steam specific volume. This means that each pound of steam generated during core reflood tends to occupy a larger volume, which decreases the rate at which steam can be vented out the break and increases peak clad temperature.
| |
| The upper temperature limit of 1 00°F, plus an allowance for temperature measurement uncertainty, is used in the containment McGuire Unit 1 B 3.5.4-3 Revision No. 117 UNIT 1 -License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during 1 EOC2 1.ECCS Water Management Modification is scheduled to be implemented on Unit 2 during the fall 2012 outage.RWST B 3.5.4 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| OPERABILITY analysis.
| |
| Exceeding this temperature will result in higher containment pressures due to reduced containment spray cooling capacity.
| |
| For the containment response following an MSLB, the lower limit on boron concentration and the upper limit on RWST water temperature are used to maximize the total energy release to containment.
| |
| The RWST satisfies Criterion 3 of 10 CFR 50.36 (Ref. 2).The RWST ensures that an adequate supply of borated water is available to cool and cover the core in the event of a LOCA, to maintain the reactor subcritical following a DBA, and to ensure adequate level in the containment sump to support ECCS and Containment Spray System pump operation in the recirculation mode.To be considered OPERABLE, the RWST must meet the water volume, boron concentration, and temperature limits established in the SRs.LCO APPLICABILITY In MODES 1, 2, 3, and 4, RWST OPERABILITY requirements are dictated by ECCS OPERABILITY requirements.
| |
| Since both the ECCS must be OPERABLE in MODES 1, 2, 3, and 4, the RWST must also be OPERABLE to support their operation.
| |
| Core cooling requirements in MODE 5 are addressed by LCO 3.4.7, "RCS Loops-MODE 5, Loops Filled," and LCO 3.4.8, "RCS Loops-MODE 5, Loops Not Filled." MODE 6 core cooling requirements are addressed by LCO 3.9.5,"Residual Heat Removal (RHR) and Coolant Circulation-High Water Level," and LCO 3.9.6, "Residual Heat Removal (RHR) and Coolant Circulation-Low Water Level." ACTIONS A.1 With RWST boron concentration or borated water temperature not within limits, they must be returned to within limits within 8 hours. Under these conditions neither the ECCS nor the Containment Spray System can perform its design function.
| |
| Therefore, prompt action must be taken to restore the tank to OPERABLE condition.
| |
| The 8 hour limit to restore the RWST temperature or boron concentration to within limits was developed considering the time required to change either the boron concentration or temperature and the fact that the contents of the tank are still available for injection.
| |
| B.1 With the RWST inoperable for reasons other than Condition A (e.g., water volume), it must be restored to OPERABLE status within 1 hour.McGuire Unit 1 B 3.5.4-4 Revision No. 117 UNIT 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during I EOC21.ECCS Water Management Modification is scheduled to be imnlemented on Unit 2 during, the fall 2012 outage.RWST B 3.5.4 BASES ACTIONS (continued)
| |
| In this Condition, the ECCS cannot perform its design function.Therefore, prompt action must be taken to restore the tank to OPERABLE status or to place the plant in a MODE in which the RWST is not required.The short time limit of 1 hour to restore the RWST to OPERABLE status is based on this condition simultaneously affecting redundant trains.C.1 and C.2 If the RWST cannot be returned to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.SURVEILLANCE SR 3.5.4.1 REQUIREMENTS The RWST borated water temperature should be verified to be within the limits assumed in the accident analyses band. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.5.4.2 The RWST water volume should be verified to be above the required minimum level plus instrument uncertainty in order to ensure that a sufficient initial supply is available for injection and to support continued ECCS and Containment Spray System pump operation on recirculation.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.5.4.3 The boron concentration of the RWST should be verified to be within the required limits. This SR ensures that the reactor will remain subcritical following a LOCA and that the boron content assumed for the injection water in the MSLB analysis is available.
| |
| Further, it assures that the resulting sump pH will be maintained in an acceptable range so that boron precipitation in the core will not occur and the effect of chloride and caustic stress corrosion on mechanical systems and components will be minimized.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Unit 1 B 3.5.4-5 Revision No. 117 UNIT I -License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during IEOC2 1.ECCS Water Management Modification is scheduled to be imolemented on Unit 2 during the fall 2012 outage.RWST B 3.5.4 BASES REFERENCES
| |
| : 1. UFSAR, Chapter 6 and Chapter 15.2. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Unit 1 B 3.5.4-6 Revision No. 117 McGuire Unit 1 B 3.5.4-6 Revision No. 117 UNIT 2 BASES 3.5.4 Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012, there will be separate documents for Unit 1 and Unit 2 Bases 3.5.4.ECCS Water Management Modification was implemented on Unit 1 during the IEOC21 outage.
| |
| UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012, there will be separate documents for Unit I and Unit 2 Bases: 3.3.2, 3.3.3, 3.5.4, 3.6.6, and 3.6.11 RWST B 3.5.4 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)B 3.5.4 Refueling Water Storage Tank (RWST)BASES BACKGROUND The RWST supplies borated water to the Chemical and Volume Control System (CVCS) during abnormal operating conditions, to the refueling pool during refueling and makeup operations, and to the ECCS and the Containment Spray System during accident conditions.
| |
| The RWST supplies both trains of the ECCS and the Containment Spray System through separate supply headers during the injection phase of a loss of coolant accident (LOCA) recovery.
| |
| A motor operated isolation valve is provided in each header to isolate the RWST once the system has been transferred to the recirculation mode. The recirculation mode is entered when pump suction is transferred to the containment sump following receipt of the RWST-Low Level signal. Use of a single RWST to supply both trains of the ECCS and Containment Spray System is acceptable since the RWST is a passive component, and since injection phase passive failures are not required to be assumed to occur coincidentally with Design Basis Events.The switchover from normal operation to the injection phase of ECCS operation requires changing centrifugal charging pump suction from the CVCS volume control tank (VCT) to the RWST through the use of isolation valves.During normal operation in MODES 1, 2, and 3, the safety injection (SI)and residual heat removal (RHR) pumps are aligned to take suction from the RWST.The ECCS pumps are provided with recirculation lines that ensure each pump can maintain minimum flow requirements when operating at or near shutoff head conditions.
| |
| When the suction for the ECCS and Containment Spray System pumps is transferred to the containment sump, the RWST flow paths must be isolated to prevent a release of the containment sump contents to the RWST, which could result in a release of contaminants to the atmosphere and the eventual loss of suction head for the ECCS pumps.This LCO ensures that: a. The RWST contains sufficient borated water to support the ECCS during the injection phase;McGuire Unit 2 B 3.5.4-1 Revision No. 115 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled durin, the fall outage of 2012.RWST B 3.5.4 BASES BACKGROUND (continued)
| |
| : b. Sufficient water volume exists in the containment sump to support continued operation of the ECCS and Containment Spray System pumps at the time of transfer to the recirculation mode of cooling;and c. The reactor remains subcritical following a LOCA.Insufficient water in the RWST could result in insufficient cooling capacity when the transfer to the recirculation mode occurs. Improper boron concentrations could result in a reduction of SDM or excessive boric acid precipitation in the core following the LOCA, as well as excessive caustic stress corrosion of mechanical components and systems inside the containment.
| |
| APPLICABLE SAFETY ANALYSES During accident conditions, the RWST provides a source of borated water to the ECCS and Containment Spray System pumps. As such, it provides containment cooling and depressurization, core cooling, and replacement inventory and is a source of negative reactivity for reactor shutdown (Ref. 1). The design basis transients and applicable safety analyses concerning each of these systems are discussed in the Applicable Safety Analyses section of B 3.5.2, "ECCS-Operating";
| |
| B 3.5.3, "ECCS-Shutdown, and B 3.6.6, "Containment Spray Systems." These analyses are used to assess changes to the RWST in order to evaluate their effects in relation to the acceptance limits in the analyses.The RWST must also meet volume, boron concentration, and temperature requirements for non-LOCA events. The volume is not an explicit assumption in non-LOCA events since the required volume is a small fraction of the available volume. The deliverable volume limit is set by the LOCA and containment analyses.
| |
| For the RWST, the deliverable volume is different from the total volume contained due to the location of the piping connection.
| |
| The ECCS water boron concentration is an explicit assumption in the main steam line break (MSLB) analysis to ensure the required shutdown capability.
| |
| This assumption is important in ensuring the required shutdown capability.
| |
| Although the maximum temperature is a conservative assumption in the feedwater line break analysis, SI termination occurs very quickly in this analysis and long before significant RCS heatup occurs. The minimum temperature is an assumption in the MSLB actuation analyses.For a large break LOCA analysis, the RWST level setpoint equivalent to the minimum water volume limit of 372,100 gallons and the lower boron concentration limits listed in the COLR are used to compute the post McGuire Unit 2 B 3.5.4-2 Revision No. 115 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled durin, the fall outage of 2012.RWST B 3.5.4 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| LOCA sump boron concentration necessary to assure subcriticality, with all rods in (crediting control rod assembly insertion), minus the highest worth rod out (ARI N-i). The large cold leg break LOCA is the limiting case since boron accumulation in the core will be maximized during the cold leg recirculation phase due to core boiling. The accumulation of boron in the core prevents the boron from returning to the sump, which leads to a boron diluted sump condition.
| |
| A reduction in the RWST minimum boron concentration would produce a subsequent reduction in the available containment sump concentration for post LOCA shutdown, potentially causing the core to become re-critical by injecting boron diluted sump water into the core when switching over to hot leg recirculation.
| |
| The RWST minimum boron concentration is also used in the post-LOCA subcriticality verification during the injection phase. For each reload cycle, the all rods out (ARO, no credit for control rod assembly insertion) critical boron concentration is verified to be less than the minimum allowed RWST boron concentration.
| |
| No credit is taken for control rod assembly insertion when verifying subcriticality during the injection phase, but credit is taken for control rod assembly insertion in the post-LOCA subcriticality calculation during the sump recirculation phase to offset the boron diluted sump condition described above.The upper limit on boron concentration as listed in the COLR is used to determine the maximum allowable time to switch to hot leg recirculation following a LOCA. The purpose of switching from cold leg to hot leg injection is to avoid boron precipitation in the core following the accident.In the ECCS analysis, the containment spray temperature is assumed to be equal to the RWST lower temperature limit of 70 0 F. If the lower temperature limit is violated, the containment spray further reduces containment pressure, which decreases the saturated steam specific volume. This means that each pound of steam generated during core reflood tends to occupy a larger volume, which decreases the rate at which steam can be vented out the break and increases peak clad temperature.
| |
| The upper temperature limit of 100°F, plus an allowance for temperature measurement uncertainty, is used in the containment OPERABILITY analysis.
| |
| Exceeding this temperature will result in higher containment pressures due to reduced containment spray cooling capacity.
| |
| For the containment response following an MSLB, the lower limit on boron concentration and the upper limit on RWST water temperature are used to maximize the total energy release to containment.
| |
| The RWST satisfies Criterion 3 of 10 CFR 50.36 (Ref. 2).McGuire Unit 2 B 3.5.4-3 Revision No. 115 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled durin. the fall outaie of 2012.RWST B 3.5.4 BASES LCO The RWST ensures that an adequate supply of borated water is available to cool and depressurize the containment in the event of a Design Basis Accident (DBA), to cool and cover the core in the event of a LOCA, to maintain the reactor subcritical following a DBA, and to ensure adequate level in the containment sump to support ECCS and Containment Spray System pump operation in the recirculation mode.To be considered OPERABLE, the RWST must meet the water volume, boron concentration, and temperature limits established in the SRs.APPLICABILITY In MODES 1, 2, 3, and 4, RWST OPERABILITY requirements are dictated by ECCS and Containment Spray System OPERABILITY requirements.
| |
| Since both the ECCS and the Containment Spray System must be OPERABLE in MODES 1, 2, 3, and 4, the RWST must also be OPERABLE to support their operation.
| |
| Core cooling requirements in MODE 5 are addressed by LCO 3.4.7, "RCS Loops-MODE 5, Loops Filled," and LCO 3.4.8, "RCS Loops-MODE 5, Loops Not Filled." MODE 6 core cooling requirements are addressed by LCO 3.9.5,"Residual Heat Removal (RHR) and Coolant Circulation-High Water Level," and LCO 3.9.6, "Residual Heat Removal (RHR) and Coolant Circulation-Low Water Level." ACTIONS A.1 With RWST boron concentration or borated water temperature not within limits, they must be returned to within limits within 8 hours. Under these conditions neither the ECCS nor the Containment Spray System can perform its design function.
| |
| Therefore, prompt action must be taken to restore the tank to OPERABLE condition.
| |
| The 8 hour limit to restore the RWST temperature or boron concentration to within limits was developed considering the time required to change either the boron concentration or temperature and the fact that the contents of the tank are still available for injection.
| |
| B. 1 With the RWST inoperable for reasons other than Condition A (e.g., water volume), it must be restored to OPERABLE status within 1 hour.In this Condition, neither the ECCS nor the Containment Spray System can perform its design function.
| |
| Therefore, prompt action must be taken to restore the tank to OPERABLE status or to place the plant in a MODE in which the RWST is not required.
| |
| The short time limit of 1 hour to McGuire Unit 2 B 3.5.4-4 Revision No. 115 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled durini, the fall outaae of 2012.RWST B 3.5.4 BASES ACTIONS (continued) restore the RWST to OPERABLE status is based on this condition simultaneously affecting redundant trains.C.1 and C.2 If the RWST cannot be returned to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.SURVEILLANCE SR 3.5.4.1 REQUIREMENTS The RWST borated water temperature should be verified to be within the limits assumed in the accident analyses band. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.5.4.2 The RWST water volume should be verified to be above the required minimum level in order to ensure that a sufficient initial supply is available for injection and to support continued ECCS and Containment Spray System pump operation on recirculation.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.5.4.3 The boron concentration of the RWST should be verified to be within the required limits. This SR ensures that the reactor will remain subcritical following a LOCA and that the boron content assumed for the injection water in the MSLB analysis is available.
| |
| Further, it assures that the resulting sump pH will be maintained in an acceptable range so that boron precipitation in the core will not occur and the effect of chloride and caustic stress corrosion on mechanical systems and components will be minimized.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Unit 2 B 3.5.4-5 Revision No. 115 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled durin, the fall outage of 2012.RWST B 3.5.4 BASES REFERENCES
| |
| : 1. UFSAR, Chapter 6 and Chapter 15.2. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Unit 2 B 3.5.4-6 Revision No. 115 Seal Injection Flow B 3.5.5 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)B 3.5.5 Seal Injection Flow BASES BACKGROUND This LCO is applicable only to those units that utilize the centrifugal charging pumps for safety injection (SI). The function of the seal injection throttle valves during an accident is similar to the function of the ECCS throttle valves in that each restricts flow from the centrifugal charging pump header to the Reactor Coolant System (RCS).The restriction on reactor coolant pump (RCP) seal injection flow limits the amount of ECCS flow that would be diverted from the injection path following an accident.
| |
| This limit is based on safety analysis assumptions that are required because RCP seal injection flow is not isolated during SI.APPLICABLE All ECCS subsystems are taken credit for in the large break loss of SAFETY ANALYSES coolant accident (LOCA) at full power (Ref. 1). The LOCA analysis establishes the minimum flow for the ECCS pumps. The centrifugal charging pumps are also credited in the small break LOCA analysis.
| |
| This analysis establishes the flow and discharge head at the design point for the centrifugal charging pumps. The steam generator tube rupture and main steam line break event analyses also credit the centrifugal charging pumps, but do not set the limits on their flow requirements.
| |
| Reference to these analyses is made in assessing changes to the Seal Injection System for evaluation of their effects in relation to the acceptance limits in these analyses.This LCO ensures that seal injection flow of _ 40 gpm, with centrifugal charging pump operating and charging flow control valve full open, will be sufficient for RCP seal integrity but limited so that the ECCS trains will be capable of delivering sufficient water to match boiloff rates soon enough to minimize uncovering of the core following a large LOCA. It also ensures that the centrifugal charging pumps will deliver sufficient water for a small LOCA and sufficient boron to maintain the core subcritical for a large LOCA. For smaller LOCAs, the charging pumps alone deliver sufficient fluid to overcome the loss and maintain RCS inventory.
| |
| Seal injection flow satisfies Criterion 2 of 10 CFR 50.36 (Ref. 2).McGuire Units 1 and 2 B 3.5.5-1 Revision No. 115 Seal Injection Flow B 3.5.5 BASES LCO The intent of the LCO limit on seal injection flow is to make sure that flow through the RCP seal water injection line is low enough to ensure that sufficient centrifugal charging pump injection flow is directed to the RCS via the injection points (Ref. 3).The LCO is not strictly a flow limit, but rather a flow limit based on a flow line resistance.
| |
| In order to establish the proper flow line resistance, a minimum pressure differential and flow must be known. The flow line resistance is determined by assuming that the RCS pressure is at normal operating pressure and that the centrifugal charging pump discharge pressure is greater than or equal to the applicable value specified in the test acceptance criteria.
| |
| Since the test acceptance criteria head curve ensures the centrifugal charging pumps are capable of delivering the flow assumed in the LOCA analyses, the minimum pressure differential is satisfied by verifying the centrifugal charging pump is operating.
| |
| A reduction in RCS pressure would result in more flow being diverted to the RCP seal injection line than at normal operating pressure.
| |
| The valve settings established at the prescribed minimum pressure differential result in a conservative valve position should RCS pressure decrease.
| |
| The additional modifier of this LCO, the charging flow control valve being full open, is required since the valve is designed to fail open unless motive air is available.
| |
| With the operating pump and control valve position as specified by the LCO, a flow limit is established.
| |
| It is this flow limit that is used in the accident analyses.The limit on seal injection flow, combined with the minimum pressure differential and an open wide condition of the charging flow control valve, must be met to render the ECCS OPERABLE.
| |
| If these conditions are not met, the ECCS flow might not be as much as assumed in the accident analyses.APPLICABILITY In MODES 1, 2, and 3, the seal injection flow limit is dictated by ECCS flow requirements, which are specified for MODES 1, 2, 3, and 4. The seal injection flow limit is not applicable for MODE 4 and lower, however, because high seal injection flow is less critical as a result of the lower initial RCS pressure and decay heat removal requirements in these MODES. Therefore, RCP seal injection flow must be limited in MODES 1, 2, and 3 to ensure adequate ECCS performance.
| |
| ACTIONS A..1 With the seal injection flow exceeding its limit, the amount of high head safety injection flow available to the RCS may be reduced. Under this Condition, action must be taken to restore the flow to below its limit. The McGuire Units 1 and 2 B 3.5.5-2 Revision No. 115 Seal Injection Flow B 3.5.5 BASES ACTIONS (continued) operator has 4 hours from the time the flow is known to be above the limit to correctly position the manual valves and thus be in compliance with the accident analysis.
| |
| The Completion Time minimizes the potential exposure of the plant to a LOCA with insufficient injection flow and provides a reasonable time to restore seal injection flow within limits.This time is conservative with respect to the Completion Times of other ECCS LCOs; it is based on operating experience and is sufficient for taking corrective actions by operations personnel.
| |
| B.1 and B.2 When the Required Actions cannot be completed within the required Completion Time, a controlled shutdown must be initiated.
| |
| The Completion Time of 6 hours for reaching MODE 3 from MODE I is a reasonable time for a controlled shutdown, based on operating experience and normal cooldown rates, and does not challenge plant safety systems or operators.
| |
| Continuing the plant shutdown begun in Required Action B.1, an additional 6 hours is a reasonable time, based on operating experience and normal cooldown rates, to reach MODE 4, where this LCO is no longer applicable.
| |
| SURVEILLANCE SR 3.5.5.1 REQUIREMENTS Verification that the manual seal injection throttle valves are adjusted to give a flow within the limit ensures that proper manual seal injection throttle valve position, and hence, proper seal injection flow, is maintained.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.As noted, the Surveillance is required to be performed within 4 hours after the RCS pressure has stabilized within a +/- 20 psig range of normal operating pressure.
| |
| The RCS pressure requirement is specified since this configuration will produce the required pressure conditions necessary to assure that the manual valves are set correctly.
| |
| The exception is limited to 4 hours to ensure that the Surveillance is timely.McGuire Units 1 and 2 B 3.5.5-3 Revision No. 115 Seal Injection Flow B 3.5.5 BASES REFERENCES 1.2.3.UFSAR, Chapter 6 and Chapter 15.10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| 10 CFR 50.46.McGuire Units 1 and 2 B 3.5.5-4 Revision No. 115 Containment B 3.6.1 B 3.6 CONTAINMENT SYSTEMS B 3.6.1 Containment BASES BACKGROUND The containment is a free standing steel pressure vessel surrounded by a reinforced concrete reactor building.
| |
| The containment vessel, including all its penetrations, is a low leakage steel shell designed to contain the radioactive material that may be released from the reactor core following a design basis Loss of Coolant Accident (LOCA).Additionally, the containment vessel and reactor building provide shielding from the fission products that may be present in the containment atmosphere following accident conditions.
| |
| The containment vessel is a vertical cylindrical steel pressure vessel with hemispherical dome and a flat circular base. It is completely enclosed by a reinforced concrete reactor building.
| |
| An annular space exists between the walls and domes of the steel containment vessel and the concrete reactor building to provide for the collection, mixing, holdup, and controlled release of containment out leakage. Ice condenser containments utilize an outer concrete building for shielding and an inner steel containment for leak tightness.
| |
| Containment piping penetration assemblies provide for the passage of process, service, sampling, and instrumentation pipelines into the containment vessel while maintaining containment integrity.
| |
| The reactor building provides shielding and allows controlled release of the annulus atmosphere under accident conditions, as well as environmental missile protection for the containment vessel and Nuclear Steam Supply System.The inner steel containment and its penetrations establish the leakage limiting boundary of the containment.
| |
| Maintaining the containment OPERABLE limits the leakage of fission product radioactivity from the containment to the environment.
| |
| SR 3.6.1.1 leakage rate requirements comply with 10 CFR 50, Appendix J, Option B (Ref. 1), as modified by approved as above exemptions.
| |
| The isolation devices for the penetrations in the containment boundary are a part of the containment leak tight barrier. To maintain this leak tight barrier: a. All penetrations required to be closed during accident conditions are either: McGuire Units 1 and 2 B 3.6. 1-1 Revision No. 53 Containment B 3.6.1 BASES BACKGROUND (continued)
| |
| : 1. capable of being closed by an OPERABLE automatic containment isolation system, or 2. closed by manual valves, blind flanges, or de-activated automatic valves secured in their closed positions, except as provided in LCO 3.6.3, "Containment Isolation Valves";b. Each air lock is OPERABLE, except as provided in LCO 3.6.2,"Containment Air Locks";C. All equipment hatches are closed and sealed; and d. The sealing mechanism associated with a penetration (e.g., welds, bellows, or O-rings) is OPERABLE.APPLICABLE The safety design basis for the containment is that the containment must SAFETY ANALYSES withstand the pressures and temperatures of the limiting Design Basis Accident (DBA) without exceeding the design leakage rates.The DBAs that result in a challenge to containment OPERABILITY from high pressures and temperatures are a loss of coolant accident (LOCA)and a steam line break (Ref. 2). In addition, release of significant fission product radioactivity within containment can occur from a LOCA. In the DBA analyses, it is assumed that the containment is OPERABLE such that, for the DBAs involving release of fission product radioactivity, release to the environment is controlled by the rate of containment leakage. The containment was designed with an allowable leakage rate of 0.3% of containment air weight per day (Ref. 3). This leakage rate, used in the evaluation of offsite doses resulting from accidents, is defined in 10 CFR 50, Appendix J, Option B (Ref. 1), as La: the maximum allowable containment leakage rate at the calculated peak containment internal pressure (Pa) resulting from the limiting design basis LOCA. The allowable leakage rate represented by La forms the basis for the acceptance criteria imposed on all containment leakage rate testing. La is assumed to be 0.3% per day in the safety analysis at Pa = 14.8 psig (Ref. 3). Satisfactory leakage rate test results are a requirement for the establishment of containment OPERABILITY.
| |
| The containment satisfies Criterion 3 of 10 CFR 50.36 (Ref. 4).McGuire Units 1 and 2 B 3.6.1-2 Revision No. 53 Containment B 3.6.1 BASES LCO Containment OPERABILITY is maintained by limiting leakage to < 1.0 La, except prior to the first startup after performing a required Containment Leakage Rate Testing Program leakage test. At this time, the applicable leakage limits must be met.Compliance with this LCO will ensure a containment configuration, including equipment hatches, that is structurally sound and that will limit leakage to those leakage rates assumed in the safety analysis.Individual leakage rates specified for the containment air lock (LCO 3.6.2), purge valves with resilient seals, and reactor building bypass leakage (LCO 3.6.3) are not specifically part of the acceptance criteria of 10 CFR 50, Appendix J. Therefore, leakage rates exceeding these individual limits only result in the containment being inoperable when the leakage results in exceeding the overall acceptance criteria of 1.0 La.APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material into containment.
| |
| In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, containment is not required to be OPERABLE in MODE 5 to prevent leakage of radioactive material from containment.
| |
| The requirements for containment during MODE 6 are addressed in LCO 3.9.4, "Containment Penetrations." ACTIONS A. 1 In the event containment is inoperable, containment must be restored to OPERABLE status within 1 hour. The 1 hour Completion Time provides a period of time to correct the problem commensurate with the importance of maintaining containment OPERABLE during MODES 1, 2, 3, and 4. This time period also ensures that the probability of an accident (requiring containment OPERABILITY) occurring during periods when containment is inoperable is minimal.B.1 and B.2 If containment cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within McGuire Units 1 and 2 B 3.6.1-3 Revision No. 53 Containment B 3.6.1 BASES ACTIONS (continued) 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.SURVEILLANCE SR 3.6.1.1 REQUIREMENTS Maintaining the containment OPERABLE requires compliance with the visual examinations and leakage rate test requirements of the Containment Leakage Rate Testing Program. Failure to meet specific leakage limits for the air lock, secondary containment bypass leakage path, and purge valve with resilient seals (as specified in LCO 3.6.2 and LCO 3.6.3) does not invalidate the acceptability of the overall containment leakage determinations unless the specific leakage contribution to overall Type A, B, and C leakage causes one of these overall leakage limits to be exceeded.
| |
| As left leakage prior to the first startup after performing a required Containment Leakage Rate Testing Program leakage test is required to be < 0.6 La for combined Type B and C leakage, and < 0.75 La for Option B for overall Type A leakage.At all other times between required leakage rate tests, the acceptance criteria is based on an overall Type A leakage limit of < 1.0 L,. At < 1.0 La the offsite dose consequences are bounded by the assumptions of the safety analysis.
| |
| SR Frequencies are as required by the Containment Leakage Rate Testing Program. These periodic testing requirements verify that the containment leakage rate does not exceed the leakage rate assumed in the safety analysis.The Surveillance is modified by three Notes.Note 1 requires that the space between each duel-ply bellows assembly on containment penetrations between the containment building and the annulus be vented to the annulus during each Type A test.Note 2 requires that following each Type A test, the space between each dual-ply bellows assembly be subjected to a low pressure leak test with no detectable leakage. Otherwise, the assembly must be tested with the containment side of the bellows assembly pressurized to P 8 and meet the requirements of SR 3.6.3.8 (bypass leakage requirements).
| |
| Note 3 allows penetrations M372 and M373 to be tested without draining the glycol-water mixture from the associated diaphragm valves (NF-288A, NF-233B and NF-234A) as long as not leakage is indicated.
| |
| This test may be used in lieu of 10 CFR 50, Appendix J, Option B as defined McGuire Units 1 and 2 B 3.6.1-4 Revision No. 53 Containment B 3.6.1 BASES SURVEILLANCE REQUIREMENTS (continued) in ANSI/ANS 56.8-1994 Section 3.3.5 (Test Medium). The required test pressure and interval are not changed.All test leakage rates shall be calculated using observed data converted to absolute values. Error analysis shall also be performed to select a balanced integrated leakage measurement system.REFERENCES
| |
| : 1. 10 CFR 50, Appendix J, Option B.2. UFSAR, Chapter 15.3. UFSAR, Section 6.2.4. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| : 5. UFSAR, Table 18-1.6. McGuire License Renewal Commitments MCS-1274.00-00-0016, Section 4.8, Containment Leak Rate Testing Program.McGuire Units 1 and 2 B 3.6.1-5 Revision No. 53 Containment Air Locks B 3.6.2 B 3.6 CONTAINMENT SYSTEMS B 3.6.2 Containment Air Locks BASES BACKGROUND Containment air locks form part of the containment pressure boundary and provide a means for personnel access during all MODES of operation.
| |
| Each air lock is nominally a right circular cylinder, 10 ft in diameter, with a door at each end. The doors are interlocked to prevent simultaneous opening. During periods when containment is not required to be OPERABLE, the door interlock mechanism may be disabled, allowing both doors of an air lock to remain open for extended periods when frequent containment entry is necessary.
| |
| Each air lock door has been designed and tested to certify its ability to withstand a pressure in excess of the maximum expected pressure following a Design Basis Accident (DBA) in containment.
| |
| As such, closure of a single door supports containment OPERABILITY.
| |
| Each of the doors contains double inflatable seals and local leakage rate testing capability to ensure pressure integrity.
| |
| Each personnel air lock is provided with limit switches on both doors that provide control room indication of door position.
| |
| Additionally, control room indication is provided to alert the operator whenever an air lock door interlock mechanism is defeated.The containment air locks form part of the containment pressure boundary.
| |
| As such, air lock integrity and leak tightness is essential for maintaining the containment leakage rate within limit in the event of a DBA. Not maintaining air lock integrity or leak tightness may result in a leakage rate in excess of that assumed in the unit safety analyses.APPLICABLE The DBAs that result in a release of radioactive material within SAFETY ANALYSES containment are a loss of coolant accident and a rod ejection accident (Ref. 2). In the analysis of each of these accidents, it is assumed that containment is OPERABLE such that release of fission products to the environment is controlled by the rate of containment leakage. The containment was designed with an allowable leakage rate of 0.3% of containment air weight per day (Ref. 2). This leakage rate is McGuire Units 1 and 2 B 3.6.2-1 Revision No. 115 Containment Air Locks B 3.6.2 BASES APPLICABLE SAFETY ANALYSES (continued) defined in 10 CFR 50, Appendix J, Option B (Ref. 1), as La = 0.3% of containment air weight per day, the maximum allowable containment leakage rate at the calculated peak containment internal pressure Pa = 14.8 psig following a design basis LOCA.. This allowable leakage rate forms the basis for the acceptance criteria imposed on the SRs associated with the air locks.The containment air locks satisfy Criterion 3 of 10 CFR 50.36 (Ref. 3).LCO Each containment air lock forms part of the containment pressure boundary.
| |
| As part of the containment pressure boundary, the air lock safety function is related to control of the containment leakage rate resulting from a DBA. Thus, each air lock's structural integrity and leak tightness are essential to the successful mitigation of such an event.Each air lock is required to be OPERABLE.
| |
| For the air lock to be considered OPERABLE, the air lock interlock mechanism must be OPERABLE, the air lock must be in compliance with the Type B air lock leakage test, and both air lock doors must be OPERABLE.
| |
| The interlock allows only one air lock door of an air lock to be opened at one time. This provision ensures that a gross breach of containment does not exist when containment is required to be OPERABLE.
| |
| Closure of a single door in each air lock is sufficient to provide a leak tight barrier following postulated events. Nevertheless, both doors are kept closed when the air lock is not being used for normal entry into or exit from containment.
| |
| APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment.
| |
| In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, the containment air locks are not required in MODE 5 to prevent leakage of radioactive material from containment.
| |
| The requirements for the containment air locks during MODE 6 are addressed in LCO 3.9.4, "Containment Penetrations." ACTIONS The ACTIONS are modified by a Note that allows entry and exit to perform repairs on the affected air lock component.
| |
| If the outer door is inoperable, then it may be easily accessed for most repairs. It is preferred that the air lock be accessed from inside primary containment by entering through the other OPERABLE air lock. However, if this is not practicable, or if repairs on either door must be performed from the barrel McGuire Units 1 and 2 B 3.6.2-2 Revision No. 115 Containment Air Locks B 3.6.2 BASES ACTIONS (continued) side of the door then it is permissible to enter the air lock through the OPERABLE door, which means there is a short time during which the containment boundary is not intact (during access through the OPERABLE door). The ability to open the OPERABLE door, even if it means the containment boundary is temporarily not intact, is acceptable due to the low probability of an event that could pressurize the containment during the short time in which the OPERABLE door is expected to be open. After each entry and exit, the OPERABLE door must be immediately closed. If ALARA conditions permit, entry and exit should be via an OPERABLE air lock.A second Note has been added to provide clarification that, for this LCO, separate Condition entry is allowed for each air lock. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable air lock. Complying with the Required Actions may allow for continued operation, and a subsequent inoperable air lock is governed by subsequent Condition entry and application of associated Required Actions.In the event the air lock leakage results in exceeding the overall containment leakage rate, Note 3 directs entry into the applicable Conditions and Required Actions of LCO 3.6.1, "Containment." A.1, A.2, and A.3 With one air lock door in one or more containment air locks inoperable, the OPERABLE door must be verified closed (Required Action A.1) in each affected containment air lock. This ensures that a leak tight containment barrier is maintained by the use of an OPERABLE air lock door. This action must be completed within 1 hour. This specified time period is consistent with the ACTIONS of LCO 3.6.1, which requires containment be restored to OPERABLE status within 1 hour.Note that for the purpose of Required Action A.1, A.2, and A.3, the bulkhead associated with an air lock door is considered to be part of the door. For example, an air lock door may be declared inoperable if the equalizing valve becomes inoperable or if it is replaced.
| |
| It is appropriate to treat the associated bulkhead as part of the door because a leak path through the bulkhead is no different than a leak path past the door seals.The remaining OPERABLE door/bulkhead provides the necessary barrier between the containment atmosphere and the environs.McGuire Units 1 and 2 B 3.6.2-3 Revision No. 115 Containment Air Locks B 3.6.2 BASES ACTIONS (continued)
| |
| In addition, the affected air lock penetration must be isolated by locking closed the OPERABLE air lock door within the 24 hour Completion Time.The 24 hour Completion Time is reasonable for locking the OPERABLE air lock door, considering the OPERABLE door of the affected air lock is being maintained closed.Required Action A.3 verifies that an air lock with an inoperable door has been isolated by the use of a locked and closed OPERABLE air lock door. This ensures that an acceptable containment leakage boundary is maintained.
| |
| The Completion Time of once per 31 days is based on engineering judgment and is considered adequate in view of the low likelihood of a locked door being mispositioned and other administrative controls.
| |
| Required Action A.3 is modified by a Note that applies to air lock doors located in high radiation areas and allows these doors to be verified locked closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted.
| |
| Therefore, the probability of misalignment of the door, once it has been verified to be in the proper position, is small.The Required Actions have been modified by two Notes. Note 1 ensures that only the Required Actions and associated Completion Times of Condition C are required if both doors in the same air lock are inoperable.
| |
| With both doors in the same air lock inoperable, an OPERABLE door is not available to be closed. Required Actions C.1 and C.2 are the appropriate remedial actions. The exception of Note 1 does not affect tracking the Completion Time from the initial entry into Condition A; only the requirement to comply with the Required Actions. Note 2 allows use of the air lock for entry and exit for 7 days under administrative controls if both air locks have an inoperable door. This 7 day restriction begins when the second air lock is discovered inoperable.
| |
| Containment entry may be required on a periodic basis to perform Technical Specifications (TS) Surveillances and Required Actions, as well as other activities on equipment inside containment that are required by TS or activities on equipment that support TS-required equipment.
| |
| This Note is not intended to preclude performing other activities (i.e., non-TS-required activities) if the containment is entered, using the inoperable air lock, to perform an allowed activity listed above. This allowance is acceptable due to the low probability of an event that could pressurize the containment during the short time that the OPERABLE door is expected to be open.McGuire Units 1 and 2 B83.6.2-4 Revision No. 115 Containment Air Locks B 3.6.2 BASES ACTIONS (continued)
| |
| B.1, B.2, and B.3 With an air lock interlock mechanism inoperable in one or more air locks, the Required Actions and associated Completion Times are consistent with those specified in Condition A.The Required Actions have been modified by two Notes. Note 1 ensures that only the Required Actions and associated Completion Times of Condition C are required if both doors in the same air lock are inoperable.
| |
| With both doors in the same air lock inoperable, an OPERABLE door is not available to be closed. Required Actions C.1 and C.2 are the appropriate remedial actions. Note 2 allows entry into and exit from containment under the control of a dedicated individual stationed at the air lock to ensure that only one door is opened at a time (i.e., the individual performs the function of the interlock).
| |
| Required Action B.3 is modified by a Note that applies to air lock doors located in high radiation areas and allows these doors to be verified locked closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted.
| |
| Therefore, the probability of misalignment of the door, once it has been verified to be in the proper position, is small.C.1, C.2, and C.3 With one or more air locks inoperable for reasons other than those described in Condition A or B, Required Action C.1 requires action to be initiated immediately to evaluate previous combined leakage rates using current air lock test results. An evaluation is acceptable, since it is overly conservative to immediately declare the containment inoperable if both doors in an air lock have failed a seal test or if the overall air lock leakage is not within limits. In many instances (e.g., only one seal per door has failed), containment remains OPERABLE, yet only 1 hour (per LCO 3.6.1)would be provided to restore the air lock door to OPERABLE status prior to requiring a plant shutdown.
| |
| In addition, even with both doors failing the seal test, the overall containment leakage rate can still be within limits.Required Action C.2 requires that one door in the affected containment air lock must be verified to be closed within the 1 hour Completion Time.This specified time period is consistent with the ACTIONS of LCO 3.6.1, which requires that containment be restored to OPERABLE status within 1 hour.McGuire Units 1 and 2 B 3.6.2-5 Revision No. 115 Containment Air Locks B 3.6.2 BASES ACTIONS (continued)
| |
| Additionally, the affected air lock(s) must be restored to OPERABLE status within the 24 hour Completion Time. The specified time period is considered reasonable for restoring an inoperable air lock to OPERABLE)status, assuming that at least one door is maintained closed in each affected air lock.D.1 and D.2 If the inoperable containment air lock cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.SURVEILLANCE SR 3.6.2.1 REQUIREMENTS Maintaining containment air locks OPERABLE requires compliance with the leakage rate test requirements of the Containment Leakage Rate Testing Program. This SR reflects the leakage rate testing requirements with regard to air lock leakage (Type B leakage tests). The acceptance criteria were established during initial air lock and containment OPERABILITY testing. The periodic testing requirements verify that the air lock leakage does not exceed the allowed fraction of the overall containment leakage rate. The Frequency is required by the Containment Leakage Rate Testing Program.The SR has been modified by two Notes. Note 1 states that an inoperable air lock door does not invalidate the previous successful performance of the overall air lock leakage test. This is considered reasonable since either air lock door is capable of providing a fission product barrier in the event of a DBA. Note 2 has been added to this SR requiring the results to be evaluated against the acceptance criteria which are applicable to SR 3.6.1.1. This ensures that air lock leakage is properly accounted for in determining the combined Type B and C containment leakage rate.SR 3.6.2.2 Door seals must be tested to verify the integrity of the inflatable door seal.The measured leakage rate must be less than 15 standard cubic centimeters per minute (sccm) per door seal when the seal is inflated McGuire Units 1 and 2 B 3.6.2-6 Revision No. 115 Containment Air Locks B 3.6.2 BASES SURVEILLANCE REQUIREMENTS (continued) to approximately 85 psig. This ensures that the seals will remain inflated for at least 7 days should the instrument air supply to the seals be lost. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.6.2.3 The air lock interlock is designed to prevent simultaneous opening of both doors in a single air lock. Since both the inner and outer doors of an air lock are designed to withstand the maximum expected post accident containment pressure, closure of either door will support containment OPERABILITY.
| |
| Thus, the door interlock feature supports containment OPERABILITY while the air lock is being used for personnel transit in and out of the containment.
| |
| Periodic testing of this interlock demonstrates that the interlock will function as designed and that simultaneous opening of the inner and outer doors will not inadvertently occur. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. 10 CFR 50, Appendix J, Option B.2. UFSAR, Section 6.2.3. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.6.2-7 Revision No. 115 Containment Isolation Valves B 3.6.3 B 3.6 CONTAINMENT SYSTEMS B 3.6.3 Containment Isolation Valves BASES BACKGROUND The containment isolation valves form part of the containment pressure boundary and provide a means for fluid penetrations not serving accident consequence limiting systems to be provided with two isolation barriers that are closed on a containment isolation signal. These isolation devices are either passive or active (automatic).
| |
| Manual valves, de-activated automatic valves secured in their closed position (including check valves with flow through the valve secured), blind flanges, and closed systems are considered passive devices. Check valves, or other automatic valves designed to close without operator action following an accident, are considered active devices. Two barriers in series are provided for each penetration so that no single credible failure or malfunction of an active component can result in a loss of isolation or leakage that exceeds limits assumed in the safety analyses.
| |
| One of these barriers may be a closed system. These barriers (typically containment isolation valves) make up the Containment Isolation System.Automatic isolation signals are produced during accident conditions.
| |
| Containment Phase "A" isolation occurs upon receipt of a safety injection signal. The Phase "A" isolation signal isolates nonessential process lines in order to minimize leakage of fission product radioactivity.
| |
| Containment Phase "B" isolation occurs upon receipt of a containment pressure High-High signal and isolates the remaining process lines, except systems required for accident mitigation.
| |
| In addition to the Phase "A" isolation signal, the purge and exhaust valves receive an isolation signal on a containment high radiation condition.
| |
| As a result, the containment isolation valves (and blind flanges) help ensure that the containment atmosphere will be isolated from the environment in the event of a release of fission product radioactivity to the containment atmosphere as a result of a Design Basis Accident (DBA).The OPERABILITY requirements for containment isolation valves help ensure that containment is isolated within the time limits assumed in the safety analyses.
| |
| Therefore, the OPERABILITY requirements provide assurance that the containment function assumed in the safety analyses will be maintained.
| |
| McGuire Units 1 and 2 B 3.6.3-1 Revision No. 115 Containment Isolation Valves B 3.6.3 BASES BACKGROUND (continued)
| |
| Containment Purge System The Containment Purge System operates to supply outside air into the containment for ventilation and cooling or heating and may also be used to reduce the concentration of airborne radioactivity within containment prior to and during personnel access. This system is used during Mode 5, Mode 6, and No Mode and is not utilized during Modes 1 through 4.The penetration valves are sealed closed in Modes 1 through 4.There are five purge air supply line penetrations and four exhaust penetrations in the containment.
| |
| The supply penetrations include one line through the reactor building wall, two through the containment vessel into upper containment, and two lines through the containment vessel into lower containment.
| |
| The exhaust penetrations include two lines through the containment vessel out of upper containment, one line through the containment vessel out of lower containment, and one line through the reactor building wall. Two normally closed isolation valves at each containment vessel penetration provide containment isolation.
| |
| The exhaust portion helps to reduce the consequences of a fuel handling accident in containment by removing and filtering any airborne radioactive effluents that may result from a fuel handling accident.APPLICABLE The containment isolation valve LCO was derived from the SAFETY ANALYSES assumptions related to minimizing the loss of reactor coolant inventory and establishing the containment boundary during major accidents.
| |
| As part of the containment boundary, containment isolation valve OPERABILITY supports leak tightness of the containment.
| |
| Therefore, the safety analyses of any event requiring isolation of containment is applicable to this LCO.The DBAs that result in a release of radioactive material within containment are a loss of coolant accident (LOCA) and a rod ejection accident (Ref. 1). In the analyses for each of these accidents, it is assumed that containment isolation valves are either closed or function to close within the required isolation time following event initiation.
| |
| This McGuire Units 1 and 2 B 3.6.3-2 Revision No. 115 Containment Isolation Valves B 3.6.3 BASES APPLICABLE SAFETY ANALYSES (continued) ensures that potential paths to the environment through containment isolation valves (including containment purge valves) are minimized.
| |
| The safety analyses assume that the lower compartment and instrument room purge valves are closed at event initiation.
| |
| The DBA analysis assumes that, within 76 seconds after the accident, isolation of the containment is complete and leakage terminated except for the design leakage rate, La. The containment isolation total response time of 76 seconds includes signal delay, diesel generator startup (for loss of offsite power), and containment isolation valve stroke times.The single failure criterion required to be imposed in the conduct of plant safety analyses was considered in the original design of the containment purge valves. Two valves in series on each purge line provide assurance that both the supply and exhaust lines could be isolated even if a single failure occurred.The lower and incore instrument room purge valves may be unable to close in the environment following a LOCA. Therefore, each of the lower and incore instrument room purge valves is required to remain sealed closed during MODES 1, 2, 3, and 4. Although the upper containment purge isolation valves are capable of closing under accident conditions, their capability to fully seal without manual assistance has proven to be unreliable.
| |
| Therefore, these valves are required to be maintained sealed closed during Modes 1, 2, 3, and 4.The containment isolation valves satisfy Criterion 3 of 10 CFR 50.36 (Ref.2).LCO Containment isolation valves form a part of the containment boundary.The containment isolation valves' safety function is related to minimizing the loss of reactor coolant inventory and establishing the containment boundary during a DBA.The automatic power operated isolation valves are required to have isolation times within limits and to actuate on an automatic isolation signal. The lower compartment, upper compartment, and incore instrument room purge valves must be maintained sealed closed. The valves covered by this LCO are listed along with their associated stroke times in the UFSAR (Ref. 3).McGuire Units 1 and 2 B 3.6.3-3 Revision No. 115 Containment Isolation Valves B 3.6.3 BASES LCO (continued)
| |
| The normally closed isolation valves are considered OPERABLE when manual valves are closed, automatic valves are de-activated and secured in their closed position, blind flanges are in place, and closed systems are intact. These passive isolation valves/devices are those listed in Reference 3.Purge valves with resilient seals and reactor building bypass valves must meet additional leakage rate requirements.
| |
| The other containment isolation valve leakage rates are addressed by LCO 3.6.1, "Containment," as Type C testing.This LCO provides assurance that the containment isolation valves and purge valves will perform their designed safety functions to minimize the loss of reactor coolant inventory and establish the containment boundary during accidents.
| |
| APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment.
| |
| In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, the containment isolation valves are not required to be OPERABLE in MODE 5. The requirements for containment isolation valves during MODE 6 are addressed in LCO 3.9.4, "Containment Penetrations." ACTIONS The ACTIONS are modified by a Note allowing penetration flow paths, except for containment purge supply and exhaust valves for the lower compartment, upper compartment, and incore instrument room, to be unisolated intermittently under administrative controls.
| |
| These administrative controls consist of stationing a dedicated operator at the valve controls, who is in continuous communication with the control room.In this way, the penetration can be rapidly isolated when a need for containment isolation is indicated.
| |
| For valve controls located in the control room, an operator may monitor containment isolation signal status rather than be stationed at the valve controls.
| |
| Due to the size of the containment purge line penetration and the fact that those penetrations exhaust directly from the containment atmosphere to the environment, the penetration flow path containing these valves may not be opened under administrative controls.
| |
| A single purge valve in a penetration flow path may be opened to effect repairs to an inoperable valve, as allowed by SR 3.6.3.1.McGuire Units 1 and 2 B 3.6.3-4 Revision No. 115 Containment Isolation Valves B 3.6.3 BASES ACTIONS (continued)
| |
| A second Note has been added to provide clarification that, for this LCO, separate Condition entry is allowed for each penetration flow path. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable containment isolation valve. Complying with the Required Actions may allow for continued operation, and subsequent inoperable containment isolation valves are governed by subsequent Condition entry and application of associated Required Actions.The ACTIONS are further modified by a third Note, which ensures appropriate remedial actions are taken, if necessary, if the affected systems are rendered inoperable by an inoperable containment isolation valve.In the event the containment isolation valve leakage results in exceeding the overall containment leakage rate, Note 4 directs entry into the applicable Conditions and Required Actions of LCO 3.6.1.A.1 and A.2 In the event one containment isolation valve in one or more penetration flow paths is inoperable except for purge valve or reactor building bypass leakage not within limit, the affected penetration flow path must be isolated.
| |
| The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic containment isolation valve, a closed manual valve, a blind flange, and a check valve inside containment with flow through the valve secured. For a penetration flow path isolated in accordance with Required Action A.1, the device used to isolate the penetration should be the closest available one to containment.
| |
| Required Action A.1 must be completed within 4 hours. The 4 hour Completion Time is reasonable, considering the time required to isolate the penetration and the relative importance of supporting containment OPERABILITY during MODES 1, 2, 3, and 4.For affected penetration flow paths that cannot be restored to OPERABLE status within the 4 hour Completion Time and that have been isolated in accordance with Required Action A.1, the affected penetration flow paths must be verified to be isolated on a periodic basis. This is necessary to ensure that containment penetrations required to be isolated following an accident and no longer capable of being automatically isolated will be in the isolation position should an event McGuire Units 1 and 2 B 3.6.3-5 Revision No. 115 Containment Isolation Valves B 3.6.3 BASES ACTIONS (continued) occur. This Required Action does not require any testing or device manipulation.
| |
| Rather, it involves verification, through a system walkdown or computer status indication, that those isolation devices outside containment and capable of being mispositioned are in the correct position.
| |
| The Completion Time of "once per 31 days for isolation devices outside containment" is appropriate considering the fact that the devices are operated under administrative controls and the probability of their misalignment is low. For the isolation devices inside containment, the time period specified as "prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of the inaccessibility of the isolation devices and other administrative controls that will ensure that isolation device misalignment is an unlikely possibility.
| |
| Condition A has been modified by a Note indicating that this Condition is only applicable to those penetration flow paths with two containment isolation valves. For penetration flow paths with only one containment isolation valve and a closed system, Condition C provides the appropriate actions.Required Action A.2 is modified by a Note that applies to isolation devices located in high radiation areas and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted.
| |
| Therefore, the probability of misalignment of these devices once they have been verified to be in the proper position, is small.B..1 With two containment isolation valves in one or more penetration flow paths inoperable, except for the purge valve or reactor building bypass leakage not within limit, the affected penetration flow path must be isolated within 1 hour. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange.The 1 hour Completion Time is consistent with the ACTIONS of LCO 3.6.1. In the event the affected penetration is isolated in accordance with Required Action B.1, the affected penetration must be verified to be isolated on a periodic basis per Required Action A.2, which remains in effect. This periodic verification is necessary to assure leak McGuire Units 1 and 2 B 3.6.3-6 Revision No. 115 Containment Isolation Valves B 3.6.3 BASES ACTIONS (continued) tightness of containment and that penetrations requiring isolation following an accident are isolated.
| |
| The Completion Time of once per 31 days for verifying each affected penetration flow path is isolated is appropriate considering the fact that the valves are operated under administrative control and the probability of their misalignment is low.Condition B is modified by a Note indicating this Condition is only applicable to penetration flow paths with two containment isolation valves.Condition A of this LCO addresses the condition of one containment isolation valve inoperable in this type of penetration flow path.C.1 and C.2 With one or more penetration flow paths with one containment isolation valve inoperable, the inoperable valve flow path must be restored to OPERABLE status or the affected penetration flow path must be isolated.The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure.Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange. A check valve may not be used to isolate the affected penetration flow path.Required Action C.1 must be completed within the 72 hour Completion Time. The specified time period is reasonable considering the relative stability of the closed system (hence, reliability) to act as a penetration isolation boundary and the relative importance of maintaining containment integrity during MODES 1, 2, 3, and 4. In the event the affected penetration flow path is isolated in accordance with Required Action C.1, the affected penetration flow path must be verified to be isolated on a periodic basis. This periodic verification is necessary to assure leak tightness of containment and that containment penetrations requiring isolation following an accident are isolated.
| |
| The Completion Time of once per 31 days for verifying that each affected penetration flow path is isolated is appropriate because the valves are operated under administrative controls and the probability of their misalignment is low.Condition C is modified by a Note indicating that this Condition is only applicable to those penetration flow paths with only one containment isolation valve and a closed system. The closed system must meet the requirements of Reference
| |
| : 5. This Note is necessary since this Condition is written to specifically address those penetration flow paths in a closed system.McGuire Units 1 and 2 B 3.6.3-7 Revision No. 115 Containment Isolation Valves B 3.6.3 BASES ACTIONS (continued)
| |
| Required Action C.2 is modified by a Note that applies to valves and blind flanges located in high radiation areas and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted.
| |
| Therefore, the probability of misalignment of these valves, once they have been verified to be in the proper position, is small.D.1 With the reactor building bypass leakage rate not within limit, the assumptions of the safety analyses are not met. Therefore, the leakage must be restored to within limit within 4 hours. Restoration can be accomplished by isolating the penetration(s) that caused the limit to be exceeded by use of one closed and de-activated automatic valve, closed manual valve, or blind flange. When a penetration is isolated the leakage rate for the isolated penetration is assumed to be the actual pathway leakage through the isolation device. If two isolation devices are used to isolate the penetration, the leakage rate is assumed to be the lesser actual pathway leakage of the two devices. The 4 hour Completion Time is reasonable considering the time required to restore the leakage by isolating the penetration(s) and the relative importance of secondary containment bypass leakage to the overall containment function.E.1, E.2, and E.3 In the event one or more purge valves for upper and lower containment or incore instrument room in one or more penetration flow paths are not within the purge valve leakage limits, leakage must be restored to within limits, or the affected penetration flow path must be isolated.
| |
| The method of isolation must be by the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, closed manual valve, or blind flange. A valve with resilient seals utilized to satisfy Required Action E.1 must have been demonstrated to meet the leakage requirements of SR 3.6.3.6. The specified Completion Time is reasonable, considering that one containment purge valve remains closed so that a gross breach of containment does not exist.In accordance with Required Action E.2, this penetration flow path must be verified to be isolated on a periodic basis. The periodic verification is McGuire Units 1 and 2 B 3.6.3-8 Revision No. 115 Containment Isolation Valves B 3.6.3 BASES ACTIONS (continued) necessary to ensure that containment penetrations required to be isolated following an accident, which are no longer capable of being automatically isolated, will be in the isolation position should an event occur. This Required Action does not require any testing or valve manipulation.
| |
| Rather, it involves verification, through a system walkdown or computer status indication, that those isolation devices outside containment capable of being mispositioned are in the correct position.
| |
| For the isolation devices inside containment, the time period specified as "prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of the inaccessibility of the isolation devices and other administrative controls that will ensure that isolation device misalignment is an unlikely possibility.
| |
| For the containment purge valve with resilient seal that is isolated in accordance with Required Action E.1, SR 3.6.3.6 must be performed at least once every 92 days. This assures that degradation of the resilient seal is detected and confirms that the leakage rate of the containment purge valve does not increase during the time the penetration is isolated.F.1 and F.2 If the Required Actions and associated Completion Times are not met, the plant must be brought to a MODE in which the LCO does not apply.To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.SURVEILLANCE SR 3.6.3.1 REQUIREMENTS Each containment purge supply and exhaust valve for the lower compartment, upper compartment, and incore instrument room is required to be verified sealed closed. This Surveillance is designed to ensure that a gross breach of containment is not caused by an inadvertent or spurious opening of a containment purge valve. These valves are required to be in the sealed closed position during MODES 1, 2, 3, and 4. A valve that is sealed closed must have motive power to the valve operator removed. This can McGuire Units 1 and 2 B 3.6.3-9 Revision No. 115 Containment Isolation Valves B 3.6.3 BASES SURVEILLANCE REQUIREMENTS (continued) be accomplished by de-energizing the source of electric power or by removing the air supply to the valve operator.
| |
| In this application, the term"sealed" has no connotation of leak tightness.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program. In the event purge valve leakage requires entry into Condition E, the Surveillance permits opening one purge valve in a penetration flow path to perform repairs.SR 3.6.3.2 Not Used SR 3.6.3.3 This SR requires verification that each containment isolation manual valve and blind flange located outside containment or annulus and not locked, sealed, or otherwise secured and required to be closed during accident conditions is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside of the containment boundary is within design limits. This SR does not require any testing or valve manipulation.
| |
| Rather, it involves verification, through a system walkdown or computer status indication, that those containment isolation valves outside containment and capable of being mispositioned are in the correct position.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program. The SR specifies that containment isolation valves that are open under administrative controls are not required to meet the SR during the time the valves are open. This SR does not apply to valves that are locked, sealed, or otherwise secured in the closed position, since these were verified to be the correct position upon locking, sealing, or securing.The Note applies to valves and blind flanges located in high radiation areas and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted during MODES 1, 2, 3 and 4 for ALARA reasons. Therefore, the probability of misalignment of these containment isolation valves, once they have been verified to be in the proper position, is small.McGuire Units 1 and 2 B83.6.3-10 Revision No. 115 Containment Isolation Valves B 3.6.3 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.6.3.4 This SR requires verification that each containment isolation manual valve and blind flange located inside containment or annulus and not locked, sealed, or otherwise secured and required to be closed during accident conditions is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside of the containment boundary is within design limits. For containment isolation valves inside containment, the Frequency of "prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is appropriate since these containment isolation valves are operated under administrative controls and the probability of their misalignment is low. The SR specifies that containment isolation valves that are open under administrative controls are not required to meet the SR during the time they are open. This SR does not apply to valves that are locked, sealed, or otherwise secured in the closed position, since these were verified to be the correct position upon locking, sealing, or securing.This Note allows valves and blind flanges located in high radiation areas to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted during MODES 1, 2, 3, and 4, for ALARA reasons. Therefore, the probability of misalignment of these containment isolation valves, once they have been verified to be in their proper position, is small.SR 3.6.3.5 Verifying that the isolation time of each automatic power operated containment isolation valve is within limits is required to demonstrate OPERABILITY.
| |
| The isolation time test ensures the valve will isolate in a time period less than or equal to that assumed in the safety analyses.The isolation time is specified in the UFSAR and Frequency of this SR are in accordance with the Inservice Testing Program.McGuire Units 1 and 2 B 3.6.3-11 Revision No. 115 Containment Isolation Valves B 3.6.3 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.6.3.6 For containment purge valves with resilient seals, additional leakage rate testing beyond the test requirements of 10 CFR 50, Appendix J, Option B is required to ensure OPERABILITY.
| |
| The measured leakage rate for containment purge lower compartment and incore instrument room valves must be _< 0.05 La when pressurized to Pa. The measured leakage rate for containment purge upper compartment valves must be < 0.01 La when pressurized to Pa. Operating experience has demonstrated that this type of seal has the potential to degrade in a shorter time period than do other seal types. Based on this observation and the importance of maintaining this penetration leak tight (due to the direct path between containment and the environment), these valves will not be placed on the maximum extended test interval, but tested on the nominal test interval in accordance with the Containment Leakage Rate Testing Program.SR 3.6.3.7 Automatic containment isolation valves close on a containment isolation signal to prevent leakage of radioactive material from containment following a DBA. This SR ensures that each automatic containment isolation valve will actuate to its isolation position on a containment isolation signal. The isolation signals involved are Phase A, Phase B, and Safety Injection.
| |
| This surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.6.3.8 This SR ensures that the combined leakage rate of all reactor building bypass leakage paths is less than or equal to the specified leakage rate.This provides assurance that the assumptions in the safety analysis are met. The Frequency is required by the Containment Leakage Rate Testing Program. This SR simply imposes additional acceptance criteria.Bypass leakage is considered part of La.McGuire Units 1 and 2 B 3.6.3-12 Revision No. 115 Containment Isolation Valves B 3.6.3 BASES REFERENCES 1.2.3.4.5.UFSAR, Section 15.10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| UFSAR, Section 6.2.Generic Issue B-24.UFSAR, Section 6.2.4.2 McGuire Units 1 and 2 B 3.6.3-13 Revision No. 115 Containment Pressure B 3.6.4 B 3.6 CONTAINMENT SYSTEMS B 3.6.4 Containment Pressure BASES BACKGROUND The containment pressure is limited during normal operation to preserve the initial conditions assumed in the accident analyses for a loss of coolant accident (LOCA) or steam line break (SLB). These limits also prevent the containment pressure from exceeding the containment design negative pressure differential with respect to the outside atmosphere following an event which has the potential to result in a net external pressure on the containment.
