|
|
| Line 17: |
Line 17: |
|
| |
|
| =Text= | | =Text= |
| {{#Wiki_filter:AFFECTED PAGE LIST - TECHNICAL SPECIFICATIONS BASES TABLE OF CONTENTS I Revision 76 ii Revision 76 iii Revision 63 B 2.0 SAFETY LIMITS (SLs) | | {{#Wiki_filter:}} |
| B 2.1.1-1 Revision 83 B 2.1.1-2 Revision 83 B 2.1.1-3 Revision 83 B 2.1.1-4 Revision 86 B 2.1.1-5 Revision 68 B 2.1.2-1 Revision 48 B 2.1.2-2 Revision 52 B 2.1.2-3 Revision 48 B 3.0 LIMITING CONDITION FOR OPERATION (LCO) AND SURVEILLANCE REQUIREMENT (SR) APPLICABILITY B 3.0-1 Revision 84 B 3.0-2 Revision 82 B 3.0-3 Revision 82 B 3.0-4 Revision 71 B 3.0-5 Revision 71 B 3.0-6 Revision 71 B 3.0-7 Revision 71 B 3.0-8 Revision 71 B 3.0-9 Revision 71 B 3.0-10 Revision 71 B 3.0-11 Revision 71 B 3.0-12 Revision 71 B 3.0-13 Revision 75 B 3.0-14 Revision 75 B 3.0-15 Revision 75 B 3.0-16 Revision 84 B 3.0-17 Revision 84 B 3.0-18 Revision 84 B 3.0-19 Revision 84 B 3.0-20 Revision 84 B 3.0-21 Revision 84 B 3.0-22 Revision 84 LaSalle 1 and 2 Page 1 of 22 Revision 91
| |
| | |
| AFFECTED PAGE LIST - TECHNICAL SPECIFICATIONS BASES B 3.0 LIMITING CONDITION FOR OPERATION (LCO) AND SURVEILLANCE REQUIREMENT (SR) APPLICABILITY (continued)
| |
| B 3.0-23 Revision 84 B 3.0-24 Revision 84 B 3.0-25 Revision 84 B 3.0-26 Revision 84 B 3.0-27 Revision 84 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.1-1 Revision 0 B 3.1.1-2 Revision 0 B 3.1.1-3 Revision 0 B 3.1.1-4 Revision 0 B 3.1.1-5 Revision 0 B.3.1.1-6 Revision 0 B 3.1.2-1 Revision 0 B 3.1.2-2 Revision 0 B 3.1.2-3 Revision 0 B 3.1.2-4 Revision 0 B 3.1.2-5 Revision 0 B 3.1.3-1 Revision 0 B 3.1.3-2 Revision 0 B 3.1.3-3 Revision 0 B 3.1.3-4 Revision 42 B 3.1.3-5 Revision 0 B 3.1.3-6 Revision 91 B 3.1.3-7 Revision 91 B 3.1.3-8 Revision 51 B 3.1.3-9 Revision 91 B 3.1.3-10 Revision 91 B 3.1.3-11 Revision 0 B 3.1.3-12 Revision 0 B 3.1.3-13 Revision 0 B 3.1.3-14 Revision 42 B 3.1.3-15 Revision 0 B 3.1.3-16 Revision 0 B 3.1.3-17 Revision 51 B 3.1.3-18 Revision 51 B 3.1.3-19 Revision 0 B 3.1.3-20 Revision 0 B 3.1.4-1 Revision 0 B 3.1.4-2 Revision 0 B 3.1.4-3 Revision 0 B 3.1.4-4 Revision 0 LaSalle 1 and 2 Page 2 of 22 Revision 91
| |
| | |
| AFFECTED PAGE LIST - TECHNICAL SPECIFICATIONS BASES B 3.1 REACTIVITY CONTROL SYSTEMS (continued)
| |
| B 3.1.4-5 Revision 78 B 3.1.4-6 Revision 0 B 3.1.4-7 Revision 0 B 3.1.5-1 Revision 0 B 3.1.5-2 Revision 0 B 3.1.5-3 Revision 0 B 3.1.5-4 Revision 0 B 3.1.5-5 Revision 51 B 3.1.6-1 Revision 91 B 3.1.6-2 Revision 91 B 3.1.6-3 Revision 91 B 3.1.6-4 Revision 91 B 3.1.6-5 Revision 91 B 3.1.6-6 Revision 91 B 3.1.6-7 Revision 0 B 3.1.6-8 Revision 17 B 3.1.6-9 Revision 17 B 3.1.6-10 Revision 17 B 3.1.6-11 Revision 51 B 3.1.6-12 Revision 17 B 3.1.7-1 Revision 48 B 3.1.7-2 Revision 48 B 3.1.7-3 Revision 89 B 3.1.7-4 Revision 51 B 3.1.7-5 Revision 51 B 3.1.7-6 Revision 70 B 3.1.7-7 Revision 51 B 3.1.8-1 Revision 48 B 3.1.8-2 Revision 0 B 3.1.8-3 Revision 0 B 3.1.8-4 Revision 51 B 3.1.8-5 Revision 51 LaSalle 1 and 2 Page 3 of 22 Revision 91
| |
| | |
| AFFECTED PAGE LIST - TECHNICAL SPECIFICATIONS BASES B 3.2 POWER DISTRIBUTION LIMITS B 3.2.1-1 Revision 0 B 3.2.1-2 Revision 0 B 3.2.1-3 Revision 51 B 3.2.2-1 Revision 83 B 3.2.2-2 Revision 83 B 3.2.2-3 Revision 83 B 3.2.2-4 Revision 83 B 3.2.2-5 Revision 83 B 3.2.2-6 Revision 83 B 3.2.3-1 Revision 48 B 3.2.3-2 Revision 51 B 3.2.3-3 Revision 51 LaSalle 1 and 2 Page 4 of 22 Revision 91
| |
| | |
| AFFECTED PAGE LIST - TECHNICAL SPECIFICATIONS BASES B 3.3 INSTRUMENTATION B 3.3.1.1-1 Revision 0 B 3.3.1.1-2 Revision 41 B 3.3.1.1-3 Revision 0 B 3.3.1.1-4 Revision 41 B 3.3.1.1-5 Revision 0 B 3.3.1.1-6 Revision 0 B 3.3.1.1-7 Revision 0 B 3.3.1.1-8 Revision 0 B 3.3.1.1-9 Revision 0 B 3.3.1.1-10 Revision 0 B 3.3.1.1-11 Revision 0 B 3.3.1.1-12 Revision 0 B 3.3.1.1-13 Revision 0 B 3.3.1.1-14 Revision 0 B 3.3.1.1-15 Revision 68 B 3.3.1.1-16 Revision 0 B 3.3.1.1-17 Revision 0 B 3.3.1.1-18 Revision 0 B 3.3.1.1-19 Revision 0 B 3.3.1.1-20 Revision 0 B 3.3.1.1-21 Revision 79 B 3.3.1.1-22 Revision 89 B 3.3.1.1-23 Revision 89 B 3.3.1.1-24 Revision 0 B 3.3.1.1-25 Revision 0 B 3.3.1.1-26 Revision 79 B 3.3.1.1-27 Revision 79 B 3.3.1.1-28 Revision 79 B 3.3.1.1-29 Revision 79 B 3.3.1.1-30 Revision 51 B 3.3.1.1-31 Revision 51 B 3.3.1.1-32 Revision 51 B 3.3.1.1-33 Revision 51 B 3.3.1.1-34 Revision 51 B 3.3.1.1-35 Revision 51 B 3.3.1.1-36 Revision 47 B 3.3.1.2-1 Revision 0 B 3.3.1.2-2 Revision 0 B 3.3.1.2-3 Revision 0 B 3.3.1.2-4 Revision 0 B 3.3.1.2-5 Revision 0 B 3.3.1.2-6 Revision 51 B 3.3.1.2-7 Revision 51 B 3.3.1.2-8 Revision 51 B 3.3.1.2-9 Revision 51 LaSalle 1 and 2 Page 5 of 22 Revision 91
| |
| | |
| AFFECTED PAGE LIST - TECHNICAL SPECIFICATIONS BASES B 3.3 INSTRUMENTATION (continued)
| |
| B 3.3.1.2-10 Revision 0 B 3.3.1.3-1 Revision 30 B 3.3.1.3-2 Revision 23 B 3.3.1.3-3 Revision 49 B 3.3.1.3-4 Revision 23 B 3.3.1.3-5 Revision 23 B 3.3.1.3-6 Revision 23 B 3.3.1.3-7 Revision 51 B 3.3.1.3-8 Revision 51 B 3.3.1.3-9 Revision 51 B 3.3.1.3-10 Revision 23 B 3.3.2.1-1 Revision 44 B 3.3.2.1-2 Revision 91 B 3.3.2.1-3 Revision 44 B 3.3.2.1-4 Revision 91 B 3.3.2.1-5 Revision 91 B 3.3.2.1-6 Revision 39 B 3.3.2.1-7 Revision 39 B 3.3.2.1-8 Revision 39 B 3.3.2.1-9 Revision 51 B 3.3.2.1-10 Revision 91 B 3.3.2.1-11 Revision 91 B 3.3.2.1-12 Revision 51 B 3.3.2.1-13 Revision 91 B 3.3.2.1-14 Revision 44 B 3.3.2.1-15 Revision 44 B 3.3.2.1-16 Revision 44 B 3.3.2.1-17 Revision 39 B 3.3.2.1-18 Revision 51 B 3.3.2.1-19 Revision 39 B 3.3.2.1-20 Revision 39 B 3.3.2.1-21 Revision 39 B 3.3.2.1-22 Revision 51 B 3.3.2.1-23 Revision 51 B 3.3.2.1-24 Revision 51 B 3.3.2.1-25 Revision 51 B 3.3.2.1-26 Revision 51 B 3.3.2.2-1 Revision 0 B 3.3.2.2-2 Revision 0 B 3.3.2.2-3 Revision 0 B 3.3.2.2-4 Revision 89 B 3.3.2.2-5 Revision 0 B 3.3.2.2-6 Revision 51 B 3.3.2.2-7 Revision 51 B 3.3.2.2-8 Revision 51 LaSalle 1 and 2 Page 6 of 22 Revision 91
| |
| | |
| AFFECTED PAGE LIST - TECHNICAL SPECIFICATIONS BASES B 3.3 INSTRUMENTATION (continued)
| |
| B 3.3.3.1-1 Revision 0 B 3.3.3.1-2 Revision 0 B 3.3.3.1-3 Revision 0 B 3.3.3.1-4 Revision 0 B 3.3.3.1-5 Revision 0 B 3.3.3.1-6 Revision 24 B 3.3.3.1-7 Revision 24 B 3.3.3.1-8 Revision 0 B 3.3.3.1-9 Revision 0 B 3.3.3.1-10 Revision 51 LaSalle 1 and 2 Page 7 of 22 Revision 91
| |
| | |
| AFFECTED PAGE LIST - TECHNICAL SPECIFICATIONS BASES B 3.3 INSTRUMENTATION (continued)
| |
| B 3.3.3.1-11 Revision 51 B 3.3.3.2-1 Revision 0 B 3.3.3.2-2 Revision 0 B 3.3.3.2-3 Revision 19 B 3.3.3.2-4 Revision 51 B 3.3.3.2-5 Revision 51 B 3.3.4.1-1 Revision 0 B 3.3.4.1-2 Revision 0 B 3.3.4.1-3 Revision 0 B 3.3.4.1-4 Revision 0 B 3.3.4.1-5 Revision 0 B 3.3.4.1-6 Revision 0 B 3.3.4.1-7 Revision 0 B 3.3.4.1-8 Revision 51 B 3.3.4.1-9 Revision 51 B 3.3.4.1-10 Revision 51 B 3.3.4.1-11 Revision 51 B 3.3.4.1-12 Revision 0 B 3.3.4.2-1 Revision 31 B 3.3.4.2-2 Revision 0 B 3.3.4.2-3 Revision 0 B 3.3.4.2-4 Revision 0 B 3.3.4.2-5 Revision 89 B 3.3.4.2-6 Revision 0 B 3.3.4.2-7 Revision 51 B 3.3.4.2-8 Revision 51 B 3.3.4.2-9 Revision 51 B 3.3.5.1-1 Revision 0 B 3.3.5.1-2 Revision 0 B 3.3.5.1-3 Revision 0 B 3.3.5.1-4 Revision 0 B 3.3.5.1-5 Revision 0 B 3.3.5.1-6 Revision 0 B 3.3.5.1-7 Revision 0 B 3.3.5.1-8 Revision 76 B 3.3.5.1-9 Revision 0 B 3.3.5.1-10 Revision 76 B 3.3.5.1-11 Revision 76 B 3.3.5.1-12 Revision 76 B 3.3.5.1-13 Revision 76 B 3.3.5.1-14 Revision 76 B 3.3.5.1-15 Revision 76 LaSalle 1 and 2 Page 8 of 22 Revision 91
| |
| | |
| AFFECTED PAGE LIST - TECHNICAL SPECIFICATIONS BASES B 3.3 INSTRUMENTATION (continued)
| |
| B 3.3.5.1-16 Revision 76 B 3.3.5.1-17 Revision 76 B 3.3.5.1-18 Revision 76 B 3.3.5.1-19 Revision 0 B 3.3.5.1-20 Revision 0 B 3.3.5.1-21 Revision 0 B 3.3.5.1-22 Revision 0 B 3.3.5.1-23 Revision 0 B 3.3.5.1-24 Revision 0 B 3.3.5.1-25 Revision 76 B 3.3.5.1-26 Revision 89 B 3.3.5.1-27 Revision 89 B 3.3.5.1-28 Revision 89 B 3.3.5.1-29 Revision 89 B 3.3.5.1-30 Revision 89 B 3.3.5.1-31 Revision 89 B 3.3.5.1-32 Revision 89 B 3.3.5.1-33 Revision 89 B 3.3.5.1-34 Revision 89 B 3.3.5.1-35 Revision 89 B 3.3.5.1-36 Revision 89 B 3.3.5.1-37 Revision 89 B 3.3.5.1-38 Revision 89 B 3.3.5.1-39 Revision 89 B 3.3.5.2-1 Revision 90 B 3.3.5.2-2 Revision 90 B 3.3.5.2-3 Revision 90 B 3.3.5.2-4 Revision 90 B 3.3.5.2-5 Revision 90 B 3.3.5.2-6 Revision 90 B 3.3.5.3-1 Revision 76 B 3.3.5.3-2 Revision 76 B 3.3.5.3-3 Revision 76 B 3.3.5.3-4 Revision 76 B 3.3.5.3-5 Revision 76 B 3.3.5.3-6 Revision 76 B 3.3.5.3-7 Revision 89 B 3.3.5.3-8 Revision 89 B 3.3.5.3-9 Revision 89 LaSalle 1 and 2 Page 9 of 22 Revision 91
| |
| | |
| AFFECTED PAGE LIST - TECHNICAL SPECIFICATIONS BASES B 3.3 INSTRUMENTATION (continued)
| |
| B 3.3.5.3-10 Revision 89 B 3.3.5.3-11 Revision 89 B 3.3.5.3-12 Revision 89 B 3.3.6.1-1 Revision 0 B 3.3.6.1-2 Revision 0 B 3.3.6.1-3 Revision 0 B 3.3.6.1-4 Revision 0 B 3.3.6.1-5 Revision 0 B 3.3.6.1-6 Revision 0 B 3.3.6.1-7 Revision 76 B 3.3.6.1-8 Revision 48 B 3.3.6.1-9 Revision 68 B 3.3.6.1-10 Revision 0 B 3.3.6.1-11 Revision 0 B 3.3.6.1-12 Revision 48 B 3.3.6.1-13 Revision 73 B 3.3.6.1-14 Revision 48 B 3.3.6.1-15 Revision 0 B 3.3.6.1-16 Revision 0 B 3.3.6.1-17 Revision 0 B 3.3.6.1-18 Revision 0 B 3.3.6.1-19 Revision 0 B 3.3.6.1-20 Revision 0 B 3.3.6.1-21 Revision 0 B 3.3.6.1-22 Revision 0 B 3.3.6.1-23 Revision 0 B 3.3.6.1-24 Revision 0 B 3.3.6.1-25 Revision 48 B 3.3.6.1-26 Revision 48 B 3.3.6.1-27 Revision 76 B 3.3.6.1-28 Revision 0 B 3.3.6.1-29 Revision 0 B 3.3.6.1-30 Revision 89 B 3.3.6.1-31 Revision 0 B 3.3.6.1-32 Revision 0 B 3.3.6.1-33 Revision 0 B 3.3.6.1-34 Revision 0 B 3.3.6.1-35 Revision 90 B 3.3.6.1-36 Revision 51 B 3.3.6.1-37 Revision 51 B 3.3.6.1-38 Revision 51 B 3.3.6.1-39 Revision 15 LaSalle 1 and 2 Page 10 of 22 Revision 91
| |
| | |
| AFFECTED PAGE LIST - TECHNICAL SPECIFICATIONS BASES B 3.3 INSTRUMENTATION (continued)
| |
| B 3.3.6.2-1 Revision 0 B 3.3.6.2-2 Revision 0 B 3.3.6.2-3 Revision 0 B 3.3.6.2-4 Revision 76 B 3.3.6.2-5 Revision 0 B 3.3.6.2-6 Revision 76 B 3.3.6.2-7 Revision 76 B 3.3.6.2-8 Revision 0 B 3.3.6.2-9 Revision 6 B 3.3.6.2-10 Revision 51 B 3.3.6.2-11 Revision 51 B 3.3.6.2-12 Revision 51 B 3.3.7.1-1 Revision 0 B 3.3.7.1-2 Revision 48 B 3.3.7.1-3 Revision 76 B 3.3.7.1-4 Revision 0 B 3.3.7.1-5 Revision 0 B 3.3.7.1-6 Revision 51 B 3.3.7.1-7 Revision 51 B 3.3.7.1-8 Revision 51 B 3.3.8.1-1 Revision 0 B 3.3.8.1-2 Revision 0 B 3.3.8.1-3 Revision 0 B 3.3.8.1-4 Revision 90 B 3.3.8.1-5 Revision 13 B 3.3.8.1-6 Revision 76 B 3.3.8.1-7 Revision 90 B 3.3.8.1-8 Revision 51 B 3.3.8.1-9 Revision 90 B 3.3.8.2-1 Revision 0 B 3.3.8.2-2 Revision 0 B 3.3.8.2-3 Revision 0 B 3.3.8.2-4 Revision 76 B 3.3.8.2-5 Revision 32 B 3.3.8.2-6 Revision 76 B 3.3.8.2-7 Revision 76 B 3.3.8.2-8 Revision 51 B 3.3.8.2-9 Revision 51 LaSalle 1 and 2 Page 11 of 22 Revision 91
| |
| | |
| AFFECTED PAGE LIST - TECHNICAL SPECIFICATIONS BASES B 3.4 REACTOR COOLANT SYSTEM (RCS)
| |
| B 3.4.1-1 Revision 0 B 3.4.1-2 Revision 23 B 3.4.1-3 Revision 23 B 3.4.1-4 Revision 23 B 3.4.1-5 Revision 23 B 3.4.1-6 Revision 51 B 3.4.2-1 Revision 0 B 3.4.2-2 Revision 0 B 3.4.2-3 Revision 0 B 3.4.2-4 Revision 51 B 3.4.3-1 Revision 0 B 3.4.3-2 Revision 0 B 3.4.3-3 Revision 0 B 3.4.3-4 Revision 51 B 3.4.3-5 Revision 0 B 3.4.4-1 Revision 0 B 3.4.4-2 Revision 4 B 3.4.4-3 Revision 76 B 3.4.4-4 Revision 76 B 3.4.5-1 Revision 0 B 3.4.5-2 Revision 91 B 3.4.5-3 Revision 91 B 3.4.5-4 Revision 91 B 3.4.5-5 Revision 91 B 3.4.6-1 Revision 0 B 3.4.6-2 Revision 0 B 3.4.6-3 Revision 0 B 3.4.6-4 Revision 0 B 3.4.6-5 Revision 70 B 3.4.6-6 Revision 0 B 3.4.7-1 Revision 53 B 3.4.7-2 Revision 53 B 3.4.7-3 Revision 53 B 3.4.7-4 Revision 53 B 3.4.7-5 Revision 53 B 3.4.7-6 Revision 53 B 3.4.7-7 Revision 53 B 3.4.7-8 Revision 53 B 3.4.7-9 Revision 53 LaSalle 1 and 2 Page 12 of 22 Revision 91
| |
| | |
| AFFECTED PAGE LIST - TECHNICAL SPECIFICATIONS BASES B 3.4 REACTOR COOLANT SYSTEM (RCS) (continued)
| |
| B 3.4.8-1 Revision 0 B 3.4.8-2 Revision 0 B 3.4.8-3 Revision 19 B 3.4.8-4 Revision 51 B 3.4.9-1 Revision 0 B 3.4.9-2 Revision 60 B 3.4.9-3 Revision 87 B 3.4.9-4 Revision 87 B 3.4.9-5 Revision 87 B 3.4.9-6 Revision 60 B 3.4.9-7 Revision 60 B 3.4.10-1 Revision 0 B 3.4.10-2 Revision 60 B 3.4.10-3 Revision 13 B 3.4.10-4 Revision 87 B 3.4.10-5 Revision 87 B 3.4.10-6 Revision 87 B 3.4.10-7 Revision 87 B 3.4.11-1 Revision 50 B 3.4.11-2 Revision 16 B 3.4.11-3 Revision 13 B 3.4.11-4 Revision 0 B 3.4.11-5 Revision 0 B 3.4.11-6 Revision 51 B 3.4.11-7 Revision 51 B 3.4.11-8 Revision 51 B 3.4.11-9 Revision 51 B 3.4.12-1 Revision 0 B 3.4.12-2 Revision 0 B 3.4.12-3 Revision 51 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS), REACTOR PRESSURE VESSEL (RPV) WATER INVENTORY CONTROL, AND REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM B 3.5.1-1 Revision 76 B 3.5.1-2 Revision 0 B 3.5.1-3 Revision 6 B 3.5.1-4 Revision 45 B 3.5.1-5 Revision 61 B 3.5.1-6 Revision 89 B 3.5.1-7 Revision 89 B 3.5.1-8 Revision 89 LaSalle 1 and 2 Page 13 of 22 Revision 91
| |
| | |
| AFFECTED PAGE LIST - TECHNICAL SPECIFICATIONS BASES B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS), REACTOR PRESSURE VESSEL (RPV) WATER INVENTORY CONTROL, AND REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM (continued)
| |
| B 3.5.1-9 Revision 45 B 3.5.1-10 Revision 60 B 3.5.1-11 Revision 60 B 3.5.1-12 Revision 60 B 3.5.1-13 Revision 70 B 3.5.1-14 Revision 60 B 3.5.1-15 Revision 60 B 3.5.2-1 Revision 90 B 3.5.2-2 Revision 90 B 3.5.2-3 Revision 90 B 3.5.2-4 Revision 76 B 3.5.2-5 Revision 76 B 3.5.2-6 Revision 90 B 3.5.2-7 Revision 90 B 3.5.2-8 Revision 90 B 3.5.2-9 Revision 90 B 3.5.2-10 Revision 90 B 3.5.2-11 Revision 90 B 3.5.2-12 Revision 90 B 3.5.3-1 Revision 76 B 3.5.3-2 Revision 76 B 3.5.3-3 Revision 89 B 3.5.3-4 Revision 60 B 3.5.3-5 Revision 60 B 3.5.3-6 Revision 83 B 3.5.3-7 Revision 83 B 3.5.3-8 Revision 60 B 3.6 CONTAINMENT SYSTEMS B 3.6.1.1-1 Revision 0 B 3.6.1.1-2 Revision 65 B 3.6.1.1-3 Revision 32 B 3.6.1.1-4 Revision 32 B 3.6.1.1-5 Revision 51 B 3.6.1.1-6 Revision 51 B 3.6.1.1-7 Revision 32 B 3.6.1.2-1 Revision 0 B 3.6.1.2-2 Revision 65 LaSalle 1 and 2 Page 14 of 22 Revision 91
| |
| | |
| AFFECTED PAGE LIST - TECHNICAL SPECIFICATIONS BASES B 3.6 CONTAINMENT SYSTEMS (continued)
| |
| B 3.6.1.2-3 Revision 0 B 3.6.1.2-4 Revision 0 B 3.6.1.2-5 Revision 0 B 3.6.1.2-6 Revision 89 B 3.6.1.2-7 Revision 0 B 3.6.1.2-8 Revision 51 B 3.6.1.3-1 Revision 0 B 3.6.1.3-2 Revision 0 B 3.6.1.3-3 Revision 76 B 3.6.1.3-4 Revision 0 B 3.6.1.3-5 Revision 89 B 3.6.1.3-6 Revision 89 B 3.6.1.3-7 Revision 89 B 3.6.1.3-8 Revision 0 B 3.6.1.3-9 Revision 76 B 3.6.1.3-10 Revision 76 B 3.6.1.3-11 Revision 51 B 3.6.1.3-12 Revision 51 B 3.6.1.3-13 Revision 70 B 3.6.1.3-14 Revision 77 B 3.6.1.3-15 Revision 77 B 3.6.1.3-16 Revision 77 B 3.6.1.4-1 Revision 0 B 3.6.1.4-2 Revision 0 B 3.6.1.4-3 Revision 51 B 3.6.1.5-1 Revision 0 B 3.6.1.5-2 Revision 0 B 3.6.1.5-3 Revision 51 B 3.6.1.6-1 Revision 0 B 3.6.1.6-2 Revision 0 B 3.6.1.6-3 Revision 0 B 3.6.1.6-4 Revision 89 B 3.6.1.6-5 Revision 32 B 3.6.1.6-6 Revision 51 B 3.6.1.6-7 Revision 32 B 3.6.2.1-1 Revision 0 B 3.6.2.1-2 Revision 0 B 3.6.2.1-3 Revision 0 B 3.6.2.1-4 Revision 51 B 3.6.2.1-5 Revision 51 LaSalle 1 and 2 Page 15 of 22 Revision 91
| |
| | |
| AFFECTED PAGE LIST - TECHNICAL SPECIFICATIONS BASES B 3.6 CONTAINMENT SYSTEMS (continued)
| |
| B 3.6.2.2-1 Revision 0 B 3.6.2.2-2 Revision 76 B 3.6.2.2-3 Revision 51 B 3.6.2.3-1 Revision 38 B 3.6.2.3-2 Revision 89 B 3.6.2.3-3 Revision 60 B 3.6.2.3-4 Revision 70 B 3.6.2.3-5 Revision 60 B 3.6.2.3-6 Revision 60 B 3.6.2.4-1 Revision 0 B 3.6.2.4-2 Revision 89 B 3.6.2.4-3 Revision 32 B 3.6.2.4-4 Revision 70 B 3.6.2.4-5 Revision 60 B 3.6.2.4-6 Revision 60 B 3.6.3.1-1 Revision 19 B 3.6.3.2-1 Revision 85 B 3.6.3.2-2 Revision 85 B 3.6.3.2-3 Revision 85 B 3.6.4.1-1 Revision 0 B 3.6.4.1-2 Revision 76 B 3.6.4.1-3 Revision 76 B 3.6.4.1-4 Revision 76 B 3.6.4.1-5 Revision 72 B 3.6.4.1-6 Revision 68 B 3.6.4.2-1 Revision 0 B 3.6.4.2-2 Revision 76 B 3.6.4.2-3 Revision 0 B 3.6.4.2-4 Revision 0 B 3.6.4.2-5 Revision 76 B 3.6.4.2-6 Revision 51 B 3.6.4.2-7 Revision 51 B 3.6.4.3-1 Revision 0 B 3.6.4.3-2 Revision 0 B 3.6.4.3-3 Revision 76 B 3.6.4.3-4 Revision 76 B 3.6.4.3-5 Revision 76 B 3.6.4.3-6 Revision 76 LaSalle 1 and 2 Page 16 of 22 Revision 91
| |
| | |
| AFFECTED PAGE LIST - TECHNICAL SPECIFICATIONS BASES B 3.7 PLANT SYSTEMS B 3.7.1-1 Revision 0 B 3.7.1-2 Revision 38 B 3.7.1-3 Revision 0 B 3.7.1-4 Revision 89 B 3.7.1-5 Revision 42 B 3.7.1-6 Revision 51 B 3.7.2-1 Revision 0 B 3.7.2-2 Revision 2 B 3.7.2-3 Revision 76 B 3.7.2-4 Revision 76 B 3.7.2-5 Revision 76 B 3.7.2-6 Revision 76 B 3.7.3-1 Revision 29 B 3.7.3-2 Revision 88 B 3.7.3-3 Revision 88 B 3.7.3-4 Revision 88 B 3.7.3-5 Revision 88 B 3.7.4-1 Revision 36 B 3.7.4-2 Revision 48 B 3.7.4-3 Revision 48 B 3.7.4-4 Revision 76 B 3.7.4-5 Revision 76 B 3.7.4-6 Revision 76 B 3.7.4-7 Revision 76 B 3.7.4-8 Revision 76 B 3.7.4-9 Revision 58 B 3.7.4-10 Revision 51 B.3.7.4-11 Revision 36 B 3.7.5-1 Revision 0 B 3.7.5-2 Revision 0 B 3.7.5-3 Revision 76 B 3.7.5-4 Revision 34 B 3.7.5-5 Revision 76 B 3.7.5-6 Revision 76 B 3.7.5-7 Revision 51 B 3.7.6-1 Revision 0 B 3.7.6-2 Revision 32 B 3.7.6-3 Revision 51 B 3.7.7-1 Revision 0 B 3.7.7-2 Revision 37 B 3.7.7-3 Revision 51 B 3.7.7-4 Revision 51 B 3.7.8-1 Revision 48 B 3.7.8-2 Revision 51 B 3.7.8-3 Revision 48 LaSalle 1 and 2 Page 17 of 22 Revision 91
| |
| | |
| AFFECTED PAGE LIST - TECHNICAL SPECIFICATIONS BASES B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.1-1 Revision 19 B 3.8.1-2 Revision 67 B 3.8.1-3 Revision 0 B 3.8.1-4 Revision 57 B 3.8.1-5 Revision 0 B 3.8.1-6 Revision 0 B 3.8.1-7 Revision 19 B 3.8.1-8 Revision 19 B 3.8.1-9 Revision 89 B 3.8.1-10 Revision 81 B 3.8.1-11 Revision 19 B 3.8.1-12 Revision 89 B 3.8.1-13 Revision 81 B 3.8.1-14 Revision 76 B 3.8.1-15 Revision 76 B 3.8.1-16 Revision 89 B 3.8.1-17 Revision 76 B 3.8.1-18 Revision 89 B 3.8.1-19 Revision 89 B 3.8.1-20 Revision 89 B 3.8.1-21 Revision 89 B 3.8.1-22 Revision 89 B 3.8.1-23 Revision 89 B 3.8.1-24 Revision 89 B 3.8.1-25 Revision 89 B 3.8.1-26 Revision 89 B 3.8.1-27 Revision 89 B 3.8.1-28 Revision 89 B 3.8.1-29 Revision 89 B 3.8.1-30 Revision 89 B 3.8.1-31 Revision 89 B 3.8.1-32 Revision 89 B 3.8.1-33 Revision 89 B 3.8.1-34 Revision 89 B 3.8.1-35 Revision 89 B 3.8.1-36 Revision 89 B 3.8.1-37 Revision 89 B 3.8.1-38 Revision 89 B 3.8.1-39 Revision 89 B 3.8.1-40 Revision 80 B 3.8.1-41 Revision 89 B 3.8.1-42 Revision 89 B 3.8.1-43 Revision 89 B 3.8.1-44 Revision 89 B 3.8.1-45 Revision 89 LaSalle 1 and 2 Page 18 of 22 Revision 91
| |
| | |
| AFFECTED PAGE LIST - TECHNICAL SPECIFICATIONS BASES B 3.8 ELECTRICAL POWER SYSTEMS (continued)
| |
| B 3.8.2-1 Revision 76 B 3.8.2-2 Revision 0 B 3.8.2-3 Revision 90 B 3.8.2-4 Revision 90 B 3.8.2-5 Revision 90 B 3.8.2-6 Revision 90 B 3.8.2-7 Revision 90 B 3.8.2-8 Revision 90 B 3.8.3-1 Revision 33 B 3.8.3-2 Revision 33 B 3.8.3-3 Revision 40 B 3.8.3-4 Revision 0 B 3.8.3-5 Revision 51 B 3.8.3-6 Revision 51 B 3.8.3-7 Revision 40 B 3.8.3-8 Revision 51 B.3.8.3-9 Revision 40 B 3.8.4-1 Revision 27 B 3.8.4-2 Revision 27 B 3.8.4-3 Revision 51 B 3.8.4-4 Revision 27 B 3.8.4-5 Revision 27 B 3.8.4-6 Revision 27 B 3.8.4-7 Revision 89 B 3.8.4-8 Revision 89 B 3.8.4-9 Revision 89 B 3.8.4-10 Revision 89 B 3.8.4-11 Revision 89 B 3.8.4-12 Revision 89 B 3.8.4-13 Revision 89 B 3.8.5-1 Revision 76 B 3.8.5-2 Revision 27 B 3.8.5-3 Revision 76 B 3.8.5-4 Revision 27 B 3.8.5-5 Revision 27 B 3.8.5-6 Revision 76 B 3.8.5-7 Revision 27 B 3.8.6-1 Revision 27 B 3.8.6-2 Revision 27 B 3.8.6-3 Revision 27 B 3.8.6-4 Revision 27 B 3.8.6-5 Revision 27 B 3.8.6-6 Revision 51 B 3.8.6-7 Revision 51 B 3.8.6-8 Revision 27 B 3.8.6-9 Revision 80 B 3.8.6-10 Revision 27 LaSalle 1 and 2 Page 19 of 22 Revision 91
| |
| | |
| AFFECTED PAGE LIST - TECHNICAL SPECIFICATIONS BASES B 3.8 ELECTRICAL POWER SYSTEMS (continued)
| |
| B 3.8.6-11 Revision 27 B 3.8.7-1 Revision 19 B 3.8.7-2 Revision 0 B 3.8.7-3 Revision 19 B 3.8.7-4 Revision 0 B 3.8.7-5 Revision 89 B 3.8.7-6 Revision 89 B 3.8.7-7 Revision 0 B 3.8.7-8 Revision 81 B 3.8.7-9 Revision 89 B 3.8.7-10 Revision 89 B 3.8.7-11 Revision 51 B 3.8.7-12 Revision 0 B 3.8.7-13 Revision 0 B 3.8.8-1 Revision 76 B 3.8.8-2 Revision 76 B 3.8.8-3 Revision 76 B 3.8.8-4 Revision 76 B 3.9 REFUELING OPERATIONS B 3.9.1-1 Revision 46 B 3.9.1-2 Revision 46 B 3.9.1-3 Revision 0 B 3.9.1-4 Revision 51 B 3.9.2-1 Revision 44 B 3.9.2-2 Revision 0 B 3.9.2-3 Revision 51 B 3.9.2-4 Revision 0 B 3.9.3-1 Revision 0 B 3.9.3-2 Revision 51 B 3.9.3-3 Revision 0 B 3.9.4-1 Revision 44 B 3.9.4-2 Revision 0 B 3.9.4-3 Revision 0 B 3.9.4-4 Revision 44 B 3.9.5-1 Revision 0 B 3.9.5-2 Revision 0 B 3.9.5-3 Revision 51 B 3.9.6-1 Revision 48 B 3.9.6-2 Revision 48 B 3.9.6-3 Revision 51 B 3.9.7-1 Revision 48 B 3.9.7-2 Revision 48 LaSalle 1 and 2 Page 20 of 22 Revision 91
| |
| | |
| AFFECTED PAGE LIST - TECHNICAL SPECIFICATIONS BASES B 3.9 REFUELING OPERATIONS (continued)
| |
| B 3.9.7-3 Revision 51 B 3.9.8-1 Revision 0 B 3.9.8-2 Revision 60 B 3.9.8-3 Revision 87 B 3.9.8-4 Revision 60 B 3.9.8-5 Revision 60 B 3.9.8-6 Revision 60 B 3.9.9-1 Revision 60 B 3.9.9-2 Revision 60 B 3.9.9-3 Revision 87 B 3.9.9-4 Revision 60 B 3.9.9-5 Revision 60 B 3.9.9-6 Revision 60 B 3.10 SPECIAL OPERATIONS B 3.10.1-1 Revision 0 B 3.10.1-2 Revision 0 B 3.10.1-3 Revision 0 B 3.10.1-4 Revision 0 B 3.10.1-5 Revision 51 B 3.10.2-1 Revision 0 B 3.10.2-2 Revision 0 B 3.10.2-3 Revision 0 B 3.10.2-4 Revision 0 B 3.10.2-5 Revision 51 B 3.10.3-1 Revision 0 B 3.10.3-2 Revision 0 B 3.10.3-3 Revision 0 B 3.10.3-4 Revision 0 B 3.10.3-5 Revision 51 B 3.10.4-1 Revision 0 B 3.10.4-2 Revision 0 B 3.10.4-3 Revision 0 B 3.10.4-4 Revision 0 B 3.10.4-5 Revision 51 B 3.10.5-1 Revision 0 B 3.10.5-2 Revision 0 B 3.10.5-3 Revision 51 B 3.10.6-1 Revision 0 B 3.10.6-2 Revision 0 B 3.10.6-3 Revision 0 B 3.10.6-4 Revision 0 B 3.10.7-1 Revision 0 B 3.10.7-2 Revision 0 B 3.10.7-3 Revision 0 LaSalle 1 and 2 Page 21 of 22 Revision 91
| |
| | |
| AFFECTED PAGE LIST - TECHNICAL SPECIFICATIONS BASES B 3.10 SPECIAL OPERATIONS (continued)
| |
| B 3.10.7-4 Revision 0 B 3.10.7-5 Revision 51 B 3.10.7-6 Revision 51 B 3.10.7-7 Revision 0 B 3.10.8-1 Revision 63 B 3.10.8-2 Revision 63 B 3.10.8-3 Revision 76 B 3.10.8-4 Revision 63 B 3.10.8-5 Revision 63 LaSalle 1 and 2 Page 22 of 22 Revision 91
| |
| | |
| LaSalle County Station Technical Specification Bases (TS Bases)
| |
| LaSalle County Nuclear Power Station, Unit 1 and 2 Facility Operating License Nos. NPF-11 (Unit 1) and NPF-18 (Unit 2)
| |
| NRC Docket Nos. STN 50-373 (Unit 1) and 50-374 (Unit 2)
| |
| | |
| TABLE OF CONTENTS B 2.0 SAFETY LIMITS (SLs)
| |
| B 2.1.1 Reactor Core SLs ....................................B 2.1.1-1 B 2.1.2 Reactor Coolant System (RCS) Pressure SL ...........B 2.1.2-1 B 3.0 LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY ...B 3.0-1 B 3.0 SURVEILLANCE REQUIREMENT (SR) APPLICABILITY ............B 3.0-17 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.1 SHUTDOWN MARGIN (SDM) ...............................B 3.1.1-1 B 3.1.2 Reactivity Anomalies ................................B 3.1.2-1 B 3.1.3 Control Rod OPERABILITY .............................B 3.1.3-1 B 3.1.4 Control Rod Scram Times .............................B 3.1.4-1 B 3.1.5 Control Rod Scram Accumulators ......................B 3.1.5-1 B 3.1.6 Rod Pattern Control .................................B 3.1.6-1 B 3.1.7 Standby Liquid Control (SLC) System .................B 3.1.7-1 B 3.1.8 Scram Discharge Volume (SDV) Vent and Drain Valves ..B 3.1.8-1 B 3.2 POWER DISTRIBUTION LIMITS B 3.2.1 AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR) ..........................................B 3.2.1-1 B 3.2.2 MINIMUM CRITICAL POWER RATIO (MCPR) .................B 3.2.2-1 B 3.2.3 LINEAR HEAT GENERATION RATE (LHGR) .................B 3.2.3-1 B 3.3 INSTRUMENTATION B 3.3.1.1 Reactor Protection System (RPS) Instrumentation .....B 3.3.1.1-1 B 3.3.1.2 Source Range Monitor (SRM) Instrumentation ..........B 3.3.1.2-1 B 3.3.1.3 Oscillation Power Range Monitor (OPRM)
| |
| Instrumentation ...................................B 3.3.1.3-1 B 3.3.2.1 Control Rod Block Instrumentation ...................B 3.3.2.1-1 B 3.3.2.2 Feedwater System and Main Turbine High Water Level Trip Instrumentation ..............................B 3.3.2.2-1 B 3.3.3.1 Post Accident Monitoring (PAM) Instrumentation ......B 3.3.3.1-1 B 3.3.3.2 Remote Shutdown Monitoring System ...................B 3.3.3.2-1 B 3.3.4.1 End of Cycle Recirculation Pump Trip (EOC-RPT)
| |
| Instrumentation ...................................B 3.3.4.1-1 B 3.3.4.2 Anticipated Transient Without Scram Recirculation Pump Trip (ATWS-RPT) Instrumentation ..............B 3.3.4.2-1 B 3.3.5.1 Emergency Core Cooling System (ECCS)
| |
| Instrumentation ...................................B 3.3.5.1-1 B 3.3.5.2 Reactor Pressure Vessel (RPV) Water Inventory Control Instrumentation ...........................B 3.3.5.2-1 B 3.3.5.3 Reactor Core Isolation Cooling (RCIC) System Instrumentation ...................................B 3.3.5.3-1 B 3.3.6.1 Primary Containment Isolation Instrumentation .......B 3.3.6.1-1 B 3.3.6.2 Secondary Containment Isolation Instrumentation .....B 3.3.6.2-1 B 3.3.7.1 Control Room Area Filtration (CRAF)
| |
| System Instrumentation ............................B 3.3.7.1-1 (continued)
| |
| LaSalle 1 and 2 i Revision 76
| |
| | |
| TABLE OF CONTENTS B 3.3 INSTRUMENTATION (continued)
| |
| B 3.3.8.1 Loss of Power (LOP) Instrumentation .................B 3.3.8.1-1 B 3.3.8.2 Reactor Protection System (RPS) Electric Power Monitoring ........................................B 3.3.8.2-1 B 3.4 REACTOR COOLANT SYSTEM (RCS)
| |
| B 3.4.1 Recirculation Loops Operating .......................B 3.4.1-1 B 3.4.2 Flow Control Valves (FCVs) ..........................B 3.4.2-1 B 3.4.3 Jet Pumps ...........................................B 3.4.3-1 B 3.4.4 Safety/Relief Valves (S/RVs) ........................B 3.4.4-1 B 3.4.5 RCS Operational LEAKAGE .............................B 3.4.5-1 B 3.4.6 RCS Pressure Isolation Valve (PIV) Leakage ..........B 3.4.6-1 B 3.4.7 RCS Leakage Detection Instrumentation ...............B 3.4.7-1 B 3.4.8 RCS Specific Activity ...............................B 3.4.8-1 B 3.4.9 Residual Heat Removal (RHR) Shutdown Cooling SystemHot Shutdown ...............................B 3.4.9-1 B 3.4.10 Residual Heat Removal (RHR) Shutdown Cooling SystemCold Shutdown ..............................B 3.4.10-1 B 3.4.11 RCS Pressure and Temperature (P/T) Limits ...........B 3.4.11-1 B 3.4.12 Reactor Steam Dome Pressure .........................B 3.4.12-1 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS), REACTOR PRESSURE VESSEL (RPV) WATER INVENTORY CONTROL, AND REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM B 3.5.1 ECCSOperating ......................................B 3.5.1-1 B 3.5.2 RPV Water Inventory Control .........................B 3.5.2-1 B 3.5.3 RCIC System .........................................B 3.5.3-1 B 3.6 CONTAINMENT SYSTEMS B 3.6.1.1 Primary Containment .................................B 3.6.1.1-1 B 3.6.1.2 Primary Containment Air Lock ........................B 3.6.1.2-1 B 3.6.1.3 Primary Containment Isolation Valves (PCIVs) ........B 3.6.1.3-1 B 3.6.1.4 Drywell and Suppression Chamber Pressure ............B 3.6.1.4-1 B 3.6.1.5 Drywell Air Temperature .............................B 3.6.1.5-1 B 3.6.1.6 Suppression Chamber-to-Drywell Vacuum Breakers ......B 3.6.1.6-1 B 3.6.2.1 Suppression Pool Average Temperature ................B 3.6.2.1-1 B 3.6.2.2 Suppression Pool Water Level ........................B 3.6.2.2-1 B 3.6.2.3 Residual Heat Removal (RHR) Suppression Pool Cooling ...........................................B 3.6.2.3-1 B 3.6.2.4 Residual Heat Removal (RHR) Suppression Pool Spray ..B 3.6.2.4-1 B 3.6.3.1 Primary Containment Hydrogen Recombiners ............B 3.6.3.1-1 B 3.6.3.2 Primary Containment Oxygen Concentration ............B 3.6.3.2-1 B 3.6.4.1 Secondary Containment ...............................B 3.6.4.1-1 B 3.6.4.2 Secondary Containment Isolation Valves (SCIVs) ......B 3.6.4.2-1 B 3.6.4.3 Standby Gas Treatment (SGT) System ..................B 3.6.4.3-1 (continued)
| |
| LaSalle 1 and 2 ii Revision 76
| |
| | |
| TABLE OF CONTENTS (continued)
| |