| |
| Containment pressure is a process variable that is monitored and controlled.
| |
| The containment pressure limits are derived from the input conditions used in the containment functional analyses and the containment structure external pressure analysis.
| |
| Should operation occur outside these limits coincident with a Design Basis Accident (DBA), post accident containment pressures could exceed calculated values.APPLICABLE SAFETY ANALYSES Containment internal pressure is an initial condition used in the DBA analyses to establish the maximum peak containment internal pressure.The limiting DBAs considered, relative to containment pressure, are the LOCA and SLB, which are analyzed using computer codes designed to predict the resultant containment pressure transients.
| |
| The worst case LOCA generates larger mass and energy release than the worst case SLB. Thus, the LOCA event bounds the SLB event from the containment peak pressure standpoint (Ref. 1).The initial pressure condition used in the containment analysis was 15.0 psia (0.3 psig). The containment analysis (Ref. 1) shows that the maximum peak calculated containment pressure, Pa, results from the limiting LOCA. The maximum containment pressure resulting from the worst case LOCA does not exceed the containment design pressure 15.0 psig.The containment was also designed for an external pressure load equivalent to -1.5 psig.There are four conditions which have a potential for resulting in a net external pressure on the containment:
| |
| I ýMcGuire Units 1 and 2 B 3.6.4-1 Revision No. 115 Containment Pressure B 3.6.4 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| : 1. Rupture of a hot or high pressure process pipe in the annulus.2. Inadvertent Containment Spray System initiation during normal operation.
| |
| : 3. Inadvertent containment air return fan initiation during normal operation.
| |
| : 4. Containment purge fan operation with containment purge inlet valves closed.The containment design of 1.5 psig negative is not violated in the above conditions due to either equipment limitations or design features.For certain aspects of transient accident analyses, maximizing the calculated containment pressure is not conservative.
| |
| In particular, the cooling effectiveness of the Emergency Core Cooling System during the core reflood phase of a LOCA analysis increases with increasing containment backpressure.
| |
| Therefore, for the reflood phase, the containment backpressure is calculated in a manner designed to conservatively minimize, rather than maximize, the containment pressure response in accordance with 10 CFR 50, Appendix K (Ref. 2).Containment pressure satisfies Criterion 2 of 10 CFR 50.36 (Ref. 3).LCO Maintaining containment pressure at less than or equal to the LCO upper pressure limit ensures that, in the event of a DBA, the resultant peak containment accident pressure will remain below the containment design pressure.
| |
| Maintaining containment pressure at greater than or equal to the LCO lower pressure limit ensures that the containment will not exceed the design negative differential pressure following an event which has the potential to result in a net external pressure on the containment.
| |
| APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment.
| |
| Since maintaining containment pressure within limits is essential to ensure initial conditions assumed in the accident analyses are maintained, the LCO is applicable in MODES 1, 2, 3 and 4.In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, maintaining containment pressure within the limits of the LCO is not required in MODE 5 or 6.McGuire Units 1 and 2 B 3.6.4-2 Revision No. 115 Containment Pressure B 3.6.4 BASES ACTIONS A._1.When containment pressure is not within the limits of the LCO, it must be restored to within these limits within 1 hour. The Required Action is necessary to return operation to within the bounds of the containment analysis.
| |
| The 1 hour Completion Time is consistent with the ACTIONS of LCO 3.6.1, "Containment," which requires that containment be restored to OPERABLE status within 1 hour.B.1 and B.2 If containment pressure cannot be restored to within limits within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.SURVEILLANCE SR 3.6.4.1 REQUIREMENTS Verifying that containment pressure is within limits ensures that unit operation remains within the limits assumed in the containment analysis.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. UFSAR, Section 6.2.2. 10 CFR 50, Appendix K.3. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.6.4-3 Revision No. 115 Containment Air Temperature B 3.6.5 B 3.6 CONTAINMENT SYSTEMS B 3.6.5 Containment Air Temperature BASES BACKGROUND The containment structure serves to contain radioactive material that may be released from the reactor core following a Design Basis Accident (DBA). The containment average air temperature is limited, during normal operation, to preserve the initial conditions assumed in the accident analyses for a loss of coolant accident (LOCA) or steam line break (SLB).The containment average air temperature limit is derived from the input conditions used in the containment functional analyses and the containment structure external pressure analyses.
| |
| This LCO ensures that initial conditions assumed in the analysis of containment response to a DBA are not violated during unit operations.
| |
| The total amount of energy to be removed from containment by the Containment Spray and ECCS systems during post accident conditions is dependent upon the energy released to the containment due to the event, as well as the initial containment temperature and pressure.
| |
| High initial temperature, results in a higher peak containment temperature.
| |
| Low initial temperature results in a higher peak containment pressure.
| |
| Exceeding containment design pressure may result in leakage greater than that assumed in the accident analysis.
| |
| Operation with containment temperature in excess of the LCO limit violates an initial condition assumed in the accident analysis.APPLICABLE SAFETY ANALYSES Containment average air temperature is an initial condition used in the DBA analyses that establishes the containment environmental qualification operating envelope for both pressure and temperature.
| |
| The limit for containment average air temperature ensures that operation is maintained within the assumptions used in the DBA analyses for containment (Ref. 1).The limiting DBAs considered relative to containment OPERABILITY are the LOCA and SLB. The DBA LOCA and SLB are analyzed using computer codes designed to predict the resultant containment pressure and temperature transients.
| |
| No two DBAs are assumed to occur simultaneously or consecutively.
| |
| The postulated DBAs are analyzed with regard to Engineered Safety Feature (ESF) systems, assuming the loss of one ESF bus, which is the worst case single active failure, resulting in one train each of Containment Spray System, Residual Heat Removal System, and Air Return System being rendered inoperable.
| |
| McGuire Units 1 and 2 B 3.6.5-1 Revision No. 115 Containment Air Temperature B 3.6.5 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| The limiting DBA for the maximum peak containment air temperature is an SLB. For the upper compartment, the initial containment average air temperature assumed in the design basis analyses (Ref. 1) is 100°F. For the lower compartment, the initial average containment air temperature assumed in the design basis analyses is 135°F. This resulted in a maximum containment air temperature of 317 0 F. The current environmental qualification temperature limit is 341 *F.The temperature upper limits are used to establish the environmental qualification operating envelope for both containment compartments.
| |
| The maximum peak containment air temperature for both containment compartments was calculated to be within the current environmental qualification temperature limit during the transient.
| |
| The basis of the containment environmental qualification temperature is to ensure the performance of safety related equipment inside containment (Ref. 2).The temperature upper limits are also used in the depressurization analyses to ensure that the minimum pressure limit is maintained for both containment compartments following an event which has the potential to result in a net external pressure on the containment.
| |
| The containment pressure transient is sensitive to the initial air mass in containment and, therefore, to the initial containment air temperature.
| |
| The limiting DBA for establishing the maximum peak containment internal pressure is a LOCA. The temperature lower limits, 75 0 F for the upper compartment and 100°F forthe lower compartment, are used in this analysis to ensure that, in the event of an accident, the maximum containment internal pressure will not be exceeded in either containment compartment.
| |
| Containment average air temperature satisfies Criterion 2 of 10 CFR 50.36 (Ref. 3).LCO During a DBA, with an initial containment average air temperature within the LCO temperature limits, the resultant peak accident temperature is maintained below the containment environmental qualification temperature.
| |
| As a result, the ability of containment to perform its design function is ensured. Two Notes to the LCO provide containment air temperature flexibility.
| |
| Note 1 establishes that in MODES 2, 3, and 4, containment air temperature may be as low as 60°F because the resultant calculated peak containment accident pressure would not McGuire Units 1 and 2 B 3.6.5-2 Revision No. 115 Containment Air Temperature B 3.6.5 BASES LCO (continued) exceed the design pressure due to a lesser amount of energy released from the pipe break in these MODES. Note 2 allows the containment lower compartment temperature to be between 120 and 125°F for up to 90 cumulative days per calendar year provided the lower compartment temperature average over the previous 365 days is less than 120°F.Within this 90 cumulative day period, lower compartment temperature may be between 125°F and 135°F for 72 cumulative hours. These exceptions are necessary during peak lake temperature periods when service water temperatures increase.
| |
| A failure of a containment air handling unit concurrent with peak service water temperatures could exceed the normal lower compartment temperature limit. The exception provides a limited period of time to effect repairs and avoid a forced unit shutdown.APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment.
| |
| In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, maintaining containment average air temperature within the limit is not required in MODE 5 or 6.ACTIONS A.1 When containment average air temperature in the upper or lower compartment is not within the limit of the LCO, the average air temperature in the affected compartment must be restored to within limits within 8 hours. This Required Action is necessary to return operation to within the bounds of the containment analysis.
| |
| The 8 hour Completion Time is acceptable considering the sensitivity of the analysis to variations in this parameter and provides sufficient time to correct minor problems.B.1 and B.2 If the containment average air temperature cannot be restored to within its limits within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.McGuire Units 1 and 2 B 3.6.5-3 Revision No. 115 Containment Air Temperature B 3.6.5 BASES SURVEILLANCE SR 3.6.5.1 and SR 3.6.5.2 REQUIREMENTS Verifying that containment average air temperature is within the LCO limits ensures that containment operation remains within the limits assumed for the containment analyses.
| |
| In order to determine the containment average air temperature, a weighted average of ambient air temperature monitoring stations is calculated using measurements taken at locations within the containment selected to provide a representative sample of the overall containment atmosphere.
| |
| The weighted average is the sum of each temperature multiplied by its respective containment volume fraction.
| |
| In the event of inoperative temperature sensor(s), the weighted average shall be taken as the reduced total divided by one minus the volume fraction represented by the sensor(s) out of service.The upper compartment measurements should be taken at elevation 826 feet at the inlet of each upper containment ventilation unit. The lower compartment measurements should be taken at elevation 745 feet at the inlet of each lower containment ventilation unit. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. UFSAR, Section 6.2.2. 10 CFR 50.49.3. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.6.5-4 Revision No. 115 UNIT 1 BASES 3.6.6 License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit 1 only during 1 EOC2 1. Until the ECCS amendment can be implemented on Unit 2, there will be separate documents for Unit I and Unit 2 Bases 3.6.6.ECCS Water Management Modification is scheduled to be implemented on Unit 2 during the fall 2012 outage.
| |
| UNIT 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during IEOC21.Until the ECCS amendment can be implemented on Unit 2, there will be separate Bases documents for Unit I and Unit 2 for Bases 3.3.2, 3.3.3, 3.5.4, 3.6.6, and 3.6.11. ECCS Water Management Modification is scheduled to be implemented on Unit 2 during the fall 2012 outage.Containment Spray System B 3.6.6 B 3.6 CONTAINMENT SYSTEMS B 3.6.6 Containment Spray System BASES BACKGROUND The Containment Spray System provides containment atmosphere cooling to limit post accident pressure and temperature in containment to less than the design values. Reduction of containment pressure and the iodine removal capability of the spray reduce the release of fission product radioactivity from containment to the environment, in the event of a Design Basis Accident (DBA). The Containment Spray System is designed to meet the requirements of 10 CFR 50, Appendix A, GDC 38, "Containment Heat Removal," GDC 39, "Inspection of Containment Heat Removal Systems," GDC 40, "Testing of Containment Heat Removal Systems," GDC 41,"Containment Atmosphere Cleanup," GDC 42, "Inspection of Containment Atmosphere Cleanup Systems," and GDC 43, "Testing of Containment Atmosphere Cleanup Systems" (Ref. 1).The Containment Spray System consists of two separate trains of equal capacity, each capable of meeting the system design basis spray coverage.Each train includes a containment spray pump, one containment spray heat exchanger, spray headers, nozzles, valves, and piping. Each train is powered from a separate Engineered Safety Feature (ESF) bus. One train of Containment Spray flow is manually initiated with suction on the Containment Sump after commencement of the ECCS sump recirculation mode of operation.
| |
| The diversion of a portion of the recirculation flow from each train of the Residual Heat Removal (RHR) System to additional redundant spray headers completes the Containment Spray System heat removal capability.
| |
| Each RHR train is capable of supplying spray coverage, if desired, to supplement the Containment Spray System.The Containment Spray System provides a spray of cold or subcooled borated water into the upper containment volume to limit the containment pressure and temperature during a DBA. In the recirculation mode of operation, heat is removed from the containment sump water by the Containment Spray System and RHR heat exchangers.
| |
| Each train of the Containment Spray System provides adequate spray coverage to meet the system design requirements for containment heat removal.McGuire Unit 1 B 3.6.6-1 Revision No. 117 UNIT 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during I EOC21.ECCS Water Management Modification is scheduled to be implemented on Unit 2 during the fall 2012 outage.Containment Spray System B 3.6.6 BASES BACKGROUND (continued)
| |
| For the hypothetical double-ended rupture of a Reactor Coolant System pipe, the pH of the sump solution (and, consequently, the spray solution) is raised to approximately 7.9 within one hour of the onset of the LOCA. The resultant pH of the sump solution is based on the mixing of the RCS fluids, ECCS injection fluid, and the melted ice which are combined in the sump.The alkaline pH of the containment sump water minimizes the evolution of iodine and the occurrence of chloride and caustic stress corrosion on mechanical systems and components exposed to the fluid.Containment Spray is manually initiated from the Control Room by opening the Containment Spray System (CSS) Pump discharge valves and starting the CSS Pump. The CSS is typically not activated until an RWST Low-Low level alarm is received.
| |
| This alarm signals the operator to manually align the ECCS to the recirculation mode and manually initiate containment spray. The CSS maintains an equilibrium temperature between the containment atmosphere and the recirculated sump water. Operation of the CSS in the recirculation mode is controlled by the operator in accordance with emergency operation procedures.
| |
| The RHR spray operation is initiated manually, when required by the emergency operating procedures, after the Emergency Core Cooling System (ECCS) is operating in the recirculation mode. The RHR sprays are available to supplement the Containment Spray System, if desired, in limiting containment pressure.
| |
| This additional spray capacity would typically be used after the ice bed has been depleted and in the event that containment pressure rises above a predetermined limit. The Containment Spray System is an ESF system. It is designed to ensure that the heat removal capability required during the post accident period can be attained.The operation of the Containment Spray System, together with the ice condenser, is adequate to assure pressure suppression subsequent to the initial blowdown of steam and water from a DBA. During the post blowdown period, the Air Return System (ARS) is automatically started.The ARS returns upper compartment air through the divider barrier to the lower compartment.
| |
| This serves to equalize pressures in containment and to continue circulating heated air and steam through the ice condenser, where heat is removed by the remaining ice.McGuire Unit 1 B 3.6.6-2 Revision No. 117 UNIT 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during I EOC2 1.ECCS Water Management Modification is scheduled to be implemented on Unit 2 during the fall 2012 outage.Containment Spray System B 3.6.6 BASES BACKGROUND (continued)
| |
| The Containment Spray System limits the temperature and pressure that could be expected following a DBA. Protection of containment integrity limits leakage of fission product radioactivity from containment to the environment.
| |
| APPLICABLE The limiting DBAs considered relative to containment OPERABILITY SAFETY ANALYSES are the loss of coolant accident (LOCA) and the steam line break (SLB).The DBA LOCA and SLB are analyzed using computer codes designed to predict the resultant containment pressure and temperature transients.
| |
| No two DBAs are assumed to occur simultaneously or consecutively.
| |
| The postulated DBAs are analyzed, in regard to containment ESF systems, assuming the loss of one ESF bus, which is the worst case single active failure, resulting in one train of the Containment Spray System, the RHR System, and the ARS being rendered inoperable (Ref. 2).The DBA analyses show that the maximum peak containment pressure results from the LOCA analysis, and is calculated to be less than the containment design pressure.
| |
| The maximum peak containment atmosphere temperature results from the SLB analysis and was calculated to be within the containment environmental qualification temperature during the DBA SLB. The basis of the containment environmental qualification temperature is to ensure the OPERABILITY of safety related equipment inside containment (Ref. 3).The Containment Spray System actuation modeled in the containment analysis is based on the time associated with reaching the RWST Low Level Setpoint and operator action prior to achieving full flow through the containment spray nozzles. A delayed response time initiation provides conservative analyses of peak calculated containment temperature and pressure responses.
| |
| The Containment Spray System total response time is composed of operator action, system startup time, and time for the piping to fill.For certain aspects of transient accident analyses, maximizing the calculated containment pressure is not conservative.
| |
| In particular, the ECCS cooling effectiveness during the core reflood phase of a LOCA analysis increases with increasing containment backpressure.
| |
| For these calculations, the containment backpressure is calculated in a manner designed to conservatively minimize, rather than maximize, the calculated transient containment pressures in accordance with 10 CFR 50, Appendix K (Ref. 4).McGuire Unit 1 B 3.6.6-3 Revision No. 117 UNIT 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during I EOC21.ECCS Water Management Modification is scheduled to be implemented on Unit 2 during the fall 2012 outage.Containment Spray System B 3.6.6 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| Inadvertent actuation is precluded by design features consisting of an additional set of containment pressure sensors which prevents operation when the containment pressure is below the containment pressure control system permissive.
| |
| The Containment Spray System satisfies Criterion 3 of 10 CFR 50.36 (Ref.5).LCO During a DBA, one train of Containment Spray System is required to provide the heat removal capability assumed in the safety analyses.
| |
| To ensure that this requirement is met, two containment spray trains must be OPERABLE with power from two safety related, independent power supplies.
| |
| Therefore, in the event of an accident, at least one train operates.Each Containment Spray System includes a spray pump, headers, valves, heat exchangers, nozzles, piping, instruments, and controls to ensure an OPERABLE flow path capable of being manually initiated to take suction from the Containment Sump and delivering it to the Containment Spray Rings.APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment and an increase in containment pressure and temperature requiring the operation of the Containment Spray System.In MODES 5 and 6, the probability and consequences of these events are reduced because of the pressure and temperature limitations of these MODES. Thus, the Containment Spray System is not required to be OPERABLE in MODE 5 or 6.ACTIONS A. 1 With one containment spray train inoperable, the affected train must be restored to OPERABLE status within 72 hours. The components in this degraded condition are capable of providing 100% of the heat removal after an accident.
| |
| The 72 hour Completion Time was developed taking into account the redundant heat removal and iodine removal capabilities afforded by the OPERABLE train and the low probability of a DBA occurring during this period.McGuire Unit 1 B 3.6.6-4 Revision No. 117 LMNT 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during I EOC2 1.ECCS Water Management Modification is scheduled to be implemented on Unit 2 during the fall 2012 outage.Containment Spray System B 3.6.6 BASES ACTIONS (continued)
| |
| B.1 and B.2 If the affected containment spray train cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 84 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.The extended interval to reach MODE 5 allows additional time and is reasonable when considering that the driving force for a release of radioactive material from the Reactor Coolant System is reduced in MODE 3.SURVEILLANCE SR 3.6.6.1 REQUIREMENTS Verifying the correct alignment of manual and power operated valves, excluding check valves, in the Containment Spray System provides assurance that the proper flow path exists for Containment Spray System operation.
| |
| This SR does not apply to valves that are locked, sealed, or otherwise secured in position since they were verified in the correct position prior to being secured. This SR does not require any testing or valve manipulation.
| |
| Rather, it involves verification, through a system walkdown or computer status indication, that those valves outside containment and capable of potentially being mispositioned, are in the correct position.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.The surveillance includes verifying the correct alignment of the containment spray pump discharge valves.SR 3.6.6.2 Verifying that each containment spray pump's developed head at the flow test point is greater than or equal to the required developed head ensures that spray pump performance has not degraded during the cycle. Flow and differential head are normal tests of centrifugal pump performance required by the ASME OM Code (Ref. 6). Since the containment spray pumps cannot be tested with flow through the spray headers, they are tested on bypass flow. This test confirms one point on the pump design curve and is indicative of overall performance.
| |
| Such inservice inspections confirm component OPERABILITY, trend performance, and detect incipient failures by indicating abnormal performance.
| |
| The Frequency of this SR is in accordance with the Inservice Testing Program.McGuire Unit 1 B 3.6.6-5 Revision No. 117 UNIT 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during I EOC21.ECCS Water Management Modification is scheduled to be implemented on Unit 2 during the fall 2012 outage.Containment Spray System B 3.6.6 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.6.6.3 and SR 3.6.6.4 Not Used.SR 3.6.6.5 and SR 3.6.6.6 These SRs require verification that each containment spray pump discharge valve can be manually opened or is prevented from opening and each containment spray pump can be manually started or is de-energized and prevented from starting upon receipt of Containment Pressure Control System start and terminate signals. The EDG Load Sequencer must be reset in order for the containment spray pump to start. The CPCS is described in the Bases for LCO 3.3.2, "ESFAS." The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.6.6.7 With the containment spray inlet valves closed and the spray header drained of any solution, low pressure air or smoke can be blown through test connections.
| |
| The spray nozzles can also be tested using a vacuum blower to induce air flow through each nozzle to verify unobstructed flow.This SR requires verification that each spray nozzle is unobstructed following activities that could cause nozzle blockage.
| |
| Normal plant operation and activities are not expected to initiate this SR. However, activities such as inadvertent spray actuation that causes fluid flow through the nozzles, major configuration change, or a loss of foreign material control when working within the respective system boundary, may require surveillance performance.
| |
| McGuire Unit 1 B 3.6.6-6 Revision No. 117 UNIT 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during 1 EOC2 1.ECCS Water Management Modification is scheduled to be implemented on Unit 2 during the fall 2012 outage.Containment Spray System B 3.6.6 BASES REFERENCES
| |
| : 1. 10 CFR 50, Appendix A, GDC 38, GDC 39, GDC 40, GDC 41, GDC 42, and GDC 43.2. UFSAR, Section 6.2.3. 10 CFR 50.49.4. 10 CFR 50, Appendix K.5. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| : 6. ASME Code for Operation and Maintenance of Nuclear Power Plants.McGuire Unit 1 B 3.6.6-7 Revision No. 117 UNIT 2 BASES 3.6.6 Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012, there will be separate documents for Unit 1 and Unit 2 Bases 3.6.6.ECCS Water Management Modification was implemented on Unit I during the I EOC21 outage.
| |
| UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012, there will be separate documents for Unit I and Unit 2 Bases: 3.3.2, 3.3.3, 3.5.4, 3.6.6, and 3.6.11 Containment Spray System B 3.6.6 B 3.6 CONTAINMENT SYSTEMS B 3.6.6 Containment Spray System BASES BACKGROUND The Containment Spray System provides containment atmosphere cooling to limit post accident pressure and temperature in containment to less than the design values. Reduction of containment pressure and the iodine removal capability of the spray reduce the release of fission product radioactivity from containment to the environment, in the event of a Design Basis Accident (DBA). The Containment Spray System is designed to meet the requirements of 10 CFR 50, Appendix A, GDC 38, "Containment Heat Removal," GDC 39, "Inspection of Containment Heat Removal Systems," GDC 40, "Testing of Containment Heat Removal Systems," GDC 41,"Containment Atmosphere Cleanup," GDC 42, "Inspection of Containment Atmosphere Cleanup Systems," and GDC 43, "Testing of Containment Atmosphere Cleanup Systems" (Ref. 1).The Containment Spray System consists of two separate trains of equal capacity, each capable of meeting the system design basis spray coverage.Each train includes a containment spray pump, one containment spray heat exchanger, spray headers, nozzles, valves, and piping. Each train is powered from a separate Engineered Safety Feature (ESF) bus. The refueling water storage tank (RWST) supplies borated water to the Containment Spray System during the injection phase of operation.
| |
| In the recirculation mode of operation, containment spray pump suction is transferred from the RWST to the containment recirculation sump(s).The diversion of a portion of the recirculation flow from each train of the Residual Heat Removal (RHR) System to additional redundant spray headers completes the Containment Spray System heat removal capability.
| |
| Each RHR train is capable of supplying spray coverage, if required, to supplement the Containment Spray System.The Containment Spray System and RHR System provide a spray of cold or subcooled borated water into the upper containment volume to limit the containment pressure and temperature during a DBA. The RWST solution temperature is an important factor in determining the heat removal capability of the Containment Spray System during the injection phase. In the recirculation mode of operation, heat is removed from the containment sump water by the Containment Spray System and RHR heat exchangers.
| |
| Each train of the Containment Spray System, supplemented by a train of RHR spray, provides adequate spray coverage to meet the system design requirements for containment heat removal.McGuire Unit 2 B 3.6.6-1 Revision No. 115 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012, there will be separate documents for Unit I and Unit 2 Bases.Containment Spray System B 3.6.6 BASES BACKGROUND (continued)
| |
| For the hypothetical double-ended rupture of a Reactor Coolant System pipe, the pH of the sump solution (and, consequently, the spray solution) is raised to at least 8.0 within one hour of the onset of the LOCA. The resultant pH of the sump solution is based on the mixing of the RCS fluids, ECCS injection fluid, and the melted ice which are combined in the sump.The alkaline pH of the containment sump water minimizes the evolution of iodine and the occurrence of chloride and caustic stress corrosion on mechanical systems and components exposed to the fluid.The Containment Spray System is actuated either automatically by a containment pressure high-high signal or manually.
| |
| An automatic actuation opens the containment spray pump discharge valves, starts the two containment spray pumps, and begins the injection phase. A manual actuation of the Containment Spray System requires the operator to actuate two separate train related switches on the main control board to begin the same sequence of two train actuation.
| |
| The injection phase continues until an RWST level Low-Low alarm is received.
| |
| The Low-Low alarm for the RWST signals the operator to manually align the system to the recirculation mode. The Containment Spray System in the recirculation mode maintains an equilibrium temperature between the containment atmosphere and the recirculated sump water. Operation of the Containment Spray System in the recirculation mode is controlled by the operator in accordance with the emergency operation procedures.
| |
| The RHR spray operation is initiated manually, when required by the emergency operating procedures, after the Emergency Core Cooling System (ECCS) is operating in the recirculation mode. The RHR sprays are available to supplement the Containment Spray System, if required, in limiting containment pressure.
| |
| This additional spray capacity would typically be used after the ice bed has been depleted and in the event that containment pressure rises above a predetermined limit. The Containment Spray System is an ESF system. It is designed to ensure that the heat removal capability required during the post accident period can be attained.The operation of the Containment Spray System, together with the ice condenser, is adequate to assure pressure suppression subsequent to the initial blowdown of steam and water from a DBA. During the post blowdown period, the Air Return System (ARS) is automatically started.The ARS returns upper compartment air through the divider barrier to the lower compartment.
| |
| This serves to equalize pressures in containment and to continue circulating heated air and steam through the ice condenser, where heat is removed by the remaining ice.McGuire Unit 2 B 3.6.6-2 Revision No. 115 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012, there will be separate documents for Unit I and Unit 2 Bases.Containment Spray System B 3.6.6 BASES BACKGROUND (continued)
| |
| The Containment Spray System limits the temperature and pressure that could be expected following a DBA. Protection of containment integrity limits leakage of fission product radioactivity from containment to the environment.
| |
| APPLICABLE The limiting DBAs considered relative to containment OPERABILITY SAFETY ANALYSES are the loss of coolant accident (LOCA) and the steam line break (SLB).The DBA LOCA and SLB are analyzed using computer codes designed to predict the resultant containment pressure and temperature transients.
| |
| No two DBAs are assumed to occur simultaneously or consecutively.
| |
| The postulated DBAs are analyzed, in regard to containment ESF systems, assuming the loss of one ESF bus, which is the worst case single active failure, resulting in one train of the Containment Spray System, the RHR System, and the ARS being rendered inoperable (Ref. 2).The DBA analyses show that the maximum peak containment pressure results from the LOCA analysis, and is calculated to be less than the containment design pressure.
| |
| The maximum peak containment atmosphere temperature results from the SLB analysis and was calculated to be within the containment environmental qualification temperature during the DBA SLB. The basis of the containment environmental qualification temperature is to ensure the OPERABILITY of safety related equipment inside containment (Ref. 3).The modeled Containment Spray System actuation from the containment analysis is based on a response time associated with exceeding the containment pressure high-high signal setpoint to achieving full flow through the containment spray nozzles. A delayed response time initiation provides conservative analyses of peak calculated containment temperature and pressure responses.
| |
| The Containment Spray System total response time of 120 seconds is composed of single delay, diesel generator startup, and time for the piping to fill.For certain aspects of transient accident analyses, maximizing the calculated containment pressure is not conservative.
| |
| In particular, the ECCS cooling effectiveness during the core reflood phase of a LOCA analysis increases with increasing containment backpressure.
| |
| For these calculations, the containment backpressure is calculated in a manner designed to conservatively minimize, rather than maximize, the calculated transient containment pressures in accordance with 10 CFR 50, Appendix K (Ref. 4).McGuire Unit 2 B 3.6.6-3 Revision No. 115 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012, there will be separate documents for Unit I and Unit 2 Bases.Containment Spray System B 3.6.6 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| Inadvertent actuation is precluded by design features consisting of an additional set of containment pressure sensors which prevents operation when the containment pressure is below the containment pressure control system permissive.
| |
| The Containment Spray System satisfies Criterion 3 of 10 CFR 50.36 (Ref.5).LCO During a DBA, one train of Containment Spray System is required to provide the heat removal capability assumed in the safety analyses.
| |
| To ensure that this requirement is met, two containment spray trains must be OPERABLE with power from two safety related, independent power supplies.
| |
| Therefore, in the event of an accident, at least one train operates.Each Containment Spray System includes a spray pump, headers, valves, heat exchangers, nozzles, piping, instruments, and controls to ensure an OPERABLE flow path capable of taking suction from the RWST upon an ESF actuation signal and manually transferring suction to the containment sump.APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment and an increase in containment pressure and temperature requiring the operation of the Containment Spray System.In MODES 5 and 6, the probability and consequences of these events are reduced because of the pressure and temperature limitations of these MODES. Thus, the Containment Spray System is not required to be OPERABLE in MODE 5 or 6.ACTIONS A. 1 With one containment spray train inoperable, the affected train must be restored to OPERABLE status within 72 hours. The components in this degraded condition are capable of providing 100% of the heat removal after an accident.
| |
| The 72 hour Completion Time was developed taking into account the redundant heat removal and iodine removal capabilities afforded by the OPERABLE train and the low probability of a DBA occurring during this period.McGuire Unit 2 B 3.6.6-4 Revision No. 115 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012, there will be separate documents for Unit I and Unit 2 Bases.Containment Spray System B 3.6.6 BASES ACTIONS (continued)
| |
| B.1 and B.2 If the affected containment spray train cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 84 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.The extended interval to reach MODE 5 allows additional time and is reasonable when considering that the driving force for a release of radioactive material from the Reactor Coolant System is reduced in MODE 3.SURVEILLANCE SR 3.6.6.1 REQUIREMENTS Verifying the correct alignment of manual, power operated, and automatic valves, excluding check valves, in the Containment Spray System provides assurance that the proper flow path exists for Containment Spray System operation.
| |
| This SR does not apply to valves that are locked, sealed, or otherwise secured in position since they were verified in the correct position prior to being secured. This SR does not require any testing or valve manipulation.
| |
| Rather, it involves verification, through a system walkdown or computer status indication, that those valves outside containment and capable of potentially being mispositioned, are in the correct position.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.6.6.2 Verifying that each containment spray pump's developed head at the flow test point is greater than or equal to the required developed head ensures that spray pump performance has not degraded during the cycle. Flow and differential head are normal tests of centrifugal pump performance required by the ASME OM Code (Ref. 6). Since the containment spray pumps cannot be tested with flow through the spray headers, they are tested on bypass flow. This test confirms one point on the pump design curve and is indicative of overall performance.
| |
| Such inservice inspections confirm component OPERABILITY, trend performance, and detect incipient failures by indicating abnormal performance.
| |
| The Frequency of this SR is in accordance with the Inservice Testing Program.McGuire Unit 2 B 3.6.6-5 Revision No. 115 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012, there will be separate documents for Unit I and Unit 2 Bases.Containment Spray System B 3.6.6 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.6.6.3 and SR 3.6.6.4 These SRs require verification that each automatic containment spray valve actuates to its correct position and each containment spray pump starts upon receipt of an actual or simulated Containment Pressure High-High signal. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.6.6.5 and SR 3.6.6.6 These SRs require verification that each containment spray pump discharge valve opens or is prevented from opening and each containment spray pump starts or is de-energized and prevented from starting upon receipt of Containment Pressure Control System start and terminate signals. The CPCS is described in the Bases for LCO 3.3.2, " ESFAS." The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.6.6.7 With the containment spray inlet valves closed and the spray header drained of any solution, low pressure air or smoke can be blown through test connections.
| |
| The spray nozzles can also be tested using a vacuum blower to induce air flow through each nozzle to verify unobstructed flow.This SR requires verification that each spray nozzle is unobstructed following activities that could cause nozzle blockage.
| |
| Normal plant operation and activities are not expected to initiate this SR. However, activities such as inadvertent spray actuation that causes fluid flow through the nozzles, major configuration change, or a loss of foreign material control when working within the respective system boundary, may require surveillance performance.
| |
| McGuire Unit 2 B 3.6.6-6 Revision No. 115 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012, there will be separate documents for Unit I and Unit 2 Bases.Containment Spray System B 3.6.6 BASES REFERENCES
| |
| : 1. 10 CFR 50, Appendix A, GDC 38, GDC 39, GDC 40, GDC 41, GDC 42, and GDC 43.2. UFSAR, Section 6.2.3. 10 CFR 50.49.4. 10 CFR 50, Appendix K.5. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| : 6. ASME Code for Operation and Maintenance of Nuclear Power Plants.McGuire Unit 2 B 3.6.6-7 Revision No. 115
| |
| | |
| B 3.6.7 B 3.6 CONTAINMENT SYSTEMS B 3.6.7 Not Used McGuire Units 1 and 2 B 3.6.7 Rev 63 HSS B 3.6.8 B 3.6 CONTAINMENT SYSTEMS B 3.6.8 Hydrogen Skimmer System (HSS)-BASES BACKGROUND The HSS reduces the potential for breach of containment due to a hydrogen oxygen reaction by providing a uniformly mixed post accident containment atmosphere, thereby minimizing the potential for local hydrogen burns due to a pocket of hydrogen above the flammable concentration.
| |
| Maintaining a uniformly mixed containment atmosphere also ensures that the hydrogen monitors will give an accurate measure of the bulk hydrogen concentration and give the operator the capability of preventing the occurrence of a bulk hydrogen burn inside containment per 10 CFR 50.44, "Standards for Combustible Gas Control Systems in Light-Water-Cooled Reactors" (Ref. 1), and 10 CFR 50, GDC 41,"Containment Atmosphere Cleanup" (Ref. 2).The post accident HSS is an Engineered Safety Feature (ESF) and is designed to withstand a loss of coolant accident (LOCA) without loss of function.
| |
| The System has two independent trains, each consisting of two fans with their own motors and controls.
| |
| Each train is sized for 3000 cfm.There is a normally closed, motor-operated valve on the hydrogen skimmer suction line to reduce ice condenser bypass during initial blowdown.
| |
| The two trains are initiated automatically on a containment pressure high-high signal. The automatic action is to open the motor operated valve on the hydrogen skimmer suction line after a 9 +/- 1 minute delay. Once the valve has fully opened, the hydrogen skimmer fan will start. Each train is powered from a separate emergency power supply.Since each train fan can provide 100% of the mixing requirements, the System will provide its design function with a limiting single active failure.Air is -drawn from the dead ended compartments by the mixing fans and is discharged toward the upper regions of the containment.
| |
| This complements the air patterns established by the containment air return fans, which take suction from the operating floor level and discharge to the lower regions of the containment, and the containment spray, which cools the air and causes it to drop to lower elevations.
| |
| The systems work together such that potentially stagnant areas where hydrogen pockets could develop are eliminated.
| |
| McGuire Units 1 and 2 B 3.6.8-1 Revision No. 115 HSS B 3.6.8 BASES APPLICABLE The HSS provides the capability for reducing the local hydrogen SAFETY ANALYSES concentration to approximately the bulk average concentration.
| |
| The limiting DBA relative to hydrogen concentration is a LOCA.Hydrogen may accumulate in containment following a LOCA as a result of: a. A metal steam reaction between the zirconium fuel rod cladding and the reactor coolant;b. Radiolytic decomposition of water in the Reactor Coolant System (RCS) and the containment sump;c. Hydrogen in the RCS at the time of the LOCA (i.e., hydrogen dissolved in the reactor coolant and hydrogen gas in the pressurizer vapor space); or d. Corrosion of metals exposed to containment spray and Emergency Core Cooling System solutions.
| |
| To evaluate the potential for hydrogen accumulation in containment following a LOCA, the hydrogen generation as a function of time following the initiation of the accident is calculated.
| |
| Conservative assumptions recommended by Reference 3 are used to maximize the amount of hydrogen calculated.
| |
| The HSS satisfies Criterion 3 of 10 CFR 50.36 (Ref. 4).LCO Two HSS trains must be OPERABLE, with power to each from an independent, safety related power supply. Each train consists of one fan with its own motor and controls and is automatically initiated by a containment pressure high-high signal.Operation with at least one HSS train provides the mixing necessary to ensure uniform hydrogen concentration throughout containment.
| |
| APPLICABILITY In MODES 1 and 2, the two HSS trains ensure the capability to prevent localized hydrogen concentrations above the flammability limit of 4.0 volume percent in containment assuming a worst case single active failure.In MODE 3 or 4, both the hydrogen production rate and the total hydrogen produced after a LOCA would be less than that calculated for McGuire Units 1 and 2 B 3.6.8-2 Revision No. 115 HSS B 3.6.8 BASES APPLICABILITY (continued) the DBA LOCA. Also, because of the limited time in these MODES, the probability of an accident requiring the HSS is low. Therefore, the HSS is not required in MODE 3 or 4.In MODES 5 and 6, the probability and consequences of a LOCA or steam line break (SLB) are reduced due to the pressure and temperature limitations in these MODES. Therefore, the HSS is not required in these MODES.ACTIONS A.1 With one HSS train inoperable, the inoperable train must be restored to OPERABLE status within 30 days. In this Condition, the remaining OPERABLE HSS train is adequate to perform the hydrogen mixing function.
| |
| However, the overall reliability is reduced because a single failure in the OPERABLE train could result in reduced hydrogen mixing capability.
| |
| The 30 day Completion Time is based on the availability of the other HSS train, the small probability of a LOCA or SLB occurring (that would generate an amount of hydrogen that exceeds the flammability limit), the amount of time available after a LOCA or SLB (should one occur) for operator action to prevent hydrogen accumulation from exceeding the flammability limit, and the availability of the Hydrogen Mitigation System.B.1 If an inoperable HSS train cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours. The allowed Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.McGuire Units 1 and 2 B 3.6.8-3 Revision No. 115 HSS B 3.6.8 BASES SURVEILLANCE SR 3.6.8.1 REQUIREMENTS Operating each HSS train for > 15 minutes ensures that each train is OPERABLE and that all associated controls are functioning properly.
| |
| It also ensures that blockage, fan and/or motor failure, or excessive vibration can be detected for corrective action. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.6.8.2 Verifying HSS fan motor current at rated speed with the motor operated suction valves closed is indicative of overall fan motor performance and system flow. Such inservice tests confirm component OPERABILITY, trend performance, and detect incipient failures by indicating abnormal performance.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.6.8.3 This SR verifies the operation of the motor operated suction valves and HSS fans in response to a start permissive from the Containment Pressure Control System (CPCS). The CPCS is described in the Bases for LCO 3.3.2, "ESFAS." The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.6.8.4 This SR ensures that each HSS train responds properly to a containment pressure high-high actuation signal. The Surveillance verifies that each fan starts after a delay of > 8 minutes and _< 10 minutes. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Units 1 and 2 B 3.6.8-4 Revision No. 115 HSS B 3.6.8 BASES REFERENCES 1.2.3.4.10 CFR 50.44.10 CFR 50, Appendix A, GDC 41.Regulatory Guide 1.7, Revision 0.10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.6.8-5 Revision No. 115 HMS B 3.6.9 B 3.6 CONTAINMENT SYSTEMS B 3.6.9 Hydrogen Mitigation System (HMS)BASES BACKGROUND The HMS reduces the potential for breach of primary containment due to a hydrogen oxygen reaction in post accident environments.
| |
| The HMS is required by 10 CFR 50.44, "Standards for Combustible Gas Control Systems in Light-Water-Cooled Reactors" (Ref. 1), and Appendix A, GDC 41, "Containment Atmosphere Cleanup" (Ref. 2), to reduce the hydrogen concentration in the primary containment following a degraded core accident.
| |
| The HMS must be capable of handling an amount of hydrogen equivalent to that generated from a metal water reaction involving 75% of the fuel cladding surrounding the active fuel region (excluding the plenum volume).10 CFR 50.44 (Ref. 1) requires units with ice condenser containments to install suitable hydrogen control systems that would accommodate an amount of hydrogen equivalent to that generated from the reaction of 75% of the fuel cladding with water. The HMS provides this required capability.
| |
| This requirement was placed on ice condenser units because of their small containment volume and low design pressure (compared with pressurized water reactor dry containments).
| |
| Calculations indicate that if hydrogen equivalent to that generated from the reaction of 75% of the fuel cladding with water were to collect in the primary containment, the resulting hydrogen concentration would be far above the lower flammability limit such that, if ignited from a random ignition source, the resulting hydrogen burn would seriously challenge the containment and safety systems in the containment.
| |
| The HMS is based on the concept of controlled ignition using thermal ignitors, designed to be capable of functioning in a post accident environment, seismically supported, and capable of actuation from the control room. A total of 70 ignitors are distributed throughout the various regions of containment in which hydrogen could be released or to which it could flow in significant quantities.
| |
| The ignitors are arranged in two independent trains such that each containment region has at least two ignitors, one from each train, controlled and powered redundantly so that ignition would occur in each region even if one train failed to energize.When the HMS is initiated, the ignitor elements are energized and heat up to a surface temperature
| |
| > 1700 0 F. At this temperature, they ignite the hydrogen gas that is present in the airspace in the vicinity of the ignitor.The HMS depends on the dispersed location of the ignitors so McGuire Units 1 and 2 B 3.6.9-1 Revision No. 115 McGuire Units 1 and 2 B 3.6.9-1 Revision No. 115 HMS B 3.6.9 BASES BACKGROUND (continued) that local pockets of hydrogen at increased concentrations would burn before reaching a hydrogen concentration significantly higher than the lower flammability limit. Hydrogen ignition in the vicinity of the ignitors is assumed to occur when the local hydrogen concentration reaches 8.5 volume percent (v/o) and results in 100% of the hydrogen present being consumed.APPLICABLE The HMS causes hydrogen in containment to burn in a controlled manner SAFETY ANALYSES as it accumulates following a degraded core accident (Ref. 3). Burning occurs at the lower flammability concentration, where the resulting temperatures and pressures are relatively benign. Without the system, hydrogen could build up to higher concentrations that could result in a violent reaction if ignited by a random ignition source after such a buildup.The hydrogen ignitors are not included for mitigation of a Design Basis Accident (DBA) because an amount of hydrogen equivalent to that generated from the reaction of 75% of the fuel cladding with water is far in excess of the hydrogen calculated for the limiting DBA loss of coolant accident (LOCA). The hydrogen ignitors have been shown by probabilistic risk analysis to be a significant contributor to limiting the severity of accident sequences that are commonly found to dominate risk for units with ice condenser containments.
| |
| As such, the hydrogen ignitors satisfy Criterion 4 of 10 CFR 50.36 (Ref. 4).LCO Two HMS trains must be OPERABLE with power from two independent, safety related power supplies.For this unit, an OPERABLE HMS train consists of 34 of 35 ignitors energized on the train.Operation with at least one HMS train ensures that the hydrogen in containment can be burned in a controlled manner. Unavailability of both HMS trains could lead to hydrogen buildup to higher concentrations, which could result in a violent reaction if ignited. The reaction could take place fast enough to lead to high temperatures and overpressurization of containment and, as a result, breach containment or cause containment leakage rates above those assumed in the safety analyses.
| |
| Damage to safety related equipment located in containment could also occur.McGuire Units 1 and 2 B 3.6.9-2 Revision No. 115 McGuire Units 1 and 2 B 3.6.9-2 Revision No. 115 HMS B 3.6.9 BASES APPLICABILITY Requiring OPERABILITY in MODES 1 and 2 for the HMS ensures its immediate availability after safety injection and scram actuated on a LOCA initiation.
| |
| In the post accident environment, the two HMS subsystems are required to control the hydrogen concentration within containment to near its flammability limit of 4.0 v/o assuming a worst case single failure. This prevents overpressurization of containment and damage to safety related equipment and instruments located within containment.
| |
| In MODES 3 and 4, both the hydrogen production rate and the total hydrogen production after a LOCA would be significantly less than that calculated for the DBA LOCA. Also, because of the limited time in these MODES, the probability of an accident requiring the HMS is low.Therefore, the HMS is not required in MODES 3 and 4.In MODES 5 and 6, the probability and consequences of a LOCA are reduced due to the pressure and temperature limitations of these MODES. Therefore, the HMS is not required to be OPERABLE in MODES 5 and 6.ACTIONS A.1 and A.2 With one HMS train inoperable, the inoperable train must be restored to OPERABLE status within 7 days or the OPERABLE train must be verified OPERABLE frequently by performance of SR 3.6.9.1. The 7 day Completion Time is based on the low probability of the occurrence of a degraded core event that would generate hydrogen in amounts equivalent to a metal water reaction of 75% of the core cladding, the length of time after the event that operator action would be required to prevent hydrogen accumulation from exceeding this limit, and the low probability of failure of the OPERABLE HMS train. Alternative Required Action A.2, by frequent surveillances, provides assurance that the OPERABLE train continues to be OPERABLE.B. 1 Condition B is one containment region with no OPERABLE hydrogen ignitor. Thus, while in Condition B, or in Conditions A and B simultaneously, there would always be ignition capability in the adjacent containment regions that would provide redundant capability by flame propagation to the region with no OPERABLE ignitors.Required Action B.1 calls for the restoration of one hydrogen ignitor in each region to OPERABLE status within 7 days. The 7 day Completion Time is based on the same reasons given under Required Action A. 1.McGuire Units 1 and 2 B 3.6.9-3 Revision No. 115 HMS B 3.6.9 BASES ACTIONS (continued)
| |
| C.1 The unit must be placed in a MODE in which the LCO does not apply if the HMS subsystem(s) cannot be restored to OPERABLE status within the associated Completion Time. This is done by placing the unit in at least MODE 3 within 6 hours. The allowed Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.SURVEILLANCE SR 3.6.9.1 REQUIREMENTS This SR confirms that _> 34 of 35 hydrogen ignitors can be successfully energized in each train. The ignitors are simple resistance elements.Therefore, energizing provides assurance of OPERABILITY.
| |
| The allowance of one inoperable hydrogen ignitor is acceptable because, although one inoperable hydrogen ignitor in a region would compromise redundancy in that region, the containment regions are interconnected so that ignition in one region would cause burning to progress to the others (i.e., there is overlap in each hydrogen ignitor's effectiveness between regions).
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.6.9.2 This SR confirms that the two inoperable hydrogen ignitors allowed by SR 3.6.9.1 (i.e., one in each train) are not in the same containment region. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.6.9.3 A more detailed functional test is performed to verify system OPERABILITY.
| |
| Each glow plug is visually examined to ensure that it is clean and that the electrical circuitry is energized.
| |
| All ignitors (glow plugs), including normally inaccessible ignitors, are visually checked for a glow to verify that they are energized.
| |
| Additionally, the surface temperature of each glow plug is measured to be > 1700°F to demonstrate that a temperature sufficient for ignition is achieved The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Units 1 and 2 B 3.6.9-4 Revision No. 115 HMS B 3.6.9 BASES REFERENCES 1.2.3.4.10 CFR 50.44.10 CFR 50, Appendix A, GDC 41.UFSAR, Section 6.2.10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.6.9-5 Revision No. 115 AVS B 3.6.10 B 3.6 CONTAINMENT SYSTEMS B 3.6.10 Annulus Ventilation System (AVS)BASES BACKGROUND The AVS is required by 10 CFR 50, Appendix A, GDC 41, "Containment Atmosphere Cleanup" (Ref. 1), to ensure that radioactive materials that leak from the primary containment into the reactor building (secondary containment) following a Design Basis Accident (DBA) are filtered and adsorbed prior to exhausting to the environment.
| |
| The containment has a secondary containment called the reactor building, which is a concrete structure that surrounds the steel primary containment vessel. Between the containment vessel and the reactor building inner wall is an annulus that collects any containment leakage that may occur following a loss of coolant accident (LOCA) or rod ejection accident.
| |
| This space also allows for periodic inspection of the outer surface of the steel containment vessel.The AVS establishes a negative pressure in the annulus between the reactor building and the steel containment vessel. Filters in the system then control the release of radioactive contaminants to the environment.
| |
| Reactor building OPERABILITY is required to ensure retention of primary containment leakage and proper operation of the AVS.The AVS consists of two separate and redundant trains. Each train includes a heater, mechanical demister, a prefilter/
| |
| moisture separator, upstream and downstream high efficiency particulate air (HEPA) filter, an activated charcoal adsorber section for removal of radioiodines, and a fan. Ductwork, valves and/or dampers, and instrumentation also form part of the system. The heaters and mechanical demisters function to reduce the moisture content of the airstream to less than 70% relative humidity.
| |
| A second bank of HEPA filters follows the adsorber section to collect carbon fines and provide backup in case of failure of the main HEPA filter bank. Only the upstream HEPA filter and the charcoal adsorber section are credited in the analysis.
| |
| The system initiates and maintains a negative air pressure in the reactor building annulus by means of filtered exhaust ventilation of the reactor building annulus following receipt of a Phase B isolation signal. The system is described in Reference 2.The prefilters remove large particles in the air, and the moisture separators remove entrained water droplets present, to prevent excessive loading of the HEPA filters and charcoal absorbers.
| |
| Heaters are included McGuire Units 1 and 2 B 3.6.10-1 Revision No. 115 McGuire Units 1 and 2 B 3.6.10-1 Revision No. 115 AVS B 3.6.10 BASES BACKGROUND (continued) to reduce the relative humidity of the airstream.
| |
| Continuous operation of each train, for at least 10 hours per month, with heaters on, reduces moisture buildup on their HEPA filters and adsorbers.
| |
| The mechanical demisters cool the air to keep the charcoal beds from becoming too hot due to absorption of fission product.The AVS reduces the radioactive content in the annulus atmosphere following a DBA. Loss of the AVS could cause site boundary doses, in the event of a DBA, to exceed the values given in the licensing basis.APPLICABLE The AVS design basis is established by the consequences of the limiting SAFETY ANALYSES DBA, which is a LOCA. The accident analysis (Ref. 3) assumes that only one train of the AVS is functional due to a single failure that disables the other train. The accident analysis accounts for the reduction in airborne radioactive material provided by the remaining one train of this filtration system. The amount of fission products available for release from containment is determined for a LOCA.The modeled AVS actuation in the safety analyses is based upon a worst case response time following a Phase B isolation signal initiated at the limiting setpoint.
| |
| The total response time, from exceeding the signal setpoint to attaining the negative pressure of 0.5 inch water gauge in the reactor building annulus, is 22 seconds. The pressure then goes to -3.5 inches water within 48 seconds after the start signal is initiated.
| |
| At this point the system switches into its recirculation mode of operation and pressure may increase to -0.5 inches water within 278 seconds but will not go above -0.5 inches water. This response time is composed of signal delay, diesel generator startup and sequencing time, system startup time, and time for the system to attain the required pressure after starting.The AVS satisfies Criterion 3 of 10 CFR 50.36 (Ref. 4).LCO In the event of a DBA, one AVS train is required to provide the minimum particulate iodine removal assumed in the safety analysis.
| |
| Two trains of the AVS must be OPERABLE to ensure that at least one train will operate, assuming that the other train is disabled by a single active failure.McGuire Units 1 and 2 B 3.6.10-2 Revision No. 115 AVS B 3.6.10 BASES APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could lead to fission product release to containment that leaks to the reactor building.
| |
| The large break LOCA, on which this system's design is based, is a full power event. Less severe LOCAs and leakage still require the system to be OPERABLE throughout these MODES. The probability and severity of a LOCA decrease as core power and Reactor Coolant System pressure decrease.
| |
| With the reactor shut down, the probability of release of radioactivity resulting from such an accident is low.In MODES 5 and 6, the probability and consequences of a DBA are low due to the pressure and temperature limitations in these MODES. Under these conditions, the AVS is not required to be OPERABLE.ACTIONS A.1 With one AVS train inoperable, the inoperable train must be restored to OPERABLE status within 7 days. The 7 day Completion Time is based on consideration of such factors as the availability of the OPERABLE redundant AVS train and the low probability of a DBA occurring during this period. The Completion Time is adequate to make most repairs.B.1 and B.2 With one or more AVS heaters inoperable, the heater must be restored to OPERABLE status within 7 days. Alternatively, a report must be initiated within 7 days in accordance with Specification 5.6.6, which details the reason for the heater's inoperability and the corrective action required to return the heater to OPERABLE status.The heaters do not affect OPERABILITY of the AVS filter train because charcoal adsorber efficiency testing is performed at 30'C and 95%relative humidity.
| |
| The accident analysis shows that site boundary radiation doses are within 10 CFR 50.67 (Ref. 6) limits during a DBA LOCA under these conditions.
| |
| C.1 and C.2 If the AVS train cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within McGuire Units 1 and 2 B 3.6.10-3 Revision No. 115 AVS B 3.6.10 BASES ACTIONS (continued) 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.SURVEILLANCE SR 3.6.10.1 REQUIREMENTS Operating each AVS train from the control room with flow through the HEPA filters and activated carbon adsorbers ensures that all trains are OPERABLE and that all associated controls are functioning properly.
| |
| It also ensures that blockage, fan or motor failure, or excessive vibration can be detected for corrective action. Operation with the heaters on for> 10 continuous hours eliminates moisture on the adsorbers and HEPA filters. Experience from filter testing at operating units indicates that the 10 hour period is adequate for moisture elimination on the adsorbers and HEPA filters. Inoperable heaters are addressed by Required Actions B.1 and B.2. The inoperability of heaters between required performances of this surveillance does not affect OPERABILITY of each AVS train. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.6.10.2 This SR verifies that the required AVS filter testing is performed in accordance with the Ventilation Filter Testing Program (VFTP). The AVS filter tests are in accordance with Regulatory Guide 1.52 (Ref. 5) with exceptions as noted in the UFSAR. The VFTP includes testing HEPA filter performance, charcoal adsorber efficiency, minimum system flow rate, and the physical properties of the activated charcoal (general use and following specific operations).
| |
| Specific test frequencies and additional information are discussed in detail in the VFTP.SR 3.6.10.3 The automatic startup on a Containment Phase B Isolation signal ensures that each AVS train responds properly.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Units I and 2 B 3.6.10-4 Revision No. 115 McGuire Units 1 and 2 B 3.6.10-4 Revision No. 115 AVS B 3.6.10 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.6.10.4 The AVS filter cooling electric motor-operated bypass valves are tested to verify OPERABILITY.
| |
| The valves are normally closed and may need to be opened to initiate miniflow cooling through a filter unit that has been shutdown following a DBA LOCA. Miniflow cooling may be necessary to limit temperature increase in the idle filter train due to decay heat from captured fission products.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.6.10.5 The proper functioning of the fans, dampers, filters, adsorbers, etc., as a system is verified by the ability of each train to produce the required system flow rate. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. 10 CFR 50, Appendix A, GDC 41.2. UFSAR, Section 6.2.3. UFSAR, Chapter 15.4. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| : 5. Regulatory Guide 1.52, Revision 2.6. 10 CFR 50.67, "Accident Source Term." McGuire Units 1 and 2 133-6.10-5 Revision No. 115 UNIT 1 BASES 3.6.11 License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit 1 only during I EOC2 1. Until the ECCS amendment can be implemented on Unit 2, there will be separate documents for Unit I and Unit 2 Bases 3.6.11.ECCS Water Management Modification is scheduled to be implemented on Unit 2 during the fall 2012 outage.
| |
| tNIT 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit 1 only during I EOC2 1.Until the ECCS amendment can be implemented on Unit 2, there will be separate Bases documents for Unit I and Unit 2 for Bases 3.3.2, 3.3.3.3.5.4, 3.6.6, and 3.6.11. ECCS Water Management Modification is scheduled to be implemented on Unit 2 during the fall 2012 outage.ARS B 3.6.11 B 3.6 CONTAINMENT SYSTEMS B 3.6.11 Air Return System (ARS)BASES BACKGROUND The ARS is designed to assure the rapid return of air from the upper to the lower containment compartment after the initial blowdown following a Design Basis Accident (DBA). The return of this air to the lower compartment and subsequent recirculation back up through the ice condenser assists in cooling the containment atmosphere and limiting post accident pressure and temperature in containment to less than design values. Limiting pressure and temperature reduces the release of fission product radioactivity from containment to the environment in the event of a DBA. The ARS also promotes hydrogen dilution by mixing the hydrogen with containment atmosphere and distributing throughout the containment.
| |
| The ARS consists of two separate trains of equal capacity, each capable of meeting the design bases. Each train includes a 100% capacity air return fan and associated motor operated damper in the fan discharge line to the containment lower compartment.
| |
| The damper acts as a barrier between the upper and lower compartments to prevent reverse flow which would bypass the ice condenser.
| |
| The damper is normally closed and remains closed throughout the initial blowdown following a postulated high energy line break. The damper motor is actuated several seconds after the containment pressure high-high setpoint is reached and a start permissive from the Containment Pressure Control System is present. A backdraft damper is also provided at the discharge of each fan to serve as a check damper on the non-operating train. Each train is powered from a separate Engineered Safety Features (ESF) bus.The ARS fans are automatically started by the containment pressure high-high signal 9 +/- 1 minutes after the containment pressure reaches the pressure setpoint and a start permissive from the Containment Pressure Control System is present. Initially during a design basis accident LOCA or HELB, natural circulation forces steam and air flow from lower containment through the ice condenser to upper containment.
| |
| Hydrogen accumulation is not a major concern, and adequate mixing of the containment atmosphere occurs. Therefore, the ARS fans are not required until approximately 10 minutes after the design basis accident.The fan start time delay allows the upper and lower containment pressure to equalize and reduce the differential pressure.McGuire Unit I B 3.6.11-1 Revision No. 117 UNIT 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during 1EOC21.ECCS Water Management Modification is scheduled to be implemented on Unit 2 during the fall 2012 outage.ARS B 3.6.11 BASES BACKGROUND (continued)
| |
| After starting, the fans displace air from the upper compartment to the lower compartment, thereby returning the air that was displaced by the high energy line break blowdown from the lower compartment and equalizing pressures throughout containment.
| |
| After discharge into the lower compartment, air flows with steam produced by residual heat through the ice condenser doors into the ice condenser compartment where the steam portion of the flow is condensed.
| |
| The air flow returns to the upper compartment through the top deck doors in the upper portion of the ice condenser compartment.
| |
| The ARS fans operate continuously after actuation, circulating air through the containment volume. When the containment pressure falls below a predetermined value, the ARS fans are automatically de-energized.
| |
| Thereafter, the fans are automatically cycled on and off if necessary to control any additional containment pressure transients.
| |
| The ARS also functions, after all the ice has melted, to circulate any steam still entering the lower compartment to the upper compartment where the Containment Spray System can cool it.The ARS is an ESF system. It is designed to ensure that the heat removal capability required during the post accident period can be attained.
| |
| The operation of the ARS, in conjunction with the ice bed, the Containment Spray System, and the Residual Heat Removal (RHR)System spray, provides the required heat removal capability to limit post accident conditions to less than the containment design values.In response to NRC Bulletin 2003-01, "Potential Impact of Debris Blockage on Emergency Sump Recirculation at Pressurized Water Reactors," McGuire has the option of starting one air return fan at a containment pressure of 1 psig during certain small break LOCA (SBLOCA) transient events.APPLICABLE SAFETY ANALYSES The limiting DBAs considered relative to containment temperature and and pressure are the loss of coolant accident (LOCA) and the steam line break (SLB). The LOCA and SLB are analyzed using computer codes designed to predict the resultant containment pressure and temperature transients.