| B 3.7 PLANT SYSTEMS B 3.7.1 Residual Heat Removal Service Water (RHRSW) System ....................................B 3.7.1-1 B 3.7.2 Diesel Generator Cooling Water (DGCW) System ........B 3.7.2-1 B 3.7.3 Ultimate Heat Sink (UHS) ............................B 3.7.3-1 B 3.7.4 Control Room Area Filtration (CRAF) System ..........B 3.7.4-1 B 3.7.5 Control Room Area Ventilation Air Conditioning (AC) System .......................................B 3.7.5-1 B 3.7.6 Main Condenser Offgas ...............................B 3.7.6-1 B 3.7.7 Main Turbine Bypass System ..........................B 3.7.7-1 B 3.7.8 Spent Fuel Storage Pool Water Level .................B 3.7.8-1 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.1 AC SourcesOperating ................................B 3.8.1-1 B 3.8.2 AC SourcesShutdown .................................B 3.8.2-1 B 3.8.3 Diesel Fuel Oil and Starting Air ....................B 3.8.3-1 B 3.8.4 DC SourcesOperating ................................B 3.8.4-1 B 3.8.5 DC SourcesShutdown .................................B 3.8.5-1 B 3.8.6 Battery Parameters ..................................B 3.8.6-1 B 3.8.7 Distribution SystemsOperating ......................B 3.8.7-1 B 3.8.8 Distribution SystemsShutdown .......................B 3.8.8-1 B 3.9 REFUELING OPERATIONS B 3.9.1 Refueling Equipment Interlocks ......................B 3.9.1-1 B 3.9.2 Refuel Position One-Rod-Out Interlock ...............B 3.9.2-1 B 3.9.3 Control Rod Position ................................B 3.9.3-1 B 3.9.4 Control Rod Position Indication .....................B 3.9.4-1 B 3.9.5 Control Rod OPERABILITYRefueling ...................B 3.9.5-1 B 3.9.6 Reactor Pressure Vessel (RPV) Water LevelIrradiated Fuel .............................B 3.9.6-1 B 3.9.7 Reactor Pressure Vessel (RPV) Water LevelNew Fuel or Control Rods ..............................B 3.9.7-1 B 3.9.8 Residual Heat Removal (RHR)High Water Level ........B 3.9.8-1 B 3.9.9 Residual Heat Removal (RHR)Low Water Level .........B 3.9.9-1 B 3.10 SPECIAL OPERATIONS B 3.10.1 Reactor Mode Switch Interlock Testing ...............B 3.10.1-1 B 3.10.2 Single Control Rod WithdrawalHot Shutdown ..........B 3.10.2-1 B 3.10.3 Single Control Rod WithdrawalCold Shutdown .........B 3.10.3-1 B 3.10.4 Single Control Rod Drive (CRD)
| |
| RemovalRefueling .................................B 3.10.4-1 B 3.10.5 Multiple Control Rod WithdrawalRefueling ...........B 3.10.5-1 B 3.10.6 Control Rod TestingOperating .......................B 3.10.6-1 B 3.10.7 SHUTDOWN MARGIN (SDM) TestRefueling ................B 3.10.7-1 B 3.10.8 Inservice Leak and Hydrostatic Testing Operation ....B 3.10.8-1 LaSalle 1 and 2 iii Revision 63
| |
| | |
| Reactor Core SLs B 2.1.1 B 2.0 SAFETY LIMITS (SLs)
| |
| B 2.1.1 Reactor Core SLs BASES BACKGROUND GDC 10 (Ref. 1) requires, and SLs ensure, that specified acceptable fuel design limits are not exceeded during steady state operation, normal operational transients, and anticipated operational occurrences (AOOs).
| |
| The fuel cladding integrity SL is set such that no significant fuel damage is calculated to occur if the limit is not violated. Because fuel damage is not directly observable, a stepback approach is used to establish an SL, such that the MCPR is not less than the limit specified in Specification 2.1.1.2. MCPR greater than the specified limit represents a conservative margin relative to the conditions required to maintain fuel cladding integrity.
| |
| The fuel cladding is one of the physical barriers that separate the radioactive materials from the environs. The integrity of this cladding barrier is related to its relative freedom from perforations or cracking. Although some corrosion or use related cracking may occur during the life of the cladding, fission product migration from this source is incrementally cumulative and continuously measurable. Fuel cladding perforations, however, can result from thermal stresses, which occur from reactor operation significantly above design conditions.
| |
| While fission product migration from cladding perforation is just as measurable as that from use related cracking, the thermally caused cladding perforations signal a threshold beyond which still greater thermal stresses may cause gross, rather than incremental, cladding deterioration. Therefore, the fuel cladding SL is defined with a margin to the conditions that would produce onset of transition boiling (i.e., MCPR = 1.00). These conditions represent a significant departure from the condition intended by design for planned operation. This is accomplished by having a Safety Limit Minimum Critical Power Ratio (SLMCPR) design basis, referred to as SLMCPR95/95, which corresponds to a 95%
| |
| probability at a 95% confidence level (the 95/95 MCPR criterion) that transition boiling will not occur.
| |
| (continued)
| |
| LaSalle 1 and 2 B 2.1.1-1 Revision 83
| |
| | |
| Reactor Core SLs B 2.1.1 BASES BACKGROUND Operation above the boundary of the nucleate boiling regime (continued) could result in excessive cladding temperature because of the onset of transition boiling and the resultant sharp reduction in heat transfer coefficient. Inside the steam film, high cladding temperatures are reached, and a cladding water (zirconium water) reaction may take place. This chemical reaction results in oxidation of the fuel cladding to a structurally weaker form. This weaker form may lose its integrity, resulting in an uncontrolled release of activity to the reactor coolant.
| |
| The reactor vessel water level SL ensures that adequate core cooling capability is maintained during all MODES of reactor operation. Establishment of Emergency Core Cooling System instrumentation setpoints higher than this SL provides margin such that the SL will not be reached or exceeded.
| |
| APPLICABLE The fuel cladding must not sustain damage as a result of SAFETY ANALYSES normal operation and AOOs. The Tech Spec SL is set generically on a fuel product MCPR correlation basis as the MCPR which corresponds to a 95% probability at a 95%
| |
| confidence level that transition boiling will not occur, referred to as SLMCPR95/95.
| |
| The Reactor Protection System setpoints (LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation"), in combination with other LCOs, are designed to prevent any anticipated combination of transient conditions for Reactor Coolant System water level, pressure, and THERMAL POWER level that would result in reaching the MCPR Safety Limit.
| |
| Cores with fuel that is all from one vendor utilize that vendor's critical power correlation for determination of MCPR. For cores with fuel from more than one vendor, the MCPR is calculated for all fuel in the core using the licensed critical power correlations. This may be accomplished by using each vendor's correlation for the vendor's respective fuel. Alternatively, a single correlation can be used for all fuel in the core. For fuel that has not been manufactured by the vendor supplying the critical power correlation, the input parameters to the reload vendor's correlation are adjusted using benchmarking data to yield conservative results compared with the critical power correlation results from the co-resident fuel.
| |
| (continued)
| |
| LaSalle 1 and 2 B 2.1.1-2 Revision 83
| |
| | |
| Reactor Core SLs B 2.1.1 BASES APPLICABLE 2.1.1.1 Fuel Cladding Integrity SAFETY ANALYSES (continued) GE critical power correlations are applicable for all critical power calculations at pressures > 700 psia and core flows 10% of rated flow. For operation at low pressures or low flows, another basis is used, as follows:
| |
| Since the pressure drop in the bypass region is essentially all elevation head, the core pressure drop at low power and flows will always be ! 4.5 psi.
| |
| Analyses (Ref. 2) show that with a bundle flow of 28 x 103 lb/hr (approximately a mass velocity of 0.25 x 106 lb/hr-ft2), bundle pressure drop is nearly independent of bundle power and has a value of 3.5 psi.
| |
| Thus, the bundle flow with a 4.5 psi driving head will be ! 28 x 103 lb/hr. Full scale critical power test data taken at pressures from 14.7 psia to 800 psia indicate that the fuel assembly critical power at this flow is approximately 3.35 MWt. With the design peaking factors, this corresponds to a THERMAL POWER ! 50% RTP.
| |
| Thus, a THERMAL POWER limit of 25% RTP for reactor pressure < 700 psia is conservative. Additional information on low flow conditions is available in References 3 and 4. Compatible ATRIUM-10 information is documented in Reference 5.
| |
| 2.1.1.2 MCPR The fuel cladding integrity SL is set such that no significant fuel damage is calculated to occur if the limit is not violated. Since the parameters that result in fuel damage are not directly observable during reactor operation, the thermal and hydraulic conditions that result in the onset of transition boiling have been used to mark the beginning of the region in which fuel damage could occur. Although it is recognized that the onset of transition boiling would not result in damage to BWR fuel rods, the critical power at which boiling transition is calculated to occur has been adopted as a convenient limit. The Technical Specification SL value is dependent on the fuel product line and the corresponding MCPR correlation, which is cycle independent.
| |
| The value is based on the Critical Power Ratio (CPR) data statistics and a 95% probability with 95% confidence that rods are not susceptible to boiling transition, referred to as MCPR95/95.
| |
| (continued)
| |
| LaSalle 1 and 2 B 2.1.1-3 Revision 83
| |
| | |
| Reactor Core SLs B 2.1.1 BASES APPLICABLE 2.1.1.2 MCPR (continued)
| |
| SAFETY ANALYSES The SL is based on GNF2 and/or GNF3 fuel. For cores with a single fuel product line, the SLMCPR95/95 is the MCPR95/95 for the fuel type. For cores loaded with a mix of applicable fuel types, the SLMCPR95/95 is based on the largest (i.e.,
| |
| most limiting) of the MCPR values for the fuel product lines that are fresh or once-burnt at the start of the cycle.
| |
| 2.1.1.3 Reactor Vessel Water Level During MODES 1 and 2, the reactor vessel water level is required to be above the top of the active irradiated fuel to provide core cooling capability. With fuel in the reactor vessel during periods when the reactor is shut down, consideration must be given to water level requirements due to the effect of decay heat. If the water level should drop below the top of the active irradiated fuel during this period, the ability to remove decay heat is reduced. This reduction in cooling capability could lead to elevated cladding temperatures and clad perforation in the event that the water level becomes 2/3 of the core height. The reactor vessel water level SL has been established at the top of the active irradiated fuel to provide a point that can be monitored and to also provide adequate margin for effective action.
| |
| (continued)
| |
| LaSalle 1 and 2 B 2.1.1-4 Revision 86
| |
| | |
| Reactor Core SLs B 2.1.1 BASES (continued)
| |
| SAFETY LIMITS The reactor core SLs are established to protect the integrity of the fuel clad barrier to prevent the release of radioactive materials to the environs. SL 2.1.1.1 and SL 2.1.1.2 ensure that the core operates within the fuel design criteria. SL 2.1.1.3 ensures that the reactor vessel water level is greater than the top of the active irradiated fuel in order to prevent elevated clad temperatures and resultant clad perforations.
| |
| APPLICABILITY SLs 2.1.1.1, 2.1.1.2, and 2.1.1.3 are applicable in all MODES.
| |
| SAFETY LIMIT 2.2 VIOLATIONS Exceeding an SL may cause fuel damage and create a potential for radioactive releases in excess of 10 CFR 50.67, "Accident Source Term," limits (Ref. 6). Therefore, it is required to insert all insertable control rods and restore compliance with the SL within 2 hours. The 2 hour Completion Time ensures that the operators take prompt remedial action and the probability of an accident occurring during this period is minimal.
| |
| REFERENCES 1. 10 CFR 50, Appendix A, GDC 10.
| |
| : 2. NEDE-24011-P-A, "General Electric Standard Application for Reactor Fuel," (latest approved revision).
| |
| : 3. General Electric Services Information Letter (SIL) No.
| |
| 516, Supplement 2, January 19, 1996.
| |
| : 4. Letter from W. C. Cline (Global Nuclear Fuel) to H. Youssefnia (Exelon Generation Company),
| |
| "Clarification of SIL 516 S2 Recommendations Related to Technical Specifications for Low Pressure Conditions - Revision 1," dated September 16, 2016.
| |
| : 5. NEDC-33106P-A, "GEXL97 Correlation Applicable to ATRIUM-10 Fuel," Revision 2, June 2004.
| |
| : 6. 10 CFR 50.67.
| |
| LaSalle 1 and 2 B 2.1.1-5 Revision 68
| |
| | |
| RCS Pressure SL B 2.1.2 B 2.0 SAFETY LIMITS (SLs)
| |
| B 2.1.2 Reactor Coolant System (RCS) Pressure SL BASES BACKGROUND The SL on reactor steam dome pressure protects the RCS against overpressurization. In the event of fuel cladding failure, fission products are released into the reactor coolant. The RCS then serves as the primary barrier in preventing the release of fission products into the atmosphere. Establishing an upper limit on reactor steam dome pressure ensures continued RCS integrity. According to 10 CFR 50, Appendix A, GDC 14, "Reactor Coolant Pressure Boundary," and GDC 15, "Reactor Coolant System Design" (Ref. 1), the reactor coolant pressure boundary (RCPB) shall be designed with sufficient margin to ensure that the design conditions are not exceeded during normal operation and anticipated operational occurrences (AOOs).
| |
| During normal operation and AOOs, RCS pressure is limited from exceeding the design pressure by more than 10%, in accordance with Section III of the ASME Code (Ref. 2) for the reactor pressure vessel, and by more than 20%, in accordance with USAS B31.1-1967 Code (Ref. 3) for the RCS piping. To ensure system integrity, all RCS components are hydrostatically tested at 125% of design pressure, in accordance with ASME Code requirements, prior to initial operation when there is no fuel in the core. Following inception of unit operation, RCS components shall be pressure tested in accordance with the requirements of ASME Code, Section XI (Ref. 4).
| |
| Overpressurization of the RCS could result in a breach of the RCPB, reducing the number of protective barriers designed to prevent radioactive releases from exceeding the limits specified in 10 CFR 50.67, "Accident Source Term" (Ref. 5). If this occurred in conjunction with a fuel cladding failure, the number of protective barriers designed to prevent radioactive releases from exceeding the limits would be reduced.
| |
| (continued)
| |
| LaSalle 1 and 2 B 2.1.2-1 Revision 48
| |
| | |
| RCS Pressure SL B 2.1.2 BASES (continued)
| |
| APPLICABLE The RCS safety/relief valves and the Reactor Protection SAFETY ANALYSES System Reactor Vessel Steam Dome Pressure-High Function have settings established to ensure that the RCS pressure SL will not be exceeded.
| |
| The RCS pressure SL has been selected such that it is at a pressure below which it can be shown that the integrity of the system is not endangered. The reactor pressure vessel is designed to ASME, Boiler and Pressure Vessel Code, Section III, 1968 Edition, including Addenda through the winter of 1969 for Unit 1 and winter of 1970 (excluding Appendix I) for Unit 2 (Ref. 6), which permits a maximum pressure transient of 110%, 1375 psig, of design pressure 1250 psig. The SL of 1325 psig, as measured in the reactor steam dome, is equivalent to 1375 psig at the lowest elevation of the RCS. The RCS is designed to ASME Code, Section III, 1971 Edition, including Addenda through the summer of 1971 (Ref. 7), for the reactor recirculation piping, which permits a maximum pressure transient of 120%
| |
| of design pressures of 1250 psig for suction piping and 1550 psig for discharge piping. The recirculation pumps are designed to ASME Code, Section III, 1971 Edition, including Addenda through the summer of 1971 (Ref. 7). The RCS pressure SL is selected to be the lowest transient overpressure allowed by the applicable codes.
| |
| SAFETY LIMITS The maximum transient pressure allowable in the RCS pressure vessel under the ASME Code, Section III, is 110% of design pressure. The maximum transient pressure allowable in the RCS piping, valves, and fittings is 120% of design pressures of 1250 psig for suction piping and 1550 psig for discharge piping. The most limiting of these allowances is the 110%
| |
| of the reactor pressure vessel design pressure; therefore, the SL on maximum allowable RCS pressure is established at 1325 psig as measured at the reactor steam dome.
| |
| APPLICABILITY SL 2.1.2 applies in all MODES.
| |
| SAFETY LIMIT 2.2 VIOLATIONS Exceeding the RCS pressure SL may cause RCS failure and create a potential for radioactive releases in excess of 10 CFR 50.67, "Accident Source Term," limits (Ref. 5).
| |
| (continued)
| |
| LaSalle 1 and 2 B 2.1.2-2 Revision 52
| |
| | |
| RCS Pressure SL B 2.1.2 BASES SAFETY LIMIT 2.2 (continued)
| |
| VIOLATIONS Therefore, it is required to insert all insertable control rods and restore compliance with the SL within 2 hours. The 2 hour Completion Time ensures that the operators take prompt remedial action and also assures that the probability of an accident occurring during this period is minimal.
| |
| REFERENCES 1. 10 CFR 50, Appendix A, GDC 14 and GDC 15.
| |
| : 2. ASME, Boiler and Pressure Vessel Code, Section III, Article NB-7000.
| |
| : 3. ASME, USAS, Power Piping Code, Section B31.1, 1967.
| |
| : 4. ASME, Boiler and Pressure Vessel Code, Section XI, Article IWB-5000.
| |
| : 5. 10 CFR 50.67.
| |
| : 6. ASME, Boiler and Pressure Vessel Code, Section III, 1968 Edition, Addenda, winter of 1969 (Unit 1) and winter of 1970 (Unit 2).
| |
| : 7. ASME, Boiler and Pressure Vessel Code, Section III, 1971 Edition, Addenda, summer of 1971.
| |
| LaSalle 1 and 2 B 2.1.2-3 Revision 48
| |
| | |
| LCO Applicability B 3.0 B 3.0 LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY BASES LCOs LCO 3.0.1 through LCO 3.0.10 establish the general requirements applicable to all Specifications in Sections 3.1 through 3.10 and apply at all times, unless otherwise stated.
| |
| LCO 3.0.1 LCO 3.0.1 establishes the Applicability statement within each individual Specification as the requirement for when the LCO is required to be met (i.e., when the unit is in the MODES or other specified conditions of the Applicability statement of each Specification).
| |
| LCO 3.0.2 LCO 3.0.2 establishes that upon discovery of a failure to meet an LCO, the associated ACTIONS shall be met. The Completion Time of each Required Action for an ACTIONS Condition is applicable from the point in time that an ACTIONS Condition is entered, unless otherwise specified.
| |
| The Required Actions establish those remedial measures that must be taken within specified Completion Times when the requirements of an LCO are not met. This Specification establishes that:
| |
| : a. Completion of the Required Actions within the specified Completion Times constitutes compliance with a Specification; and
| |
| : b. Completion of the Required Actions is not required when an LCO is met within the specified Completion Time, unless otherwise specified.
| |
| There are two basic types of Required Actions. The first type of Required Action specifies a time limit in which the LCO must be met. This time limit is the Completion Time to restore an inoperable system or component to OPERABLE status or to restore variables to within specified limits. If this type of Required Action is not completed within the specified Completion Time, a shutdown may be required to place the unit in a MODE or condition in which the Specification is not applicable. (Whether stated as a Required Action or not, correction of the entered Condition is an action that may always be considered upon entering (continued)
| |
| LaSalle 1 and 2 B 3.0-1 Revision 84
| |
| | |
| LCO Applicability B 3.0 BASES LCO 3.0.2 ACTIONS.) The second type of Required Action specifies the (continued) remedial measures that permit continued operation of the unit that is not further restricted by the Completion Time.
| |
| In this case, compliance with the Required Actions provides an acceptable level of safety for continued operation.
| |
| Completing the Required Actions is not required when an LCO is met or is no longer applicable, unless otherwise stated in the individual Specifications.
| |
| The nature of some Required Actions of some Conditions necessitates that, once the Condition is entered, the Required Actions must be completed even though the associated Condition no longer exists. The individual LCO's ACTIONS specify the Required Actions where this is the case.
| |
| An example of this is in LCO 3.4.11, "RCS Pressure and Temperature (P/T) Limits."
| |
| The Completion Times of the Required Actions are also applicable when a system or component is removed from service intentionally. The ACTIONS for not meeting a single LCO adequately manage any increase in plant risk, provided any unusual external conditions (e.g., severe weather, offsite power instability) are considered. In addition, the increased risk associated with simultaneous removal of multiple structures, systems, trains or components from service is assessed and managed in accordance with 10 CFR 50.65(a)(4). Individual Specifications may specify a time limit for performing an SR when equipment is removed from service or bypassed for testing. In this case, the Completion Times of the Required Actions are applicable when this time limit expires, if the equipment remains removed from service or bypassed.
| |
| When a change in MODE or other specified condition is required to comply with Required Actions, the unit may enter a MODE or other specified condition in which another Specification becomes applicable. In this case, the Completion Times of the associated Required Actions would apply from the point in time that the new Specification becomes applicable and the ACTIONS Condition(s) are entered.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.0-2 Revision 82
| |
| | |
| LCO Applicability B 3.0 BASES (continued)
| |
| LCO 3.0.3 LCO 3.0.3 establishes the actions that must be implemented when an LCO is not met and:
| |
| : a. An associated Required Action and Completion Time is not met and no other Condition applies; or
| |
| : b. The condition of the unit is not specifically addressed by the associated ACTIONS. This means that no combination of Conditions stated in the ACTIONS can be made that exactly corresponds to the actual condition of the unit. Sometimes, possible combinations of Conditions are such that entering LCO 3.0.3 is warranted; in such cases, the ACTIONS specifically state a Condition corresponding to such combinations and also that LCO 3.0.3 be entered immediately.
| |
| This Specification delineates the time limits for placing the unit in a safe MODE or other specified condition when operation cannot be maintained within the limits for safe operation as defined by the LCO and its ACTIONS. Planned entry into LCO 3.0.3 should be avoided. If it is not practicable to avoid planned entry into LCO 3.0.3, plant risk should be assessed and managed in accordance with 10 CFR 50.65(a)(4), and the planned entry into LCO 3.0.3 should have less effect on plant safety than other practicable alternatives.
| |
| Upon entering LCO 3.0.3, 1 hour is allowed to prepare for an orderly shutdown before initiating a change in unit operation. This includes time to permit the operator to coordinate the reduction in electrical generation with the load dispatcher to ensure the stability and availability of the electrical grid. The time limits specified to enter lower MODES of operation permit the shutdown to proceed in a controlled and orderly manner that is well within the specified maximum cooldown rate and within the capabilities of the unit, assuming that only the minimum required equipment is OPERABLE. This reduces thermal stresses on components of the Reactor Coolant System and the potential for a plant upset that could challenge safety systems under conditions to which this Specification applies. The use and interpretation of specified times to complete the actions of LCO 3.0.3 are consistent with the discussion of Section 1.3, Completion Times.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.0-3 Revision 82
| |
| | |
| LCO Applicability B 3.0 BASES LCO 3.0.3 A unit shutdown required in accordance with LCO 3.0.3 may be (continued) terminated and LCO 3.0.3 exited if any of the following occurs:
| |
| : a. The LCO is now met.
| |
| : b. The LCO is no longer applicable.
| |
| : c. A Condition exists for which the Required Actions have now been performed.
| |
| : d. ACTIONS exist that do not have expired Completion Times. These Completion Times are applicable from the point in time that the Condition is initially entered and not from the time LCO 3.0.3 is exited.
| |
| The time limits of Specification 3.0.3 allow 37 hours for the unit to be in MODE 4 when a shutdown is required during MODE 1 operation. If the unit is in a lower MODE of operation when a shutdown is required, the time limit for entering the next lower MODE applies. If a lower MODE is entered in less time than allowed, however, the total allowable time to enter MODE 4, or other applicable MODE, is not reduced. For example, if MODE 2 is entered in 2 hours, then the time allowed for entering MODE 3 is the next 11 hours, because the total time for entering MODE 3 is not reduced from the allowable limit of 13 hours. Therefore, if remedial measures are completed that would permit a return to MODE 1, a penalty is not incurred by having to enter a lower MODE of operation in less than the total time allowed.
| |
| In MODES 1, 2, and 3, LCO 3.0.3 provides actions for Conditions not covered in other Specifications. The requirements of LCO 3.0.3 do not apply in MODES 4 and 5 because the unit is already in the most restrictive Condition required by LCO 3.0.3. The requirements of LCO 3.0.3 do not apply in other specified conditions of the Applicability (unless in MODE 1, 2, or 3) because the ACTIONS of individual Specifications sufficiently define the remedial measures to be taken.
| |
| Exceptions to LCO 3.0.3 are provided in instances where requiring a unit shutdown, in accordance with LCO 3.0.3, would not provide appropriate remedial measures for the associated condition of the unit. An example of this is in (continued)
| |
| LaSalle 1 and 2 B 3.0-4 Revision 71
| |
| | |
| LCO Applicability B 3.0 BASES LCO 3.0.3 LCO 3.7.8, "Spent Fuel Storage Pool Water Level." LCO 3.7.8 (continued) has an Applicability of "During movement of irradiated fuel assemblies in the spent fuel storage pool." Therefore, this LCO can be applicable in any or all MODES. If the LCO and the Required Actions of LCO 3.7.8 are not met while in MODE 1, 2, or 3, there is no safety benefit to be gained by placing the unit in a shutdown condition. The Required Action of LCO 3.7.8 of "Suspend movement of fuel assemblies in the spent fuel storage pool" is the appropriate Required Action to complete in lieu of the actions of LCO 3.0.3.
| |
| These exceptions are addressed in the individual Specifications.
| |
| LCO 3.0.4 LCO 3.0.4 establishes limitations on changes in MODES or other specified conditions in the Applicability when an LCO is not met. It allows placing the unit in a MODE or other specified condition stated in that Applicability (e.g., the Applicability desired to be entered) when unit conditions are such that the requirements of the LCO would not be met, in accordance with either LCO 3.0.4.a, LCO 3.0.4.b, or LCO 3.0.4.c.
| |
| LCO 3.0.4.a allows entry into a MODE or other specified condition in the Applicability with the LCO not met when the associated ACTIONS to be entered following entry into the MODE or other specified condition in the Applicability will permit continued operation within the MODE or other specified condition for an unlimited period of time.
| |
| Compliance with ACTIONS that permit continued operation of the unit for an unlimited period of time in a MODE or other specified condition provides an acceptable level of safety for continued operation. This is without regard to the status of the unit before or after the MODE change.
| |
| Therefore, in such cases, entry into a MODE or other specified condition in the Applicability may be made and the Required Actions followed after entry into the Applicability.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.0-5 Revision 71
| |
| | |
| LCO Applicability B 3.0 BASES LCO 3.0.4 For example, LCO 3.0.4.a may be used when the Required (continued) Action to be entered states that an inoperable instrument channel must be placed in the trip condition within the Completion Time. Transition into a MODE or other specified condition in the Applicability may be made in accordance with LCO 3.0.4 and the channel is subsequently placed in the tripped condition within the Completion Time, which begins when the Applicability is entered. If the instrument channel cannot be placed in the tripped condition and the subsequent default ACTION ("Required Action and associated Completion Time not met") allows the OPERABLE train to be placed in operation, use of LCO 3.0.4.a is acceptable because the subsequent ACTIONS to be entered following entry into the MODE include ACTIONS (place the OPERABLE train in operation) that permit safe plant operation for an unlimited period of time in the MODE or other specified condition to be entered.
| |
| LCO 3.0.4.b allows entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering the MODE or other specified condition in the Applicability, and establishment of risk management actions, if appropriate.
| |
| The risk assessment may use quantitative, qualitative, or blended approaches, and the risk assessment will be conducted using the plant program, procedures, and criteria in place to implement 10 CFR 50.65(a)(4), which requires that risk impacts of maintenance activities to be assessed and managed. The risk assessment, for the purposes of LCO 3.0.4 (b), must take into account all inoperable Technical Specification equipment regardless of whether the equipment is included in the normal 10 CFR 50.65(a)(4) risk assessment scope. The risk assessments will be conducted using the procedures and guidance endorsed by Regulatory Guide 1.182, Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants. Regulatory Guide 1.182 endorses the guidance in Section 11 of NUMARC 93-01, Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants. These documents address general guidance for conduct of the risk assessment, quantitative and qualitative guidelines for establishing risk management actions, and example risk management actions. These include actions to plan and conduct other activities in a manner (continued)
| |
| LaSalle 1 and 2 B 3.0-6 Revision 71
| |
| | |
| LCO Applicability B 3.0 BASES LCO 3.0.4 that controls overall risk, increased risk awareness by (continued) shift and management personnel, actions to reduce the duration of the condition, actions to minimize the magnitude of risk increases (establishment of backup success paths or compensatory measures), and determination that the proposed MODE change is acceptable. Consideration should also be given to the probability of completing restoration such that the requirements of the LCO would be met prior to the expiration of ACTIONS Completion Times that would require exiting the Applicability.
| |
| LCO 3.0.4.b may be used with single, or multiple systems and components unavailable. NUMARC 93-01 provides guidance relative to consideration of simultaneous unavailability of multiple systems and components.
| |
| The results of the risk assessment shall be considered in determining the acceptability of entering the MODE or other specified condition in the Applicability, and any corresponding risk management actions. The LCO 3.0.4.b risk assessments do not have to be documented.
| |
| The Technical Specifications allow continued operation with equipment unavailable in MODE 1 for the duration of the Completion Time. Since this is allowable, and since in general the risk impact in that particular MODE bounds the risk of transitioning into and through the applicable MODES or other specified conditions in the Applicability of the LCO, the use of the LCO 3.0.4.b allowance should be generally acceptable, as long as the risk is assessed and managed as stated above. However, there is a small subset of systems and components that have been determined to be more important to risk and use of the LCO 3.0.4.b allowance is prohibited. The LCOs governing these system and components contain Notes prohibiting the use of LCO 3.0.4.b by stating that LCO 3.0.4.b is not applicable.
| |
| LCO 3.0.4.c allows entry into a MODE or other specified condition in the Applicability with the LCO not met based on a Note in the Specification which states LCO 3.0.4.c is applicable. These specific allowances permit entry into MODES or other specified conditions in the Applicability when the associated ACTIONS to be entered do not provide for continued operation for an unlimited period of time and a risk assessment has not been performed. This allowance may apply to all the ACTIONS or to a specific Required Action of (continued)
| |
| LaSalle 1 and 2 B 3.0-7 Revision 71
| |
| | |
| LCO Applicability B 3.0 BASES LCO 3.0.4 a Specification. The risk assessments performed to justify (continued) the use of LCO 3.0.4.b usually only consider systems and components. For this reason, LCO 3.0.4.c is typically applied to Specifications which describe values and parameters (e.g., RCS Specific Activity), and may be applied to other Specifications based on NRC plant-specific approval.
| |
| The provisions of this Specification should not be interpreted as endorsing the failure to exercise the good practice of restoring systems or components to OPERABLE status before entering an associated MODE or other specified condition in the Applicability.
| |
| The provisions of LCO 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS. In addition, the provisions of LCO 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that result from any unit shutdown. In this context, a unit shutdown is defined as a change in MODE or other specified condition in the Applicability associated with transitioning from MODE 1 to MODE 2, MODE 2 to MODE 3, and MODE 3 to MODE 4.
| |
| Upon entry into a MODE or other specified condition in the Applicability with the LCO not met, LCO 3.0.1 and LCO 3.0.2 require entry into the applicable Conditions and Required Actions until the Condition is resolved, until the LCO is met, or until the unit is not within the Applicability of the Technical Specification.
| |
| Surveillances do not have to be performed on the associated inoperable equipment (or on variables outside the specified limits), as permitted by SR 3.0.1. Therefore, utilizing LCO 3.0.4 is not a violation of SR 3.0.1 or SR 3.0.4 for any Surveillances that have not been performed on inoperable equipment. However, SRs must be met to ensure OPERABILITY prior to declaring the associated equipment OPERABLE (or variable within limits) and restoring compliance with the affected LCO.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.0-8 Revision 71
| |
| | |
| LCO Applicability B 3.0 BASES (continued)
| |
| LCO 3.0.5 LCO 3.0.5 establishes the allowance for restoring equipment to service under administrative controls when it has been removed from service or declared inoperable to comply with ACTIONS. The sole purpose of this Specification is to provide an exception to LCO 3.0.2 (e.g., to not comply with the applicable Required Action(s)) to allow the performance of required testing to demonstrate:
| |
| : a. The OPERABILITY of the equipment being returned to service; or
| |
| : b. The OPERABILITY of other equipment.
| |
| The administrative controls ensure the time the equipment is returned to service in conflict with the requirements of the ACTIONS is limited to the time absolutely necessary to perform the required testing to demonstrate OPERABILITY.
| |
| This Specification does not provide time to perform any other preventive or corrective maintenance. LCO 3.0.5 should not be used in lieu of other practicable alternatives that comply with Required Actions and that do not require changing the MODE or other specified conditions in the Applicability in order to demonstrate equipment is OPERABLE.
| |
| LCO 3.0.5 is not intended to be used repeatedly.
| |
| An example of demonstrating equipment is OPERABLE with the Required Actions not met is opening a manual valve that was closed to comply with Required Actions to isolate a flowpath with excessive Reactor Coolant System (RCS) Pressure Isolation Valve (PIV) leakage in order to perform testing to demonstrate that RCS PIV leakage is now within limit.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.0-9 Revision 71
| |
| | |
| LCO Applicability B 3.0 BASES LCO 3.0.5 Examples of demonstrating equipment OPERABILITY include (continued) instances in which it is necessary to take an inoperable channel or trip system out of a tripped condition that was directed by a Required Action, if there is no Required Action Note for this purpose. An example of verifying OPERABILITY of equipment removed from service is taking a tripped channel out of the tripped condition to permit the logic to function and indicate the appropriate response during performance of required testing on the inoperable channel.
| |
| Examples of demonstrating the OPERABILITY of other equipment are taking an inoperable channel or trip system out of the tripped condition 1) to prevent the trip function from occurring during the performance of required testing on another channel in the other trip system, or 2) to permit the logic to function and indicate the appropriate response during the performance of required testing on another channel in the same trip system.
| |
| The administrative controls in LCO 3.0.5 apply in all cases to systems or components in Chapter 3 of the Technical Specifications, as long as the testing could not be conducted while complying with the Required Actions. This includes the realignment or repositioning of redundant or alternate equipment or trains previously manipulated to comply with ACTIONS, as well as equipment removed from service or declared inoperable to comply with ACTIONS.
| |
| LCO 3.0.6 LCO 3.0.6 establishes an exception to LCO 3.0.2 for support systems that have an LCO specified in the Technical Specifications (TS). This exception is provided because LCO 3.0.2 would require that the Conditions and Required Actions of the associated inoperable supported system's LCO be entered solely due to the inoperability of the support system. This exception is justified because the actions that are required to ensure the plant is maintained in a safe condition are specified in the support systems' LCO's Required Actions. These Required Actions may include entering the supported system's Conditions and Required Actions or may specify other Required Actions.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.0-10 Revision 71
| |
| | |
| LCO Applicability B 3.0 BASES LCO 3.0.6 When a support system is inoperable and there is an LCO (continued) specified for it in the TS, the supported system(s) are required to be declared inoperable if determined to be inoperable as a result of the support system inoperability.
| |
| However, it is not necessary to enter into the supported systems' Conditions and Required Actions unless directed todo so by the support system's Required Actions. The potential confusion and inconsistency of requirements related to the entry into multiple support and supported systems' LCO's Conditions and Required Actions are eliminated by providing all the actions that are necessary to ensure the plant is maintained in a safe condition in the support system's Required Actions.
| |
| However, there are instances where a support system's Required Action may either direct a supported system to be declared inoperable or direct entry into Conditions and Required Actions for the supported system. This may occur immediately or after some specified delay to perform some other Required Action. Regardless of whether it is immediate or after some delay, when a support system's Required Action directs a supported system to be declared inoperable or directs entry into Conditions and Required Actions for a supported system, the applicable Conditions and Required Actions shall be entered in accordance with LCO 3.0.2.
| |
| Specification 5.5.12, "Safety Function Determination Program" (SFDP), ensures loss of safety function is detected and appropriate actions are taken. Upon entry into LCO 3.0.6, an evaluation shall be made to determine if loss of safety function exists. Additionally, other limitations, remedial actions, or compensatory actions may be identified as a result of the support system inoperability and corresponding exception to entering supported system Conditions and Required Actions. The SFDP implements the requirements of LCO 3.0.6.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.0-11 Revision 71
| |
| | |
| LCO Applicability B 3.0 BASES LCO 3.0.6 Cross division checks to identify a loss of safety function (continued) for those support systems that support safety systems are required. The cross division check verifies that the supported systems of the redundant OPERABLE support system are OPERABLE, thereby ensuring safety function is retained. If this evaluation determines that a loss of safety function exists, the appropriate Conditions and Required Actions of the LCO in which the loss of safety function exists are required to be entered.
| |
| This loss of safety function does not require the assumption of additional single failures or loss of offsite power. Since operation is being restricted in accordance with the ACTIONS of the support system, any resulting temporary loss of redundancy or single failure protection is taken into account.
| |
| Similarly, the ACTIONS for inoperable offsite circuit(s) and inoperable diesel generator(s) provide the necessary restriction for cross division inoperabilities. This explicit cross division verification for inoperable AC electrical power sources also acknowledges that support system(s) are not declared inoperable solely as a result of inoperability of a normal or emergency electrical power source (refer to the definition of OPERABLEOPERABILITY).
| |
| When a loss of safety function is determined to exist, and the SFDP requires entry into the appropriate Conditions and Required Actions of the LCO in which the loss of safety function exists, consideration must be given to the specific type of function affected. Where a loss of function is solely due to a single Technical Specification support system (e.g.,
| |
| loss of automatic start due to inoperable instrumentation, or loss of pump suction source due to low tank level) the appropriate LCO is the LCO for the support system. The ACTIONS for a support system LCO adequately addresses the inoperabilities of that system without reliance on entering its supported system LCO. When the loss of function is the result of multiple support systems, the appropriate LCO is the LCO for the supported system.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.0-12 Revision 71
| |
| | |
| LCO Applicability B 3.0 BASES (continued)
| |
| LCO 3.0.7 There are certain special tests and operations required to be performed at various times over the life of the unit. These special tests and operations are necessary to demonstrate select unit performance characteristics, to perform special maintenance activities, and to perform special evolutions.
| |
| Special Operations LCOs in Section 3.10 allow specified TS requirements to be changed to permit performances of these special tests and operations, which otherwise could not be performed if required to comply with the requirements of these TS. Unless otherwise specified, all the other TS requirements remain unchanged. This will ensure all appropriate requirements of the MODE or other specified condition not directly associated with or required to be changed to perform the special test or operation will remain in effect.
| |
| The Applicability of a Special Operations LCO represents a condition not necessarily in compliance with the normal requirements of the TS. Compliance with Special Operations LCOs is optional. A special operation may be performed either under the provisions of the appropriate Special Operations LCO or under the other applicable TS requirements. If it is desired to perform the special operation under the provisions of the Special Operations LCO, the requirements of the Special Operations LCO shall be followed. When a Special Operations LCO requires another LCO to be met, only the requirements of the LCO statement are required to be met regardless of that LCO's Applicability (i.e., should the requirements of this other LCO not be met, the ACTIONS of the Special Operations LCO apply, not the ACTIONS of the other LCO). However, there are instances where the Special Operations LCO's ACTIONS may direct the other LCOs' ACTIONS be met. The Surveillances of the other LCO are not required to be met, unless specified in the Special Operations LCO. If conditions exist such that the Applicability of any other LCO is met, all the other LCO's requirements (ACTIONS and SRs) are required to be met concurrent with the requirements of the Special Operations LCO.
| |
| LCO 3.0.8 LCO 3.0.8 establishes conditions under which systems are considered to remain capable of performing their intended safety function when associated snubbers are not capable of providing their associated support function(s). This LCO states that the supported system is not considered to be inoperable solely due to one or more snubbers not capable of performing their associated support function(s). This is (continued)
| |
| LaSalle 1 and 2 B 3.0-13 Revision 75
| |
| | |
| LCO Applicability B 3.0 BASES LCO 3.0.8 appropriate because a limited length of time is allowed for (continued) maintenance, testing, or repair of one or more snubbers not capable of performing their associated support function(s) and appropriate compensatory measures are specified in the snubber requirements, which are located outside of the Technical Specifications (TS) under licensee control. LCO 3.0.8 applies to snubbers that only have seismic function. It does not apply to snubbers that also have design functions to mitigate steam/water hammer or other transient loads. The snubber requirements do not meet the criteria in 10 CFR 50.36(c)(2)(ii), and, as such, are appropriate for control by the licensee.
| |
| If the allowed time expires and the snubber(s) are unable to perform their associated support function(s), the affected supported system's LCO(s) must be declared not met and the conditions and Required Actions entered in accordance with LCO 3.0.2.
| |
| LCO 3.0.8.a applies when one or more snubbers are not capable of providing their associated support function(s) to a single train or subsystem of a multiple train or subsystem supported system or to a single train or subsystem supported system.
| |
| LCO 3.0.8.a allows 72 hours to restore the snubber(s) before declaring the supported system inoperable. The 72 hour Completion Time is reasonable based on the low probability of a seismic event concurrent with an event that would require operation of the supported system occurring while the snubber(s) are not capable of performing their associated support function and due to the availability of the redundant train of the supported system.
| |
| LCO 3.0.8.b applies when one or more snubbers are not capable of providing their associated support function(s) to more than one train or subsystem of a multiple train or subsystem supported system. LCO 3.0.8.b allows 12 hours to restore the snubber(s) before declaring the supported system inoperable.
| |
| The 12-hour Completion Time is reasonable based on the low probability of a seismic event concurrent with an event that would require operation of the supported system occurring while the snubber(s) are not capable of performing their associated support function.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.0-14 Revision 75
| |
| | |
| LCO Applicability B 3.0 BASES LCO 3.0.8 The following configuration restrictions shall be applied to (continued) the use of LCO 3.0.8:
| |
| (1) LCO 3.0.8.a can only be used if one of the following two means of heat removal is available:
| |
| : a. At least one high pressure makeup path (e.g., using High Pressure Core Spray (HPCS) or Reactor Core Isolation Cooling (RCIC) or its equivalent) and heat removal capability (e.g., suppression pool cooling),
| |
| including a minimum set of supporting equipment required for success, not associated with the inoperable snubber(s),
| |
| OR
| |
| : b. At least one low pressure makeup path (e.g., Low Pressure Coolant Injection (LPCI) or Low Pressure Core Spray (LPCS)) and heat removal capability (e.g., suppression pool cooling or shutdown cooling), including a minimum set of supporting equipment required for success, not associated with the inoperable snubber(s).
| |
| (2) LCO 3.0.8.b can only be used following verification that at least one success path exists, using equipment not associated with the inoperable snubber(s), to provide makeup and core cooling needed to mitigate Loss of Offsite Power (LOOP) accident sequences (i.e., initiated by a seismically-induced LOOP event with concurrent loss of all safety system trains supported by the out-of-service snubbers).
| |
| Each use of LCO 3.0.8 requires confirmation that at least one train (or subsystem) of systems supported by the inoperable snubbers would remain capable of performing their required safety or support functions for postulated design loads other than seismic loads. LCO 3.0.8 does not apply to non-seismic snubbers. In addition, a record of the design function of the inoperable snubber (i.e., seismic vs. non-seismic),
| |
| implementation and compliance with the configuration restrictions defined above, and the associated plant configuration shall be available on a recoverable basis for NRC inspection.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.0-15 Revision 75
| |
| | |
| LCO Applicability B 3.0 BASES LCO 3.0.8 LCO 3.0.8 requires that risk be assessed and managed.
| |
| (continued) Industry and NRC guidance on the implementation of 10 CFR 50.65(a)(4) (i.e., the Maintenance Rule) does not address seismic risk. However, use of LCO 3.0.8 should be considered with respect to other plant maintenance activities, and integrated into the existing Maintenance Rule process to the extent possible so that maintenance on any unaffected train or subsystem is properly controlled, and emergent issues are properly addressed. The risk assessment need not be quantified, but may be a qualitative awareness of the vulnerability of systems and components when one or more snubbers are not able to perform their associated support function.
| |
| LCO 3.0.8 does not apply to non-seismic functions of snubbers.
| |
| The provisions of LCO 3.0.8 apply to seismic snubbers that may also have non-seismic functions provided the supported systems would remain capable of performing their required safety or support functions for postulated design loads other than seismic loads. Non-seismic snubber issues will be addressed in the corrective action program.
| |
| LCO 3.0.9 LCO 3.0.9 establishes the applicability of each Specification to both Unit 1 and Unit 2 operation. Whenever a requirement applies to only one unit, or is different for each unit, this will be identified in the appropriate section of the Specification (e.g., Applicability, Surveillance, etc.) with parenthetical reference, Notes, or other appropriate presentation within the body of the requirement.
| |
| LCO 3.0.10 LCO 3.0.10 establishes conditions under which systems described in the Technical Specifications are considered to remain OPERABLE when required barriers are not capable of providing their related support function(s).
| |
| Barriers are doors, walls, floor plugs, curbs, hatches, installed structures or components, or other devices, not explicitly described in Technical Specifications, that support the performance of the safety function of systems described in the Technical Specifications. This LCO states that the supported system is not considered to be inoperable solely due to required barriers not capable of performing their related support function(s) under the described conditions.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.0-16 Revision 84
| |
| | |
| LCO Applicability B 3.0 BASES LCO 3.0.10 LCO 3.0.10 allows 30 days before declaring the supported (continued) system(s) inoperable and the LCO(s) associated with the supported system(s) not met. A maximum time is placed on each use of this allowance to ensure that as required barriers are found or are otherwise made unavailable, they are restored.
| |
| However, the allowable duration may be less than the specified maximum time based on the risk assessment.
| |
| If the allowed time expires and the barriers are unable to perform their related support function(s), the supported system's LCO(s) must be declared not met and the Conditions and Required Actions entered in accordance with LCO 3.0.2.
| |
| This provision does not apply to barriers which support ventilation systems or to fire barriers. The Technical Specifications for ventilation systems provide specific Conditions for inoperable barriers. Fire barriers are addressed by other regulatory requirements and associated plant programs. This provision does not apply to barriers which are not required to support system OPERABILITY (see NRC Regulatory Issue Summary 2001-09, "Control of Hazard Barriers," dated April 2, 2001).
| |
| The provisions of LCO 3.0.10 are justified because of the low risk associated with required barriers not being capable of performing their related support function. This provision is based on consideration of the following initiating event categories:
| |
| x Loss of coolant accidents; x High energy line breaks; x Feedwater line breaks; x Internal flooding; x External flooding; x Turbine missile ejection; and x Tornado or high wind.
| |
| The risk impact of the barriers which cannot perform their related support function(s) must be addressed pursuant to the risk assessment and management provision of the Maintenance Rule, 10 CFR 50.65(a)(4), and the associated implementation guidance, Regulatory Guide 1.160, "Monitoring the Effectiveness of Maintenance at Nuclear Power Plants."
| |
| Regulatory Guide 1.160 endorses the guidance in Section 11 of NUMARC 93-01, "Industry Guideline for Monitoring the (continued)
| |
| LaSalle 1 and 2 B 3.0-17 Revision 84
| |
| | |
| LCO Applicability B 3.0 BASES LCO 3.0.10 Effectiveness of Maintenance at Nuclear Power Plants." This (continued) guidance provides for the consideration of dynamic plant configuration issues, emergent conditions, and other aspects pertinent to plant operation with the barriers unable to perform their related support function(s). These considerations may result in risk management and other compensatory actions being required during the period that barriers are unable to perform their related support function(s).
| |
| LCO 3.0.10 may be applied to one or more trains or subsystems of a system supported by barriers that cannot provide their related support function(s), provided that risk is assessed and managed (including consideration of the effects on Large Early Release and from external events). If applied concurrently to more than one train or subsystem of a multiple train or subsystem supported system, the barriers supporting each of these trains or subsystems must provide their related support function(s) for different categories of initiating events. For example, LCO 3.0.10 may be applied for up to 30 days for more than one train of a multiple train supported system if the affected barrier for one train protects against internal flooding and the affected barrier for the other train protects against tornado missiles. In this example, the affected barrier may be the same physical barrier but serve different protection functions for each train.
| |
| The HPCS (High Pressure Core Spray) and RCIC (Reactor Core Isolation Cooling) systems are single train systems for injecting makeup water into the reactor during an accident or transient event. The RCIC system is not a safety system, nor required to operate during a transient, therefore, it does not have to meet the single failure criterion. The HPCS system provides backup in case of a RCIC system failure. The ADS (Automatic Depressurization System) and low pressure ECCS coolant injection provide the core cooling function in the event of failure of the HPCS system during an accident. Thus, for the purposes of LCO 3.0.10, the HPCS system, the RCIC system, and the ADS are considered independent subsystems of a single system and LCO 3.0.10 can be sued on these single train systems in a manner similar to multiple train or subsystem systems.
| |
| If during the time that LCO 3.0.10 is being used, the required OPERABLE train or subsystem becomes inoperable, it must be (continued)
| |
| LaSalle 1 and 2 B 3.0-18 Revision 84
| |
| | |
| LCO Applicability B 3.0 BASES LCO 3.0.10 restored to OPERABLE status within 24 hours. Otherwise the (continued) train(s) or subsystem(s) supported by barriers that cannot perform their related support function(s) must be declared inoperable and the associated LCOs declared not met. This 24 hour period provides time to respond to emergent conditions that would otherwise likely lead to entry into LCO 3.0.3 and a rapid plant shutdown, which is not justified given the low probability of an initiating event which would require the barrier(s) not capable of performing their related support function(s). During this 24 hour period, the plant risk associated with the existing conditions is assessed and managed in accordance with 10 CFR 50.65(a)(4).
| |
| LaSalle 1 and 2 B 3.0-19 Revision 84
| |
| | |
| SR Applicability B 3.0 B 3.0 SURVEILLANCE REQUIREMENT (SR) APPLICABILITY BASES SRs SR 3.0.1 through SR 3.0.5 establish the general requirements applicable to all Specifications in Sections 3.1 through 3.10 and apply at all times, unless otherwise stated.
| |
| SR 3.0.2 and SR 3.0.3 apply in Chapter 5 only when invoked by a Chapter 5 Specification.
| |
| SR 3.0.1 SR 3.0.1 establishes the requirement that SRs must be met during the MODES or other specified conditions in the Applicability for which the requirements of the LCO apply, unless otherwise specified in the individual SRs. This Specification is to ensure that Surveillances are performed to verify the OPERABILITY of systems and components, and that variables are within specified limits. Failure to meet a Surveillance within the specified Frequency, in accordance with SR 3.0.2, constitutes a failure to meet an LCO.
| |
| Systems and components are assumed to be OPERABLE when the associated SRs have been met. Nothing in this Specification, however, is to be construed as implying that systems or components are OPERABLE when:
| |
| : a. The systems or components are known to be inoperable, although still meeting the SRs; or
| |
| : b. The requirements of the Surveillance(s) are known to be not met between required Surveillance performances.
| |
| Surveillances do not have to be performed when the unit is in a MODE or other specified condition for which the requirements of the associated LCO are not applicable, unless otherwise specified. The SRs associated with a Special Operations LCO are only applicable when the Special Operations LCO is used as an allowable exception to the requirements of a Specification.
| |
| Unplanned events may satisfy the requirements (including applicable acceptance criteria) for a given SR. In this case, the unplanned event may be credited as fulfilling the performance of the SR.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.0-20 Revision 84
| |
| | |
| SR Applicability B 3.0 BASES SR 3.0.1 Surveillances, including Surveillances invoked by Required (continued) Actions, do not have to be performed on inoperable equipment because the ACTIONS define the remedial measures that apply.
| |
| Surveillances have to be met and performed in accordance with SR 3.0.2, prior to returning equipment to OPERABLE status.
| |
| Upon completion of maintenance, appropriate post maintenance testing is required to declare equipment OPERABLE. This includes ensuring applicable Surveillances are not failed and their most recent performance is in accordance with SR 3.0.2. Post maintenance testing may not be possible in the current MODE or other specified conditions in the Applicability due to the necessary unit parameters not having been established. In these situations, the equipment may be considered OPERABLE provided testing has been satisfactorily completed to the extent possible and the equipment is not otherwise believed to be incapable of performing its function. This will allow operation to proceed to a MODE or other specified condition where other necessary post maintenance tests can be completed. Some examples of this process are:
| |
| : a. Control rod drive maintenance during refueling that requires scram testing at t 800 psig. However, if other appropriate testing is satisfactorily completed and the scram time testing of SR 3.1.4.3 is satisfied, the control rod can be considered OPERABLE. This allows startup to proceed to reach 800 psig to perform other necessary testing.
| |
| : b. Reactor Core Isolation Cooling (RCIC) maintenance during shutdown that requires system functional tests at a specified pressure. Provided other appropriate testing is satisfactorily completed, startup can proceed with RCIC considered OPERABLE. This allows operation to reach the specified pressure to complete the necessary post maintenance testing.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.0-21 Revision 84
| |
| | |
| SR Applicability B 3.0 BASES (continued)
| |
| SR 3.0.2 SR 3.0.2 establishes the requirements for meeting the specified Frequency for Surveillances and any Required Action with a Completion Time that requires the periodic performance of the Required Action on a "once per..."
| |
| interval.
| |
| SR 3.0.2 permits a 25% extension of the interval specified in the Frequency. This extension facilitates Surveillance scheduling and considers plant operating conditions that may not be suitable for conducting the Surveillance (e.g.,
| |
| transient conditions or other ongoing Surveillance or maintenance activities).
| |
| The 25% extension does not significantly degrade the reliability that results from performing the Surveillance at its specified Frequency. This is based on the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the SRs. The exceptions to SR 3.0.2 are those Surveillances for which the 25% extension of the interval specified in the Frequency does not apply. These exceptions are stated in the individual Specifications. The requirements of regulations take precedence over the TS. Therefore, when a test interval is specified in the regulations, the test interval cannot be extended by the TS, and the SR includes a Note in the Frequency stating "SR 3.0.2 is not applicable."
| |
| As stated in SR 3.0.2, the 25% extension also does not apply to the initial portion of a periodic Completion Time that requires performance on a "once per..." basis. The 25%
| |
| extension applies to each performance after the initial performance. The initial performance of the Required Action, whether it is a particular Surveillance or some other remedial action, is considered a single action with a single Completion Time. One reason for not allowing the 25%
| |
| extension to this Completion Time is that such an action usually verifies that no loss of function has occurred by checking the status of redundant or diverse components or accomplishes the function of the inoperable equipment in an alternative manner.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.0-22 Revision 84
| |
| | |
| SR Applicability B 3.0 BASES SR 3.0.2 The provisions of SR 3.0.2 are not intended to be used (continued) repeatedly to extend Surveillance intervals (other than those consistent with refueling intervals) or periodic Completion Time intervals beyond those specified.
| |
| SR 3.0.3 SR 3.0.3 establishes the flexibility to defer declaring affected equipment inoperable or an affected variable outside the specified limits when a Surveillance has not been performed within the specified Frequency. A delay period of up to 24 hours or up to the limit of the specified Frequency, whichever is greater, applies from the point in time it is discovered that the Surveillance has not been performed in accordance with SR 3.0.2, and not at the time that the specified Frequency was not met. This delay period provides adequate time to perform Surveillances that have been missed. This delay period permits the performance of a Surveillance before complying with Required Actions or other remedial measures that might preclude performance of the Surveillance.
| |
| The basis for this delay period includes consideration of unit conditions, adequate planning, availability of personnel, the time required to perform the Surveillance, the safety significance of the delay in completing the required Surveillance, and the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the requirements.
| |
| When a Surveillance with a Frequency based not on time intervals, but upon specified unit conditions, operating situations, or requirements of regulations (e.g., prior to entering MODE 1 after each fuel loading, or in accordance with 10 CFR 50, Appendix J, as modified by approved exemptions, etc.) is discovered to not have been performed when specified, SR 3.0.3 allows for the full delay period of up to the specified Frequency to perform the Surveillance.
| |
| However, since there is not a time interval specified, the missed Surveillance should be performed at the first reasonable opportunity.
| |
| SR 3.0.3 provides a time limit for, and allowances for the performance of, Surveillances that become applicable as a consequence of MODE changes imposed by Required Actions.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.0-23 Revision 84
| |
| | |
| SR Applicability B 3.0 BASES SR 3.0.3 SR 3.0.3 is only applicable if there is a reasonable (continued) expectation the associated equipment is OPERABLE or that variables are within limits, and it is expected that the Surveillance will be met when performed. Many factors should be considered, such as the period of time since the Surveillance was last performed, or whether the Surveillance, or a portion thereof, has ever been performed, and any other indications, tests, or activities that might support the expectation that the Surveillance will be met when performed. An example of the use of SR 3.0.3 would be a relay contact that was not tested as required in accordance with a particular SR, but previous successful performances of the SR included the relay contact; the adjacent, physically connected relay contacts were tested during the SR performance; the subject relay contact has been tested by another SR; or historical operation of the subject relay contact has been tested by another SR; or historical operation of the subject relay contact has been successful. It is not sufficient to infer the behavior of the associated equipment from the performance of similar equipment. The rigor of determining whether there is a reasonable expectation a Surveillance will be met when performed should increase based on the length of time since the last performance of the Surveillance. If the Surveillance has been performed recently, a review of the Surveillance history and equipment performance may be sufficient to support a reasonable expectation that the Surveillance will be met when performed. For Surveillances that have not been performed for a long period or that have never been performed, a rigorous evaluation based on objective evidence should provide a high degree of confidence that the equipment is OPERABLE. The evaluation should be documented in sufficient detail to allow a knowledgeable individual to understand the basis for the determination.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.0-24 Revision 84
| |
| | |
| SR Applicability B 3.0 BASES SR 3.0.3 Failure to comply with specified Frequencies for SRs is (continued) expected to be an infrequent occurrence. Use of the delay period established by SR 3.0.3 is a flexibility which is not intended to be used repeatedly to extend Surveillance intervals. While up to 24 hours or the limit of the specified Frequency is provided to perform the missed Surveillance, it is expected that the missed Surveillance will be performed at the first reasonable opportunity. The determination of the first reasonable opportunity should include consideration of the impact on plant risk (from delaying the Surveillance as well as any plant configuration changes required or shutting the plant down to perform the Surveillance) and impact on any analysis assumptions, in addition to unit conditions, planning, availability of personnel, and the time required to perform the Surveillance. This risk impact should be managed through the program in place to implement 10 CFR 50.65(a)(4) and its implementation guidance, NRC Regulatory Guide 1.182, Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants. This Regulatory Guide addresses consideration of temporary and aggregate risk impacts, determination of risk management action thresholds, and risk management action up to and including plant shutdown. The missed Surveillance should be treated as an emergent condition as discussed in the Regulatory Guide. The risk evaluation may use quantitative, qualitative, or blended methods. The degree of depth and rigor of the evaluation should be commensurate with the importance of the component.
| |
| Missed Surveillances for important components should be analyzed quantitatively. If the results of the risk evaluation determine the risk increase is significant, this evaluation should be used to determine the safest course of action. All missed Surveillances will be placed in the licensees Corrective Action Program.
| |
| If a Surveillance is not completed within the allowed delay period, then the equipment is considered inoperable or the variable then is considered outside the specified limits and the Completion Times of the Required Actions for the applicable LCO Conditions begin immediately upon expiration (continued)
| |
| LaSalle 1 and 2 B 3.0-25 Revision 84
| |
| | |
| SR Applicability B 3.0 BASES SR 3.0.3 of the delay period. If a Surveillance is failed within the (continued) delay period, then the equipment is inoperable, or the variable is outside the specified limits and the Completion Times of the Required Actions for the applicable LCO Conditions begin immediately upon the failure of the Surveillance.
| |
| Completion of the Surveillance within the delay period allowed by this Specification, or within the Completion Time of the ACTIONS, restores compliance with SR 3.0.1.
| |
| SR 3.0.4 SR 3.0.4 establishes the requirement that all applicable SRs must be met before entry into a MODE or other specified condition in the Applicability.
| |
| This Specification ensures that system and component OPERABILITY requirements and variable limits are met before entry into MODES or other specified conditions in the Applicability for which these systems and components ensure safe operation of the unit. The provisions of this Specification should not be interpreted as endorsing the failure to exercise the good practice of restoring systems or components to OPERABLE status before entering an associated MODE or other specified condition in the Applicability.
| |
| A provision is included to allow entry into a MODE or other specified condition in the Applicability when an LCO is not met due to Surveillance not being met in accordance with LCO 3.0.4.
| |
| However, in certain circumstances, failing to meet an SR will not result in SR 3.0.4 restricting a MODE change or other specified condition change. When a system, subsystem, division, component, device, or variable is inoperable or outside its specified limits, the associated SR(s) are not required to be performed, per SR 3.0.1, which states that surveillances do not have to be performed on inoperable equipment. When equipment is inoperable, SR 3.0.4 does not apply to the associated SR(s) since the requirement for the SR(s) to be performed is removed. Therefore, failing to perform the Surveillance(s) within the specified Frequency does not result in an SR 3.0.4 restriction to changing MODES or other specified conditions of the Applicability.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.0-26 Revision 84
| |
| | |
| SR Applicability B 3.0 BASES SR 3.0.4 However, since the LCO is not met in this instance, (continued) LCO 3.0.4 will govern any restrictions that may (or may not) apply to MODE or other specified condition changes. SR 3.0.4 does not restrict changing MODES or other specified conditions of the Applicability when a Surveillance has not been performed within the specified Frequency, provided the requirement to declare the LCO not met has been delayed in accordance with SR 3.0.3.
| |
| The provisions of SR 3.0.4 shall not prevent entry into MODES or other specified conditions in the Applicability that are required to comply with ACTIONS. In addition, the provisions of SR 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that result from any unit shutdown. In this context, a unit shutdown is defined as a change in MODE or other specified condition in the Applicability associated with transitioning from MODE 1 to MODE 2, MODE 2 to MODE 3, and MODE 3 to MODE 4.
| |
| The precise requirements for performance of SRs are specified such that exceptions to SR 3.0.4 are not necessary. The specific time frames and conditions necessary for meeting the SRs are specified in the Frequency, in the Surveillance, or both. This allows performance of Surveillances when the prerequisite condition(s) specified in a Surveillance procedure require entry into the MODE or other specified condition in the Applicability of the associated LCO prior to the performance or completion of a Surveillance. A Surveillance that could not be performed until after entering the LCOs Applicability, would have its Frequency specified such that it is not "due" until the specific conditions needed are met. Alternately, the Surveillance may be stated in the form of a Note, as not required (to be met or performed) until a particular event, condition, or time has been reached. Further discussion of the specific formats of SRs' annotation is found in Section 1.4, Frequency.
| |
| SR 3.0.5 SR 3.0.5 establishes the applicability of each Surveillance to both Unit 1 and Unit 2 operation. Whenever a requirement applies to only one unit, or is different for each unit, this will be identified with parenthetical reference, Notes, or other appropriate presentation within the SR.
| |
| LaSalle 1 and 2 B 3.0-27 Revision 84
| |
| | |
| SDM B 3.1.1 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.1 SHUTDOWN MARGIN (SDM)
| |
| BASES BACKGROUND SDM requirements are specified to ensure:
| |
| : a. The reactor can be made subcritical from all operating conditions and transients and Design Basis Events;
| |
| : b. The reactivity transients associated with postulated accident conditions are controllable within acceptable limits; and
| |
| : c. The reactor will be maintained sufficiently subcritical to preclude inadvertent criticality in the shutdown condition.
| |
| These requirements are satisfied by the control rods, as described in GDC 26 (Ref. 1), which can compensate for the reactivity effects of the fuel and water temperature changes experienced during all operating conditions.