| |
| DBAs are assumed not to occur simultaneously or consecutively.
| |
| The postulated DBAs are analyzed, in regard to ESF systems, assuming the loss of one ESF bus, which is the worst case single active failure and results in one train each of the Containment Spray System, RHR System, and ARS being inoperable (Ref. 1). The DBA analyses show that the maximum peak containment pressure results from the LOCA analysis and is calculated to be less than the containment design pressure.McGuire Unit 1 B 3.6.11-2 Revision No. 117 UNIT 1 -License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit 1 only during I EOC2 1.ECCS Water Management Modification is scheduled to be implemented on Unit 2 during the fall 2012 outage.ARS B 3.6.11 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| For certain aspects of transient accident analyses, maximizing the calculated containment pressure is not conservative.
| |
| In particular, the cooling effectiveness of the Emergency Core Cooling System during the core reflood phase of a LOCA analysis increases with increasing containment backpressure.
| |
| For these calculations, the containment backpressure is calculated in a manner designed to conservatively minimize, rather than maximize, the calculated transient containment pressures, in accordance with 10 CFR 50, Appendix K (Ref. 2).The analysis for minimum internal containment pressure (i.e., maximum external differential containment pressure) assumes inadvertent simultaneous actuation of both the ARS and the Containment Spray System.The modeled ARS actuation from the containment analysis is based upon a response time associated with exceeding the containment pressure High-High signal setpoint to achieving full ARS air flow. A delayed response time initiation provides conservative analyses of peak calculated containment temperature and pressure responses.
| |
| The ARS total response time of 600 seconds includes signal delays.The ARS satisfies Criterion 3 of 10 CFR 50.36 (Ref. 3).LCO In the event of a DBA, one train of the ARS is required to provide the minimum air recirculation for heat removal assumed in the safety analyses.
| |
| To ensure this requirement is met, two trains of the ARS must be OPERABLE.
| |
| This will ensure that at least one train will operate, assuming the worst case single failure occurs, which is in the ESF power supply.APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause an increase in containment pressure and temperature requiring the operation of the ARS. Therefore, the LCO is applicable in MODES 1, 2, 3, and 4.In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, the ARS is not required to be OPERABLE in these MODES.McGuire Unit 1 B 3.6.11-3 Revision No. 117 UNIT 1 -License Amendment No. 3 65/245 (ECCS Water Management Modification) was implemented on Unit 1 only during 1 EOC2 1.ECCS Water Management Modification is scheduled to be implemented on Unit 2 during the fall 2012 outage.ARS B 3.6.11 BASES ACTIONS A.1.: If one of the required trains of the ARS is inoperable, it must be restored to OPERABLE status within 72 hours. The 72 hour Completion Time was developed taking into account the redundant flow of the OPERABLE ARS train and the low probability of a DBA occurring in this period.B.1 and B.2 If the ARS train cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.SURVEILLANCE SR 3.6.11.1 REQUIREMENTS Verifying that each ARS fan starts on an actual or simulated actuation signal, after a delay _> 8.0 minutes and < 10.0 minutes, and operates for_> 15 minutes is sufficient to ensure that all fans are OPERABLE and that all associated controls and time delays are functioning properly.
| |
| It also ensures that blockage, fan and/or motor failure, or excessive vibration can be detected for corrective action. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.6.11.2 Verifying ARS fan motor current to be at rated speed with the return air dampers closed confirms one operating condition of the fan. This test is indicative of overall fan motor performance.
| |
| Such inservice tests confirm component OPERABILITY, trend performance, and detect incipient failures by indicating abnormal performance.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.6.11.3 Verifying the OPERABILITY of the return air damper provides assurance that the proper flow path will exist when the fan is started. This surveillance also tests the circuitry, including time delays, to ensure the system operates properly.
| |
| The Surveillance Frequency is based on McGuire Unit 1 B 3.6.11-4 Revision No. 117 UNIT 1- License Amendment No. 365/245 (ECCS Water Management Modification) was implemented on Unit I only during 1EOC2 1.ECCS Water Management Modification is scheduled to be implemented on Unit 2 during the fall 2012 outage.ARS B 3.6.11 BASES SURVEILLANCE REQUIREMENTS (continued) operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.6.11.4 and SR 3.6.1.1.5 Verifying the OPERABILITY of the check damper in the air return fan discharge line to the containment lower compartment provides assurance that the proper flow path will exist when the fan is started and that reverse flow can not occur when the fan is not operating.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.6.11.6 and SR 3.6.11.7 These SRs require verification that each ARS motor operated damper opens or is prevented from opening and each ARS fan is allowed to start or is prevented from starting upon receipt of Containment Pressure Control System start permissive and terminate signals. The CPCS is described in the Bases for LCO 3.3.2, "ESFAS." The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. UFSAR, Section 6.2.2. 10 CFR 50, Appendix K.3. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Unit 1 B 3.6.11-5 Revision No. 117 UNIT 2 BASES 3.6.11 Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012, there will be separate documents for Unit 1 and Unit 2 Bases 3.6.11.ECCS Water Management Modification was implemented on Unit 1 during the 1 EOC21 outage.
| |
| UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012, there will be separate documents for Unit I and Unit 2 Bases: 3.3.2, 3.3.3, 3.5.4, 3.6.6, and 3.6.11 ARS B 3.6.11 B 3.6 CONTAINMENT SYSTEMS B 3.6.11 Air Return System (ARS)BASES BACKGROUND The ARS is designed to assure the rapid return of air from the upper to the lower containment compartment after the initial blowdown following a Design Basis Accident (DBA). The return of this air to the lower compartment and subsequent recirculation back up through the ice condenser assists in cooling the containment atmosphere and limiting post accident pressure and temperature in containment to less than design values. Limiting pressure and temperature reduces the release of fission product radioactivity from containment to the environment in the event of a DBA. The ARS also promotes hydrogen dilution by mixing the hydrogen with containment atmosphere and distributing throughout the containment.
| |
| The ARS consists of two separate trains of equal capacity, each capable of meeting the design bases. Each train includes a 100% capacity air return fan and associated motor operated damper in the fan discharge line to the containment lower compartment.
| |
| The damper acts as a barrier between the upper and lower compartments to prevent reverse flow which would bypass the ice condenser.
| |
| The damper is normally closed and remains closed throughout the initial blowdown following a postulated high energy line break. The damper motor is actuated several seconds after the containment pressure high-high setpoint is reached and a start permissive from the Containment Pressure Control System is present. A backdraft damper is also provided at the discharge of each fan to serve as a check damper on the non-operating train. Each train is powered from a separate Engineered Safety Features (ESF) bus.The ARS fans are automatically started by the containment pressure high-high signal 9 +/- 1 minutes after the containment pressure reaches the pressure setpoint and a start permissive from the Containment Pressure Control System is present. Initially during a design basis accident LOCA or HELB, natural circulation forces steam and air flow from lower containment through the ice condenser to upper containment.
| |
| Hydrogen accumulation is not a major concern, and adequate mixing of the containment atmosphere occurs. Therefore, the ARS fans are not required until approximately 10 minutes after the design basis accident.The fan start time delay allows the upper and lower containment pressure to equalize and reduce the differential pressure.McGuire Unit 2 B 3.6.11 -1 Revision No. 115 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012, there will be separate documents for Unit I and Unit 2 Bases.ARS B 3.6.11 BASES BACKGROUND (continued)
| |
| After starting, the fans displace air from the upper compartment to the lower compartment, thereby returning the air that was displaced by the high energy line break blowdown from the lower compartment and equalizing pressures throughout containment.
| |
| After discharge into the lower compartment, air flows with steam produced by residual heat through the ice condenser doors into the ice condenser compartment where the steam portion of the flow is condensed.
| |
| The air flow returns to the upper compartment through the top deck doors in the upper portion of the ice condenser compartment.
| |
| The ARS fans operate continuously after actuation, circulating air through the containment volume. When the containment pressure falls below a predetermined value, the ARS fans are automatically de-energized.
| |
| Thereafter, the fans are automatically cycled on and off if necessary to control any additional containment pressure transients.
| |
| The ARS also functions, after all the ice has melted, to circulate any steam still entering the lower compartment to the upper compartment where the Containment Spray System can cool it.The ARS is an ESF system. It is designed to ensure that the heat removal capability required during the post accident period can be attained.
| |
| The operation of the ARS, in conjunction with the ice bed, the Containment Spray System, and the Residual Heat Removal (RHR)System spray, provides the required heat removal capability to limit post accident conditions to less than the containment design values.In response to NRC Bulletin 2003-01, "Potential Impact of Debris Blockage on Emergency Sump Recirculation at Pressurized Water Reactors," McGuire has the option of starting one air return fan at a containment pressure of 1 psig during certain small break LOCA (SBLOCA) transient events. This is an additional manual operator action to prevent or delay reaching the initiation pressure setpoint for containment spray and possible subsequent sump screen debris buildup.APPLICABLE The limiting DBAs considered relative to containment temperature and SAFETY ANALYSES and pressure are the loss of coolant accident (LOCA) and the steam line break (SLB). The LOCA and SLB are analyzed using computer codes designed to predict the resultant containment pressure and temperature transients.
| |
| DBAs are assumed not to occur simultaneously or consecutively.
| |
| The postulated DBAs are analyzed, in regard to ESF systems, assuming the loss of one ESF bus, which is the worst case single active failure and results in one train each of the Containment Spray System, RHR System, and ARS being inoperable (Ref. 1). The DBA analyses show that the maximum peak containment pressure results from the LOCA analysis and is calculated to be less than the containment design pressure.McGuire Unit 2 B 3.6.11-2 Revision No. 115 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012, there will be separate documents for Unit I and Unit 2 Bases.ARS B 3.6.11 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| For certain aspects of transient accident analyses, maximizing the calculated containment pressure is not conservative.
| |
| In particular, the cooling effectiveness of the Emergency Core Cooling System during the core reflood phase of a LOCA analysis increases with increasing containment backpressure.
| |
| For these calculations, the containment backpressure is calculated in a manner designed to conservatively minimize, rather than maximize, the calculated transient containment pressures, in accordance with 10 CFR 50, Appendix K (Ref. 2).The analysis for minimum internal containment pressure (i.e., maximum external differential containment pressure) assumes inadvertent simultaneous actuation of both the ARS and the Containment Spray System.The modeled ARS actuation from the containment analysis is based upon a response time associated with exceeding the containment pressure High-High signal setpoint to achieving full ARS air flow. A delayed response time initiation provides conservative analyses of peak calculated containment temperature and pressure responses.
| |
| The ARS total response time of 600 seconds includes signal delays.In the SBLOCA analysis performed in response to NRC Bulletin 2003-01, one ARS fan is manually placed in operation to prevent or delay the start of the Containment Spray System. This will minimize the amount of spray water available to transport debris to the containment sump as well as delay swapover from the Refueling Water Storage Tank.The ARS satisfies Criterion 3 of 10 CFR 50.36 (Ref. 3).LCO In the event of a DBA, one train of the ARS is required to provide the minimum air recirculation for heat removal assumed in the safety analyses.
| |
| To ensure this requirement is met, two trains of the ARS must be OPERABLE.
| |
| This will ensure that at least one train will operate, assuming the worst case single failure occurs, which is in the ESF power supply.APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause an increase in containment pressure and temperature requiring the operation of the ARS. Therefore, the LCO is applicable in MODES 1, 2, 3, and 4.In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, the ARS is not required to be OPERABLE in these MODES.McGuire Unit 2 B 3.6.11-3 Revision No. 115 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012, there will be separate documents for Unit I and Unit 2 Bases.ARS B 3.6.11 BASES ACTIONS A. 1 If one of the required trains of the ARS is inoperable, it must be restored to OPERABLE status within 72 hours. The 72 hour Completion Time was developed taking into account the redundant flow of the OPERABLE ARS train and the low probability of a DBA occurring in this period.B.1 and B.2 If the ARS train cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.SURVEILLANCE SR 3.6.11.1 REQUIREMENTS Verifying that each ARS fan starts on an actual or simulated actuation signal, after a delay >_ 8.0 minutes and < 10.0 minutes, and operates for> 15 minutes is sufficient to ensure that all fans are OPERABLE and that all associated controls and time delays are functioning properly.
| |
| It also ensures that blockage, fan and/or motor failure, or excessive vibration can be detected for corrective action. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.6.11.2 Verifying ARS fan motor current to be at rated speed with the return air dampers closed confirms one operating condition of the fan. This test is indicative of overall fan motor performance.
| |
| Such inservice tests confirm component OPERABILITY, trend performance, and detect incipient failures by indicating abnormal performance.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.6.11.3 Verifying the OPERABILITY of the return air damper provides assurance that the proper flow path will exist when the fan is started. This surveillance also tests the circuitry, including time delays, to ensure the system operates properly.
| |
| The Surveillance Frequency is based on McGuire Unit 2 B 3.6.11-4 Revision No. 115 UNIT 2- Until License Amendment No. 365/245 (ECCS Water Management Modification) can be implemented on Unit 2, which is scheduled during the fall outage of 2012, there will be separate documents for Unit I and Unit 2 Bases.ARS B 3.6.11 BASES SURVEILLANCE REQUIREMENTS (continued) operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.6.11.4 and SR 3.6.11.5 Verifying the OPERABILITY of the check damper in the air return fan discharge line to the containment lower compartment provides assurance that the proper flow path will exist when the fan is started and that reverse flow can not occur when the fan is not operating.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.6.11.6 and SR 3.6.11.7 These SRs require verification that each ARS motor operated damper opens or is prevented from opening and each ARS fan is allowed to start or is prevented from starting upon receipt of Containment Pressure Control System start permissive and terminate signals. The CPCS is described in the Bases for LCO 3.3.2, "ESFAS." The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. UFSAR, Section 6.2.2. 10 CFR 50, Appendix K.3. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Unit 2 B] 3.6.11-5 Revision No. 115 Ice Bed B 3.6.12 B 3.6 CONTAINMENT SYSTEMS B 3.6.12 Ice Bed BASES BACKGROUND The ice bed consists of a minimum of 1,890,000 lbs of ice stored within the ice condenser.
| |
| The primary purpose of the ice bed is to provide a large heat sink in the event of a release of energy from a Design Basis Accident (DBA) in containment.
| |
| The ice would absorb energy and limit containment peak pressure and temperature during the accident transient.
| |
| Limiting the pressure and temperature reduces the release of fission product radioactivity from containment to the environment in the event of a DBA.The ice condenser is an annular compartment enclosing approximately 3000 of the perimeter of the upper containment compartment, but penetrating the operating deck so that a portion extends into the lower containment compartment.
| |
| The lower portion has a series of hinged doors exposed to the atmosphere of the lower containment compartment, which, for normal unit operation, are designed to remain closed. At the top of the ice condenser is another set of doors exposed to the atmosphere of the upper compartment, which also remain closed during normal unit operation.
| |
| Intermediate deck doors, located below the top deck doors, form the floor of a plenum at the upper part of the ice condenser.
| |
| These doors also remain closed during normal unit operation.
| |
| The upper plenum area is used to facilitate surveillance and maintenance of the ice bed.The ice baskets contain the ice within the ice condenser.
| |
| The ice bed is considered to consist of the total volume from the bottom elevation of the ice baskets to the top elevation of the ice baskets. The ice baskets position the ice within the ice bed in an arrangement to promote heat transfer from steam to ice. This arrangement enhances the ice condenser's primary function of condensing steam and absorbing heat energy released to the containment during a DBA.In the event of a DBA, the ice condenser inlet doors (located below the operating deck) open due to the pressure rise in the lower compartment.
| |
| This allows air and steam to flow from the lower compartment into the ice condenser.
| |
| The resulting pressure increase within the ice condenser causes the intermediate deck doors and the top deck doors to open, which allows the air to flow out of the ice condenser into the upper compartment.
| |
| Steam condensation within the ice condenser limits the pressure and temperature buildup in containment.
| |
| A divider barrier (i.e., operating deck and extensions thereof) separates the upper and lower compartments and ensures that the steam is directed into the ice condenser.
| |
| McGuire Unit 1 and 2 B 3.6.12-1 Revision No. 115 Ice Bed B 3.6.12 BASES BACKGROUND (continued)
| |
| The ice, together with the containment spray, is adequate to absorb the initial blowdown of steam and water from a DBA and the additional heat loads that would enter containment during several hours following the initial blowdown.
| |
| The additional heat loads would come from the residual heat in the reactor core, the hot piping and components, and the secondary system, including the steam generators.
| |
| During the post blowdown period, the Air Return System (ARS) returns upper compartment air through the divider barrier to the lower compartment.
| |
| This serves to equalize pressures in containment and to continue circulating heated air and steam from the lower compartment through the ice condenser where the heat is removed by the remaining ice.As ice melts, the water passes through the ice condenser floor drains into the lower compartment.
| |
| Thus, a second function of the ice bed is to be a large source of borated water (via the containment sump) for long term Emergency Core Cooling System (ECCS) and Containment Spray System heat removal functions in the recirculation mode.A third function of the ice bed and melted ice is to remove fission product iodine that may be released from the core during a DBA. Iodine removal occurs during the ice melt phase of the accident and continues as the melted ice is sprayed into the containment atmosphere by the Containment Spray System. The ice is adjusted to an alkaline pH that facilitates removal of radioactive iodine from the containment atmosphere.
| |
| The alkaline pH also minimizes the occurrence of the chloride and caustic stress corrosion on mechanical systems and components exposed to ECCS and Containment Spray System fluids in the recirculation mode of operation.
| |
| It is important for ice to exist in the ice baskets, the ice to be appropriately distributed around the 24 ice condenser bays, and for open flow paths to exist around ice baskets. This is especially important during the initial blowdown so that the steam and water mixture entering the lower compartment do not pass through only part of the ice condenser, depleting the ice there while bypassing the ice in other bays.Two phenomena that can degrade the ice bed during the long service period are: a. Loss of ice by melting or sublimation; and b. Obstruction of flow passages through the ice bed due to buildup of ice.Both of these degrading phenomena are reduced by minimizing air leakage into and out of the ice condenser.
| |
| McGuire Unit I and 2 B 3.6.12-2 Revision No. 115 McGuire Unit 1 and 2 B 3.6.12-2 Revision No. 115 Ice Bed B 3.6.12 BASES BACKGROUND (continued)
| |
| The ice bed limits the temperature and pressure that could be expected following a DBA, thus limiting leakage of fission product radioactivity from containment to the environment.
| |
| APPLICABLE The limiting DBAs considered relative to containment temperature and SAFETY ANALYSES pressure are the loss of coolant accident (LOCA) and the steam line break (SLB). The LOCA and SLB are analyzed using computer codes designed to predict the resultant containment pressure and temperature transients.
| |
| DBAs are not assumed to occur simultaneously or consecutively.
| |
| Although the ice condenser is a passive system that requires no electrical power to perform its function, the Containment Spray System, RHR Spray System, and the ARS also function to assist the ice bed in limiting pressures and temperatures.
| |
| Therefore, the postulated DBAs are analyzed in regards to containment Engineered Safety Feature (ESF)systems, assuming the loss of one ESF bus, which is the worst case single active failure and results in one train each of the Containment Spray System, RHR Spray System, and ARS being inoperable.
| |
| The limiting DBA analyses (Ref. 1) show that the maximum peak containment pressure results from the LOCA analysis and is calculated to be less than the containment design pressure.
| |
| For certain aspects of the transient accident analyses, maximizing the calculated containment pressure is not conservative.
| |
| In particular, the cooling effectiveness of the ECCS during the core reflood phase of a LOCA analysis increases with increasing containment backpressure.
| |
| For these calculations, the containment backpressure is calculated in a manner designed to conservatively minimize, rather than maximize, the calculated transient containment pressures, in accordance with 10 CFR 50, Appendix K (Ref. 2).The maximum peak containment atmosphere temperature results from the SLB analysis and is discussed in the Bases for LCO 3.6.5,"Containment Air Temperature." In addition to calculating the overall peak containment pressures, the DBA analyses include calculation of the transient differential pressures that occur across subcompartment walls during the initial blowdown phase of the accident transient.
| |
| The internal containment walls and structures are designed to withstand these local transient pressure differentials for the limiting DBAs.The ice bed satisfies Criterion 3 of 10 CFR 50.36 (Ref. 3).McGuire Unit 1 and 2 B 3.6.12-3 Revision No. 115 McGuire Unit 1 and 2 B 3.6.12-3 Revision No. 115 Ice Bed B 3.6.12 BASES LCO The ice bed LCO requires the existence of the required quantity of stored ice, appropriate distribution of the ice and the ice bed, open flow paths through the ice bed, and appropriate chemical content and pH of the stored ice. The stored ice functions to absorb heat during the blowdown phase and long term phase of a DBA, thereby limiting containment air temperature and pressure.
| |
| The chemical content and pH of the stored ice provide core SDM (boron content) and remove radioactive iodine from the containment atmosphere when the melted ice is recirculated through the ECCS and the Containment Spray System, respectively.
| |
| APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause an increase in containment pressure and temperature requiring the operation of the ice bed.Therefore, the LCO is applicable in MODES 1, 2, 3, and 4.In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, the ice bed is not required to be OPERABLE in these MODES.ACTIONS A..1 If the ice bed is inoperable, it must be restored to OPERABLE status within 48 hours. The Completion Time was developed based on operating experience, which confirms that due to the very large mass of stored ice, the parameters comprising OPERABILITY do not change appreciably in this time period. Because of this fact, the Surveillance Frequencies are long (months), except for the ice bed temperature, which is checked every 12 hours. If a degraded condition is identified, even for temperature, with such a large mass of ice it is not possible for the degraded condition to significantly degrade further in a 48 hour period.Therefore, 48 hours is a reasonable amount of time to correct a degraded condition before initiating a shutdown.B.1 and B.2 If the ice bed cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.McGuire Unit 1 and 2 B 3.6.12-4 Revision No. 115 McGuire Unit 1 and 2 B 3.6.12-4 Revision No. 115 Ice Bed B 3.6.12 BASES SURVEILLANCE SR 3.6.12.1 REQUIREMENTS Verifying that the maximum temperature of the ice bed is < 27°F ensures that the ice is kept well below the melting point. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program. This SR may be satisfied by use of the Ice Bed Temperature Monitoring System.SR 3.6.12.2 This SR ensures that initial ice fill and any subsequent ice additions meet the boron concentration and pH requirements of SR 3.6.12.7.
| |
| The SR is modified by a NOTE that allows the chemical analysis to be performed on either the liquid or resulting ice of each sodium tetraborate solution prepared.
| |
| If ice is obtained from offsite sources, then chemical analysis data must be obtained for the ice supplied.SR 3.6.12.3 This SR ensures that the air/steam flow channels through the ice bed have not accumulated ice blockage that exceeds 15 percent of the total flow area through the ice bed region. The allowable 15 percent buildup of ice is based on the analysis of the sub-compartment response to a design basis LOCA with partial blockage of the ice condenser flow channels.The analysis did not perform detailed flow area modeling, but rather lumped the ice condenser bays into six sections ranging from 2.75 bays to 6.5 bays. Individual bays are acceptable with greater than 15 percent blockage, as long as 15 percent blockage is not exceeded for any analysis section.To provide a 95 percent confidence that flow blockage does not exceed the allowed 15 percent, the visual inspection must be made for at least 54 (33 percent) of the 162 flow channels per ice condenser bay. The visual inspection of the ice bed flow channels is to inspect the flow area, by looking down form the top of the ice bed, and where view is achievable up from the bottom of the ice bed. Flow channels to be inspected are determined by random sample. As the most restrictive ice bed flow passage is found at a lattice frame elevation, the 15 percent blockage criteria only applies to "flow channels" that comprise the area: McGuire Unit I and 2 B 3.6.12-5 Revision No. 115 Ice Bed B 3.6.12 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| : a. Between ice baskets, and b. Past lattice frames and wall panels.Due to a significantly larger flow area in the regions of the upper deck grating and the lower inlet plenum support structures and turning vanes, it would require a gross buildup of ice on there structures to obtain a degradation in air/steam flow. Therefore, these structures are excluded as part of a flow channel for application of the 15 percent blockage criteria.
| |
| Plant and industry experience have shown that removal of ice from the excluded structures during the refueling outage is sufficient to ensure they remain operable throughout the operating cycle. Thus, removal of any gross ice buildup on the excluded structures is performed following outage maintenance activities.
| |
| Operating experience has demonstrated that the ice bed is the region that is the most flow restrictive, due to the normal presence of ice accumulation on lattice frames and wall panels. The flow area through the ice basket support platform is not a more restrictive flow area because it is easily accessible from the lower plenum and is maintained clear of ice accumulation.
| |
| There is not a mechanistically credible method for ice to accumulate on the ice basket support platform during plant operation.
| |
| Plant and industry experience has shown that the vertical flow area through the ice basket support platform remains clear of ice accumulation that could produce blockage.
| |
| Normally only a glaze may develop or exist on the ice basket support platform which is not significant to blockage of flow area. Additionally, outage maintenance practices provided measures to clear the ice basket support platform following maintenance activities of any accumulation of ice that could block flow areas.Activities that have a potential for significant degradation of flow channels should be limited to outage periods. Performance of this SR following completion of these maintenance activities assures the ice bed is in an acceptable condition for the duration of the operating cycle.Frost buildup or lose ice is not to be considered as flow channel blockage, whereas attached ice is considered blockage of a flow channel. Frost is the solid form of water that is loosely adherent, and can be brushed off with the open hand.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Unit 1 and 2 B 3.6.12-6 Revision No. 115 McGuire Unit 1 and 2 B 3.6.12-6 Revision No. 115 Ice Bed B 3.6.12 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.6.12.4 Ice mass determination methodology is designed to verify the total as-found (pre-maintenance) mass of ice in the ice bed, and the appropriate distribution of that mass, using a random sampling of individual baskets.The random sample will include at least 30 baskets from each of three defined Radial Zones (at least 90 baskets total). Radial Zone A consists of baskets located in rows 8, and 9 (innermost rows adjacent to the Crane Wall), Radial Zone B consists of baskets located in rows 4, 5, 6, and 7 (middle rows of the ice bed), and Radial Zone C consists of baskets located in rows 1, 2, and 3 (outermost rows adjacent to the Containment Vessel).The Radial Zones chosen include the row groupings nearest the inside and outside walls of the ice bed and the middle rows of the ice bed.These groupings facilitate the statistical sampling plan by creating sub-populations of ice baskets that have similar mean mass and sublimation characteristics.
| |
| Methodology for determining sample ice basket mass will be either by direct lifting or by alternative techniques.
| |
| Any method chosen will include procedural allowances for the accuracy of the method used. The number of sample baskets in any Radial Zone may be increased once by adding 20 or more randomly selected baskets to verify the total mass of that Radial Zone.In the event the mass of a selected basket in a sample population (initial or expanded) cannot be determined by any available means (e.g., due to surface ice accumulation or obstruction), a randomly selected representative alternate basket may be used to replace the original selection in that sample population.
| |
| If employed, the representative alternate must meet the following criteria: a. Alternate selection must be from the same bay-Zone (i.e., same bay, same Radial Zone) as the original selection, and b. Alternate selection cannot be a repeated selection (original or alternate) in the current Surveillance, and cannot have been used as an analyzed alternate selection in the three most recent Surveillances.
| |
| The complete basis for the methodology used in establishing the 95%confidence level in the total ice bed mass is documented in Ref. 5.The total ice mass and individual Radial Zone ice mass requirements defined in this Surveillance, and the minimum ice mass per basket requirement defined by SR 3.6.12.5, are the minimum requirements for McGuire Unit 1 and 2 B 3.6.12-7 Revision No. 115 Ice Bed B 3.6.12 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| OPERABILITY.
| |
| Additional ice mass beyond the SRs is maintained to address sublimation.
| |
| This sublimation allowance is generally applied to baskets in each Radial Zone, as appropriate, at the beginning of an operating cycle to ensure sufficient ice is available at the end of the operating cycle for the ice condenser to perform its intended design function.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.6.12.5 Verifying that each selected sample basket from SR 3.6.12.4 contains at least 600 lbs of ice in the as-found (pre-maintenance) condition ensures that a significant localized degraded mass condition is avoided.This SR establishes a per basket limit to ensure any ice mass degradation is consistent with the initial conditions of the DBA by not significantly affecting the containment pressure response.
| |
| Ref. 5 provides insights through sensitivity runs that demonstrate that the containment peak pressure during a DBA is not significantly affected by the ice mass in a large localized region of baskets being degraded below the required safety analysis mean, when the Radial Zone and total ice mass requirements of SR 3.6.12.4 are satisfied.
| |
| Any basket identified as containing less than 600 lbs of ice requires appropriately entering the TS Required Action for an inoperable ice bed due to the potential that it may represent a significant condition adverse to quality.As documented in Ref. 5, maintenance practices actively manage individual ice basket mass above the required safety analysis mean for each Radial Zone. Specifically, each basket is serviced to keep its ice mass above 725 lbs for Radial Zone A, 1043 lbs for Radial Zone B, and 1043 lbs for Radial Zone C. If a basket sublimates below the safety analysis mean value, this instance is identified within the plant's corrective action program, including evaluating maintenance practices to identify the cause and correct any deficiencies.
| |
| These maintenance practices provide defense in depth beyond compliance with the ice bed surveillance requirements by limiting the occurrence of individual baskets with ice mass less than the required safety analysis mean.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Unit 1 and 2 B 3.6.12-8 Revision No. 115 Ice Bed B 3.6.12 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.6.12.6 This SR ensures that a representative sampling of accessible portions of ice baskets, which are relatively thin walled, perforated cylinders, have not been degraded by wear, cracks, corrosion, or other damage. The SR is designed around a full-length inspection of a sample of baskets, and is intended to monitor the effect of the ice condenser environment of ice baskets. The groupings defined in the SR (two baskets in each azimuthal third of the ice bed) ensure that the sampling of baskets is reasonably distributed.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.6.12.7 Verifying the chemical composition of the stored ice ensures that the stored ice has a boron concentration
| |
| > 1800 ppm and < 2330 ppm as sodium tetraborate and a high pH, > 9.0 and < 9.5 at 20 0 C, in order to meet the requirement for borated water when the melted ice is used in the ECCS recirculation mode of operation.
| |
| Additionally, the minimum boron concentration setpoint is used to assure reactor subcriticality in a post LOCA environment, while the maximum boron concentration is used as a bounding value in the hot leg switchover timing calculation (Ref. 4). This is accomplished by obtaining at least 24 ice samples. Each sample is taken approximately one foot from the top of the ice of each randomly selected ice basket in each ice condenser bay. The SR is modified by a NOTE that allows the boron concentration and pH value obtained from averaging the individual samples analysis results to satisfy the requirements of the SR. If either the average boron concentration or average pH value is outside their prescribed limit, then entry into ACTION Condition A is required.
| |
| Sodium tetraborate has been proven effective in maintaining the boron content for long storage periods, and it also enhances the ability of the solution to remove and retain fission product iodine. The high pH is required to enhance the effectiveness of the ice and the melted ice in removing iodine from the containment atmosphere.
| |
| This pH range also minimizes the occurrence of chloride and caustic stress corrosion on mechanical systems and components exposed to ECCS and Containment Spray System fluids in the recirculation mode of operation.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Unit 1 and 2 B 3.6.12-9 Revision No. 115 Ice Bed B 3.6.12 BASES REFERENCES o.2.3.4.5.UFSAR, Section 6.2.10 CFR 50, Appendix K.10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| UFSAR, Section 6.3.3.10.Topical Report ICUG-001, Application of the Active Ice Mass Management Concept to the Ice Condenser Ice Mass Technical Specification, revision 2.UFSAR, Table 18-1 and Section 18.2.14.McGuire License Renewal Commitments MCS-1274.00-00-0016, Section 4.19, Ice Condenser Inspections.
| |
| 6.7.McGuire Unit 1 and 2 B 3.6.12-10 Revision No. 115
| |
| | |
| Ice Condenser Doors B 3.6.13 B 3.6 CONTAINMENT SYSTEMS B 3.6.13 Ice Condenser Doors BASES BACKGROUND The ice condenser doors consist of the lower inlet doors, the intermediate deck doors, and the top deck doors. The functions of the doors are to: a. Seal the ice condenser from air leakage and provide thermal/humidity barriers during the lifetime of the unit; and b. Open in the event of a Design Basis Accident (DBA) to direct the hot steam-air mixture from the DBA into the ice bed, where the ice would absorb energy and limit containment peak pressure and temperature during the accident transient.
| |
| Limiting the pressure and temperature following a DBA reduces the release of fission product radioactivity from containment to the environment.
| |
| The ice condenser is an annular compartment enclosing approximately 3000 of the perimeter of the upper containment compartment, but penetrating the operating deck so that a portion extends into the lower containment compartment.
| |
| The lower inlet doors separate the atmosphere of the lower compartment from the ice bed inside the ice condenser.
| |
| The top deck doors are above the ice bed and exposed to the atmosphere of the upper compartment.
| |
| The intermediate deck doors, located below the top deck doors, form the floor of a plenum at the upper part of the ice condenser.
| |
| This upper plenum area is used to facilitate surveillance and maintenance of the ice bed and contains the air handling units that remove heat from the ice bed. Equalization vents located at the periphery of the intermediate and top decks are provided to balance small pressure differentials occurring across the decks during normal operation.
| |
| The ice baskets held in the ice bed within the ice condenser are arranged to promote heat transfer from steam to ice. This arrangement enhances the ice condenser's primary function of condensing steam and absorbing heat energy released to the containment during a DBA.In the event of a DBA, the ice condenser lower inlet doors (located below the operating deck) open due to the pressure rise in the lower compartment.
| |
| This allows air and steam to flow from the lower McGuire Units 1 and 2 B 3.6.13-1 Revision No. 115 Ice Condenser Doors B 3.6.13 BASES BACKGROUND (continued) compartment into the ice condenser.
| |
| The resulting pressure increase within the ice condenser causes the intermediate deck doors and the top deck doors to open, which allows the air to flow out of the ice condenser into the upper compartment.
| |
| Steam condensation within the ice condenser limits the pressure and temperature buildup in containment.
| |
| A divider barrier separates the upper and lower compartments and ensures that the steam is directed into the ice condenser.
| |
| The ice, together with the containment spray, serves as a containment heat removal system and is adequate to absorb the initial blowdown of steam and water from a DBA as well as the additional heat loads that would enter containment during the several hours following the initial blowdown.
| |
| The additional heat loads would come from the residual heat in the reactor core, the hot piping and components, and the secondary system, including the steam generators.
| |
| During the post blowdown period, the Air Return System (ARS) returns upper compartment air through the divider barrier to the lower compartment.
| |
| This serves to equalize pressures in containment and to continue circulating heated air and steam from the lower compartment through the ice condenser, where the heat is removed by the remaining ice.The water from the melted ice drains into the lower compartment where it serves as a source of borated water (via the containment sump) for the Emergency Core Cooling System (ECCS) and the Containment Spray System heat removal functions in the recirculation mode. The ice and the recirculated ice melt (via the Containment Spray System) also serve to clean up the containment atmosphere.
| |
| The ice condenser doors ensure that the ice stored in the ice bed is preserved during normal operation (doors closed) and that the ice condenser functions as designed if called upon to act as a passive heat sink following a DBA.APPLICABLE The limiting DBAs considered relative to containment pressure and SAFETY ANALYSES temperature are the loss of coolant accident (LOCA) and the steam line break (SLB). The LOCA and SLB are analyzed using computer codes designed to predict the resultant containment pressure and temperature transients.
| |
| DBAs are assumed not to occur simultaneously or consecutively.
| |
| Although the ice condenser is a passive system that requires no electrical power to perform its function, the Containment Spray System and ARS also function to assist the ice bed in limiting pressures and temperatures.
| |
| Therefore, the postulated DBAs are analyzed with respect to Engineered Safety Feature (ESF) systems, assuming the loss of one ESF bus, which McGuire Unts 1 and 2 B 3.6.13-2 Revision No. 115 Ice Condenser Doors B 3.6.13 BASES APPLICABLE SAFETY ANALYSES (continued) is the worst case single active failure and results in one train each of the Containment Spray System and the ARS being rendered inoperable.
| |
| The limiting DBA analyses (Ref. 1) show that the maximum peak containment pressure results from the LOCA analysis and is calculated to be less than the containment design pressure.
| |
| For certain aspects of transient accident analyses, maximizing the calculated containment pressure is not conservative.
| |
| In particular, the cooling effectiveness of the ECCS during the core reflood phase of a LOCA analysis increases with increasing containment backpressure.
| |
| For these calculations, the containment backpressure is calculated in a manner designed to conservatively minimize, rather than maximize, the calculated transient containment pressures, in accordance with 10 CFR 50, Appendix K (Ref. 2).The maximum peak containment atmosphere temperature results from the SLB analysis and is discussed in the Bases for LCO 3.6.5,"Containment Air Temperature." For very small break events occurring in the lower compartment that do not by themselves produce sufficient breakaway pressure to open the lower inlet doors, slowly released steam will migrate through the Divider Barrier into the upper compartment.
| |
| In this situation, the Containment ARS will actuate at its defined pressure setpoint (including a defined time delay) and open the lower inlet doors, returning the steam/air mixture to the lower compartment and displacing it into the ice condenser where the steam portion of the flow will be condensed (Ref. 1). The Containment ARS can also be actuated manually.In addition to calculating the overall peak containment pressures, the DBA analyses include the calculation of the transient differential pressures that would occur across subcompartment walls during the initial blowdown phase of the accident transient.
| |
| The internal containment walls and structures are designed to withstand the local transient pressure differentials for the limiting DBAs.The ice condenser doors satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii) (Ref.3).LCO This LCO establishes the minimum equipment requirements to assure that the ice condenser doors perform their safety function.
| |
| The ice condenser lower inlet doors, intermediate deck doors, and top deck doors must be closed to minimize air leakage into and out of the ice condenser, with its attendant leakage of heat into the ice condenser and loss of ice McGuire Unts 1 and 2 B 3.6.13-3 Revision No. 115 Ice Condenser Doors B 3.6.13 BASES LCO (continued) through melting and sublimation.
| |
| All lower inlet doors, intermediate deck doors, and top deck doors must be OPERABLE to ensure the proper functioning of the ice condenser in the event of a DBA. Ice condenser door OPERABILITY includes the absence of any obstructions that would physically restrain the doors from opening (i.e., prevent initial breakaway under any circumstances), and for the lower inlet doors, being adjusted such that the initial opening torques are within prescribed limits. The ice condenser doors function with the ice condenser to limit the pressure and temperature that could be expected following a DBA.APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause an increase in containment pressure and temperature requiring the operation of the ice condenser doors. Therefore, the LCO is applicable in MODES 1, 2, 3, and 4.The probability and consequences of these events in MODES 5 and 6 are reduced due to the pressure and temperature limitations of these MODES. Therefore, the ice condenser doors are not required to be OPERABLE in these MODES.ACTIONS Note 1 provides clarification that, for this LCO, separate Condition entry is allowed for each ice condenser door.Note 2 provides clarification that entry into the Conditions and Required Actions is not required for short duration (< 4 hours) routine activities during Modes of Applicability for the Intermediate Deck and Top Deck Doors.1 A._1 If one or more ice condenser lower inlet doors are inoperable due to being physically restrained from opening, the lower inlet door(s) must be restored to OPERABLE status within 1 hour. The Required Action is necessary to return operation to within the bounds of the containment analysis.
| |
| The 1 hour Completion Time is consistent with the ACTIONS of LCO 3.6.1, "Containment," which requires containment to be restored to OPERABLE status within 1 hour.B.1 and B.2 If one or more ice condenser doors are determined to be partially open or otherwise inoperable for reasons other than Condition A or if a door is found that is not closed, it is acceptable to continue unit operation for up to 14 days, provided the ice bed temperature instrumentation is monitored once per 4 hours to ensure that the open or inoperable door is not McGuire Unts 1 and 2 B 3.6.13-4 Revision No. 115 Ice Condenser Doors B 3.6.13 BASES ACTIONS (continued) allowing enough air leakage to cause the maximum ice bed temperature to approach the melting point. The Frequency of 4 hours is based on the fact that temperature changes cannot occur rapidly in the ice bed because of the large mass of ice involved.
| |
| The 14 day Completion Time is based on long term ice storage tests that indicate that if the temperature is maintained below 27°F, there would not be a significant loss of ice from sublimation.
| |
| If the maximum ice bed temperature is > 27 0 F at any time or if the doors are not closed and restored to OPERABLE status within 14 days, the situation reverts to Condition C and a Completion Time of 48 hours is allowed to restore the inoperable door to OPERABLE status or enter into Required Actions D.1 and D.2.Ice bed temperature must be verified within the specified Frequency as augmented by the provisions of SR 3.0.2. Entry into Condition B is not required due to personnel standing on or opening an intermediate deck or top deck door for short durations
| |
| (< 4 hours) to perform required surveillances, minor maintenance such as ice removal, or routine tasks such a system walkdowns C.1 If Required Actions B.1 or B.2 are not met, the doors must be restored to OPERABLE status and closed positions within 48 hours. The 48 hour Completion Time is based on the fact that, with the very large mass of ice involved, it would not be possible for the temperature to increase to the melting point and a significant amount of ice to melt in a 48 hour period.D.1 and D.2 If the ice condenser doors cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.SURVEILLANCE SR 3.6.13.1 REQUIREMENTS Verifying, by means of the Inlet Door Position Monitoring System, that the lower inlet doors are in their closed positions makes the operator aware of an inadvertent opening of one or more lower inlet doors. The Surveillance Frequency is based on operating experience, equipment McGuire Unts 1 and 2 B 3.6.13-5 Revision No. 115 Ice Condenser Doors B 3.6.13 BASES SURVEILLANCE REQUIREMENTS (continued) reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.6.13.2 Verifying, by visual inspection, that each intermediate deck door is closed and not impaired by ice, frost, or debris provides assurance that the intermediate deck doors (which form the floor of the upper plenum where frequent maintenance on the ice bed is performed) have not been left open or obstructed.
| |
| In determining if a door is impaired by ice, the frost accumulation on the doors, joints, and hinges are to be considered in conjunction with the lifting force limits of SR 3.6.13.7.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.6.13.3 Verifying, by visual inspection, that the top deck doors are in place and not obstructed provides assurance that the doors are performing their function of keeping warm air out of the ice condenser during normal operation, and would not be obstructed if called upon to open in response to a DBA. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.6.13.4 Verifying, by visual inspection, that the ice condenser lower inlet doors are not impaired by ice, frost, or debris provides assurance that the doors are free to open in the event of a DBA. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Unts 1 and 2 B 3.6.13-6 Revision No. 115 Ice Condenser Doors B 3.6.13 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.6.13.5 Verifying the initial opening torque of the lower inlet doors provides assurance that no doors have become stuck in the closed position and maintains consistency with the safety analysis initial conditions.
| |
| Verifying the doors are free to move provides assurance that the hinges and spring closure mechanisms are functioning properly and not degrading.
| |
| The verifications consists of: a) Ascertaining the opening torque (torque required to just begin to move the door off of its seal) of each door when pulled (or pushed) open and ensuring this torque is < 675 in-lb, as resolved to the vertical hinge pin centerline, and b) Opening each door manually to the full extent of its available swing arc (i.e., up to slight contact with the shock absorber) and releasing the door, verifying that the spring closure mechanisms are capable of returning the door toward the closed position.The opening torque test a) should be performed first to minimize the loss of cold head in the ice condenser and prevent any preconditioning of the seal area. During the freedom of movement test b) the cold head is not required, and once the effect of cold head is reduced through outflow, the door may not completely return to its seal from the open position.The opening torque test limiting value of 675 in-lb is based on the design cold head pressure on the closed lower inlet doors of approximately 1 pound per square foot. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.6.13.6 (deleted)SR 3.6.13.7 Verifying the OPERABILITY of the intermediate deck doors provides assurance that the intermediate deck doors are free to open in the event of a DBA. The verification consists of visually inspecting the intermediate doors for structural deterioration, verifying free movement of the vent assemblies, and ascertaining free movement of each door when lifted with the applicable force shown below: McGuire Unts 1 and 2 B 3.6.13-7 Revision No. 115 Ice Condenser Doors B 3.6.13 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| Door Lifting Force a. Adjacent to crane wall < 37.4 lb b. Paired with door adjacent to crane wall < 33.8 lb c. Adjacent to containment wall < 31.8 lb d. Paired with door adjacent to containment
| |
| _< 31.0 lb wall The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. UFSAR, Chapter 6.2. 10 CFR 50, Appendix K.3. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| : 4. MCS-1 558.NF-00-0001 "Design Basis Specification for the NF System".McGuire Unts 1 and 2 B 3.6.13-8 Revision No. 115 Divider Barrier Integrity B 3.6.14 B 3.6 CONTAINMENT SYSTEMS B 3.6.14 Divider Barrier Integrity BASES BACKGROUND The divider barrier consists of the operating deck and associated seals, personnel access doors, and equipment hatches that separate the upper and lower containment compartments.
| |
| Divider barrier integrity is necessary to minimize bypassing of the ice condenser by the hot steam and air mixture released into the lower compartment during a Design Basis Accident (DBA). This ensures that most of the gases pass through the ice bed, which condenses the steam and limits pressure and temperature during the accident transient.
| |
| Limiting the pressure and temperature reduces the release of fission product radioactivity from containment to the environment in the event of a DBA.In the event of a DBA, the ice condenser inlet doors (located below the operating deck) open due to the pressure rise in the lower compartment.
| |
| This allows air and steam to flow from the lower compartment into the ice condenser.
| |
| The resulting pressure increase within the ice condenser causes the intermediate deck doors and the door panels at the top of the condenser to open, which allows the air to flow out of the ice condenser into the upper compartment.
| |
| The ice condenses the steam as it enters, thus limiting the pressure and temperature buildup in containment.
| |
| The divider barrier separates the upper and lower compartments and ensures that the steam is directed into the ice condenser.
| |
| The ice, together with the containment spray, is adequate to absorb the initial blowdown of steam and water from a DBA as well as the additional heat loads that would enter containment over several hours following the initial blowdown.
| |
| The additional heat loads would come from the residual heat in the reactor core, the hot piping and components, and the secondary system, including the steam generators.
| |
| During the post blowdown period, the Air Return System (ARS) returns upper compartment air through the divider barrier to the lower compartment.
| |
| This serves to equalize pressures in containment and to continue circulating heated air and steam from the lower compartment through the ice condenser, where the heat is removed by the remaining ice.Divider barrier integrity ensures that the high energy fluids released during a DBA would be directed through the ice condenser and that the ice condenser would function as designed if called upon to act as a passive heat sink following a DBA.McGuire Units 1 and 2 B 3.6.14-1 Revision No. 115 Divider Barrier Integrity B 3.6.14 BASES APPLICABLE Divider barrier integrity ensures the functioning of the ice condenser to SAFETY ANALYSES the limiting containment pressure and temperature that could be experienced following a DBA. The limiting DBAs considered relative to containment temperature and pressure are the loss of coolant accident (LOCA) and the steam line break (SLB). The LOCA and SLB are analyzed using computer codes designed to predict the resultant containment pressure and temperature transients.
| |
| DBAs are assumed not to occur simultaneously or consecutively.
| |
| Although the ice condenser is a passive system that requires no electrical power to perform its function, the Containment Spray System, RHR Spray System, and the ARS also function to assist the ice bed in limiting pressures and temperatures.
| |
| Therefore, the postulated DBAs are analyzed, with respect to containment Engineered Safety Feature (ESF)systems, assuming the loss of one ESF bus, which is the worst case single active failure and results in the inoperability of one train in the Containment Spray System, RHR Spray System, and the ARS.Additionally, a 5.0 ft 2 opening is conservatively assumed to exist in the divider plate in the LOCA and SLB DBA analyses.The limiting DBA analyses (Ref. 1) show that the maximum peak containment pressure results from the LOCA analysis and is calculated to be less than the containment design pressure.
| |
| The maximum peak containment temperature results from the SLB analysis and is discussed in the Bases for LCO 3.6.5, "Containment Air Temperature." In addition to calculating the overall peak containment pressures, the DBA analyses include calculation of the transient differential pressures that occur across subcompartment walls during the initial blowdown phase of the accident transient.
| |
| The internal containment walls and structures are designed to withstand these local transient pressure differentials for the limiting DBAs.The divider barrier satisfies Criterion 3 of 10 CFR 50.36 (Ref. 2).LCO This LCO establishes the minimum equipment requirements to ensure that the divider barrier performs its safety function of ensuring that bypass leakage, in the event of a DBA, does not exceed the bypass leakage assumed in the accident analysis.
| |
| Included are the requirements that the personnel access doors and equipment hatches in the divider barrier are OPERABLE and closed and that the divider barrier seal is properly installed and has not degraded with time. An exception to the requirement that the doors be closed is made to allow personnel transit entry through the divider barrier. The basis of this exception is the McGuire Units 1 and 2 B 3.6.14-2 Revision No. 115 Divider Barrier Integrity B 3.6.14 BASES LCO (continued) assumption that, for personnel transit, the time during which a door is open will be short (i.e., shorter than the Completion Time of 1 hour for Condition A). The divider barrier functions with the ice condenser to limit the pressure and temperature that could be expected following a DBA.APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause an increase in containment pressure and temperature requiring the integrity of the divider barrier.Therefore, the LCO is applicable in MODES 1, 2, 3, and 4.The probability and consequences of these events in MODES 5 and 6 are low due to the pressure and temperature limitations of these MODES. As such, divider barrier integrity is not required in these MODES.ACTIONS A.1 If one or more personnel access doors or equipment hatches (other than one pressurizer enclosure hatch addressed by Condition D) are open or inoperable, except for personnel transit entry, 1 hour is allowed to restore the door(s) and equipment hatches to OPERABLE status and the closed position.
| |
| The 1 hour Completion Time is consistent with LCO 3.6.1,"Containment," which requires that containment be restored to OPERABLE status within 1 hour. Personnel access doors or equipment hatches open or inoperable in accordance with Condition A are not included in the ice condenser steam bypass analysis that provides the basis for Condition D. Conditions A and D are each implemented independently.
| |
| Condition A has been modified by a Note to provide clarification that, for this LCO, separate Condition entry is allowed for each personnel access door or equipment hatch.B. 1 If the divider barrier seal is inoperable, 1 hour is allowed to restore the seal to OPERABLE status. The 1 hour Completion Time is consistent with LCO 3.6.1, which requires that containment be restored to OPERABLE status within 1 hour.C.1 and C.2 If divider barrier integrity cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in McGuire Units 1 and 2 B 3.6.14-3 Revision No. 115 Divider Barrier Integrity B 3.6.14 BASES ACTIONS (continued) which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.D.1 If a pressurizer enclosure hatch is open or inoperable, 6 hours are allowed to restore the hatch to OPERABLE status and in the closed position.
| |
| The 6 hour completion time is based on the need to perform inspections and maintenance in the pressurizer compartment during power operation, as well as for personnel safety and radiation safety considerations.
| |
| An analysis has been performed that shows an open hatch of 7.5 ft 2 bypass area during a DBA does not impact the design pressure or temperature of the containment.
| |
| The 7.5 ft 2 bypass is in addition to the total operating deck leakage discussed in Ref. 1 (approximately 5 ft 2 for Unit 2 and 4.6 ft 2 for Unit 1). There is one pressurizer enclosure hatch on Unit 1 and there are three on Unit 2.These hatches are concrete plugs which must be removed with a crane to access the pressurizer cavity. The analyses supporting Condition D for steam bypassing the ice condenser and the heavy load drop apply to the removal of one pressurizer enclosure hatch at a time. The analyses were both done in a manner that bounds the largest of the hatches. The analysis supporting Condition D for steam bypassing the ice condenser does not include the personnel access doors or equipment hatches open or inoperable in accordance with Condition A. Conditions A and D are each implemented independently.
| |
| SURVEILLANCE SR 3.6.14.1 REQUIREMENTS Verification, by visual inspection, that all personnel access doors and equipment hatches between the upper and lower containment compartments are closed provides assurance that divider barrier integrity is maintained prior to the reactor being taken from MODE 5 to MODE 4.This SR is necessary because many of the doors and hatches may have been opened for maintenance during the shutdown.SR 3.6.14.2 Verification, by visual inspection, that the personnel access door and equipment hatch seals, sealing surfaces, and alignments are acceptable provides assurance that divider barrier integrity is maintained.
| |
| This McGuire Units 1 and 2 B 3.6.14-4 Revision No. 115 Divider Barrier Integrity B 3.6.14 BASES SURVEILLANCE REQUIREMENTS (continued) inspection cannot be made when the door or hatch is closed. Therefore, SR 3.6.14.2 is required for each door or hatch that has been opened, prior to the final closure. Some doors and hatches may not be opened for long periods of time. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.6.14.3 Verification, by visual inspection, after each opening of a personnel access door or equipment hatch that it has been closed makes the operator aware of the importance of closing it and thereby provides additional assurance that divider barrier integrity is maintained while in applicable MODES.SR 3.6.14.4 Conducting periodic physical property tests on divider barrier seal test coupons provides assurance that the seal material has not degraded in the containment environment, including the effects of irradiation with the reactor at power. The required tests include a tensile strength test. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.6.14.5 Visual inspection of the seal around the perimeter provides assurance that the seal is properly secured in place. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. UFSAR, Section 6.2.2. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.6.14-5 Revision No. 115 Containment Recirculation Drains B 3.6.15 B 3.6 CONTAINMENT SYSTEMS B 3.6.15 Containment Recirculation Drains BASES BACKGROUND The containment recirculation drains consist of the ice condenser drains and the refueling canal drains. The ice condenser is partitioned into 24 bays, each having a pair of inlet doors that open from the bottom plenum to allow the hot steam-air mixture from a Design Basis Accident (DBA) to enter the ice condenser.
| |
| Twenty of the 24 bays have an ice condenser floor drain at the bottom to drain the melted ice into the lower compartment (in the 4 bays that do not have drains, the water drains through the floor drains in the adjacent bays). Each drain leads to a drain pipe that drops down several feet, then makes one or more 90° bends and exits into the lower compartment.
| |
| A check (flapper) valve at the end of each pipe keeps warm air from entering during normal operation, but when the water exerts pressure, it opens to allow the water to spill into the lower compartment.
| |
| This prevents water from backing up and interfering with the ice condenser inlet doors. The water delivered to the lower containment serves to cool the atmosphere as it falls through to the floor and provides a source of borated water at the containment sump for long term use by the Emergency Core Cooling System (ECCS) and the Containment Spray System during the recirculation mode of operation.
| |
| The refueling canal drains are at low points in the refueling canal. During a refueling, valves are closed in the drains and the canal is flooded to facilitate the refueling process. The water acts to shield and cool the spent fuel as it is transferred from the reactor vessel to storage. After refueling, the canal is drained and the valves are locked open. In the event of a DBA, the refueling canal drains are the main return path to the lower compartment for Containment Spray System water sprayed into the upper compartment.
| |
| The ice condenser drains and the refueling canal drains function with the ice bed, the Containment Spray System, and the ECCS to limit the pressure and temperature that could be expected following a DBA.APPLICABLE SAFETY ANALYSES The limiting DBAs considered relative to containment temperature and pressure are the loss of coolant accident (LOCA) and the steam line break (SLB). The LOCA and SLB are analyzed using computer codes designed to predict the resultant containment pressure and temperature transients.
| |
| DBAs are assumed not to occur simultaneously or consecutively.
| |
| Although the ice condenser is a passive system that McGuire Units 1 and 2 B 3.6.15-1 Revision No. 115 Containment Recirculation Drains B 3.6.15 BASES APPLICABLE SAFETY ANALYSES (continued) requires no electrical power to perform its function, the Containment Spray System and the Air Return System (ARS) also function to assist the ice bed in limiting pressures and temperatures.
| |
| Therefore, the analysis of the postulated DBAs, with respect to Engineered Safety Feature (ESF) systems, assumes the loss of one ESF bus, which is the worst case single active failure and results in one train of the Containment Spray System and one train of the ARS being rendered inoperable.
| |
| The limiting DBA analyses (Ref. 1) show that the maximum peak containment pressure results from the LOCA analysis and is calculated to be less than the containment design pressure.
| |
| The maximum peak containment atmosphere temperature results from the SLB analysis and is discussed in the Bases for LCO 3.6.5, "Containment Air Temperature." In addition to calculating the overall peak containment pressures, the DBA analyses include calculation of the transient differential pressures that occur across subcompartment walls during the initial blowdown phase of the accident transient.
| |
| The internal containment walls and structures are designed to withstand these local transient pressure differentials for the limiting DBAs.The containment recirculation drains satisfy Criterion 3 of 10 CFR 50.36 (Ref. 2).LCO This LCO establishes the minimum requirements to ensure that the containment recirculation drains perform their safety functions.
| |
| The ice condenser floor drain valve disks must be closed to minimize air leakage into and out of the ice condenser during normal operation and must open in the event of a DBA when water begins to drain out. The refueling canal drain valves must be locked open and remain clear to ensure the return of Containment Spray System water to the lower containment in the event of a DBA. The containment recirculation drains function with the ice condenser, ECCS, and Containment Spray System to limit the pressure and temperature that could be expected following a DBA.APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause an increase in containment pressure and temperature, which would require the operation of the containment recirculation drains. Therefore, the LCO is applicable in MODES 1, 2, 3, and 4.The probability and consequences of these events in MODES 5 and 6 are low due to the pressure and temperature limitations of these MODES.McGuire Units 1 and 2 B 3.6.15-2 Revision No. 115 Containment Recirculation Drains B 3.6.15 BASES APPLICABILITY (continued)
| |
| As such, the containment recirculation drains are not required to be OPERABLE in these MODES.ACTIONS A..1 If one ice condenser floor drain is inoperable, 1 hour is allowed to restore the drain to OPERABLE status. The Required Action is necessary to return operation to within the bounds of the containment analysis.
| |
| The 1 hour Completion Time is consistent with the ACTIONS of LCO 3.6.1,"Containment," which requires that containment be restored to OPERABLE status within 1 hour.B. 1 If one refueling canal drain is inoperable, 1 hour is allowed to restore the drain to OPERABLE status. The Required Action is necessary to return operation to within the bounds of the containment analysis.
| |
| The 1 hour Completion Time is consistent with the ACTIONS of LCO 3.6.1, which requires that containment be restored to OPERABLE status in 1 hour.C.1 and C.2 If the affected drain(s) cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.SURVEILLANCE SR 3.6.15.1 and SR 3.6.15.2 REQUIREMENTS Verifying the OPERABILITY of the refueling canal drains ensures that they will be able to perform their functions in the event of a DBA. SR 3.6.15.1 confirms that the refueling canal drain valves have been locked open and that the drains are clear of any obstructions that could impair their functioning.
| |
| In addition to debris near the drains, SR 3.6.15.2 requires attention be given to any debris that is located where it could be McGuire Units 1 and 2 B 3.6.15-3 Revision No. 115 Containment Recirculation Drains B 3.6.15 BASES SURVEILLANCE REQUIREMENTS (continued) moved to the drains in the event that the Containment Spray System is in operation and water is flowing to the drains. SR 3.6.15.1 must be performed before entering MODE 4 from MODE 5 after every filling of the canal to ensure that the valves have been locked open and that no debris that could impair the drains was deposited during the time the canal was filled. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.6.15.3 Verifying the OPERABILITY of the ice condenser floor drains ensures that they will be able to perform their functions in the event of a DBA.Inspecting the drain valve disk ensures that the valve is performing its function of sealing the drain line from warm air leakage into the ice condenser during normal operation, yet will open if melted ice fills the line following a DBA. Verifying that the drain lines are not obstructed ensures their readiness to drain water from the ice condenser.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. UFSAR, Section 6.2.2. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.6.15-4 Revision No. 115 Reactor Building B 3.6.16 B 3.6 CONTAINMENT SYSTEMS B 3.6.16 Reactor Building BASES BACKGROUND The reactor building is a concrete structure that surrounds the steel containment vessel. Between the containment vessel and the reactor building inner wall is an annular space that collects containment leakage that may occur following a loss of coolant accident (LOCA). This space also allows for periodic inspection of the outer surface of the steel containment vessel.The Annulus Ventilation System (AVS) establishes a negative pressure in the annulus between the reactor building and the steel containment vessel under post accident conditions.