| |
| APPLICABLE Having sufficient SDM assures that the reactor will become SAFETY ANALYSES and remain subcritical after all design basis accidents and transients. For example, SDM is assumed as an initial condition for the control rod removal error during a refueling accident (Ref. 2). The analysis of this reactivity insertion event assumes the refueling interlocks are OPERABLE when the reactor is in the refueling mode of operation. These interlocks prevent the withdrawal of more than one control rod from the core during refueling.
| |
| (Special consideration and requirements for multiple control rod withdrawal during refueling are covered in Special Operations LCO 3.10.5, "Multiple Control Rod Withdrawal-Refueling.") The analysis assumes this condition is acceptable since the core will be shut down with the highest worth control rod withdrawn, if adequate SDM has been demonstrated.
| |
| Prevention or mitigation of positive reactivity insertion events is necessary to limit the energy deposition in the fuel, thereby preventing significant fuel damage, which (continued)
| |
| LaSalle 1 and 2 B 3.1.1-1 Revision 0
| |
| | |
| SDM B 3.1.1 BASES APPLICABLE could result in undue release of radioactivity. Adequate SAFETY ANALYSES SDM ensures inadvertent criticalities do not cause (continued) significant fuel damage.
| |
| SDM satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The specified SDM limit accounts for the uncertainty in the demonstration of SDM by testing. Separate SDM limits are provided for testing where the highest worth control rod is determined analytically or by measurement. This is due to the reduced uncertainty in the SDM test when the highest worth control rod is determined by measurement. When SDM is demonstrated by calculations not associated with a test (e.g., to confirm SDM during the fuel loading sequence),
| |
| additional margin is included to account for uncertainties in the calculation. To ensure adequate SDM, a design margin is included to account for uncertainties in the design calculations (Ref. 3).
| |
| APPLICABILITY In MODES 1 and 2, SDM must be provided to assure shutdown capability. In MODES 3 and 4, SDM is required to ensure the reactor will be held subcritical with margin for a single withdrawn control rod. SDM is required in MODE 5 to prevent an inadvertent criticality during the withdrawal of a single control rod from a core cell containing one or more fuel assemblies (Ref. 2).
| |
| ACTIONS A.1 With SDM not within the limits of the LCO in MODE 1 or 2, SDM must be restored within 6 hours. Failure to meet the specified SDM may be caused by a control rod that cannot be inserted. The 6 hour Completion time is acceptable, considering that the reactor can still be shut down, assuming no additional failures of control rods to insert, and the low probability of an event occurring during this interval.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.1.1-2 Revision 0
| |
| | |
| SDM B 3.1.1 BASES ACTIONS B.1 (continued)
| |
| If the SDM cannot be restored, the plant must be brought to MODE 3 within 12 hours, to prevent the potential for further reductions in available SDM (e.g., additional stuck control rods). The allowed Completion Time of 12 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.
| |
| C.1 With SDM not within limits in MODE 3, the operator must immediately initiate action to fully insert all insertable control rods. Action must continue until all insertable control rods are fully inserted. This action results in the least reactive condition for the core.
| |
| D.1, D.2, D.3, and D.4 With SDM not within limits in MODE 4, the operator must immediately initiate action to fully insert all insertable control rods. Action must continue until all insertable control rods are fully inserted. This action results in the least reactive condition for the core. Actions must also be initiated within 1 hour to provide means for control of potential radioactive releases. This includes ensuring secondary containment is OPERABLE; at least one Standby Gas Treatment (SGT) subsystem is OPERABLE; and secondary containment isolation capability is available in each associated secondary containment penetration flow path not isolated that is assumed to be isolated to mitigate radioactivity releases (i.e., at least one secondary containment isolation valve and associated instrumentation are OPERABLE, or other acceptable administrative controls to assure isolation capability). These administrative controls consist of stationing a dedicated operator, who is in continuous communication with the control room, at the controls of the isolation device. In this way, the penetration can be rapidly isolated when a need for secondary containment isolation is indicated. This (ensuring components are OPERABLE) may be performed as an (continued)
| |
| LaSalle 1 and 2 B 3.1.1-3 Revision 0
| |
| | |
| SDM B 3.1.1 BASES ACTIONS D.1, D.2, D.3, and D.4 (continued) administrative check, by examining logs or other information, to determine if the components are out of service for maintenance or other reasons. It is not necessary to perform the Surveillances needed to demonstrate the OPERABILITY of the components. If, however, any required component is inoperable, then it must be restored to OPERABLE status. In this case, SRs may need to be performed to restore the component to OPERABLE status.
| |
| Actions must continue until all required components are OPERABLE.
| |
| E.1, E.2, E.3, E.4, and E.5 With SDM not within limits in MODE 5, the operator must immediately suspend CORE ALTERATIONS that could reduce SDM, e.g., insertion of fuel in the core or the withdrawal of control rods. Suspension of these activities shall not preclude completion of movement of a component to a safe condition. Inserting control rods or removing fuel from the core will reduce the total reactivity and are therefore excluded from the suspended actions.
| |
| Action must also be immediately initiated to fully insert all insertable control rods in core cells containing one or more fuel assemblies. Action must continue until all insertable control rods in core cells containing one or more fuel assemblies have been fully inserted. Control rods in core cells containing no fuel assemblies do not affect the reactivity of the core and therefore do not have to be inserted.
| |
| Action must also be initiated within 1 hour to provide means for control of potential radioactive releases. This includes ensuring secondary containment is OPERABLE; at least one SGT subsystem is OPERABLE; and secondary containment isolation capability is available in each associated secondary containment penetration flow path not isolated that is assumed to be isolated to mitigate radioactivity releases (i.e., at least one secondary containment isolation valve and associated instrumentation are OPERABLE, or other acceptable administrative controls to assure isolation capability). These administrative controls (continued)
| |
| LaSalle 1 and 2 B 3.1.1-4 Revision 0
| |
| | |
| SDM B 3.1.1 BASES ACTIONS E.1, E.2, E.3, E.4, and E.5 (continued) consist of stationing a dedicated operator, who is in continuous communication with the control room, at the controls of the isolation device. In this way, the penetration can be rapidly isolated when a need for secondary containment isolation is indicated. This (ensuring components are OPERABLE) may be performed as an administrative check, by examining logs or other information, to determine if the components are out of service for maintenance or other reasons. It is not necessary to perform the Surveillances needed to demonstrate the OPERABILITY of the components. If, however, any required component is inoperable, then it must be restored to OPERABLE status. In this case, SRs may need to be performed to restore the component to OPERABLE status.
| |
| Actions must continue until all required components are OPERABLE.
| |
| SURVEILLANCE SR 3.1.1.1 REQUIREMENTS Adequate SDM must be verified to ensure the reactor can be made subcritical from any initial operating condition. This can be accomplished by a test, an evaluation, or a combination of the two. Adequate SDM is demonstrated by testing before or during the first startup after fuel movement, shuffling within the reactor pressure vessel, or control rod replacement. Control rod replacement refers to the decoupling and removal of a control rod from a core location, and subsequent replacement with a new control rod or a control rod from another core location. Since core reactivity will vary during the cycle as a function of fuel depletion and poison burnup, the beginning of cycle (BOC) test must also account for changes in core reactivity during the cycle. Therefore, to obtain the SDM, the initial measured value must be increased by an adder, "R", which is the difference between the calculated value of maximum core reactivity during the operating cycle and the calculated BOC core reactivity. If the value of R is negative (i.e., BOC is the most reactive point in the cycle), no correction to the BOC measured value is required (Ref. 4). For the SDM demonstrations that rely solely on calculation of the highest worth control rod, additional margin (0.10% k/k) must be added to the SDM limit of 0.28% k/k to account for uncertainties in the calculation.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.1.1-5 Revision 0
| |
| | |
| SDM B 3.1.1 BASES SURVEILLANCE SR 3.1.1.1 (continued)
| |
| REQUIREMENTS The SDM may be demonstrated during an in-sequence control rod withdrawal, in which the highest worth control rod is analytically determined, or during local criticals, where the highest worth control rod is determined by testing.
| |
| Local critical tests require the withdrawal of out of sequence control rods. This testing would therefore require bypassing of the Rod Worth Minimizer to allow the out of sequence withdrawal, and therefore additional requirements must be met (see LCO 3.10.6, "Control Rod Testing-Operating").
| |
| The Frequency of 4 hours after reaching criticality is allowed to provide a reasonable amount of time to perform the required calculations and appropriate verification.
| |
| During MODES 3 and 4, analytical calculation of SDM may be used to assure the requirements of SR 3.1.1.1 are met.
| |
| During MODE 5, adequate SDM is also required to ensure the reactor does not reach criticality during control rod withdrawals. An evaluation of each in vessel fuel movement during fuel loading (including shuffling fuel within the core) is required to ensure adequate SDM is maintained during refueling. This evaluation ensures the intermediate loading patterns are bounded by the safety analyses for the final core loading pattern. For example, bounding analyses that demonstrate adequate SDM for the most reactive configurations during the refueling may be performed to demonstrate acceptability of the entire fuel movement sequence. These bounding analyses include additional margins to the associated uncertainties. Spiral offload or reload sequences inherently satisfy the SR, provided the fuel assemblies are reloaded in the same configuration analyzed for the new cycle. Removing fuel from the core will always result in an increase in SDM.
| |
| REFERENCES 1. 10 CFR 50, Appendix A, GDC 26.
| |
| : 2. UFSAR, Section 15.4.1.1.
| |
| : 3. UFSAR, Section 4.3.2.4.1.
| |
| : 4. NEDE-24011-P-A, "GE Standard Application for Reactor Fuel," (as specified in Technical Specification 5.6.5).
| |
| LaSalle 1 and 2 B 3.1.1-6 Revision 0
| |
| | |
| Reactivity Anomalies B 3.1.2 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.2 Reactivity Anomalies BASES BACKGROUND In accordance with GDC 26, GDC 28, and GDC 29 (Ref. 1),
| |
| reactivity shall be controllable such that subcriticality is maintained under cold conditions and acceptable fuel design limits are not exceeded during normal operation and anticipated operational occurrences. Reactivity Anomalies is used as a measure of the predicted versus measured core reactivity during power operation. The continual confirmation of core reactivity is necessary to ensure that the Design Basis Accident (DBA) and transient safety analyses remain valid. A large reactivity anomaly could be the result of unanticipated changes in fuel reactivity, control rod worth, or operation at conditions not consistent with those assumed in the predictions of core reactivity, and could potentially result in a loss of SDM or violation of acceptable fuel design limits. Comparing predicted versus measured core reactivity validates the nuclear methods used in the safety analysis and supports the SDM demonstrations (LCO 3.1.1, "SHUTDOWN MARGIN (SDM)") in ensuring the reactor can be brought safely to cold, subcritical conditions.
| |
| When the reactor core is critical or in normal power operation, a reactivity balance exists and the net reactivity is zero. A comparison of predicted and measured reactivity is convenient under such a balance, since parameters are being maintained relatively stable under steady state power conditions. The positive reactivity inherent in the core design is balanced by the negative reactivity of the control components, thermal feedback, neutron leakage, and materials in the core that absorb neutrons, such as burnable absorbers, producing zero net reactivity.
| |
| In order to achieve the required fuel cycle energy output, the uranium enrichment in the new fuel loading and the fuel loaded in the previous cycles provide excess positive reactivity beyond that required to sustain steady state operation at the beginning of cycle (BOC). When the reactor is critical at RTP and operating moderator temperature, the (continued)
| |
| LaSalle 1 and 2 B 3.1.2-1 Revision 0
| |
| | |
| Reactivity Anomalies B 3.1.2 BASES BACKGROUND excess positive reactivity is compensated by burnable (continued) absorbers (e.g., gadolinia), control rods, and whatever neutron poisons (mainly xenon and samarium) are present in the fuel.
| |
| The predicted core reactivity, as represented by k effective (keff), is calculated by a 3D core simulator code as a function of cycle exposure. This calculation is performed for projected operating states and conditions throughout the cycle. The monitored keff is calculated by the core monitoring system for actual plant conditions and is then compared to the predicted value for the cycle exposure.
| |
| APPLICABLE Accurate prediction of core reactivity is either an explicit SAFETY ANALYSES or implicit assumption in the accident analysis evaluations (Ref. 2). In particular, SDM and reactivity transients, such as control rod withdrawal accidents or rod drop accidents, are very sensitive to accurate prediction of core reactivity. These accident analysis evaluations rely on computer codes that have been qualified against available test data, operating plant data, and analytical benchmarks.
| |
| Monitoring reactivity anomaly provides additional assurance that the nuclear methods provide an accurate representation of the core reactivity.
| |
| The comparison between measured and predicted initial core reactivity provides a normalization for the calculational models used to predict core reactivity. If the measured and predicted keff for identical core conditions at BOC do not reasonably agree, then the assumptions used in the reload cycle design analysis or the calculation models used to predict keff may not be accurate. If reasonable agreement between measured and predicted core reactivity exists at BOC, then the prediction may be normalized to the measured value. Thereafter, any significant deviations in the measured keff from the predicted keff that develop during fuel depletion may be an indication that the assumptions of the DBA and transient analyses are no longer valid, or that an unexpected change in core conditions has occurred.
| |
| Reactivity Anomalies satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.1.2-2 Revision 0
| |
| | |
| Reactivity Anomalies B 3.1.2 BASES (continued)
| |
| LCO The reactivity anomaly limit is established to ensure plant operation is maintained within the assumptions of the safety analyses. Large differences between monitored and predicted core reactivity may indicate that the assumptions of the DBA and transient analyses are no longer valid, or that the uncertainties in the Nuclear Design Methodology are larger than expected. A limit on the difference between the monitored core keff and the predicted core keff of 1% k/k has been established based on engineering judgment. A > 1%
| |
| deviation in reactivity from that predicted is larger than expected for normal operation and should therefore be evaluated.
| |
| APPLICABILITY In MODE 1, most of the control rods are withdrawn and steady state operation is typically achieved. Under these conditions, the comparison between predicted and monitored core reactivity provides an effective measure of the reactivity anomaly. In MODE 2, control rods are typically being withdrawn during a startup. In MODES 3 and 4, all control rods are fully inserted, and, therefore, the reactor is in the least reactive state, where monitoring core reactivity is not necessary. In MODE 5, fuel loading results in a continually changing core reactivity. SDM requirements (LCO 3.1.1) ensure that fuel movements are performed within the bounds of the safety analysis, and an SDM demonstration is required during the first startup following operations that could have altered core reactivity (e.g., fuel movement, control rod replacement, control rod shuffling). The SDM test, required by LCO 3.1.1, provides a direct comparison of the predicted and monitored core reactivity at cold conditions; therefore, Reactivity Anomalies is not required during these conditions.
| |
| ACTIONS A.1 Should an anomaly develop between measured and predicted core reactivity, the core reactivity difference must be restored to within the limit to ensure continued operation is within the core design assumptions. Restoration to within the limit could be performed by an evaluation of the core design and safety analysis to determine the reason for the anomaly. This evaluation normally reviews the core (continued)
| |
| LaSalle 1 and 2 B 3.1.2-3 Revision 0
| |
| | |
| Reactivity Anomalies B 3.1.2 BASES ACTIONS A.1 (continued) conditions to determine their consistency with input to design calculations. Measured core and process parameters are also normally evaluated to determine that they are within the bounds of the safety analysis, and safety analysis calculational models may be reviewed to verify that they are adequate for representation of the core conditions.
| |
| The required Completion Time of 72 hours is based on the low probability of a DBA during this period, and allows sufficient time to assess the physical condition of the reactor and complete the evaluation of the core design and safety analysis.
| |
| B.1 If the core reactivity cannot be restored to within the 1% k/k limit, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. The allowed Completion Time of 12 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.
| |
| SURVEILLANCE SR 3.1.2.1 REQUIREMENTS Verifying the reactivity difference between the monitored and predicted core keff is within the limits of the LCO provides further assurance that plant operation is maintained within the assumptions of the DBA and transient analyses. The Core Monitoring System calculates the core keff for the reactor conditions obtained from plant instrumentation. A comparison of the monitored core keff to the predicted core keff at the same cycle exposure is used to calculate the reactivity difference. The comparison is required when the core reactivity has potentially changed by a significant amount. This may occur following a refueling in which new fuel assemblies are loaded, fuel assemblies are shuffled within the core, or control rods are replaced or shuffled. Control rod replacement refers to the decoupling and removal of a control rod from a core location, and (continued)
| |
| LaSalle 1 and 2 B 3.1.2-4 Revision 0
| |
| | |
| Reactivity Anomalies B 3.1.2 BASES SURVEILLANCE SR 3.1.2.1 (continued)
| |
| REQUIREMENTS subsequent replacement with a new control rod or a control rod from another core location. Also, core reactivity changes during the cycle. The 24 hour interval after reaching equilibrium conditions following a startup is based on the need for equilibrium xenon concentrations in the core, such that an accurate comparison between the monitored and predicted core keff values can be made. For the purposes of this SR, the reactor is assumed to be at equilibrium conditions when steady state operations (no control rod movement or core flow changes) at 75% RTP have been obtained. The 1000 MWD/T Frequency was developed, considering the relatively slow change in core reactivity with exposure and operating experience related to variations in core reactivity. This comparison requires the core to be operating at power levels which minimize the uncertainties and measurement errors, in order to obtain meaningful results. Therefore, the comparison is only done when in MODE 1. The core weight, tons (T) in MWD/T, reflects metric tons.
| |
| REFERENCES 1. 10 CFR 50, Appendix A, GDC 26, GDC 28, and GDC 29.
| |
| : 2. UFSAR, Chapter 15.
| |
| LaSalle 1 and 2 B 3.1.2-5 Revision 0
| |
| | |
| 1 Control ntrol rol Rod OPERABILITY B 3.1.3 B 3.1 REACTIVITY TY CONTROL SYSTEMS B 3.1.3 Control Rod OPERABILITY BASES BACKGROUND Control rods are components of the Control Rod Drive (CRD)
| |
| System, which is the primary reactivity control system for the reactor. In conjunction with the Reactor Protection System, the CRD System provides the means for the reliable control of reactivity changes to ensure that under conditions of normal operation, including anticipated operational occurrences, specified acceptable fuel design limits are not exceeded. In addition, the control rods provide the capability to hold the reactor core subcritical under all conditions and to limit the potential amount and rate of reactivity increase caused by a malfunction in the CRD System. The CRD System is designed to satisfy the requirements of GDC 26, GDC 27, GDC 28, and GDC 29, (Ref. 1).
| |
| The CRD System consists of 185 locking piston control rod drive mechanisms (CRDMs) and a hydraulic control unit for each drive mechanism. The locking piston type CRDM is a double acting hydraulic piston, which uses condensate water as the operating fluid. Accumulators provide additional energy for scram. An index tube and piston, coupled to the control rod, are locked at fixed increments by a collet mechanism. The collet fingers engage notches in the index tube to prevent unintentional withdrawal of the control rod, but without restricting insertion.
| |
| This Specification, along with LCO 3.1.4, "Control Rod Scram Times," LCO 3.1.5, "Control Rod Scram Accumulators," and LCO 3.1.6, "Rod Pattern Control," ensure that the performance of the control rods in the event of a Design Basis Accident (DBA) or transient meets the assumptions used in the safety analyses of References 2, 3, 4, 5, and 6.
| |
| APPLICABLE The analytical methods and assumptions used in the SAFETY ANALYSES evaluations involving control rods are presented in References 2, 3, 4, 5, and 6. The control rods provide the primary means for rapid reactivity control (reactor scram),
| |
| for maintaining the reactor subcritical, and for limiting the potential effects of reactivity insertion events caused by malfunctions in the CRD System.
| |
| (continued)
| |
| LaSalle 1 B 3.1.3-1 Revision 91
| |
| | |
| UNIT 1 Control ntrol rol Rod OPERABILITY B 3.1.3 BASES APPLICABLE The capability of inserting the control rods provides SAFETY ANALYSES assurance that the assumptions for scram reactivity in the (continued) DBA and transient analyses are not violated. Since the SDM ensures the reactor will be subcritical with the highest worth control rod withdrawn (assumed single failure), the additional failure of a second control rod to insert could invalidate the demonstrated SDM and potentially limit the ability of the CRD System to hold the reactor subcritical.
| |
| If the control rod is stuck at an inserted position and becomes decoupled from the CRD, a control rod drop accident (CRDA) can possibly occur. Therefore, the requirement that all control rods be OPERABLE ensures the CRD System can perform its intended function.
| |
| The control rods also protect the fuel from damage that results in release of radioactivity. The limits protected are the MCPR Safety Limit (SL) (see Bases for SL 2.1.1, "Reactor Core SLs," and LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)"), the 1% cladding plastic strain fuel design limit (see Bases for LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLGHR)," and LCO 3.2.3, "LINEAR HEAT GENERATION RATE (LHGR)"), and the fuel design limit (see Bases for LCO 3.1.6, "Rod Pattern Control") during reactivity insertion events.
| |
| The negative reactivity insertion (scram) provided by the CRD System provides the analytical basis for determination of plant thermal limits and provides protection against fuel design limits during a CRDA. Bases for LCO 3.1.4, LCO 3.1.5, and LCO 3.1.6 discuss in more detail how the SLs are protected by the CRD System.
| |
| Control rod OPERABILITY satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO OPERABILITY of an individual control rod is based on a combination of factors, primarily the scram insertion times, the control rod coupling integrity, and the ability to determine the control rod position. Accumulator OPERABILITY is addressed by LCO 3.1.5. The associated scram accumulator status for a control rod only affects the scram insertion times and therefore an inoperable accumulator does not (continued)
| |
| LaSalle 1 B 3.1.3-2 Revision 0
| |
| | |
| UNIT 1 Control ntrol rol Rod OPERABILITY B 3.1.3 BASES LCO immediately require declaring a control rod inoperable.
| |
| (continued) Although not all control rods are required to be OPERABLE to satisfy the intended reactivity control requirements, strict control over the number and distribution of inoperable control rods is required to satisfy the assumptions of the DBA and transient analyses.
| |
| OPERABILITY requirements for control rods also includes correct assembly of the CRD housing supports.
| |
| APPLICABILITY In MODES 1 and 2, the control rods are assumed to function during a DBA or transient and are therefore required to be OPERABLE in these MODES. In MODES 3 and 4, control rods are not able to be withdrawn since the reactor mode switch is in shutdown and a control rod block is applied. This provides adequate requirements for control rod OPERABILITY during these conditions. Control rod requirements in MODE 5 are located in LCO 3.9.5, "Control Rod OPERABILITYRefueling."
| |
| ACTIONS The ACTIONS Table is modified by a Note indicating that a separate Condition entry is allowed for each control rod.
| |
| This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable control rod. Complying with the Required Actions may allow for continued operation, and subsequent inoperable control rods are governed by subsequent Condition entry and application of associated Required Actions.
| |
| A.1, A.2, A.3, and A.4 A control rod is considered stuck if it will not insert by either CRD drive water or scram pressure. The Required Actions are modified by a Note that allows the Rod Worth Minimizer (RWM) to be bypassed if required to allow continued operation. LCO 3.3.2.1, "Control Rod Block Instrumentation," provides additional requirements when the RWM is bypassed to ensure compliance with the CRDA analysis.
| |
| With one withdrawn control rod stuck, the local scram reactivity rate assumptions may not be met if the stuck (continued)
| |
| LaSalle 1 B 3.1.3-3 Revision 0
| |
| | |
| UNIT 1 Control ntrol rol Rod OPERABILITY B 3.1.3 BASES ACTIONS A.1, A.2, A.3, and A.4 (continued) control rod separation criteria are not met. Therefore, a verification that the separation criteria are met must be performed immediately. The separation criteria are not met if: a) the stuck control rod occupies a location adjacent to two "slow" control rods, b) the stuck control rod occupies a location adjacent to one "slow" control rod, and the one "slow" control rod is also adjacent to another "slow" control rod, or c) if the stuck control rod occupies a location adjacent to one "slow" control rod when there is another pair of "slow" control rods elsewhere in the core adjacent to one another. The description of "slow" control rods is provided in LCO 3.1.4, "Control Rod Scram Times."
| |
| In addition, the associated control rod drive must be disarmed within 2 hours. The allowed Completion Time of 2 hours is acceptable, considering the reactor can still be shut down, assuming no additional control rods fail to insert, and provides a reasonable amount of time to perform the Required Action in an orderly manner. The control rod must be isolated from both scram and normal insert and withdraw pressure. Isolating the control rod from scram and normal insert and withdraw pressure prevents damage to the CRDM or reactor internals. The control rod isolation method should also ensure cooling water to the CRD is maintained.
| |
| Monitoring of the insertion capability for each withdrawn control rod must also be performed within 24 hours from discovery of Condition A concurrent with THERMAL POWER greater than the low power setpoint (LPSP) of the RWM.
| |
| SR 3.1.3.3 performs periodic tests of the control rod insertion capability of withdrawn control rods. Testing each withdrawn control rod ensures that a generic problem does not exist. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." The Required Action A.3 Completion Time only begins upon discovery of Condition A concurrent with THERMAL POWER greater than the actual LPSP of the RWM, since the notch insertions may not be compatible with the requirements of rod pattern control (LCO 3.1.6) and the RWM (LCO 3.3.2.1). The allowed Completion Time provides a reasonable time to test the control rods, considering the potential for a need to reduce power to perform the tests.
| |
| (continued)
| |
| LaSalle 1 B 3.1.3-4 Revision 42
| |
| | |
| UNIT 1 Control ntrol rol Rod OPERABILITY B 3.1.3 BASES ACTIONS A.1, A.2, A.3, and A.4 (continued)
| |
| To allow continued operation with a withdrawn control rod stuck, an evaluation of adequate SDM is also required within 72 hours. Should a DBA or transient require a shutdown, to preserve the single failure criterion an additional control rod would have to be assumed to have failed to insert when required. Therefore, the original SDM demonstration may not be valid. The SDM must therefore be evaluated (by measurement or analysis) with the stuck control rod at its stuck position and the highest worth OPERABLE control rod assumed to be fully withdrawn.
| |
| The allowed Completion Time of 72 hours to verify SDM is adequate, considering that with a single control rod stuck in a withdrawn position, the remaining OPERABLE control rods are capable of providing the required scram and shutdown reactivity. Failure to reach MODE 4 is only likely if an additional control rod adjacent to the stuck control rod also fails to insert during a required scram. Even with the postulated additional single failure of an adjacent control rod to insert, sufficient reactivity control remains to reach MODE 3 conditions.
| |
| B.1 With two or more withdrawn control rods stuck, the plant must be brought to MODE 3 within 12 hours. The occurrence of more than one control rod stuck at a withdrawn position increases the probability that the reactor cannot be shut down if required. Insertion of all insertable control rods eliminates the possibility of an additional failure of a control rod to insert. The allowed Completion Time of 12 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.
| |
| C.1 and C.2 With one or more control rods inoperable for reasons other than being stuck in the withdrawn position, operation may continue, provided the control rods are fully inserted (continued)
| |
| LaSalle 1 B 3.1.3-5 Revision 0
| |
| | |
| UNIT 1 Control ntrol rol Rod OPERABILITY B 3.1.3 BASES ACTIONS C.1 and C.2 (continued) within 3 hours and disarmed (electrically or hydraulically) within 4 hours. Inserting a control rod ensures the shutdown and scram capabilities are not adversely affected.
| |
| The control rod is disarmed to prevent inadvertent withdrawal during subsequent operations. The control rods can be hydraulically disarmed by closing the drive water and exhaust water isolation valves. Electrically, the control rods can be disarmed by disconnecting power from all four directional control valve solenoids. Required Action C.1 is modified by a Note that allows the RWM to be bypassed if required to allow insertion of the inoperable control rods and continued operation. LCO 3.3.2.1 provides additional requirements when the RWM is bypassed to ensure compliance with the CRDA analysis.
| |
| The allowed Completion Times are reasonable, considering the small number of allowed inoperable control rods, and provide time to insert and disarm the control rods in an orderly manner and without challenging plant systems.
| |
| (continued)
| |
| LaSalle 1 B 3.1.3-6 Revision 91
| |
| | |
| UNIT 1 Control ntrol rol Rod OPERABILITY B 3.1.3 BASES ACTIONS D.1 (continued)
| |
| If any Required Action and associated Completion Time of Condition A or C are not met or nine or more inoperable control rods exist, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours. This ensures all insertable control rods are inserted and places the reactor in a condition that does not require the active function (i.e., scram) of the control rods. The number of control rods permitted to be inoperable when operating above 5% RTP or 300 psig reactor steam dome pressure (i.e., no CRDA considerations as described in the Bases for LCO 3.1.6) could be more than the value specified, but the occurrence of a large number of inoperable control rods could be indicative of a generic problem, and investigation and resolution of the potential problem should be undertaken.
| |
| The allowed Completion Time of 12 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.
| |
| SURVEILLANCE SR 3.1.3.1 REQUIREMENTS The position of each control rod must be determined, to ensure adequate information on control rod position is available to the operator for determining control rod OPERABILITY and controlling rod patterns. Control rod position may be determined by the use of OPERABLE position indicators, by moving control rods by single notch movement to a position with an OPERABLE indicator (full-in, full-out, or numeric indicator) and then returning the control rods by single notch movement to their original position, or by the use of other appropriate methods. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| (continued)
| |
| LaSalle 1 B 3.1.3-7 Revision 91
| |
| | |
| UNIT 1 Control ntrol rol Rod OPERABILITY B 3.1.3 BASES SURVEILLANCE SR 3.1.3.2 REQUIREMENTS (continued) DELETED SR 3.1.3.3 Control rod insertion capability is demonstrated by inserting each partially or fully withdrawn control rod at least one notch and observing that the control rod moves.
| |
| The control rod may then be returned to its original position. This ensures the control rod is not stuck and is free to insert on a scram signal. This Surveillances is not required when THERMAL POWER is less than or equal to the actual LPSP of the RWM since the notch insertions may not be compatible with the requirements of the analyzed rod position sequence (LCO 3.1.6) and the RWM (LCO 3.3.2.1). The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by a Note that allows 31 days, after withdrawal of the control rod and increasing power to above the LPSP, to perform the Surveillance. This acknowledges that the control rod must be first withdrawn and THERMAL POWER must be increased to above the LPSP before performance of the Surveillance, and therefore, the Note avoids potential conflicts with SR 3.0.3 and SR 3.0.4.
| |
| (continued)
| |
| LaSalle 1 B 3.1.3-8 Revision 51
| |
| | |
| UNIT 1 Control ntrol rol Rod OPERABILITY B 3.1.3 BASES SURVEILLANCE SR 3.1.3.4 REQUIREMENTS (continued) Verifying the scram time for each control rod to notch position 05 is d 7 seconds provides reasonable assurance that the control rod will insert when required during a DBA or transient, thereby completing its shutdown function.
| |
| This SR is performed in conjunction with the control rod scram time testing of SR 3.1.4.1, SR 3.1.4.2, SR 3.1.4.3, and SR 3.1.4.4. The LOGIC SYSTEM FUNCTIONAL TEST in LCO 3.3.1.1, "Reactor Protection System (RPS)
| |
| Instrumentation," and the functional testing of SDV vent and drain valves in LCO 3.1.8, "Scram Discharge Volume (SDV)
| |
| Vent and Drain Valves," overlap this Surveillance to provide complete testing of the assumed safety function. The associated Frequencies are acceptable, considering the more frequent testing performed to demonstrate other aspects of control rod OPERABILITY and operating experience, which shows scram times do not significantly change over an operating cycle.
| |
| SR 3.1.3.5 Coupling verification is performed to ensure the control rod is connected to the CRDM and will perform its intended function when necessary. The Surveillance requires verifying that a control rod does not go to the withdrawn overtravel position when it is fully withdrawn. The overtravel position feature provides a positive check on the coupling integrity, since only an uncoupled CRD can reach the overtravel position. The verification is required to be performed anytime a control rod is withdrawn to the "full out" position (notch position 48) or prior to declaring the control rod OPERABLE after work on the control rod or CRD System that could affect coupling. This includes control rods inserted one notch and then returned to the "full out" position during the performance of SR 3.1.3.2. This Frequency is acceptable, considering the low probability that a control rod will become uncoupled when it is not being moved and operating experience related to uncoupling events.
| |
| The performance of SR 3.1.3.5 is an assumption of Reference 8.
| |
| (continued)
| |
| LaSalle 1 B 3.1.3-9 Revision 91
| |
| | |
| UNIT 1 Control ntrol rol Rod OPERABILITY B 3.1.3 BASES (continued) ued) ed)
| |
| REFERENCES 1. 10 CFR 50, Appendix A, GDC 26, GDC 27, GDC 28, and GDC 29.
| |
| : 2. UFSAR, Section 4.3.2.5.
| |
| : 3. UFSAR, Section 4.6.1.1.2.
| |
| : 4. UFSAR, Section 5.2.2.2.
| |
| : 5. UFSAR, Section 15.4.
| |
| : 6. UFSAR, Section 15.4.9.
| |
| : 7. NFSR-0091, Commonwealth Edison Topical Report, Benchmark of CASMO/MICROBURN BWR Nuclear Design Methods, (as specified in Technical Specification 5.6.5).
| |
| : 8. NEDE 33885P-A, "GNF CRDA Application Methodology,"
| |
| Revision 1, March 2020.
| |
| LaSalle 1 B 3.1.3-10 Revision 91
| |
| | |
| 2 Control ontrol R Rod OPERABILITY B 3.1.3 B 3.1 REACTIVITY TY CONTROL SYSTEMS B 3.1.3 Control Rod OPERABILITY BASES BACKGROUND Control rods are components of the Control Rod Drive (CRD)
| |
| System, which is the primary reactivity control system for the reactor. In conjunction with the Reactor Protection System, the CRD System provides the means for the reliable control of reactivity changes to ensure that under conditions of normal operation, including anticipated operational occurrences, specified acceptable fuel design limits are not exceeded. In addition, the control rods provide the capability to hold the reactor core subcritical under all conditions and to limit the potential amount and rate of reactivity increase caused by a malfunction in the CRD System. The CRD System is designed to satisfy the requirements of GDC 26, GDC 27, GDC 28, and GDC 29, (Ref. 1).
| |
| The CRD System consists of 185 locking piston control rod drive mechanisms (CRDMs) and a hydraulic control unit for each drive mechanism. The locking piston type CRDM is a double acting hydraulic piston, which uses condensate water as the operating fluid. Accumulators provide additional energy for scram. An index tube and piston, coupled to the control rod, are locked at fixed increments by a collet mechanism. The collet fingers engage notches in the index tube to prevent unintentional withdrawal of the control rod, but without restricting insertion.
| |
| This Specification, along with LCO 3.1.4, "Control Rod Scram Times," LCO 3.1.5, "Control Rod Scram Accumulators," and LCO 3.1.6, "Rod Pattern Control," ensure that the performance of the control rods in the event of a Design Basis Accident (DBA) or transient meets the assumptions used in the safety analyses of References 2, 3, 4, 5, and 6.
| |
| APPLICABLE The analytical methods and assumptions used in the SAFETY ANALYSES evaluations involving control rods are presented in References 2, 3, 4, 5, and 6. The control rods provide the primary means for rapid reactivity control (reactor scram),
| |
| for maintaining the reactor subcritical, and for limiting the potential effects of reactivity insertion events caused by malfunctions in the CRD System.
| |
| (continued)
| |
| LaSalle 2 B 3.1.3-11 Revision 0
| |
| | |
| UNIT 2 Control ontrol R Rod OPERABILITY B 3.1.3 BASES APPLICABLE The capability of inserting the control rods provides SAFETY ANALYSES assurance that the assumptions for scram reactivity in the (continued) DBA and transient analyses are not violated. Since the SDM ensures the reactor will be subcritical with the highest worth control rod withdrawn (assumed single failure), the additional failure of a second control rod to insert could invalidate the demonstrated SDM and potentially limit the ability of the CRD System to hold the reactor subcritical.
| |
| If the control rod is stuck at an inserted position and becomes decoupled from the CRD, a control rod drop accident (CRDA) can possibly occur. Therefore, the requirement that all control rods be OPERABLE ensures the CRD System can perform its intended function.
| |
| The control rods also protect the fuel from damage that results in release of radioactivity. The limits protected are the MCPR Safety Limit (SL) (see Bases for SL 2.1.1, "Reactor Core SLs," and LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)"), the 1% cladding plastic strain fuel design limit (see Bases for LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLGHR)," and LCO 3.2.3, "LINEAR HEAT GENERATION RATE (LHGR)"), and the fuel design limit (see Bases for LCO 3.1.6, "Rod Pattern Control") during reactivity insertion events.