| |
| Filters in the system then control the release of radioactive contaminants to the environment.
| |
| The reactor building is required to be OPERABLE to ensure retention of containment leakage and proper operation of the AVS. To ensure the retention of containment leakage within the reactor bWuilding:
| |
| : a. The door in each access opening is closed except when the access opening is being used for normal transit entry and exit.b. The sealing mechanism associated with each penetration (e.g., welds, bellows, or O-rings) is OPERABLE.APPLICABLE The design basis for reactor building OPERABILITY is a LOCA.SAFETY ANALYSES Maintaining reactor building OPERABILITY ensures that the release of radioactive material from the containment atmosphere is restricted to those leakage paths and associated leakage rates assumed in the accident analyses.The reactor building satisfies Criterion 3 of 10 CFR 50.36 (Ref. 1).LCO Reactor building OPERABILITY must be maintained to ensure proper operation of the AVS and to limit radioactive leakage from the containment to those paths and leakage rates assumed in the accident analyses.McGuire Units 1 and 2 B 3.6.16-1 Revision No. 115 Reactor Building B 3.6.16 BASES APPLICABILITY Maintaining reactor building OPERABILITY prevents leakage of radioactive material from the reactor building.
| |
| Radioactive material may enter the reactor building from the containment following a LOCA.Therefore, reactor building OPERABILITY is required in MODES 1, 2, 3, and 4 when a steam line break, LOCA, or rod ejection accident could release radioactive material to the containment atmosphere.
| |
| In MODES 5 and 6, the probability and consequences of these events are low due to the Reactor Coolant System temperature and pressure limitations in these MODES. Therefore, reactor building OPERABILITY is not required in MODE 5 or 6.ACTIONS A._1 In the event reactor building OPERABILITY is not maintained, reactor building OPERABILITY must be restored within 24 hours. Twenty-four hours is a reasonable Completion Time considering the limited leakage design of containment and the low probability of a Design Basis Accident occurring during this time period.B.1 and B.2 If the reactor building cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.SURVEILLANCE SR 3.6.16.1 REQUIREMENTS Maintaining reactor building OPERABILITY requires maintaining the door in each access opening closed, except when the access opening is being used for normal transit entry and exit. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Units 1 and 2 B 3.6.16-2 Revision No. 115 Reactor Building B 3.6.16 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.6.16.2 The ability of a AVS train to produce the required negative pressure within the required times provides assurance that the building is adequately sealed. The negative pressure prevents leakage from the building, since outside air will be drawn in by the low pressure.
| |
| The negative pressure must be established within the time limit to ensure that no significant quantity of radioactive material leaks from the reactor building prior to developing the negative pressure.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.6.16.3 This SR would give advance indication of gross deterioration of the concrete structural integrity of the reactor building.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.6.16-3 Revision No. 115 MSSVs B 3.7.1 B 3.7 PLANT SYSTEMS B 3.7.1 Main Steam Safety Valves (MSSVs)BASES BACKGROUND The primary purpose of the MSSVs is to provide overpressure protection for the secondary system. The MSSVs also provide protection against overpressurizing the reactor coolant pressure boundary (RCPB) by providing a heat sink for the removal of energy from the Reactor Coolant System (RCS) if the preferred heat sink, provided by the Condenser and Circulating Water System, is not available.
| |
| Five MSSVs are located on each main steam header, outside containment, upstream of the main steam isolation valves, as described in the UFSAR, Section 10.3.1 (Ref. 1). The MSSV capacity criteria is 110% of rated steam flow at 110% of the steam generator design pressure.
| |
| This meets the requirements of the ASME Code, Section III (Ref. 2). The MSSV design includes staggered setpoints, according to Table 3.7.1-2 in the accompanying LCO, so that only the needed valves will actuate. Each valve is orificed to a size of either 12.174 or 16.0 square inches. Staggered setpoints reduce the potential for valve chattering that is due to steam pressure insufficient to fully open all valves following a turbine reactor trip.APPLICABLE SAFETY ANALYSES The design basis for the MSSVs comes from Reference 2 and its purpose is to limit the secondary system pressure to < 110% of design pressure when passing 100% of design steam flow. This design basis is sufficient to cope with any anticipated operational occurrence (AOO) or accident considered in the Design Basis Accident (DBA) and transient analysis.The events that challenge the relieving capacity of the MSSVs, and thus RCS pressure, are those characterized as decreased heat removal events, which are presented in the UFSAR, Section 15.2 (Ref. 3). Of these, the full power turbine trip without steam dump is the limiting AOO.The transient response for turbine trip without a direct reactor trip presents no hazard to the integrity of the RCS or the Main Steam System.The reactor is tripped on high pressurizer pressure in the peak primary pressure case. In this case, the pressurizer safety valves open, and RCS pressure remains below 110% of the design value. The MSSVs also open to limit the secondary steam pressure.McGuire Units 1 and 2 B 3.7. 1-1 Revision No. 102 MSSVs B 3.7.1 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| For the peak secondary pressure case, the reactor is tripped on overtemperature AT. Pressurizer relief valves and MSSVs are activated and prevent overpressurization in the primary and secondary systems.The MSSVs satisfy Criterion 3 of 10 CFR 50.36 (Ref. 4).LCO The accident analysis assumes five MSSVs per steam generator to provide overpressure protection for design basis transients occurring at 102% RTP. An MSSV will be considered inoperable if it fails to open on demand. The LCO requires that five MSSVs be OPERABLE in compliance with Reference 2, even though this is not a requirement of the DBA analysis.
| |
| This is because operation with less than the full number of MSSVs requires limitations on allowable THERMAL POWER (to meet ASME Code requirements).
| |
| These limitations are according to Table 3.7.1-1 in the accompanying LCO, and Required Action A.1 and A.2.The OPERABILITY of the MSSVs is defined as the ability to open within the setpoint tolerances, relieve steam generator overpressure, and reseat when pressure has been reduced. The OPERABILITY of the MSSVs is determined by periodic surveillance testing in accordance with the Inservice Testing Program.The lift settings, according to Table 3.7.1-2 in the accompanying LCO, correspond to ambient conditions of the valve at nominal operating temperature and pressure.This LCO provides assurance that the MSSVs will perform their designed safety functions to mitigate the consequences of accidents that could result in a challenge to the RCPB.APPLICABILITY In MODE 1, the number of MSSVs per steam generator required to be OPERABLE must be according to Table 3.7.1-1 in the accompanying LCO. In MODES 2 and 3, only two MSSVs per steam generator are required to be OPERABLE.In MODES 4 and 5, there are no credible transients requiring the MSSVs.The steam generators are not normally used for heat removal in MODES 5 and 6, and thus cannot be overpressurized; there is no requirement for the MSSVs to be OPERABLE in these MODES.McGuire Units 1 and 2 B 3.7.1-2 Revision No. 102 MSSVs B 3.7.1 BASES ACTIONS The ACTIONS table is modified by a Note indicating that separate Condition entry is allowed for each MSSV.A.1 and A.2 With one or more MSSVs inoperable, reduce power so that the available MSSV relieving capacity meets Reference 2 requirements for the applicable THERMAL POWER.Operation with less than all five MSSVs OPERABLE for each steam generator is permissible, if THERMAL POWER is proportionally limited to the relief capacity of the remaining MSSVs. This is accomplished by restricting THERMAL POWER so that the energy transfer to the most limiting steam generator is not greater than the available relief capacity in that steam generator.
| |
| For example, if one MSSV is inoperable in one steam generator, the relief capacity of that steam generator is reduced by approximately 20%. To offset this reduction in relief capacity, energy transfer to that steam generator must be similarly reduced. This is accomplished by reducing THERMAL POWER by the necessary amount to conservatively limit the energy transfer to all steam generators, consistent with the relief capacity of the most limiting steam generator.
| |
| The maximum power level specified for the power range neutron flux high trip setpoint with inoperable MSSVs must ensure that power is limited to less than the heat removal capacity of the remaining OPERABLE MSSVs. The reduced high flux trip setpoint also ensures that the reactor trip occurs early enough in the loss of load/turbine trip event to limit primary to secondary heat transfer and preclude overpressurization of the primary and secondary systems. To calculate this power level, the governing equation is the relationship q = m Ah, where q is the heat input from the primary side, m is the steam flow rate and Ah is the heat of vaporization at the steam relief pressure (assuming no subcooled feedwater).
| |
| The algorithm use is consistent with the recommendations of the Westinghouse Nuclear Safety Advisory Letter, NSAL-94-001, dated January 20, 1994 (Ref. 6).Additionally, the calculated values are reduced by 9% to account for instrument and channel uncertainties.
| |
| The allowed Completion Time of 4 hours provides an acceptable time to reach the required power level from full power operation without allowing the plant to remain in an unacceptable condition for an extended period of time and provides sufficient time to reduce the trip setpoints.
| |
| The adjustment of the trip setpoints is a sensitive operation that may inadvertently trip the Reactor Protection System.McGuire Units 1 and 2 B 3.7.1-3 Revision No. 102 MSSVs B 3.7.1 BASES ACTIONS (continued)
| |
| B.1 and B.2 If the MSSVs cannot be restored to OPERABLE status within the associated Completion Time, or if one or more steam generators have less than two MSSVs OPERABLE, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours, and in MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.SURVEILLANCE SR 3.7.1.1 REQUIREMENTS This SR verifies the OPERABILITY of the MSSVs by the verification of each MSSV lift setpoint in accordance with the Inservice Testing Program. The ASME OM Code (Ref. 5) requires that safety and relief valve tests be performed.
| |
| According to Reference 5, the following tests are required: a. Visual examination;
| |
| : b. Seat tightness determination;
| |
| : c. Setpoint pressure determination (lift setting);d. Compliance with seat tightness criteria; and e. Verification of the balancing device integrity on balanced valves.The ASME Standard requires that all valves be tested every 5 years, and a minimum of 20% of the valves be tested every 24 months. The ASME OM Code specifies the activities and frequencies necessary to satisfy the requirements.
| |
| Table 3.7.1-2 allows a + 3% setpoint tolerance for OPERABILITY; however, the valves are reset to + 1% during the Surveillance to allow for drift.This SR is modified by a Note that allows entry into and operation in MODE 3 prior to performing the SR. The MSSVs may be either bench tested or tested in situ at hot conditions using an assist device to simulate lift pressure.
| |
| If the MSSVs are not tested at hot conditions, the lift setting pressure shall be corrected to ambient conditions of the valve at operating temperature and pressure.McGuire Units 1 and 2 B 3.7.1-4 Revision No. 102 MSSVs B 3.7.1 BASES REFERENCES
| |
| : 1. UFSAR, Section 10.3.1.2. ASME, Boiler and Pressure Vessel Code, Section III, Article NC-7000, Class 2 Components.
| |
| : 3. UFSAR, Section 15.2.4. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| : 5. ASME Code for Operation and Maintenance of Nuclear Power Plants.6. Westinghouse Nuclear Safety Advisory Letter, NSAL-94-001, Dated January 20, 1994.McGuire Units 1 and 2 B 3.7.1-5 Revision No. 102 MSIVs B 3.7.2 B 3.7 PLANT SYSTEMS B 3.7.2 Main Steam Isolation Valves (MSIVs)BASES BACKGROUND The MSIVs isolate steam flow from the secondary side of the steam generators following a high energy line break (HELB). MSIV closure terminates flow from the unaffected (intact) steam generators.
| |
| One MSIV is located in each main steam line outside, but close to, containment.
| |
| The MSIVs are downstream from the main steam safety valves (MSSVs) and auxiliary feedwater (AFW) pump turbine steam supply, to prevent MSSV and AFW isolation from the steam generators by MSIV closure. Closing the MSIVs isolates each steam generator from the others, and isolates the turbine, Steam Dump System, and other auxiliary steam supplies from the steam generators.
| |
| The MSIVs close on a main steam isolation signal generated by either low steam line pressure, high rate steam line pressure decrease, or high-high containment pressure.The MSIV control circuits consist of both safety-related and non-safety control power. Non-safety control power is utilized in the manual open/close circuitry associated with each individual valve. The MSIVs will fail closed on a complete loss of A-Train and/or B-Train safety-related control power. Loss of the non-safety control power will not initiate closure of the MSIVs. Manual closure of the MSIVs is still available with a loss of non-safety control power by manually initiating the safety-related main steamline isolation signal.The MSIVs close with spring force along with motive force provided by Instrument Air (VI). A safety-related VI accumulator for each MSIV will provide motive force and maintain valve control for approximately four hours following a loss of the non-safety instrument air system. The accumulator pressure must be > 60 psig to maintain valve operabillity.
| |
| Each MSIV has an MSIV bypass valve. Although these bypass valves are normally closed, they receive the same emergency closure signal as do their associated MSIVs. The MSIVs may also be actuated manually.A description of the MSIVs is found in the UFSAR, Section 10.3 (Ref. 1).McGuire Units 1 and 2 B 3.7.2-1 Revision 105 MSIVs B 3.7.2 BASES APPLICABLE The design basis of the MSIVs is established by the containment and SAFETY ANALYSES core response analyses for the large steam line break (SLB) events, discussed in the UFSAR, Section 6.2 (Ref. 2). The design precludes the blowdown of more than one steam generator.
| |
| The limiting case for the containment analysis is the SLB inside containment, with a loss of offsite power following turbine trip. At lower powers, the steam generator inventory and temperature are at their maximum, maximizing the analyzed mass and energy release to the containment.
| |
| Due to reverse flow and failure of the MSIV to close, the additional mass and energy in the steam headers downstream from the other MSIV contribute to the total release. With the most reactive rod cluster control assembly assumed stuck in the fully withdrawn position, there is an increased possibility that the core will become critical and return to power. The core is ultimately shut down by the boric acid injection delivered by the Emergency Core Cooling System.The accident analysis compares several different SLB events against different acceptance criteria.
| |
| The large SLB outside containment upstream of the MSIV is limiting for offsite dose, although a break in this short section of main steam header has a very low probability.
| |
| The large SLB inside containment at hot zero power is the limiting case for a post trip return to power. The analysis includes scenarios with offsite power available, and with a loss of offsite power following turbine trip. With offsite power available, the reactor coolant pumps continue to circulate coolant through the steam generators, maximizing the Reactor Coolant System cooldown.
| |
| With a loss of offsite power, the response of mitigating systems is delayed. Significant single failures considered include failure of an MSIV to close.The MSIVs serve only a safety function and remain open during power operation.
| |
| These valves operate under the following situations:
| |
| : a. An HELB inside containment.
| |
| In order to maximize the mass and energy release into containment, the analysis assumes quick closure of all MSIVs. For this accident scenario, steam is discharged into containment from all steam generators until the MSIVs close. After MSIV closure, steam is discharged into containment only from the affected steam generator and from the residual steam in the main steam header downstream of the closed MSIVs. Closure of the MSIVs isolates the break from the unaffected steam generators.
| |
| : b. A break outside of containment and upstream from the MSIVs is not a containment pressurization concern. The uncontrolled blowdown of more than one steam generator must be prevented to limit the potential for uncontrolled RCS cooldown and positive McGuire Units 1 and 2 B 3.7.2-2 Revision 105 MSIVs B 3.7.2 BASES SAFETY ANALYSES (continued) reactivity addition.
| |
| Closure of the MSIVs isolates the break and limits the blowdown to a single steam generator.
| |
| : c. A break downstream of the MSIVs will be isolated by the closure of the MSIVs.d. Following a steam generator tube rupture, closure of the MSIVs isolates the ruptured steam generator from the intact steam generators to minimize radiological releases.e. The MSIVs are also utilized during other events such as a feedwater line break. This event is less limiting so far as MSIV OPERABILITY is concerned.
| |
| The MSIVs satisfy Criterion 3 of 10 CFR 50.36 (Ref. 3).LCO This LCO requires that four MSIVs in the steam lines be OPERABLE.The MSIVs are considered OPERABLE when the isolation times are within limits, and they close on an isolation actuation signal. The accumulator air pressure must also be > 60 psig.This LCO provides assurance that the MSIVs will perform their design safety function to mitigate the consequences of accidents that could result in offsite exposures comparable to the 10 CFR 100 (Ref. 4) limits or the NRC staff approved licensing basis.APPLICABILITY The MSIVs must be OPERABLE in MODE 1, and in MODES 2 and 3 except when closed and de-activated, when there is significant mass and energy in the RCS and steam generators.
| |
| When the MSIVs are closed, they are already performing the safety function.In MODE 4, normally most of the MSIVs are closed, and the steam generator energy is low.In MODE 5 or 6, the steam generators do not contain much energy because their temperature is below the boiling point of water; therefore, the MSIVs are not required for isolation of potential high energy secondary system pipe breaks in these MODES.ACTIONS A.1 With one MSIV inoperable in MODE 1, action must be taken to restore OPERABLE status within 8 hours. Some repairs to the MSIV can be made with the unit hot. The 8 hour Completion Time is reasonable, McGuire Units 1 and 2 B 3.7.2-3 Revision 105 MSIVs B 3.7.2 BASES ACTIONS (contd)considering the low probability of an accident occurring during this time period that would require a closure of the MSIVs.The 8 hour Completion Time is greater than that normally allowed for containment isolation valves because the MSIVs are valves that isolate a closed system penetrating containment.
| |
| These valves differ from other containment isolation valves in that the closed system provides an additional means for containment isolation.
| |
| B._1 If the MSIV cannot be restored to OPERABLE status within 8 hours, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in MODE 2 within 6 hours and Condition C would be entered. The Completion Times are reasonable, based on operating experience, to reach MODE 2 and to close the MSIVs in an orderly manner and without challenging unit systems.C.1 and C.2 Condition C is modified by a Note indicating that separate Condition entry is allowed for each MSIV.Since the MSIVs are required to be OPERABLE in MODES 2 and 3, the inoperable MSIVs may either be restored to OPERABLE status or closed.When closed, the MSIVs are already in the position required by the assumptions in the safety analysis.The 8 hour Completion Time is consistent with that allowed in Condition A.For inoperable MSIVs that cannot be restored to OPERABLE status within the specified Completion Time, but are closed, the inoperable MSIVs must be verified on a periodic basis to be closed. This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day Completion Time is reasonable, based on engineering judgment, in view of MSIV status indications available in the control room, and other administrative controls, to ensure that these valves are in the closed position.McGuire Units 1 and 2 B 3.7.2-4 Revision 105 MSIVs B 3.7.2 BASES ACTIONS (contd)D.1 and D.2 If the MSIVs cannot be restored to OPERABLE status or are not closed within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed at least in MODE 3 within 6 hours, and in MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from MODE 2 conditions in an orderly manner and without challenging unit systems.SURVEILLANCE SR 3.7.2.1 REQUIREMENTS This SR verifies that MSIV closure time is _< 8.0 seconds on an actual or simulated actuation signal. The MSIV closure time is assumed in the accident and containment analyses.
| |
| This Surveillance is normally performed during a refueling outage. The MSIVs should not be tested at power, since even a part stroke exercise increases the risk of a valve closure when the unit is generating power. An IST program Justification For Deferral documents the basis for performing the stroke time testing during cold shutdown instead of at power. This alternative is acceptable in accordance with the Inservice Testing Program and the ASME OM Code (Ref. 5).The Frequency is in accordance with the Inservice Testing Program.Separate A and B train tests are conducted at cold condition to meet the requirements of the ASME OM Code. These tests shall be performed with both spring force and the motive force provided by Instrument Air (VI)simultaneously.
| |
| Leak-rate testing of the MSIV air control system shall be performed prior to returning the unit to operation following a refueling outage.A final test is conducted in MODE 3 with the unit at operating temperature and pressure (ref. NRC Information Notice 94-44). This test also shall be performed with both spring force and the motive force provided by the Instrument Air (VI) simultaneously.
| |
| This final test verifies MSIV closure time remains acceptable at system conditions consistent with those under which the MSIV is required to operate. This SR is modified by a Note that allows entry into and operation in MODE 3 prior to performing this final test.REFERENCES
| |
| : 1. UFSAR, Section 10.3.2. UFSAR, Section 6.2.McGuire Units 1 and 2 B63.7.2-5 Revision 105 MSIVs B 3.7.2 BASES 3. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| : 4. 10 CFR 100.11.5. ASME Code for Operation and Maintenance of Nuclear Power Plants.6. NRC Information Notice 94-44.McGuire Units 1 and 2 B 3.7.2-6 Revision 105 MFIVs, MFCVs, MFCV's Bypass Valves, and MFW/AFW NBVs B 3.7.3 B 3.7 PLANT SYSTEMS B 3.7.3 Main Feedwater Isolation Valves (MFIVs), Main Feedwater Control Valves (MFCVs), MFCV's Bypass Valves and Main Feedwater (MFW) to Auxiliary Feedwater (AFW)Nozzle Bypass Valves (MFW/AFW NBVs)BASES BACKGROUND The MFIVs isolate main feedwater (MFW) flow to the secondary side of the steam generators following a high energy line break (HELB). The safety related function of the MFCVs is to provide the second isolation of MFW flow to the secondary side of the steam generators following an HELB. Closure of the MFIVs (CF 26, 28, 30, and 35), MFCVs (CF 17, 20, 23, and 32) and MFCV's bypass valves (CF 104, 105, 106, and 107), and MFW/AFW NBVs (CF 126, 127, 128, and 129) terminates flow to the steam generators, terminating the event for feedwater line breaks (FWLBs) occurring upstream of the MFIVs or MFCVs. The consequences of events occurring in the main steam lines or in the MFW lines downstream from the MFIVs will be mitigated by their closure.Closure of the MFIVs, MFCVs and MFCV's bypass valves or MFW/AFW NBVs, effectively terminates the addition of feedwater to an affected steam generator, limiting the mass and energy release for steam line breaks (SLBs) or FWLBs inside containment, and reducing the cooldown effects for SLBs.The MFIVs, MFCVs, and MFCV's bypass valves, and MFW/AFW NBVs isolate the nonsafety related portions from the safety related portions of the system. In the event of a secondary side pipe rupture inside containment, the valves limit the quantity of high energy fluid that enters containment through the break, and provide a pressure boundary for the controlled addition of AFW to the intact loops.One MFIV, one MFCV, one MFCV's bypass valve, and one MFW/AFW NBV are located on each MFW line, outside containment.
| |
| The MFIVs and MFCVs are located on different supply lines from the AFW injection line so that AFW may be supplied to the steam generators following MFIV or MFCV closure. The piping volume from these valves to the steam generators must be accounted for in calculating mass and energy releases, and refilled prior to AFW reaching the steam generator following either an SLB or FWLB.The MFIVs, MFCVs, MFCV's bypass valves, and MFW/AFW NBVs close on receipt of a safety injection signal, Tavg-Low coincident with reactor trip (P-4), or steam generator water level-high high signal. They may also be actuated manually.
| |
| The check valve outside containment McGuire Units 1 and 2 B 3.7.3-1 Revision No. 102 MFIVs, MFCVs, MFCV's Bypass Valves, and MFW/AFW NBVs B 3.7.3 BASES BACKGROUND (continued) prevents multiple steam generator blowdown and overcooling in the event of a nonsafety related pipe failure or faulted steam generator concurrent with a single failure of a MFIV on an otherwise intact steam generator.
| |
| A description of the MFIVs and MFCVs is found in the UFSAR, Section 10.4.7 (Ref. 1).APPLICABLE The design basis of the MFIVs and MFCVs is established by the analyses SAFETY ANALYSES for the large SLB. It is also influenced by the accident analysis for the large FWLB. Closure of the MFIVs, MFCVs and MFCV's bypass valves, or MFW/AFW NBVs, may also be relied on to terminate an SLB for core response analysis and excess feedwater event upon the receipt of a steam generator water level-high high signal or a feedwater isolation signal on high steam generator level.Failure of a MFIV, MFCV, MFCV's bypass valve, or MFW/AFW NBV to close following an SLB or FWLB can result in additional mass and energy being delivered to the steam generators, contributing to cooldown.
| |
| This failure also results in additional mass and energy releases following an SLB or FWLB event.The MFIVs and MFCVs satisfy Criterion 3 of 10 CFR 50.36 (Ref. 2).LCO This LCO ensures that the MFIVs, MFCVs, MFCV's bypass valves, and MFW/AFW NBVs will isolate MFW flow to the steam generators, following an FWLB or main steam line break. These valves will also isolate the nonsafety related portions from the safety related portions of the system.This LCO requires that four MFIVs, four MFCVs, four MFCV's bypass valves, and four MFW/AFW NBVs be OPERABLE.
| |
| The MFIVs, MFCVs, MFCV's bypass valves, and MFW/AFW NBVs are considered OPERABLE when isolation times are within limits and they close on an isolation actuation signal.Failure to meet the LCO requirements can result in additional mass and energy being released to containment following an SLB or FWLB inside containment.
| |
| If a feedwater isolation signal on high steam generator level is relied on to terminate an excess feedwater flow event, failure to meet the LCO may result in the introduction of water into the main steam lines.McGuire Units I and 2 B 3.7.3-2 Revision No. 102 MFIVs, MFCVs, MFCV's Bypass Valves, and MFW/AFW NBVs B 3.7.3 BASES APPLICABILITY The MFIVs, MFCVs, MFCV's bypass valves, and MFW/AFW NBVs must be OPERABLE whenever there is significant mass and energy in the Reactor Coolant System and steam generators.
| |
| This ensures that, in the event of an HELB, a single failure cannot result in the blowdown of more than one steam generator.
| |
| In MODES 1, 2, and 3, the MFIVs, MFCVs, MFCV's bypass valves, and MFW/AFW NBVs are required to be OPERABLE to limit the amount of available fluid that could be added to containment in the case of a secondary system pipe break inside containment.
| |
| When the valves are closed and de-activated or isolated by a closed manual valve, they are already performing their safety function.In MODES 4, 5, and 6, steam generator energy is low. Therefore, the MFIVs, MFCVs, MFCV's bypass valves, and MFW/AFW NBVs are normally closed since MFW is not required.ACTIONS The ACTIONS table is modified by a Note indicating that separate Condition entry is allowed for each valve.A.1 and A.2 With one MFIV in one or more flow paths inoperable, action must be taken to restore the affected valves to OPERABLE status, or to close or isolate inoperable affected valves within 72 hours by use of a closed and de-activated automatic valve, a closed manual valve, or blind flange.When these valves are closed or isolated, they are performing their required safety function.The 72 hour Completion Time takes into account the redundancy afforded by the remaining OPERABLE valves and the low probability of an event occurring during this time period that would require isolation of the MFW flow paths. The 72 hour Completion Time is reasonable, based on operating experience.
| |
| Inoperable MFIVs that are closed or isolated must be verified on a periodic basis that they are closed or isolated.
| |
| This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day Completion Time is reasonable, based on engineering judgment, in view of valve status indications available in the control room, and other administrative controls, to ensure that these valves are closed or isolated.McGuire Units 1 and 2 B 3.7.3-3 Revision No. 102 MFIVs, MFCVs, MFCV's Bypass Valves, and MFW/AFW NBVs B 3.7.3 BASES ACTIONS (continued)
| |
| B.1 and B.2 With one MFCV in one or more flow paths inoperable, action must be taken to restore the affected valves to OPERABLE status, or to close or isolate inoperable affected valves within 72 hours by use of a closed and de-activated automatic valve, a closed manual valve, or blind flange.When these valves are closed or isolated, they are performing their required safety function.The 72 hour Completion Time takes into account the redundancy afforded by the remaining OPERABLE valves and the low probability of an event occurring during this time period that would require isolation of the MFW flow paths. The 72 hour Completion Time is reasonable, based on operating experience.
| |
| Inoperable MFCVs, that are closed or isolated, must be verified on a periodic basis that they are closed or isolated.
| |
| This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day Completion Time is reasonable, based on engineering judgment, in view of valve status indications available in the control room, and other administrative controls to ensure that the valves are closed or isolated.C.1 and C.2 With one MFCV's bypass valve or MFW/AFW NBV in one or more flow paths inoperable, action must be taken to restore the affected valves to OPERABLE status, or to close or isolate inoperable affected valves within 72 hours by use of a closed and de-activated automatic valve, a closed manual valve, or blind flange. When these valves are closed or isolated, they are performing their required safety function.The 72 hour Completion Time takes into account the redundancy afforded by the remaining OPERABLE valves and the low probability of an event occurring during this time period that would require isolation of the MFW flow paths. The 72 hour Completion Time is reasonable, based on operating experience.
| |
| Inoperable MFCV's bypass valves or MFW/AFW NBVs that are closed or isolated must be verified on a periodic basis that they are closed or isolated.
| |
| This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day Completion Time is reasonable, based on engineering judgment, in view of valve status indications available in the control room, and other administrative controls, to ensure that these valves are closed or isolated.McGuire Units 1 and 2 B 3.7.3-4 Revision No. 102 MFIVs, MFCVs, MFCV's Bypass Valves, and MFW/AFW NBVs B 3.7.3 BASES ACTIONS (continued)
| |
| D.1 With two inoperable valves in the same flow path, there may be no redundant system to operate automatically and perform the required safety function.
| |
| Under these conditions, affected valves in each flow path must be restored to OPERABLE status, or the affected flow path isolated within 8 hours. This action returns the system to the condition where at least one valve in each flow path is performing the required safety function.
| |
| The 8 hour Completion Time is reasonable, based on operating experience, to complete the actions required to close the MFIV or MFCV, or otherwise isolate the affected flow path.E.1 and E.2 If the MFIV(s), MFCV(s), MFCV's bypass valve(s), and MFW/AFW NBV(s) cannot be restored to OPERABLE status, or closed, or isolated within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours, and in MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.SURVEILLANCE SR 3.7.3.1 REQUIREMENTS This SR verifies that the closure time of each MFIV, MFCV, MFCV's bypass valve, and MFW/AFW NBV is _< 10 seconds on an actual or simulated actuation signal. The MFIV and MFCV closure times are assumed in the accident and containment analyses.
| |
| This Surveillance is normally performed upon returning the unit to operation following a refueling outage. These valves should not be tested at power since even a part stroke exercise increases the risk of a valve closure with the unit generating power. This is consistent with the ASME OM Code (Ref. 3)quarterly stroke requirements during operation in MODES 1 and 2.The Frequency for this SR is in accordance with the Inservice Testing Program.McGuire Units 1 and 2 B 3.7.3-5 Revision No. 102 MFIVs, MFCVs, MFCV's Bypass Valves, and MFW/AFW NBVs B 3.7.3 BASES REFERENCES 1.2.3.UFSAR, Section 10.4.7.10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| ASME Code for Operation and Maintenance of Nuclear Power Plants.McGuire Units 1 and 2 B 3.7.3-6 Revision No. 102 SG PORVs B 3.7.4 B 3.7 PLANT SYSTEMS B 3.7.4 Steam Generator Power Operated Relief Valves (SG PORVs)BASES BACKGROUND The SG PORVs provide a method for cooling the unit to residual heat removal (RHR) entry conditions should the preferred heat sink via the Steam Dump System to the condenser not be available, as discussed in the UFSAR, Section 10.3 (Ref. 1). This is done in conjunction with the Auxiliary Feedwater System providing cooling water from the condensate storage system (CSS). The SG PORVs may also be required to meet the design cooldown rate during a normal cooldown when steam pressure drops too low for maintenance of a vacuum in the condenser to permit use of the Steam Dump System.One SG PORV line for each of the four steam generators is provided.Each SG PORV line consists of one SG PORV and an associated block valve.The SG PORVs are provided with upstream block valves to permit their being tested at power, and to provide an alternate means of isolation.
| |
| The SG PORVs are equipped with pneumatic controllers to permit control of the cooldown rate.A description of the SG PORVs is found in Reference
| |
| : 1. The SG PORVs are OPERABLE when they are capable of fully opening and closing manually using the handwheel.
| |
| APPLICABLE SAFETY ANALYSES The design basis of the SG PORVs is established by the capability to cool the unit to RHR entry conditions.
| |
| The PORVs were sized to achieve a 500 F/hr cooldown rate. At cooldown inception, the PORVs will slowly open to maintain the desired cooldown rate. As S/G pressure decreases, the PORVs will eventually be wide open and the cooldown rate will gradually decrease.
| |
| Therefore, the cooldown time from hot standby to RHR initiation is a function of the chosen maximum cooldown rate, the number of PORVs operating, and the time spent at MODE 3.In the accident analysis presented in Reference 2, the SG PORVs are assumed to be used by the operator to cool down the unit to RHR entry conditions for accidents accompanied by a loss of offsite power. Prior to operator actions to cool down the unit, the SG PORVs and main steam safety valves (MSSVs) are assumed to operate automatically to relieve steam and maintain the steam generator pressure below the design McGuire Units 1 and 2 B 3.7.4-1 Revision No. 115 SG PORVs B 3.7.4 BASES APPLICABLE SAFETY ANALYSES (continued) value. For the recovery from a steam generator tube rupture (SGTR)event, the operator is also required to perform a limited cooldown to establish adequate subcooling as a necessary step to terminate the primary to secondary break flow into the ruptured steam generator.
| |
| The time required to terminate the primary to secondary break flow for an SGTR is more critical than the time required to cool down to RHR conditions for this event and also for other accidents.
| |
| Thus, the SGTR is the limiting event for the SG PORVs. The number of SG PORVs required to be OPERABLE to satisfy the SGTR accident analysis requirements depends upon the number of unit loops and consideration of any single failure assumptions regarding the failure of one SG PORV to open on demand. SG PORVs are credited to be operated manually using the handwheel for safety analysis assumptions.
| |
| The SG PORVs are equipped with block valves in the event an SG PORV spuriously fails to close during use.The SG PORVs satisfy Criterion 3 of 10 CFR 50.36 (Ref. 3).LCO Three SG PORV lines are required to be OPERABLE.
| |
| One SG PORV line is required from each of three steam generators to ensure that at least one SG PORV line is available to conduct a unit cooldown following an SGTR, in which one steam generator becomes unavailable, accompanied by a single, active failure of a second SG PORV line on an unaffected steam generator.
| |
| The block valves must be OPERABLE to isolate a failed open SG PORV line. A closed block valve does not render it or its SG PORV line inoperable if operator action time to open the block valve is supported in the accident analysis.Failure to meet the LCO can result in the inability to cool the unit to RHR entry conditions following an event in which the condenser is unavailable for use with the Steam Dump System.An SG PORV line is considered OPERABLE when the SG PORV and its associated block valve are capable of fully opening and closing manually using the handwheel.
| |
| APPLICABILITY In MODES 1, 2, and 3, and in MODE 4, when a steam generator is being relied upon for heat removal, the SG PORVs are required to be OPERABLE.In MODE 5 or 6, an SGTR is not a credible event.McGuire Units 1 and 2 B 3.7.4-2 Revision No. 115 SG PORVs B 3.7.4 BASES ACTIONS A.1 With one required SG PORV line inoperable, action must be taken to restore OPERABLE status within 7 days. The 7 day Completion Time allows for the redundant capability afforded by the remaining OPERABLE SG PORV lines, a nonsafety grade backup in the Steam Dump System, and MSSVs.B. 1 With two or more SG PORV lines inoperable, action must be taken to restore all but one SG PORV line to OPERABLE status. Since the block valve can be closed to isolate an SG PORV, some repairs may be possible with the unit at power. The 24 hour Completion Time is reasonable to repair inoperable SG PORV lines, based on the availability of the Steam Dump System and MSSVs, and the low probability of an event occurring during this period that would require the SG PORV lines.C.1 and C.2 If the SG PORV lines cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours, and in MODE 4, without reliance upon steam generator for heat removal, within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.SURVEILLANCE SR 3.7.4.1 REQUIREMENTS To perform a controlled cooldown of the RCS, the SG PORVs must be able to be opened manually using the handwheel and throttled through their full range. This SR ensures that the SG PORVs are tested through a full cycle at least once per fuel cycle. Performance of inservice testing or use of an SG PORV during a unit cooldown may satisfy this requirement.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Units 1 and 2 B 3.7.4-3 Revision No. 115 SG PORVs B 3.7.4 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.7.4.2 The function of the block valve is to isolate a failed open SG PORV.Cycling the block valve manually using the handwheel both closed and open demonstrates its capability to perform this function.
| |
| Performance of inservice testing or use of the block valve during unit cooldown may satisfy this requirement.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. UFSAR, Section 10.3.2. UFSAR, Chapter 15.3. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.7.4-4 Revision No. 115 AFW System B 3.7.5 B 3.7 PLANT SYSTEMS B 3.7.5 Auxiliary Feedwater (AFW) System BASES BACKGROUND The AFW System automatically supplies feedwater to the steam generators to remove decay heat from the Reactor Coolant System upon the loss of normal feedwater supply. The AFW pumps take suction from the non-safety related AFW Storage Tank (Water Tower). The assured source of water to the AFW System is the Nuclear Service Water (RN)System. The turbine and motor driven pump discharge lines to each individual steam generator join into a single line outside containment.
| |
| These individual lines penetrate the containment and enter each steam generator through the auxiliary feedwater nozzle. The steam generators function as a heat sink for core decay heat. The heat load is dissipated by releasing steam to the atmosphere from the steam generators via the main steam safety valves (MSSVs) (LCO 3.7.1) or SG PORVs (LCO 3.7.4). If the main condenser is available, steam may be released via the steam dump valves and recirculated to the condensate storage system (CSS).The AFW System consists of two motor driven AFW pumps and one steam turbine driven pump configured into three trains. Each of the motor driven pumps supply 100% of the flow requirements to two steam generators, although each pump has the capability to be realigned to feed other steam generators.
| |
| The turbine driven pump provides 200% of the flow requirements and supplies water to all four steam generators.
| |
| Travel stops are set on the steam generator flow control valves such that the pumps can supply the minimum flow required without exceeding the maximum flow allowed. The pumps are equipped with independent recirculation lines to prevent pump operation against a closed system.Each motor driven AFW pump is powered from an independent Class 1 E power supply. The steam turbine driven AFW pump receives steam from two main steam lines upstream of the main steam isolation valves. Each of the steam feed lines will supply 100% of the requirements of the turbine driven AFW pump.The AFW System is capable of supplying feedwater to the steam generators during normal unit startup, shutdown, and hot standby McGuire Units 1 and 2 B 3.7.5-1 Revision No. 115 BASES AFW System B 3.
| |
| | |
| ==7.5 BACKGROUND==
| |
| (continued) conditions.
| |
| One turbine driven pump at full flow is sufficient to remove decay heat and cool the unit to residual heat removal (RHR) entry conditions.
| |
| During unit cooldown, SG pressures and Main Steam pressures decrease simultaneously.
| |
| Thus, the turbine driven AFW pump with a reduced steam supply pressure remains fully capable of providing flow to all SGs. Thus, the requirement for diversity in motive power sources for the AFW System is met.The AFW System is designed to supply sufficient water to the steam generator(s) to remove decay heat with steam generator pressure at the lowest setpoint of the MSSVs plus 3% accumulation.
| |
| Subsequently, the AFW System supplies sufficient water to cool the unit to RHR entry conditions, with steam released through the SG PORVs or MSSVs.The motor driven AFW pumps actuate automatically on steam generator water level low-low in 1 out of 4 steam generators by the ESFAS (LCO 3.3.2). The motor driven pumps also actuates on loss of offsite power, safety injection, and trip of all MFW pumps. The turbine driven AFW pump actuates automatically on steam generator water level low-low in 2 out of 4 steam generators and on loss of offsite power.The AFW System is discussed in the UFSAR, Section 10.4.7 (Ref. 1).APPLICABLE The AFW System mitigates the consequences of any event with loss of SAFETY ANALYSES normal feedwater.
| |
| The design basis of the AFW System is to supply water to the steam generator to remove decay heat and other residual heat by delivering at least the minimum required flow rate to the steam generators.
| |
| In addition, the AFW System must supply enough makeup water to replace steam generator secondary inventory lost as the unit cools to MODE 4 conditions.
| |
| Sufficient AFW flow must also be available to account for flow losses such as pump recirculation valve leakage and line breaks.The limiting Design Basis Accidents (DBAs) and transients for the AFW System are as follows: a. Feedwater Line Break (FWLB);b. Steam Generator Tube Rupture (SGTR);McGuire Units 1 and 2 B 3.7.5-2 Revision No. 115 BASES AFW System B 3.7.5 APPLICABLE SAFETY ANALYSES (continued)
| |
| : c. Main Steam Line Break (MSLB);d. Small Break Loss of Coolant Accident (SBLOCA);
| |
| and e. Loss of Offsite AC Power.The AFW System design is such that it can perform its function following a FWLB between the Steam Generator and the feedwater isolation valve, combined with a loss of offsite power following turbine trip, and a single active failure of the steam turbine driven AFW pump. In such a case, one motor driven AFW pump will deliver nearly all of its flow to the steam generator with the broken MFW header until flow to that steam generator can be terminated by the operator.
| |
| Sufficient flow is delivered to the intact steam generators by the redundant AFW pump.The ESFAS automatically actuates the AFW turbine driven pump and associated power operated valves and controls when required to ensure an adequate feedwater supply to the steam generators during loss of offsite power.The AFW System satisfies the requirements of Criterion 3 of 10 CFR 50.36 (Ref. 2).LCO This LCO provides assurance that the AFW System will perform its design safety function to mitigate the consequences of accidents that could result in overpressurization of the reactor coolant pressure boundary.
| |
| Three independent AFW pumps in three diverse trains are required to be OPERABLE to ensure the availability of RHR capability for all events accompanied by a loss of offsite power and a single failure.This is accomplished by powering two of the pumps from independent emergency buses. The third AFW pump is powered by a different means, a steam driven turbine supplied with steam from a source that is not isolated by closure of the MSIVs.The AFW System is configured into three trains. The AFW System is considered OPERABLE when the components and flow paths required to provide redundant AFW flow to the steam generators are OPERABLE.This requires that the two motor driven AFW pumps be OPERABLE in two diverse paths, each supplying AFW to separate steam generators.
| |
| The turbine driven AFW pump is required to be OPERABLE with redundant steam supplies from two main steam lines upstream of the MSIVs, and shall be capable of supplying AFW to any of the steam generators.
| |
| The piping, valves, instrumentation, and controls in the required flow paths also are required to be OPERABLE.McGuire Units 1 and 2 B 3.7.5-3 Revision No. 115 BASES AFW System B 3.7.5 LCO (continued)
| |
| The LCO is modified by a Note indicating that one AFW train, which includes a motor driven pump, is required to be OPERABLE in MODE 4.This is because of the reduced heat removal requirements and short period of time in MODE 4 during which the AFW is required and the insufficient steam available in MODE 4 to power the turbine driven AFW pump.APPLICABILITY In MODES 1, 2, and 3, the AFW System is required to be OPERABLE in the event that it is called upon to function when the MFW is lost. In addition, the AFW System is required to supply enough makeup water to replace the steam generator secondary inventory, lost as the unit cools to MODE 4 conditions.
| |
| In MODE 4 the AFW System may be used for heat removal via the steam generators.
| |
| In MODE 5 or 6, the steam generators are not normally used for heat removal, and the AFW System is not required.ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable AFW train when entering MODE 1. There is an increased risk associated with entering MODE 1 with an AFW train inoperable and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.
| |
| A.1 If one of the two steam supplies to the turbine driven AFW train is inoperable, action must be taken to restore OPERABLE status within 7 days in MODES 1, 2, and 3. The 7 day Completion Time is reasonable, based on the following reasons: a. The redundant OPERABLE steam supply to the turbine driven AFW pump;b. The availability of redundant OPERABLE motor driven AFW pumps; and c. The low probability of an event occurring that requires the inoperable steam supply to the turbine driven AFW pump.McGuire Units 1 and 2 B 3.7.5-4 Revision No. 115 BASES AFW System B 3.7.5 ACTIONS (continued)
| |
| The second Completion Time for Required Action A.1 establishes a limit on the maximum time allowed for any combination of Conditions to be inoperable during any continuous failure to meet this LCO.The 10 day Completion Time provides a limitation time allowed in this specified Condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which Conditions A and B are entered concurrently.
| |
| The AND connector between 7 days and 10 days dictates that both Completion Times apply simultaneously, and the more restrictive must be met.B.1 With one of the required AFW trains (pump or flow path) inoperable in MODE 1, 2, or 3 for reasons other than Condition A, action must be taken to restore OPERABLE status within 72 hours. This Condition includes the loss of two steam supply lines to the turbine driven AFW pump. The 72 hour Completion Time is reasonable, based on redundant capabilities afforded by the AFW System, time needed for repairs, and the low probability of a DBA occurring during this time period.The second Completion Time for Required Action B. 1 establishes a limit on the maximum time allowed for any combination of Conditions to be inoperable during any continuous failure to meet this LCO.The 10 day Completion Time provides a limitation time allowed in this specified Condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which Conditions A and B are entered concurrently.
| |
| The AND connector between 72 hours and 10 days dictates that both Completion Times apply simultaneously, and the more restrictive must be met.C.1 and C.2 When Required Action A.1 or B.1 cannot be completed within the required Completion Time, or if two AFW trains are inoperable in MODE 1, 2, or 3, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours, and in MODE 4 within 12 hours.The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.In MODE 4 with two AFW trains inoperable, operation is allowed to continue because only one motor driven pump AFW train is required in McGuire Units 1 and 2 B 3.7.5-5 Revision No. 115 BASES AFW System B 3.7.5 ACTIONS (continued) accordance with the Note that modifies the LCO. Although not required, the unit may continue to cool down and initiate RHR.D.1.If all three AFW trains are inoperable in MODE 1, 2, or 3, the unit is in a seriously degraded condition with no safety related means for conducting a cooldown, and only limited means for conducting a cooldown with nonsafety related equipment.
| |
| In such a condition, the unit should not be perturbed by any action, including a power change, that might result in a trip. The seriousness of this condition requires that action be started immediately to restore one AFW train to OPERABLE status.Required Action D.1 is modified by a Note indicating that all required MODE changes or power reductions are suspended until one AFW train is restored to OPERABLE status. In this case, LCO 3.0.3 is not applicable because it could force the unit into a less safe condition.
| |
| E. 1 In MODE 4, either the reactor coolant pumps or the RHR loops can be used to provide forced circulation.
| |
| This is addressed in LCO 3.4.6, "RCS Loops-MODE 4." With one required AFW train with a motor driven pump inoperable, action must be taken to immediately restore the inoperable train to OPERABLE status. The immediate Completion Time is consistent with LCO 3.4.6.SURVEILLANCE SR 3.7.5.1 REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves in the AFW System water and steam supply flow paths provides assurance that the proper flow paths will exist for AFW operation.
| |
| This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since they are verified to be in the correct position prior to locking, sealing, or securing.
| |
| This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves. This Surveillance does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position.
| |
| The SR is also modified by a note that excludes automatic valves when THERMAL POWER is <10% RTP. Some automatic valves may be in a throttled position to support low power operation.
| |
| McGuire Units 1 and 2 B 3.7.5-6 Revision No. 115 BASES AFW System B 3.7.5 SURVEILLANCE REQUIREMENTS (continued)
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.7.5.2 Verifying that each AFW pump's developed head at the flow test point is greater than or equal to the required developed head ensures that AFW pump performance has not degraded during the cycle. Flow and differential head are normal tests of centrifugal pump performance required by the ASME OM Code (Ref 3). Because it is undesirable to introduce cold AFW into the steam generators while they are operating, this testing is performed on recirculation flow. This test confirms one point on the pump design curve and is indicative of overall performance.
| |
| Such inservice tests confirm component OPERABILITY, trend performance, and detect incipient failures by indicating abnormal performance.
| |
| Performance of inservice testing discussed in the ASME OM Code (Ref. 3) (only required at 3 month intervals) satisfies this requirement.
| |
| The Frequency for this SR is in accordance with the Inservice Testing Program.This SR is modified by a Note indicating that the SR should be deferred until suitable test conditions are established.
| |
| This deferral is required because there is insufficient steam pressure to perform the test. The test should be conducted within 24 hours of the steam pressure exceeding 900 psig.SR 3.7.5.3 This SR verifies that AFW can be delivered to the appropriate steam generator in the event of any accident or transient that generates an ESFAS, by demonstrating that each automatic valve in the flow path actuates to its correct position on an actual or simulated actuation signal.This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.This SR is modified by a Note that states the SR is not required in MODE 4. In MODE 4, the required AFW train may already be aligned and operating.
| |
| McGuire Units 1 and 2 B 3.7.5-7 Revision No. 115 BASES AFW System B 3.7.5 SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.7.5.4 This SR verifies that the AFW pumps will start in the event of any accident or transient that generates an ESFAS by demonstrating that each AFW pump starts automatically on an actual or simulated actuation signal in MODES 1, 2, and 3. In MODE 4, the required pump may already be operating and the autostart function is not required.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.This SR is modified by two Notes. Note 1 indicates that the SR can be deferred until suitable test conditions are established.
| |
| This deferral is required because there is insufficient steam pressure to perform the test.The test should be conducted within 24 hours of the steam pressure exceeding 900 psig. Note 2 states that the SR is not required in MODE 4.In MODE 4, the required pump may already be operating and the autostart function is not required.
| |
| In MODE 4, the heat removal requirements would be less providing more time for operator action to manually start the required AFW pump if it were not in operation.
| |
| REFERENCES
| |
| : 1. UFSAR, Section 10.4.7.2. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| : 3. ASME Code for Operation and Maintenance of Nuclear Power Plants.McGuire Units 1 and 2 B 3.7.5-8 Revision No. 115 CCW System B 3.7.6 B 3.7 PLANT SYSTEMS B 3.7.6 Component Cooling Water (CCW) System BASES BACKGROUND The CCW System provides a heat sink for the removal of process and operating heat from safety related components during a Design Basis Accident (DBA) or transient.
| |
| During normal operation, the CCW System also provides this function for various nonessential components, as well as the spent fuel storage pool. The CCW System serves as a barrier to the release of radioactive byproducts between potentially radioactive systems and the Nuclear Service Water System (NSWS), and thus to the environment.
| |
| The CCW System is arranged as two independent, full capacity cooling loops, and has isolatable nonsafety related components.
| |
| Each safety related train includes two pumps, surge tank, heat exchanger, piping, valves, and instrumentation.
| |
| Each safety related train is powered from a separate bus. An open surge tank in the system provides pump trip protective functions to ensure that sufficient net positive suction head is available.
| |
| Both pumps in each train are automatically started on receipt of a safety injection or Station Blackout signal, and all nonessential components are isolated.Additional information on the design and operation of the system, along with a list of the components served, is presented in the UFSAR, Section 9.2 (Ref. 1). The principal safety related function of the CCW System is the removal of decay heat from the reactor via the Residual Heat Removal (RHR) System. This may be during a normal or post accident cooldown and shutdown.APPLICABLE The design basis of the CCW System is for one CCW train to remove the SAFETY ANALYSES post loss of coolant accident (LOCA) heat load from the containment sump during the recirculation phase, with a maximum CCW temperature of 100OF (Ref. 1). The Emergency Core Cooling System (ECCS) LOCA and containment OPERABILITY LOCA each model the maximum and minimum performance of the CCW System, respectively.
| |
| The normal temperature of the CCW is 90 0 F, and, during unit cooldown to MODE 5 (Tcald < 200 0 F), a maximum temperature of 100°F is assumed. This prevents the containment sump fluid from increasing in temperature during the recirculation phase following a LOCA, and provides a gradual reduction in the temperature of this fluid as it is supplied to the Reactor Coolant System (RCS) by the ECCS pumps.McGuire Units 1 and 2 B 3.7.6-1 Revision No. 115 CCW System B 3.7.6 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| The CCW System is designed to perform its function with a single failure of any active component, assuming a loss of offsite power.The CCW System also functions to cool the unit from RHR entry conditions (TcId < 350°F), to MODE 5 (TcId < 200 0 F), during normal and post accident operations.
| |
| The time required to cool from 350°F to 200OF is a function of the number of CCW and RHR trains operating.
| |
| One CCW train is sufficient to remove decay heat during subsequent operations with Tcad < 200 0 F. This assumes a maximum service water temperature of 95°F occurring simultaneously with the maximum heat loads on the system.The CCW System satisfies Criterion 3 of 10 CFR 50.36 (Ref. 2).LCO The CCW trains are independent of each other to the degree that each has separate controls and power supplies and the operation of one does not depend on the other. In the event of a DBA, one CCW train is required to provide the minimum heat removal capability assumed in the safety analysis for the systems to which it supplies cooling water. To ensure this requirement is met, two trains of CCW must be OPERABLE.At least one CCW train will operate assuming the worst case single active failure occurs coincident with a loss of offsite power.A CCW train is considered OPERABLE when: a. Both pumps and associated surge tank are OPERABLE; and b. The associated piping, valves, heat exchanger, and instrumentation and controls required to perform the safety related function are OPERABLE.The isolation of CCW from other components or systems not required for safety may render those components or systems inoperable but does not affect the OPERABILITY of the CCW System.APPLICABILITY In MODES 1, 2, 3, and 4, the CCW System is a normally operating system, which must be prepared to perform its post accident safety functions, primarily RCS heat removal, which is achieved by cooling the RHR heat exchanger.
| |
| In MODE 5 or 6, the requirements of the CCW System are determined by the systems it supports.McGuire Units 1 and 2 B 3.7.6-2 Revision No. 115 CCW System B 3.7.6 BASES ACTIONS A.1 Required Action A.1 is modified by a Note indicating that the applicable Conditions and Required Actions of LCO 3.4.6, "RCS Loops-MODE 4," be entered if an inoperable CCW train results in an inoperable R-HR loop.This is an exception to LCO 3.0.6 and ensures the proper actions are taken for these components.
| |
| If one CCW train is inoperable, action must be taken to restore OPERABLE status within 72 hours. In this Condition, the remaining OPERABLE CCW train is adequate to perform the heat removal function.The 72 hour Completion Time is reasonable, based on the redundant capabilities afforded by the OPERABLE train, and the low probability of a DBA occurring during this period.B.1 and B.2 If the CCW train cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours and in MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.SURVEILLANCE SR 3.7.6.1 REQUIREMENTS This SR is modified by a Note indicating that the isolation of the CCW flow to individual components may render those components inoperable but does not affect the OPERABILITY of the CCW System.Verifying the correct alignment for manual, power operated, and automatic valves in the CCW flow path provides assurance that the proper flow paths exist for CCW operation.
| |
| This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves are verified to be in the correct position prior to locking, sealing, or securing.
| |
| This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves. This Surveillance does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Units 1 and 2 B 3.7.6-3 Revision No. 115 CCW System B 3.7.6 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.7.6.2 This SR verifies proper automatic operation of the CCW valves on an actual or simulated actuation safety injection signal. The CCW System is a normally operating system that cannot be fully actuated as part of routine testing during normal operation.
| |
| This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.7.6.3 This SR verifies proper automatic operation of the CCW pumps on an actual or simulated actuation signal. The CCW System is a normally operating system that cannot be fully actuated as part of routine testing during normal operation.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. UFSAR, Section 9.2.2. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.7.6-4 Revision No. 115 NSWS B 3.7.7 B 3.7 PLANT SYSTEMS B 3.7.7 Nuclear Service Water System (NSWS)BASES BACKGROUND The NSWS provides a transfer mechanism for the removal of process and operating heat from safety related components during a Design Basis Accident (DBA) or transient.
| |
| During normal operation, and a normal shutdown, the NSWS also provides this function for various safety related and nonsafety related components.
| |
| The safety related function is covered by this LCO.The NSWS is normally supplied from Lake Norman as a non-seismic source, through a single supply line as shown in Figure B 3.7.7-1. An additional safety-related and seismic supply of water to the NSWS, in the event of a loss of Lake Norman, is the Standby Nuclear Service Water Pond (SNSWP). The supply line from Lake Norman separates into two supply headers, each header is capable of being isolated by two, independently powered, motor operated valves. The two supply headers feed into two separate supply trains. The "A" train supplies water to the"A" pump on each unit and the "B" train to the "B" pump on each unit.During normal operation, only one pump, per unit, is in operation to supply NSWS flow to the essential and non-essential headers for each unit. The "B" train supply is automatically realigned to the SNSWP and supplies the "B" header on an SI signal from either unit. The "A" train supply is automatically realigned to the low-level supply from Lake Norman and supplies the "A" header on an SI signal from either unit.Essential headers provide flow to the following safety related components and systems: 1. Component Cooling (CCW) Heat Exchangers and Pump Motor Coolers, 2. Containment Spray Heat Exchangers and Pump Motor Coolers, 3. Control Room Area Chiller Condensers, 4. Diesel Generator Heat Exchangers, 5. Centrifugal Charging Pump Motor, Bearing Oil and Gear Oil Coolers, 6. Nuclear Service Water Pump Motor Coolers, 7. Auxiliary Feedwater Pump Motor Coolers, 8. Safety Injection Pump Motor and Bearing Oil Coolers, 9. Residual Heat Removal Pump Motor Coolers, 10. Fuel Pool Pump Motor Coolers, 11. Assured Auxiliary Feedwater Supply, 12. Assured Component Cooling System Makeup, 13. Assured Fuel Pool Cooling System makeup, and 14. Assured Diesel Generator Engine Cooling System makeup.McGuire Units 1 and 2 B 3.7.7-1 Revision No. 115 NSWS B 3.7.7 BASES BACKGROUND (continued)
| |
| The non-essential channel supply comes from the "A" and "B" train crossover piping and isolates on an SI or Blackout signal.The Reactor Coolant Pump Motor Air Coolers are not essential for safe shutdown, but are set up to receive cooling flow until the Containment, High-High signal is received.
| |
| The pumps and valves are remote and manually aligned, except in the unlikely event of a loss of coolant accident (LOCA). The pumps aligned to the critical loops are automatically started upon receipt of a safety injection or Station Blackout signal, and all essential valves are aligned to their post accident positions.
| |
| Additional information about the design and operation of the NSWS, along with a list of the components served, is presented in the UFSAR, Section 9.2 (Ref. 1). The principal safety related function of the NSWS is the removal of decay heat from the reactor via the CCW System.APPLICABLE The design basis of the NSWS is for one NSWS train, in conjunction with SAFETY ANALYSES the CCW System and the Containment Spray system, to remove core decay heat following a design basis LOCA as discussed in the UFSAR, Section 6.2 (Ref. 2). This prevents the containment sump fluid from increasing in temperature during the recirculation phase following a LOCA and provides for a gradual reduction in the temperature of this fluid as it is supplied to the Reactor Coolant System by the ECCS pumps. The NSWS is designed to perform its function with a single failure of any active component, assuming the loss of offsite power.The NSWS, in conjunction with the CCW System, also removes heat from the residual heat removal (RHR) system, as discussed in the UFSAR, Section 5.4 (Ref. 3), from RHR entry conditions to MODE 5 during normal and post accident operations.
| |
| The time required for this evolution is a function of the number of CCW and RHR System trains that are operating.
| |
| One NSWS train is sufficient to remove decay heat during subsequent operations in MODES 5 and 6. This assumes a maximum NSWS inlet temperature of 95 0 F is not exceeded.The NSWS satisfies Criterion 3 of 10 CFR 50.36 (Ref. 4).LCO Two NSWS trains are required to be OPERABLE to provide the required redundancy to ensure that the system functions to remove post accident McGuire Units 1 and 2 B 3.7.7-2 Revision No. 115 NSWS B 3.7.7 BASES LCO (continued) heat loads, assuming that the worst case single active failure occurs coincident with the loss of offsite power.An NSWS train is considered OPERABLE during MODES 1, 2, 3, and 4 when: a. The associated unit's pump is OPERABLE; and b. The associated piping, valves, and instrumentation and controls required to perform the safety related function are OPERABLE.Portions of the NSWS system are shared between the two units (Figure B 3.7.7-1).
| |
| The shared portions of the system must be OPERABLE for each unit when that unit is in the MODE of Applicability.
| |
| Additionally, both normal and emergency power for shared components must also be OPERABLE.