| |
| The negative reactivity insertion (scram) provided by the CRD System provides the analytical basis for determination of plant thermal limits and provides protection against fuel design limits during a CRDA. Bases for LCO 3.1.4, LCO 3.1.5, and LCO 3.1.6 discuss in more detail how the SLs are protected by the CRD System.
| |
| Control rod OPERABILITY satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO OPERABILITY of an individual control rod is based on a combination of factors, primarily the scram insertion times, the control rod coupling integrity, and the ability to determine the control rod position. Accumulator OPERABILITY is addressed by LCO 3.1.5. The associated scram accumulator status for a control rod only affects the scram insertion times and therefore an inoperable accumulator does not (continued)
| |
| LaSalle 2 B 3.1.3-12 Revision 0
| |
| | |
| UNIT 2 Control ontrol RRod OPERABILITY B 3.1.3 BASES LCO immediately require declaring a control rod inoperable.
| |
| (continued) Although not all control rods are required to be OPERABLE to satisfy the intended reactivity control requirements, strict control over the number and distribution of inoperable control rods is required to satisfy the assumptions of the DBA and transient analyses.
| |
| OPERABILITY requirements for control rods also includes correct assembly of the CRD housing supports.
| |
| APPLICABILITY In MODES 1 and 2, the control rods are assumed to function during a DBA or transient and are therefore required to be OPERABLE in these MODES. In MODES 3 and 4, control rods are not able to be withdrawn since the reactor mode switch is in shutdown and a control rod block is applied. This provides adequate requirements for control rod OPERABILITY during these conditions. Control rod requirements in MODE 5 are located in LCO 3.9.5, "Control Rod OPERABILITYRefueling."
| |
| ACTIONS The ACTIONS Table is modified by a Note indicating that a separate Condition entry is allowed for each control rod.
| |
| This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable control rod. Complying with the Required Actions may allow for continued operation, and subsequent inoperable control rods are governed by subsequent Condition entry and application of associated Required Actions.
| |
| A.1, A.2, A.3, and A.4 A control rod is considered stuck if it will not insert by either CRD drive water or scram pressure. The Required Actions are modified by a Note that allows the Rod Worth Minimizer (RWM) to be bypassed if required to allow continued operation. LCO 3.3.2.1, "Control Rod Block Instrumentation," provides additional requirements when the RWM is bypassed to ensure compliance with the CRDA analysis.
| |
| With one withdrawn control rod stuck, the local scram reactivity rate assumptions may not be met if the stuck (continued)
| |
| LaSalle 2 B 3.1.3-13 Revision 0
| |
| | |
| UNIT 2 Control ontrol R Rod OPERABILITY B 3.1.3 BASES ACTIONS A.1, A.2, A.3, and A.4 (continued) control rod separation criteria are not met. Therefore, a verification that the separation criteria are met must be performed immediately. The separation criteria are not met if: a) the stuck control rod occupies a location adjacent to two "slow" control rods, b) the stuck control rod occupies a location adjacent to one "slow" control rod, and the one "slow" control rod is also adjacent to another "slow" control rod, or c) if the stuck control rod occupies a location adjacent to one "slow" control rod when there is another pair of "slow" control rods elsewhere in the core adjacent to one another. The description of "slow" control rods is provided in LCO 3.1.4, "Control Rod Scram Times."
| |
| In addition, the associated control rod drive must be disarmed within 2 hours. The allowed Completion Time of 2 hours is acceptable, considering the reactor can still be shut down, assuming no additional control rods fail to insert, and provides a reasonable amount of time to perform the Required Action in an orderly manner. The control rod must be isolated from both scram and normal insert and withdraw pressure. Isolating the control rod from scram and normal insert and withdraw pressure prevents damage to the CRDM or reactor internals. The control rod isolation method should also ensure cooling water to the CRD is maintained.
| |
| Monitoring of the insertion capability for each withdrawn control rod must also be performed within 24 hours from discovery of Condition A concurrent with THERMAL POWER greater than the low power setpoint (LPSP) of the RWM.
| |
| SR 3.1.3.3 performs periodic tests of the control rod insertion capability of withdrawn control rods. Testing each withdrawn control rod ensures that a generic problem does not exist. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." The Required Action A.3 Completion Time only begins upon discovery of Condition A concurrent with THERMAL POWER greater than the actual LPSP of the RWM, since the notch insertions may not be compatible with the requirements of rod pattern control (LCO 3.1.6) and the RWM (LCO 3.3.2.1). The allowed Completion Time provides a reasonable time to test the control rods, considering the potential for a need to reduce power to perform the tests.
| |
| (continued)
| |
| LaSalle 2 B 3.1.3-14 Revision 42
| |
| | |
| UNIT 2 Control ontrol R Rod OPERABILITY B 3.1.3 BASES ACTIONS A.1, A.2, A.3, and A.4 (continued)
| |
| To allow continued operation with a withdrawn control rod stuck, an evaluation of adequate SDM is also required within 72 hours. Should a DBA or transient require a shutdown, to preserve the single failure criterion an additional control rod would have to be assumed to have failed to insert when required. Therefore, the original SDM demonstration may not be valid. The SDM must therefore be evaluated (by measurement or analysis) with the stuck control rod at its stuck position and the highest worth OPERABLE control rod assumed to be fully withdrawn.
| |
| The allowed Completion Time of 72 hours to verify SDM is adequate, considering that with a single control rod stuck in a withdrawn position, the remaining OPERABLE control rods are capable of providing the required scram and shutdown reactivity. Failure to reach MODE 4 is only likely if an additional control rod adjacent to the stuck control rod also fails to insert during a required scram. Even with the postulated additional single failure of an adjacent control rod to insert, sufficient reactivity control remains to reach MODE 3 conditions.
| |
| B.1 With two or more withdrawn control rods stuck, the plant must be brought to MODE 3 within 12 hours. The occurrence of more than one control rod stuck at a withdrawn position increases the probability that the reactor cannot be shut down if required. Insertion of all insertable control rods eliminates the possibility of an additional failure of a control rod to insert. The allowed Completion Time of 12 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.
| |
| C.1 and C.2 With one or more control rods inoperable for reasons other than being stuck in the withdrawn position, operation may continue, provided the control rods are fully inserted (continued)
| |
| LaSalle 2 B 3.1.3-15 Revision 0
| |
| | |
| UNIT 2 Control ontrol RRod OPERABILITY B 3.1.3 BASES ACTIONS C.1 and C.2 (continued) within 3 hours and disarmed (electrically or hydraulically) within 4 hours. Inserting a control rod ensures the shutdown and scram capabilities are not adversely affected.
| |
| The control rod is disarmed to prevent inadvertent withdrawal during subsequent operations. The control rods can be hydraulically disarmed by closing the drive water and exhaust water isolation valves. Electrically, the control rods can be disarmed by disconnecting power from all four directional control valve solenoids. Required Action C.1 is modified by a Note that allows the RWM to be bypassed if required to allow insertion of the inoperable control rods and continued operation. LCO 3.3.2.1 provides additional requirements when the RWM is bypassed to ensure compliance with the CRDA analysis.
| |
| The allowed Completion Times are reasonable, considering the small number of allowed inoperable control rods, and provide time to insert and disarm the control rods in an orderly manner and without challenging plant systems.
| |
| D.1 and D.2 Out of sequence control rods may increase the potential reactivity worth of a dropped control rod during a CRDA. At d 10% RTP, the analyzed rod position sequence analysis (Refs. 7 and 8) requires inserted control rods not in compliance with the analyzed rod position sequence to be separated by at least two OPERABLE control rods in all directions, including the diagonal (i.e., all other control rods in a five-by-five array centered on the inoperable control rod are OPERABLE). Therefore, if two or more inoperable control rods are not in compliance with the analyzed rod position sequence and not separated by at least two OPERABLE control rods in all directions, action must be taken to restore compliance with the analyzed rod position sequence or restore the control rods to OPERABLE status. A Note has been added to the Condition to clarify that the Condition is not applicable when ! 10% RTP since the analyzed rod position sequence is not required to be followed under these conditions, as described in the Bases for LCO 3.1.6. The allowed Completion Time of 4 hours is acceptable, considering the low probability of a CRDA occurring.
| |
| (continued)
| |
| LaSalle 2 B 3.1.3-16 Revision 0
| |
| | |
| UNIT 2 Control ontrol R Rod OPERABILITY B 3.1.3 BASES ACTIONS E.1 (continued)
| |
| If any Required Action and associated Completion Time of Condition A, C, or D are not met or nine or more inoperable control rods exist, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours. This ensures all insertable control rods are inserted and places the reactor in a condition that does not require the active function (i.e., scram) of the control rods. The number of control rods permitted to be inoperable when operating above 10% RTP (i.e., no CRDA considerations) could be more than the value specified, but the occurrence of a large number of inoperable control rods could be indicative of a generic problem, and investigation and resolution of the potential problem should be undertaken. The allowed Completion Time of 12 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.
| |
| SURVEILLANCE SR 3.1.3.1 REQUIREMENTS The position of each control rod must be determined, to ensure adequate information on control rod position is available to the operator for determining control rod OPERABILITY and controlling rod patterns. Control rod position may be determined by the use of OPERABLE position indicators, by moving control rods by single notch movement to a position with an OPERABLE indicator (full-in, full-out, or numeric indicator) and then returning the control rods by single notch movement to their original position, or by the use of other appropriate methods. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| (continued)
| |
| LaSalle 2 B 3.1.3-17 Revision 51
| |
| | |
| UNIT 2 Control ontrol R Rod OPERABILITY B 3.1.3 BASES SURVEILLANCE SR 3.1.3.2 REQUIREMENTS (continued) DELETED SR 3.1.3.3 Control rod insertion capability is demonstrated by inserting each partially or fully withdrawn control rod at least one notch and observing that the control rod moves.
| |
| The control rod may then be returned to its original position. This ensures the control rod is not stuck and is free to insert on a scram signal. This Surveillances is not required when THERMAL POWER is less than or equal to the actual LPSP of the RWM since the notch insertions may not be compatible with the requirements of the analyzed rod position sequence (LCO 3.1.6) and the RWM (LCO 3.3.2.1). The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by a Note that allows 31 days, after withdrawal of the control rod and increasing power to above the LPSP, to perform the Surveillance. This acknowledges that the control rod must be first withdrawn and THERMAL POWER must be increased to above the LPSP before performance of the Surveillance, and therefore, the Note avoids potential conflicts with SR 3.0.3 and SR 3.0.4.
| |
| (continued)
| |
| LaSalle 2 B 3.1.3-18 Revision 51
| |
| | |
| UNIT 2 Control ontrol RRod OPERABILITY B 3.1.3 BASES SURVEILLANCE SR 3.1.3.4 REQUIREMENTS (continued) Verifying the scram time for each control rod to notch position 05 is d 7 seconds provides reasonable assurance that the control rod will insert when required during a DBA or transient, thereby completing its shutdown function.
| |
| This SR is performed in conjunction with the control rod scram time testing of SR 3.1.4.1, SR 3.1.4.2, SR 3.1.4.3, and SR 3.1.4.4. The LOGIC SYSTEM FUNCTIONAL TEST in LCO 3.3.1.1, "Reactor Protection System (RPS)
| |
| Instrumentation," and the functional testing of SDV vent and drain valves in LCO 3.1.8, "Scram Discharge Volume (SDV)
| |
| Vent and Drain Valves," overlap this Surveillance to provide complete testing of the assumed safety function. The associated Frequencies are acceptable, considering the more frequent testing performed to demonstrate other aspects of control rod OPERABILITY and operating experience, which shows scram times do not significantly change over an operating cycle.
| |
| SR 3.1.3.5 Coupling verification is performed to ensure the control rod is connected to the CRDM and will perform its intended function when necessary. The Surveillance requires verifying that a control rod does not go to the withdrawn overtravel position when it is fully withdrawn. The overtravel position feature provides a positive check on the coupling integrity, since only an uncoupled CRD can reach the overtravel position. The verification is required to be performed anytime a control rod is withdrawn to the "full out" position (notch position 48) or prior to declaring the control rod OPERABLE after work on the control rod or CRD System that could affect coupling. This includes control rods inserted one notch and then returned to the "full out" position during the performance of SR 3.1.3.2. This Frequency is acceptable, considering the low probability that a control rod will become uncoupled when it is not being moved and operating experience related to uncoupling events.
| |
| (continued)
| |
| LaSalle 2 B 3.1.3-19 Revision 0
| |
| | |
| UNIT 2 Control ontrol R Rod OPERABILITY B 3.1.3 BASES (continued) ued) ed)
| |
| REFERENCES 1. 10 CFR 50, Appendix A, GDC 26, GDC 27, GDC 28, and GDC 29.
| |
| : 2. UFSAR, Section 4.3.2.5.
| |
| : 3. UFSAR, Section 4.6.1.1.2.
| |
| : 4. UFSAR, Section 5.2.2.2.
| |
| : 5. UFSAR, Section 15.4.
| |
| : 6. UFSAR, Section 15.4.9.
| |
| : 7. NEDO-21231, "Banked Position Withdrawal Sequence,"
| |
| Section 7.2, January 1977.
| |
| : 8. NFSR-0091, Commonwealth Edison Topical Report, Benchmark of CASMO/MICROBURN BWR Nuclear Design Methods, (as specified in Technical Specification 5.6.5).
| |
| LaSalle 2 B 3.1.3-20 Revision 0
| |
| | |
| Control Rod Scram Times B 3.1.4 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.4 Control Rod Scram Times BASES BACKGROUND The scram function of the Control Rod Drive (CRD) System controls reactivity changes during anticipated operational occurrences to ensure that specified acceptable fuel design limits are not exceeded (Ref. 1). The control rods are scrammed by positive means, using hydraulic pressure exerted on the CRD piston.
| |
| When a scram signal is initiated, control air is vented from the scram valves, allowing them to open by spring action.
| |
| Opening the exhaust valves reduces the pressure above the main drive piston to atmospheric pressure, and opening the inlet valve applies the accumulator or reactor pressure to the bottom of the piston. Since the notches in the index tube are tapered on the lower edge, the collet fingers are forced open by cam action, allowing the index tube to move upward without restriction because of the high differential pressure across the piston. As the drive moves upward and accumulator pressure drops below the reactor pressure, a ball check valve opens, letting the reactor pressure complete the scram action. If the reactor pressure is low, such as during startup, the accumulator will fully insert the control rod within the required time without assistance from reactor pressure.
| |
| APPLICABLE The analytical methods and assumptions used in evaluating SAFETY ANALYSES the control rod scram function are presented in References 2, 3, 4, 5, and 6. The Design Basis Accident (DBA) and transient analyses assume that all of the control rods scram at a specified insertion rate. The resulting negative scram reactivity forms the basis for the determination of plant thermal limits (e.g., the MCPR). Other distributions of scram times (e.g., several control rods scramming slower than the average time, with several control rods scramming faster than the average time) can also provide sufficient scram reactivity. Surveillance of each individual control rod's scram time ensures the scram reactivity assumed in the DBA and transient analyses can be met.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.1.4-1 Revision 0
| |
| | |
| Control Rod Scram Times B 3.1.4 BASES APPLICABLE The scram function of the CRD System protects the MCPR SAFETY ANALYSES Safety Limit (SL) (see Bases for SL 2.1.1, "Reactor Core (continued) SLs," and LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)"),
| |
| and the 1% cladding plastic strain fuel design limit (see Bases for LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)," and LCO 3.2.3, "LINEAR HEAT GENERATION RATE (LHGR)"), which ensure that no fuel damage will occur if these limits are not exceeded. Above 800 psig, the scram function is designed to insert negative reactivity at a rate fast enough to prevent the actual MCPR from becoming less than the MCPR SL during the analyzed limiting power transient. Below 800 psig, the scram function is assumed to perform during the control rod drop accident (Ref. 6) and, therefore, also provides protection against violating fuel design limits during reactivity insertion accidents (see Bases for LCO 3.1.6, "Rod Pattern Control"). For the reactor vessel overpressure protection analysis (Ref. 4),
| |
| the scram function, along with the safety/relief valves, ensure that the peak vessel pressure is maintained within the applicable ASME Code limits.
| |
| Control rod scram times satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The scram times specified in Table 3.1.4-1 are required to ensure that the scram reactivity assumed in the DBA and transient analysis is met. To account for single failure and "slow" scramming control rods, the scram times specified in Table 3.1.4-1 are faster than those assumed in the design basis analysis. The scram times have a margin to allow up to 7.0% of the control rods (e.g., 185 x 7.0% ! 12) to have scram times that exceed the specified limits (i.e., "slow" control rods) assuming a single stuck control rod (as allowed by LCO 3.1.3, "Control Rod OPERABILITY") and an additional control rod failing to scram per the single failure criterion. The scram times are specified as a function of reactor steam dome pressure to account for the pressure dependence of the scram times. The scram times are specified relative to measurements based on reed switch positions, which provide the control rod position indication. The reed switch closes ("pickup") when the index tube passes a specific location and then opens
| |
| ("dropout") as the index tube travels upward. Verification of the specified scram times in Table 3.1.4-1 is accomplished through measurement of the "dropout" times.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.1.4-2 Revision 0
| |
| | |
| Control Rod Scram Times B 3.1.4 BASES LCO To ensure that local scram reactivity rates are maintained (continued) within acceptable limits, no more than two of the allowed "slow" control rods may occupy adjacent (face or diagonal) locations.
| |
| Table 3.1.4-1 is modified by two Notes, which state control rods with scram times not within the limits of the Table are considered "slow" and that control rods with scram times 7 seconds are considered inoperable as required by SR 3.1.3.4.
| |
| This LCO applies only to OPERABLE control rods since inoperable control rods will be inserted and disarmed (LCO 3.1.3). Slow scramming control rods may be conservatively declared inoperable and not accounted for as "slow" control rods.
| |
| APPLICABILITY In MODES 1 and 2, a scram is assumed to function during transients and accidents analyzed for these plant conditions. These events are assumed to occur during startup and power operation; therefore, the scram function of the control rods is required during these MODES. In MODES 3 and 4, the control rods are not able to be withdrawn since the reactor mode switch is in shutdown and a control rod block is applied. This provides adequate requirements for control rod scram capability during these conditions.
| |
| Scram requirements in MODE 5 are contained in LCO 3.9.5, "Control Rod OPERABILITYRefueling."
| |
| ACTIONS A.1 When the requirements of this LCO are not met, the rate of negative reactivity insertion during a scram may not be within the assumptions of the safety analyses. Therefore, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours. The allowed Completion Time of 12 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.1.4-3 Revision 0
| |
| | |
| Control Rod Scram Times B 3.1.4 BASES (continued)
| |
| SURVEILLANCE The four SRs of this LCO are modified by a Note stating that REQUIREMENTS during a single control rod scram time surveillance, the CRD pumps shall be isolated from the associated scram accumulator. With the CRD pump isolated (i.e., charging valve closed), the influence of the CRD pump head does not affect the single control rod scram times. During a full core scram, the CRD pump head would be seen by all control rods and would have a negligible effect on the scram insertion times.
| |
| SR 3.1.4.1 The scram reactivity used in DBA and transient analyses is based on assumed control rod scram time. Measurement of the scram times with reactor steam dome pressure # 800 psig demonstrates acceptable scram times for the transients analyzed in References 5 and 6.
| |
| Maximum scram insertion times occur at a reactor pressure of approximately 800 psig because of the competing effects of reactor steam dome pressure and stored accumulator energy.
| |
| Therefore, demonstration of adequate scram times at reactor steam dome pressure # 800 psig ensures that the scram times will be within the specified limits at higher pressures.
| |
| Limits are specified as a function of reactor pressure to account for the sensitivity of the scram insertion times with pressure and to allow a range of pressures over which scram time testing can be performed. To ensure scram time testing is performed within a reasonable time following a shutdown # 120 days, control rods are required to be tested before exceeding 40% RTP. This Frequency is acceptable, considering the additional Surveillances performed for control rod OPERABILITY, the frequent verification of adequate accumulator pressure, and the required testing of control rods affected by fuel movement within the associated core cell and by work on control rods or the CRD System.
| |
| SR 3.1.4.2 Additional testing of a sample of control rods is required to verify the continued performance of the scram function during the cycle. A representative sample contains at least (continued)
| |
| LaSalle 1 and 2 B 3.1.4-4 Revision 0
| |
| | |
| Control Rod Scram Times B 3.1.4 BASES SURVEILLANCE SR 3.1.4.2 (continued)
| |
| REQUIREMENTS 10% of the control rods. The sample remains representative if no more than 7.5% of the control rods in the sample tested are determined to be "slow." If more than 7.5% of the sample is declared to be "slow" per the criteria in Table 3.1.4-1, additional control rods are tested until this 7.5% criterion (i.e., 7.5% of the entire sample size) is satisfied, or until the total number of "slow" control rods (throughout the core, from all Surveillances) exceeds the LCO limit. For planned testing, the control rods selected for the sample should be different for each test. Data from inadvertent scrams should be used whenever possible to avoid unnecessary testing at power, even if the control rods with data were previously tested in a sample. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.1.4.3 When work that could affect the scram insertion time is performed on a control rod or the CRD System, testing must be done to demonstrate that each affected control rod retains adequate scram performance over the range of applicable reactor pressures from zero to the maximum permissible pressure. The scram testing must be performed once before declaring the control rod OPERABLE. The required scram time testing must demonstrate that the affected control rod is still within acceptable limits. The scram time limits for reactor pressures 800 psig are found in the Technical Requirements Manual (Ref. 7) and are established based on a high probability of meeting the acceptance criteria at reactor pressures # 800 psig. Limits for reactor pressures # 800 psig are found in Table 3.1.4-1.
| |
| If testing demonstrates the affected control rod does not meet these limits, but is within 7-second limit of Table 3.1.4-1, Note 2, the control rod can be declared OPERABLE and "slow."
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.1.4-5 Revision 78
| |
| | |
| Control Rod Scram Times B 3.1.4 BASES SURVEILLANCE SR 3.1.4.3 (continued)
| |
| REQUIREMENTS Specific examples of work that could affect the scram times include (but are not limited to) the following: removal of any CRD for maintenance or modification; replacement of a control rod; and maintenance or modification of a scram solenoid pilot valve, scram valve, accumulator isolation valve, or check valves in the piping required for scram.
| |
| The Frequency of once prior to declaring the affected control rod OPERABLE is acceptable because of the capability of testing the control rod over a range of operating conditions and the more frequent surveillances on other aspects of control rod OPERABILITY.
| |
| SR 3.1.4.4 When work that could affect the scram insertion time is performed on a control rod or CRD System, or when fuel movement within the reactor pressure vessel occurs, testing must be done to demonstrate each affected control rod is still within the limits of Table 3.1.4-1 with the reactor steam dome pressure # 800 psig. Where work has been performed at high reactor pressure, the requirements of SR 3.1.4.3 and SR 3.1.4.4 will be satisfied with one test.
| |
| For a control rod affected by work performed while shut down, however, a zero pressure and a high pressure test may be required. This testing ensures that the control rod scram performance is acceptable for operating reactor pressure conditions prior to withdrawing the control rod for continued operation. Alternatively, a test during hydrostatic pressure testing could also satisfy both criteria. When fuel movement within the reactor pressure vessel occurs, only those control rods associated with the core cells affected by the fuel movement are required to be scram time tested. During a routine refueling outage, it is expected that all control rods will be affected.
| |
| The Frequency of once prior to exceeding 40% RTP is acceptable because of the capability of testing the control rod at the different conditions and the more frequent surveillances on other aspects of control rod OPERABILITY.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.1.4-6 Revision 0
| |
| | |
| Control Rod Scram Times B 3.1.4 BASES (continued)
| |
| REFERENCES 1. 10 CFR 50, Appendix A, GDC 10.
| |
| : 2. UFSAR, Section 4.3.2.5.
| |
| : 3. UFSAR, Section 4.6.1.1.2.
| |
| : 4. UFSAR, Section 5.2.2.
| |
| : 5. UFSAR, Section 15.4.
| |
| : 6. UFSAR, Section 15.4.9.
| |
| : 7. Technical Requirements Manual.
| |
| LaSalle 1 and 2 B 3.1.4-7 Revision 0
| |
| | |
| Control Rod Scram Accumulators B 3.1.5 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.5 Control Rod Scram Accumulators BASES BACKGROUND The control rod scram accumulators are part of the Control Rod Drive (CRD) System and are provided to ensure that the control rods scram under varying reactor conditions. The control rod scram accumulators store sufficient energy to fully insert a control rod at any reactor vessel pressure.
| |
| The accumulator is a hydraulic cylinder with a free floating piston. The piston separates the water used to scram the control rods from the nitrogen, which provides the required energy. The scram accumulators are necessary to scram the control rods within the required insertion times of LCO 3.1.4, "Control Rod Scram Times."
| |
| APPLICABLE The analytical methods and assumptions used in evaluating SAFETY ANALYSES the control rod scram function are presented in References 1, 2, 3, and 4. The Design Basis Accident (DBA) and transient analyses assume that all of the control rods scram at a specified insertion rate. OPERABILITY of each individual control rod scram accumulator, along with LCO 3.1.3, "Control Rod OPERABILITY," and LCO 3.1.4, ensures that the scram reactivity assumed in the DBA and transient analyses can be met. The existence of an inoperable accumulator may invalidate prior scram time measurements for the associated control rod.
| |
| The scram function of the CRD System, and, therefore, the OPERABILITY of the accumulators, protects the MCPR Safety Limit (see Bases for SL 2.1.1, "Reactor Core SLs," and LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)") and the 1%
| |
| cladding plastic strain fuel design limit (see Bases for LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)," and LCO 3.2.3, "LINEAR HEAT GENERATION RATE (LHGR)"), which ensure that no fuel damage will occur if these limits are not exceeded (see Bases for LCO 3.1.4).
| |
| Also, the scram function at low reactor vessel pressure (i.e., startup conditions) provides protection against violating fuel design limits during reactivity insertion accidents (see Bases for LCO 3.1.6, "Rod Pattern Control").
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.1.5-1 Revision 0
| |
| | |
| Control Rod Scram Accumulators B 3.1.5 BASES APPLICABLE Control rod scram accumulators satisfy Criterion 3 of SAFETY ANALYSES 10 CFR 50.36(c)(2)(ii).
| |
| (continued)
| |
| LCO The OPERABILITY of the control rod scram accumulators is required to ensure that adequate scram insertion capability exists when needed over the entire range of reactor pressures. The OPERABILITY of the scram accumulators is based on maintaining adequate accumulator pressure.
| |
| APPLICABILITY In MODES 1 and 2, the scram function is required for mitigation of DBAs and transients and, therefore, the scram accumulators must be OPERABLE to support the scram function.
| |
| In MODES 3 and 4, control rods are not able to be withdrawn since the reactor mode switch is in shutdown and a control rod block is applied. This provides adequate requirements for control rod scram accumulator OPERABILITY under these conditions. Requirements for scram accumulators in MODE 5 are contained in LCO 3.9.5, "Control Rod OPERABILITY Refueling."
| |
| ACTIONS The ACTIONS Table is modified by a Note indicating that a separate Condition entry is allowed for each control rod scram accumulator. This is acceptable since the Required Actions for each Condition provide appropriate compensatory action for each inoperable accumulator. Complying with the Required Actions may allow for continued operation and subsequent inoperable accumulators governed by subsequent Condition entry and application of associated Required Actions.
| |
| A.1 and A.2 With one control rod scram accumulator inoperable and the reactor steam dome pressure 900 psig, the control rod may be declared "slow," since the control rod will still scram at the reactor operating pressure but may not satisfy the required scram times in Table 3.1.4-1. Required Action A.1 is modified by a Note, which clarifies that declaring the control rod "slow" is only applicable if the associated (continued)
| |
| LaSalle 1 and 2 B 3.1.5-2 Revision 0
| |
| | |
| Control Rod Scram Accumulators B 3.1.5 BASES ACTIONS A.1 and A.2 (continued) control rod scram time was within the limits of Table 3.1.4-1 during the last scram time Surveillance.
| |
| Otherwise, the control rod may already be considered "slow" and the further degradation of scram performance with an inoperable accumulator could result in excessive scram times. In this event, the associated control rod is declared inoperable (Required Action A.2) and LCO 3.1.3 entered. This would result in requiring the affected control rod to be fully inserted and disarmed, thereby satisfying its intended function in accordance with ACTIONS of LCO 3.1.3.
| |
| The allowed Completion Time of 8 hours is considered reasonable, based on the large number of control rods available to provide the scram function and the ability of the affected control rod to scram only with reactor pressure at high reactor pressures.
| |
| B.1, B.2.1, and B.2.2 With two or more control rod scram accumulators inoperable and reactor steam dome pressure 900 psig, adequate pressure must be supplied to the charging water header.
| |
| With inadequate charging water pressure, all of the accumulators could become inoperable, resulting in a potentially severe degradation of the scram performance.
| |
| Therefore, within 20 minutes from discovery of charging water header pressure < 940 psig concurrent with Condition B, adequate charging water header pressure must be restored. The allowed Completion Time of 20 minutes is considered a reasonable time to place a CRD pump into service to restore the charging header pressure, if required. This Completion Time also recognizes the ability of the reactor pressure alone to fully insert all control rods.
| |
| The control rod may be declared "slow," since the control rod will still scram using only reactor pressure, but may not satisfy the times in Table 3.1.4-1. Required Action B.2.1 is modified by a Note indicating that declaring the control rod "slow" is only applicable if the associated (continued)
| |
| LaSalle 1 and 2 B 3.1.5-3 Revision 0
| |
| | |
| Control Rod Scram Accumulators B 3.1.5 BASES ACTIONS B.1, B.2.1, and B.2.2 (continued) control rod scram time was within the limits of Table 3.1.4-1 during the last scram time Surveillance.
| |
| Otherwise, the control rod may already be considered "slow" and the further degradation of scram performance with an inoperable accumulator could result in excessive scram times. In this event, the associated control rod is declared inoperable (Required Action B.2.2) and LCO 3.1.3 entered. This would result in requiring the affected control rod to be fully inserted and disarmed, thereby satisfying its intended function in accordance with ACTIONS of LCO 3.1.3.
| |
| The allowed Completion Time of 1 hour is considered reasonable, based on the ability of only the reactor pressure to scram the control rods and the low probability of a DBA or transient occurring while the affected accumulators are inoperable.
| |
| C.1 and C.2 With one or more control rod scram accumulators inoperable and the reactor steam dome pressure < 900 psig, the pressure supplied to the charging water header must be adequate to ensure that accumulators remain charged. With the reactor steam dome pressure < 900 psig, the function of the accumulators in providing the scram force becomes much more important since the scram function could become severely degraded during a depressurization event or at low reactor pressures. Therefore, immediately upon discovery of charging water header pressure < 940 psig, concurrent with Condition C, all control rods associated with inoperable accumulators must be verified to be fully inserted.
| |
| Withdrawn control rods with inoperable scram accumulators may fail to scram under these low pressure conditions. The associated control rods must also be declared inoperable within 1 hour. The allowed Completion Time of 1 hour is reasonable for Required Action C.2, considering the low probability of a DBA or transient occurring during the time the accumulator is inoperable.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.1.5-4 Revision 0
| |
| | |
| Control Rod Scram Accumulators B 3.1.5 BASES ACTIONS D.1 (continued)
| |
| The reactor mode switch must be immediately placed in the shutdown position if either Required Action and associated Completion Time associated with loss of the CRD pump (Required Actions B.1 and C.1) cannot be met. This ensures that all insertable control rods are inserted and that the reactor is in a condition that does not require the active function (i.e., scram) of the control rods. This Required Action is modified by a Note stating that the Required Action is not applicable if all control rods associated with the inoperable scram accumulators are fully inserted, since the function of the control rods has been performed.
| |
| SURVEILLANCE SR 3.1.5.1 REQUIREMENTS SR 3.1.5.1 requires that the accumulator pressure be checked periodically to ensure adequate accumulator pressure exists to provide sufficient scram force. The primary indicator of accumulator OPERABILITY is the accumulator pressure. A minimum accumulator pressure is specified, below which the capability of the accumulator to perform its intended function becomes degraded and the accumulator is considered inoperable. The minimum accumulator pressure of 940 psig is well below the expected pressure of 980 psig to 1200 psig.
| |
| Declaring the accumulator inoperable when the minimum pressure is not maintained ensures that significant degradation in scram times does not occur. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 4.3.2.5.3.
| |
| : 2. UFSAR, Section 4.6.1.1.2.
| |
| : 3. UFSAR, Section 5.2.2.2.2.3.
| |
| : 4. UFSAR, Section 15.4.
| |
| LaSalle 1 and 2 B 3.1.5-5 Revision 51
| |
| | |
| 1 Rod Pattern Control B 3.1.6 B 3.1 REACTIVITY TY CONTROL SYSTEMS B 3.1.6 Rod Pattern Control BASES BACKGROUND Control rod patterns during startup conditions are controlled by the operator and the Rod Worth Minimizer (RWM)
| |
| (LCO 3.3.2.1, "Control Rod Block Instrumentation"), so that only specified control rod sequences and relative positions are allowed over the operating range of all control rods inserted to 5% RTP or 300 psig reactor steam dome pressure.
| |
| The sequences effectively limit the potential amount of reactivity addition that could occur in the event of a control rod drop accident (CRDA).
| |
| This Specification assures that the control rod patterns are consistent with the assumptions of the CRDA analyses of References 1, 2, and 3.
| |
| APPLICABLE The analytical methods and assumptions used in evaluating SAFETY ANALYSES the CRDA are summarized in References 1, 2, 3, 4, and 5.
| |
| CRDA analyses assume that the reactor operator follows prescribed withdrawal sequences. These sequences define the potential initial conditions for the CRDA analysis. The RWM (LCO 3.3.2.1) provides backup to operator control of the withdrawal sequences to ensure that the initial conditions of the CRDA analysis are not violated.
| |
| Prevention or mitigation of positive reactivity insertion events is necessary to limit the energy deposition in the fuel, thereby preventing significant fuel damage, which could result in undue release of radioactivity. Control rod patterns analyzed in the cycle specific analyses are developed in accordance with Reference 12. The Technical Specifications refer to these patterns as the "analyzed rod position sequence(s)." Per Ref. 12, use of the analyzed rod position sequence ensures ASME Code limits (Ref. 10) and the calculated offsite doses will be well within the required limits (Ref. 11).
| |
| When performing a shutdown of the plant, an optional rod position sequence (Ref. 12) may be used provided that all withdrawn control rods have been confirmed to be coupled.
| |
| (continued)
| |
| LaSalle 1 B 3.1.6-1 Revision 91
| |
| | |
| UNIT 1 Rod Pattern Control B 3.1.6 BASES APPLICABLE The rods may be inserted without the need to stop at SAFETY ANALYSES intermediate positions since the possibility of a CRDA is (continued) eliminated by the confirmation that withdrawn control rods are coupled. When using the optional (Ref. 12) control rod sequence for shutdown, the rod worth minimizer may be reprogrammed to enforce the requirements of the improved control rod insertion process.
| |
| In order to use the Reference 12 shutdown process, an extra check is required in order to consider a control rod to be confirmed to be coupled. This extra check ensures that no single operator error can result in an incorrect coupling check. For purposes of this shutdown process, the method for confirming that control rods are coupled varies depending on the position of the control rod in the core.
| |
| Details on this coupling confirmation requirement are provided in Reference 12.
| |
| The plant is in compliance with the rod position sequence required by this LCO when the requirements of Reference 12 are met.
| |
| Rod pattern control satisfies the requirements of Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| (continued)
| |
| LaSalle 1 B 3.1.6-2 Revision 91
| |
| | |
| UNIT 1 Rod Pattern Control B 3.1.6 BASES LCO Compliance with the prescribed control rod sequences minimizes the potential consequences of a CRDA by limiting the initial conditions to those consistent with the analyzed rod position sequence. This LCO applies to all control rods.
| |
| APPLICABILITY In MODE 2, when THERMAL POWER is d 5% RTP and reactor steam dome pressure is d 300 psig, the CRDA is a Design Basis Accident (DBA) and, therefore, compliance with the assumptions of the safety analysis is required. When THERMAL POWER is ! 5% RTP or reactor steam dome pressure is
| |
| ! 300psig, there is no credible control rod configuration that results in a control rod worth that could exceed the fuel cladding failure criteria during a CRDA (Ref. 4 and 5).
| |
| In MODES 3 and 4, the reactor is shutdown and the control rods are not able to be withdrawn since the reactor mode switch is in shutdown and a control rod block is applied, therefore a CRDA is not postulated to occur. In MODE 5, since the reactor is shut down and only a single control rod can be withdrawn from a core cell containing fuel assemblies, adequate SDM ensures that the consequences of a CRDA are acceptable, since the reactor will remain subcritical with a single control rod withdrawn. Before entering MODE 1, the reactor has completed heat up and pressurization. Reactor steam dome pressure is therefore above 300 psig, and so constraints on the control rod pattern due to CRDA are not required in MODE 1.
| |
| ACTIONS A.1 and A.2 With one or more control rods not in compliance with the prescribed control rod sequence, action may be taken to either correct the control rod pattern or fully insert the associated control rods within 8 hours. Noncompliance with the prescribed sequence may be the result of "double notching," drifting from a control rod drive cooling water transient, leaking scram valves, or a power reduction to d 5% RTP and d 300 psig reactor steam dome pressure before establishing the correct control rod pattern. The number of control rods not in compliance with the prescribed sequence is limited to eight to prevent the operator from attempting to correct a control rod pattern that significantly deviates from the prescribed sequence.
| |
| (continued)
| |
| LaSalle 1 B 3.1.6-3 Revision 91
| |
| | |
| UNIT 1 Rod Pattern Control B 3.1.6 BASES ACTIONS A.1 and A.2 (continued)
| |
| Required Action A.1 is modified by a Note, which allows the RWM to be bypassed to allow the affected control rods to be returned to their correct position. LCO 3.3.2.1 requires verification of control rod movement by a second licensed operator (Reactor Operator or Senior Reactor Operator) or by a task qualified member of the technical staff (e.g., a shift technical advisor or reactor engineer). This helps to ensure that the control rods will be moved to the correct position. A control rod not in compliance with the prescribed sequence is not necessarily considered inoperable. The allowed Completion Time of 8 hours is reasonable, considering the restrictions on the number of allowed out of sequence control rods and the low probability of a CRDA occurring during the time the control rods are out of sequence.
| |
| B.1 and B.2 If nine or more control rods are out of sequence, the control rod pattern significantly deviates from the prescribed sequence. Control rod withdrawal should be suspended immediately to prevent the potential for further deviation from the prescribed sequence. Control rod insertion to correct control rods withdrawn beyond their allowed position is allowed since, in general, insertion of control rods has less impact on control rod worth than withdrawals have. Required Action B.1 is modified by a Note that allows the RWM to be bypassed to allow the affected control rods to be returned to their correct position.
| |
| LCO 3.3.2.1 requires verification of control rod movement by a second licensed operator (Reactor Operator or Senior Reactor Operator) or by a task qualified member of the technical staff (e.g., a shift technical advisor or reactor engineer).
| |
| With nine or more control rods not in compliance with analyzed rod position sequence, the reactor mode switch must be placed in the shutdown position within 1 hour. With the reactor mode switch in shutdown, the reactor is shut down, and therefore does not meet the applicability requirements of this LCO. The allowed Completion Time of 1 hour is reasonable to allow insertion of control rods to restore compliance, and is appropriate relative to the low probability of a CRDA occurring with the control rods out of sequence.
| |
| (continued)
| |
| LaSalle 1 B 3.1.6-4 Revision 91
| |
| | |
| UNIT 1 Rod Pattern Control B 3.1.6 BASES SURVEILLANCE SR 3.1.6.1 REQUIREMENTS The control rod pattern is periodically verified to be in compliance with the analyzed rod position sequence, ensuring the assumptions of the CRDA analyses are met. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The RWM provides control rod blocks to enforce the required control rod sequence and is required to be OPERABLE when operating at d 5% RTP and d 300 psig reactor steam dome pressure.
| |
| REFERENCES 1. UFSAR, Section 15.4.10.
| |
| : 2. XN-NF-80-19(P)(A), Volume 1, Supplement 2, Section 7.1, Exxon Nuclear Methodology for Boiling Water Reactor-Neutronics Methods for Design and Analysis, (as specified in Technical Specification 5.6.5).
| |
| : 3. NEDE-24011-P-A, "GE Standard Application for Reactor Fuel," (as specified in Technical Specification 5.6.5).
| |
| : 4. Letter from T.A. Pickens (BWROG) to G.C. Lainas (NRC),
| |
| "Amendment 17 to General Electric Licensing Topical Report NEDE-24011-P-A," BWROG-8644, August 15, 1986.
| |
| : 5. NFSR-0091, Benchmark of CASMO/MICROBURN BWR Nuclear Design Methods, Commonwealth Edison Topical Report, (as specified in Technical Specification 5.6.5).
| |
| : 6. NUREG-0979, "NRC Safety Evaluation Report for BWR/6 Nuclear Island Design, Docket No. 50-447,"
| |
| Section 4.2.1.3.2, April 1983.
| |
| : 7. NUREG-0800, "Standard Review Plan," Section 15.4.9, "Radiological Consequences of Control Rod Drop Accident (BWR)," Revision 2, July 1981.
| |
| : 8. NEDO-21778-A, "Transient Pressure Rises Affected Fracture Toughness Requirements for Boiling Water Reactors," December 1978.
| |
| (continued)
| |
| LaSalle 1 B 3.1.6-5 Revision 91
| |
| | |
| UNIT 1 Rod Pattern Control B 3.1.6 BASES REFERENCES (continued)
| |
| : 9. NEDO-10527, "Rod Drop Accident Analysis for Large BWRs," (including Supplements 1 and 2), March 1972.
| |
| : 10. ASME, Boiler and Pressure Vessel Code.
| |
| : 11. 10 CFR 100.11, "Determination of Exclusion Area Low Population Zone and Population Center Distance."
| |
| : 12. NEDE-33885P-A, "GNF CRDA Application Methodology,"
| |
| Revision 1, March 2020.
| |
| LaSalle 1 B 3.1.6-6 Revision 91
| |
| | |
| UNIT 2 Rod P Pattern Control B 3.1.6 B 3.1 REACTIVITY TY CONTROL SYSTEMS B 3.1.6 Rod Pattern Control BASES BACKGROUND Control rod patterns during startup conditions are controlled by the operator and the Rod Worth Minimizer (RWM)
| |
| (LCO 3.3.2.1, "Control Rod Block Instrumentation"), so that only specified control rod sequences and relative positions are allowed over the operating range of all control rods inserted to 10% RTP. The sequences effectively limit the potential amount of reactivity addition that could occur in the event of a control rod drop accident (CRDA).
| |
| This Specification assures that the control rod patterns are consistent with the assumptions of the CRDA analyses of References 1, 2, and 3.
| |
| APPLICABLE The analytical methods and assumptions used in evaluating SAFETY ANALYSES the CRDA are summarized in References 1, 2, 3, 4, and 5.
| |
| CRDA analyses assume that the reactor operator follows prescribed withdrawal sequences. These sequences define the potential initial conditions for the CRDA analysis. The RWM (LCO 3.3.2.1) provides backup to operator control of the withdrawal sequences to ensure that the initial conditions of the CRDA analysis are not violated.
| |
| Prevention or mitigation of positive reactivity insertion events is necessary to limit the energy deposition in the fuel, thereby preventing significant fuel damage, which could result in undue release of radioactivity. Since the failure consequences for UO2 have been shown to be insignificant below fuel energy depositions of 300 cal/gm (Ref. 6), the fuel design limit of 280 cal/gm provides a margin of safety from significant core damage, which would result in release of radioactivity (Ref. 7). Generic evaluations (Refs. 8 and 9) of a design basis CRDA (i.e., a CRDA resulting in a peak fuel energy deposition of 280 cal/gm) have shown that if the peak fuel enthalpy remains below 280 cal/gm, then the maximum reactor pressure will be less than the required ASME Code limits (Ref. 10) and the calculated offsite doses will be well within the (continued)
| |
| LaSalle 2 B 3.1.6-7 Revision 0
| |
| | |
| 2 Rod P Pattern Control B 3.1.6 BASES APPLICABLE required limits (Ref. 11). Cycle-specific CRDA analyses are SAFETY ANALYSES performed that assume eight inoperable control rods with at (continued) least two cell separation and confirm the fuel energy deposition is less that 280 cal/gm.
| |
| Control rod patterns analyzed in the cycle specific analyses follow predetermined sequencing rules (analyzed rod position sequence). The analyzed rod position sequence is applicable from the condition of all control rods fully inserted to 10% RTP (Ref. 5). The control rods are required to be moved in groups, with all control rods assigned to a specific group required to be within specified banked positions (e.g., between notches 08 and 12). The banked positions are defined to minimize the maximum incremental control rod worths without being overly restrictive during normal plant operation. Cycle specific analyses ensure that the 280 cal/gm fuel design limit will not be violated during a CRDA under worst case scenarios. The cycle specific analyses (Refs. 1, 2, 3, 4, and 5) also evaluate the effect of fully inserted, inoperable control rods not in compliance with the sequence, to allow a limited number (i.e., eight) and distribution of fully inserted, inoperable control rods.
| |
| Specific analyses may also be performed for atypical operating conditions (e.g., fuel leaker suppression).
| |
| When performing a shutdown of the plant, an optional rod position sequence (Ref. 13) may be used provided that all withdrawn control rods have been confirmed to be coupled.
| |
| The rods may be inserted without the need to stop at intermediate positions since the possibility of a CRDA is eliminated by the confirmation that withdrawn control rods are coupled. When using the optional (Ref. 13) control rod sequence for shutdown, the rod worth minimizer may be reprogrammed to enforce the requirements of the improved control rod insertion process.
| |
| In order to use the Reference 13 shutdown process, an extra check is required in order to consider a control rod to be confirmed to be coupled. This extra check ensures that no single operator error can result in an incorrect coupling check. For purposes of this shutdown process, the method for confirming that control rods are coupled varies depending on the position of the control rod in the core.
| |
| Details on this coupling confirmation requirement are provided in Reference 13.
| |
| (continued)
| |
| LaSalle 2 B 3.1.6-8 Revision 17
| |
| | |
| 2 Rod P Pattern Control B 3.1.6 BASES APPLICABLE The plant is in compliance with the rod position sequence SAFETY ANALYSES required by this LCO when the requirements of Reference 13 (continued) are met.
| |
| Rod pattern control satisfies the requirements of Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO Compliance with the prescribed control rod sequences minimizes the potential consequences of a CRDA by limiting the initial conditions to those consistent with the analyzed rod position sequence. This LCO only applies to OPERABLE control rods. For inoperable control rods required to be inserted, separate requirements are specified in LCO 3.1.3, "Control Rod OPERABILITY," consistent with the allowances for inoperable control rods in the analyzed rod position sequence.
| |
| APPLICABILITY In MODES 1 and 2, when THERMAL POWER is d 10% RTP, the CRDA is a Design Basis Accident (DBA) and, therefore, compliance with the assumptions of the safety analysis is required.
| |
| When THERMAL POWER is ! 10% RTP, there is no credible control rod configuration that results in a control rod worth that could exceed the 280 cal/gm fuel design limit during a CRDA (Ref. 4 and 5). In MODES 3 and 4, the reactor is shutdown and the control rods are not able to be withdrawn since the reactor mode switch is in shutdown and a control rod block is applied, therefore a CRDA is not postulated to occur. In MODE 5, since the reactor is shut down and only a single control rod can be withdrawn from a core cell containing fuel assemblies, adequate SDM ensures that the consequences of a CRDA are acceptable, since the reactor will remain subcritical with a single control rod withdrawn.
| |
| ACTIONS A.1 and A.2 With one or more OPERABLE control rods not in compliance with the prescribed control rod sequence, action may be taken to either correct the control rod pattern or declare the associated control rods inoperable within 8 hours.
| |
| Noncompliance with the prescribed sequence may be the result of "double notching," drifting from a control rod drive (continued)
| |
| LaSalle 2 B 3.1.6-9 Revision 17
| |
| | |
| UNIT 2 Rod P Pattern Control B 3.1.6 BASES ACTIONS A.1 and A.2 (continued) cooling water transient, leaking scram valves, or a power reduction to d 10% RTP before establishing the correct control rod pattern. The number of OPERABLE control rods not in compliance with the prescribed sequence is limited to eight to prevent the operator from attempting to correct a control rod pattern that significantly deviates from the prescribed sequence.
| |
| Required Action A.1 is modified by a Note, which allows the RWM to be bypassed to allow the affected control rods to be returned to their correct position. LCO 3.3.2.1 requires verification of control rod movement by a second licensed operator (Reactor Operator or Senior Reactor Operator) or by a task qualified member of the technical staff (e.g., a shift technical advisor or reactor engineer). This helps to ensure that the control rods will be moved to the correct position. A control rod not in compliance with the prescribed sequence is not considered inoperable except as required by Required Action A.2. The allowed Completion Time of 8 hours is reasonable, considering the restrictions on the number of allowed out of sequence control rods and the low probability of a CRDA occurring during the time the control rods are out of sequence.
| |
| B.1 and B.2 If nine or more OPERABLE control rods are out of sequence, the control rod pattern significantly deviates from the prescribed sequence. Control rod withdrawal should be suspended immediately to prevent the potential for further deviation from the prescribed sequence. Control rod insertion to correct control rods withdrawn beyond their allowed position is allowed since, in general, insertion of control rods has less impact on control rod worth than withdrawals have. Required Action B.1 is modified by a Note that allows the RWM to be bypassed to allow the affected control rods to be returned to their correct position.
| |
| LCO 3.3.2.1 requires verification of control rod movement by a second licensed operator (Reactor Operator or Senior Reactor Operator) or by a task qualified member of the technical staff (e.g., a shift technical advisor or reactor engineer).
| |
| (continued)
| |
| LaSalle 2 B 3.1.6-10 Revision 17
| |
| | |
| UNIT 2 Rod P Pattern Control B 3.1.6 BASES ACTIONS B.1 and B.2 (continued)
| |
| With nine or more OPERABLE control rods not in compliance with analyzed rod position sequence, the reactor mode switch must be placed in the shutdown position within 1 hour. With the reactor mode switch in shutdown, the reactor is shut down, and therefore does not meet the applicability requirements of this LCO. The allowed Completion Time of 1 hour is reasonable to allow insertion of control rods to restore compliance, and is appropriate relative to the low probability of a CRDA occurring with the control rods out of sequence.
| |
| SURVEILLANCE SR 3.1.6.1 REQUIREMENTS The control rod pattern is periodically verified to be in compliance with the analyzed rod position sequence, ensuring the assumptions of the CRDA analyses are met. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The RWM provides control rod blocks to enforce the required control rod sequence and is required to be OPERABLE when operating at d 10% RTP.
| |
| REFERENCES 1. UFSAR, Section 15.4.10.
| |
| : 2. XN-NF-80-19(P)(A), Volume 1, Supplement 2, Section 7.1, Exxon Nuclear Methodology for Boiling Water Reactor-Neutronics Methods for Design and Analysis, (as specified in Technical Specification 5.6.5).
| |
| : 3. NEDE-24011-P-A, "GE Standard Application for Reactor Fuel," (as specified in Technical Specification 5.6.5).
| |
| : 4. Letter from T.A. Pickens (BWROG) to G.C. Lainas (NRC),
| |
| "Amendment 17 to General Electric Licensing Topical Report NEDE-24011-P-A," BWROG-8644, August 15, 1986.
| |
| : 5. NFSR-0091, Benchmark of CASMO/MICROBURN BWR Nuclear Design Methods, Commonwealth Edison Topical Report, (as specified in Technical Specification 5.6.5).
| |
| (continued)
| |
| LaSalle 2 B 3.1.6-11 Revision 51
| |
| | |
| UNIT 2 Rod P Pattern Control B 3.1.6 BASES REFERENCES 6. NUREG-0979, "NRC Safety Evaluation Report for GESSAR II (continued) BWR/6 Nuclear Island Design, Docket No. 50-447,"
| |
| Section 4.2.1.3.2, April 1983.
| |
| : 7. NUREG-0800, "Standard Review Plan," Section 15.4.9, "Radiological Consequences of Control Rod Drop Accident (BWR)," Revision 2, July 1981.
| |
| : 8. NEDO-21778-A, "Transient Pressure Rises Affected Fracture Toughness Requirements for Boiling Water Reactors," December 1978.
| |
| : 9. NEDO-10527, "Rod Drop Accident Analysis for Large BWRs," (including Supplements 1 and 2), March 1972.
| |
| : 10. ASME, Boiler and Pressure Vessel Code.
| |
| : 11. 10 CFR 100.11, "Determination of Exclusion Area Low Population Zone and Population Center Distance."
| |
| : 12. NEDO-21231, "Banked Position Withdrawal Sequence,"
| |
| January 1977.
| |
| : 13. NEDO-33091-A, Revision 2, "Improved BPWS Control Rod Insertion Process," July 2004.
| |
| LaSalle 2 B 3.1.6-12 Revision 17
| |
| | |
| SLC System B 3.1.7 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.7 Standby Liquid Control (SLC) System BASES BACKGROUND The SLC System is designed to provide the capability of bringing the reactor, at any time in a fuel cycle, from full power and minimum control rod inventory (which is at the peak of the xenon transient) to a subcritical condition with the reactor in the most reactive xenon free state without taking credit for control rod movement. The SLC System satisfies the requirements of 10 CFR 50.62 (Ref. 1) on anticipated transient without scram (ATWS).
| |
| The SLC System is also used to maintain suppression pool pH at or above 7 following a loss of coolant accident (LOCA) involving significant fission product releases. Maintaining suppression pool pH levels at or above 7 following an accident ensures that iodine will be retained in the suppression pool water (Ref. 3).
| |
| The SLC System consists of a boron solution storage tank, two positive displacement pumps, two explosive valves, which are provided in parallel for redundancy, and associated piping and valves used to transfer borated water from the storage tank to the reactor pressure vessel (RPV). The borated solution is discharged near the bottom of the core shroud, where it then mixes with the cooling water rising through the core.
| |
| APPLICABLE The SLC System is manually initiated from the main control SAFETY ANALYSES room, as directed by the emergency operating procedures, if the operator determines the reactor cannot be shut down, or kept shut down, with the control rods. The SLC System is used in the event that not enough control rods can be inserted to accomplish shutdown and cooldown in the normal manner. The SLC System injects borated water into the reactor core to compensate for all of the various reactivity effects that could occur during plant operation. To meet this objective, it is necessary to inject a quantity of boron that produces a reactivity change equivalent to a concentration of 660 ppm of enriched boron in the reactor core at 68qF. To ensure this objective is met, a sodium pentaborate solution enriched with boron-10 is used. The (continued)
| |
| LaSalle 1 and 2 B 3.1.7-1 Revision 48
| |
| | |
| SLC System B 3.1.7 BASES APPLICABLE shutdown analysis assumes a sodium pentaborate solution with SAFETY ANALYSES enriched boron is used (Ref. 2). A 45% enriched sodium (continued) pentaborate solution is also used to satisfy the requirements of Reference 1. To allow for potential leakage and imperfect mixing in the reactor system, an additional amount of boron equal to 25% of the amount cited above is added (Ref. 2). An additional 250 ppm is provided to accommodate dilution in the RPV by the residual heat removal shutdown cooling piping. The volume versus concentration limits in Figure 3.1.7-1 are calculated such that the required concentration is achieved. This quantity of borated solution is the amount that is above the pump suction shutoff level in the boron solution storage tank.
| |
| No credit is taken for the portion of the tank volume that cannot be injected.
| |
| Following a LOCA, offsite doses from the accident will remain within 10 CFR 50.67, "Accident Source Term," limits (Ref. 4) provided sufficient iodine activity is retained in the suppression pool. Credit for iodine deposition in the suppression pool is allowed (Ref.3) as long as suppression pool pH is maintained at or above 7. Alternative Source Term analyses credit the use of the SLC System for maintaining the pH of the suppression pool at or above 7.
| |
| The SLC System satisfies Criteria 3 and 4 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The OPERABILITY of the SLC System provides backup capability for reactivity control, independent of normal reactivity control provisions provided by the control rods. The OPERABILITY of the SLC System is based on the conditions of the borated solution in the storage tank and the availability of a flow path to the RPV, including the OPERABILITY of the pumps and valves. Two SLC subsystems are required to be OPERABLE, each containing an OPERABLE pump, an explosive valve and associated piping, valves, and instruments and controls to ensure an OPERABLE flow path.
| |
| APPLICABILITY In MODES 1 and 2, shutdown capability is required. In MODES 3 and 4, control rods are not able to be withdrawn since the reactor mode switch is in shutdown and a control rod block is applied. This provides adequate controls to (continued)
| |
| LaSalle 1 and 2 B 3.1.7-2 Revision 48
| |
| | |
| SLC System B 3.1.7 BASES APPLICABILITY (continued) ensure the reactor remains subcritical. In MODE 5, only a single control rod can be withdrawn from a core cell containing fuel assemblies. Demonstration of adequate SDM (LCO 3.1.1, "SHUTDOWN MARGIN (SDM)") ensures that the reactor will not become critical. Therefore, the SLC System is not required to be OPERABLE during these conditions, when only a single control rod can be withdrawn.
| |
| In MODES 1, 2, and 3, the SLC System must be OPERABLE to ensure that offsite doses remain within 10 CFR 50.67 (Ref. 4) limits following a LOCA involving significant fission product releases. The SLC System is designed to maintain suppression pool pH at or above 7 following a LOCA to ensure that iodine will be retained in the suppression pool water (Ref. 3).
| |
| ACTIONS A.1 If one SLC System subsystem is inoperable, the inoperable subsystem must be restored to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program. In this condition, the remaining OPERABLE subsystem is adequate to perform the shutdown function.
| |
| However, the overall reliability is reduced because a single failure in the remaining OPERABLE subsystem could result in reduced SLC System shutdown capability and inability to meet the requirements of Reference 1. The 7 day Completion Time is based on the availability of an OPERABLE subsystem capable of performing the unit shutdown function and the low probability of a Design Basis Accident (DBA) or severe transient occurring concurrent with the failure of the Control Rod Drive System to shut down the reactor.
| |
| B.1 If both SLC subsystems are inoperable, at least one subsystem must be restored to OPERABLE status within 8 hours. The allowed Completion Time of 8 hours is considered acceptable, given the low probability of a DBA or transient occurring concurrent with the failure of the control rods to shut down the reactor.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.1.7-3 Revision 89
| |
| | |
| SLC System B 3.1.7 BASES ACTIONS C.1 (continued)
| |
| If any Required Action and associated Completion Time is not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours and MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging plant systems.
| |
| SURVEILLANCE SR 3.1.7.1, SR 3.1.7.2, and SR 3.1.7.3 REQUIREMENTS SR 3.1.7.1 through SR 3.1.7.3 verify certain characteristics of the SLC System (e.g., the volume and temperature of the borated solution in the storage tank), thereby ensuring the SLC System OPERABILITY without disturbing normal plant operation. These Surveillances ensure the proper borated solution and temperature, including the temperature (using the local indicator) of the pump suction piping up to the storage tank outlet valves, are maintained. Maintaining a minimum specified borated solution temperature is important in ensuring that the boron remains in solution and does not precipitate out in the storage tank or in the pump suction piping. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.1.7.4 and SR 3.1.7.6 SR 3.1.7.4 verifies the continuity of the explosive charges in the injection valves to ensure proper operation will occur if required. Other administrative controls, such as those that limit the shelf life of the explosive charges, must be followed. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.1.7-4 Revision 51
| |
| | |
| SLC System B 3.1.7 BASES SURVEILLANCE SR 3.1.7.4 and SR 3.1.7.6 (continued)
| |
| REQUIREMENTS SR 3.1.7.6 verifies each valve in the system is in its correct position, but does not apply to the squib (i.e.,
| |
| explosive) valves. Verifying the correct alignment for manual, power operated, and automatic valves in the SLC System flow path ensures that the proper flow paths will exist for system operation. A valve is also allowed to be in the nonaccident position, provided it can be aligned to the accident position from the control room, or locally by a dedicated operator at the valve control. This is acceptable since the SLC System is a manually initiated system. This Surveillance does not apply to valves that are locked, sealed, or otherwise secured in position, since they were verified to be in the correct position prior to locking, sealing, or securing. This verification of valve alignment does not apply to valves that cannot be inadvertently misaligned, such as check valves. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct positions. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.1.7.5 This Surveillance requires an examination of the sodium pentaborate solution by using chemical analysis to ensure the proper concentration of sodium pentaborate exists in the storage tank. SR 3.1.7.5 must be performed anytime boron or water is added to the storage tank solution to establish that the sodium pentaborate solution concentration is within the specified limits. This Surveillance must be performed anytime the temperature is restored to within the limits of Figure 3.1.7-1, to ensure no significant boron precipitation occurred. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.1.7-5 Revision 51
| |
| | |
| SLC System B 3.1.7 BASES SURVEILLANCE SR 3.1.7.7 REQUIREMENTS (continued) Demonstrating each SLC System pump develops a flow rate t 41.2 gpm at a discharge pressure t 1220 psig ensures that pump performance has not degraded during the fuel cycle.
| |
| This minimum pump flow rate requirement ensures that, when combined with the sodium pentaborate solution concentration requirements, the rate of negative reactivity insertion from the SLC System will adequately compensate for the positive reactivity effects encountered during power reduction, cooldown of the moderator, and xenon decay. This test confirms one point on the pump design curve, and is indicative of overall performance. Such inservice tests confirm component OPERABILITY and detect incipient failures by indicating abnormal performance. The Frequency of this Surveillance is in accordance with the INSERVICE TESTING PROGRAM.
| |
| SR 3.1.7.8 and SR 3.1.7.9 These Surveillances ensure that there is a functioning flow path from the boron solution storage tank to the RPV, including the firing of an explosive valve. The replacement charge for the explosive valve shall be from the same manufactured batch as the one fired or from another batch that has been certified by having one of that batch successfully fired. The Surveillance may be performed in separate steps to prevent injecting boron into the RPV. An acceptable method for verifying flow from the pump to the RPV is to pump demineralized water from a test tank through one SLC subsystem and into the RPV. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.1.7-6 Revision 70
| |
| | |
| SLC System B 3.1.7 BASES SURVEILLANCE SR 3.1.7.8 and SR 3.1.7.9 (continued)
| |
| REQUIREMENTS Demonstrating that all heat traced piping in the flow path between the boron solution storage tank and the storage tank outlet valves to the injection pumps is unblocked ensures that there is a functioning flow path for injecting the sodium pentaborate solution. An acceptable method for verifying that the suction piping up to the storage tank outlet valves is unblocked is to verify flow from the storage tank to the test tank. Upon completion of this verification, the pump suction piping between the storage tank outlet valve and pump suction must be drained and flushed with demineralized water, since the piping is not heat traced. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. If, in performing SR 3.1.7.3, it is determined that the temperature of this piping has fallen below the specified minimum, SR 3.1.7.9 must be performed once within 24 hours after the piping temperature is restored within the limits of Figure 3.1.7-2.
| |
| REFERENCES 1. 10 CFR 50.62.
| |
| : 2. UFSAR, Section 9.3.5.3.
| |
| : 3. NUREG-1465, "Accident Source Terms for Light-Water Nuclear Power Plants, Final Report," February 1, 1995.
| |
| : 4. 10 CFR 50.67.
| |
| LaSalle 1 and 2 B 3.1.7-7 Revision 51
| |
| | |
| SDV Vent and Drain Valves B 3.1.8 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.8 Scram Discharge Volume (SDV) Vent and Drain Valves BASES BACKGROUND The SDV vent and drain valves are normally open and discharge any accumulated water in the SDV to ensure that sufficient volume is available at all times to allow a complete scram. During a scram, the SDV vent and drain valves close to contain reactor water. The SDV consists of header piping that connects to each hydraulic control unit (HCU) and drains into an instrument volume. There are two headers and two instrument volumes, each receiving approximately one half of the control rod drive (CRD) discharges. The two instrument volumes are connected to a common drain line with two valves in series. Each header is connected to a common vent line with two valves in series.
| |
| The header piping is sized to receive and contain all the water discharged by the CRDs during a scram. The design and functions of the SDV are described in Reference 1.
| |
| APPLICABLE The Design Basis Accident and transient analyses assume all SAFETY ANALYSES the control rods are capable of scramming. The primary function of the SDV is to limit the amount of reactor coolant discharged during a scram. The acceptance criteria for the SDV vent and drain valves are that they operate automatically to:
| |
| : a. Close during scram to limit the amount of reactor coolant discharged so that adequate core cooling is maintained and offsite doses remain within the limits of 10 CFR 50.67 (Ref. 2); and
| |
| : b. Open on scram reset to maintain the SDV vent and drain path open so there is sufficient volume to accept the reactor coolant discharged during a scram.
| |
| Isolation of the SDV can also be accomplished by manual closure of the SDV valves. Additionally, the discharge of reactor coolant to the SDV can be terminated by scram reset or closure of the HCU manual isolation valves. For a bounding leakage case, the offsite doses are well within the limits of 10 CFR 50.67 (Ref. 2) and adequate core cooling is maintained (Ref. 3). The SDV vent and drain valves also (continued)
| |
| LaSalle 1 and 2 B 3.1.8-1 Revision 48
| |
| | |
| SDV Vent and Drain Valves B 3.1.8 BASES APPLICABLE allow continuous drainage of the SDV during normal plant SAFETY ANALYSES operation to ensure the SDV has sufficient capacity (continued) to contain the reactor coolant discharge during a full core scram. To automatically ensure this capacity, a reactor scram (LCO 3.3.1.1, "Reactor Protection System (RPS)
| |
| Instrumentation") is initiated if the SDV water level exceeds a specified setpoint. The setpoint is chosen such that all control rods are inserted before the SDV has insufficient volume to accept a full scram.
| |
| SDV vent and drain valves satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The OPERABILITY of all SDV vent and drain valves ensures that, during a scram, the SDV vent and drain valves will close to contain reactor water discharged to the SDV piping.
| |
| Since the vent and drain lines are provided with two valves in series, the single failure of one valve in the open position will not impair the isolation function of the system. Additionally, the valves are required to be open to ensure that a path is available for the SDV piping to drain freely at other times.
| |
| APPLICABILITY In MODES 1 and 2, a scram may be required, and therefore, the SDV vent and drain valves must be OPERABLE. In MODES 3 and 4, control rods are not able to be withdrawn since the reactor mode switch is in shutdown and a control rod block is applied. Also, during MODE 5, only a single control rod can be withdrawn from a core cell containing fuel assemblies. Therefore, the SDV vent and drain valves are not required to be OPERABLE in these MODES since the reactor is subcritical and only one rod may be withdrawn and subject to scram.
| |
| ACTIONS The ACTIONS Table is modified by a Note indicating that a separate Condition entry is allowed for each SDV vent and drain line. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable SDV line. Complying with the Required Actions may allow for continued operation, and subsequent inoperable SDV lines are governed by subsequent Condition entry and application of associated Required Actions.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.1.8-2 Revision 0
| |
| | |
| SDV Vent and Drain Valves B 3.1.8 BASES ACTIONS The ACTIONS Table is modified by a second Note stating that (continued) an isolated line may be unisolated under administrative control to allow draining and venting of the SDV.
| |
| When a line is isolated, the potential for an inadvertent scram due to high SDV level is increased. During these periods, the line may be unisolated under administrative control. This allows any accumulated water in the line to be drained, to preclude a reactor scram on SDV high level.
| |
| This is acceptable, since the administrative controls ensure the valve can be closed quickly, by a dedicated operator at the valve controls, if a scram occurs with the valve open.
| |
| A.1 When one SDV vent or drain valve is inoperable in one or more lines, the line must be isolated to contain the reactor coolant during a scram. The 7 day Completion Time is reasonable, given the level of redundancy in the lines and the low probability of a scram occurring during the time the valve(s) are inoperable and the line(s) not isolated. The SDV is still isolable since the redundant valve in the affected line is OPERABLE. During these periods, the single failure criterion may not be preserved, and a higher risk exists to allow reactor water out of the primary system during a scram.
| |
| B.1 If both valves in a line are inoperable, the line must be isolated to contain the reactor coolant during a scram. The 8 hour Completion Time to isolate the line is based on the low probability of a scram occurring while the line is not isolated and unlikelihood of significant CRD seal leakage.
| |
| C.1 If any Required Action and associated Completion Time is not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be (continued)
| |
| LaSalle 1 and 2 B 3.1.8-3 Revision 0
| |
| | |
| SDV Vent and Drain Valves B 3.1.8 BASES ACTIONS C.1 (continued) brought to MODE 3 within 12 hours. The allowed Completion Time of 12 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.
| |
| SURVEILLANCE SR 3.1.8.1 REQUIREMENTS During normal operation, the SDV vent and drain valves should be in the open position (except when performing SR 3.1.8.2) to allow for drainage of the SDV piping.
| |
| Verifying that each valve is in the open position ensures that the SDV vent and drain valves will perform their intended function during normal operation. This SR does not require any testing or valve manipulation; rather, it involves verification that the valves are in the correct position. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. Improper valve position (closed) would not affect the isolation function.
| |
| SR 3.1.8.2 During a scram, the SDV vent and drain valves should close to contain the reactor water discharged to the SDV piping.
| |
| Cycling each valve through its complete range of motion (closed and open) ensures that the valve will function properly during a scram. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.1.8.3 SR 3.1.8.3 is an integrated test of the SDV vent and drain valves to verify total system performance. After receipt of a simulated or actual scram signal, the closure of the SDV vent and drain valves is verified. The closure time of 30 seconds after a receipt of a scram signal is based on the bounding leakage case evaluated in the accident analysis.
| |
| Similarly, after receipt of a simulated or actual scram (continued)
| |
| LaSalle 1 and 2 B 3.1.8-4 Revision 51
| |
| | |
| SDV Vent and Drain Valves B 3.1.8 BASES SURVEILLANCE SR 3.1.8.3 (continued) reset signal, the opening of the SDV vent and drain valves is verified. The LOGIC SYSTEM FUNCTIONAL TEST in LCO 3.3.1.1 and the scram time testing of control rods in LCO 3.1.3, "Control Rod OPERABILITY," overlap this Surveillance to provide complete testing of the assumed safety function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 4.6.1.1.2.
| |
| : 2. 10 CFR 50.67.
| |
| : 3. NUREG-0803, "Generic Safety Evaluation Report Regarding Integrity of BWR Scram System Piping,"
| |
| August 1981.
| |
| LaSalle 1 and 2 B 3.1.8-5 Revision 51
| |
| | |
| APLHGR B 3.2.1 B 3.2 POWER DISTRIBUTION LIMITS B 3.2.1 AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)
| |
| BASES BACKGROUND The APLHGR is a measure of the average LHGR of all the fuel rods in a fuel assembly at any axial location. Limits on the APLHGR are specified to ensure that criteria specified in 10 CFR 50.46 are met during the postulated design basis loss of coolant accident (LOCA).
| |
| APPLICABLE The analytical methods and assumptions used in evaluating SAFETY ANALYSES Design Basis Accidents (DBAs) that determine APLHGR limits are presented in UFSAR, Chapters 4, 6, and 15, and in References 1 and 2.
| |
| LOCA analyses are performed to ensure that the APLHGR limits are adequate to meet the peak cladding temperature (PCT) and maximum oxidation limits of 10 CFR 50.46. The analysis is performed using calculational models that are consistent with the requirements of 10 CFR 50, Appendix K. A complete discussion of the analysis code is provided in References 1 and 2. The PCT following a postulated LOCA is a function of the average heat generation rate of all the rods of a fuel assembly at any axial location and is not strongly influenced by the rod to rod power distribution within an assembly. A conservative multiplier is applied to the LHGR and APLHGR assumed in the LOCA analysis to account for the uncertainty associated with the measurement of the APLHGR.
| |
| APLHGR limits are typically set high enough such that the LHGR limits are more limiting than the APLHGR limits.
| |
| For single recirculation loop operation, a conservative multiplier is applied to the exposure dependent APLHGR limits for two loop operation. This additional limitation is due to the conservative analysis assumption of an earlier departure from nucleate boiling with one recirculation loop available, resulting in a more severe cladding heatup during a LOCA.
| |
| The APLHGR satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.2.1-1 Revision 0
| |
| | |
| APLHGR B 3.2.1 BASES (continued)
| |
| LCO The APLHGR limits specified in the COLR are the result of the DBA analyses. For two recirculation loops operating, the limit is dependent on exposure. With only one recirculation loop in operation, in conformance with the requirements of LCO 3.4.1, "Recirculation Loops Operating,"
| |
| the limit is determined by multiplying the exposure dependent APLHGR limit by a conservative multiplier determined by a specific single recirculation loop analysis.