| |
| If a shared NSWS component becomes inoperable, or normal or emergency power to shared components becomes inoperable, then the Required Actions of this LCO must be entered independently for each unit that is in the MODE of applicability of the LCO.APPLICABILITY In MODES 1, 2, 3, and 4, the NSWS is a normally operating system that is required to support the OPERABILITY of the equipment serviced by the NSWS and required to be OPERABLE in these MODES.In MODES 5 and 6, the requirements of the NSWS are determined by the systems it supports.ACTIONS A.1 If one NSWS train is inoperable, action must be taken to restore OPERABLE status within 72 hours. In this Condition, the remaining OPERABLE NSWS train is adequate to perform the heat removal function.
| |
| However, the overall reliability is reduced because a single failure in the OPERABLE NSWS train could result in loss of NSWS function.
| |
| Required Action A.1 is modified by two Notes. The first Note indicates that the applicable Conditions and Required Actions of LCO 3.8.1, "AC Sources-Operating," should be entered if an inoperable NSWS train results in an inoperable emergency diesel generator.
| |
| The second Note indicates that the applicable Conditions and Required Actions of LCO 3.4.6, "RCS Loops-MODE 4," should be entered if an inoperable NSWS train results in an inoperable decay heat removal train.McGuire Units 1 and 2 B 3.7.7-3 Revision No. 115 NSWS B 3.7.7 BASES ACTIONS (continued)
| |
| This is an exception to LCO 3.0.6 and ensures the proper actions are taken for these components.
| |
| The 72 hour Completion Time is based on the redundant capabilities afforded by the OPERABLE train, and the low probability of a DBA occurring during this time period.B.1 and B.2 If the NSWS train cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours and in MODE 5 within 36 hours.The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.SURVEILLANCE SR 3.7.7.1 REQUIREMENTS This SR is modified by a Note indicating that the isolation of the NSWS components or systems may render those components inoperable, but does not affect the OPERABILITY of the NSWS.Verifying the correct alignment for manual, power operated, and automatic valves in the NSWS flow path provides assurance that the proper flow paths exist for NSWS operation.
| |
| This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since they are verified to be in the correct position prior to being locked, sealed, or secured. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position.
| |
| This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Units 1 and 2 B 3.7.7-4 Revision No. 115 NSWS B 3.7.7 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.7.7.2 This SR verifies proper automatic operation of the NSWS valves on an actual or simulated actuation safety injection signal. The NSWS is a normally operating system that cannot be fully actuated as part of normal testing. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.7.7.3 This SR verifies proper automatic operation of the NSWS pumps on an actual or simulated actuation signal. The NSWS is a normally operating system that cannot be fully actuated as part of normal testing during normal operation.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. UFSAR, Section 9.2.2. UFSAR, Section 6.2.3. UFSAR, Section 5.4.4. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| : 5. 10 CFR 50, Appendix A, GDC 5, "Sharing of Structures, Systems, and Components".
| |
| McGuire Units 1 and 2 B 3.7.7-5 Revision No. 115 0 G)CD cn 0)CL)0)CD U, 0.:3 z 0 cy, RC DISCH.03 m U), ESS HOR 2A ESS HOR 2B ESS HOR RNO?ESS HDR ESS KIR is ESS HOR 2A NON£55 HOP ESS HOR 2B Co Zi w (~n SNSWP B 3.7.8 B 3.7 PLANT SYSTEMS B 3.7.8 Standby Nuclear Service Water Pond (SNSWP)BASES BACKGROUND The SNSWP functions as the ultimate heat sink and performs two principal safety functions:
| |
| (1) dissipation of residual heat after reactor shutdown and (2) dissipation of residual heat after an accident.
| |
| This is done by utilizing the Nuclear Service Water System (NSWS) and the Component Cooling Water (CCW) System.The ultimate heat sink (UHS) is comprised of cooling water from the SNSWP, necessary retaining structures, and the canals or conduits connecting the water sources with, but not including, the cooling water system intake structures as discussed in the UFSAR, Section 9.2 (Ref. 1).For McGuire, the SNSWP is the only cooling water source qualified as the ultimate heat sink.The SNSWP can be aligned to dissipate sensible heat during normal operation.
| |
| The basic performance requirements are that a 30 day supply of water be available, and that the design basis temperatures of safety related equipment not be exceeded.Additional information on the design and operation of the system, along with a list of components served, can be found in Reference 1.APPLICABLE SAFETY ANALYSES The SNSWP provides the Ultimate Heat Sink safety function to dissipate residual heat from the reactor core following all accidents and anticipated operational occurrences in which the unit is cooled down and placed on residual heat removal (RHR) operation.
| |
| Its maximum post accident heat load occurs approximately 3 hours after a design basis loss of coolant accident (LOCA). Prior to this time, the unit switches from injection to recirculation and the containment cooling systems and RHR are required to remove the core decay heat.The operating limits are based on conservative heat transfer analyses for the worst case LOCA. Reference 1 provides the details of the assumptions used in the analysis, which include worst expected meteorological conditions, conservative uncertainties when calculating McGuire Units 1 and 2 B 3.7.8-1 Revision No. 115 SNSWP B 3.7.8 BASES APPLICABLE SAFETY ANALYSES (continued) decay heat, and worst case single active failure. The SNSWP is designed in accordance with Regulatory Guide 1.27 (Ref. 2), which requires a 30 day supply of cooling water in the SNSWP.The SNSWP satisfies Criterion 3 of 10 CFR 50.36 (Ref. 3).LCO The SNSWP is required to be OPERABLE and is considered OPERABLE if it contains a sufficient volume of water at or below the maximum temperature that would allow the NSWS to operate for at least 30 days following the design basis LOCA without the loss of net positive suction head (NPSH), and without exceeding the maximum design temperature of the equipment served by the NSWS. To meet this condition, the SNSWP temperature should not exceed 82 0 F at 722 ft mean sea level and the level should not fall below 739.5 ft mean sea level during normal unit operation.
| |
| APPLICABILITY In MODES 1, 2, 3, and 4, the SNSWP is required to support the OPERABILITY of the equipment serviced by the SNSWP and required to be OPERABLE in these MODES.In MODE 5 or 6, the requirements of the SNSWP are determined by the systems it supports.ACTIONS A. 1 If the SNSWP is inoperable the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours and in MODE 5 within 36 hours.The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.SURVEILLANCE SR 3.7.8.1 REQUIREMENTS This SR verifies that adequate long term (30 day) cooling can be maintained.
| |
| The specified level also ensures that sufficient NPSH is McGuire Units 1 and 2 B 3.7.8-2 Revision No. 115 SNSWP B 3.7.8 BASES SURVEILLANCE REQUIREMENTS (continued) available to operate the NSWS pumps. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program. This SR verifies that the SNSWP water level is > 739.5 ft mean sea level.SR 3.7.8.2 This SR verifies that the NSWS is available to cool the CCW System to at least its maximum design temperature with the maximum accident or normal design heat loads for 30 days following a Design Basis Accident.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program. This SR verifies that the average water temperature of the SNSWP is < 82 0 F at an elevation of 722 ft. The SR is modified by a Note that states the Surveillance is only required to be performed during the months of July, August, and September.
| |
| During other months, the ambient temperature is below the surveillance limit.SR 3.7.8.3 This SR verifies dam integrity by inspection to detect degradation, erosion, or excessive seepage. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. UFSAR, Section 9.2.2. Regulatory Guide 1.27.3. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.7.8-3 Revision No. 115 CRAVS B 3.7.9 B 3.7 PLANT SYSTEMS B 3.7.9 Control Room Area Ventilation System (CRAVS)BASES BACKGROUND The CRAVS provides a protected environment from which occupants can control the unit following an uncontrolled release of radioactivity, hazardous chemicals, or smoke.The CRAVS consists of two independent, redundant trains that draw in filtered outside air and mix this air with conditioned air recirculating through the Control Room Envelope (CRE). Each outside air pressure filter train consists of a prefilter, a high efficiency particulate air (HEPA)filter, an activated charcoal absorber section for removal of gaseous activity (principally iodines), and a fan. Ductwork, valves or dampers, doors, barriers, and instrumentation also form part of the system, as well as prefilters to remove water droplets from the air stream. A second bank of HEPA filters follows the absorber section to collect carbon fines and provides backup in case of failure of the main HEPA filter bank.The CRE is the area within the confines of the CRE boundary that contains the spaces that control room occupants inhabit to control the unit during normal and accident conditions.
| |
| The CRE is protected during normal operation, natural events, and accident conditions.
| |
| The CRE boundary is the combination of walls, floor, roof, ducting, doors, penetrations, and equipment that physically form the CRE. The OPERABILITY of the CRE boundary must be maintained to ensure that the inleakage of unfltered air into the CRE will not exceed the inleakage assumed in the licensing basis analysis of design basis accident (DBA)consequences to CRE occupants.
| |
| The CRE and its boundary are defined in the Control Room Envelope Habitability Program.The CRAVS is an emergency system. During normal operation the CRE is provided with 100% recirculated air and the outside air pressure filter train is in the standby mode. Upon receipt of the actuating signal(s), the CRE is provided with fresh air through outside air intakes and is circulated through the system filter trains. The prefilters remove any large particles in the air, and any entrained water droplets present, to prevent excessive loading of the HEPA filters and charcoal adsorbers.
| |
| Continuous operation of each train for at least 10 hours per month, with the heaters on, reduces moisture buildup on the HEPA filters and adsorbers.
| |
| The heater is important to the effectiveness of the charcoal adsorbers.
| |
| McGuire Units 1 and 2 B 3.7.9-1 Revision No. 115 McGuire Units 1 and 2 B 3.7.9-1 Revision No. 115 CRAVS B 3.7.9 BASES BACKGROUND (continued)
| |
| Actuation of the CRAVS places the system in the emergency mode of operation, depending on the initiation signal. The emergency radiation state initiates pressurization and filtered ventilation of the air supply to the CRE. Pressurization of the CRE minimizes infiltration of unfiltered air from the surrounding areas adjacent to the CRE boundary.The air entering the outside air intakes is continuously monitored by radiation detectors.
| |
| The detector output above the setpoint will alarm in the Control Room.A single CRAVS train can adequately pressurize the CRE relative to atmospheric pressure.
| |
| The CRAVS operation in maintaining the CRE habitable is discussed in the UFSAR, Section 6.4 (Ref. 1).Redundant supply and recirculation trains provide the required filtration should an excessive pressure drop develop across the other filter train.Normally open outside air intake isolation dampers are arranged in series pairs so that the failure of one damper to shut will not result in a breach of isolation.
| |
| The CRAVS is designed in accordance with Seismic Category I requirements.
| |
| The CRAVS is designed to maintain a habitable environment in the CRE for 30 days of continuous occupancy after a Design Basis Accident (DBA)without exceeding a 5 rem Total Effective Dose Equivalent (TEDE).There are components that have nomenclature associated with the CRAVS but do not perform any function that impacts the control room.These components include the Control Room Area Air Handling units, the Switchgear Air Handling units, the Battery Room Exhaust Fans and the associated ductwork, dampers, and instrumentation.
| |
| These components share the CRACWS with the CRAVS but are not governed by LCO 3.7.9.APPLICABLE The CRAVS components are arranged in redundant, safety related SAFETY ANALYSES ventilation trains. The CRAVS provides airborne radiological protection for the CRE occupants, as demonstrated by the CRE occupant dose analyses for the most limiting design basis accident -fission product release presented in the UFSAR, Chapter 15 (Ref. 2).The CRAVS provides protection from smoke and hazardous chemicals to the CRE occupants.
| |
| The analysis of hazardous chemical releases demonstrates that the toxicity limits are not exceeded in the CRE following a hazardous chemical release (Ref. 1). The evaluation of a McGuire Units I and 2 B 3.7.9-2 Revision No. 115 CRAVS B 3.7.9 BASES APPLICABLE SAFETY ANALYSES (continued) smoke challenge demonstrates that it will not result in the inability of the CRE occupants to control the reactor either from the control room or from the safe shutdown facility (Ref. 3).The worst case single active failure of a component of the CRAVS, assuming a loss of offsite power, does not impair the ability of the system to perform its design function.The CRAVS satisfies Criterion 3 of 10 CFR 50.36.LCO Two independent and redundant CRAVS trains are required to be OPERABLE to ensure that at least one is available if a single active failure disables the other train. Total system failure, such as from a loss of both ventilation trains or from an inoperable CRE boundary, could result in exceeding a dose of 5 rem TEDE to the CRE occupants in the event of a large radioactive release.Each CRAVS train is considered OPERABLE when the individual components necessary to limit CRE occupant exposure are OPERABLE.A CRAVS train is OPERABLE when the associated:
| |
| : a. An Outside Air Pressure Filter Train fan and a Control Room Air Handling unit are OPERABLE;b. HEPA filters and charcoal adsorbers are not excessively restricting flow, and are capable of performing their filtration functions; and c. Ductwork, valves, and dampers are OPERABLE, and air circulation can be maintained.
| |
| In order for the CRAVS trains to be considered OPERABLE, the CRE boundary must be maintained such that the CRE occupant dose from a large radioactive release does not exceed the calculated dose in the licensing basis consequence analyses for DBAs, and that CRE occupants are protected from hazardous chemicals and smoke.The CRAVS is shared between the two units. The system must be OPERABLE for each unit when that unit is in the MODE of Applicability.
| |
| Additionally, both normal and emergency power must also be OPERABLE because the system is shared. If a CRAVS component becomes inoperable, or normal or emergency power to a CRAVS component becomes inoperable, then the Required Actions of this LCO McGuire Units 1 and 2 B 3.7.9-3 Revision No. 115 CRAVS B 3.7.9 BASES LOC (continued) must be entered independently for each unit that is in the MODE of applicability of the LCO.The LCO is modified by a Note allowing the CRE boundary to be opened intermittently under administrative controls.
| |
| This Note only applies to openings in the CRE boundary that can be rapidly restored to the design condition, such as doors, hatches, floor plugs, and access panels. For entry and exit through doors, the administrative control of the opening is performed by the person(s) entering or exiting the area.For other openings, these controls should be proceduralized and consist of stationing a dedicated individual at the opening who is in continuous communication with the operators in the CRE. This individual will have a method to rapidly close the opening and to restore the CRE boundary to a condition equivalent to the design condition when a need for CRE isolation is indicated.
| |
| APPLICABILITY In MODES 1, 2, 3, 4, 5, and 6, and during movement of irradiated fuel assemblies and during CORE ALTERATIONS, the CRAVS must be OPERABLE to ensure that the CRE will remain habitable during and following a DBA.During movement of irradiated fuel assemblies and CORE ALTERATIONS, the CRAVS must be OPERABLE to cope with the release from a fuel handling accident.ACTIONS A.1 When one CRAVS train is inoperable, for reasons other than an inoperable CRE boundary, action must be taken to restore OPERABLE status within 7 days. In this Condition, the remaining OPERABLE CRAVS train is adequate to perform the CRE occupant protection function.
| |
| However, the overall reliability is reduced because a failure in the OPERABLE CRAVS train could result in loss of CRAVS function.
| |
| The 7 day Completion Time is based on the low probability of a DBA occurring during this time period, and ability of the remaining train to provide the required capability.
| |
| McGuire Units 1 and 2 B 3.7.9-4 Revision No. 115 CRAVS B 3.7.9 BASES ACTIONS (Continued)
| |
| B.1, B.2, and B.3 If the unfiltered inleakage of potentially contaminated air past the CRE boundary and into the CRE can result in CRE occupant radiological dose greater than the calculated dose of the licensing basis analyses of DBA consequences (allowed to be up to 5 rem TEDE), or inadequate protection of CRE occupants from hazardous chemicals or smoke, the CRE boundary is inoperable.
| |
| Actions must be taken to restore an OPERABLE CRE boundary within 90 days.During the period that the CRE boundary is considered inoperable, action must be initiated to implement mitigating actions to lessen the effect on CRE occupants from the potential hazards of a radiological or chemical event or a challenge from smoke. Actions must be taken within 24 hours to verify that in the event of a DBA, the mitigating actions will ensure that CRE occupant radiological exposure will not exceed the calculated dose of the licensing basis analyses of DBA consequences, and the CRE occupants are protected from hazardous chemicals and smoke. These mitigating actions (i.e., actions that are taken to offset the consequences of the inoperable CRE boundary) should be preplanned for implementation upon entry into the condition, regardless of whether entry is intentional or unintentional.
| |
| The 24 hour Completion Time is reasonable based on the low probability of a DBA occurring during this time period, and the use of mitigating actions. The 90 day Completion Time is reasonable based on the determination that the mitigating actions will ensure protection of CRE occupants within analyzed limits while limiting the probability that CRE occupants will have to implement protective measures that may adversely affect their ability to control the reactor and maintain it in a safe shutdown condition in the event of a DBA. In addition, the 90 day Completion Time is a reasonable time to diagnose, plan and possibly repair, and test most problems with the CRE boundary.C.1 and C.2 In MODE 1, 2, 3, or 4, if the inoperable CRAVS train or the CRE boundary cannot be restored to OPERABLE status within the required Completion Time, the unit must be placed in a MODE that minimizes accident risk. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours, and in MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.McGuire Units 1 and 2 B 3.7.9-5 Revision No. 115 CRAVS B 3.7.9 BASES ACTIONS (Continued)
| |
| D.1. D.2.1, and D.2.2 In MODE 5 or 6, or during movement of irradiated fuel assemblies, or during CORE ALTERATIONS, if the inoperable CRAVS train cannot be restored to OPERABLE status within the required Completion Time, action must be taken to immediately place the OPERABLE CRAVS train in the emergency mode. This action ensures that the remaining train is OPERABLE, that no failures preventing automatic actuation will occur, and that any active failure would be readily detected.
| |
| An alternative to Required Action D.1 is to immediately suspend activities that could result in a release of radioactivity that might require isolation of the CRE. This places the unit in a condition that minimizes the accident risk. This does not preclude the movement of fuel to a safe position.E.1 and E.2 In MODE 5 or 6, or during movement of irradiated fuel assemblies, or during CORE ALTERATIONS, with two CRAVS trains inoperable or with one or more CRAVS trains inoperable due to an inoperable CRE boundary, action must be taken immediately to suspend activities that could result in a release of radioactivity that might enter the control room.This places the unit in a condition that minimizes the accident risk. This does not preclude the movement of fuel to a safe position.F. 1 If both CRAVS trains are inoperable in MODE 1, 2, 3, or 4 for reasons other than an inoperable CRE boundary (i.e., Condition B), the CRAVS may not be capable of performing the intended function and the unit is in a condition outside the accident analyses.
| |
| Therefore, LCO 3.0.3 must be entered immediately.
| |
| G.1 and G.2 Action G.1 allows one or more CRAVS heater inoperable, with the heater restored to OPERABLE status within 7 days. Alternatively, Action G.2 requires if the heater is not returned to OPERABLE within the 7 days, a report to be initiated per Specification 5.6.6, which details the reason for the heater's inoperability and the corrective action required to return the heater to OPERABLE status.The heaters do not affect OPERABILITY of the CRAVS filter train because charcoal absorber efficiency testing is performed at 30 0 C and 90% relative humidity.
| |
| The accident analysis shows that control room McGuire Units 1 and 2 B 3.7.9-6 Revision No. 115 CRAVS B 3.7.9 BASES ACTIONS (Continued) radiation doses are within 10 CFR 50.67 (Ref. 8) limits during a DBA LOCA under these conditions.
| |
| SURVEILLANCE SR 3.7.9.1 REQUIREMENTS Standby systems should be checked periodically to ensure that they function properly.
| |
| As the environment and normal operating conditions on this system are not too severe, testing each train once every month provides an adequate check of this system. Monthly heater operations dry out any moisture accumulated in the charcoal from humidity in the ambient air. Systems with heaters must be operated from the control room for > 10 continuous hours with the heaters energized and flow through the HEPA filters and charcoal adsorbers.
| |
| Inoperable heaters are addressed by Required Actions G.1 and G.2. The inoperability of heaters between required performances of this surveillance does not affect OPERABILITY of each CRAVS train. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.7.9.2 This SR verifies that the required CRAVS testing is performed in accordance with the Ventilation Filter Testing Program (VFTP). The CRAVS filter tests are in accordance with Regulatory Guide 1.52 (Ref. 4).The VFTP includes testing the performance of the HEPA filter, charcoal adsorber efficiency, minimum flow rate, and the physical properties of the activated charcoal.
| |
| Specific test Frequencies and additional information are discussed in detail in the VFTP.SR 3.7.9.3 This SR verifies that each CRAVS train starts and operates with flow through the HEPA filters and charcoal adsorbers on an actual or simulated actuation signal. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.7.9.4 This SR verifies the OPERABILITY of the CRE boundary by testing for unfiltered air inleakage past the CRE boundary and into the CRE. The details of the testing are specified in the Control Room Envelope Habitability Program.McGuire Units 1 and 2 B 3.7.9-7 Revision No. 115 CRAVS B 3.7.9 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| The CRE is considered habitable when the radiological dose to CRE occupants calculated in the licensing basis analyses of DBA consequences is no more that 5 rem TEDE and the CRE occupants are protected from hazardous chemicals and smoke. This SR verifies that the unfiltered air inleakage into the CRE is no greater than the flow rate assumed in the licensing basis analyses of DBA consequences.
| |
| When unfiltered air inleakage is greater than the assumed flow rate, Condition B must be entered. Required Acton B.3 allows time to restore the CRE boundary to OPERABLE status provided mitigating actions can ensure that the CRE remains within the licensing basis habitability limits for the occupants following an accident.
| |
| Compensatory measures are discussed in Regulatory Guide 1.196, Section C.2.7.3, (Ref. 5) which endorses, with exceptions, NEI 99-03, Section 8.4 and Appendix F (Ref. 6). These compensatory measures may also be used as mitigating actions as required by Required Action B.2. Temporary analytical methods may also be used as compensatory measures to restore OPERABILITY (Ref. 7).Options for restoring the CRE boundary to OPERABLE status include changing the licensing basis DBA consequence analysis, repairing the CRE boundary, or a combination of these actions. Depending upon the nature of the problem and the corrective action, a full scope inleakage test may not be necessary to establish that the CRE boundary has been restored to OPERABLE status.REFERENCES
| |
| : 1. UFSAR, Section 6.4.2. UFSAR, Chapter 15.3. UFSAR, Section 9.5.4. Regulatory Guide 1.52, Rev. 2.5. Regulatory Guide 1.196, Rev. 1.6. NEI 99-03, June 2001, "Control Room Habitability Assessment Guidance".
| |
| : 7. Letter from Eric Leeds (NRC) to James Davis (NEI) dated January 30, 2004, "NEI Draft White Paper, Use of GL 91-18 Process and Alternate Source Terms in the Context of Control Room Habitability." 8. 10 CFR 50.67, "Accident Source Term." McGuire Units 1 and 2 B 3.7.9-8 Revision No. 115 McGuire Units 1 and 2 B 3.7.9-8 Revision No. 115 B 3.7 PLANT SYSTEMS B 3.7.10 Control Room Area Chilled Water System (CRACWS)BASES BACKGROUND The CRACWS provides temperature control for the control room following isolation of the control room.The CRACWS consists of two independent and redundant trains that provide cooling of recirculated control room air. Each train consists of cooling coils, instrumentation, and controls to provide for control room temperature control. The CRACWS is a subsystem providing air temperature control for the control room.The CRACWS is an emergency system, parts of which may also operate during normal unit operations.
| |
| A single train will provide the required temperature control to maintain the control room at approximately 75 0 F.The CRACWS operation in maintaining the control room temperature is discussed in the UFSAR, Section 6.4 (Ref. 1).There are components that are part of the CRACWS but do not affect the CRAVS. These components are associated with the Control Room Area Air Handling units, the Switchgear Air Handling units. LCO 3.7.10 does not apply if a CRAVS component does not directly impact the CRACWS.APPLICABLE The design basis of the CRACWS is to maintain the control room SAFETY ANALYSES temperature for 30 days of continuous occupancy.
| |
| The CRACWS components are arranged in redundant, safety related trains. During emergency operation, the CRACWS maintains the temperature between 75°F and 90 0 F. A single active failure of a component of the CRACWS, with a loss of offsite power, does not impair the ability of the system to perform its design function.
| |
| Redundant detectors and controls are provided for control room temperature control.The CRACWS is designed in accordance with Seismic Category I requirements.
| |
| The CRACWS is capable of removing sensible and latent heat loads from the control room, which include consideration of equipment heat loads and personnel occupancy requirements, to ensure equipment OPERABILITY.
| |
| The CRACWS satisfies Criterion 3 of 10 CFR 50.36 (Ref. 2).McGuire Units 1 and 2 B 3.7.10-1 Revision No. 115 CRACWS B 3.7.10 BASES LCO Two independent and redundant trains of the CRACWS are required to be OPERABLE to ensure that at least one is available, assuming a single failure disabling the other train. Total system failure could result in the equipment operating temperature exceeding limits in the event of an accident.The CRACWS is considered to be OPERABLE when the individual components necessary to maintain the control room temperature are OPERABLE in both trains. These components include the cooling coils and associated temperature control instrumentation.
| |
| In addition, the CRACWS must be operable to the extent that air circulation can be maintained.
| |
| The CRACWS is shared between the two units. The system must be OPERABLE for each unit when that unit is in the MODE of Applicability.
| |
| Additionally, both normal and emergency power must also be OPERABLE because the system is shared. If a CRACWS component becomes inoperable, or normal or emergency power to a CRACWS component becomes inoperable, then the Required Actions of this LCO must be entered independently for each unit that is in the MODE of applicability of the LCO.APPLICABILITY In MODES 1, 2, 3, 4, 5, and 6, and during movement of irradiated fuel assemblies and during CORE ALTERATIONS, the CRACWS must be OPERABLE to ensure that the control room temperature will not exceed equipment operational requirements following isolation of the control room.ACTIONS A.1 With one CRACWS train inoperable, action must be taken to restore OPERABLE status within 30 days. In this Condition, the remaining OPERABLE CRACWS train is adequate to maintain the control room temperature within limits. However, the overall reliability is reduced because a single failure in the OPERABLE CRACWS train could result in loss of CRACWS function.
| |
| The 30 day Completion Time is based on the low probability of an event requiring control room isolation, the consideration that the remaining train can provide the required protection, and that alternate safety or nonsafety related cooling means are available.
| |
| McGuire Units 1 and 2 B 3.7.10-2 Revision No. 115 CRACWS B 3.7.10 BASES ACTIONS (continued)
| |
| B.1 and B.2 In MODE 1, 2, 3, or 4, if the inoperable CRACWS train cannot be restored to OPERABLE status within the required Completion Time, the unit must be placed in a MODE that minimizes the risk.To achieve this status, the unit must be placed in at least MODE 3 within 6 hours, and in MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.C.1, C.2.1, and C.2.2 In MODE 5 or 6, or during movement of irradiated fuel, or during CORE ALTERATIONS, if the inoperable CRACWS train cannot be restored to OPERABLE status within the required Completion Time, the OPERABLE CRACWS train must be placed in operation immediately.
| |
| This action ensures that the remaining train is OPERABLE, that no failures preventing automatic actuation will occur, and that active failures will be readily detected.An alternative to Required Action C.1 is to immediately suspend activities that present a potential for releasing radioactivity that might require isolation of the control room. This places the unit in a condition that minimizes accident risk. This does not preclude the movement of fuel to a safe position.D.1 and D.2 In MODE 5 or 6, or during movement of irradiated fuel assemblies, or during CORE ALTERATIONS, with two CRACWS trains inoperable, action must be taken immediately to suspend activities that could result in a release of radioactivity that might require isolation of the control room. This places the unit in a condition that minimizes risk. This does not preclude the movement of fuel to a safe position.E._1 If both CRACWS trains are inoperable in MODE 1, 2, 3, or 4, the control room CRACWS may not be capable of performing its intended function.
| |
| Therefore, LCO 3.0.3 must be entered immediately.
| |
| McGuire Units 1 and 2 B 3.7.10-3 Revision No. 115 CRACWS B 3.7.10 BASES SURVEILLANCE SR 3.7.10.1 REQUIREMENTS This SR verifies that the heat removal capability of the system is sufficient to maintain the temperature in the control room at or below 90 0 F. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. UFSAR, Section 6.4.2. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.7.10-4 Revision No. 115 ABFVES B 3.7.11 B 3.7 PLANT SYSTEMS B 3.7.11 Auxiliary Building Filtered Ventilation Exhaust System (ABFVES)BASES BACKGROUND The ABFVES filters air from the area of the active ECCS components during the recirculation phase of a loss of coolant accident (LOCA).The ABFVES, in conjunction with other normally operating systems, also provides environmental control of temperature and humidity in the ECCS pump room area and the auxiliary building.The ABFVES consists of a system, made up of prefilter, a high efficiency particulate air (HEPA) filter, a carbon adsorber section for removal of gaseous activity (principally iodines), and two fans.Ductwork, valves or dampers, and instrumentation also form part of the system. The system initiates filtered ventilation of the pump room following receipt of a safety injection (SI) signal.The ABFVE systems are designed to be shared between units. Each unit's system is constructed with two 50% capacity fans providing flow to a 100% capacity filter package. With this design, both Units l's and Units 2's ABFVE systems are required to be OPERABLE with either unit in MODES 1, 2, 3, or 4.The ABFVES is a standby system, aligned to bypass the system HEPA filters and carbon adsorbers.
| |
| During emergency operations, the ABFVES dampers are realigned to begin filtration.
| |
| Upon receipt of the actuating Engineered Safety Feature Actuation System signal(s), air is pulled from the mechanical penetration area and the ECCS pump rooms, and the stream of ventilation air discharges through the system filters. The prefilters remove any large particles in the air, and any entrained water droplets present, to prevent excessive loading of the HEPA filters and carbon adsorbers.
| |
| The ABFVES was not initially designed as a safety related system.However, during initial plant licensing, the ABFVES was re-classified as an engineered safety feature (ESF) atmosphere cleanup system and partially upgraded to meet most of the recommendations of Regulatory Guide 1.52. A comparison of the current ABFVES design to Regulatory Guide 1.52 (lRef. 6) is presented in UFSAR Table 9-38 (Ref. 8) and is discussed in UFSAR Section 9.4 (Ref. 1).McGuire Units 1 and 2 B 3.7.11 -1 Revision No. 115 ABFVES B 3.7.11 BASES BACKGROUND (Continued)
| |
| The ABFVES is discussed in the UFSAR, Sections 9.4, 12.2, and 15.6.5 (Refs. 1, 2, and 3, respectively) since it may be used for normal, as well as post accident, atmospheric cleanup functions.
| |
| APPLICABLE SAFETY ANALYSES The design basis of the ABFVES is established by the large break LOCA. The system evaluation assumes a passive failure of the ECCS outside containment, such as an SI pump seal failure, during the recirculation mode. In such a case, the system limits radioactive release to within the 10 CFR 50.67 (Ref. 4) limits, or the NRC staff approved licensing basis (e.g., a specified fraction of Reference 4 limits). The analysis of the effects and consequences of a large break LOCA is presented in Reference
| |
| : 3. The ABFVES also actuates following a small break LOCA, in those cases where the ECCS goes into the recirculation mode of long term cooling, to clean up releases of smaller leaks, such as from valve stem packing.Two types of system failures are considered in the accident analysis:
| |
| complete loss of function, and excessive LEAKAGE.Either type of failure may result in a lower efficiency of removal for any gaseous and particulate activity released to the ECCS pump rooms following a LOCA.The ABFVES satisfies Criterion 3 of 10 CFR 50.36 (Ref. 5).LCO The ABFVES is required to be OPERABLE with either unit in MODES 1, 2, 3, or 4. Total system failure could result in the atmospheric release from the ECCS pump room exceeding 10 CFR 50.67 limits in the event of a Design Basis Accident (DBA).ABFVES is considered OPERABLE when the individual components necessary to maintain the ECCS pump room filtration are OPERABLE in both units systems.An ABFVES is considered OPERABLE when its associated:
| |
| : a. Fans in configuration as described below are OPERABLE: Both fans OPERABLE in any one set of fans listed below: 1A and 1B, or 2A and 28, or 1A and 2A, or 1B and 2B McGuire Units 1 and 2 B 3.7.11-2 Revision No. 115 ABFVES B 3.7.11 BASES LCO (continued)
| |
| Use of any other two fan combination requires surveillance testing in that configuration prior to taking credit for that combination.
| |
| : b. HEPA filter and carbon adsorbers are not excessively restricting flow, and are capable of performing their filtration functions; and c. Ductwork, valves, and dampers are OPERABLE and air circulation can be maintained.
| |
| The ABFVES is shared between the two units. The system must be OPERABLE for each unit when that unit is in the MODE of Applicability.
| |
| Additionally, both normal and emergency power must also be OPERABLE because the system is shared. If a ABFVES component becomes inoperable, or normal or emergency power to a ABFVES component becomes inoperable, then the Required Actions of this LCO must be entered independently for each unit that is in the MODE of applicability of the LCO.The LCO is modified by a NOTE allowing the Auxiliary Building pressure boundary to be opened intermittently under administrative controls.
| |
| For entry and exit through doors, the administrative control of the opening is performed by the person(s)entering or exiting the area. For other openings, these controls consist of stationing a dedicated individual at the opening who is in continuous communication with the control room. This individual will have a method to rapidly close the opening when a need for Auxiliary Building pressure boundary isolation is indicated.
| |
| APPLICABILITY Either unit in MODES 1, 2, 3, and 4, the ABFVES is required to be OPERABLE consistent with the OPERABILITY requirements of the ECCS.Both units in MODE 5 or 6, the ABFVES is not required to be OPERABLE since the ECCS is not required to be OPERABLE.ACTIONS A. 1 With one unit's ABFVES inoperable, action must be taken to restore OPERABLE status within 7 days. During this time, the McGuire Units 1 and 2 B 3.7.11-3 Revision No. 115 ABFVES B 3.7.11 BASES ACTIONS (continued) remaining OPERABLE unit's system is adequate to perform the ABFVES function.
| |
| One unit's system of ABFVES may be made inoperable from, but not limited to, the filter assembly, fans, flowpath, or the ability to maintain the required negative 0.125 inches of water gauge (wg) for the ECCS pump rooms relative to atmospheric pressure.The 7 day Completion Time is appropriate because the risk contribution is less than that for the ECCS (72 hour Completion Time), and this system is not a direct support system for the ECCS. The 7 day Completion Time is based on the low probability of a DBA occurring during this time period, and ability of the remaining unit's system to provide the required capability.
| |
| B._ 1 With both unit's ABFVE systems inoperable, action must be taken to restore to OPERABLE status one unit's ABFVE system within 24 hours. The 24 hour Completion Time is based on an adequate period of time to determine the cause of the inoperability and affect repairs without the need of shutting down both units. In addition, the probability of a DBA is low for this short period of time.If the Auxiliary Building pressure boundary is inoperable such that the ABFVES trains cannot establish or maintain the required pressure, action must be taken to restore an OPERABLE Auxiliary Building pressure boundary within 24 hours. During the period that the Auxiliary Building pressure boundary is inoperable, appropriate compensatory measures [consistent with the intent, as applicable, of GDC 19, 60, 64 and 10 CFR Part 50.67] should be utilized to protect plant personnel from potential hazards such as radioactive contamination, toxic chemicals, smoke, temperature and relative humidity, and physical security.
| |
| Preplanned measures should be available to address these concerns for intentional and unintentional entry into the condition.
| |
| C.1 and C.2 If the ABFVES cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours, and in MODE 5 within 36 hours. The allowed Completion Times are reasonable, McGuire Units 1 and 2 B 3.7.11-4 Revision No. 115 ABFVES B 3.7.11 BASES ACTIONS (continued) based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.SURVEILLANCE SR 3.7.11.1 REQUIREMENTS Standby systems should be checked periodically to ensure that they function properly.
| |
| As the environment and normal operating conditions on this system are not severe, testing each train once a month provides an adequate check on this system. Systems without heaters need only be operated from the control room for> 15 minutes with flow through the HEPA filters and charcoal adsorbers to demonstrate the function of the system. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.7.11.2 This SR verifies that the required ABFVES testing is performed in accordance with the Ventilation Filter Testing Program (VFTP).The ABFVES filter tests are in accordance with Reference
| |
| : 4. The VFTP includes testing HEPA filter performance, carbon adsorbers efficiency, minimum system flow rate, and the physical properties of the carbon (general use and following specific operations).
| |
| Specific test Frequencies and additional information are discussed in detail in the VFTP.SR 3.7.11.3 This SR verifies that ABFVES starts and operates with flow through the HEPA filters and charcoal adsorbers on an actual or simulated actuation signal. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.7.11.4 This SR verifies the integrity of the ECCS pump room enclosure.
| |
| The ability of the ECCS pump room to maintain a negative pressure, with respect to potentially uncontaminated adjacent areas, is periodically tested to verify proper functioning of the ABFVES. During the post accident mode of operation, the ABFVES is designed to maintain a slight negative pressure in the McGuire Units 1 and 2 B 3.7.11-5 Revision No. 115 ABFVES B 3.7.11 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| ECCS pump room area, with respect to adjacent areas, to prevent unfiltered LEAKAGE. The ABFVES is designed to maintain a< -0.125 inches water gauge relative to atmospheric pressure.This SR is required to be performed for each fan combination (1A and 1B, 2A and 2B, 1A and 2A, 1B and 2B) described in the LCO Bases. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. UFSAR, Section 9.4.2. UFSAR, Section 12.2.3. UFSAR, Section 15.6.5.4. 10 CFR 50.67, "Accident Source Term." 5. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| : 6. Regulatory Guide 1.52 (Rev. 2).7. NUREG-0800, Section 6.5.1, Rev. 2, July 1981.8. UFSAR, Table 9-38.McGuire Units 1 and 2 B 3.7.11-6 Revision No. 115 FHVES B 3.7.12 BASES B 3.7 PLANT SYSTEMS B 3.7.12 Fuel Handling Ventilation Exhaust System (FHVES)BASES BACKGROUND The FHVES filters airborne radioactive particulates from the area of the fuel pool following a fuel handling accident.
| |
| The FHVES, in conjunction with other normally operating systems, also provides environmental control of temperature and humidity in the fuel pool area.The FHVES is composed of both a supply and exhaust section. The supply portion consists of a 100% capacity air handling unit containing water cooling coils, hot water heating coils, roughing filters, and associated ductwork and dampers. The exhaust portion consists of a 100% capacity filter train, two 50% capacity exhaust fans, and associated ductwork and dampers. The exhaust fans were originally each 100%capacity but have been modified to 50% capacity fans in order to meet the required intake and exhaust flowrate.
| |
| The filter train contains a prefilter, high efficiency particulate air (HEPA) filter, and carbon filters of the gasketless design. The system is required to be in operation in filtered mode any time irradiated fuel is being moved in the fuel handling building.The prefilters remove any large particles in the air, and any entrained water droplets present, to prevent excessive loading of the HEPA filters and carbon adsorbers.
| |
| The FHVES is discussed in the UFSAR, Sections 9.4 and 15.7 (Refs. 1 and 2 respectively) because it may be used for normal, as well as post accident, atmospheric cleanup functions.
| |
| A fuel handling accident can occur as a result of either dropping an irradiated fuel assembly that is being moved, or by dropping other equipment onto an irradiated fuel assembly in storage. As such, the FHVES is required to be OPERABLE and in operation in filtered mode to alleviate the consequences of a fuel handling accident during the following evolutions:
| |
| : 1. Movement of irradiated fuel in the fuel handling building;2. Movement of loads in excess of 100 lbs. over irradiated fuel in the fuel handling building.
| |
| This can include equipment and/or McGuire Units 1 and 2 B 3.7.12-1 Revision No. 115 FHVES B 3.7.12 BASES BACKGROUND (continued) new fuel assemblies that are being moved over irradiated fuel stored in the fuel pool; and 3. Movement of a loaded dry storage cask in the fuel handling building with the 125 ton overhead crane. This specifically excludes the movement of a loaded cask into or out of the fuel handling building when the fuel handling building roll-up door is raised.APPLICABLE The FHVES design basis is established by the consequences of the SAFETY ANALYSES limiting Design Basis Accident (DBA), which is a fuel handling accident.The analysis of the fuel handling accident, given in Reference 2, assumes that all fuel rods in an assembly are damaged. The DBA analysis of the fuel handling accident assumes that the FHVES is in operation in filtered mode. The accident analysis accounts for the reduction in airborne radioactive material provided by this filtration system. The amount of fission products available for release from the fuel handling building is determined for a fuel handling accident.
| |
| These assumptions and the analysis follow the guidance provided in Regulatory Guide 1.25 (Ref. 3).The FHVES satisfies Criterion 3 of 10 CFR 50.36 (Ref. 4).LCO The FHVES is required to be OPERABLE and in operation in filtered mode when irradiated fuel is being handled in the fuel handling building.Total system failure could result in the atmospheric release from the fuel handling building exceeding the 10 CFR 100 (Ref. 5) limits in the event of a fuel handling accident.The FHVES is considered OPERABLE when the individual components necessary to control exposure in the fuel handling building are OPERABLE.
| |
| The FHVES is considered OPERABLE when its associated:
| |
| : a. Two exhaust fans are OPERABLE;b. Supply fan is OPERABLE;c. HEPA filter and carbon adsorber are not excessively restricting flow, and are capable of performing their filtration function; and d. Ductwork, valves, and dampers are OPERABLE, and air circulation can be maintained.
| |
| McGuire Units 1 and 2 B 3.7.12-2 Revision No. 115 FHVES B 3.7.12 BASES APPLICABILITY The FHVES is required to be OPERABLE and in operation in filtered mode during the following evolutions:
| |
| : 1. Movement of irradiated fuel in the fuel handling building;2. Movement of loads in excess of 100 lbs. over irradiated fuel stored in the spent fuel pool; and 3. Movement of a loaded dry storage cask in the fuel handling building with the 125 ton overhead crane.ACTIONS A..1 With the FHVES inoperable, action must be taken to immediately suspend the movement of irradiated fuel in the fuel handling building.This does not preclude movement of a fuel assembly to a safe position.his action ensures a release to the environment will be within the limits of 10 CFR 100 limits (Ref. 5), if a fuel handling accident were to occur.Required Action A.1 is modified by a Note indicating that LCO 3.0.3 does not apply.SURVEILLANCE SR 3.7.12.1 REQUIREMENTS With the FHVES in service, a periodic monitoring of the system for proper operation is required to ensure that the system functions properly.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.7.12.2 Systems should be checked periodically to ensure that they function properly.
| |
| As the environmental and normal operating conditions on this system are not severe, testing prior to movement of irradiated fuel will ensure an adequate check on this system.Systems without heaters need only be operated for > 15 minutes to demonstrate the function of the system.McGuire Units 1 and 2 B 3.7.12-3 Revision No. 115 FHVES B 3.7.12 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.7.12.3 This SR verifies that the required FHVES testing is performed in accordance with the Ventilation Filter Testing Program (VFTP). The FHVES filter tests are in accordance with Regulatory Guide 1.52 (Ref. 6).The VFTP includes testing HEPA filter performance, carbon adsorber efficiency, minimum system flow rate, and the physical properties of the activated charcoal (general use and following specific operations).
| |
| Specific test frequencies and additional information are discussed in detail in the VFTP.SR 3.7.12.4 This SR verifies the integrity of the fuel building enclosure.
| |
| The ability of the fuel building to maintain negative pressure with respect to potentially uncontaminated adjacent areas is periodically verified by ensuring the exhaust flow rate of the FHVES is 8000 cfm greater than the supply flow rate. During the post accident mode of operation, the FHVES is designed to maintain a slight negative pressure in the fuel building, to prevent unfiltered LEAKAGE.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.7.12.5 Operating the FHVES filter bypass damper is necessary to ensure that the system functions properly.
| |
| The OPERABILITY of the FHVES filter bypass damper is verified if it can be manually closed. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Units 1 and 2 B 3.7.12-4 Revision No. 115 FHVES B 3.7.12 BASES REFERENCES 2.3.4.5.6.7.UFSAR, Section 9.4.UFSAR, Section 15.7.Regulatory Guide 1.25.10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| 10 CFR 100.Regulatory Guide 1.52 (Rev. 2).NUREG-0800, Section 6.5.1, Rev. 2, July 1981.McGuire Units 1 and 2 B 3.7.12-5 Revision No. 115 Spent Fuel Pool Water Level B 3.7.13 B 3.7 PLANT SYSTEMS B 3.7.13 Spent Fuel Pool Water Level BASES BACKGROUND The minimum water level in the spent fuel pool meets the assumptions of iodine decontamination factors following a fuel handling accident.
| |
| The specified water level shields and minimizes the general area dose when the storage racks are filled to their maximum capacity.
| |
| The water also provides shielding during the movement of spent fuel.A general description of the spent fuel pool design is given in the UFSAR, Section 9.1.2 (Ref. 1). A description of the Spent Fuel Pool Cooling System is given in the UFSAR, Section 9.1.3 (Ref. 2). The assumptions of the fuel handling accident are given in the UFSAR, Section 15.7.4 (Ref. 3).APPLICABLE The minimum water level in the spent fuel pool meets the assumptions of SAFETY ANALYSES the fuel handling accident described in Regulatory Guide 1.183 (Ref. 4).The resultant 2 hour TEDE dose per person at the exclusion area boundary is a small fraction of the 10 CFR 50.67 (Ref. 5) limits.According to Reference 4, there is 23 ft of water between the top of the damaged fuel bundle and the fuel pool surface during a fuel handling accident.
| |
| With 23 ft of water, the assumptions of Reference 4 can be used directly.
| |
| In practice, this LCO preserves this assumption for the bulk of the fuel in the storage racks. In the case of a single bundle dropped and lying horizontally on top of the spent fuel racks, however, there may be < 23 ft of water above the top of the fuel bundle and the surface, indicated by the width of the bundle. To offset this small nonconservatism, the analysis assumes that all fuel rods fail, although analysis shows that only the first few rows fail from a hypothetical maximum drop.The spent fuel pool water level satisfies Criterion 2 of 10 CFR 50.36 (Ref.6).LCO The spent fuel pool water level is required to be > 23 ft over the top of irradiated fuel assemblies seated in the storage racks. The specified water level preserves the assumptions of the fuel handling accident analysis (Ref. 3). As such, it is the minimum required for fuel storage and movement within the spent fuel pool.McGuire Units 1 and 2 B 3.7.13-1 Revision No. 115 Spent Fuel Pool Water Level B 3.7.13 BASES APPLICABILITY This LCO applies during movement of irradiated fuel assemblies in the spent fuel pool, since the potential for a release of fission products exists.ACTIONS A. 1 Required Action A.1 is modified by a Note indicating that LCO 3.0.3 does not apply.When the initial conditions for prevention of an accident cannot be met, steps should be taken to preclude the accident from occurring.
| |
| When the spent fuel pool water level is lower than the required level, the movement of irradiated fuel assemblies in the spent fuel pool is immediately suspended to a safe position.
| |
| This action effectively precludes the occurrence of a fuel handling accident.
| |
| This does not preclude movement of a fuel assembly to a safe position.If moving irradiated fuel assemblies while in MODE 5 or 6, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODES 1, 2, 3, and 4, the fuel movement is independent of reactor operations.
| |
| Therefore, inability to suspend movement of irradiated fuel assemblies is not sufficient reason to require a reactor shutdown.SURVEILLANCE SR 3.7.13.1 REQUIREMENTS This SR verifies sufficient spent fuel pool water is available in the event of a fuel handling accident.
| |
| The water level in the spent fuel pool must be checked periodically.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.During refueling operations, the level in the spent fuel pool is in equilibrium with the refueling canal, and the level in the refueling canal is checked in accordance with SR 3.9.7.1.McGuire Units 1 and 2 B 3.7.13-2 Revision No. 115 Spent Fuel Pool Water Level B 3.7.13 BASES REFERENCES 1.2.3.4.5.6.UFSAR, Section 9.1.2.UFSAR, Section 9.1.3.UFSAR, Section 15.7.4.Regulatory Guide 1.183, Rev. 0.10 CFR 50.67.10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.7.13-3 Revision No. 115 Spent Fuel Pool Boron Concentration B 3.7.14 B 3.7 PLANT SYSTEMS B 3.7.14 Spent Fuel Pool Boron Concentration BASES BACKGROUND In the two region poison fuel storage rack (References.
| |
| 1 and 2) design, the spent fuel pool is divided into two separate and distinct regions.Region 1, with 286 storage positions, is designed and generally reserved for temporary storage of new or partially irradiated fuel. Region 2, with 1177 storage positions, is designed and generally used for normal, long term storage of permanently discharged fuel that has achieved qualifying burnup levels.The McGuire spent fuel storage racks have been analyzed taking credit for soluble boron as allowed in Reference
| |
| : 3. The methodology ensures that the spent fuel rack multiplication factor, ke,, is less than or equal to 0.95 as recommended in ANSI/ANS-57.2-1983 (Reference
| |
| : 4) and NRC guidance (Reference.
| |
| 5). The spent fuel storage racks are analyzed to allow storage of fuel assemblies with enrichments up to a maximum nominal value of 5.00 weight percent Uranium-235 while maintaining keff<0.95 including uncertainties, tolerances, biases, and credit for soluble boron. Soluble boron credit is used to offset off-normal conditions and to provide subcritical margin such that the spent fuel pool keff is maintained less than or equal to 0.95. The soluble boron concentration required to maintain keff less than or equal to 0.95 under normal conditions is 800 ppm. In addition, sub-criticality of the pool (keff < 1.0) is assured on a 95/95 basis, without the presence of the soluble boron in the pool. The criticality analysis performed shows that the regulatory subcriticality requirements are met for fuel assembly storage within an allowable storage configuration, when the criteria for fuel assembly type, initial enrichment, burnup, and post-irradiation cooling time, as specified in LCO 3.7.15, are, satisfied.
| |
| APPLICABLE SAFETY ANALYSES Most accident conditions do not result in an increase in reactivity of the racks in the spent fuel pool. Examples of these accident conditions are the drop of a fuel assembly on top of a rack, the drop of a fuel assembly between rack modules (rack design precludes this condition), and the drop of a fuel assembly between rack modules and the pool wall.However, three accidents can be postulated which could result in an increase in reactivity in the spent fuel storage pools. The first is a drop or placement of a fuel assembly into the cask loading area. The second is a significant change in the spent fuel pool water temperature (either the loss of normal cooling to the spent fuel pool water which causes an increase in the pool water temperature or a large makeup to the pool with cold water which causes a decrease in the pool water temperature) and McGuire Units 1 and 2 B 3.7.14-1 Revision No. 115 Spent Fuel Pool Boron Concentration B 3.7.14 Bases APPLICABLE SAFETY ANALYSES (continued) the third is the misloading of a fuel assembly into a location which the restrictions on location, enrichment, and burnup are not satisfied.
| |
| For an occurrence of these postulated accidents, the double contingency principle discussed in ANSI N-16.1-1975 and the April 1978 NRC letter (Reference.
| |
| : 6) can be applied. This states that one is not required to assume two unlikely, independent, concurrent events to ensure protection against a criticality accident.
| |
| Thus, for these postulated accident conditions, the presence of additional soluble boron in the spent fuel pool water (above the 800 ppm required to maintain keff less than or equal to 0.95 under normal conditions) can be assumed as a realistic initial condition since not assuming its presence would be a second unlikely event.Calculations were performed to determine the amount of soluble boron required to offset the highest reactivity increase caused by either of these postulated accidents and to maintain keff less than or equal to 0.95.It was determined that a spent fuel pool boron concentration of 1600 ppm was adequate to mitigate these postulated criticality related accidents and to maintain keff less than or equal to 0.95. Specification 3.7.14 ensures the spent fuel pool contains adequate dissolved boron to compensate for the increased reactivity caused by these postulated accidents.
| |
| Specification 4.3.1.1 c. requires that the spent fuel rack keff be less than or equal to 0.95 when flooded with water borated to 800 ppm. A spent fuel pool boron dilution analysis was performed which confirmed that sufficient time is available to detect and mitigate a dilution of the spent fuel pool before the 0.95 keff design basis is exceeded.
| |
| The spent fuel pool boron dilution analysis concluded that an unplanned or inadvertent event which could result in the dilution of the spent fuel pool boron concentration to 800 ppm is not a credible event.The concentration of dissolved boron in the spent fuel pool satisfies Criterion 2 of 10 CFR 50.36 (Reference.
| |
| 5).LCO The spent fuel pool boron concentration is required to be within the limits specified in the COLR. The specified concentration of dissolved boron in the spent fuel pool preserves the assumptions used in the analyses of the potential criticality accident scenarios as described in Reference
| |
| : 4. This concentration of dissolved boron is the minimum required concentration for fuel assembly storage and movement within the spent fuel pool.McGuire Units 1 and 2 B 3.7.14-2 Revision No. 115 McGuire Units 1 and 2 B 3.7.14-2 Revision No. 115 Spent Fuel Pool Boron Concentration B 3.7.14 Bases APPLICABILITY This LCO applies whenever fuel assemblies are stored in the spent fuel pool.ACTIONS A.1 and A.2 The Required Actions are modified by a Note indicating that LCO 3.0.3 does not apply.When the concentration of boron in the fuel storage pool is less than required, immediate action must be taken to preclude the occurrence of an accident or to mitigate the consequences of an accident in progress.This is most efficiently achieved by immediately suspending the movement of fuel assemblies.
| |
| The concentration of boron is restored simultaneously with suspending movement of fuel assemblies.
| |
| If the LCO is not met while moving irradiated fuel assemblies in MODE 5 or 6, LCO 3.0.3 would not be applicable.
| |
| If moving irradiated fuel assemblies while in MODE 1, 2, 3, or 4, the fuel movement is independent of reactor operation.
| |
| Therefore, inability to suspend movement of fuel assemblies is not sufficient reason to require a reactor shutdown.SURVEILLANCE SR 3.7.14.1 REQUIREMENTS This SR verifies that the concentration of boron in the spent fuel pool is within the required limit. As long as this SR is met, the analyzed accidents are fully addressed.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Units 1 and 2 B 3.7.14-3 Revision No. 115 McGuire Units 1 and 2 B 3.7.14-3 Revision No. 115 Spent Fuel Pool Boron Concentration B 3.7.14 Bases REFERENCES
| |
| : 1. UFSAR, Section 9.1.2.2. Issuance of Amendments, McGuire Nuclear Station, Units 1 and 2 (TAC NOS. MC0945 and MC0946), March 17, 2005.3. 10 CFR 50.68, "Criticality Accident Requirements" 4. American Nuclear Society, "American National Standard Design Requirements for Light Water Reactor Fuel Storage Facilities at Nuclear Power Plants," ANSI/ANS-57.2-1983, October 7, 1983.5. Nuclear Regulatory Commission, Memorandum to Timothy Collins from Laurence Kopp, "Guidance on the Regulatory Requirements for Criticality Analysis of Fuel Storage at Light Water Reactor Power Plants," August 19, 1998.6. Double contingency principle of ANSI N16.1-1975, as specified in the April 14, 1978 NRC letter (Section 1.2) and implied in the proposed revision to Regulatory Guide 1.13 (Section 1.4, Appendix A).7. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| : 8. UFSAR, Section 15.7.4.MoGuire Units 1 and 2 B 3.7.14-4 Revision No. 115 McGuire Units 1 and 2 B 3.7.14-4 Revision No. 115 Spent Fuel Assembly Storage B 3.7.15 B 3.7 PLANT SYSTEMS B 3.7.15 Spent Fuel Assembly Storage BASES BACKGROUND In the two region poison fuel storage rack (Refs. 1 and 2) design, the spent fuel pool is divided into two separate and distinct regions.Region 1, with 286 storage positions, is designed and generally reserved for temporary storage of new or partially irradiated fuel. Region 2, with 1177 storage positions, is designed and generally used for normal, long term storage of permanently discharged fuel that has achieved qualifying burnup levels.The McGuire Region 1 spent fuel storage racks are composed of individual cells made of stainless steel. These racks utilize Boral, a boron carbide aluminum cermet, as the neutron absorber material.
| |
| The cells within a module are interconnected at six locations along the length of the cell using spacer plates to form an integral structure.
| |
| Depending on the criticality requirements, some cells have a Boral wrapper on all four sides, some on three sides and some on two sides. The Region 1 racks will store the most reactive fuel (up to 5.00 weight percent Uranium-235 enrichment) without any burnup limitations.
| |
| Boral is a thermal neutron poison material composed of boron carbide and 1100 alloy aluminum.
| |
| Boron carbide is a compound having a high boron content in a physical stable and chemically inert form. The 1100 alloy aluminum is a lightweight metal with high tensile strength, which is protected from corrosion by a highly resistant oxide film. Boron carbide and aluminum are chemically compatible and ideally suited for long-term use in a spent fuel pool environment.
| |
| The McGuire Region 2 spent fuel storage racks contain Boraflex neutron-absorbing panels that surround each storage cell on all four sides (except for peripheral sides). It has been observed that after Boraflex receives a high gamma dose from the stored irradiated fuel (>1010 rads) it can begin to degrade and dissolve in the wet environment.
| |
| Thus, the B4C poison material can be removed, thereby reducing the poison worth of the Boraflex sheets. This phenomenon is documented in NRC Generic Letter 96-04, "Boraflex Degradation in Spent Fuel Pool Storage Racks".To address this degradation, the McGuire spent fuel storage racks (both Regions) have been analyzed taking credit for soluble boron as allowed in Reference
| |
| : 3. The methodology ensures that the spent fuel rack multiplication factor, keff, is less than or equal to 0.95 as recommended in ANSI/ANS-57.2-1983 (Ref. 4) and NRC guidance (Ref. 5). The spent fuel storage racks are analyzed to allow storage of fuel assemblies with enrichments up to a maximum nominal enrichment of 5.00 weight percent Uranium-235 while maintaining kef < 0.95 including uncertainties, McGuire Units 1 and 2 B 3.7.15-1 Revision No.66 Spent Fuel Assembly Storage B 3.7.15 BASES BACKGROUND (continued) tolerances, biases, and credit for soluble boron. Soluble boron credit is used to offset off-normal conditions and to provide subcritical margin such that the spent fuel pool keff is maintained less than or equal to 0.95.The soluble boron concentration required to maintain kI, less than or equal to 0.95 under normal conditions is at least 800 ppm. In addition, sub-criticality of the pool (keff < 1.0) is assured on a 95/95 basis, without the presence of the soluble boron in the pool. The criticality analysis performed for Region 2 shows that the regulatory subcriticality requirements are met for fuel assembly storage within an allowable storage configuration, when the criteria for fuel assembly type, initial enrichment, burnup, and post-irradiation cooling time, as specified in LCO 3.7.15, are satisfied.
| |
| No credit is taken for the Boraflex neutron absorber panels in Region 2. The criticality analysis performed for Region 1 shows that the acceptance criteria for subcriticality are met for unrestricted storage of unirradiated fuel assemblies with enrichments up to a maximum nominal value of 5.00 weight percent Uranium-235.
| |
| The storage criteria for fuel stored in Region 2 of the spent fuel pool is based upon criticality analysis that was performed in accordance with the criteria of 10 CFR 50.68(b).
| |
| The fuel storage requirements are defined as a function of enrichment, burnup, cooling time and fuel type. The following are the fuel types considered in the criticality analyses: MkBI -This generic fuel type represents the old Oconee 15x1 5 MkB2, MkB3, and MkB4 fuel assembly designs, which used Inconel spacer grids in the active fuel area. 300 of these assemblies, which operated in the Oconee reactors, were transshipped to McGuire.W-STD -This is the standard 17x1 7 Westinghouse fuel design which was used in the initial cycles (batches 1-3) of both the McGuire reactors.At that time the W-STD design had Inconel grids.W-OFA -This is the 17x1 7 Westinghouse "Optimized Fuel Assembly" design, which had thin rods, Zircaloy grids, and a low total uranium loading. This design was deployed for batches 4 through 9 in both McGuire units.MkBW -This is the standard 17x1 7 Framatome (B&W) fuel design which was modeled after the standard Westinghouse prodpuct.