| |
| APPLICABILITY The APLHGR limits are derived from LOCA analyses that are assumed to occur at high power levels. Studies and operating experience have shown that as power is reduced, the margin to the required APLHGR limits increases. This trend continues down to the power range of 5% to 15% RTP when entry into MODE 2 occurs. When in MODE 2, the intermediate range monitor (IRM) scram function and the average power range monitor (APRM) scram function provide prompt scram initiation during any significant transient, thereby effectively removing any APLHGR limit compliance concern in MODE 2. Therefore, at THERMAL POWER levels 25% RTP, the reactor operates with substantial margin to the APLHGR limits; thus, this LCO is not required.
| |
| ACTIONS A.1 If any APLHGR exceeds the required limits, an assumption regarding an initial condition of the DBA analyses may not be met. Therefore, prompt action is taken to restore the APLHGR(s) to within the required limits such that the plant will be operating within analyzed conditions and within the design limits of the fuel rods. The 2 hour Completion Time is sufficient to restore the APLHGR(s) to within its limits and is acceptable based on the low probability of a DBA occurring simultaneously with the APLHGR out of specification.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.2.1-2 Revision 0
| |
| | |
| APLHGR B 3.2.1 BASES ACTIONS B.1 (continued)
| |
| If the APLHGR cannot be restored to within its required limits within the associated Completion Time, the plant must be brought to a MODE or other specified condition in which the LCO does not apply. To achieve this status, THERMAL POWER must be reduced to < 25% RTP within 4 hours. The allowed Completion Time is reasonable, based on operating experience, to reduce THERMAL POWER to < 25% RTP in an orderly manner and without challenging plant systems.
| |
| SURVEILLANCE SR 3.2.1.1 REQUIREMENTS APLHGRs are required to be initially calculated within 12 hours after THERMAL POWER is 25% RTP and periodically thereafter. They are compared to the specified limits in the COLR to ensure that the reactor is operating within the assumptions of the safety analysis. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The 12 hour allowance after THERMAL POWER 25% RTP is achieved is acceptable given the large inherent margin to operating limits at low power levels.
| |
| REFERENCES 1. NEDE-24011-P-A, "General Electric Standard Application for Reactor Fuel," (as specified in Technical Specification 5.6.5).
| |
| : 2. EMF-94-217(NP), Revision 1, "Boiling Water Reactor Licensing Methodology Summary," November 1995.
| |
| LaSalle 1 and 2 B 3.2.1-3 Revision 51
| |
| | |
| MCPR B 3.2.2 B 3.2 POWER DISTRIBUTION LIMITS B 3.2.2 MINIMUM CRITICAL POWER RATIO (MCPR)
| |
| BASES BACKGROUND MCPR is a ratio of the fuel assembly power that would result in the onset of boiling transition to the actual fuel assembly power. The operating limit MCPR is established to ensure that no fuel damage results during anticipated operational occurrences (AOOs), and that 99.9% of the fuel rods are not susceptible to boiling transition if the limit is not violated. Although fuel damage does not necessarily occur if a fuel rod actually experiences boiling transition (Ref. 1), the critical power at which boiling transition is calculated to occur has been adopted as a fuel design criterion.
| |
| The onset of transition boiling is a phenomenon that is readily detected during the testing of various fuel bundle designs. Based on these experimental data, correlations have been developed to predict critical bundle power (i.e.,
| |
| the bundle power level at the onset of transition boiling) for a given set of plant parameters (e.g., reactor vessel pressure, flow, and subcooling). Because plant operating conditions and bundle power levels are monitored and determined relatively easily, monitoring the MCPR is a convenient way of ensuring that fuel failures due to inadequate cooling do not occur.
| |
| APPLICABLE The analytical methods and assumptions used in evaluating SAFETY ANALYSES the AOOs to establish the operating limit MCPR are presented in References 2, 3, 4, 5, 6, 7, 8, and 9. To ensure that the MCPR Safety Limit (SL) is not exceeded during any transient event that occurs with moderate frequency, limiting transients have been analyzed to determine the largest reduction in critical power ratio (CPR). The types of transients evaluated are loss of flow, increase in pressure and power, positive reactivity insertion, and coolant temperature decrease. The limiting transient yields the largest change in CPR ('CPR). When the largest 'CPR is combined with the MCPR99.9%, the required operating limit MCPR is obtained.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.2.2-1 Revision 83
| |
| | |
| MCPR B 3.2.2 BASES APPLICABLE MCPR99.9% is determined to ensure more than 99.9% of the fuel SAFETY ANALYSES rods in the core are not susceptible to boiling transition (continued) using a statistical model that combines all the uncertainties in operating parameters and the procedures used to calculate critical power. The probability of the occurrence of boiling transition is determined using the approved Critical Power correlations. Details of the MCPR99.9% calculation are given in Reference 2. Reference 2 also includes a tabulation of the uncertainties and the nominal values of the parameters used in the MCPR99.9%
| |
| statistical analysis.
| |
| The MCPR operating limits are derived from the MCPR99.9% value and the transient analysis, and are dependent on the operating core flow and power state (MCPRf and MCPRp, respectively) to ensure adherence to fuel design limits during the worst transient that occurs with moderate frequency as identified in the UFSAR, Chapter 15 (Ref. 5).
| |
| Flow dependent MCPR limits are determined by steady state thermal hydraulic methods with key physics response inputs benchmarked using the three dimensional BWR simulator code (Ref. 8) and the multichannel thermal hydraulic code (Ref. 9) to analyze slow flow runout transients on a cycle-specific basis. For core flows less than rated, the established MCPR operating limit is adjusted to provide protection of the MCPR SL in the event of an uncontrolled recirculation flow increase to the physical limit of the pump. Protection is provided for manual and automatic flow control by applying appropriate flow dependent MCPR operating limits. The MCPR operating limit for a given power/flow state is the greater of the rated conditions MCPR operating limit or the power dependent MCPR operating limit.
| |
| For automatic flow control, in addition to protecting the MCPR SL during the flow run-up event, protection is provided by the flow dependent MCPR operating limit to prevent exceeding the rated flow MCPR operating limit during an automatic flow increase to rated core flow.
| |
| Power dependent MCPR limits (MCPRp) are determined on a cycle-specific basis. These limits are established to protect the core from plant transients other than core flow increases, including pressurization and local control rod withdrawal events.
| |
| The MCPR satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.2.2-2 Revision 83
| |
| | |
| MCPR B 3.2.2 BASES (continued)
| |
| LCO The MCPR operating limits specified in the COLR (MCPR99.9%
| |
| value, MCPRf values, and MCPRp values) are the result of the Design Basis Accident (DBA) and transient analysis. MCPR operating limits which include the effects of analyzed equipment out-of-service are also included in the COLR. The MCPR operating limits are determined by the larger of the MCPRf and MCPRp limits, which are based on the MCPR99.9% limit specified in the COLR.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.2.2-3 Revision 83
| |
| | |
| MCPR B 3.2.2 BASES (continued)
| |
| APPLICABILITY The MCPR operating limits are primarily derived from transient analyses that are assumed to occur at high power levels. Below 25% RTP, the reactor is operating at a slow recirculation pump speed and the moderator void ratio is small. Surveillance of thermal limits below 25% RTP is unnecessary due to the inherent margin that ensures that the MCPR SL is not exceeded even if a limiting transient occurs.
| |
| Studies of the variation of limiting transient behavior have been performed over the range of power and flow conditions.
| |
| These studies (Ref. 5) encompass the range of key actual plant parameter values important to typically limiting transients. The results of these studies demonstrate that a margin is expected between performance and the MCPR requirements, and that margins increase as power is reduced to 25% RTP. This trend is expected to continue to the 5% to 15% power range when entry into MODE 2 occurs. When in MODE 2, the intermediate range monitor (IRM) and average power range monitor (APRM) provide rapid scram initiation for any significant power increase transient, which effectively eliminates any MCPR compliance concern.
| |
| Therefore, at THERMAL POWER levels 25% RTP, the reactor is operating with substantial margin to the MCPR limits and this LCO is not required.
| |
| ACTIONS A.1 If any MCPR is outside the required limits, an assumption regarding an initial condition of the design basis transient analyses may not be met. Therefore, prompt action should be taken to restore the MCPR(s) to within the required limits such that the plant remains operating within analyzed conditions. The 2 hour Completion Time is normally sufficient to restore the MCPR(s) to within its limits and is acceptable based on the low probability of a transient or DBA occurring simultaneously with the MCPR out of specification.
| |
| B.1 If the MCPR cannot be restored to within the required limits within the associated Completion Time, the plant must be brought to a MODE or other specified condition in which the LCO does not apply. To achieve this status, THERMAL POWER (continued)
| |
| LaSalle 1 and 2 B 3.2.2-4 Revision 83
| |
| | |
| MCPR B 3.2.2 BASES ACTIONS B.1 (continued) must be reduced to 25% RTP within 4 hours. The allowed Completion Time is reasonable, based on operating experience, to reduce THERMAL POWER to 25% RTP in an orderly manner and without challenging plant systems.
| |
| SURVEILLANCE SR 3.2.2.1 REQUIREMENTS The MCPR is required to be initially calculated within 12 hours after THERMAL POWER is t 25% RTP and periodically thereafter. It is compared to the specified limits in the COLR to ensure that the reactor is operating within the assumptions of the safety analysis. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The 12 hour allowance after THERMAL POWER reaches t 25% RTP is acceptable given the inherent margin to operating limits at low power levels.
| |
| SR 3.2.2.2 Because the transient analyses may take credit for conservatism in the control rod scram speed performance, it must be demonstrated that the specific scram speed distribution is consistent with that used in the transient analyses. SR 3.2.2.2 determines the actual scram speed distribution and compares it with the assumed distribution.
| |
| The MCPR operating limit is then determined based either on the applicable limit associated with scram times of LCO 3.1.4, "Control Rod Scram Times," or the realistic scram times. The scram time dependent MCPR limits are contained in the COLR. This determination must be performed within 72 hours after each set of control rod scram time tests required by SR 3.1.4.1, SR 3.1.4.2, and SR 3.1.4.4 because the effective scram speed distribution may change during the cycle or after maintenance that could affect scram times.
| |
| The 72 hour Completion Time is acceptable due to the relatively minor changes in the actual control rod scram speed distribution expected during the fuel cycle.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.2.2-5 Revision 83
| |
| | |
| MCPR B 3.2.2 BASES (continued)
| |
| REFERENCES 1. NUREG-0562, June 1979.
| |
| : 2. NEDE-24011-P-A, "General Electric Standard Application for Reactor Fuel" (as specified in Technical Specification 5.6.5).
| |
| : 3. UFSAR, Chapter 4.
| |
| : 4. UFSAR, Chapter 6.
| |
| : 5. UFSAR, Chapter 15.
| |
| : 6. EMF-94-217(NP) , Revision 1, "Boiling Water Reactor Licensing Methodology Summary," November 1995.
| |
| : 7. NFSR-0091, Benchmark of CASMO/MICROBURN BWR Nuclear Design Methods, Commonwealth Edison Topical Report, (as specified in Technical Specification 5.6.5).
| |
| : 8. XN-NF-80-19(P)(A), Volume 1, Exxon Nuclear Methodology for Boiling Water Reactors-Neutronic Methods for Design and Analysis, (as specified in Technical Specification 5.6.5).
| |
| : 9. XN-NF-80-19(P)(A), Volume 3, Exxon Nuclear Methodology for Boiling Water Reactors-THERMEX Thermal Limits Methodology Summary Description, (as specified in Technical Specification 5.6.5).
| |
| LaSalle 1 and 2 B 3.2.2-6 Revision 83
| |
| | |
| LHGR B 3.2.3 B 3.2 POWER DISTRIBUTION LIMITS B 3.2.3 LINEAR HEAT GENERATION RATE (LHGR)
| |
| BASES BACKGROUND The LHGR is a measure of the heat generation rate of a fuel rod in a fuel assembly at any axial location. Limits on the LHGR are specified to ensure that fuel design limits are not exceeded anywhere in the core during normal operation, including anticipated operational occurrences (AOOs), and to ensure that the peak cladding temperature (PCT) during the postulated design basis loss of coolant accident (LOCA) does not exceed the limits specified in 10 CFR 50.46. Exceeding the LHGR limit could potentially result in fuel damage and subsequent release of radioactive materials. Fuel design limits are specified to ensure that fuel system damage, fuel rod failure or inability to cool the fuel does not occur during the normal operations and anticipated operating conditions identified in References 1 and 2.
| |
| APPLICABLE The analytical methods and assumptions used in evaluating SAFETY ANALYSES the fuel system design and establish LHGR limits are presented in References 1, 2, 3, 4, 5, and 6. The fuel assembly is designed to ensure (in conjunction with the core nuclear and thermal hydraulic design, plant equipment, instrumentation, and protection system) that fuel damage will not result in the release of radioactive materials in excess of the guidelines of 10 CFR, Parts 20 and 50. A mechanism that could cause fuel damage during normal operations and operational transients and that is considered in fuel evaluations is a rupture of the fuel rod cladding caused by strain from the relative expansion of the UO2 pellet.
| |
| A value of 1% plastic strain of the fuel cladding has been defined as the limit below which fuel damage caused by overstraining of the fuel cladding is not expected to occur (Ref. 7).
| |
| Fuel design evaluations have been performed and demonstrate that the 1% fuel cladding plastic strain design limit is not exceeded during continuous operation with LHGRs up to the operating limit specified in the COLR. The analysis also includes allowances for short term transient excursions above the operating limit while still remaining within the AOO limits, plus an allowance for densification power spiking.
| |
| The LHGR satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.2.3-1 Revision 48
| |
| | |
| LHGR B 3.2.3 BASES (continued)
| |
| LCO The LHGR is a basic assumption in the fuel design analysis.
| |
| The fuel has been designed to operate at rated core power with sufficient design margin to the LHGR calculated to cause a 1% fuel cladding plastic strain. The operating limit to accomplish this objective is specified in the COLR.
| |
| APPLICABILITY The LHGR limits are derived from fuel design analysis that is limiting at high power level conditions. At core thermal power levels < 25% RTP, the reactor is operating with margin to the LHGR limits and, therefore, the Specification is only required when the reactor is operating at 25% RTP.
| |
| ACTIONS A.1 If any LHGR exceeds its required limit, an assumption regarding an initial condition of the fuel design analysis is not met. Therefore, prompt action should be taken to restore the LHGR(s) to within its required limits such that the plant is operating within analyzed conditions. The 2 hour Completion Time is normally sufficient to restore the LHGR(s) to within its limits and is acceptable based on the low probability of a transient or Design Basis Accident occurring simultaneously with the LHGR out of specification.
| |
| B.1 If the LHGR cannot be restored to within its required limits within the associated Completion Time, the plant must be brought to a MODE or other specified condition in which the LCO does not apply. To achieve this status, THERMAL POWER must be reduced to < 25% RTP within 4 hours. The allowed Completion Time is reasonable, based on operating experience, to reduce THERMAL POWER to < 25% RTP in an orderly manner and without challenging plant systems.
| |
| SURVEILLANCE SR 3.2.3.1 REQUIREMENTS The LHGRs are required to be initially calculated within 12 hours after THERMAL POWER is 25% RTP and then periodically thereafter. They are compared with the LHGR limits in the COLR to ensure that the reactor is operating within (continued)
| |
| LaSalle 1 and 2 B 3.2.3-2 Revision 51
| |
| | |
| LHGR B 3.2.3 BASES SURVEILLANCE SR 3.2.3.1 (continued)
| |
| REQUIREMENTS the assumptions of the safety analysis. The 12 hour allowance after THERMAL POWER 25% RTP is achieved is acceptable given the inherent margin to operating limits at lower power levels. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Chapter 4.
| |
| : 2. UFSAR, Chapter 15.
| |
| : 3. XN-NF-80-19(P)(A), Advanced Nuclear Fuel Methodology for Boiling Water Reactors.
| |
| : 4. XN-NF-81-58(P)(A), RODEX2 Fuel Rod Thermal-Mechanical Response Evaluation Model.
| |
| : 5. NEDE-24011-P-A, General Electric Standard Application for Reactor Fuel (as specified in Technical Specification 5.6.5).
| |
| : 6. EMF-85-74(P)(A), RODEX2A (BWR) Fuel Rod Thermal-Mechanical Evaluation Model.
| |
| : 7. NUREG-0800, Section 4.2.II A.2(g), Revision 2, July 1981.
| |
| LaSalle 1 and 2 B 3.2.3-3 Revision 51
| |
| | |
| RPS Instrumentation B 3.3.1.1 B 3.3 INSTRUMENTATION B 3.3.1.1 Reactor Protection System (RPS) Instrumentation BASES BACKGROUND The RPS initiates a reactor scram when one or more monitored parameters exceed their specified limit to preserve the integrity of the fuel cladding and the reactor coolant pressure boundary (RCPB), and minimize the energy that must be absorbed following a loss of coolant accident (LOCA).
| |
| This can be accomplished either automatically or manually.
| |
| The protection and monitoring functions of the RPS have been designed to ensure safe operation of the reactor. This is achieved by specifying limiting safety system settings (LSSS) in terms of parameters directly monitored by the RPS, as well as LCOs on other reactor system parameters, and equipment performance. The LSSS are defined in this Specification as the Allowable Values, which, in conjunction with the LCOs, establish the threshold for protective system action to prevent exceeding acceptable limits, including Safety Limits (SLs), during Design Basis Accidents (DBAs).
| |
| The RPS, as described in the UFSAR, Section 7.2 (Ref. 1),
| |
| includes sensors, relays, bypass circuits, and switches that are necessary to cause initiation of a reactor scram.
| |
| Functional diversity is provided by monitoring a wide range of dependent and independent parameters. The input parameters to the scram logic are from instrumentation that monitors reactor vessel water level; reactor vessel pressure; neutron flux; main steam line isolation valve position; turbine control valve (TCV) fast closure, trip oil pressure low; turbine stop valve (TSV) position; drywell pressure and scram discharge volume (SDV) water level; as well as reactor mode switch in shutdown position and manual scram signals. There are at least four redundant sensor input signals from each of these parameters. Most channels include instrument switches or electronic equipment (e.g.,
| |
| trip units) that compares measured input signals with pre-established setpoints. When a setpoint is exceeded, the channel outputs an RPS trip signal to the trip logic.
| |
| The RPS is comprised of two independent trip systems (A and B), with two logic channels in each trip system (logic channels A1 and A2, B1 and B2), as described in Reference 1.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.1.1-1 Revision 0
| |
| | |
| RPS Instrumentation B 3.3.1.1 BASES BACKGROUND The outputs of the logic channels in a trip system are (continued) combined in a one-out-of-two logic so either channel can trip the associated trip system. The tripping of both trip systems will produce a reactor scram. This logic arrangement is referred to as one-out-of-two taken twice logic. Each trip system can be reset by use of a reset switch. If a full scram occurs (both trip systems trip), a relay prevents reset of the trip systems for 10 seconds.
| |
| This 10 second delay on reset is only possible if the conditions that caused the scram have been cleared. This ensures that the scram function will be completed.
| |
| Two scram pilot valves are located in the hydraulic control unit (HCU) for each control rod drive (CRD). Each CRD alternatively may have a single scram pilot valve with dual solenoid operated pilot assemblies in place of two scram pilot valves. Each scram pilot valve is solenoid operated, with the solenoids normally energized. The scram pilot valves control the air supply to the scram inlet and outlet valves for the associated CRD. When either scram pilot valve solenoid is energized, air pressure holds the scram valves closed and, therefore, both scram pilot valve solenoids must be de-energized to cause a control rod to scram. The scram valves control the supply and discharge paths for the CRD water during a scram. One of the scram pilot valve solenoids for each CRD is controlled by trip system A, and the other solenoid is controlled by trip system B. Any trip of trip system A in conjunction with any trip in trip system B results in de-energizing both solenoids, air bleeding off, scram valves opening, and control rod scram.
| |
| The backup scram valves, which energize on a scram signal to depressurize the scram air header, are also controlled by the RPS. Additionally, the RPS System controls the SDV vent and drain valves such that when both trip systems trip, the SDV vent and drain valves close to isolate the SDV.
| |
| APPLICABLE The actions of the RPS are assumed in the safety analyses SAFETY ANALYSES, of References 2, 3, and 4. The RPS initiates a reactor LCO, and scram when monitored parameter values exceed the Allowable APPLICABILITY Values specified by the setpoint methodology and listed in Table 3.3.1.1-1 to preserve the integrity of the fuel cladding, the RCPB, and the containment by minimizing the energy that must be absorbed following a LOCA.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.1.1-2 Revision 41
| |
| | |
| RPS Instrumentation B 3.3.1.1 BASES APPLICABLE RPS instrumentation satisfies Criterion 3 of SAFETY ANALYSES, 10 CFR 50.36(c)(2)(ii). Functions not specifically credited LCO, and in the accident analysis are retained for the overall APPLICABILITY redundancy and diversity of the RPS as required by the NRC (continued) approved licensing basis.
| |
| The OPERABILITY of the RPS is dependent on the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.1.1-1. Each Function must have a required number of OPERABLE channels per RPS trip system, with their setpoints within the specified Allowable Value, where appropriate. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.
| |
| Each channel must also respond within its assumed response time, where applicable.
| |
| Allowable Values are specified for each RPS Function specified in the Table. Nominal trip setpoints are specified in the setpoint calculations. The nominal setpoints are selected to ensure that the actual setpoints do not exceed the Allowable Value between successive CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value.
| |
| Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The trip setpoints are determined from the analytic limits, corrected for defined process, calibration, and instrumentation errors. The Allowable Values are then determined, based on the trip setpoint values, by accounting for the calibration based errors. These calibration based errors are limited to reference accuracy, instrument drift, errors associated with measurement and test equipment, and calibration tolerance of loop components. The trip setpoints and Allowable Values determined in this manner provide adequate protection (continued)
| |
| LaSalle 1 and 2 B 3.3.1.1-3 Revision 0
| |
| | |
| RPS Instrumentation B 3.3.1.1 BASES APPLICABLE because instrument uncertainties, process effects, SAFETY ANALYSES, calibration tolerances, instrument drift, and severe LCO, and environment errors (for channels that must function in harsh APPLICABILITY environments as defined by 10 CFR 50.49) are accounted for (continued) and appropriately applied for the instrumentation.
| |
| The OPERABILITY of scram pilot valves and associated solenoids, backup scram valves, and SDV valves, described in the Background section, are not addressed by this LCO.
| |
| The individual Functions are required to be OPERABLE in the MODES or other conditions specified in the Table that may require an RPS trip to mitigate the consequences of a design basis accident or transient. To ensure a reliable scram function, a combination of Functions is required in each MODE to provide primary and diverse initiation signals.
| |
| The only MODES specified in Table 3.3.1.1-1 are MODES 1 and 2, and MODE 5 with any control rod withdrawn from a core cell containing one or more fuel assemblies. No RPS Function is required in MODES 3 and 4, since all control rods are fully inserted and the Reactor Mode Switch Shutdown Position control rod withdrawal block (LCO 3.3.2.1) does not allow any control rod to be withdrawn. Under these conditions, the RPS function is not required to be OPERABLE.
| |
| In MODE 5, control rods withdrawn from a core cell containing no fuel assemblies do not affect the reactivity of the core and therefore are not required to have the capability to scram. Provided all other control rods remain inserted, no RPS Function is required. In this condition, the required SDM (LCO 3.1.1) and refuel position one-rod-out interlock (LCO 3.9.2) ensure that no event requiring RPS will occur.
| |
| The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.
| |
| 1.a. Intermediate Range Monitor (IRM) Neutron FluxHigh The IRMs monitor neutron flux levels from the upper range of the source range monitors (SRMs) to the lower range of the average power range monitors (APRMs). The IRMs are capable of generating trip signals that can be used to prevent fuel (continued)
| |
| LaSalle 1 and 2 B 3.3.1.1-4 Revision 41
| |
| | |
| RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 1.a. Intermediate Range Monitor (IRM) Neutron FluxHigh SAFETY ANALYSES, (continued)
| |
| LCO, and APPLICABILITY damage resulting from abnormal operating transients in the intermediate power range. In this power range, the most significant source of reactivity change is due to control rod withdrawal. The IRM provides a diverse protection function from the rod worth minimizer (RWM), which monitors and controls the movement of control rods at low power. The RWM prevents the withdrawal of an out of sequence control rod during startup that could result in an unacceptable neutron flux excursion (Ref. 5). The IRM provides a backup to the APRM in mitigation of the neutron flux excursion.
| |
| However, to demonstrate the capability of the IRM System to mitigate control rod withdrawal events, a generic analysis has been performed (Ref. 6) to evaluate the consequences of control rod withdrawal events during startup that are mitigated only by the IRM. This analysis, which assumes that one IRM channel in each trip system is bypassed, demonstrates that the IRMs provide protection against local control rod withdrawal errors and results in peak fuel enthalpy below the 170 cal/gm fuel failure threshold criterion.
| |
| The IRMs are also capable of limiting other reactivity excursions during startup, such as cold water injection events, although no credit is specifically assumed.
| |
| The IRM System is divided into two groups of IRM channels, with four IRM channels inputting to each trip system. The analysis of Reference 6 assumes that one channel in each trip system is bypassed. Therefore, six channels with three channels in each trip system are required for IRM OPERABILITY to ensure that no single instrument failure will preclude a scram from this Function on a valid signal. This trip is active in each of the 10 ranges of the IRM, which must be selected by the operator to maintain the neutron flux within the monitored level of an IRM range.
| |
| The analysis of Reference 6 has adequate conservatism to permit the IRM Allowable Value specified in Table 3.3.1.1-1.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.1.1-5 Revision 0
| |
| | |
| RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 1.a. Intermediate Range Monitor (IRM) Neutron FluxHigh SAFETY ANALYSES, (continued)
| |
| LCO, and APPLICABILITY The Intermediate Range Monitor Neutron FluxHigh Function must be OPERABLE during MODE 2 when control rods may be withdrawn and the potential for criticality exists. In MODE 5, when a cell with fuel has its control rod withdrawn, the IRMs provide monitoring for and protection against unexpected reactivity excursions. In MODE 1, the APRM System, the RWM and Rod Block Monitor provide protection against control rod withdrawal error events and the IRMs are not required. The IRMs are automatically bypassed when the Reactor Mode Switch is in the run position.
| |
| 1.b. Intermediate Range MonitorInop This trip signal provides assurance that a minimum number of IRMs are OPERABLE. Anytime an IRM mode switch is moved to any position other than "Operate," the detector voltage drops below a preset level, or a module is not plugged in, an inoperative trip signal will be received by the RPS unless the IRM is bypassed. Since only one IRM in each trip system may be bypassed, only one IRM in each RPS trip system may be inoperable without resulting in an RPS trip signal.
| |
| This Function was not specifically credited in the accident analysis, but it is retained for the overall redundancy and diversity of the RPS as required by the NRC approved licensing basis.
| |
| Six channels of Intermediate Range MonitorInop with three channels in each trip system are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function on a valid signal.
| |
| There is no Allowable Value for this Function.
| |
| This Function is required to be OPERABLE when the Intermediate Range Monitor Neutron FluxHigh Function is required.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.1.1-6 Revision 0
| |
| | |
| RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 2.a. Average Power Range Monitor Neutron FluxHigh, SAFETY ANALYSES, Setdown LCO, and APPLICABILITY The APRM channels receive input signals from the local power (continued) range monitors (LPRM) within the reactor core, which provide an indication of the power distribution and local power changes. The APRM channels average these LPRM signals to provide a continuous indication of average reactor power from a few percent to greater than RTP. For operation at low power (i.e., MODE 2), the Average Power Range Monitor Neutron FluxHigh, Setdown Function is capable of generating a trip signal that prevents fuel damage resulting from abnormal operating transients in this power range. For most operation at low power levels, the Average Power Range Monitor Neutron FluxHigh, Setdown Function will provide a secondary scram to the Intermediate Range Monitor Neutron FluxHigh Function because of the relative setpoints. With the IRMs at Range 9 or 10, it is possible that the Average Power Range Monitor Neutron FluxHigh, Setdown Function will provide the primary trip signal for a corewide increase in power. The initial core, fuel cycle independent analysis provided in Reference 5 indicates that a primary trip signal from the Average Power Range Monitor Neutron FluxHigh, Setdown Function would provide acceptable results.
| |
| The safety analyses (Ref. 5) take credit for the Average Power Range Monitor Neutron FluxHigh, Setdown Function.
| |
| This Function ensures that, before the reactor mode switch is placed in the run position, reactor power does not exceed 25% RTP (SL 2.1.1.1) when operating at low reactor pressure and low core flow. Therefore, it prevents fuel damage during significant reactivity increases with THERMAL POWER
| |
| 25% RTP.
| |
| The APRM System is divided into two groups of channels with three APRM channel inputs to each trip system. The system is designed to allow one channel in each trip system to be bypassed. Any one APRM channel in a trip system can cause the associated trip system to trip. Four channels of Average Power Range Monitor Neutron FluxHigh, Setdown, with two channels in each trip system are required to be OPERABLE to ensure that no single failure will preclude a scram from this Function on a valid signal. In addition, to (continued)
| |
| LaSalle 1 and 2 B 3.3.1.1-7 Revision 0
| |
| | |
| RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 2.a. Average Power Range Monitor Neutron FluxHigh, SAFETY ANALYSES, Setdown (continued)
| |
| LCO, and APPLICABILITY provide adequate coverage of the entire core, at least 14 LPRM inputs are required for each APRM channel, with at least two LPRM inputs from each of the four axial levels at which the LPRMs are located.
| |
| The Allowable Value is based on preventing significant increases in power when THERMAL POWER is 25% RTP.
| |
| The Average Power Range Monitor Neutron FluxHigh, Setdown Function must be OPERABLE during MODE 2 when control rods may be withdrawn and the potential for fuel damage from abnormal operating transients exists. In MODE 1, the Average Power Range Monitor Neutron FluxHigh Function provides protection against reactivity transients and the RWM and Rod Block Monitor protect against control rod withdrawal error events.
| |
| 2.b. Average Power Range Monitor Flow Biased Simulated Thermal PowerUpscale The Average Power Range Monitor Flow Biased Simulated Thermal PowerUpscale Function monitors neutron flux to approximate the THERMAL POWER being transferred to the reactor coolant. The APRM neutron flux is electronically filtered with a time constant representative of the fuel heat transfer dynamics to generate a signal proportional to the THERMAL POWER in the reactor. The trip level is varied as a function of recirculation drive flow (i.e., at lower core flows the setpoint is reduced proportional to the reduction in power experienced as core flow is reduced) but is clamped at an upper limit that is always lower than the Average Power Range Monitor Fixed Neutron FluxHigh Function Allowable Value. The Average Power Range Monitor Flow Biased Simulated Thermal PowerUpscale Function provides protection against transients where THERMAL POWER increases slowly (such as the loss of feedwater heating event) and protects the fuel cladding integrity by ensuring that the MCPR SL is not exceeded. During these events, the THERMAL POWER increase does not significantly lag the neutron flux response and, because of a lower trip setpoint, (continued)
| |
| LaSalle 1 and 2 B 3.3.1.1-8 Revision 0
| |
| | |
| RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 2.b. Average Power Range Monitor Flow Biased Simulated SAFETY ANALYSES, Thermal PowerUpscale (continued)
| |
| LCO, and APPLICABILITY will initiate a scram before the high neutron flux scram.
| |
| For rapid neutron flux increase events, the THERMAL POWER lags the neutron flux and the Average Power Range Monitor Fixed Neutron FluxHigh Function will provide a scram signal before the Average Power Range Monitor Flow Biased Simulated Thermal PowerUpscale Function setpoint is exceeded.
| |
| The APRM System is divided into two groups of channels with three APRM inputs to each trip system. The system is designed to allow one channel in each trip system to be bypassed. Any one Average Power Range Monitor channel in a trip system can cause the associated trip system to trip.
| |
| Four channels of Average Power Range Monitor Flow Biased Simulated Thermal PowerUpscale, with two channels in each trip system arranged in one-out-of-two logic, are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function on a valid signal.
| |
| In addition, to provide adequate coverage of the entire core, at least 14 LPRM inputs are required for each APRM channel, with at least two LPRM inputs from each of the four axial levels at which the LPRMs are located. Each APRM channel receives two independent, redundant flow signals representative of total recirculation drive flow. The total drive flow signals are generated by four flow units, two of which supply signals to the trip system A APRMs, while the other two supply signals to the trip system B APRMs. Each flow unit signal is provided by summing the flow signals from the two recirculation loops. These redundant flow signals are sensed from four pairs of elbow taps, two on each recirculation loop. No single active component failure can cause more than one of these two redundant signals to read incorrectly. To obtain the most conservative reference signals, the total flow signals from the two flow units (associated with a trip system as described above) are routed to a low auction circuit associated with each APRM.
| |
| Each APRM's auction circuit selects the lower of the two flow unit signals for use as the scram trip reference for that particular APRM. Each required Average Power Range Monitor Flow Biased Simulated (continued)
| |
| LaSalle 1 and 2 B 3.3.1.1-9 Revision 0
| |
| | |
| RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 2.b. Average Power Range Monitor Flow Biased Simulated SAFETY ANALYSES, Thermal PowerUpscale (continued)
| |
| LCO, and APPLICABILITY Thermal PowerUpscale channel only requires an input from one OPERABLE flow unit, since the individual APRM channel will perform the intended function with only one OPERABLE flow unit input. However, in order to maintain single failure criteria for the Function, at least one required Average Power Range Monitor Flow Biased Simulated Thermal PowerUpscale channel in each trip system must be capable of maintaining an OPERABLE flow unit signal in the event of a failure of an auction circuit, or a flow unit, in the associated trip system (e.g., if a flow unit is inoperable, one of the two required Average Power Range Monitor Flow Biased Simulated Thermal PowerUpscale channels in the associated trip system must be considered inoperable).
| |
| Although the Average Power Range Monitor Flow Biased Simulated Thermal PowerUpscale Function is not specifically credited in the safety analysis, the associated Allowable Value provides additional margin from transient induced fuel damage beyond that provided by the Average Power Range Monitor Fixed Neutron FluxHigh Function. "W,"
| |
| in the Allowable Value column of Table 3.3.1.1-1, is the percentage of recirculation loop flow which provides a rated core flow of 108.5 million lbs/hr. The THERMAL POWER time constant of d 7 seconds is based on the fuel heat transfer dynamics and provides a signal that is proportional to the THERMAL POWER.
| |
| The Average Power Range Monitor Flow Biased Simulated Thermal PowerUpscale Function is required to be OPERABLE in MODE 1 when there is the possibility of generating excessive THERMAL POWER and potentially exceeding the SL applicable to high pressure and core flow conditions (MCPR SL). During MODES 2 and 5, other IRM and APRM Functions provide protection for fuel cladding integrity.
| |
| 2.c. Average Power Range Monitor Fixed Neutron FluxHigh The APRM channels provide the primary indication of neutron flux within the core and respond almost instantaneously to neutron flux increases. The Average Power Range Monitor Fixed Neutron FluxHigh Function is capable of generating a (continued)
| |
| LaSalle 1 and 2 B 3.3.1.1-10 Revision 0
| |
| | |
| RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 2.c. Average Power Range Monitor Fixed Neutron FluxHigh SAFETY ANALYSES, (continued)
| |
| LCO, and APPLICABILITY trip signal to prevent fuel damage or excessive Reactor Coolant System (RCS) pressure. For the overpressurization protection analysis of Reference 2, the Average Power Range Monitor Fixed Neutron FluxHigh Function is assumed to terminate the main steam isolation valve (MSIV) closure event and, along with the safety/relief valves (S/RVs),
| |
| limits the peak reactor pressure vessel (RPV) pressure to less than the ASME Code limits. The control rod drop accident (CRDA) analysis (Ref. 8) takes credit for the Average Power Range Monitor Fixed Neutron FluxHigh Function to terminate the CRDA. The recirculation flow control failure event also credits this function (Ref. 4).
| |
| The APRM System is divided into two groups of channels with three APRM channels inputting to each trip system. The system is designed to allow one channel in each trip system to be bypassed. Any one APRM channel in a trip system can cause the associated trip system to trip. Four channels of Average Power Range Monitor Fixed Neutron FluxHigh with two channels in each trip system arranged in a one-out-of-two logic are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function on a valid signal. In addition, to provide adequate coverage of the entire core, at least 14 LPRM inputs are required for each APRM channel, with at least two LPRM inputs from each of the four axial levels at which the LPRMs are located.
| |
| The Allowable Value is based on the Analytical Limit assumed in the CRDA analyses.