| |
| The MkBW design contains Zircaloy grids. This fuel type (without axial blankets) was used for batches 10 through 13 in both McGuire reactors.MkBWbl -This is the same design as the standard MkBW, but it employs solid, 6-inch, 2.00 wt % U-235 axial blankets at the top and bottom of the active fuel zone. This fuel type was used in McGuire Unit 1, batches 14 to 16, and McGuire Unit 2, batch 14.McGuire Units 1 and 2 B 3.7.15-2 Revision No.66 Spent Fuel Assembly Storage B 3.7.15 BASES MkBWb2 --This is also the same design as the standard MkBW, but it employs solid, 6-inch, 2.60 wt % U-235 axial blankets at the top and bottom of the active fuel zone. This fuel type was used in McGuire Unit 2, batch 15.W-RFA- This is the advanced 17x17 Westinghouse fuel design. It is similar to the MkBW assembly design, and contains Zircaloy grids, but uses annular, 6-inch, 2.60 wt % U-235 axial blankets at the top and bottom of the active fuel zone. This fuel type has been chosen for McGuire Unit 1, batches 17 to present, and McGuire Unit 2, batches 16 to present." APPLICABLE Most accident conditions do not result in an increase in reactivity of the SAFETY ANALYSES racks in the spent fuel pool. Examples of these accident conditions are the drop of a fuel assembly on top of a rack, the drop of a fuel assembly between rack modules (rack design precludes this condition), and the drop of a fuel assembly between rack modules and the pool wall.However, three accidents can be postulated which could result in an increase in reactivity in the spent fuel storage pools. The first is a drop or placement of a fuel assembly into the cask loading area. The second is a significant change in the spent fuel pool water temperature (either the loss of normal cooling to the spent fuel pool water which causes an increase in the pool water temperature or a large makeup to the pool with cold water which causes a decrease in the pool water temperature) and the third is the misloading of a fuel assembly into a location which the restrictions on location, enrichment, burnup and decay time is not met.For an occurrence of these postulated accidents, the double contingency principle discussed in ANSI N-16.1-1975 and the April 1978 NRC letter (Ref. 6) can be applied. This states that one is not required to assume two unlikely, independent, concurrent events to ensure protection against a criticality accident.
| |
| Thus, for these postulated accident conditions, the presence of additional soluble boron in the spent fuel pool water (above 800 ppm required to maintain kef less than or equal to 0.95 under normal conditions) can be assumed as a realistic initial condition since not assuming its presence would be a second unlikely event.Calculations were performed to determine the amount of soluble boron required to offset the highest reactivity increase caused by either of these postulated accidents and to maintain keff less than or equal to 0.95. It was found that a spent fuel pool boron concentration of 1600 ppm was McGuire Units 1 and 2 B 3.7.15-3 Revision No.66 McGuire Units 1 and 2 B 3.7.15-3 Revision No.66 Spent Fuel Assembly Storage B 3.7.15 BASES APPLICABLE SAFETY ANALYSES (continued) adequate to mitigate these postulated criticality related accidents and to maintain keff less than or equal to 0.95. Specification 3.7.14 ensures the spent fuel pool contains adequate dissolved boron to compensate for the increased reactivity caused by these postulated accidents.
| |
| Specification 4.3.1.1 c. requires that the spent fuel rack kI be less than or equal to 0.95 when flooded with water borated to 800 ppm. A spent fuel pool boron dilution analysis was performed which confirmed that sufficient time is available to detect and mitigate a dilution of the spent fuel pool before the 0.95 ken design basis is exceeded.
| |
| The spent fuel pool boron dilution analysis concluded that an unplanned or inadvertent event which could result in the dilution of the spent fuel pool boron concentration to 800 ppm is not a credible event.The configuration of fuel assemblies in the spent fuel pool satisfies Criterion 2 of 10 CFR 50.36 (Ref. 7).LCO a Unrestricted storage of fuel assemblies within Region 1 of the spent fuel pool is allowed provided that the maximum nominal Uranium-235 enrichment is equal to or less than 5.00 weight percent. This ensures the keff of the spent fuel pool will always remain < 0.95, assuming the pool is flooded with water borated to 800 ppm.b The restrictions on the placement of fuel assemblies within Region 2 of the spent fuel pool, which have accumulated burnup greater than or equal to the minimum qualified burnups and which have decayed greater than or equal to the minimum qualified cooling time in Table 3.7.15-1 in the accompanying LCO, ensures the keff of the spent fuel pool will always remain < 0.95, assuming the pool to be flooded with water borated to 800 ppm. Fuel assemblies not meeting the criteria of Table 3.7.15-1 may be stored in accordance with Figure 3.7.15-1 per the initial enrichment, burnup and decay time criteria specified by Tables 3.7.15-2 and 3.7.15-3 for restricted/filler storage configuration.
| |
| Another acceptable storage configuration is described by Figure 3.7.15-2 for fuel assemblies that satisfy the initial enrichment, burnup and decay time criteria specified in Table 3.7.15-4 for Checkerboard storage.APPLICABILITY This LCO applies whenever any fuel assembly is stored in the spent fuel pool.McGuire Units 1 and 2 B 3.7.15-4 Revision No.66 McGuire Units 1 and 2 B 3.7.15-4 Revision No.66 Spent Fuel Assembly Storage B 3.7.15 BASES ACTIONS A.1 Required Action A.1 is modified by a Note indicating that LCO 3.0.3 does not apply.When the configuration of fuel assemblies stored in the spent fuel pool is not in accordance with the LCO, the immediate action is to initiate action to make the necessary fuel assembly movement(s) to bring the configuration into compliance.
| |
| If unable to move irradiated fuel assemblies while in MODE 5 or 6, LCO 3.0.3 would not be applicable.
| |
| If unable to move irradiated fuel assemblies while in MODE 1, 2, 3, or 4, the action is independent of reactor operation.
| |
| Therefore, inability to move fuel assemblies is not sufficient reason to require a reactor shutdown.SURVEILLANCE SR 3.7.15.1 REQUIREMENTS This SR verifies by administrative means that the fuel assembly is in accordance with the configurations specified in the accompanying LCO.REFERENCES
| |
| : 1. UFSAR, Section 9.1.2.2. Issuance of Amendments, McGuire Nuclear Station, Units 1 and 2 (TAC NOS. MC0945 and MC0946), March 17, 2005.3. 10 CFR 50.68, "Criticality Accident Requirements".
| |
| : 4. American Nuclear Society, "American National Standard Design Requirements for Light Water Reactor Fuel Storage Facilities at Nuclear Power Plants," ANSI/ANS-57.2-1983, October 7, 1983.5. Nuclear Regulatory Commission, Memorandum to Timothy Collins from Laurence Kopp, "Guidance on the Regulatory Requirements for Criticality Analysis of Fuel Storage at Light Water Reactor Power Plants," August 19, 1998.6. Double contingency principle of ANSI N16.1-1975, as specified in the April 14, 1978 NRC letter (Section 1.2) and implied in the proposed revision to Regulatory Guide 1.13 (Section 1.4, Appendix A).7. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.7.15-5 Revision No.66 Secondary Specific Activity B 3.7.16 B 3.7 PLANT SYSTEMS B 3.7.16 Secondary Specific Activity BASES BACKGROUND Activity in the secondary coolant results from steam generator tube outleakage from the Reactor Coolant System (RCS). Under steady state conditions, the activity is primarily iodines with relatively short half lives and, thus, indicates current conditions.
| |
| During transients, 1-131 spikes have been observed as well as increased releases of some noble gases. Fission product isotopes and activated corrosion products in lesser amounts may also be found in the secondary coolant when steam generator tube leakage occurs.A limit on secondary coolant specific activity during power operation minimizes releases to the environment because of normal operation, anticipated operational occurrences, and accidents.
| |
| The steam line failure is assumed to result in the release of the noble gas and iodine activity contained in the steam generator inventory, the feedwater, and the reactor coolant LEAKAGE. Most of the iodine isotopes have short half lives, (i.e., < 20 hours). 1-131, with a half life of 8.04 days, concentrates faster than it decays, but does not reach equilibrium because of blowdown and other losses.Operating a unit at the allowable limits will result in a 2 hour EAB exposure of less than a small fraction of the 10 CFR 100 (Ref. 1)limits.APPLICABLE SAFETY ANALYSES The accident analysis of the main steam line break (MSLB), as discussed in the UFSAR, Chapter 15 (Ref. 2) assumes the initial secondary coolant specific activity to have a radioactive isotope concentration of 0.10 pCi/gm DOSE EQUIVALENT 1-131. This assumption is used in the analysis for determining the radiological consequences of the postulated accident.
| |
| The accident analysis, based on this and other assumptions, shows that the radiological consequences of an MSLB do not exceed a small fraction of the unit EAB limits (Ref. 1) for whole body and thyroid dose rates.With the loss of offsite power, the remaining steam generators are available for core decay heat dissipation by venting steam to the atmosphere through the MSSVs and steam generator power operated relief valves (SG PORVs). The Auxiliary Feedwater McGuire Units 1 and 2 B 3.7.16-1 Revision No. 115 Secondary Specific Activity B 3.7.1.6 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| System supplies the necessary makeup to the steam generators.
| |
| Venting continues until the reactor coolant temperature and pressure have decreased sufficiently for the Residual Heat Removal System to complete the cooldown.In the evaluation of the radiological consequences of this accident, the activity released from the steam generator connected to the failed steam line is assumed to be released directly to the environment.
| |
| The unaffected steam generator is assumed to discharge steam and any entrained activity through the MSSVs and SG PORVs during the event. Since no credit is taken in the analysis for activity plateout or retention, the resultant radiological consequences represent a conservative estimate of the potential integrated dose due to the postulated steam line failure.Secondary specific activity limits satisfy Criterion 2 of 10 CFR 50.36 (Ref. 3).LCO As indicated in the Applicable Safety Analyses, the specific activity of the secondary coolant is required to be < 0.10 pCi/gm DOSE EQUIVALENT 1-131 to limit the radiological consequences of a Design Basis Accident (DBA) to a small fraction of the required limit (Ref. 1).Monitoring the specific activity of the secondary coolant ensures that when secondary specific activity limits are exceeded, appropriate actions are taken in a timely manner to place the unit in an operational MODE that would minimize the radiological consequences of a DBA.APPLICABILITY In MODES 1, 2, 3, and 4, the limits on secondary specific activity apply due to the potential for secondary steam releases to the atmosphere.
| |
| In MODES 5 and 6, the steam generators are not being used for heat removal. Both the RCS and steam generators are depressurized, and primary to secondary LEAKAGE is minimal. Therefore, monitoring of secondary specific activity is not required.McGuire Units 1 and 2 B 3.7.16-2 Revision No. 115 Secondary Specific Activity B 3.7.1.6 BASES ACTIONS A.1 and A.2 DOSE EQUIVALENT 1-131 exceeding the allowable value in the secondary coolant, is an indication of a problem in the RCS and contributes to increased post accident doses. If the secondary specific activity cannot be restored to within limits within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours, and in MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.SURVEILLANCE SR 3.7.16.1 REQUIREMENTS This SR verifies that the secondary specific activity is within the limits of the accident analysis.
| |
| A gamma isotopic analysis of the secondary coolant, which determines DOSE EQUIVALENT 1-131, confirms the validity of the safety analysis assumptions as to the source terms in post accident releases.
| |
| It also serves to identify and trend any unusual isotopic concentrations that might indicate changes in reactor coolant activity or LEAKAGE. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. 10 CFR 100.11.2. UFSAR, Section 15.1.5.3. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.7.16-3 Revision No. 115
| |
| | |
| AC Sources-Operating B 3.8.1 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.1 AC Sources-Operating BASES BACKGROUND The unit Essential Auxiliary or Class 1 E AC Electrical Power Distribution System AC sources consist of the offsite power sources (preferred power sources, normal and alternate(s)), and the onsite standby power sources (Train A and Train B diesel generators (DGs)). As required by 10 CFR 50, Appendix A, GDC 17 (Ref. 1), the design of the AC electrical power system provides independence and redundancy to ensure an available source of power to the Engineered Safety Feature (ESF) systems.The onsite Class 1 E AC Distribution System is divided into redundant load groups (trains) so that the loss of any one group does not prevent the minimum safety functions from being performed.
| |
| Each train has connections to two preferred offsite power sources and a single DG.Offsite power is supplied to the unit switchyard(s) from the transmission network by two transmission lines. From the switchyard(s), two electrically and physically separated circuits provide AC power, through step down station auxiliary transformers, to the 4.16 kV ESF buses. A detailed description of the offsite power network and the circuits to the Class 1 E ESF buses is found in the UFSAR, Chapter 8 (Ref. 2).A qualified offsite circuit consists of all breakers, transformers, switches, interrupting devices, cabling, and controls required to transmit power from the offsite transmission network to the onsite Class 1 E ESF bus(es).The offsite transmission systems normally supply their respective unit's onsite power supply requirements.
| |
| However, in the event that one or both buslines of a unit become unavailable, or by operational desire, it is acceptable to supply that unit's offsite to onsite power requirements by aligning the affected 4160V bus of the opposite unit via the standby transformers, SATA and SATB in accordance with Regulatory Guides 1.6 and 1.81 (Ref. 12 and 13). In this alignment, each unit's offsite transmission system could simultaneously supply its own 4160V buses and one (or both) of the buses of the other unit.Although a single auxiliary transformer (1ATA, 1ATB, 2ATA, 2ATB) is sized to carry all of the auxiliary loads of its unit plus both trains of essential 4160V loads of the opposite unit, the LCO would not be met in this alignment due to separation criteria.McGuire Units 1 and 2 B 3.8. 1-1 Revision No. 115 AC Sources-Operating B 3.8.1 BASES BACKGROUND (continued)
| |
| Each unit's Train A and B 4160V bus must be derived from separate offsite buslines.
| |
| The first offsite power supply can be derived from any of the four buslines (1A, I B, 2A, or 2B). The second offsite power supply must not derive its power from the same busline as the first.Acceptable train and unit specific breaker alignment options are described below: Unit 1 A Train 1. BL1A-1ATA-1TA-1ATC-1 ETA 2. BL1B-1ATB-ITA-1ATC-1ETA
| |
| : 3. BL1A-1ATA-ITC-SATA-1 ETA 4. BLI B-1ATB-1TC-SATA-1 ETA 5. BL2A-2ATA-2TC-SATA-1 ETA 6. BL2B-2ATB-2TC-SATA-1 ETA Unit 1 B Train 1. BL1B-1ATB-1TD-1ATD-1ETB
| |
| : 2. BL1A-1ATA-1TD-1ATD-1ETB
| |
| : 3. BLIB-1ATB-1TB-SATB-1 ETB 4. BL1A-1ATA-1TB-SATB-1 ETB 5. BL2B-2ATB-2TB-SATB-1 ETB 6. BL2A-2ATA-2TB-SATB-1 ETB Unit 2 A Train 1. BL2A-2ATA-2TA-2ATC-2ETA
| |
| : 2. BL2B-2ATB-2TA-2ATC-2ETA
| |
| : 3. BL2A-2ATA-2TC-SATA-2ETA
| |
| : 4. BL2B-2ATB-2TC-SATA-2ETA
| |
| : 5. BL1A-1ATA-1TC-SATA-2ETA
| |
| : 6. BLI B-IATB-1TC-SATA-2ETA Unit 2 B Train 1. BL2B-2ATB-2TD-2ATD-2ETB
| |
| : 2. BL2A-2ATA-2TD-2ATD-2ETB
| |
| : 3. BL2B-2ATB-2TB-SATB-2ETB
| |
| : 4. BL2A-2ATA-2TB-SATB-2ETB
| |
| : 5. BL1 B-1ATB-1TB-SATB-2ETB
| |
| : 6. BL1A-i ATA-lTB-SATB-2ETB McGuire Units 1 and 2 B 3.8.1-2 Revision No. 115 AC Sources-Operating B 3.8.1 BASES BACKGROUND (continued)
| |
| Certain required unit loads are returned to service in a predetermined sequence in order to prevent overloading the transformer supplying offsite power to the onsite Class 1 E Distribution System. Typically (via accelerated sequencing), within 1 minute after the initiating signal is received, all loads needed to recover the unit or maintain it in a safe condition are returned to service.The onsite standby power source for each 4.16 kV ESF bus is a dedicated DG. DGs A and B are dedicated to ESF buses ETA and ETB, respectively.
| |
| A DG starts automatically on a safety injection (SI) signal (i.e., low pressurizer pressure or high containment pressure signals) or on an ESF bus degraded voltage or undervoltage signal (refer to LCO 3.3.5, "Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation").
| |
| After the DG has started, it will automatically tie to its respective bus after offsite power is tripped as a consequence of ESF bus undervoltage or degraded voltage, independent of or coincident with an SI signal. The DGs will also start and operate in the standby mode without tying to the ESF bus on an SI signal alone. Following the trip of offsite power, a sequencer strips loads from the ESF bus. When the DG is tied to the ESF bus, loads are then sequentially connected to its respective ESF bus by the automatic load sequencer.
| |
| The sequencing logic controls the permissive and starting signals to motor breakers to prevent overloading the DG by automatic load application.
| |
| In the event of a loss of preferred power, the ESF electrical loads are automatically connected to the DGs in sufficient time to provide for safe reactor shutdown and to mitigate the consequences of a Design Basis Accident (DBA) such as a loss of coolant accident (LOCA).Certain required unit loads are returned to service in a predetermined sequence in order to prevent overloading the DG in the process.Typically (via accelerated sequencing), within 1 minute after the initiating signal is received, all loads needed to recover the unit or maintain it in a safe condition are returned to service.Ratings for Train A and Train B DGs satisfy the requirements of Regulatory Guide 1.9 (Ref. 3). The continuous service rating of each DG is 4000 kW with 10% overload permissible for up to 2 hours in any 24 hour period. The ESF loads that are powered from the 4.16 kV ESF buses are listed in Reference 2.APPLICABLE The initial conditions of DBA and transient analyses in the UFSAR, SAFETY ANALYSES Chapter 6 (Ref. 4) and Chapter 15 (Ref. 5), assume ESF systems are OPERABLE.
| |
| The AC electrical power sources are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor McGuire Units 1 and 2 B 3.8.1-3 Revision No. 115 AC Sources-Operating B 3.8.1 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| Coolant System (RCS), and containment design limits are not exceeded.These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution Limits; Section 3.4, Reactor Coolant System (RCS);and Section 3.6, Containment Systems.The OPERABILITY of the AC electrical power sources is consistent with the initial assumptions of the Accident analyses and is based upon meeting the design basis of the unit. This results in maintaining at least one train of the onsite or offsite AC sources OPERABLE during Accident conditions in the event of: a. An assumed loss of all offsite power or all onsite AC power; and b. A worst case single failure.The AC sources satisfy Criterion 3 of 10 CFR 50.36 (Ref. 6).LCO Two qualified circuits between the offsite transmission network and the onsite Class 1 E Electrical Power System and separate and independent DGs for each train ensure availability of the required power to shut down the reactor and maintain it in a safe shutdown condition after an anticipated operational occurrence (AOO) or a postulated DBA.Qualified offsite circuits are those that are described in the UFSAR and are part of the licensing basis for the unit.In addition, one required automatic load sequencer per train must be OPERABLE.Each offsite circuit must be capable of maintaining rated frequency and voltage, and accepting required loads during an accident, while connected to the ESF buses.The 4.16 kV essential system is divided into two completely redundant and independent trains designated A and B, each consisting of one 4.16 kV switchgear assembly, two 4.16 kV/600 V load centers, and associated loads.Normally, each Class 1 E 4.16 kV switchgear is powered from its associated non-Class 1 E train of the 6.9 kV Normal Auxiliary Power System as discussed in "6.9 kV Normal Auxiliary Power System" in Chapter 8 of the UFSAR (Ref. 2). Additionally, an alternate source of power to each 4.16 kV essential switchgear is provided from the 6.9 kV system via a separate and independent 6.9/4.16 kV transformer.
| |
| Two transformers are shared between units and provide the capability to supply an alternate source of power to each unit's 4.16 kV essential McGuire Units 1 and 2 B 3.8.1-4 Revision No. 115 AC Sources-Operating B 3.8.1 BASES LCO (continued) switchgear from either unit's 6.9 kV system. A key interlock scheme is provided to preclude the possibility of connecting the two units together at either the 6.9 or 4.16 kV level.Each train of the 4.16 kV Essential Auxiliary Power System is also provided with a separate and independent emergency diesel generator to supply the Class 1 E loads required to safely shut down the unit following a design basis accident.Each DG must be capable of starting, accelerating to rated speed and voltage, and connecting to its respective ESF bus on detection of bus undervoltage.
| |
| This will be accomplished within 11 seconds. Each DG must also be capable of accepting required loads within the assumed loading sequence intervals, and continue to operate until offsite power can be restored to the ESF buses. These capabilities are required to be met from a variety of initial conditions such as DG in standby with the engine hot and DG in standby with the engine at ambient conditions.
| |
| Additional DG capabilities must be demonstrated to meet required Surveillance, e.g., capability of the DG to revert to standby status on an ECCS signal while operating in parallel test mode.Proper sequencing of loads is a function of Sequencer OPERABILITY.
| |
| Proper load shedding is a function of DG OPERABILITY.
| |
| Proper tripping of non-essential loads is a function of AC Bus OPERABILITY (Condition A of Technical Specification 3.8.9).The AC sources in one train must be separate and independent (to the extent possible) of the AC sources in the other train. For the DGs, separation and independence are complete.Both normal and emergency power must be OPERABLE for a shared component to be OPERABLE.
| |
| If normal or emergency power supplying a shared component becomes inoperable, then the Required Actions of the affected shared component LCO must be entered independently for each unit that is in the MODE of applicability of the shared component LCO.The shared component LCOs are: 3.7.7 -Nuclear Service Water System (NSWS), 3.7.9 -Control Room Area Ventilation System (CRAVS), 3.7.10 -Control Room Area Chilled Water System (CRACWS), and 3.7.11 -Auxiliary Building Filtered Ventilation Exhaust System (ABFVES).McGuire Units 1 and 2 B 3.8.1-5 Revision No. 115 AC Sources-Operating B 3.8.1 BASES APPLICABILITY The AC sources and sequencers are required to be OPERABLE in MODES 1, 2, 3, and 4 to ensure that: a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients; and b. Adequate core cooling is provided and containment OPERABILITY and other vital functions are maintained in the event of a postulated DBA.The AC power requirements for MODES 5 and 6 are covered in LCO 3.8.2, "AC Sources-Shutdown." ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable DG.There is an increased risk associated with entering a MODE or other specified condition in the Applicability with an inoperable DG and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.
| |
| A.1 To ensure a highly reliable power source remains with one offsite circuit inoperable, it is necessary to verify the OPERABILITY of the remaining required offsite circuit on a more frequent basis. Since the Required Action only specifies "perform," a failure of SR 3.8.1.1 acceptance criteria does not result in a Required Action not met. However, if a second required circuit fails SR 3.8.1.1, the second offsite circuit is inoperable, and Condition C, for two offsite circuits inoperable, is entered.A.2 Required Action A.2, which only applies if the train cannot be powered from an offsite source, is intended to provide assurance that an event coincident with a single failure of the associated DG will not result in a complete loss of safety function of critical redundant required features.
| |
| These features are powered from the redundant AC electrical power train. This includes motor driven auxiliary feedwater pumps. The turbine driven auxiliary feedwater pump is required to be considered a redundant required feature, and, therefore, required to be determined OPERABLE by this Required Action. Three independent AFW pumps are required to ensure the McGuire Units 1 and 2 B83.8.1-6 Revision No. 115 AC Sources-Operating B 3.8.1 BASES ACTIONS (continued) availability of decay heat removal capability for all events accompanied by a loss of offsite power and a single failure. System design is such that the remaining OPERABLE motor driven auxiliary feedwater pump is not by itself capable of providing 100% of the auxiliary feedwater flow assumed in the safety analysis.The Completion Time for Required Action A.2 is intended to allow the operator time to evaluate and repair any discovered inoperabilities.
| |
| This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." In this Required Action, the Completion Time only begins on discovery that both: a. The train has no offsite power supplying its loads; and b. A required feature on the other train is inoperable.
| |
| If at any time during the existence of Condition A (one offsite circuit inoperable) a redundant required feature subsequently becomes inoperable, this Completion Time begins to be tracked.Discovering no offsite power to one train of the onsite Class 1 E Electrical Power Distribution System coincident with one or more inoperable required support or supported features, or both, that are associated with the other train that has offsite power, results in starting the Completion Times for the Required Action. Twenty-four hours is acceptable because it minimizes risk while allowing time for restoration before subjecting the unit to transients associated with shutdown.The remaining OPERABLE offsite circuit and DGs are adequate to supply electrical power to Train A and Train B of the onsite Class 1 E Distribution System. The 24 hour Completion Time takes into account the component OPERABILITY of the redundant counterpart to the inoperable required feature. Additionally, the 24 hour Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.A.3 According to Regulatory Guide 1.93 (Ref. 7), operation may continue in Condition A for a period that should not exceed 72 hours. With one offsite circuit inoperable, the reliability of the offsite system is degraded, and the potential for a loss of offsite power is increased, with attendant potential for a challenge to the unit safety systems. In this Condition, however, the remaining OPERABLE offsite circuit and DGs are adequate to supply electrical power to the onsite Class 1 E Distribution System.McGuire Units I and 2 B 3.8.1-7 Revision No. 115 AC Sources-Operating B 3.8.1 BASES ACTIONS (continued)
| |
| The 72 hour Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.The second Completion Time for Required Action A.3 establishes a limit on the maximum time allowed for any combination of required AC power sources to be inoperable during any single contiguous occurrence of failing to meet the LCO. If Condition A is entered while, for instance, a DG is inoperable and that DG is subsequently returned OPERABLE, the LCO may already have been not met for up to 72 hours. This could lead to a total of 144 hours, since initial failure to meet the LCO, to restore the offsite circuit. At this time, a DG could again become inoperable, the circuit restored OPERABLE, and an additional 72 hours (for a total of 9 days) allowed prior to complete restoration of the LCO. The 6 day Completion Time provides a limit on the time allowed in a specified condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which Conditions A and B are entered concurrently.
| |
| The "AND" connector between the 72 hour and 6 day Completion Times means that both Completion Times apply simultaneously, and the more restrictive Completion Time must be met.As in Required Action A.2, the Completion Time allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." This will result in establishing the "time zero" at the time that the LCO was initially not met, instead of at the time Condition A was entered.B.1 To ensure a highly reliable power source remains with an inoperable DG, it is necessary to verify the availability of the offsite circuits on a more frequent basis. Since the Required Action only specifies "perform," a failure of SR 3.8.1.1 acceptance criteria does not result in a Required Action being not met. However, if a circuit fails to pass SR 3.8.1.1, it is inoperable.
| |
| Upon offsite circuit inoperability, additional Conditions and Required Actions must then be entered.B.2 Required Action B.2 is intended to provide assurance that a loss of offsite power, during the period that a DG is inoperable, does not result in a complete loss of safety function of critical systems. These features are designed with redundant safety related trains. This includes motor driven auxiliary feedwater pumps. The turbine driven auxiliary feedwater pump is required to be considered a redundant required feature, and, therefore, required to be determined OPERABLE by this Required Action. Three McGuire Units 1 and 2 B 3.8.1-8 Revision No. 115 AC Sources-Operating B 3.8.1 BASES ACTIONS (continued) independent AFW pumps are required to ensure the availability of decay heat removal capability for all events accompanied by a loss of offsite power and a single failure. System design is such that the remaining OPERABLE motor driven auxiliary feedwater pump is not by itself capable of providing 100% of the auxiliary feedwater flow assumed in the safety analysis.
| |
| Redundant required feature failures consist of inoperable features associated with a train, redundant to the train that has an inoperable DG.The Completion Time for Required Action B.2 is intended to allow the operator time to evaluate and repair any discovered inoperabilities.
| |
| This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." In this Required Action, the Completion Time only begins on discovery that both: a. An inoperable DG exists; and b. A required feature on the other train (Train A or Train B) is inoperable.
| |
| If at any time during the existence of this Condition (one DG inoperable) a required feature subsequently becomes inoperable, this Completion Time would begin to be tracked.Discovering one required DG inoperable coincident with one or more inoperable required support or supported features, or both, that are associated with the OPERABLE DG, results in starting the Completion Time for the Required Action. Four hours from the discovery of these events existing concurrently is Acceptable because it minimizes risk while allowing time for restoration before subjecting the unit to transients associated with shutdown.In this Condition, the remaining OPERABLE DG and offsite circuits are adequate to supply electrical power to the onsite Class 1 E Distribution System. Thus, on a component basis, single failure protection for the required feature's function may have been lost; however, function has not been lost. The 4 hour Completion Time takes into account the OPERABILITY of the redundant counterpart to the inoperable required feature. Additionally, the 4 hour Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.McGuire Units 1 and 2 B 3.8.1-9 Revision No. 115 AC Sources-Operating B 3.8.1 BASES ACTIONS (continued)
| |
| B.3.1 and B.3.2 Required Action B.3.1 provides an allowance to avoid unnecessary testing of OPERABLE DG(s). If it can be determined that the cause of the inoperable DG does not exist on the OPERABLE DG, SR 3.8.1.2 does not have to be performed.
| |
| If the cause of inoperability exists on other DG(s), the other DG(s) would be declared inoperable upon discovery and Condition E of LCO 3.8.1 would be entered. Once the failure is repaired, the common cause failure no longer exists, and Required Action B.3.1 is satisfied.
| |
| If the cause of the initial inoperable DG cannot be confirmed not to exist on the remaining DG(s), performance of SR 3.8.1.2 suffices to provide assurance of continued OPERABILITY of that DG.In the event the inoperable DG is restored to OPERABLE status prior to completing either B.3.1 or B.3.2, the problem investigation process will continue to evaluate the common cause possibility.
| |
| This continued evaluation, however, is no longer under the 24 hour constraint imposed while in Condition B.These Conditions are not required to be entered if the inoperability of the DG is due to an inoperable support system, an independently testable component, or preplanned testing or maintenance.
| |
| If required, these Required Actions are to be completed regardless of when the inoperable DG is restored to OPERABLE status.According to Generic Letter 84-15 (Ref. 8), 24 hours is reasonable to confirm that the OPERABLE DG(s) is not affected by the same problem as the inoperable DG.B.4 According to Regulatory Guide 1.93 (Ref. 7), operation may continue in Condition B for a period that should not exceed 72 hours.In Condition B, the remaining OPERABLE DG and offsite circuits are adequate to supply electrical power to the onsite Class 1 E Distribution System. The 72 hour Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.The second Completion Time for Required Action B.4 establishes a limit on the maximum time allowed for any combination of required AC power sources to be inoperable during any single contiguous occurrence of failing to meet the LCO. If Condition B is entered while, for instance, an offsite circuit is inoperable and that circuit is subsequently restored McGuire Units 1 and 2 B 3.8.1-10 Revision No. 115 AC Sources-Operating B 3.8.1 BASES ACTIONS (continued)
| |
| OPERABLE, the LCO may already have been not met for up to 72 hours.This could lead to a total of 144 hours, since initial failure to meet the LCO, to restore the DG. At this time, an offsite circuit could again become inoperable, the DG restored OPERABLE, and an additional 72 hours (for a total of 9 days) allowed prior to complete restoration of the LCO. The 6 day Completion Time provides a limit on time allowed in a specified condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which Conditions A and B are entered concurrently.
| |
| The "AND" connector between the 72 hour and 6 day Completion Times means that both Completion Times apply simultaneously, and the more restrictive Completion Time must be met.As in Required Action B.2, the Completion Time allows for an exception to the normal "time zero" for beginning the allowed time "clock." This will result in establishing the "time zero" at the time that the LCO was initially not met, instead of at the time Condition B was entered.C.1 and C.2 Required Action C.1, which applies when two offsite circuits are inoperable, is intended to provide assurance that an event with a coincident single failure will not result in a complete loss of redundant required safety functions.
| |
| The Completion Time for this failure of redundant required features is reduced to 12 hours from that allowed for one train without offsite power (Required Action A.2). The rationale for the reduction to 12 hours is that Regulatory Guide 1.93 (Ref. 7) allows a Completion Time of 24 hours for two required offsite circuits inoperable, based upon the assumption that two complete safety trains are OPERABLE.
| |
| When a concurrent redundant required feature failure exists, this assumption is not the case, and a shorter Completion Time of 12 hours is appropriate.
| |
| These features are powered from redundant AC safety trains. This includes motor driven auxiliary feedwater pumps.Single train features, such as turbine driven auxiliary pumps, are not included in the list.The Completion Time for Required Action C. I is intended to allow the operator time to evaluate and repair any discovered inoperabilities.
| |
| This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." In this Required Action the Completion Time only begins on discovery that both: a. All required offsite circuits are inoperable; and b. A required feature is inoperable.
| |
| McGuire Units 1 and 2 B 3.8.1-11 Revision No. 115 AC Sources-Operating B 3.8.1 BASES ACTIONS (continued)
| |
| If at any time during the existence of Condition C (two offsite circuits inoperable) a required feature becomes inoperable, this Completion Time begins to be tracked.According to Regulatory Guide 1.93 (Ref. 7), operation may continue in Condition C for a period that should not exceed 24 hours. This level of degradation means that the offsite electrical power system does not have the capability to effect a safe shutdown and to mitigate the effects of an accident; however, the onsite AC sources have not been degraded.
| |
| This level of degradation generally corresponds to a total loss of the immediately accessible offsite power sources.Because of the normally high availability of the offsite sources, this level of degradation may appear to be more severe than other combinations of two AC sources inoperable that involve one or more DGs inoperable.
| |
| However, two factors tend to decrease the severity of this level of degradation:
| |
| : a. The configuration of the redundant AC electrical power system that remains available is not susceptible to a single bus or switching failure; and b. The time required to detect and restore an unavailable offsite power source is generally much less than that required to detect and restore an unavailable onsite AC source.With both of the required offsite circuits inoperable, sufficient onsite AC sources are available to maintain the unit in a safe shutdown condition in the event of a DBA or transient.
| |
| In fact, a simultaneous loss of offsite AC sources, a LOCA, and a worst case single failure were postulated as a part of the design basis in the safety analysis.
| |
| Thus, the 24 hour Completion Time provides a period of time to effect restoration of one of the offsite circuits commensurate with the importance of maintaining an AC electrical power system capable of meeting its design criteria.According to Reference 6, with the available offsite AC sources, two less than required by the LCO, operation may continue for 24 hours. If two offsite sources are restored within 24 hours, unrestricted operation may continue.
| |
| If only one offsite source is restored within 24 hours, power operation continues in accordance with Condition A.D.1 and D.2 Pursuant to LCO 3.0.6, the Distribution System ACTIONS would not be entered even if all AC sources to it were inoperable, resulting in de-energization.
| |
| Therefore, the Required Actions of Condition D are McGuire Units 1 and 2 B 3.8.1-12 Revision No. 115 AC Sources-Operating B 3.8.1 BASES ACTIONS (continued) modified by a Note to indicate that when Condition D is entered with no AC source to any train, the Conditions and Required Actions for LCO 3.8.9, "Distribution Systems--Operating," must be immediately entered. This allows Condition D to provide requirements for the loss of one offsite circuit and one DG, without regard to whether a train is de-energized.
| |
| LCO 3.8.9 provides the appropriate restrictions for a de-energized train.According to Regulatory Guide 1.93 (Ref. 7), operation may continue in Condition D for a period that should not exceed 12 hours.In Condition D, individual redundancy is lost in both the offsite electrical power system and the onsite AC electrical power system. Since power system redundancy is provided by two diverse sources of power, however, the reliability of the power systems in this Condition may appear higher than that in Condition C (loss of both required offsite circuits).
| |
| This difference in reliability is offset by the susceptibility of this power system configuration to a single bus or switching failure. The 12 hour Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.E.1 With Train A and Train B DGs inoperable, there are no remaining standby AC sources. Thus, with an assumed loss of offsite electrical power, insufficient standby AC sources are available to power the minimum required ESF functions.
| |
| Since the offsite electrical power system is the only source of AC power for this level of degradation, the risk associated with continued operation for a very short time could be less than that associated with an immediate controlled shutdown (the immediate shutdown could cause grid instability, which could result in a total loss of AC power). Since any inadvertent generator trip could also result in a total loss of offsite AC power, however, the time allowed for continued operation is severely restricted.
| |
| The intent here is to avoid the risk associated with an immediate controlled shutdown and to minimize the risk associated with this level of degradation.
| |
| According to Reference 7, with both DGs inoperable, operation may continue for a period that should not exceed 2 hours.F. 1 The sequencer(s) is an essential support system to both the offsite circuit and the DG associated with a given ESF bus. Furthermore, the McGuire Units 1 and 2 B 3.8.1-13 Revision No. 115 AC Sources-Operating B 3.8.1 BASES ACTIONS (continued) sequencer is on the primary success path for most major AC electrically powered safety systems powered from the associated ESF bus.Therefore, loss of an ESF bus sequencer affects every major ESF system in the train. The 12 hour Completion Time provides a period of time to correct the problem commensurate with the importance of maintaining sequencer OPERABILITY.
| |
| This time period also ensures that the probability of an accident (requiring sequencer OPERABILITY) occurring during periods when the sequencer is inoperable is minimal.G.1 and G.2 If the inoperable AC electric power sources cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging plant systems.H.1 Condition H corresponds to a level of degradation in which all redundancy in the AC electrical power supplies has been lost. At this severely degraded level, any further losses in the AC electrical power system will cause a loss of function.
| |
| Therefore, no additional time is justified for continued operation.
| |
| The unit is required by LCO 3.0.3 to commence a controlled shutdown.McGuire Units 1 and 2 B 3.8.1-14 Revision No. 115 AC Sources-Operating B 3.8.1 BASES SURVEILLANCE The AC sources are designed to permit inspection and testing of all REQUIREMENTS important areas and features, especially those that have a standby function, in accordance with 10 CFR 50, Appendix A, GDC 18 (Ref. 9).Periodic component tests are supplemented by extensive functional tests during refueling outages (under simulated accident conditions).
| |
| The SRs for demonstrating the OPERABILITY of the DGs are in accordance with the recommendations of Regulatory Guide 1.9 (Ref. 3) and Regulatory Guide 1.137 (Ref. 11), as addressed in the UFSAR.Since the McGuire DG manufacturer, Nordberg, is no longer in business, McGuire engineering is the designer of record. Therefore, the term"manufacturer's or vendor's recommendations" is taken to mean the recommendations as determined by McGuire engineering, with specific Nordberg input as it is available, that were intended for the DGs, taking into account the maintenance, operating history, and industry experience, when available.
| |
| Where the SRs discussed herein specify voltage and frequency tolerances, the following is applicable.
| |
| The minimum steady state output voltage of 3740 V is 90% of the nominal 4160 V output voltage. This value allows for voltage drop to the terminals of 4000 V motors whose minimum operating voltage is specified as 90% or 3600 V. It also allows for voltage drops to motors and other equipment down through the 120 V level where minimum operating voltage is also usually specified as 90%of name plate rating. The specified maximum steady state output voltage of 4580 V is equal to the maximum operating voltage specified for 4000 V motors. It ensures that for a lightly loaded distribution system, the voltage at the terminals of 4000 V motors is no more than the maximum rated operating voltages.
| |
| The specified minimum and maximum frequencies of the DG are 58.8 Hz and 61.2 Hz, respectively.
| |
| These values are equal to+/- 2% of the 60 Hz nominal frequency and are derived from the recommendations given in Regulatory Guide 1.9 (Ref. 3).SR 3.8.1.1 This SR ensures proper circuit continuity for the offsite AC electrical power supply to the onsite distribution network and availability of offsite AC electrical power. The breaker alignment verifies that each breaker is in its correct position to ensure that distribution buses and loads are connected to their preferred power source, and that appropriate independence of offsite circuits is maintained.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Units 1 and 2 B 3.8.1-15 Revision No. 115 AC Sources-Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.8.1.2 and SR 3.8.1.7 These SRs help to ensure the availability of the standby electrical power supply to mitigate DBAs and transients and to maintain the unit in a safe shutdown condition.
| |
| To minimize the wear on moving parts that do not get lubricated when the engine is not running, these SRs are modified by a Note (Note 2 for SR 3.8.1.2) to indicate that all DG starts for these Surveillances may be preceded by an engine prelube period and followed by a warmup period prior to loading.For the purposes of SR 3.8.1.2 and SR 3.8.1.7 testing, the DGs are started from standby conditions using a manual start, loss of offsite power signal, safety injection signal, or loss of offsite power coincident with a safety injection signal. Standby conditions for a DG mean that the diesel engine coolant and oil are being continuously circulated and temperature is being maintained consistent with manufacturer recommendations.
| |
| In order to reduce stress and wear, the manufacturer recommends a modified start in which the DGs are gradually accelerated to synchronous speed prior to loading. These start procedures are the intent of Note 3, which is only applicable when such modified start procedures are recommended by the manufacturer.
| |
| SR 3.8.1.7 requires that the DG starts from standby conditions and achieves required voltage and frequency within 11 seconds. The 11 second start requirement supports the assumptions of the design basis LOCA analysis in the UFSAR, Chapter 15 (Ref. 5).The 11 second start requirement is not applicable to SR 3.8.1.2 (see Note 3) when a modified start procedure as described above is used. If a modified start is not used, the 11 second start requirement of SR 3.8.1.7 applies.Since SR 3.8.1.7 requires a 11 second start, it is more restrictive than SR 3.8.1.2, and it may be performed in lieu of SR 3.8.1.2. This is the intent of Note 1 of SR 3.8.1.2.McGuire Units 1 and 2 B 3.8.1-16 Revision No. 115 AC Sources-Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.8.1.3 This Surveillance verifies that the DGs are capable of synchronizing with the offsite electrical system and accepting loads greater than or equal to the equivalent of the maximum expected accident loads. A minimum run time of 60 minutes is required to stabilize engine temperatures, while minimizing the time that the DG is connected to the offsite source.Although no power factor requirements are established by this SR, the DG is normally operated at a power factor between 0.8 lagging and 1.0.The 0.8 value is the design rating of the machine, while the 1.0 is an operational limitation to ensure circulating currents are minimized.
| |
| The load band is provided to avoid routine overloading of the DG. Routine overloading may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain DG OPERABILITY.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.This SR is modified by four Notes. Note 1 indicates that diesel engine runs for this Surveillance may include gradual loading, as recommended by the manufacturer, so that mechanical stress and wear on the diesel engine are minimized.
| |
| Note 2 states that momentary transients, because of changing bus loads, do not invalidate this test. Similarly, momentary power factor transients above the limit do not invalidate the test. Note 3 indicates that this Surveillance should be conducted on only one DG at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations.
| |
| Note 4 stipulates a prerequisite requirement for performance of this SR. A successful DG start must precede this test to credit satisfactory performance.
| |
| McGuire Units 1 and 2 B 3.8.1-17 Revision No. 115 AC Sources-Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.8,1.4 This SR provides verification that the level of fuel oil in the day tank is adequate for approximately 30 minutes of DG operation at full load, which allows for an orderly shutdown of the DG should fuel replenishment to the day tank become unavailable.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.8.1.5 Microbiological fouling is a major cause of fuel oil degradation.
| |
| There are numerous bacteria that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive. Removal of water from the fuel oil day tanks eliminates the necessary environment for bacterial survival.
| |
| This is the most effective means of controlling microbiological fouling. In addition, it eliminates the potential for water entrainment in the fuel oil during DG operation.
| |
| Water may come from any of several sources, including condensation, ground water, rain water, contaminated fuel oil, and breakdown of the fuel oil by bacteria.
| |
| Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program. This SR is for preventative maintenance.
| |
| The presence of water does not necessarily represent failure of this SR, provided the accumulated water is removed during the performance of this Surveillance.
| |
| SR 3.8.1.6 This Surveillance demonstrates that each required fuel oil transfer pump operates and transfers fuel oil from its associated storage tank to its associated day tank. This is required to support continuous operation of standby power sources. This Surveillance provides assurance that the fuel oil transfer pump is OPERABLE, the fuel oil piping system is intact, the fuel delivery piping is not obstructed, and the controls and control systems for automatic fuel transfer systems are OPERABLE.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Units 1 and 2 B 3.8.1-18 Revision No. 115 AC Sources-Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.8.1.7 See SR 3.8.1.2.SR 3.8.1.8 Transfer of each 4.16 kV ESF bus power supply from the normal offsite circuit to the alternate offsite circuit demonstrates the OPERABILITY of the alternate circuit distribution network to power the shutdown loads.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.This SR is modified by a Note. The reason for the Note is that, during operation with the reactor critical, performance of this SR could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, unit safety systems.SR 3.8.1.9 Each DG is provided with an engine overspeed trip to prevent damage to the engine. Recovery from the transient caused by the loss of a large load could cause diesel engine overspeed, which, if excessive, might result in a trip of the engine. This Surveillance demonstrates the DG load response characteristics and capability to reject the largest single load without exceeding predetermined voltage and frequency and while maintaining a specified margin to the overspeed trip. For this unit, the single load for each DG and its kilowatt rating is as follows: Nuclear Service Water Pump which is a 576 kW motor. This Surveillance may be accomplished by: a. Tripping the DG output breaker with the DG carrying greater than or equal to its associated single largest post-accident load while paralleled to offsite power, or while solely supplying the bus; or b. Tripping its associated single largest post-accident load with the DG solely supplying the bus.As required by Regulatory Guide 1.9 (Ref. 3), the load rejection test is acceptable if the increase in diesel speed does not exceed 75% of the McGuire Units 1 and 2 B 3.8.1-19 Revision No. 115 AC Sources-Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued) difference between synchronous speed and the overspeed trip setpoint, or 15% above synchronous speed, whichever is lower.The time, voltage, and frequency tolerances specified in this SR are derived from Regulatory Guide 1.9 (Ref. 3) recommendations for response during load sequence intervals.
| |
| The 3 seconds specified is equal to 60% of a typical 5 second load sequence interval associated with sequencing of the largest load. The voltage and frequency specified are consistent with the design range of the equipment powered by the DG.SR 3.8.1.9.a corresponds to the maximum frequency excursion, while SR 3.8.1.9.b and SR 3.8.1.9.c are steady state voltage and frequency values to which the system must recover following load rejection.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.This Surveillance is performed with the DG connected to its bus in parallel with offsite power supply. The DG is tested under maximum kVAR loading, which is defined as being as close to design basis conditions as practical subject to offsite power conditions.
| |
| Design basis conditions have been calculated to be greater than 0.9 power factor. During DG testing, equipment ratings are not to be exceeded (i.e., without creating an overvoltage condition on the DG or 4 kV emergency buses, over-excitation in the generator, or overloading the DG emergency feeder while maintaining the power factor greater than or equal to 0.9).This Surveillance should be conducted on only one DG at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations.
| |
| SR 3.8.1.10 This Surveillance demonstrates the DG capability to reject a full load without overspeed tripping or exceeding the predetermined voltage limits.The DG full load rejection may occur because of a system fault or inadvertent breaker tripping.
| |
| This Surveillance ensures proper engine generator load response under the simulated test conditions.
| |
| This test simulates the loss of the total connected load that the DG experiences following a full load rejection and verifies that the DG does not trip upon loss of the load. These acceptance criteria provide for DG damage protection.
| |
| While the DG is not expected to experience this transient during an event and continues to be available, this response ensures that the DG is not degraded for future application, including reconnection to the bus if the trip initiator can be corrected or isolated.McGuire Units 1 and 2 B 3.8.1-20 Revision No. 115 AC Sources-Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| Although not representative of the design basis inductive loading that the DG would experience, a power factor of approximately unity (1.0) is used for testing. This power factor is chosen in accordance with manufacturer's recommendations to minimize DG overvoltage during testing.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.This Surveillance should be conducted on only one DG at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations.
| |
| SR 3.8.1.11 As required by Regulatory Guide 1.9 (Ref. 3), paragraph 2.2.4, this Surveillance demonstrates the as designed operation of the standby power sources during loss of the offsite source. This test verifies the de-energization of the emergency buses, load shedding from the emergency buses and energization of the emergency buses and blackout loads from the DG. Tripping of non-essential loads is not verified in this test. It further demonstrates the capability of the DG to automatically achieve the required voltage and frequency within the specified time.The DG autostart time of 11 seconds is derived from requirements of the accident analysis to respond to a design basis large break LOCA. The Surveillance should be continued for a minimum of 5 minutes in order to demonstrate that all starting transients have decayed and stability is achieved.The requirement to verify the connection and power supply of the emergency bus and autoconnected loads is intended to satisfactorily show the relationship of these loads to the DG loading logic. In certain circumstances, many of these loads cannot actually be connected or loaded without undue hardship or potential for undesired operation.
| |
| For instance, Emergency Core Cooling Systems (ECCS) injection valves are not desired to be stroked open, or high pressure injection systems are not capable of being operated at full flow, or residual heat removal (RHR)systems performing a decay heat removal function are not desired to be realigned to the ECCS mode of operation.
| |
| In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the McGuire Units 1 and 2 B 3.8.1-21 Revision No. 115 AC Sources-Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued) capability of the DG systems to perform these functions is acceptable.
| |
| This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.This SR is modified by two Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. For the purpose of this testing, the DGs must be started from standby conditions, that is, with the engine coolant and oil continuously circulated and temperature maintained consistent with manufacturer recommendations.
| |
| The reason for Note 2 is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems.SR 3.8.1.12 This Surveillance demonstrates that the DG automatically starts and achieves the required voltage and frequency within the specified time (11 seconds) from the design basis actuation signal (LOCA signal) and operates for _ 5 minutes. The 5 minute period provides sufficient time to demonstrate stability.
| |
| SR 3.8.1.12.d ensures that the emergency bus remains energized from the offsite electrical power system on an ESF signal without loss of offsite power. This Surveillance also verified the tripping of non-essential loads. Tripping of non-essential loads is verified only once, either in this SR or in SR 3.8.1.19, since the same circuitry is tested in each SR.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program. This SR is modified by a Note. The reason for the Note is to minimize wear and tear on the DGs during testing. For the purpose of this testing, the DGs must be started from standby conditions, that is, with the engine coolant and oil continuously circulated and temperature maintained consistent with manufacturer recommendations.
| |
| SR 3.8.1.13 This Surveillance demonstrates that DG non-emergency protective functions (e.g., high jacket water temperature) are bypassed on a loss of voltage signal concurrent with an ESF actuation test signal.McGuire Units 1 and 2 B 3.8.1-22 Revision No. 115 AC Sources-Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| The non-emergency automatic trips are all automatic trips except: a. Engine overspeed;
| |
| : b. Generator differential current;c. Low lube oil pressure; and d. Generator voltage -controlled overcurrent.
| |
| The non-emergency trips are bypassed during DBAs and provide an alarm on an abnormal engine condition.
| |
| This alarm provides the operator with sufficient time to react appropriately.
| |
| The DG availability to mitigate the DBA is more critical than protecting the engine against minor problems that are not immediately detrimental to emergency operation of the DG. Currently, DG emergency automatic trips are tested periodically per the station periodic maintenance program.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.This SR is not normally performed in MODE 1 or 2, but it may be performed in conjunction with periodic preplanned preventative maintenance activity that causes the DG to be inoperable.
| |
| This is acceptable provided that performance of the SR does not increase the time the DG would be inoperable for the preplanned preventative maintenance activity.SR 3.8.1.14 Regulatory Guide 1.9 (Ref. 3), paragraph 2.2.9, requires demonstration that the DGs can start and run continuously at full load capability for an interval of not less than 24 hours, -_ 2 hours of which is at a load equivalent from 105% to 110% of the continuous duty rating and the remainder of the time at a load equivalent to the continuous duty rating of the DG. The DG starts for this Surveillance can be performed either from standby or hot conditions.
| |
| The provisions for prelubricating and warmup, discussed in SR 3.8.1.2, and for gradual loading, discussed in SR 3.8.1.3, are applicable to this SR.McGuire Units 1 and 2 B 3.8.1-23 Revision No. 115 AC Sources-Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| This Surveillance is performed with the DG connected to its bus in parallel with offsite power supply. The DG is tested under maximum kVAR loading, which is defined as being as close to design basis conditions as practical subject to offsite power conditions.
| |
| Design basis conditions have been calculated to be greater than 0.9 power factor. During DG testing, equipment ratings are not to be exceeded (i.e., without creating an overvoltage condition on the DG or 4 kV emergency buses, over-excitation in the generator, or overloading the DG emergency feeder while maintaining the power factor greater than or equal to 0.9).The load band is provided to avoid routine overloading of the DG.Routine overloading may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain DG OPERABILITY.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.This Surveillance is modified by two Notes. Note 1 states that momentary transients due to changing bus loads do not invalidate this test. Note 2 allows gradual loading of the DG in accordance with recommendation from the manufacturer.
| |
| This Surveillance should be conducted on only one DG at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations.
| |
| SR 3.8.1.15 This Surveillance demonstrates that the diesel engine can restart from a hot condition, such as subsequent to shutdown from normal Surveillances, and achieve the required voltage and frequency within 11 seconds. The 11 second time is derived from the requirements of the accident analysis to respond to a design basis large break LOCA. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.This SR is modified by two Notes. Note 1 ensures that the test is performed with the diesel sufficiently hot. The load band is provided to avoid routine overloading of the DG. Routine overloads may result in more frequent teardown inspections in accordance with vendor McGuire Units 1 and 2 B 3.8.1-24 Revision No. 115 AC Sources-Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued) recommendations in order to maintain DG OPERABILITY.
| |
| The requirement that the diesel has operated for at least 2 hours at full load conditions prior to performance of this Surveillance is based on manufacturer recommendations for achieving hot conditions.
| |
| Momentary transients due to changing bus loads do not invalidate this test. Note 2 allows all DG starts to be preceded by an engine prelube period to minimize wear and tear on the diesel during testing.SR 3.8.1.16 As required by Regulatory Guide 1.9 (Ref. 3), paragraph 2.2.11, this Surveillance ensures that the manual synchronization and automatic load transfer from the DG to the offsite source can be made and the DG can be returned to standby operation when offsite power is restored.
| |
| It also ensures that the autostart logic is reset to allow the DG to reload if a subsequent loss of offsite power occurs. The DG is considered to be in standby operation when the DG is at rated speed and voltage, the output breaker is open and can receive an autoclose signal on bus undervoltage, and the load sequence timers are reset.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program. This SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems.SR 3.8.1.17 Demonstration of the test mode override ensures that the DG availability under accident conditions will not be compromised as the result of testing and the DG will automatically reset to standby operation if a LOCA actuation signal is received during operation in the test mode. Standby operation is defined as the DG running at rated speed and voltage with the DG output breaker open. These provisions for automatic switchover are required by Regulatory Guide 1.9 (Ref. 3), paragraph 2.2.13. The requirement to automatically energize the emergency loads with offsite power is essentially identical to that of SR 3.8.1.12.
| |
| The intent in the requirement associated with SR 3.8.1.17.b is to show that the emergency loading was not affected by the DG operation in test mode. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the emergency loads to perform these functions is acceptable.
| |
| This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.McGuire Units 1 and 2 B 3.8.1-25 Revision No. 115 AC Sources-Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.This SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems.SR 3.8.1.18 Under accident and loss of offsite power conditions loads are sequentially connected to the bus by the automatic load sequencer.
| |
| The sequencing logic controls the permissive and starting signals to motor breakers to prevent overloading of the DGs due to high motor starting currents.
| |
| The load sequence time interval tolerance in Table 8-16 of Reference 2 ensures that sufficient time exists for the DG to restore frequency and voltage prior to applying the next load and that safety analysis assumptions regarding ESF equipment time delays are not violated.Table 8-1 of Reference 2 provides a summary of the automatic loading of ESF buses. The sequencing times of Table 8-16 are committed and required for OPERABILITY.
| |
| The typical 1 minute loading duration seen by the accelerated sequencing scheme is NOT required for OPERABILITY.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.8.1.19 In the event of a DBA coincident with a loss of offsite power, the DGs are required to supply the necessary power to ESF systems so that the fuel, RCS, and containment design limits are not exceeded.This Surveillance verifies the de-energization of the emergency buses, load shedding from the emergency buses, tripping of non-essential loads and energization of the emergency buses and ESF loads from the DG.Tripping of non-essential loads is verified only once, either in this SR or in SR 3.8.1.12, since the same circuitry is tested in each SR. In lieu of actual demonstration of connection and loading of loads, testing that McGuire Units 1 and 2 B 3.8.1-26 Revision No. 115 AC Sources-Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued) adequately shows the capability of the DG system to perform these functions is acceptable.
| |
| This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.This SR is modified by two Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. For the purpose of this testing, the DGs must be started from standby conditions, that is, with the engine coolant and oil continuously circulated and temperature maintained consistent with manufacturer recommendations for DGs. The reason for Note 2 is that the performance of the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems.SR 3.8.1.20 This Surveillance demonstrates that the DG starting independence has not been compromised.
| |
| Also, this Surveillance demonstrates that each engine can achieve proper speed within the specified time when the DGs are started simultaneously.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.This SR is modified by a Note. The reason for the Note is to minimize wear on the DG during testing. For the purpose of this testing, the DGs must be started from standby conditions, that is, with the engine coolant and oil continuously circulated and temperature maintained consistent with manufacturer recommendations.
| |
| McGuire Units 1 and 2 B 3.8.1-27 Revision No. 115 AC Sources-Operating B 3.8.1 BASES REFERENCES 1.2.3.4.5.6.7.8.10 CFR 50, Appendix A, GDC 17.UFSAR, Chapter 8.Regulatory Guide 1.9, Rev. 3, July 1993.UFSAR, Chapter 6.UFSAR, Chapter 15.10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| Regulatory Guide 1.93, Rev. 0, December 1974.Generic Letter 84-15, "Proposed Staff Actions to Improve and Maintain Diesel Generator Reliability," July 2, 1984.10 CFR 50, Appendix A, GDC 18.Regulatory Guide 1.137, Rev. 1, October 1979.IEEE Standard 308-1971.Regulatory Guide 1.6, Rev. 0, March 1971.Regulatory Guide 1.8.1, Rev. 1, January 1975.9.10.11.12.13.McGuire Units 1 and 2 B 3.8.1-28 Revision No. 115 AC Sources-Shutdown B 3.8.2 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.2 AC Sources-Shutdown BASES BACKGROUND A description of the AC sources is provided in the Bases for LCO 3.8.1,"AC Sources-Operating." APPLICABLE The OPERABILITY of the minimum AC sources during MODES 5 and 6 SAFETY ANALYSES and during movement of irradiated fuel assemblies ensures that: a. The unit can be maintained in the shutdown or refueling condition for extended periods;b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and c. Adequate AC electrical power is provided to mitigate events postulated during shutdown, such as a fuel handling accident.In general, when the unit is shut down, the Technical Specifications requirements ensure that the unit has the capability to mitigate the consequences of postulated accidents.
| |
| However, assuming a single failure and concurrent loss of all offsite or all onsite power is not required.The rationale for this is based on the fact that many Design Basis Accidents (DBAs) that are analyzed in MODES 1, 2, 3, and 4 have no specific analyses in MODES 5 and 6. Worst case bounding events are deemed not credible in MODES 5 and 6 because the energy contained within the reactor pressure boundary, reactor coolant temperature and pressure, and the corresponding stresses result in the probabilities of occurrence being significantly reduced or eliminated, and in minimal consequences.
| |
| These deviations from DBA analysis assumptions and design requirements during shutdown conditions are allowed by the LCO for required systems.During MODES 1, 2, 3, and 4, various deviations from the analysis assumptions and design requirements are allowed within the Required Actions. This allowance is in recognition that certain testing and maintenance activities must be conducted provided an acceptable level of risk is not exceeded.
| |
| During MODES 5 and 6, performance of a significant number of required testing and maintenance activities is also required.
| |
| In MODES 5 and 6, the activities are generally planned and administratively controlled.
| |
| Relaxations from MODE 1, 2, 3, and 4 LCO requirements are acceptable during shutdown modes based on: McGuire Units 1 and 2 B 3.8.2-1 Revision No. 92 AC Sources-Shutdown B 3.8.2 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| : a. The fact that time in an outage is limited. This is a risk prudent goal as well as a utility economic consideration.
| |
| : b. Requiring appropriate compensatory measures for certain conditions.
| |
| These may include administrative controls, reliance on systems that do not necessarily meet typical design requirements applied to systems credited in operating MODE analyses, or both.c. Prudent utility consideration of the risk associated with multiple activities that could affect multiple systems.d. Maintaining, to the extent practical, the ability to perform required functions (even if not meeting MODE 1, 2, 3, and 4 OPERABILITY requirements) with systems assumed to function during an event.In the event of an accident during shutdown, this LCO ensures the capability to support systems necessary to avoid immediate difficulty, assuming either a loss of all offsite power or a loss of all onsite diesel generator (DG) power.The AC sources satisfy Criterion 3 of 10 CFR 50.36 (Ref. 1).LCO One offsite circuit capable of supplying the onsite Class 1 E power distribution subsystem(s) of LCO 3.8.10, "Distribution Systems-Shutdown," ensures that all required loads are powered from offsite power. An OPERABLE DG, associated with the distribution system train required to be OPERABLE by LCO 3.8.10, ensures a diverse power source is available to provide electrical power support, assuming a loss of the offsite circuit. Together, OPERABILITY of the required offsite circuit and DG ensures the availability of sufficient AC sources to operate the unit in a safe manner and to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents).
| |
| The qualified offsite circuit must be capable of maintaining rated frequency and voltage, and accepting required loads during an accident, while connected to the Engineered Safety Feature (ESF) bus(es).Qualified offsite circuits are those that are described in the UFSAR and are part of the licensing basis for the unit.The 4.16 kV essential system is divided into two completely redundant and independent trains designated A and B, each consisting of one 4.16 kV switchgear assembly, two 4.16 kV/600 V transformers, two 600 V load centers, and associated loads.McGuire Units 1 and 2 B 3.8.2-2 Revision No. 92 AC Sources-Shutdown B 3.8.2 BASES LCO (continued)
| |
| Normally, each Class 1E 4.16 kV switchgear is powered from its associated non-Class 1 E train of the 6.9 kV Normal Auxiliary Power System as discussed in "6.9 kV Normal Auxiliary Power System" in Chapter 8 of the UFSAR. Additionally, an alternate source of power to each 4.16 kV essential switchgear is provided from the 6.9 kV system via two separate and independent 6.9/4.16 kV transformers.
| |
| These transformers are shared between units and provide the capability to supply an alternate source of preferred power to each unit's 4.16 kV essential switchgear from either unit's 6.9 kV system. A key interlock scheme is provided to preclude the possibility of connecting the two units together at either the 6.9 or 4.16 kV level.Each train of the 4.16 kV Essential Auxiliary Power System is also provided with a separate and independent emergency diesel generator to supply the Class 1 E loads required to safely shut down the unit following a design basis accident.The DG must be capable of starting, accelerating to rated speed and voltage, and connecting to its respective ESF bus on detection of bus undervoltage.
| |
| This sequence must be accomplished within 11 seconds.The DG must be capable of accepting required loads within the assumed loading sequence intervals, and continue to operate until offsite power can be restored to the ESF buses. These capabilities are required to be met from a variety of initial conditions such as DG in standby with the engine hot and DG in standby at ambient conditions.
| |
| The sequencer associated with the required DG is also required to be OPERABLE.
| |
| Proper sequencer operation on safety injection signal is not required by this LCO since safety injection signal is not required to be OPERABLE in the MODES applicable to this LCO.Proper sequencing of blackout loads is a function of Sequencer OPERABILITY.
| |
| Proper load shedding is a function of DG OPERABILITY.
| |
| In addition, proper sequencer operation is an integral part of offsite circuit OPERABILITY since its inoperability impacts on the ability to start and maintain energized loads required OPERABLE by LCO 3.8.10.It is acceptable for trains to be cross tied during shutdown conditions, allowing a single offsite power circuit to supply all required trains.Both normal and emergency power must be OPERABLE for a shared component to be OPERABLE.
| |
| If normal or emergency power supplying a shared component becomes inoperable, then the Required Actions of the affected shared component LCO must be entered independently for each McGuire Units 1 and 2 B 3.8.2-3 Revision No. 92 AC Sources-Shutdown B 3.8.2 BASES LCO (continued) unit that is in the MODE of applicability of the shared component LCO.The shared component LCOs are: 3.7.7 -Nuclear Service Water System (NSWS), 3.7.9 -Control Room Area Ventilation System (CRAVS), 3.7.10 -Control Room Area Chilled Water System (CRACWS), and 3.7.11 -Auxiliary Building Filtered Ventilation Exhaust System (ABFVES).APPLICABILITY The AC sources required to be OPERABLE in MODES 5 and 6 and during movement of irradiated fuel assemblies provide assurance that: APPLICABILITY (continued)
| |
| : a. Systems to provide adequate coolant inventory makeup are available for the irradiated fuel assemblies in the core;b. Systems needed to mitigate a fuel handling accident are available;
| |
| : c. Systems necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.
| |
| The AC power requirements for MODES 1, 2, 3, and 4 are covered in LCO 3.8.1.ACTIONS A. 1 An offsite circuit would be considered inoperable if it were not available to one required ESF train. Although two trains are required by LCO 3.8.10, the one train with offsite power available may be capable of supporting sufficient required features to allow continuation of CORE ALTERATIONS and fuel movement.
| |
| By the allowance of the option to declare required features inoperable, with no offsite power available, appropriate restrictions will be implemented in accordance with the affected required features LCO's ACTIONS.A.2.1, A.2.2, A.2.3, A.2.4, B.1, B.2, B.3, and B.4 McGuire Units 1 and 2 B 3.8.2-4 Revision No. 92 AC Sources-Shutdown B 3.8.2 BASES ACTIONS (continued)
| |
| With the offsite circuit not available to all required trains, the option would still exist to declare all required features inoperable.
| |
| Since this option may involve undesired administrative efforts, the allowance for sufficiently conservative actions is made. With the required DG inoperable, the minimum required diversity of AC power sources is not available.
| |
| It is, therefore, required to suspend CORE ALTERATIONS, movement of irradiated fuel assemblies, and operations involving positive reactivity additions that could result in loss of required SDM (Mode 5) or required boron concentration (Mode 6). Suspending positive reactivity additions that could result in failure to meet the minimum SDM or boron concentration limits is required to assure continued safe operation.
| |
| Introduction of coolant inventory must be from sources that have a boron concentration greater than that what would be required in the RCS for minimum SDM or refueling boron concentration.
| |
| This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation.
| |
| Introduction of temperature changes including temperature increases when operating with a positive MTC must also be evaluated to ensure they do not result in a loss of required SDM.Suspension of these activities does not preclude completion of actions to establish a safe conservative condition.
| |
| These actions minimize the probability or the occurrence of postulated events. It is further required to immediately initiate action to restore the required AC sources and to continue this action until restoration is accomplished in order to provide the necessary AC power to the unit safety systems.The Completion Time of immediately is consistent with the required times for actions requiring prompt attention.
| |
| The restoration of the required AC electrical power sources should be completed as quickly as possible in order to minimize the time during which the unit safety systems may be without sufficient power.Pursuant-to LCO 3.0.6, the Distribution System's ACTIONS would not be entered even if all AC sources to it are inoperable, resulting in de-energization.
| |
| Therefore, the Required Actions of Condition A are modified by a Note to indicate that when Condition A is entered with no AC power to any required ESF bus, the ACTIONS for LCO 3.8.10 must be immediately entered. This Note allows Condition A to provide requirements for the loss of the offsite circuit, whether or not a train is de-energized.
| |
| LCO 3.8.10 would provide the appropriate restrictions for the situation involving a de-energized train.McGuire Units 1 and 2 B 3.8.2-5 Revision No. 92 AC Sources-Shutdown B 3.8.2 BASES SURVEILLANCE SR 3.8.2.1 REQUIREMENTS SR 3.8.2.1 requires the SRs from LCO 3.8.1 that are necessary for ensuring the OPERABILITY of the AC sources in other than MODES 1, 2, 3, and 4. SR 3.8.1.8 is not required to be met since only one offsite circuit is required to be OPERABLE.
| |
| SRs 3.8.1.12 and 3.8.1.19 are not required to be met because the ESF signals, required for the SRs, are not required to be OPERABLE in MODES 5 or 6. SR 3.8.1.17 is not required to be met because the required OPERABLE DG(s) is not required to undergo periods of being synchronized to the offsite circuit. SR 3.8.1.20 is excepted because starting independence is not required with the DG(s)that is not required to be operable.This SR is modified by a Note. The reason for the Note is to preclude requiring the OPERABLE DG(s) from being paralleled with the offsite power network or otherwise rendered inoperable during performance of SRs, and to preclude de-energizing a required 4160 V ESF bus or disconnecting a required offsite circuit during performance of SRs. With limited AC sources available, a single event could compromise both the required circuit and the DG. It is the intent that these SRs must still be capable of being met, but actual performance is not required during periods when the DG and offsite circuit is required to be OPERABLE.Refer to the corresponding Bases for LCO 3.8.1 for a discussion of each SR.REFERENCES
| |
| : 1. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.8.2-6 Revision No. 92 Diesel Fuel Oil and Starting Air B 3.8.3 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.3 Diesel Fuel Oil and Starting Air BASES BACKGROUND Each diesel generator (DG) is provided with a storage tank having a fuel oil capacity sufficient to operate that diesel for a period of 5 days while the DG is supplying maximum post loss of coolant accident load demand discussed in the UFSAR, Section 8.3.1.1.7 (Ref. 1). The maximum load demand is calculated using the assumption that a minimum of any two DGs is available.
| |
| This onsite fuel oil capacity is sufficient to operate the DGs for longer than the time to replenish the onsite supply from outside sources.Fuel oil is transferred from storage tank to day tank by either of two transfer pumps associated with each storage tank. Redundancy of pumps and piping precludes the failure of one pump, or the rupture of any pipe, valve or tank to result in the loss of more than one DG. All outside tanks, pumps, and piping are located underground.
| |
| For proper operation of the standby DGs, it is necessary to ensure the proper quality of the fuel oil. Regulatory Guide 1.137 (Ref. 2) addresses the recommended fuel oil practices as supplemented by ANSI N 195 (Ref. 3). The fuel oil properties governed by these SRs are the water and sediment content, the kinematic viscosity, specific gravity (or API gravity), and impurity level.Each DG has an air start system with adequate capacity for five successive start attempts on the DG without recharging the air start receiver(s).
| |
| APPLICABLE The initial conditions of Design Basis Accident (DBA) and transient SAFETY ANALYSES analyses in the UFSAR, Chapter 6 (Ref. 4), and in the UFSAR, Chapter 15 (Ref. 5), assume Engineered Safety Feature (ESF) systems are OPERABLE.
| |
| The DGs are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that fuel, Reactor Coolant System and containment design limits are not exceeded.
| |
| These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution Limits; Section 3.4, Reactor Coolant System (RCS); and Section 3.6, Containment Systems.Since diesel fuel oil and the air start subsystem support the operation of the standby AC power sources, they satisfy Criterion 3 of 10 CFR 50.36 (Rev. 6).McGuire Units 1 and 2 B 3.8.3-1 Revision No. 115 Diesel Fuel Oil and Starting Air B 3.8.3 BASES LCO Stored diesel fuel oil is required to have sufficient supply for 5 days of full load operation.
| |
| It is also required to meet specific standards for quality.DG day tank fuel requirements, as well as transfer capability from the storage tank to the day tank, are addressed in LCO 3.8.1, "AC Sources-Operating," and LCO 3.8.2, "AC Sources-Shutdown." This requirement, in conjunction with an ability to obtain replacement supplies within 4 days, supports the availability of DGs required to shut down the reactor and to maintain it in a safe condition for an anticipated operational occurrence (AOO) or a postulated DBA with loss of offsite power.The starting air system is required to have a minimum capacity for 5 successive DG start attempts without recharging the air start receivers.
| |
| APPLICABILITY The AC sources (LCO 3.8.1 and LCO 3.8.2) are required to ensure the availability of the required power to shut down the reactor and maintain it in a safe shutdown condition after an AOO or a postulated DBA. Since stored diesel fuel oil and the starting air subsystem support LCO 3.8.1 and LCO 3.8.2, stored diesel fuel oil and starting air are required to be within limits when the associated DG is required to be OPERABLE.ACTIONS The ACTIONS Table is modified by a Note indicating that separate Condition entry is allowed for each DG. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable DG subsystem.
| |
| Complying with the Required Actions for one inoperable DG subsystem may allow for continued operation, and subsequent inoperable DG subsystem(s) are governed by separate Condition entry and application of associated Required Actions.A.!1 In this Condition, the 5 day fuel oil supply for a DG is not available.
| |
| However, the Condition is restricted to fuel oil level reductions that maintain at least a 4 day supply. These circumstances may be caused by events, such as full load operation required after an inadvertent start while at minimum required level, or feed and bleed operations, which may be necessitated by increasing particulate levels or any number of other oil quality degradations.
| |
| This restriction allows sufficient time for obtaining the requisite replacement volume and performing the analyses required prior to addition of fuel oil to the tank. A period of 48 hours is considered sufficient to complete restoration of the required level prior to declaring the DG inoperable.
| |
| This period is acceptable based on the remaining capacity (> 4 days), the fact that procedures will be initiated to obtain replenishment, and the low probability of an event during this brief period.McGuire Units 1 and 2 B 3.8.3-2 Revision No. 115 Diesel Fuel Oil and Starting Air B 3.8.3 BASES ACTIONS (continued)
| |
| B.1 This Condition is entered as a result of a failure to meet the acceptance criterion of SR 3.8.3.2. Normally, trending of particulate levels allows sufficient time to correct high particulate levels prior to reaching the limit of acceptability.
| |
| Poor sample procedures (bottom sampling), contaminated sampling equipment, and errors in laboratory analysis can produce failures that do not follow a trend. Since the presence of particulates does not mean failure of the fuel oil to burn properly in the diesel engine, and particulate concentration is unlikely to change significantly between Surveillance Frequency intervals, and proper engine performance has been recently demonstrated (within 31 days), it is prudent to allow a brief period prior to declaring the associated DG inoperable.
| |
| The 7 day Completion Time allows for further evaluation, resampling and re-analysis of the DG fuel oil.C.1 With the new fuel oil properties defined in the Bases for SR 3.8.3.2 not within the required limits, a period of 30 days is allowed for restoring the stored fuel oil properties.
| |
| This period provides sufficient time to test the stored fuel oil to determine that the new fuel oil, when mixed with previously stored fuel oil, remains acceptable, or to restore the stored fuel oil properties.
| |
| This restoration may involve feed and bleed procedures, filtering, or combinations of these procedures.
| |
| Even if a DG start and load was required during this time interval and the fuel oil properties were outside limits, there is a high likelihood that the DG would still be capable of performing its intended function.D.1 and D.2 DG starting air system normal alignment allows air from both receivers to enter both left and right starting air headers. Therefore, with one receiver isolated, both left and right starting air headers will be supplied from the remaining receiver.
| |
| With the degraded receiver isolated and the remaining receiver > 210 psig, the capacity for 5 starts exists. In the interim prior to manually isolating the degraded receiver, part of the starting air would be lost to pressurizing the degraded receiver.
| |
| Therefore, this period must be minimized and action to isolate the degraded receiver shall be initiated immediately.
| |
| With the degraded starting air receiver isolated and the remaining receiver pressure _> 210 psig, the capacity for 5 starts exists, and the DG can be considered OPERABLE while the degraded air receiver pressure is McGuire Units 1 and 2 B 3.8.3-3 Revision No. 115 Diesel Fuel Oil and Starting Air B 3.8.3 BASES ACTIONS (continued) restored to the required limit. A period of 48 hours is considered sufficient to complete restoration to the required pressure prior to declaring the DG inoperable.
| |
| This period is acceptable based on the remaining air start capacity, the fact that most DG starts are accomplished on the first attempt, and the low probability of an event during this period.E. With a Required Action and associated Completion Time not met, or one or more DG's fuel oil or starting air subsystem not within limits for reasons other than addressed by Conditions A through D, the associated DG may be incapable of performing its intended function and must be immediately declared inoperable.
| |
| SURVEILLANCE SR 3.8.3.1 REQUIREMENTS This SR provides verification that there is an adequate inventory of fuel oil in the storage tanks to support each DG's operation for 5 days at full load.The 4 day period is sufficient time to place the unit in a safe shutdown condition and to bring in replenishment fuel from an offsite location.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.8.3.2 The tests listed below are a means of determining whether new fuel oil is of the appropriate grade and has not been contaminated with substances that would have an immediate, detrimental impact on diesel engine combustion.
| |
| If results from these tests are within acceptable limits, the fuel oil may be added to the storage tanks without concern for contaminating the entire volume of fuel oil in the storage tanks. These tests are to be conducted prior to adding the new fuel to the storage tank(s). The tests, limits, and applicable ASTM Standards are as follows: a. Sample the new fuel oil in accordance with ASTM D4057 (Ref. 7);b. Verify in accordance with the tests specified in ASTM D975 that the sample has a kinematic viscosity at 40 0 C of > 1.9 centistokes and 4.1 centistokes, and a flash point of >_ 125°F; and McGuire Units 1 and 2 B 3.8.3-4 Revision No. 115 Diesel Fuel Oil and Starting Air B 3.8.3 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| : c. Verify that the new fuel oil has a clear and bright appearance with proper color when tested in accordance with ASTM D4176 (Ref. 7)or a water and sediment content within limits when tested in accordance with ASTM D2709 (Ref. 7); and d. Verify that the new fuel oil has an absolute specific gravity at 60 /60'F of > 0.83 and < 0.89 when tested in accordance with ASTM D1298 or an API gravity at 60OF of_> 270 and < 390 when tested in accordance with ASTM D287 (Ref.7).Failure to meet any of the above limits, except for clear and bright, is cause for rejecting the fuel oil, but does not represent a failure to meet the LCO concern since the fuel oil is not added to the storage tanks. If the fuel oil fails on clear and bright, it may be accepted if it passes water and sediment.
| |
| The specifications for water and sediment recognize that a small amount of water and sediment is acceptable.
| |
| Thus, this test may be used after a clear and bright test to provide a more quantitative result.Within 31 days following the initial new fuel oil sample, the fuel oil is analyzed to establish that the other properties specified in Table 1 of ASTM D975 (Ref. 7) are met for new fuel oil when tested in accordance with ASTM D975 (Ref. 7), except that the analysis for sulfur may be performed in accordance with ASTM D5453 (Ref. 7), D3120 (Ref. 7) or ASTM D2622 (Ref. 7). The 31 day period is acceptable because the fuel oil properties of interest, even if they were not within stated limits, would not have an immediate effect on DG operation.
| |
| This Surveillance ensures the availability of high quality fuel oil for the DGs.Fuel oil degradation during long term storage shows up as an increase in particulate, due mostly to oxidation.
| |
| The presence of particulate does not mean the fuel oil will not burn properly in a diesel engine. The particulate can cause fouling of filters and fuel oil injection equipment, however, which can cause engine failure.Particulate concentrations should be determined based on ASTM D6217 (Ref. 7). This test method is used for assessing the mass quantity of particulates in middle distillate fuels, which includes 2-D diesel fuel. This method involves a gravimetric determination of total particulate concentration in the fuel oil and has a limit of 10 mg/l. For those designs in which the total stored fuel oil volume is contained in two or more interconnected tanks, each tank must be considered and tested separately.
| |
| The Frequency of this test takes into consideration fuel oil degradation trends that indicate that particulate concentration is unlikely to change significantly between Frequency intervals.
| |
| McGuire Units 1 and 2 B 3.8.3-5 Revision No. 115 Diesel Fuel Oil and Starting Air B 3.8.3 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.8.3.3 This Surveillance ensures that, without the aid of the refill compressor, sufficient air start capacity for each DG is available.
| |
| The system design requirements provide for a minimum of five engine start cycles without recharging.
| |
| A start cycle is defined as the period of time required to reach 95% speed from standby prelubed condition.
| |
| The pressure specified in this SR is intended to reflect a conservative value at which a single fast start and five total starts can be accomplished.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.8.3.4 Microbiological fouling is a major cause of fuel oil degradation.
| |
| There are numerous bacteria that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive. Removal of water from the fuel storage tanks eliminates the necessary environment for bacterial survival.
| |
| This is the most effective means of controlling microbiological fouling. In addition, it eliminates the potential for water entrainment in the fuel oil during DG operation.
| |
| Water may come from any of several sources, including condensation, ground water, rain water, and contaminated fuel oil, and from breakdown of the fuel oil by bacteria.Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program. This SR is for preventive maintenance.
| |
| The presence of water does not necessarily represent failure of this SR, provided the accumulated water is removed during performance of the Surveillance.
| |
| McGuire Units 1 and 2 B 3.8.3-6 Revision No. 115 Diesel Fuel Oil and Starting Air B 3.8.3 BASES REFERENCES I.2.3.4.5.6.7.8.9.UFSAR, Section 8.3.1.1.7.
| |
| Regulatory Guide 1.137.ANSI N195-1976, Appendix B.UFSAR, Chapter 6.UFSAR, Chapter 15.10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| ASTM Standards:
| |
| D4057; D975; D1298; D4176; D2709; D6217;D2622; D287; D5453; and D3120.UFSAR, Section 18.2.4, Chemistry Control Program.McGuire License Renewal Commitments MCS-1274.00-00-0016, Section 4.6, Chemistry Control Program.McGuire Units 1 and 2 B 3.8.3-7 Revision No. 115 DC Sources-Operating B 3.8.4 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.4 DC Sources-Operating BASES BACKGROUND The station DC electrical power system provides the AC emergency power system with control power. It also provides both motive and control power to selected safety related equipment and preferred AC vital bus power (via inverters).
| |
| As required by 10 CFR 50, Appendix A, GDC 17 (Ref. 1), the DC electrical power system is designed to have sufficient independence, redundancy, and testability to perform its safety functions, assuming a single failure. The DC electrical power system also conforms to the recommendations of Regulatory Guide 1.6 (Ref. 2) and IEEE-308 (Ref. 3).The 125 VDC electrical power system consists of two independent and redundant safety related Class 1 E DC electrical power subsystems (Train A and Train B). Each subsystem consists of two channels of 125 VDC batteries (each battery 100% capacity), the associated battery charger(s) for each battery, and all the associated control equipment and interconnecting cabling.Additionally there is one spare battery charger, which provides backup service in the event that the preferred battery charger is out of service. If the spare battery charger is substituted for one of the preferred battery chargers, then the requirements of independence and redundancy between subsystems are maintained.
| |
| During normal operation, the 125 VDC load is powered from the battery chargers with the batteries floating on the system. In case of loss of normal power to the battery charger, the DC load is automatically powered from the station batteries.
| |
| The Train A and Train B DC electrical power subsystems provide the control power for its associated Class 1 E AC power load group, 4.16 kV switchgear, and 600 V load centers. The DC electrical power subsystems also provide DC electrical power to the inverters, which in turn power the AC vital buses.The DC power distribution system is described in more detail in Bases for LCO 3.8.9, "Distribution System-Operating," and LCO 3.8.10,"Distribution Systems-Shutdown." McGuire Units 1 and 2 B 3.8.4-1 Revision No. 115 DC Sources-Operating B 3.8.4 BASES BACKGROUND (continued)
| |
| Each battery (EVCA, EVCB, EVCC, EVCD) has adequate storage capacity to carry the required duty cycle for one hour after the loss of the battery charger output. In addition, the battery is capable of supplying power for the operation of anticipated momentary loads during the one hour period.Each 125 VDC battery is separately housed in a ventilated room apart from its charger and distribution centers. Each channel is located in an area separated physically and electrically from the other channel to ensure that a single failure in one subsystem does not cause a failure in a redundant subsystem.
| |
| There is no sharing between redundant Class 1 E subsystems, such as batteries, battery chargers, or distribution panels.The batteries for the channels of DC are sized to produce required capacity at 80% of nameplate rating, corresponding to warranted capacity at end of life cycles and the 100% design demand. Battery size is based on 125% of required capacity and, after selection of an available commercial battery, results in a battery capacity in excess of 150% of required capacity.
| |
| The individual cell voltage limit is 2.13 V per cell. The minimum battery terminal voltage limit is greater than or equal to 125 V while on float charge as discussed in the UFSAR, Chapter 8 (Ref. 4).The criteria for sizing large lead storage batteries are defined in IEEE-485 (Ref. 5).Each channel of DC has ample power output capacity for the steady state operation of connected loads required during normal operation, while at the same time maintaining its battery bank fully charged. Each battery charger also has sufficient capacity to restore the battery from the design minimum charge to its fully charged state within 8 hours while supplying normal steady state loads discussed in the UFSAR, Chapter 8 (Ref. 4).APPLICABLE The initial conditions of Design Basis Accident (DBA) and transient SAFETY ANALYSES analyses in the UFSAR, Chapter 6 (Ref. 6), and in the UFSAR, Chapter 15 (Ref. 7), assume that Engineered Safety Feature (ESF)systems are OPERABLE.The OPERABILITY of the DC sources is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit. This includes maintaining the DC sources OPERABLE during accident conditions in the event of: McGuire Units 1 and 2 B 3.8.4-2 Revision No. 115 DC Sources-Operating B 3.8.4 BASES APPLICABLE SAFETY ANALYSES (continued)
| |
| : a. An assumed loss of all offsite AC power or all onsite AC power; and b. A worst case single failure.The DC sources satisfy Criterion 3 of 10 CFR 50.36 (Ref. 8).LCO Each DC channel consisting of one battery, battery charger for each battery and the corresponding control equipment and interconnecting cabling supplying power to the associated bus within the train is required to be OPERABLE to ensure the availability of the required power to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence (AOO) or a postulated DBA. Loss of any channel of DC does not prevent the minimum safety function from being performed (Ref. 4).An OPERABLE channel of DC requires the battery and respective charger to be operating and connected to the associated DC bus.APPLICABILITY The DC electrical power sources are required to be OPERABLE in MODES 1, 2, 3, and 4 to ensure safe unit operation and to ensure that: a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients; and b. Adequate core cooling is provided, and containment integrity and other vital functions are maintained in the event of a postulated DBA.The DC electrical power requirements for MODES 5 and 6 are addressed in the Bases for LCO 3.8.5, "DC Sources- Shutdown." ACTIONS A.1 and A.2 Condition A represents one channel of DC with a loss of ability to fully respond to a DBA with the worst case single failure. Two hours is provided to restore the channel of DC to OPERABLE status and is consistent with the allowed time for an inoperable channel of DC distribution system requirement.
| |
| i McGuire Units 1 and 2 B 3.8.4-3 Revision No. 115 DC Sources-Operating B 3.8.4 BASES ACTIONS (continued)
| |
| If one of the required channels of DC is inoperable (e.g., inoperable battery, inoperable battery charger(s), or inoperable battery charger and associated inoperable battery), the remaining DC channels have the capacity to support a safe shutdown and to mitigate an accident condition.
| |
| If the channel of DC cannot be restored to OPERABLE status, Action A.2 must be entered and the DC channel must be energized from an OPERABLE channel, from the same train, within 2 hours. The capacity of the redundant channel is sufficient to supply its normally supplied channel and cross tied channel for the required time, in case of a DBA event. The inoperable channel of DC must be returned to OPERABLE status within 72 hours and the cross ties to the other channel open. The 72 hour Completion Time reflects a reasonable time to assess unit status as a function of the inoperable channel of DC and, if the DC channel is not restored to OPERABLE status, to prepare to effect an orderly and safe unit shutdown.B.1 and B.2 If the inoperable channel of DC cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging plant systems.The Completion Time to bring the unit to MODE 5 is consistent with the time required in Regulatory Guide 1.93 (Ref. 9).SURVEILLANCE SR 3.8.4.1 REQUIREMENTS Verifying battery terminal voltage while on float charge for the batteries helps to ensure the effectiveness of the charging system and the ability of the batteries to perform their intended function.
| |
| Float charge is the condition in which the charger is supplying the continuous charge required to overcome the internal losses of a battery (or battery cell) and maintain the battery (or a battery cell) in a fully charged state. The voltage requirements are based on the nominal design voltage of the battery and are consistent with the initial voltages assumed in the battery sizing calculations.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Units 1 and 2 B 3.8.4-4 Revision No. 115 DC Sources-Operating B 3.8.4 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.8.4.2 Visual inspection to detect corrosion of the battery cells and connections, or measurement of the resistance of each intercell, interrack, intertier, and terminal connection, provides an indication of physical damage or abnormal deterioration that could potentially degrade battery performance.
| |
| For any connection that shows corrosion, the resistance shall be measured at that connection to verify acceptable connection resistance (Ref. 10). The limits for battery connection resistance are specified in Table 3.8.4-1.The plant safety analyses do not assume a specific battery connection resistance value, but typically assume that the batteries will supply adequate power for a specified period of time. The resistance of each battery connection varies independently from all the others. Some of these individual connection resistance values may be higher or lower than the others, and the battery will still be able to perform its design function.Overall connection resistance, which is the sum total of all connection resistances, has a direct impact on battery operability.
| |
| The values listed in Table 3.8.4-1 are based on the battery manufacturers recommended connection voltage drop. As long as battery connection resistance values are at or below the values listed in Table 3.8.4-1, battery operability will not be in question based on intercell, interrack, intertier, and terminal connection resistance.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.8.4.3 Visual inspection of the battery cells, cell plates, and battery racks provides an indication of physical damage or abnormal deterioration that could potentially degrade battery performance.
| |
| The presence of physical damage or deterioration does not necessarily represent a failure of this SR, provided an evaluation determines that the physical damage or deterioration does not affect the OPERABILITY of the battery (its ability to perform its design function).
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Units 1 and 2 B 3.8.4-5 Revision No. 115 DC Sources-Operating B 3.8.4 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.8.4.4 and SR 3.8.4.5 Visual inspection and resistance measurements of intercell, interrack, intertier, terminal connections, and the average intercell connection resistance provide an indication of physical damage or abnormal deterioration that could indicate degraded battery condition.
| |
| The limits for battery connection resistance are specified in Table 3.8.4-1. Single terminal connection resistance is defined as the measurement from each individual load cable lug to the battery cell post. Average intercell connection resistance is defined as the battery manufacturer's maximum allowed intercell connection voltage drop divided by the maximum battery duty cycle load current. The maximum allowable battery total intercell connection resistance can then be defined as the average intercell connection resistance times the total number of intercell connectors in the battery string. Intercell connection is referring to the 56 copper connection straps between the battery jar posts and the battery terminal connections.
| |
| The plant safety analyses do not assume a specific battery connection resistance value, but typically assume that the batteries will supply adequate power for a specified period of time. The resistance of each battery connection varies independently from all the others. Some of these individual connection resistance values may be higher or lower than the others, and the battery will still be able to perform its design function.Overall connection resistance, which is the sum total of all connection resistances, has a direct impact on battery operability.
| |
| The values listed in Table 3.8.4-1 are based on the battery manufacturers recommended connection voltage drop. As long as battery connection resistance values are at or below the values listed in Table 3.8.4-1, battery operability will not be in question based on intercell, interrack, intertier, and terminal connection resistance.
| |
| The anticorrosion material is used to help ensure good electrical connections and to reduce terminal deterioration.
| |
| The visual inspection for corrosion is not intended to require removal of and inspection under each terminal connection.
| |
| The removal of visible corrosion is a preventive maintenance SR. The presence of visible corrosion does not necessarily represent a failure of this SR provided visible corrosion is removed during performance of SR 3.8.4.4. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Units 1 and 2 B 3.8.4-6 Revision No. 115 DC Sources-Operating B 3.8.4 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| SR 3.8.4.6 This SR requires that each battery charger be capable of supplying 400 amps and 125 V for > 1 hour. These requirements are based on the design requirements of the chargers.
| |
| According to Regulatory Guide 1.32 (Ref. 11), the battery charger supply is required to be based on the largest combined demands of the various steady state loads and the charging capacity to restore the battery from the design minimum charge state to the fully charged state, irrespective of the status of the unit during these demand occurrences.
| |
| The minimum required amperes and duration ensures that these requirements can be satisfied.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.8.4.7 A battery service test is a special test of battery capability, as found, to satisfy the design requirements (battery duty cycle) of the DC electrical power system. The discharge rate and test length of 1 hour should correspond to the design duty cycle requirements as specified in Reference 4.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.This SR is modified by a Note. The Note allows the performance of a modified performance discharge test in lieu of a service test.The modified performance discharge test, as defined by IEEE-450 (Ref. 12)is a simulated duty cycle consisting of just two rates; the one minute rate published for the battery or the largest current load of the duty cycle, followed by the test rate employed for the performance test, both of which envelope the duty cycle of the service test. Since the ampere-hours removed by a rated one minute discharge represents a very small portion of the battery capacity, the test rate can be changed to that for the performance test without compromising the results of the performance discharge test. The battery terminal voltage for the modified performance discharge test should remain above the minimum battery terminal voltage specified in the battery service test for the duration of time equal to that of the service test.McGuire Units 1 and 2 B 3.8.4-7 Revision No. 115 DC Sources-Operating B 3.8.4 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| A modified discharge test is a test of the battery capacity and its ability to provide a high rate, short duration load (usually the highest rate of the duty cycle). This will often confirm the battery's ability to meet the critical period of the load duty cycle, in addition to determining its percentage of rated capacity.
| |
| Initial conditions for the modified performance discharge test should be identical to those specified for a service test.SR 3.8.4.8 A battery performance discharge test is a test of constant current capacity of a battery, normally done in the as found condition, after having been in service, to detect any change in the capacity determined by the acceptance test. The test is intended to determine overall battery degradation due to age and usage.A battery modified performance discharge test is described in the Bases for SR 3.8.4.7 and in IEEE-450 (Ref. 12). Either the battery performance discharge test or the modified performance discharge test is acceptable for satisfying SR 3.8.4.8; however, only the modified performance discharge test may be used to satisfy SR 3.8.4.8 while satisfying the requirements of SR 3.8.4.7 at the same time.The acceptance criteria for this Surveillance are consistent with IEEE-450 (Ref. 12). These references recommend that the battery be replaced if its capacity is below 80% of the manufacturer's rating. A capacity of 80%shows that the battery rate of deterioration is increasing, even if there is ample capacity to meet the load requirements.
| |
| If the battery shows degradation, or if the battery has reached 85% of its expected life and capacity is < 100% of the manufacturer's rating, the Surveillance Frequency is reduced to 12 months. However, if the battery shows no degradation but has reached 85% of its expected life, the Surveillance Frequency is only reduced to 24 months for batteries that retain capacity 2! 100% of the manufacturer's rating. Degradation is indicated, according to IEEE-450 (Ref. 10), when the battery capacity drops by more than 10% relative to its capacity on the previous performance test or when it is >_ 10% below the manufacturer's rating. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Units 1 and 2 B 3.8.4-8 Revision No. 115 DC Sources-Operating B 3.8.4 BASES REFERENCES 1.2.3.4.5.6.7.8.9.10.11.12.10 CFR 50, Appendix A, GDC 17.Regulatory Guide 1.6, March 10, 1971.IEEE-308-1971.
| |
| UFSAR, Chapter 8.IEEE-485-1983, June 1983.UFSAR, Chapter 6.UFSAR, Chapter 15.10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| Regulatory Guide 1.93, December 1974.IEEE-450-1995.
| |
| Regulatory Guide 1.32, February 1977.IEEE-450-1980.
| |
| McGuire Units 1 and 2 B 3.8.4-9 Revision No. 115 DC Sources -Shutdown B 3.8.5 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.5 DC Sources-Shutdown BASES BACKGROUND A description of the DC sources is provided in the Bases for LCO 3.8.4,"DC Sources-Operating." APPLICABLE SAFETY ANALYSES The initial conditions of Design Basis Accident and transient analyses in in the UFSAR, Chapter 6 (Ref. 1) and Chapter 15 (Ref. 2), assume that Engineered Safety Feature systems are OPERABLE.
| |
| The DC electrical power system provides normal control and switching during all MODES of operation.
| |
| The OPERABILITY of the DC subsystems is consistent with the initial assumptions of the accident analyses and the requirements for the supported systems' OPERABILITY.
| |
| The OPERABILITY of the minimum DC electrical power sources during MODES 5 and 6 and during movement of irradiated fuel assemblies ensures that: a. The unit can be maintained in the shutdown or refueling condition for extended periods;b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and c. Adequate DC electrical power is provided to mitigate events postulated during shutdown, such as a fuel handling accident.The DC sources satisfy Criterion 3 of 10 CFR 50.36 (Ref. 3).LCO The DC electrical power subsystems, with 1) at least one subsystem consisting of two channels of DC; and 2) when the redundant train of DC electrical power distribution subsystem is required by LCO 3.8.10, the other subsystem consisting of either a battery or a charger, and 3) the corresponding control equipment and interconnecting cabling within the channel, are required to be OPERABLE to support required channels of the distribution systems required OPERABLE by LCO 3.8.10, "Distribution McGuire Units 1 and 2 B 3.8.5-1 Revision No. 41 DC Sources -Shutdown B 3.8.5 BASES LCO (continued)
| |
| Systems-Shutdown." This ensures the availability of sufficient DC electrical power sources to operate the unit in a safe manner and to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents).
| |
| APPLICABILITY The channel of DC sources required to be OPERABLE in MODES 5 and 6, and during movement of irradiated fuel assemblies, provide assurance that: a. Required features to provide adequate coolant inventory makeup are available for the irradiated fuel assemblies in the core;b. Required features needed to mitigate a fuel handling accident are available;
| |
| : c. Required features necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.
| |
| The DC electrical power requirements for MODES 1, 2, 3, and 4 are covered in LCO 3.8.4.ACTIONS A.1, A.2.1. A.2.2. A.2.3, and A.2.4 If two trains are required by LCO 3.8.10, the remaining train with DC power available may be capable of supporting sufficient systems to allow continuation of CORE ALTERATIONS and fuel movement.
| |
| By allowing the option to declare required features inoperable with the associated DC power source(s) inoperable, appropriate restrictions will be implemented in accordance with the affected required features LCO ACTIONS. In many instances, this option may involve undesired administrative efforts.Therefore, the allowance for sufficiently conservative actions is made (i.e., to suspend CORE ALTERATIONS, movement of irradiated fuel assemblies, operations involving positive reactivity additions), that could result in loss of required SDM (Mode 5) or required boron concentration (Mode 6). Suspending positive reactivity additions that could result in failure to meet the minimum SDM or boron concentration limits is required to assure continued safe operation.
| |
| Introduction of coolant inventory must be from sources that have a boron concentration greater than that what would be required in the RCS for minimum SDM or refueling boron concentration.
| |
| This may result in an overall reduction in RCS boron McGuire Units 1 and 2 B 3.8.5-2 Revision No. 41 DC Sources -Shutdown B 3.8.5 BASES ACTIONS (continued) concentration, but provides acceptable margin to maintaining subcritical operation.
| |
| Introduction of temperature changes including temperature increases when operating with a positive MTC must also be evaluated to ensure they do not result in a loss of required SDM.Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition.
| |
| These actions minimize probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required DC sources and to continue this action until restoration is accomplished in order to provide the necessary DC electrical power to the unit safety systems.The Completion Time of immediately is consistent with the required times for actions requiring prompt attention.
| |
| The restoration of the required DC sources should be completed as quickly as possible in order to minimize the time during which the unit safety systems may be without sufficient power.SURVEILLANCE SR 3.8.5.1 REQUIREMENTS SR 3.8.5.1 requires performance of all Surveillances required by SR 3.8.4.1 through SR 3.8.4.8. Therefore, see the corresponding Bases for LCO 3.8.4 for a discussion of each SR.This SR is modified by a Note. The reason for the Note is to preclude requiring the OPERABLE DC sources from being discharged below their capability to provide the required power supply or otherwise rendered inoperable during the performance of SRs. It is the intent that these SRs must still be capable of being met, but actual performance is not required.REFERENCES
| |
| : 1. UFSAR, Chapter 6.2. UFSAR, Chapter 15.3. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.8.5-3 Revision No. 41
| |
| | |
| Battery Cell Parameters B 3.8.6 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.6 Battery Cell Parameters BASES BACKGROUND This LCO delineates the limits on electrolyte temperature, level, float voltage, and specific gravity for the DC power source batteries.
| |
| A discussion of these batteries and their OPERABILITY requirements is provided in the Bases for LCO 3.8.4, "DC Sources-Operating," and LCO 3.8.5, "DC Sources-Shutdown." APPLICABLE The initial conditions of Design Basis Accident (DBA) and transient SAFETY ANALYSES analyses in the UFSAR, Chapter 6 (Ref. 1) and Chapter 15 (Ref. 2), assume Engineered Safety Feature systems are OPERABLE.
| |
| The DC electrical power system provides normal and emergency DC electrical power for the diesel generators, emergency auxiliaries, and control and switching during all MODES of operation.
| |
| The OPERABILITY of the DC subsystems is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit. This includes maintaining at least one train of DC sources OPERABLE during accident conditions, in the event of: a. An assumed loss of all offsite AC power or all onsite AC power; and b. A worst case single failure.Battery cell parameters satisfy the Criterion 3 of 10 CFR 50.36 (Ref. 3).LCO Battery cell parameters must remain within acceptable limits to ensure availability of the required DC power to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence or a postulated DBA. Electrolyte limits are conservatively established, allowing continued DC electrical system function even with Category A and B limits not met.APPLICABILITY The battery cell parameters are required solely for the support of the associated DC electrical power subsystems.
| |
| Therefore, battery electrolyte is only required when the DC power source is required to be OPERABLE.
| |
| Refer to the Applicability discussion in Bases for LCO 3.8.4 and LCO 3.8.5.McGuire Units 1 and 2 B 3.8.6-1 Revision No. 115 Battery Cell Parameters B 3.8.6 BASES ACTIONS A.1, A.2, and A.3 With one or more cells in one or more batteries not within limits (i.e., Category A limits not met, Category B limits not met, or Category A and B limits not met) but within the Category C limits specified in Table 3.8.6-1 in the accompanying LCO, the battery is degraded but there is still sufficient capacity to perform the intended function.
| |
| Therefore, the affected battery is not required to be considered inoperable solely as a result of Category A or B limits not met and operation is permitted for a limited period.The pilot cell electrolyte level and float voltage are required to be verified to meet the Category C limits within 1 hour (Required Action A.1). This check will provide a quick indication of the status of the remainder of the battery cells. One hour provides time to inspect the electrolyte level and to confirm the float voltage of the pilot cells. One hour is considered a reasonable amount of time to perform the required verification.
| |
| Verification that the Category C limits are met (Required Action A.2)provides assurance that during the time needed to restore the parameters to the Category A and B limits, the battery is still capable of performing its intended function.
| |
| A period of 24 hours is allowed to complete the initial verification because specific gravity measurements must be obtained for each connected cell. Taking into consideration both the time required to perform the required verification and the assurance that the battery cell parameters are not severely degraded, this time is considered reasonable.
| |
| The verification is repeated at 7 day intervals until the parameters are restored to Category A or B limits. This periodic verification is consistent with the normal Frequency of pilot cell Surveillances.
| |
| Continued operation is only permitted for 31 days before battery cell parameters must be restored to within Category A and B limits. With the consideration that, while battery capacity is degraded, sufficient capacity exists to perform the intended function and to allow time to fully restore the battery cell parameters to normal limits, this time is acceptable prior to declaring the battery inoperable.
| |
| B.1 With one or more batteries with one or more battery cell parameters outside the Category C limit for any connected cell, sufficient capacity to supply the maximum expected load requirement is not assured and the corresponding DC electrical power subsystem must be declared inoperable.
| |
| Additionally, other potentially extreme conditions, such as not McGuire Units 1 and 2 B 3.8.6-2 Revision No. 115 Battery Cell Parameters B 3.8.6 BASES ACTIONS (continued) completing the Required Actions of Condition A within the required Completion Time or average electrolyte temperature of representative cells falling below 60 0 F, are also cause for immediately declaring the associated DC electrical power subsystem inoperable.
| |
| SURVEILLANCE SR 3.8.6.1 REQUIREMENTS This SR verifies that Category A battery cell parameters are consistent with IEEE-450 (Ref. 4), which recommends regular battery inspections including voltage, specific gravity, and electrolyte temperature of pilot cells. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.8.6.2 The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program. In addition, within 7 days of a battery discharge
| |
| < 110 V or a battery overcharge
| |
| > 150 V, the battery must be demonstrated to meet Category B limits. Transients, such as motor starting transients, which may momentarily cause battery voltage to drop to < 110 V, do not constitute a battery discharge provided the battery terminal voltage and float current return to pre-transient values. This inspection is also consistent with IEEE-450 (Ref. 4), which recommends special inspections following a severe discharge or overcharge, to ensure that no significant degradation of the battery occurs as a consequence of such discharge or overcharge.
| |
| SR 3.8.6.3 The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.Lower than normal temperatures act to inhibit or reduce battery capacity.This SR ensures that the operating temperatures remain within an acceptable operating range. This limit is based on manufacturer recommendations.
| |
| The term "representative cells" replaces the fixed number of "six connected cells", consistent with the recommendations of IEEE-450 (Ref.4) to provide a general guidance to the number of cells adequate to McGuire Units I and 2 B 3.8.6-3 Revision No. 115 Battery Cell Parameters B 3.8.6 BASES SURVEILLANCE REQUIREMENTS (continued) monitor the temperature of the battery cells as an indicator of satisfactory performance.
| |
| For some cases, the number of cells may be less than six, in other conditions, the number may be more.Table 3.8.6-1 This table delineates the limits on electrolyte level, float voltage, and specific gravity for three different categories.
| |
| The meaning of each category is discussed below.Category A defines the normal parameter limit for each designated pilot cell in each battery. The cells selected as pilot cells are those whose temperature, voltage, and electrolyte specific gravity approximate the state of charge of the entire battery.The Category A limits specified for electrolyte level are based on manufacturer recommendations and are consistent with the guidance in IEEE-450 (Ref. 4), with the extra 1/4 inch allowance above the high water level indication for operating margin to account for temperatures and charge effects. In addition to this allowance, footnote a to Table 3.8.6-1 permits the electrolyte level to be above the specified maximum level during equalizing charge, provided it is not overflowing.
| |
| These limits ensure that the plates suffer no physical damage, and that adequate electron transfer capability is maintained in the event of transient conditions.
| |
| IEEE-450 (Ref. 4) recommends that electrolyte level readings should be made only after the battery has been at float charge for at least 72 hours.The Category A limit specified for float voltage is > 2.13 V per cell. This value is based on the recommendations of IEEE-450 (Ref. 4), which states that prolonged operation of cells < 2.13 V can reduce the life expectancy of cells.The Category A limit specified for specific gravity for each pilot cell is>_ 1.200 (0.015 below the manufacturer fully charged nominal specific gravity or a battery charging current that had stabilized at a low value).This value is characteristic of a charged cell with adequate capacity.According to IEEE-450 (Ref. 4), the specific gravity readings are based on a temperature of 77 0 F (25 0 C).McGuire Units 1 and 2 B 3.8.6-4 Revision No. 115 Battery Cell Parameters B 3.8.6 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| The specific gravity readings are corrected for actual electrolyte temperature and level. For each 3 0 F (1.67 0 C) above 77 0 F (25 0 C), 1 point (0.001) is added to the reading; 1 point is subtracted for each 3 0 F below 770F. The specific gravity of the electrolyte in a cell increases with a loss of water due to electrolysis or evaporation.
| |
| Category B defines the normal parameter limits for each connected cell.The term "connected cell" excludes any battery cell that may be jumpered out.The Category B limits specified for electrolyte level and float voltage are the same as those specified for Category A and have been discussed above. The Category B limit specified for specific gravity for each connected cell is > 1.195 (0.020 below the manufacturer fully charged, nominal specific gravity) with the average of all connected cells > 1.205 (0.010 below the manufacturer fully charged, nominal specific gravity).These values are based on manufacturer's recommendations.
| |
| The minimum specific gravity value required for each cell ensures that the effects of a highly charged or newly installed cell will not mask overall degradation of the battery.Category C defines the limits for each connected cell. These values, although reduced, provide assurance that sufficient capacity exists to perform the intended function and maintain a margin of safety. When any battery parameter is outside the Category C limits, the assurance of sufficient capacity described above no longer exists, and the battery must be declared inoperable.
| |
| The Category C limits specified for electrolyte level (above the top of the plates and not overflowing) ensure that the plates suffer no physical damage and maintain adequate electron transfer capability.
| |
| The Category C limits for float voltage is based on IEEE-450 (Ref. 4), which states that a cell voltage of 2.07 V or below, under float conditions and not caused by elevated temperature of the cell, indicates internal cell problems and may require cell replacement.
| |
| The Category C limit of average specific gravity > 1.195 is based on manufacturer recommendations (0.020 below the manufacturer recommended fully charged, nominal specific gravity).
| |
| In addition to that limit, it is required that the specific gravity for each connected cell must be no less than 0.020 below the average of all connected cells. This limit ensures that the effect of a highly charged or new cell does not mask overall degradation of the battery.McGuire Units 1 and 2 B 3.8.6-5 Revision No. 115 Battery Cell Parameters B 3.8.6 BASES SURVEILLANCE REQUIREMENTS (continued)
| |
| The footnotes to Table 3.8.6-1 are applicable to Category A, B, and C specific gravity. Footnote (b) to Table 3.8.6-1 requires the above mentioned correction for electrolyte level and temperature, with the exception that level correction is not required when battery charging current is < 2 amps on float charge. This current provides, in general, an indication of overall battery condition.
| |
| Because of specific gravity gradients that are produced during the recharging process, delays of several days may occur while waiting for the specific gravity to stabilize.
| |
| A stabilized charger current is an acceptable alternative to specific gravity measurement for determining the state of charge. This phenomenon is discussed in IEEE-450 (Ref. 4).Footnote (c) to Table 3.8.6-1 allows the float charge current to be used as an alternate to specific gravity for up to 7 days following a battery recharge.
| |
| Within 7 days, each connected cell's specific gravity must be measured to confirm the state of charge. Following a minor battery recharge (such as equalizing charge that does not follow a deep discharge) specific gravity gradients are not significant, and confirming measurements may be made in less than 7 days.The value of 2 amps used in footnote (b) and (c) is the nominal value for float current established by the battery vendor as representing a fully charged battery with an allowance for overall battery condition.
| |
| REFERENCES
| |
| : 1. UFSAR, Chapter 6.2. UFSAR, Chapter 15.3. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| : 4. IEEE-450-1980.
| |
| McGuire Units 1 and 2 B 3.8.6-6 Revision No. 115
| |
| | |
| Inverters-Operating B 3.8.7 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.7 Inverters-Operating BASES BACKGROUND The inverters are the preferred source of power for the AC vital buses because of the stability and reliability they achieve. The function of the inverter is to provide AC electrical power to the vital buses. The inverters can be powered from a station battery charger or from the station battery. The station battery provides an uninterruptible power source for the instrumentation and controls for the Reactor Protective System (RPS) and the Engineered Safety Feature Actuation System (ESFAS). Specific details on inverters and their operating characteristics are found in the UFSAR, Chapter 8 (Ref. 1).APPLICABLE The initial conditions of Design Basis Accident (DBA) and transient SAFETY ANALYSES analyses in the UFSAR, Chapter 6 (Ref. 2) and Chapter 15 (Ref. 3), assume Engineered Safety Feature systems are OPERABLE.
| |
| The inverters are designed to provide the required capacity, capability, redundancy, and reliability to ensure the availability of necessary power to the RPS and ESFAS instrumentation and controls so that the fuel, Reactor Coolant System, and containment design limits are not exceeded.
| |
| These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution Limits; Section 3.4, Reactor Coolant System (RCS); and Section 3.6, Containment Systems.The OPERABILITY of the inverters is consistent with the initial assumptions of the accident analyses and is based on meeting the design basis of the unit. This includes maintaining required AC vital buses OPERABLE during accident conditions in the event of: a. An assumed loss of all offsite AC electrical power or all onsite AC electrical power; and b. A worst case single failure.McGuire Units 1 and 2 B 3.8.7-1 Revision No. 115 Inverters-Operating B 3.8.7 BASES SAFETY ANALYSES (continued)
| |
| Inverters are a part of the distribution system and, as such, satisfy Criterion 3 of 10 CFR 50.36 (Ref. 4).LCO The inverters ensure the availability of AC electrical power for the systems instrumentation required to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence (AOO) or a postulated DBA.Maintaining the required inverters OPERABLE ensures that the redundancy incorporated into the design of the RPS and ESFAS instrumentation and controls is maintained.
| |
| The four inverters (two per train) ensure an uninterruptible supply of AC electrical power to the AC vital buses even if the 4.16 kV safety buses are de-energized.
| |
| Operable inverters require the associated vital bus to be powered by the inverter with output voltage and frequency within tolerances, and power input to the inverter from a 125 VDC station battery.APPLICABILITY The inverters are required to be OPERABLE in MODES 1, 2, 3, and 4 to ensure that: a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients; and b. Adequate core cooling is provided, and containment OPERABILITY and other vital functions are maintained in the event of a postulated DBA.Inverter requirements for MODES 5 and 6 are covered in the Bases for LCO 3.8.8, "lnverters-Shutdown." ACTIONS A..1 With a required inverter inoperable, its associated AC vital bus becomes inoperable until it is manually re-energized from its voltage regulated transformer.
| |
| For this reason a Note has been included in Condition A requiring the entry into the Conditions and Required Actions of LCO 3.8.9,"Distribution Systems-Operating." This ensures that the vital bus is re-energized within 2 hours.McGuire Units 1 and 2 B 3.8.7-2 Revision No. 115 Inverters-Operating B 3.8.7 BASES ACTIONS (continued)
| |
| Required Action A.1 allows 24 hours to fix the inoperable inverter and return it to service. The 24 hour limit is based upon engineering judgment, taking into consideration the time required to repair an inverter and the additional risk to which the unit is exposed because of the inverter inoperability.
| |
| This has to be balanced against the risk of an immediate shutdown, along with the potential challenges to safety systems such a shutdown might entail. When the AC vital bus is powered from its regulated voltage transformer, it is relying upon interruptible AC electrical power sources (offsite and onsite).The uninterruptible inverter source to the AC vital buses is the preferred source for powering instrumentation trip setpoint devices.B.1 and B.2 If the inoperable devices or components cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging plant systems.SURVEILLANCE SR 3.8.7.1 REQUIREMENTS This Surveillance verifies that the inverters are functioning properly with all required circuit breakers closed and AC vital bus energized from the inverter.
| |
| The verification of proper voltage output ensures that the required power is readily available for the instrumentation of the RPS and ESFAS connected to the AC vital buses. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. UFSAR, Chapter 8.2. UFSAR, Chapter 6.3. UFSAR, Chapter 15.4. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.8.7-3 Revision No. 115 Inverters-Shutdown B 3.8.8 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.8 Inverters-.Shutdown BASES BACKGROUND A description of the inverters is provided in the Bases for LCO 3.8.7,"lnverters-Operating." APPLICABLE SAFETY ANALYSES The initial conditions of Design Basis Accident (DBA) and transient analyses in the UFSAR, Chapter 6 (Ref. 1) and Chapter 15 (Ref. 2), assume Engineered Safety Feature systems are OPERABLE.
| |
| The DC to AC inverters are designed to provide the required capacity, capability, redundancy, and reliability to ensure the availability of necessary power to the Reactor Protective System and Engineered Safety Features Actuation System instrumentation and controls so that the fuel, Reactor Coolant System, and containment design limits are not exceeded.The OPERABILITY of the inverters is consistent with the initial assumptions of the accident analyses and the requirements for the supported systems' OPERABILITY.
| |
| The OPERABILITY of the minimum inverters to each AC vital bus during MODES 5 and 6 ensures that: a. The unit can be maintained in the shutdown or refueling condition for extended periods;b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and c. Adequate power is available to mitigate events postulated during shutdown, such as a fuel handling accident.The inverters were previously identified as part of the distribution system and, as such, satisfy Criterion 3 of 10 CFR 50.36 (Ref. 3).LCO The inverters ensure the availability of electrical power for the instrumentation for systems required to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence or a postulated DBA. At least two AC vital buses on one train energized by their associated battery powered inverters provide uninterruptible supply of AC electrical power to associated loads even if the 4.16 kV McGuire Units 1 and 2 B 3.8.8-1 Revision No. 115 Inverters
| |
| -Shutdown B 3.8.8 BASES LCO (continued) safety buses are de-energized.
| |
| OPERABILITY of the inverters requires that the AC vital bus be powered by the inverter.
| |
| When the redundant train of class 1 E AC vital bus electrical power distribution subsystem is required by LCO 3.8.10, the power source for these AC vital buses may consist of 1) the associated inverter powered by its associated battery; or 2) the regulated voltage transformer.
| |
| This ensures the availability of sufficient power sources to operate the unit in a safe manner and to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents).
| |
| APPLICABILITY The inverters required to be OPERABLE in MODES 5 and 6 and during movement of irradiated fuel assemblies provide assurance that: a. Systems to provide adequate coolant inventory makeup are available for the irradiated fuel in the core;b. Systems needed to mitigate a fuel handling accident are available;
| |
| : c. Systems necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.
| |
| Inverter requirements for MODES 1, 2, 3, and 4 are covered in LCO 3.8.7.ACTIONS A.1, A.2.1, A.2.2, A.2.3, and A.2.4 If two trains are required by LCO 3.8.10, "Distribution Systems-Shutdown," the remaining OPERABLE Inverters may be capable of supporting sufficient required features to allow continuation of CORE ALTERATIONS, fuel movement, and operations with a potential for positive reactivity additions.
| |
| By the allowance of the option to declare required features inoperable with the associated inverter(s) inoperable, appropriate restrictions will be implemented in accordance with the affected required features LCOs' Required Actions. In many instances, this option may involve undesired administrative efforts. Therefore, the allowance for sufficiently conservative actions is made (i.e., to suspend CORE ALTERATIONS, movement of irradiated fuel assemblies, and operations involving positive reactivity additions), that could result in loss of required SDM (Mode 5) or required boron concentration (Mode 6).Suspending positive reactivity additions that could result in failure to meet the minimum SDM or boron concentration limits is required to assure continued safe operation.
| |
| Introduction of coolant inventory must be from McGuire Units 1 and 2 B 3.8.8-2 Revision No. 115 Inverters
| |
| -Shutdown B 3.8.8 BASES ACTIONS (continued) sources that have a boron concentration greater than that what would be required in the RCS for minimum SDM or refueling boron concentration.
| |
| This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation.
| |
| Introduction of temperature changes including temperature increases when operating with a positive MTC must also be evaluated to ensure they do not result in a loss of required SDM.Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition.
| |
| These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required inverters and to continue this action until restoration is accomplished in order to provide the necessary inverter power to the unit safety systems.The Completion Time of immediately is consistent with the required times for actions requiring prompt attention.
| |
| The restoration of the required inverters should be completed as quickly as possible in order to minimize the time the unit safety systems may be without power or powered from a regulated voltage transformer.
| |
| SURVEILLANCE SR 3.8.8.1 REQUIREMENTS This Surveillance verifies that the power sources are functioning properly with all required circuit breakers closed and AC vital buses energized from the required power source. The verification of proper voltage ensures that the required power is readily available for the instrumentation connected to the AC vital buses. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. UFSAR, Chapter 6.2. UFSAR, Chapter 15.3. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.8.8-3 Revision No. 115 Distribution Systems-Operating B 3.8.9 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.9 Distribution Systems-Operating BASES BACKGROUND The onsite Class 1 E AC, DC, and AC vital bus electrical power distribution systems are divided by train into two redundant and independent AC, four independent channels (two per train) of DC, and four AC vital buses electrical power distribution subsystems.
| |
| The AC electrical power subsystem for each train consists of a primary Engineered Safety Feature (ESF) 4.16 kV bus and secondary 600 V buses, distribution panels, motor control centers and load centers. Each 4.16 kV ESF bus has at least one separate and independent offsite source of power from a 6.9 kV non safety related bus, as well as a dedicated onsite diesel generator (DG) source. Each 6.9 kV bus is normally connected to an offsite source. After a loss of the normal offsite power source to a 6.9 kV bus, an automatic transfer scheme automatically transfers the bus to the alternate offsite source if it is available.
| |
| A fast transfer occurs if normal and alternate sources are synchronous, otherwise this transfer is done as a slow transfer (time delayed).
| |
| If the normal and alternate offsite sources are unavailable, the onsite emergency DG supplies power to the 4.16 kV ESF bus. Control power for the 4.16 kV breakers is supplied from the Class 1 E batteries.
| |
| Additional description of this system may be found in the Bases for LCO 3.8.1, "AC Sources-Operating," and the Bases for LCO 3.8.4, "DC Sources-Operating." The secondary AC electrical power distribution system for each train includes the safety related load centers, motor control centers, and distribution panels shown in Table B 3.8.9-1. Motor control centers shown in Table B 3.8.9-1 also include all submotor control centers such as EMXA1, EMXA2, EMXB1, EMXB2, 1EMXH1, etc.The 120 VAC vital buses are arranged in two load groups per train and are normally powered from the inverters.
| |
| The alternate power supply for the vital buses is from the regulated voltage transformers and their use is governed by LCO 3.8.7, "Inverters-Operating." The regulated voltage transformer is powered from a non-Class 1 E AC bus.The list of all required distribution buses is presented in Table B 3.8.9-1.APPLICABLE The initial conditions of Design Basis Accident (DBA) and transient SAFETY ANALYSES analyses in the UFSAR, Chapter 6 (Ref. 1), and in the UFSAR, Chapter 15 (Ref. 2), assume ESF systems are OPERABLE.
| |
| The AC, DC, McGuire Units 1 and 2 B 3.8.9-1 Revision No. 115 Distribution Systems-Operating B 3.8.9 BASES APPLICABLE SAFETY ANALYSES (continued) and AC vital bus electrical power distribution systems are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor Coolant System, and containment design limits are not exceeded.
| |
| These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution Limits; Section 3.4, Reactor Coolant System (RCS); and Section 3.6, Containment Systems.The OPERABILITY of the AC, DC, and AC vital bus electrical power distribution systems is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit. This includes maintaining power distribution systems OPERABLE during accident conditions in the event of: a. An assumed loss of all offsite power or all onsite AC electrical power;and b. A worst case single failure.The distribution systems satisfy Criterion 3 of 10 CFR 50.36 (c)(2)(ii).
| |
| LCO The required power distribution subsystems listed in Table B 3.8.9-1 ensure the availability of AC, DC, and AC vital bus electrical power for the systems required to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence (AOO) or a postulated DBA. The AC, DC, and AC vital bus electrical power distribution subsystems are required to be OPERABLE.Maintaining the Train A and Train B AC, channels of DC, and AC vital buses OPERABLE ensures that the redundancy incorporated into the design of ESF is not defeated.
| |
| Therefore, a single failure within any system or within the electrical power distribution subsystems will not prevent safe shutdown of the reactor.OPERABLE AC electrical power distribution subsystems require the associated buses, load centers, motor control centers, and distribution panels to be energized to their proper voltages.
| |
| OPERABLE DC electrical power distribution subsystems require the associated buses to be energized to their proper voltage from either the associated battery or charger. OPERABLE AC vital bus electrical power distribution subsystems require the associated buses to be energized to their proper voltage from the associated inverter via inverted DC voltage or regulated voltage transformer.
| |
| McGuire Units 1 and 2 B 3.8.9-2 Revision No. 115 Distribution Systems-Operating B 3.8.9 BASES APPLICABILITY The electrical power distribution subsystems are required to be OPERABLE in MODES 1, 2, 3, and 4 to ensure that: a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients; and b. Adequate core cooling is provided, and containment OPERABILITY and other vital functions are maintained in the event of a postulated DBA.Electrical power distribution subsystem requirements for MODES 5 and 6 are covered in the Bases for LCO 3.8.10, "Distribution Systems-Shutdown." ACTIONS A.1 With one or more required AC buses, load centers, motor control centers, or distribution panels, except AC vital buses, in one train inoperable, the remaining AC electrical power distribution subsystem in the other train is capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition, assuming no single failure. The overall reliability is reduced, however, because a single failure in the remaining power distribution subsystems could result in the minimum required ESF functions not being supported.
| |
| Therefore, the required AC buses, load centers, motor control centers, and distribution panels must be restored to OPERABLE status within 8 hours.Condition A worst scenario is one train without AC power (i.e., no offsite power to the train and the associated DG inoperable).
| |
| In this Condition, the unit is more vulnerable to a complete loss of AC power. It is, therefore, imperative that the unit operator's attention be focused on minimizing the potential for loss of power to the remaining train by stabilizing the unit, and on restoring power to the affected train. The 8 hour time limit before requiring a unit shutdown in this Condition is acceptable because of: a. The potential for decreased safety if the unit operator's attention is diverted from the evaluations and actions necessary to restore power to the affected train, to the actions associated with taking the unit to shutdown within this time limit; and b. The potential for an event in conjunction with a single failure of a redundant component in the train with AC power.McGuire Units 1 and 2 B 3.8.9-3 Revision No- 115 Distribution Systems-Operating B 3.8.9 BASES ACTIONS (continued)
| |
| The second Completion Time for Required Action A.1 establishes a limit on the maximum time allowed for any combination of required distribution subsystems to be inoperable during any single contiguous occurrence of failing to meet the LCO. If Condition A is entered while, for instance, a DC bus is inoperable and subsequently restored OPERABLE, the LCO may already have been not met for up to 2 hours. This could lead to a total of 10 hours, since initial failure of the LCO, to restore the AC distribution system. At this time, a DC circuit could again become inoperable, and AC distribution restored OPERABLE.
| |
| This could continue indefinitely.
| |
| The Completion Time allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." This will result in establishing the"time zero" at the time the LCO was initially not met, instead of the time Condition A was entered. The 16 hour Completion Time is an acceptable limitation on this potential to fail to meet the LCO indefinitely.
| |
| B. 1 With one AC vital bus inoperable, the remaining OPERABLE AC vital buses are capable of supporting the minimum safety functions necessary to shut down the unit and maintain it in the safe shutdown condition.
| |
| Overall reliability is reduced, however, since an additional single failure could result in the minimum ESF functions not being supported.
| |
| Therefore, the required AC vital bus must be restored to OPERABLE status within 2 hours by powering the bus from the associated inverter via inverted DC or regulated voltage transformer.
| |
| Condition B represents one AC vital bus without power; potentially both the DC source and the associated AC source are nonfunctioning.
| |
| In this situation, the unit is significantly more vulnerable to a complete loss of all noninterruptible power. It is, therefore, imperative that the operator's attention focus on stabilizing the unit, minimizing the potential for loss of power to the remaining vital buses and restoring power to the affected vital bus.This 2 hour limit is more conservative than Completion Times allowed for the vast majority of components that are without adequate vital AC power. Taking exception to LCO 3.0.2 for components without adequate vital AC power, that would have the Required Action Completion Times shorter than 2 hours if declared inoperable, is acceptable because of: a. The potential for decreased safety by requiring a change in unit conditions (i.e., requiring a shutdown) and not allowing stable operations to continue;McGuire Units I and 2 B 3.8.9-4 Revision No. 115 Distribution Systems-Operating B 3.8.9 BASES ACTIONS (continued)
| |
| : b. The potential for decreased safety by requiring entry into numerous Applicable Conditions and Required Actions for components without adequate vital AC power and not providing sufficient time for the operators to perform the necessary evaluations and actions for restoring power to the affected train; and c. The potential for an event in conjunction with a single failure of a redundant component.
| |
| The 2 hour Completion Time takes into account the importance to safety of restoring the AC vital bus to OPERABLE status, the redundant capability afforded by the other OPERABLE vital buses, and the low probability of a DBA occurring during this period.The second Completion Time for Required Action B.1 establishes a limit on the maximum allowed for any combination of required distribution subsystems to be inoperable during any single contiguous occurrence of failing to meet the LCO. If Condition B is entered while, for instance, an AC bus is inoperable and subsequently returned OPERABLE, the LCO may already have been not met for up to 8 hours. This could lead to a total of 10 hours, since initial failure of the LCO, to restore the vital bus distribution system. At this time, an AC train could again become inoperable, and vital bus distribution restored OPERABLE.
| |
| This could continue indefinitely.
| |
| This Completion Time allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." This will result in establishing the"time zero" at the time the LCO was initially not met, instead of the time Condition B was entered. The 16 hour Completion Time is an acceptable limitation on this potential to fail to meet the LCO indefinitely.
| |
| C.1 With one DC bus in one train inoperable, the remaining DC electrical power distribution subsystems are capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition, assuming no single failure. The overall reliability is reduced, however, because a single failure in the remaining DC electrical power distribution subsystem could result in the minimum required ESF functions not being supported.
| |
| Therefore, the DC buses must be restored to OPERABLE status within 2 hours by powering the bus from the associated battery or charger.McGuire Units 1 and 2 B 3.8.9-5 Revision No. 115 Distribution Systems--Operating B 3.8.9 BASES ACTIONS (continued)
| |
| Condition C represents one DC bus without adequate DC power; potentially both with the battery significantly degraded and the associated charger nonfunctioning.
| |
| It is, therefore, imperative that the operator's attention focus on stabilizing the unit, minimizing the potential for loss of power to the remaining channels and restoring power to the affected channel.This 2 hour limit is more conservative than Completion Times allowed for the vast majority of components that would be without power. Taking exception to LCO 3.0.2 for components without adequate DC power, which would have Required Action Completion Times shorter than 2 hours, is acceptable because of: a. The potential for decreased safety by requiring a change in unit conditions (i.e., requiring a shutdown) while allowing stable operations to continue;b. The potential for decreased safety by requiring entry into numerous applicable Conditions and Required Actions for components without DC power and not providing sufficient time for the operators to perform the necessary evaluations and actions for restoring power to the affected channel; and c. The potential for an event in conjunction with a single failure of a redundant component.
| |
| The 2 hour Completion Time for DC buses is consistent with Regulatory Guide 1.93 (Ref. 4).The second Completion Time for Required Action C. 1 establishes a limit on the maximum time allowed for any combination of required distribution subsystems to be inoperable during any single contiguous occurrence of failing to meet the LCO. If Condition C is entered while, for instance, an AC bus is inoperable and subsequently returned OPERABLE, the LCO may already have been not met for up to 8 hours. This could lead to a total of 10 hours, since initial failure of the LCO, to restore the DC distribution system. At this time, an AC train could again become inoperable, and DC distribution restored OPERABLE.
| |
| This could continue indefinitely.
| |
| This Completion Time allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." This will result in establishing the"time zero" at the time the LCO was initially not met, instead of the time Condition C was entered. The 16 hour Completion Time is an acceptable limitation on this potential to fail to meet the LCO indefinitely.
| |
| McGuire Units 1 and 2 B 3.8.9-6 Revision No. 115 Distribution Systems-Operating B 3.8.9 BASES ACTIONS (continued)
| |
| D.1 and D.2 If the inoperable distribution subsystem cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging plant systems.E.1 Condition E corresponds to a level of degradation in the electrical power distribution system that causes a required safety function to be lost. When more than one inoperable electrical power distribution subsystem results in the loss of a required function, the plant is in a condition outside the accident analysis.
| |
| Therefore, no additional time is justified for continued operation.
| |
| LCO 3.0.3 must be entered immediately to commence a controlled shutdown.SURVEILLANCE SR 3.8.9.1 REQUIREMENTS This Surveillance verifies that the AC, DC, and AC vital bus electrical power distribution systems are functioning properly, with the correct circuit breaker alignment.
| |
| The correct breaker alignment ensures the appropriate separation and independence of the electrical divisions is maintained, and the appropriate voltage is available to each required bus. The verification of proper voltage availability on the buses ensures that the required voltage is readily available for motive as well as control functions for critical system loads connected to these buses. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. UFSAR, Chapter 6.2. UFSAR, Chapter 15.3. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| : 4. Regulatory Guide 1.93, December 1974.McGuire Units 1 and 2 B 3.8.9-7 Revision No. 115 Distribution Systems-Operating B 3.8.9 BASES Table B 3.8.9-1 (page 1 of 1)AC and DC Electrical Power Distribution Systems TYPE VOLTAGE TRAIN A* TRAIN B*AC safety 4160 V Essential Bus ETA Essential Bus ETB buses 600 V Load Centers Load Centers ELXA, ELXC ELXB, ELXD 600 V Motor Control Centers Motor Control Centers EMXA, EMXC, EMXB, EMXD, EMXE, 1EMXG, EMXF, 2EMXG, 1EMXH 2EMXH DC buses 125 V Bus EVDA Bus EVDB Bus EVDC Bus EVDD Distribution Panels Distribution Panels EVDA, EVDC EVDB, EVDD AC vital buses 120 V Bus EKVA Bus EKVB Bus EKVC Bus EKVD* Each train of the AC and DC electrical power distribution systems is a subsystem.
| |
| McGuire Units 1 and 2 B 3.8.9-8 Revision No. 115 Distribution Systems-Shutdown B 3.8.10 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.10 Distribution Systems-Shutdown BASES BACKGROUND A description of the AC, DC, and AC vital bus electrical power distribution systems is provided in the Bases for LCO 3.8.9, "Distribution Systems-Operating." APPLICABLE The initial conditions of Design Basis Accident and transient analyses in SAFETY ANALYSES the UFSAR, Chapter 6 (Ref. 1) and Chapter 15 (Ref. 2), assume Engineered Safety Feature (ESF) systems are OPERABLE.
| |
| The AC, DC, and AC vital bus electrical power distribution systems are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor Coolant System, and containment design limits are not exceeded.The OPERABILITY of the AC, DC, and AC vital bus electrical power distribution system is consistent with the initial assumptions of the accident analyses and the requirements for the supported systems'OPERABILITY.
| |
| The OPERABILITY of the minimum AC, DC, and AC vital bus electrical power distribution subsystems during MODES 5 and 6, and during movement of irradiated fuel assemblies ensures that: a. The unit can be maintained in the shutdown or refueling condition for extended periods;b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and c. Adequate power is provided to mitigate events postulated during shutdown, such as a fuel handling accident.The AC and DC electrical power distribution systems satisfy Criterion 3 of 10 CFR 50.36 (Ref. 3).LCO Various combinations of subsystems, equipment, and components are required OPERABLE by other LCOs, depending on the specific plant condition.
| |
| Implicit in those requirements is the required OPERABILITY of necessary support required features.
| |
| This LCO explicitly requires McGuire Units 1 and 2 B 3.8. 10-1 Revision No. 115 Distribution Systems-Shutdown B 3.8.10 BASES LCO (continued) energization of the portions of the electrical distribution system necessary to support OPERABILITY of required systems, equipment, and components
| |
| -all specifically addressed in each LCO and implicitly required via the definition of OPERABILITY.
| |
| Maintaining these portions of the distribution system energized ensures the availability of sufficient power to operate the unit in a safe manner to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents).
| |
| APPLICABILITY The AC and DC electrical power distribution subsystems required to be OPERABLE in MODES 5 and 6, and during movement of irradiated fuel assemblies, provide assurance that: a. Systems to provide adequate coolant inventory makeup are available for the irradiated fuel in the core;b. Systems needed to mitigate a fuel handling accident are available;
| |
| : c. Systems necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition and refueling condition.
| |
| The AC, DC, and AC vital bus electrical power distribution subsystems requirements for MODES 1, 2, 3, and 4 are covered in LCO 3.8.9.ACTIONS A.1, A.2.1, A.2.2, A.2.3, A.2.4, A.2.5 and A.2.6 Although redundant required features may require redundant trains of electrical power distribution subsystems to be OPERABLE, one OPERABLE distribution subsystem train may be capable of supporting sufficient required features to allow continuation of CORE ALTERATIONS and fuel movement.
| |
| By allowing the option to declare required features associated with an inoperable distribution subsystem inoperable, appropriate restrictions are implemented in accordance with the affected distribution subsystem LCO's Required Actions. In many instances, this option may involve undesired administrative efforts. Therefore, the allowance for sufficiently conservative actions is made (i.e., to suspend CORE ALTERATIONS, movement of irradiated fuel assemblies, and operations involving positive reactivity additions that could result in loss of McGuire Units 1 and 2 B 3.8.10-2 Revision No. 115 Distribution Systems-Shutdown B 3.8.10 BASES ACTIONS (continued) required SDM (Mode 5) or required boron concentration (Mode 6).Suspending positive reactivity additions that could result in failure to meet the minimum SDM or boron concentration limits is required to assure continued safe operation.
| |
| Introduction of coolant inventory must be from sources that have a boron concentration greater than that what would be required in the RCS for minimum SDM or refueling boron concentration.
| |
| This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation.
| |
| Introduction of temperature changes including temperature increases when operating with a positive MTC must also be evaluated to ensure they do not result in a loss of required SDM.Suspension of these activities does not preclude completion of actions to establish a safe conservative condition.
| |
| These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required AC and DC electrical power distribution subsystems and to continue this action until restoration is accomplished in order to provide the necessary power to the unit safety systems.Notwithstanding performance of the above conservative Required Actions, a required residual heat removal (RHR) subsystem or required Low Temperature Overpressure Protection (LTOP) feature may be inoperable.
| |
| In this case, Required Actions A.2.1 through A.2.4 do not adequately address the concerns relating to coolant circulation and heat removal. Pursuant to LCO 3.0.6, the RHR or LTOP ACTIONS would not be entered. Therefore, Required Actions A.2.5 and A.2.6 are provided to direct declaring RHR and LTOP features inoperable, which results in taking the appropriate actions.The Completion Time of immediately is consistent with the required times for actions requiring prompt attention.
| |
| The restoration of the required distribution subsystems should be completed as quickly as possible in order to minimize the time the unit safety systems may be without power.McGuire Units 1 and 2 B 3.8.10-3 Revision No. 115 Distribution Systems-Shutdown B 3.8.10 BASES SURVEILLANCE SR 3.8.10.1 REQUIREMENTS This Surveillance verifies that the AC, DC, and AC vital bus electrical power distribution subsystems are functioning properly, with all the buses energized.
| |
| The verification of proper voltage availability on the buses ensures that the required power is readily available for motive as well as control functions for critical system loads connected to these buses. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. UFSAR, Chapter 6.2. UFSAR, Chapter 15.3. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.8.10-4 Revision No. 115 Boron Concentration B 3.9.1 B 3.9 REFUELING OPERATIONS B 3.9.1 Boron Concentration BASES BACKGROUND The limit on the boron concentrations of the Reactor Coolant System (RCS), the refueling canal, and the refueling cavity during refueling ensures that the reactor remains subcritical during MODE 6. Refueling boron concentration is the soluble boron concentration in the coolant in each of these volumes having direct access to the reactor core during refueling.
| |
| The soluble boron concentration offsets the core reactivity and is measured by chemical analysis of a representative sample of the coolant in each of the volumes. The refueling boron concentration limit is specified in the COLR. Plant procedures ensure the specified boron concentration in order to maintain an overall core reactivity of keff< 0.95 during fuel handling, with control rods and fuel assemblies assumed to be in the most adverse configuration (least negative reactivity) allowed by plant procedures.
| |
| GDC 26 of 10 CFR 50, Appendix A, requires that two independent reactivity control systems of different design principles be provided (Ref. 1). One of these systems must be capable of holding the reactor core subcritical under cold conditions.
| |
| The Chemical and Volume Control System (CVCS) is the system capable of maintaining the reactor subcritical in cold conditions by maintaining the boron concentration.
| |
| The reactor is brought to shutdown conditions before beginning operations to open the reactor vessel for refueling.
| |
| After the RCS is cooled and depressurized and the vessel head is unbolted, the head is slowly removed to form the refueling cavity. The refueling canal and the refueling cavity are then flooded with borated water by one of the following methods: 1. gravity fill directly from the refueling water storage tank (RWST), 2. refueling water pump taking suction directly from RWST, 3. refueling water pump taking suction from the spent fuel cooling water purification loop, or 4. RHR pumps taking suction from the RWST.The pumping action of the RHR System in the RCS and the natural circulation due to thermal driving heads in the reactor vessel and refueling McGuire Units 1 and 2 B 3.9. 1-1 Revision No. 115 Boron Concentration B 3.9.1 BASES BACKGROUND (continued) cavity mix the added concentrated boric acid with the water in the refueling canal. The RHR System is in operation during refueling (see LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation-High Water Level," and LCO 3.9.6, "Residual Heat Removal (RHR) and Coolant Circulation-Low Water Level") to provide forced circulation in the RCS and assist in maintaining the boron concentrations in the RCS, the refueling canal, and the refueling cavity above the COLR limit.APPLICABLE During refueling operations, the reactivity condition of the core is SAFETY ANALYSES consistent with the initial conditions assumed for the boron dilution accident in the accident analysis and is conservative for MODE 6. The boron concentration limit specified in the COLR is based on the core reactivity at the beginning of each fuel cycle (the end of refueling) and includes an uncertainty allowance.
| |
| The required boron concentration and the plant refueling procedures that verify the correct fuel loading plan (including full core mapping) ensure that the keff of the core will remain < 0.95 during the refueling operation.
| |
| Hence, at least a 5% Ak/k margin of safety is established during refueling.
| |
| During refueling, the water volume in the spent fuel pool, the transfer canal, the refueling canal, the refueling cavity, and the reactor vessel form a single mass. As a result, the soluble boron concentration is relatively the same in each of these volumes.The RCS boron concentration satisfies Criterion 2 of 10 CFR 50.36 (Ref.2).LCO The LCO requires that a minimum boron concentration be maintained in the RCS, the refueling canal, and the refueling cavity while in MODE 6.The boron concentration limit specified in the COLR ensures that a core kff of < 0.95 is maintained during fuel handling operations.
| |
| Violation of the LCO could lead to an inadvertent criticality during MODE 6.APPLICABILITY This LCO is applicable in MODE 6 to ensure that the fuel in the reactor vessel will remain subcritical.
| |
| The required boron concentration ensures a kerr< 0.95. Above MODE 6, LCO 3.1.1, "SHUTDOWN MARGIN (SDM)," ensure that an adequate amount of negative reactivity is available to shut down the reactor and maintain it subcritical.
| |
| The Applicability is modified by a Note. The Note states that the limits on boron concentration are only applicable to the refueling canal and the McGuire Units 1 and 2 B 3.9.1-2 Revision No. 115 Boron Concentration B 3.9.1 BASES refueling cavity when those volumes are connected to the Reactor Coolant System. When the refueling canal and the refueling cavity are isolated from the RCS, no potential path for boron dilution of the RCS exists."Refueling cavity" includes the shallow and deep end of the refueling cavity. "Refueling canal" is the fuel transfer canal in the Reactor Building."Connected" is when the water in the reactor vessel and the refueling cavity is hydraulically connected.
| |
| ACTIONS A.1 and A.2 Continuation of CORE ALTERATIONS or positive reactivity additions (including actions to reduce boron concentration) is contingent upon maintaining the unit in compliance with the LCO. If the boron concentration of any coolant volume in the RCS, the refueling canal, or the refueling cavity is less than its limit, all operations involving CORE ALTERATIONS or positive reactivity additions must be suspended immediately.
| |
| Suspension of CORE ALTERATIONS and positive reactivity additions shall not preclude moving a component to a safe position.
| |
| Operations that individually add limited positive reactivity (e.g., temperature fluctuations from inventory addition or temperature control fluctuations), but when combined with all other operations affecting core reactivity (e.g., intentional boration) result in overall net negative reactivity addition, are not precluded by this action.A.3 In addition to immediately suspending CORE ALTERATIONS and positive reactivity additions, boration to restore the concentration must be initiated immediately.
| |
| In determining the required combination of boration flow rate and concentration, no unique Design Basis Event must be satisfied.
| |
| The only requirement is to restore the boron concentration to its required value as soon as possible.
| |
| In order to raise the boron concentration as soon as possible, the operator should begin boration with the best source available for unit conditions.
| |
| An acceptable method is to borate at greater than or equal to 30 gpm of a solution containing greater than or equal to 7000 ppm boron or its equivalent.
| |
| Once actions have been initiated, they must be continued until the boron concentration is restored.
| |
| The restoration time depends on the amount of boron that must be injected to reach the required concentration.
| |
| McGuire Units 1 and 2 B 3.9.1-3 Revision No. 115 Boron Concentration B 3.9.1 BASES SURVEILLANCE SR 3.9.1.1 REQUIREMENTS This SR ensures that the coolant boron concentration in the RCS, and connected portions of the refueling canal and the refueling cavity, is within the COLR limits. The boron concentration of the coolant in each required volume is determined periodically by chemical analysis.
| |
| Prior to re-connecting portions of the refueling canal or the refueling cavity to the RCS, this SR must be met per SR 3.0.4. If any dilution activity has occurred while the cavity or canal were disconnected from the RCS, this SR ensures the correct boron concentration prior to communication with the RCS. One sample from the refueling canal or refueling cavity is sufficient to determine the boron concentration in that volume of water.An additional sample is taken from the RCS.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. 10 CFR 50, Appendix A, GDC 26.2. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.9.1-4 Revision No. 115 Unborated Water Source Isolation Valves B 3.9.2 B 3.9 REFUELING OPERATIONS B 3.9.2 Unborated Water Source Isolation Valves BASES BACKGROUND During MODE 6 operations, all isolation valves for reactor makeup water sources containing unborated water that are connected to the Reactor Coolant System (RCS) must be closed to prevent unplanned boron dilution of the reactor coolant. The isolation valves must be secured in the closed position.
| |
| One of the following groups of valves is required to be closed: 1) NV-250, or 2) NV-131, NV-140, NV-176, NV-468, NV-808, and either NV-1 32 or NV-1 026 when it is necessary to makeup to the RWST during refueling operations.
| |
| The Chemical and Volume Control System is capable of supplying borated and unborated water to the RCS through various flow paths.Since a positive reactivity addition, that could result in failure to meet the minimum SDM or boron concentration limits, is inappropriate during MODE 6, isolation of all unborated water sources prevents an unplanned boron dilution.APPLICABLE SAFETY ANALYSES The possibility of an inadvertent boron dilution event (Ref. 1) occurring during MODE 6 refueling operations is precluded by adherence to this LCO, which requires that potential dilution sources be isolated.
| |
| Closing the required valves during refueling operations prevents the flow of unborated water to the filled portion of the RCS. The valves are used to isolate unborated water sources. These valves have the potential to indirectly allow dilution of the RCS boron concentration in MODE 6. By isolating unborated water sources, a safety analysis for an uncontrolled boron dilution accident in accordance with the Standard Review Plan (Ref. 2) is not required for MODE 6.The RCS boron concentration satisfies Criterion 2 of 10 CFR 50.36 (Ref.3).LCO This LCO requires that flow paths to the RCS from unborated water sources be isolated to prevent unplanned boron dilution during MODE 6 and thus avoid a reduction in SDM.McGuire Units 1 and 2 B 3.9.2-1 Revision No. 115 Unborated Water Source Isolation Valves B 3.9.2 BASES APPLICABILITY In MODE 6, this LCO is applicable to prevent an inadvertent boron dilution event by ensuring isolation of all sources of unborated water to the RCS. For all other applicable MODES, the boron dilution accident was analyzed and was found to be capable of being mitigated.
| |
| ACTIONS The ACTIONS table has been modified by a Note that allows separate Condition entry for each unborated water source isolation valve.A. 1 Continuation of CORE ALTERATIONS is contingent upon maintaining the unit in compliance with this LCO. With any valve used to isolate unborated water sources not secured in the closed position, all operations involving CORE ALTERATIONS must be suspended immediately.
| |
| The Completion Time of "immediately" for performance of Required Action A.1 shall not preclude completion of movement of a component to a safe position.Condition A has been modified by a Note to require that Required Action A.3 be completed whenever Condition A is entered.A.2 Preventing inadvertent dilution of the reactor coolant boron concentration is dependent on maintaining the unborated water isolation valves secured closed. Securing the valves in the closed position ensures that the valves cannot be inadvertently opened. The Completion Time of "immediately" requires an operator to initiate actions to close an open valve and secure the isolation valve in the closed position immediately.
| |
| Once actions are initiated, they must be continued until the valves are secured in the closed position.A.3 Due to the potential of having diluted the boron concentration of the reactor coolant, SR 3.9.1.1 (verification of boron concentration) must be performed whenever Condition A is entered to demonstrate that the required boron concentration exists. The Completion Time of 4 hours is sufficient to obtain and analyze a reactor coolant sample for boron concentration.
| |
| McGuire Units 1 and 2 B 3.9.2-2 Revision No. 115 Unborated Water Source Isolation Valves B 3.9.2 BASES SURVEILLANCE SR 3.9.2.1 REQUIREMENTS These valves are to be secured closed to isolate possible dilution paths.The likelihood of a significant reduction in the boron concentration during MODE 6 operations is remote due to the large mass of borated water in the refueling cavity and the fact that all unborated water sources are isolated, precluding a dilution.
| |
| The boron concentration is checked every 72 hours during MODE 6 under SR 3.9.1.1. This Surveillance demonstrates that the valves are closed through a system walkdown.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. UFSAR, Section 15.4.6.2. NUREG-0800, Section 15.4.6.3. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.9.2-3 Revision No. 115 Nuclear Instrumentation B 3.9.3 B 3.9 REFUELING OPERATIONS B 3.9.3 Nuclear Instrumentation BASES BACKGROUND The source range neutron flux monitors are used during refueling operations to monitor the core reactivity condition.
| |
| The installed source range neutron flux monitors are part of the Nuclear Instrumentation System (NIS) while the Wide Range Neutron Flux Monitoring System (Gamma-Metrics) are not. Source range indication is provided via the NIS source range channels and the Gamma-Metrics shutdown monitors using detectors located external to the reactor vessel. These detectors monitor neutrons leaking from the core. Neutron flux indication for these monitors are provided in counts per second.The Westinghouse-supplied boron triflouride (BF 3) detectors used for the NIS Source Range Channels are being replaced with Thermo Scientific-supplied fission chamber detectors.
| |
| The Westinghouse NIS Source Range Channels utilizing BF 3 detectors have a range of I to 1 E6 cps.The replacement Thermo Scientific NIS Source Range Channels utilizing fission chamber detectors have a range of 0.1 to 1 E6 cps. The Wide Range (Gamma-Metrics) channels are fission chambers with a range of 0.1 to 1E5 cps (in the startup range). The NIS source range channels and the Gamma-Metrics shutdown monitors provide continuous visible count rate indication in the control room and a high flux control room alarm to alert operators to any unexpected positive reactivity additions.
| |
| Since TS 3.9.2 requires isolation of unborated water sources, the shutdown monitors (Gamma-Metrics) audible alarm, NIS source range audible indication and audible alarm are not required for OPERABILITY in Mode 6.The NIS source range detectors and the Gamma-Metrics are designed in accordance with the criteria presented in Reference 1.APPLICABLE SAFETY ANALYSES Two OPERABLE source range neutron flux monitors (any combination of the two NIS source range monitors and the two Gamma-Metrics wide range monitors) are required to provide an indication to alert the operator to unexpected changes in core reactivity such as with a boron dilution accident (Ref. 2) or an improperly loaded fuel assembly.The source range neutron flux monitors satisfy Criterion 3 of 10 CFR 50.36 (Ref. 3).McGuire Units 1 and 2 B 3.9.3-1 Revision No. 115 Nuclear Instrumentation B 3.9.3 BASES LCO This LCO requires that two source range neutron flux monitors be OPERABLE to ensure that redundant monitoring capability is available to detect changes in core reactivity.
| |
| To be operable, each monitor must provide a visual indication in the Control Room. The visual indication can be, but not limited to, either a gauge, chart recorder, CRT, or some other recording device. The two required source range neutron flux monitors may consist of any combination of the two NIS source range monitors and the two Gamma-Metrics wide range shutdown monitors.As required by LCO 3.9.2, "Unborated water source isolation valves", all isolation valves for reactor makeup water sources containing unborated water that are connected to the Reactor Coolant System (RCS) must be closed to prevent unplanned boron dilution of the reactor coolant during MODE 6 and thus avoid a reduction in shutdown margin. As such, the required source range monitors OPERABILITY includes only a visual monitoring function.
| |
| A high flux alarm is not a required function for OPERABILITY.
| |
| APPLICABILITY In MODE 6, the source range neutron flux monitors must be OPERABLE to determine changes in core reactivity.
| |
| There are no other direct means available to check core reactivity levels. In MODES 2, 3, 4, and 5, the NIS source range detectors and circuitry are also required to be OPERABLE by LCO 3.3.1, "Reactor Trip System (RTS) Instrumentation." The Gamma-Metrics wide range shutdown monitors do not provide an automatic reactor trip protective function.ACTIONS A.1 and A.2 With only one required source range neutron flux monitor OPERABLE, redundancy has been lost. Since these instruments are the only direct means of monitoring core reactivity conditions, CORE ALTERATIONS and introduction of coolant into the RCS with boron concentration less than required to meet the minimum boron concentration of LCO 3.9.1 must be suspended immediately.
| |
| Suspending positive reactivity additions that could result in failure to meet the minimum boron concentration limit is required to assure continued safe operation.
| |
| Introduction of coolant inventory must be from sources that have a boron concentration greater than that which would be required in the RCS for minimum refueling boron concentration.
| |
| This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation.
| |
| Performance of Required Action A.1 shall not preclude completion of movement of a component to a safe position.McGuire Units 1 and 2 B 3.9.3-2 Revision 115 Nuclear Instrumentation B 3.9.3 BASES ACTIONS (continued)
| |
| B.1 With no required source range neutron flux monitor OPERABLE, action to restore a monitor to OPERABLE status shall be initiated immediately.
| |
| Once initiated, action shall be continued until a source range neutron flux monitor is restored to OPERABLE status.B.2 With no required source range neutron flux monitor OPERABLE, there are no direct means of detecting changes in core reactivity.
| |
| However, since CORE ALTERATIONS and positive reactivity additions are not to be made, the core reactivity condition is stabilized until the source range neutron flux monitors are OPERABLE.
| |
| This stabilized condition is determined by performing SR 3.9.1.1 to ensure that the required boron concentration exists.The Completion Time of once per 12 hours is sufficient to obtain and analyze a reactor coolant sample for boron concentration and ensures that unplanned changes in boron concentration would be identified.
| |
| The 12 hour Frequency is reasonable, considering the low probability of a change in core reactivity during this time period.SURVEILLANCE SR 3.9.3.1 REQUIREMENTS SR 3.9.3.1 is the performance of a CHANNEL CHECK, which is a comparison of the parameter indicated on one channel to a similar parameter on other channels.
| |
| It is based on the assumption that the two indication channels should be consistent with core conditions.
| |
| Changes in fuel loading and core geometry can result in significant differences between source range channels, but each channel should be consistent with its local conditions.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.9.3.2 SR 3.9.3.2 is the performance of a CHANNEL CALIBRATION.
| |
| The CHANNEL CALIBRATION ensures that the monitors are calibrated.
| |
| This SR is modified by a Note stating that neutron detectors are excluded from the CHANNEL CALIBRATION.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Units 1 and 2 B 3.9.3-3 Revision 115 Nuclear Instrumentation B 3.9.3 BASES REFERENCES 1.2.3.10 CFR 50, Appendix A, GDC 13, GDC 26, GDC 28, and GDC 29.UFSAR, Sections 4.2, 15.4.6.10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.9.3-4 Revision 115 Containment Penetrations B 3.9.4 B 3.9 REFUELING OPERATIONS B 3.9.4 Containment Penetrations-BASES BACKGROUND During movement of recently irradiated fuel assemblies within containment, a release of fission product radioactivity within containment will be restricted from escaping to the environment when the LCO requirements are met. In MODES 1, 2, 3, and 4, this is accomplished by maintaining containment OPERABLE as described in LCO 3.6.1,"Containment." In MODE 6, the potential for containment pressurization as a result of an accident is not likely; therefore, requirements to isolate the containment from the outside atmosphere can be less stringent.
| |
| The LCO requirements are referred to as "containment closure" rather than"containment OPERABILITY." Containment closure means that all potential escape paths are closed or exhausting through an OPERABLE containment purge exhaust HEPA filter and charcoal adsorber.
| |
| Since there is no potential for containment pressurization, the Appendix J leakage criteria and tests are not required.The containment serves to contain fission product radioactivity that may be released from the reactor core following an accident, such that offsite radiation exposures are maintained well within the requirements of 10 CFR 50.67 (Ref.4). Additionally, the containment provides radiation shielding from the fission products that may be present in the containment atmosphere following accident conditions.
| |
| The containment equipment hatch, which is part of the containment pressure boundary, provides a means for moving large equipment and components into and out of containment.
| |
| During movement of recently irradiated fuel assemblies within containment, the equipment hatch must be held in place by at least four bolts. Good engineering practice dictates that the bolts required by this LCO be approximately equally spaced.The containment air locks, which are also part of the containment pressure boundary, provide a means for personnel access during MODES 1, 2, 3, and 4 unit operation in accordance with LCO 3.6.2,"Containment Air Locks." Each air lock has a door at both ends. The doors are normally interlocked to prevent simultaneous opening when containment OPERABILITY is required.
| |
| During periods of unit shutdown when containment closure is not required, the door interlock mechanism may be disabled, allowing both doors of an air lock to remain open for extended periods when frequent containment entry is necessary.
| |
| During McGuire Units 1 and 2 B 3.9.4-1 Revision No. 115 Containment Penetrations B 3.9.4 BASES BACKGROUND (continued) movement of recently irradiated fuel assemblies within containment, containment closure is required; therefore, the door interlock mechanism may remain disabled, but one air lock door must always remain closed.The requirements for containment penetration closure ensure that a release of fission product radioactivity within containment will be restricted from escaping to the environment.
| |
| The closure restrictions are sufficient to restrict fission product radioactivity release from containment due to a fuel handling accident involving recently irradiated fuel during refueling.
| |
| The Containment Purge Supply and Exhaust is a subsystem of the Containment Purge and Ventilation System. Purge air is supplied to the Containment through two 50 percent capacity fans and their associated filters and heating coils. Purged air is exhausted through two 50 percent capacity fan and filter networks to the unit vent where it is monitored during release to the atmosphere.
| |
| The purge air supply and exhaust fans and filters are located in the Auxiliary Building.There are five purge air supply penetrations and four purge air exhaust penetrations in the Containment.
| |
| These penetrations are in the upper compartment and lower compartment.
| |
| Two normally closed isolation valves in each penetration provide Containment isolation.
| |
| The upper compartment purge exhaust ductwork is so arranged to draw exhaust air into a plenum around the periphery of the refueling canal, effecting a ventilation sweep of the canal during the refueling process.The lower compartment purge exhaust ductwork is arranged as to sweep the reactor well during the refueling process.The other containment penetrations that provide direct access from containment atmosphere to outside atmosphere must be isolated on at least one side. Isolation may be achieved by a closed automatic isolation valve, or by a manual isolation valve, blind flange, or equivalent.
| |
| Equivalent isolation methods must be approved and may include use of a material that can provide a temporary, atmospheric pressure, ventilation barrier for the other containment penetrations during recently irradiated fuel movements.
| |
| APPLICABLE During movement of irradiated fuel assemblies within containment, SAFETY ANALYSES the most severe radiological consequences result from a fuel handling accident involving recently irradiated fuel. The fuel handling accident is a postulated event that involves damage to irradiated fuel (Ref. 1). Fuel handling accidents include dropping a single irradiated fuel assembly and handling tool or a heavy object onto other irradiated McGuire Units 1 and 2 B 3.9.4-2 Revision No. 115 Containment Penetrations B 3.9.4 BASES APPLICABLE SAFETY ANALYSES (continued) fuel assemblies.
| |
| The requirements of LCO 3.9.7, " Refueling Cavity Water Level," in conjunction with irradiated fuel minimum decay time of 72 hours, ensure that the release of fission product radioactivity, subsequent to the limiting fuel handling accident, results in doses that are well within the guideline values specified in 10 CFR 50.67 (Ref. 4) and Regulatory Guide 1.183 (Ref. 5).Containment penetrations satisfy Criterion 3 of 10 CFR 50.36 (Ref. 2).LCO This LCO limits the consequences of a fuel handling accident involving recently irradiated fuel in containment by limiting the potential escape paths for fission product radioactivity released within containment.
| |
| The LCO requires any penetration providing direct access from the containment atmosphere to the outside atmosphere to be closed except for penetrations exhausting through an OPERABLE Containment Purge Exhaust System HEPA filter and charcoal adsorber.APPLICABILITY The containment penetration requirements are applicable during movement of recently irradiated fuel assemblies within containment because this is when there is a potential for the limiting fuel handling accident.
| |
| Recently irradiated fuel is defined as fuel that has occupied part of a critical reactor core within the previous 72 hours. In Modes 1,2,3, and 4, containment penetration requirements are addressed by LCO 3.6.1. In Modes 5 and 6, when movement of irradiated fuel assemblies is not being conducted, the potential for a fuel handling accident does not exist.Additionally, due to radioactive decay, a fuel handling accident involving irradiated fuel that has not occupied part of a critical reactor core within the previous 72 hours will result in doses that are within the guideline values specified in 10 CFR 50.67 even without containment closure capability.
| |
| Therefore, under these conditions no requirements are placed on containment penetration status.ACTIONS A.1 If the containment equipment hatch, air locks, or any containment penetration that provides direct access from the containment atmosphere to the outside atmosphere is not in the required status, the unit must be placed in a condition where the isolation function is not needed. This is accomplished by immediately suspending and movement of recently irradiated fuel assemblies within containment.
| |
| Performance of these actions shall not preclude completion of movement of a component to a safe position.McGuire Units 1 and 2 B 3.9.4-3 Revision No. 115 Containment Penetrations B 3.9.4 BASES SURVEILLANCE SR 3.9.4.1 REQUIREMENTS This Surveillance demonstrates that each of the containment penetrations required to be in its closed position is in that position.
| |
| The Surveillance on the open purge and exhaust valves will demonstrate that the valves are exhausting through an OPERABLE Containment Purge Exhaust System HEPA filter and charcoal adsorber.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program. As such, this Surveillance ensures that a postulated fuel handling accident involving recently irradiated fuel that releases fission product radioactivity within the containment will not result in a release of significant fission product radioactivity to the environment.
| |
| SR 3.9.4.2 This SR verifies that the required testing is performed in accordance with the Ventilation Filter Testing Program (VFTP). The Containment Purge Exhaust System filter tests are in accordance with Reference
| |
| : 3. The VFTP includes testing HEPA filter performance, charcoal adsorbers efficiency, minimum system flow rate, and the physical properties of the activated charcoal (general use and following specific operations).
| |
| Specific test Frequencies and additional information are discussed in detail in the VFTP.REFERENCES
| |
| : 1. UFSAR, Section 15.7.4.2. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| : 3. Regulatory Guide 1.52 (Rev. 2).4. 10 CFR 50.67, Accident Source Term.5. Regulatory Guide 1.183, Rev 0.6. PIP M-05-1608.
| |
| McGuire Units 1 and 2 B 3.9.4-4 Revision No. 115 RHR and Coolant Circulation-High Water Level B 3.9.5 B 3.9 REFUELING OPERATIONS B 3.9.5 Residual Heat Removal (RHR) and Coolant Circulation-High Water Level BASES BACKGROUND The purpose of the RHR System in MODE 6 is to remove decay heat and sensible heat from the Reactor Coolant System (RCS), as required by GDC 34, to provide mixing of borated coolant and to prevent boron stratification (Ref. 1). Heat is removed from the RCS by circulating reactor coolant through the RHR heat exchanger(s), where the heat is transferred to the Component Cooling Water System. The coolant is then returned to the RCS via the RCS cold leg(s). Operation of the RHR System for normal cooldown or decay heat removal is manually accomplished from the control room. The heat removal rate is adjusted by controlling the flow of reactor coolant and component cooling water through the RHR heat exchanger(s).
| |
| Mixing of the reactor coolant is maintained by this continuous circulation of reactor coolant through the RHR System.APPLICABLE If the reactor coolant temperature is not maintained below 200 0 F, SAFETY ANALYSES boiling of the reactor coolant could result. This could lead to a loss of coolant in the reactor vessel. Additionally, boiling of the reactor coolant could lead to a reduction in boron concentration in the coolant due to boron plating out on components near the areas of the boiling activity.The loss of reactor coolant and the reduction of boron concentration in the reactor coolant would eventually challenge the integrity of the fuel cladding, which is a fission product barrier. One train of the RHR System is required to be operational in MODE 6, with the water level > 23 ft above the top of the reactor vessel flange, to prevent this challenge.
| |
| The LCO does permit de-energizing the RHR pump for short durations, under the condition that the boron concentration is not diluted. This conditional de-energizing of the RHR pump does not result in a challenge to the fission product barrier.The RHR System satisfies Criterion 4 of 10 CFR 50.36 (Ref. 2).LCO Only one RHR loop is required for decay heat removal in MODE 6, with the water level _> 23 ft above the top of the reactor vessel flange. Only one RHR loop is required to be OPERABLE, because the volume of water above the reactor vessel flange provides backup decay heat removal capability.
| |
| At least one RHR loop must be OPERABLE and in operation to provide: McGuire Units 1 and 2 B 3.9.5-1 Revision No. 115 RHR and Coolant Circulation
| |
| -High Water Level B 3.9.5 BASES LCO (continued)
| |
| : a. Removal of decay heat;b. Mixing of borated coolant to minimize the possibility of criticality; and c. Indication of reactor coolant temperature.
| |
| An OPERABLE RHR loop includes an RHR pump, a heat exchanger, valves, piping, instruments, and controls to ensure an OPERABLE flow path and to determine the low end temperature.
| |
| The flow path starts in one of the RCS hot legs and is returned to the RCS cold legs. The operability of the operating RHR train and the supporting heat sink is dependent on the ability to maintain the desired RCS temperature.
| |
| The LCO is modified by a Note that allows the required operating RHR loop to be removed from service for up to 1 hour per 8 hour period, provided no operations are permitted that would dilute the RCS boron concentration with coolant at boron concentrations less than required to meet the minimum boron concentration of LCO 3.9.1. Boron concentration reduction with coolant at boron concentrations less than required to assure minimum required RCS boron concentration is maintained is prohibited because uniform concentration distribution cannot be ensured without forced circulation.
| |
| This permits operations such as core mapping or alterations in the vicinity of the reactor vessel hot leg nozzles and RCS to RHR isolation valve testing. During this 1 hour period, decay heat is removed by natural convection to the large mass of water in the refueling cavity.The acceptability of the LCO and the LCO NOTE is based on preventing boiling in the core in the event of the loss of RHR cooling. However, it has been determined that when the upper internals are in place in the reactor vessel there is insufficient communication with the water above the core for adequate decay heat removal by natural circulation.
| |
| As a result, boiling in the core could occur in a relatively short time if RHR cooling is lost. Therefore, during the short period of time that the upper internals are installed, administrative processes are implemented to reduce the risk of core boiling. The availability of additional cooling equipment, including equipment not required to be OPERABLE by the Technical Specifications, contributes to this risk reduction.
| |
| The plant staff assesses these cooling sources to assure that the desired minimal level of risk is maintained.
| |
| This is commonly referred to as defense-in-depth.
| |
| This strategy is consistent with NUMARC 91-06, "Guidelines for Industry Actions to Assess Shutdown Management." (Ref.3)McGuire Units 1 and 2 B 3.9.5-2 Revision No. 115 RHR and Coolant Circulation
| |
| -High Water Level B 3.9.5 BASES APPLICABILITY One RHR loop must be OPERABLE and in operation in MODE 6, with the water level _> 23 ft above the top of the reactor vessel flange, to provide decay heat removal. The 23 ft water level was selected because it corresponds to the 23 ft requirement established for fuel movement in LCO 3.9.7, "Refueling Cavity Water Level." Requirements for the RHR System in other MODES are covered by LCOs in Section 3.4, Reactor Coolant System (RCS), and Section 3.5, Emergency Core Cooling Systems (ECCS). RHR loop requirements in MODE 6 with the water level < 23 ft are located in LCO 3.9.6, "Residual Heat Removal (RHR)and Coolant Circulation-Low Water Level." ACTIONS RHR loop requirements are met by having one RHR loop OPERABLE and in operation, except as permitted in the Note to the LCO.A.1 If RHR loop requirements are not met, there will be no forced circulation to provide mixing to establish uniform boron concentrations.
| |
| Suspending positive reactivity additions that could result in failure to meet the minimum boron concentration limit is required to assure continued safe operation.
| |
| Introduction of coolant inventory must be from sources that have a boron concentration greater than that which would be required in the RCS for minimum refueling boron concentration.
| |
| This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation.
| |
| A.2 If RHR loop requirements are not met, actions shall be taken immediately to suspend loading of irradiated fuel assemblies in the core. With no forced circulation cooling, decay heat removal from the core occurs by natural convection to the heat sink provided by the water above the core.A minimum refueling water level of 23 ft above the reactor vessel flange provides an adequate available heat sink. Suspending any operation that would increase decay heat load, such as loading a fuel assembly, is a prudent action under this condition.
| |
| A.3 If RHR loop requirements are not met, actions shall be initiated and continued in order to satisfy RHR loop requirements.
| |
| With the unit in MODE 6 and the refueling water level 23 ft above the top of the reactor vessel flange, corrective actions shall be initiated immediately.
| |
| McGuire Units 1 and 2 B 3.9.5-3 Revision No. 115 RHR and Coolant Circulation
| |
| -High Water Level B 3.9.5 BASES ACTIONS (continued)
| |
| A.4 If RHR loop requirements are not met, all containment penetrations providing direct access from the containment atmosphere to the outside atmosphere must be closed within 4 hours. With the RHR loop requirements not met, the potential exists for the coolant to boil and release radioactive gas to the containment atmosphere.
| |
| Closing containment penetrations that are open to the outside atmosphere ensures dose limits are not exceeded.The Completion Time of 4 hours is reasonable, based on the low probability of the coolant boiling in that time.SURVEILLANCE SR 3.9.5.1 REQUIREMENTS This Surveillance demonstrates that the RHR loop is in operation and circulating reactor coolant. The flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability and to prevent thermal and boron stratification in the core. The RCS temperature is determined to ensure the appropriate decay heat removal is maintained.
| |
| The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
| |
| : 1. UFSAR, Section 5.5.7.2. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| : 3. NUMARC 91-06, "'Guidelines for Industry Actions to Assess Shutdown Management".
| |
| McGuire Units 1 and 2 B 3.9.5-4 Revision No. 115 RHR and Coolant Circulation-Low Water Level B 3.9.6 B 3.9 REFUELING OPERATIONS B 3.9.6 Residual Heat Removal (RHR) and Coolant Circulation-Low Water Level BASES BACKGROUND The purpose of the RHR System in MODE 6 is to remove decay heat and sensible heat from the Reactor Coolant System (RCS), as required by GDC 34, to provide mixing of borated coolant, and to prevent boron stratification (Ref. 1). Heat is removed from the RCS by circulating reactor coolant through the RHR heat exchangers where the heat is transferred to the Component Cooling Water System. The coolant is then returned to the RCS via the RCS cold leg(s). Operation of the RHR System for normal cooldown decay heat removal is manually accomplished from the control room. The heat removal rate is adjusted by controlling the flow of reactor coolant and component cooling water through the RHR heat exchanger(s).
| |
| Mixing of the reactor coolant is maintained by this continuous circulation of reactor coolant through the RHR System.APPLICABLE If the reactor coolant temperature is not maintained below 200 0 F, boiling SAFETY ANALYSES of the reactor coolant could result. This could lead to a loss of coolant in the reactor vessel. Additionally, boiling of the reactor coolant could lead to a reduction in boron concentration in the coolant due to the boron plating out on components near the areas of the boiling activity.
| |
| The loss of reactor coolant and the reduction of boron concentration in the reactor coolant will eventually challenge the integrity of the fuel cladding, which is a fission product barrier. Two trains of the RHR System are required to be OPERABLE, and one train in operation, in order to prevent this challenge.
| |
| The RHR System satisfies Criterion 4 of 10 CFR 50.36 (Ref. 2).LCO In MODE 6, with the water level < 23 ft above the top of the reactor vessel flange, both RHR loops must be OPERABLE.Additionally, one loop of RHR must be in operation in order to provide: a. Removal of decay heat;b. Mixing of borated coolant to minimize the possibility of criticality; and c. Indication of reactor coolant temperature.
| |
| McGuire Units 1 and 2 B 3.9.6-1 Revision No. 115 RHR and Coolant Circulation
| |
| -Low Water Level B 3.9.6 BASES LCO (continued)
| |
| An OPERABLE RHR loop consists of an RHR pump, a heat exchanger, valves, piping, instruments and controls to ensure an OPERABLE flow path and to determine the low end temperature.
| |
| The flow path starts in one of the RCS hot legs and is returned to the RCS cold legs. The operability of the operating RHR train and the supporting heat sink is dependent on the ability to maintain the desired RCS temperature.
| |
| Both RHR pumps may be aligned to the Refueling Water Storage Tank to support filling the refueling cavity or for performance of required testing.APPLICABILITY Two RHR loops are required to be OPERABLE, and one RHR loop must be in operation in MODE 6, with the water level < 23 ft above the top of the reactor vessel flange, to provide decay heat removal. Requirements for the RHR System in other MODES are covered by LCOs in Section 3.4, Reactor Coolant System (RCS), and Section 3.5, Emergency Core Cooling Systems (ECCS). RHR loop requirements in MODE 6 with the water level > 23 ft are located in LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation-High Water Level." ACTIONS A.1 and A.2 If less than the required number of RHR loops are OPERABLE, action shall be immediately initiated and continued until the RHR loop is restored to OPERABLE status and to operation or until > 23 ft of water level is established above the reactor vessel flange. When the water level is> 23 ft above the reactor vessel flange, the Applicability changes to that of LCO 3.9.5, and only one RHR loop is required to be OPERABLE and in operation.
| |
| An immediate Completion Time is necessary for an operator to initiate corrective actions.B._1 If no RHR loop is in operation, there will be no forced circulation to provide mixing to establish uniform boron concentrations.
| |
| Suspending positive reactivity additions that could result in failure to meet the minimum boron concentration limit is required to assure continued safe operation.
| |
| Introduction of coolant inventory must be from sources that have a boron concentration greater than that which would be required in the RCS for minimum refueling boron concentration.
| |
| This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation.
| |
| McGuire Units 1 and 2 B 3.9.6-2 Revision No. 115 RHR and Coolant Circulation
| |
| -Low Water Level B 3.9.6 BASES ACTIONS (continued)
| |
| B.2 If no RHR loop is in operation, actions shall be initiated immediately, and continued, to restore one RHR loop to operation.
| |
| Since the unit is in Conditions A and B concurrently, the restoration of two OPERABLE RHR loops and one operating RHR loop should be accomplished expeditiously.
| |
| B.3 If no RHR loop is in operation, all containment penetrations providing direct access from the containment atmosphere to the outside atmosphere must be closed within 4 hours. With the RHR loop requirements not met, the potential exists for the coolant to boil and release radioactive gas to the containment atmosphere.
| |
| Closing containment penetrations that are open to the outside atmosphere ensures that dose limits are not exceeded.
| |
| The Completion Time of 4 hours is appropriate for the majority of time during refueling operations, based on time to coolant boiling, since water level is not routinely maintained at low levels.SURVEILLANCE SR 3.9.6.1 REQUIREMENTS This Surveillance demonstrates that one RHR loop is in operation and circulating reactor coolant. The flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability, prevent vortexing in the suction of the RHR pumps, and to prevent thermal and boron stratification in the core. The RCS temperature is determined to ensure the appropriate decay heat removal is maintained.
| |
| In addition, during operation of the RHR loop with the water level in the vicinity of the reactor vessel nozzles, the RHR pump suction requirements must be met.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.9.6.2 Verification that the required pump is OPERABLE ensures that an additional RCS or RHR pump can be placed in operation, if needed, to maintain decay heat removal and reactor coolant circulation.
| |
| Verification is performed by verifying proper breaker alignment and power available to the required pump. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Units 1 and 2 B 3.9.6-3 Revision No. 115 RHR and Coolant Circulation
| |
| -Low Water Level B 3.9.6 BASES REFERENCES I.2.UFSAR, Section 5.5.7.10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B 3.9.6-4 Revision No. 115 Refueling Cavity Water Level B 3.9.7 B 3.9 REFUELING OPERATIONS B 3.9.7 Refueling Cavity Water Level BASES BACKGROUND The movement of irradiated fuel assemblies or performance of CORE ALTERATIONS, except during latching and unlatching of control rod drive shafts, within containment requires a minimum water level of 23 ft above the top of the reactor vessel flange. During refueling, this maintains sufficient water level in the containment, refueling canal, fuel transfer canal, refueling cavity, and spent fuel pool. Sufficient water is necessary to retain iodine fission product activity in the water in the event of a fuel handling accident (Refs. 1 and 2). Sufficient iodine activity would be retained to limit offsite doses from the accident to within 10 CFR 50.67 (ref. 3) limits, as provided by the guidance of Reference 1.APPLICABLE SAFETY ANALYSES During CORE ALTERATIONS and movement of irradiated fuel assemblies, the water level in the refueling canal and the 'refueling cavity is an initial condition design parameter in the analysis of a fuel handling accident in containment, as postulated by Regulatory Guide 1.183 (Ref. 1). Regulatory Guide 1.183 Appendix B provides the regulatory positions applicable to evaluating the radiological consequences of a fuel handling accident.
| |
| The methodology stipulates a minimum water level of 23 feet to apply an effective iodine decontamination factor of 200 to the chemical forms of iodine given in Reference 1.The fuel handling accident analysis inside containment is described in Reference
| |
| : 2. With a minimum water level of 23 ft and a minimum decay time of 72 hours prior to fuel handling, the analysis and test programs demonstrate that the iodine release due to a postulated fuel handling accident is adequately captured by the water and offsite doses are maintained within allowable limits (Refs. 1 and 4).Refueling cavity water level satisfies Criterion 2 of 10 CFR 50.36 (Ref. 5).LCO A minimum refueling cavity water level of 23 ft above the reactor vessel flange is required to ensure that the radiological consequences of a postulated fuel handling accident inside containment are within acceptable limits, as provided by the guidance of Reference 1.McGuire Units I and 2 B 3.9.7-1 Revision No. 115 Refueling Cavity Water Level B 3.9.7 BASES APPLICABILITY LCO 3.9.7 is applicable during CORE ALTERATIONS, except during latching and unlatching of control rod drive shafts, and is also applicable when moving irradiated fuel assemblies within containment.
| |
| The LCO minimizes the possibility of a fuel handling accident in containment that is beyond the assumptions of the safety analysis.
| |
| If irradiated fuel assemblies are not present in containment, there can be no significant radioactivity release as a result of a postulated fuel handling accident.Requirements for fuel handling accidents in the spent fuel pool are covered by LCO 3.7.13, "Spent Fuel Pool Water Level." ACTIONS A.1 and A.2 With a water level of < 23 ft above the top of the reactor vessel flange, all operations involving CORE ALTERATIONS or movement of irradiated fuel assemblies within the containment shall be suspended immediately to ensure that a fuel handling accident cannot occur.The suspension of CORE ALTERATIONS and fuel movement shall not preclude completion of movement of a component to a safe position.SURVEILLANCE REQUIREMENTS SR 3.9.7.1 Verification of a minimum water level of 23 ft above the top of the reactor vessel flange ensures that the design basis for the analysis of the postulated fuel handling accident during refueling operations is met.Water at the required level above the top of the reactor vessel flange limits the consequences of damaged fuel rods that are postulated to result from a fuel handling accident inside containment (Ref. 2).The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.McGuire Units 1 and 2 B 3.9.7-2 Revision No. 115 Refueling Cavity Water Level B 3.9.7 BASES REFERENCES
| |
| : 1. Regulatory Guide 1.183, Rev. 0.2. UFSAR, Section 15.7.4.3. 10 CFR 50.67, Accident Source Term.4. Malinowski, D. D., Bell, M. J., Duhn, E., and Locante, J., WCAP-7828, Radiological Consequences of a Fuel Handling Accident, December 1971.5. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
| |
| McGuire Units 1 and 2 B63.9.7-3 Revision No. 115}}
| |