| |
| The Average Power Range Monitor Fixed Neutron FluxHigh Function is required to be OPERABLE in MODE 1 where the potential consequences of the analyzed transients could result in the SLs (e.g., MCPR and RCS pressure) being exceeded. Although the Average Power Range Monitor Fixed Neutron FluxHigh Function is assumed in the CRDA analysis (Ref. 8) that is applicable in MODE 2, the Average Power Range Monitor Neutron FluxHigh, Setdown Function (continued)
| |
| LaSalle 1 and 2 B 3.3.1.1-11 Revision 0
| |
| | |
| RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 2.c. Average Power Range Monitor Fixed Neutron FluxHigh SAFETY ANALYSES, (continued)
| |
| LCO, and APPLICABILITY conservatively bounds the assumed trip and, together with the assumed IRM trips, provides adequate protection.
| |
| Therefore, the Average Power Monitor Fixed Neutron Flux-High Function is not required in MODE 2.
| |
| 2.d. Average Power Range MonitorInop This signal provides assurance that a minimum number of APRMs are OPERABLE. Anytime an APRM mode switch is moved to any position other than Operate, an APRM module is unplugged, or the APRM has too few LPRM inputs ( 14), an inoperative trip signal will be received by the RPS, unless the APRM is bypassed. Since only one APRM in each trip system may be bypassed, only one APRM in each trip system may be inoperable without resulting in an RPS trip signal.
| |
| This Function was not specifically credited in the accident analysis, but it is retained for the overall redundancy and diversity of the RPS as required by the NRC approved licensing basis.
| |
| Four channels of Average Power Range MonitorInop with two channels in each trip system are required to be OPERABLE to ensure that no single failure will preclude a scram from this Function on a valid signal.
| |
| There is no Allowable Value for this Function.
| |
| This Function is required to be OPERABLE in the MODES where the other APRM Functions are required.
| |
| : 3. Reactor Vessel Steam Dome PressureHigh An increase in the RPV pressure during reactor operation compresses the steam voids and results in a positive reactivity insertion. This causes the neutron flux and THERMAL POWER transferred to the reactor coolant to increase, which could challenge the integrity of the fuel cladding and the RCPB. No specific safety analysis takes direct credit for this Function. However, the Reactor (continued)
| |
| LaSalle 1 and 2 B 3.3.1.1-12 Revision 0
| |
| | |
| RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 3. Reactor Vessel Steam Dome PressureHigh (continued)
| |
| SAFETY ANALYSES, LCO, and Vessel Steam Dome PressureHigh Function initiates a scram APPLICABILITY for transients that result in a pressure increase, counteracting the pressure increase by rapidly reducing core power. For the overpressurization protection analysis of Reference 2, the reactor scram (the analyses conservatively assume scram on the Average Power Range Monitor Fixed Neutron FluxHigh signal, not the Reactor Vessel Steam Dome Pressure-High or the Main Steam Isolation ValveClosure signals), along with the S/RVs, limits the peak RPV pressure to less than the ASME Section III Code limits.
| |
| High reactor pressure signals are initiated from four pressure switches that sense reactor pressure. The Reactor Vessel Steam Dome PressureHigh Allowable Value is chosen to provide a sufficient margin to the ASME Section III Code limits during the event.
| |
| Four channels of Reactor Vessel Steam Dome PressureHigh Function, with two channels in each trip system arranged in a one-out-of-two logic, are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function on a valid signal. The Function is required to be OPERABLE in MODES 1 and 2 since the RCS is pressurized and the potential for pressure increase exists.
| |
| : 4. Reactor Vessel Water LevelLow, Level 3 Low RPV water level indicates the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, a reactor scram is initiated at Level 3 to substantially reduce the heat generated in the fuel from fission. The Reactor Vessel Water LevelLow, Level 3 Function is assumed in the analysis of the recirculation line break (Ref. 3). The reactor scram reduces the amount of energy required to be absorbed and, along with the actions of the Emergency Core Cooling Systems (ECCS), ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.1.1-13 Revision 0
| |
| | |
| RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 4. Reactor Vessel Water LevelLow, Level 3 (continued)
| |
| SAFETY ANALYSES, LCO, and Reactor Vessel Water LevelLow, Level 3 signals are APPLICABILITY initiated from four differential pressure transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.
| |
| Four channels of Reactor Vessel Water LevelLow, Level 3 Function, with two channels in each trip system arranged in a one-out-of-two logic, are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function on a valid signal.
| |
| The Reactor Vessel Water LevelLow, Level 3 Allowable Value is selected to ensure that, for transients involving loss of all normal feedwater flow, initiation of the low pressure ECCS at RPV Water Level 1 will not be required.
| |
| The Function is required in MODES 1 and 2 where considerable energy exists in the RCS resulting in the limiting transients and accidents. ECCS initiations at Reactor Vessel Water LevelLow Low, Level 2 and Low Low Low, Level 1 provide sufficient protection for level transients in all other MODES.
| |
| : 5. Main Steam Isolation ValveClosure MSIV closure results in loss of the main turbine and the condenser as a heat sink for the Nuclear Steam Supply System and indicates a need to shut down the reactor to reduce heat generation. Therefore, a reactor scram is initiated on a Main Steam Isolation ValveClosure signal before the MSIVs are completely closed in anticipation of the complete loss of the normal heat sink and subsequent overpressurization transient. However, for the overpressurization protection analysis of Reference 2, the Average Power Range Monitor Fixed Neutron FluxHigh Function, along with the S/RVs, limits the peak RPV pressure to less than the ASME Code limits. That is, the direct scram on position switches for MSIV closure events is not assumed in the overpressurization analysis. Additionally, MSIV closure is assumed in the transients analyzed in Reference 4 (e.g., low steam line pressure, manual closure of MSIVs, high steam line flow).
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.1.1-14 Revision 0
| |
| | |
| RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 5. Main Steam Isolation ValveClosure (continued)
| |
| SAFETY ANALYSES, LCO, and The reactor scram reduces the amount of energy required to APPLICABILITY be absorbed and, along with the actions of the ECCS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46. The reactor scram resulting from an MSIV closure due to a Low Main Steam Line Pressure Isolation also ensures reactor power is less than 25% RTP before reactor pressure decreases below the Safety Limit 2.1.1 Low Pressure Limit of 700 psia.
| |
| MSIV closure signals are initiated from position switches located on each of the eight MSIVs. Each MSIV has two position switches; one inputs to RPS trip system A while the other inputs to RPS trip system B. Thus, each RPS trip system receives an input from eight Main Steam Isolation ValveClosure channels, each consisting of one position switch. The logic for the Main Steam Isolation Valve-Closure Function is arranged such that either the inboard or outboard valve on three or more of the main steam lines (MSLs) must close in order for a scram to occur. In addition, certain combinations of valves closed in two lines will result in a half scram.
| |
| The Main Steam Isolation ValveClosure Allowable Value is specified to ensure that a scram occurs prior to a significant reduction in steam flow, thereby reducing the severity of the subsequent pressure transient.
| |
| Sixteen channels of the Main Steam Isolation ValveClosure Function with eight channels in each trip system are required to be OPERABLE to ensure that no single instrument failure will preclude the scram from this Function on a valid signal. This Function is only required in MODE 1 since, with the MSIVs open and the heat generation rate high, a pressurization transient can occur if the MSIVs close. In MODE 2, the heat generation rate is low enough so that the other diverse RPS functions provide sufficient protection.
| |
| : 6. Drywell PressureHigh High pressure in the drywell could indicate a break in the RCPB. A reactor scram is initiated to minimize the possibility of fuel damage and to reduce the amount of energy being added to the coolant and the drywell. The (continued)
| |
| LaSalle 1 and 2 B 3.3.1.1-15 Revision 68
| |
| | |
| RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 6. Drywell PressureHigh (continued)
| |
| SAFETY ANALYSES, LCO, and Drywell PressureHigh Function is a secondary scram signal APPLICABILITY to Reactor Vessel Water LevelLow, Level 3 for LOCA analysis. This Function was not specifically credited with the Appendix K accident analysis to initiate a reactor trip, but is retained for the overall redundancy and diversity of the RPS as required by the NRC approved licensing basis.
| |
| The reactor scram reduces the amount of energy required to be absorbed and, along with the actions of the ECCS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.
| |
| High drywell pressure signals are initiated from four pressure switches that sense drywell pressure. The Allowable Value was selected to be as low as possible and be indicative of a LOCA inside primary containment.
| |
| Four channels of Drywell PressureHigh Function, with two channels in each trip system, are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function on a valid signal. The Function is required in MODES 1 and 2 where considerable energy exists in the RCS, resulting in the limiting transients and accidents.
| |
| 7.a, b. Scram Discharge Volume Water LevelHigh The SDV receives the water displaced by the motion of the CRD pistons during a reactor scram. Should this volume fill to a point where there is insufficient volume to accept the displaced water, control rod insertion would be hindered.
| |
| Therefore, a reactor scram is initiated when the remaining free volume is still sufficient to accommodate the water from a full core scram. However, even though the two types of Scram Discharge Volume Water LevelHigh Functions are an input to the RPS logic, no credit is taken for a scram initiated from these Functions for any of the design basis accidents or transients analyzed in the UFSAR. However, they are retained to ensure that the RPS remains OPERABLE.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.1.1-16 Revision 0
| |
| | |
| RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 7.a, b. Scram Discharge Volume Water LevelHigh SAFETY ANALYSES, (continued)
| |
| LCO, and APPLICABILITY SDV water level is measured by two diverse methods. The level in each of the two SDVs is measured by two float type level switches and two transmitters and trip units for a total of eight level signals. The outputs of these devices are arranged so that there is a signal from a level switch and a transmitter and trip unit to each RPS logic channel.
| |
| The level measurement instrumentation satisfies the recommendations of Reference 9.
| |
| The Allowable Value is chosen low enough to ensure that there is sufficient volume in the SDV to accommodate the water from a full scram.
| |
| Four channels of each type of Scram Discharge Volume Water LevelHigh Function, with two channels of each type in each trip system, are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from these Functions on a valid signal. These Functions are required in MODES 1 and 2, and in MODE 5 with any control rod withdrawn from a core cell containing one or more fuel assemblies, since these are the MODES and other specified conditions when control rods are withdrawn. At all other times, this Function may be bypassed.
| |
| : 8. Turbine Stop ValveClosure Closure of the TSVs results in the loss of a heat sink that produces reactor pressure, neutron flux, and heat flux transients that must be limited. Therefore, a reactor scram is initiated at the start of TSV closure in anticipation of the transients that would result from the closure of these valves. The Turbine Stop ValveClosure is the primary scram signal for the turbine trip event analyzed in Reference 4. For this event, the reactor scram reduces the amount of energy required to be absorbed and, along with the actions of the End of Cycle Recirculation Pump Trip (EOC-RPT) System, ensures that the MCPR SL is not exceeded.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.1.1-17 Revision 0
| |
| | |
| RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 8. Turbine Stop ValveClosure (continued)
| |
| SAFETY ANALYSES, LCO, and Turbine Stop ValveClosure signals are initiated by valve APPLICABILITY stem position switches at each stop valve. Two switches are associated with each stop valve. One of the two switches provides input to RPS trip system A; the other, to RPS trip system B. Thus, each RPS trip system receives an input from four Turbine Stop ValveClosure channels, each consisting of one valve stem position switch. The logic for the Turbine Stop ValveClosure Function is such that three or more TSVs must be closed to produce a scram. In addition, certain combinations of two valves closed will result in a half scram.
| |
| This Function must be enabled at THERMAL POWER t 25% RTP.
| |
| This is normally accomplished automatically by pressure switches sensing turbine first stage pressure; therefore, opening the turbine bypass valves may affect the OPERABILITY of this Function.
| |
| The Turbine Stop ValveClosure Allowable Value is selected to detect imminent TSV closure thereby reducing the severity of the subsequent pressure transient.
| |
| Eight channels of Turbine Stop ValveClosure Function, with four channels in each trip system, are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function even if one TSV should fail to close. This Function is required, consistent with analysis assumptions, whenever THERMAL POWER is t 25% RTP.
| |
| This Function is not required when THERMAL POWER is
| |
| 25% RTP since the Reactor Vessel Steam Dome PressureHigh and the Average Power Range Monitor Fixed Neutron FluxHigh Functions are adequate to maintain the necessary safety margins.
| |
| : 9. Turbine Control Valve Fast Closure, Trip Oil PressureLow Fast closure of the TCVs results in the loss of a heat sink that produces reactor pressure, neutron flux, and heat flux transients that must be limited. Therefore, a reactor scram is initiated on TCV fast closure in anticipation of the (continued)
| |
| LaSalle 1 and 2 B 3.3.1.1-18 Revision 0
| |
| | |
| RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 9. Turbine Control Valve Fast Closure, Trip Oil SAFETY ANALYSES, PressureLow (continued)
| |
| LCO, and APPLICABILITY transients that would result from the closure of these valves. The Turbine Control Valve Fast Closure, Trip Oil PressureLow Function is the primary scram signal for the generator load rejection event analyzed in Reference 4. For this event, the reactor scram reduces the amount of energy required to be absorbed and, along with the actions of the EOC-RPT System, ensures that the MCPR SL is not exceeded.
| |
| Turbine Control Valve Fast Closure, Trip Oil PressureLow signals are initiated by the EHC fluid pressure to each control valve. There is one pressure switch associated with each control valve, the signal from each switch being assigned to a separate RPS logic channel. This Function must be enabled at THERMAL POWER t 25% RTP. This is accomplished automatically by pressure switches sensing turbine first stage pressure; therefore, opening the turbine bypass valves may affect the OPERABILITY of this Function.
| |
| The Turbine Control Valve Fast Closure, Trip Oil Pressure-Low Allowable Value is selected high enough to detect imminent TCV fast closure.
| |
| Four channels of Turbine Control Valve Fast Closure, Trip Oil PressureLow Function, with two channels in each trip system arranged in a one-out-of-two logic, are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function on a valid signal. This Function is required, consistent with the analysis assumptions, whenever THERMAL POWER is t 25% RTP. This Function is not required when THERMAL POWER is 25% RTP since the Reactor Vessel Steam Dome PressureHigh and the Average Power Range Monitor Fixed Neutron FluxHigh Functions are adequate to maintain the necessary safety margins.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.1.1-19 Revision 0
| |
| | |
| RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 10. Reactor Mode SwitchShutdown Position SAFETY ANALYSES, LCO, and The Reactor Mode SwitchShutdown Position Function provides APPLICABILITY signals, via the manual scram logic channels, that are (continued) redundant to the automatic protective instrumentation channels and provide manual reactor trip capability. This Function was not specifically credited in the accident analysis, but it is retained for the overall redundancy and diversity of the RPS as required by the NRC approved licensing basis.
| |
| The reactor mode switch is a single switch with four channels (one from each of the four independent banks of contacts), each of which inputs into one of the RPS logic channels.
| |
| There is no Allowable Value for this Function since the channels are mechanically actuated based solely on reactor mode switch position.
| |
| Four channels of Reactor Mode SwitchShutdown Position Function, with two channels in each trip system, are available and required to be OPERABLE. The Reactor Mode SwitchShutdown Position Function is required to be OPERABLE in MODES 1 and 2, and in MODE 5 with any control rod withdrawn from a core cell containing one or more fuel assemblies, since these are the MODES and other specified conditions when control rods are withdrawn.
| |
| : 11. Manual Scram The Manual Scram push button channels provide signals, via the manual scram logic channels, to each of the four RPS logic channels that are redundant to the automatic protective instrumentation channels and provide manual reactor trip capability. This Function was not specifically credited in the accident analysis, but it is retained for the overall redundancy and diversity of the RPS as required by the NRC approved licensing basis.
| |
| There is one Manual Scram push button channel for each of the four RPS logic channels. In order to cause a scram it is necessary that at least one channel in each trip system be actuated.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.1.1-20 Revision 0
| |
| | |
| RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 11. Manual Scram (continued)
| |
| SAFETY ANALYSES, LCO, and There is no Allowable Value for this Function since the APPLICABILITY channels are mechanically actuated based solely on the position of the push buttons.
| |
| Four channels of Manual Scram with two channels in each trip system arranged in a one-out-of-two logic, are available and required to be OPERABLE in MODES 1 and 2, and in MODE 5 with any control rod withdrawn from a core cell containing one or more fuel assemblies, since these are the MODES and other specified conditions when control rods are withdrawn.
| |
| ACTIONS Note 1 has been provided to modify the ACTIONS related to RPS instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable RPS instrumentation channels provide appropriate compensatory measures for separate, inoperable channels. As such, Note 1 has been provided that allows separate Condition entry for each inoperable RPS instrumentation channel.
| |
| Note 2 has been provided to modify the ACTIONS for the RPS instrumentation functions of APRM Flow Biased Simulated Thermal PowerUpscale (Function 2.b) and APRM Fixed Neutron FluxHigh (Function 2.c) when they are inoperable due to failure of SR 3.3.1.1.2 and gain adjustments are necessary.
| |
| Note 2 allows entry into associated Conditions and Required Actions to be delayed for up to 2 hours if the APRM is indicating a lower power value than the calculated power (i.e., the gain adjustment factor (GAF) is high (non-conservative)). The GAF for any channel is defined as (continued)
| |
| LaSalle 1 and 2 B 3.3.1.1-21 Revision 79
| |
| | |
| RPS Instrumentation B 3.3.1.1 BASES ACTIONS the power value determined by the heat balance divided by (continued) the APRM reading for that channel. Upon completion of the gain adjustment, or expiration of the allowed time, the channel must be returned to OPERABLE status or the applicable Condition entered and the Required Actions taken.
| |
| This Note is based on the time required to perform gain adjustments on multiple channels.
| |
| A.1 and A.2 Because of the diversity of sensors available to provide trip signals and the redundancy of the RPS design, an allowable out of service time of 12 hours has been shown to be acceptable (Ref. 10) to permit restoration of any inoperable required channel to OPERABLE status. However, this out of service time is only acceptable provided the associated Function's inoperable channel is in one trip system and the Function still maintains RPS trip capability (refer to Required Actions B.1, B.2, and C.1 Bases).
| |
| Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.
| |
| If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel or the associated trip system must be placed in the tripped condition per Required Actions A.1 and A.2. Placing the inoperable channel in trip (or the associated trip system in trip) would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue. Alternately, if it is not desired to place the channel (or trip system) in trip (e.g.,
| |
| as in the case where placing the inoperable channel in trip would result in a scram or recirculation pump trip (RPT)),
| |
| Condition D must be entered and its Required Action taken.
| |
| B.1 and B.2 Condition B exists when, for any one or more Functions, at least one required channel is inoperable in each trip system. In this condition, provided at least one channel per trip system is OPERABLE, the RPS still maintains trip capability for that Function, but cannot accommodate a single failure in either trip system.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.1.1-22 Revision 89
| |
| | |
| RPS Instrumentation B 3.3.1.1 BASES ACTIONS B.1 and B.2 (continued)
| |
| Required Actions B.1 and B.2 limit the time the RPS scram logic for any Function would not accommodate single failure in both trip systems (e.g., one-out-of-one and one-out-of-one arrangement for a typical four channel Function). The reduced reliability of this logic arrangement was not evaluated in Reference 10 for the 12 hour Completion Time. Within the 6 hour allowance, the associated Function will have all required channels either OPERABLE or in trip (or in any combination) in one trip system.
| |
| Completing one of these Required Actions restores RPS to an equivalent reliability level as that evaluated in Reference 10, which justified a 12 hour allowable out of service time as presented in Condition A. The trip system in the more degraded state should be placed in trip or, alternatively, all the inoperable channels in that trip system should be placed in trip (e.g., a trip system with two inoperable channels could be in a more degraded state than a trip system with four inoperable channels, if the two inoperable channels are in the same Function while the four inoperable channels are all in different Functions). The decision as to which trip system is in the more degraded state should be based on prudent judgment and current plant conditions (i.e., what MODE the plant is in). If this action would result in a scram or RPT, it is permissible to place the other trip system or its inoperable channels in trip.
| |
| The 6 hour Completion Time is judged acceptable based on the remaining capability to trip, the diversity of the sensors available to provide the trip signals, the low probability of extensive numbers of inoperabilities affecting all diverse Functions, and the low probability of an event requiring the initiation of a scram. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.
| |
| Alternately, if it is not desired to place the inoperable channels (or one trip system) in trip (e.g., as in the case where placing the inoperable channel or associated trip system in trip would result in a scram or RPT), Condition D must be entered and its Required Action taken.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.1.1-23 Revision 89
| |
| | |
| RPS Instrumentation B 3.3.1.1 BASES ACTIONS C.1 (continued)
| |
| Required Action C.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same trip system for the same Function result in the Function not maintaining RPS trip capability.
| |
| A Function is considered to be maintaining RPS trip capability when sufficient channels are OPERABLE or in trip (or the associated trip system is in trip), such that both trip systems will generate a trip signal from the given Function on a valid signal. For the typical Function with one-out-of-two taken twice logic and the IRM and APRM Functions, this would require both trip systems to have one channel OPERABLE or in trip (or the associated trip system in trip). For Function 5 (Main Steam Isolation Valve-Closure), this would require both trip systems to have each channel associated with the MSIVs in three MSLs (not necessarily the same MSLs for both trip systems),
| |
| OPERABLE or in trip (or the associated trip system in trip).
| |
| For Function 8 (Turbine Stop ValveClosure), this would require both trip systems to have three channels, each OPERABLE or in trip (or the associated trip system in trip).
| |
| The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. The 1 hour Completion Time is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.
| |
| D.1 Required Action D.1 directs entry into the appropriate Condition referenced in Table 3.3.1.1-1. The applicable Condition specified in the Table is Function and MODE or other specified condition dependent and may change as the Required Action of a previous Condition is completed. Each time an inoperable channel has not met any Required Action of Condition A, B, or C, and the associated Completion Time has expired, Condition D will be entered for that channel and provides for transfer to the appropriate subsequent Condition.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.1.1-24 Revision 0
| |
| | |
| RPS Instrumentation B 3.3.1.1 BASES ACTIONS E.1, F.1, and G.1 (continued)
| |
| If the channel(s) is not restored to OPERABLE status or placed in trip (or the associated trip system placed in trip) within the allowed Completion Time, the plant must be placed in a MODE or other specified condition in which the LCO does not apply. The Completion Times are reasonable, based on operating experience, to reach the specified condition from full power conditions in an orderly manner and without challenging plant systems. In addition, the Completion Time of Required Action E.1 is consistent with the Completion Time provided in LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)."
| |
| H.1 If the channel(s) is not restored to OPERABLE status or placed in trip (or the associated trip system placed in trip) within the allowed Completion Time, the plant must be placed in a MODE or other specified condition in which the LCO does not apply. This is done by immediately initiating action to fully insert all insertable control rods in core cells containing one or more fuel assemblies. Control rods in core cells containing no fuel assemblies do not affect the reactivity of the core and are, therefore, not required to be inserted. Action must continue until all insertable control rods in core cells containing one or more fuel assemblies are fully inserted.
| |
| SURVEILLANCE As noted at the beginning of the SRs, the SRs for each RPS REQUIREMENTS instrumentation Function are located in the SRs column of Table 3.3.1.1-1.
| |
| The Surveillances are modified by a Note to indicate that, when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours, provided the associated Function maintains RPS trip capability. Upon completion of the Surveillance, or expiration of the 6 hour allowance, the channel must be returned to OPERABLE status or the applicable Condition (continued)
| |
| LaSalle 1 and 2 B 3.3.1.1-25 Revision 0
| |
| | |
| RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE entered and Required Actions taken. This Note is based on REQUIREMENTS the RPS reliability analysis (Ref. 10) assumption of the (continued) average time required to perform channel surveillance. That analysis demonstrated that the 6 hour testing allowance does not significantly reduce the probability that the RPS will trip when necessary.
| |
| SR 3.3.1.1.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.
| |
| Significant deviations between the instrument channels could be an indication of excessive instrument drift on one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
| |
| Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.
| |
| SR 3.3.1.1.2 To ensure that the APRMs are accurately indicating the true core average power, the APRMs are adjusted to the reactor power calculated from a heat balance if the heat balance calculated reactor power exceeds the APRM channel output by more than 2% RTP.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.1.1-26 Revision 79
| |
| | |
| RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.2 (continued)
| |
| REQUIREMENTS This Surveillance does not preclude making APRM channel adjustments, if desired, when the heat balance calculated reactor power is less than the APRM channel output. To provide close agreement between the APRM indicated power and to preserve operating margin, the APRM channels are normally adjusted to within +/- 2% of the heat balance calculated reactor power. However, this agreement is not required for OPERABILITY when APRM output indicates a higher reactor power than the heat balance calculated reactor power.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| An allowance is provided that requires the SR to be performed only at t 25% RTP because it is difficult to accurately maintain APRM indication of core THERMAL POWER consistent with a heat balance when 25% RTP. At low power levels, a high degree of accuracy is unnecessary because of the inherent margin to thermal limits (MCPR and APLHGR). At t 25% RTP, the Surveillance is required to have been satisfactorily performed in accordance with SR 3.0.2. A Note is provided which allows an increase in THERMAL POWER above 25% if the Frequency is not met per SR 3.0.2. In this event, the SR must be performed within 12 hours after reaching or exceeding 25% RTP. Twelve hours is based on operating experience and in consideration of providing a reasonable time in which to complete the SR.
| |
| SR 3.3.1.1.3 The Average Power Range Monitor Flow Biased Simulated Thermal PowerUpscale Function uses the recirculation loop drive flows to vary the trip setpoint. This SR ensures that the total loop drive flow signals from the flow unit used to vary the setpoint are appropriately compared to a calibrated flow signal and therefore the APRM Function accurately reflects the required setpoint as a function of flow. Each flow signal from the respective flow unit must be d 100% of the calibrated flow signal. If the flow unit signal is not within the limit, one required APRM that receives an input from the inoperable flow unit must be declared inoperable.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.1.1-27 Revision 79
| |
| | |
| RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.3 (continued)
| |
| REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.1.1.4 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the channel will perform the intended function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.
| |
| Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.
| |
| As noted, SR 3.3.1.1.4 is not required to be performed when entering MODE 2 from MODE 1 since testing of the MODE 2 required IRM and APRM Functions cannot be performed in MODE 1 without utilizing jumpers, lifted leads, or movable links. This allows entry into MODE 2 if the Surveillance Frequency is not met per SR 3.0.2. In this event, the SR must be performed within 24 hours after entering MODE 2 from MODE 1. Twenty-four hours is based on operating experience and in consideration of providing a reasonable time in which to complete the SR.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.1.1.5 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the channel will perform the intended Function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the (continued)
| |
| LaSalle 1 and 2 B 3.3.1.1-28 Revision 79
| |
| | |
| RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.5 (continued)
| |
| REQUIREMENTS change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. In accordance with Reference 10, the scram contactors must be tested as part of the Manual Scram Function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.1.1.6 and SR 3.3.1.1.7 These Surveillances are established to ensure that no gaps in neutron flux indication exist from subcritical to power operation for monitoring core reactivity status.
| |
| The overlap between SRMs and IRMs is required to be demonstrated to ensure that reactor power will not be increased into a region without adequate neutron flux indication. This is required prior to fully withdrawing SRMs since indication is being transitioned from the SRMs to the IRMs.
| |
| The overlap between IRMs and APRMs is of concern when reducing power into the IRM range. On power increases, the system design will prevent further increases (initiate a rod block) if adequate overlap is not maintained. The IRM/APRM and SRM/IRM overlap are acceptable if a 1/2 decade overlap exists.
| |
| As noted, SR 3.3.1.1.7 is only required to be met during entry into MODE 2 from MODE 1. That is, after the overlap requirement has been met and indication has transitioned to the IRMs, maintaining overlap is not required (APRMs may be reading downscale once in MODE 2).
| |
| If overlap for a group of channels is not demonstrated (e.g., IRM/APRM overlap), the reason for the failure of the Surveillance should be determined and the appropriate (continued)
| |
| LaSalle 1 and 2 B 3.3.1.1-29 Revision 79
| |
| | |
| RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.6 and SR 3.3.1.1.7 (continued)
| |
| REQUIREMENTS channel(s) declared inoperable. Only those appropriate channel(s) that are required in the current MODE or condition should be declared inoperable.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.1.1.8 LPRM gain settings are determined from the local flux profiles measured by the Traversing Incore Probe (TIP)
| |
| System. This establishes the relative local flux profile for appropriate representative input to the APRM System.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. SR 3.3.1.1.8 also ensures the operability of the OPRM system (specification 3.3.1.3).
| |
| SR 3.3.1.1.9 and SR 3.3.1.1.12 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the channel will perform the intended function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at lease once per refueling interval with applicable extensions. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.1.1-30 Revision 51
| |
| | |
| RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.10, SR 3.3.1.1.11, and SR 3.3.1.1.13 REQUIREMENTS (continued) A CHANNEL CALIBRATION is a complete check of the instrument loop, including associated trip unit, and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.
| |
| Note 1 of SR 3.3.1.1.11 and SR 3.3.1.1.13 states that neutron detectors are excluded from CHANNEL CALIBRATION because of the difficulty of simulating a meaningful signal.
| |
| Changes in neutron detector sensitivity are compensated for by performing the calorimetric calibration (SR 3.3.1.1.2) and the LPRM calibration against the TIPs (SR 3.3.1.1.8). A second Note to SR 3.3.1.1.11 and SR 3.3.1.1.13 is provided that requires the APRM and IRM SRs to be performed within 24 hours of entering MODE 2 from MODE 1. Testing of the MODE 2 APRM and IRM Functions cannot be performed in MODE 1 without utilizing jumpers, lifted leads, or movable links. This Note allows entry into MODE 2 from MODE 1 if the associated Frequency is not met per SR 3.0.2.
| |
| Twenty-four hours is based on operating experience and in consideration of providing a reasonable time in which to complete the SR. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| For Function 2.b, SR 3.3.1.1.11 is modified by two Notes.
| |
| The first Note requires evaluation of channel performance (continued)
| |
| LaSalle 1 and 2 B 3.3.1.1-31 Revision 51
| |
| | |
| RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.10, SR 3.3.1.1.11, SR 3.3.1.1.13 (continued)
| |
| REQUIREMENTS for the condition where the as-found setting for the channel setpoint is outside its as-found tolerance but conservative with respect to the Allowable Value. Evaluation of channel performance will verify that the channel will continue to behave in accordance with safety analysis assumptions and the channel performance assumptions in the setpoint methodology. The purpose of the assessment is to ensure confidence in the channel performance prior to returning the channel to service. For channels determined to be OPERABLE but degraded, after returning the channel to service the performance of these channels will be evaluated under the plant Corrective Action Program. Entry into the Corrective Action Program will ensure required review and documentation of the condition. The second Note requires that the as-left setting for the channel be within the as-left tolerance of the nominal trip setpoint (NTSP). Where a setpoint more conservative than the NTSP is used in the plant surveillance procedures, the as-left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint. This will ensure that sufficient margin to the Safety Limit and/or Analytical Limit is maintained. If the as-left channel setting cannot be returned to a setting within the as-left tolerance of the NTSP, then the channel shall be declared inoperable.
| |
| SR 3.3.1.1.14 The Average Power Range Monitor Flow Biased Simulated Thermal PowerUpscale Function uses an electronic filter circuit to generate a signal proportional to the core THERMAL POWER from the APRM neutron flux signal. This filter circuit is representative of the fuel heat transfer dynamics that produce the relationship between the neutron flux and the core THERMAL POWER. The filter time constant must be verified to ensure that the channel is accurately reflecting the desired parameter.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.1.1-32 Revision 51
| |
| | |
| RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.15 REQUIREMENTS (continued) The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required trip logic for a specific channel. The functional testing of control rods, in LCO 3.1.3, "Control Rod OPERABILITY," and SDV vent and drain valves, in LCO 3.1.8, "Scram Discharge Volume (SDV) Vent and Drain Valves," overlaps this Surveillance to provide complete testing of the assumed safety function.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.1.1.16 This SR ensures that scrams initiated from the Turbine Stop ValveClosure and Turbine Control Valve Fast Closure, Trip Oil PressureLow Functions will not be inadvertently bypassed when THERMAL POWER is t 25% RTP. This involves calibration of the bypass channels. Adequate margins for the instrument setpoint methodology are incorporated into the Allowable Value and the actual setpoint. Because main turbine bypass flow can affect this setpoint nonconservatively (THERMAL POWER is derived from turbine first stage pressure), the main turbine bypass valves must remain closed during in-service calibration at THERMAL POWER t 25% RTP, if performing the calibration using actual turbine first stage pressure, to ensure that the calibration is valid.
| |
| If any bypass channel setpoint is nonconservative (i.e., the Functions are bypassed at t 25% RTP, either due to open main turbine bypass valve(s) or other reasons), then the affected Turbine Stop ValveClosure and Turbine Control Valve Fast Closure, Trip Oil PressureLow Functions are considered inoperable. Alternatively, the bypass channel can be placed in the conservative condition (nonbypass). If placed in the nonbypass condition, this SR is met and the channel is considered OPERABLE.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.1.1-33 Revision 51
| |
| | |
| RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.16 (continued)
| |
| REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.1.1.17 This SR ensures that the individual channel response times are less than or equal to the maximum values assumed in the accident analysis. The RPS RESPONSE TIME acceptance criteria are included in Reference 11.
| |
| RPS RESPONSE TIME may be verified by actual response time measurements in any series of sequential, overlapping, or total channel measurements. However, the sensor for Function 4 is allowed to be excluded from specific RPS RESPONSE TIME measurement if the conditions of Reference 12 are satisfied. If these conditions are satisfied, sensor response time may be allocated based on either assumed design sensor response time or the manufacturers stated design response time. When the requirements of Reference 12 are not satisfied, sensor response time must be measured.
| |
| Also, regardless of whether or not the sensor response time is measured, the response time for the remaining portion of the channel, including the trip unit and relay logic, is required to be measured. The sensor and relay/logic components for Function 3 are assumed to operate at the design response time and therefore, are excluded from specific RPS RESPONSE TIME measurement. This allowance is supported by References 12 and 14, which determined that significant degradation of the channel response time can be detected during performance of other Technical Specification surveillance requirements. In addition, the response time of the limit switches for Function 8 may be assumed to be the design limit switch response time and therefore, are excluded from the RPS RESPONSE TIME testing. This is allowed, as documented in Reference 13, since the actual measurement of the limit switch response time is not practicable as this test is done during the refueling outage when the turbine stop valves are fully closed, and thus the limit switch in the RPS circuitry is open. The design limit switch response time is 10 ms.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.1.1-34 Revision 51
| |
| | |
| RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.17 (continued)
| |
| REQUIREMENTS As noted (Note 1), neutron detectors are excluded from RPS RESPONSE TIME testing. The principles of detector operation virtually ensure an instantaneous response time. Note 3 modifies the starting point of the RPS RESPONSE TIME test for Function 9, since this starting point (start of turbine control valve fast closure) corresponds to safety analysis assumptions.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 7.2.
| |
| : 2. UFSAR, Section 5.2.2.
| |
| : 3. UFSAR, Section 6.3.3.
| |
| : 4. UFSAR, Chapter 15.
| |
| : 5. UFSAR, Section 15.4.1.
| |
| : 6. NEDO-23842, "Continuous Control Rod Withdrawal in the Startup Range," April 18, 1978.
| |
| : 7. UFSAR, Section 7.6.3.3.
| |
| : 8. UFSAR, Section 15.4.9.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.1.1-35 Revision 51
| |
| | |
| RPS Instrumentation B 3.3.1.1 BASES REFERENCES 9. Letter, P. Check (NRC) to G. Lainas (NRC), "BWR Scram (continued) Discharge System Safety Evaluation," December 1, 1980.
| |
| : 10. NEDC-30851-P-A, "Technical Specification Improvement Analyses for BWR Reactor Protection System,"
| |
| March 1988.
| |
| : 11. Technical Requirements Manual.
| |
| : 12. NEDO-32291-A, "System Analyses for the Elimination of Selected Response Time Testing Requirements," October 1995.
| |
| : 13. Letter, W. G. Guldemond (NRC) to C. Reed (ComEd),
| |
| dated January 28, 1987.
| |
| : 14. NEDO-32291-A Supplement 1, System Analysis for the Elimination of Selected Response Time Testing Requirements, October 1999.
| |
| LaSalle 1 and 2 B 3.3.1.1-36 Revision 47
| |
| | |
| SRM Instrumentation B 3.3.1.2 B 3.3 INSTRUMENTATION B 3.3.1.2 Source Range Monitor (SRM) Instrumentation BASES BACKGROUND The SRMs provide the operator with information relative to the neutron level at very low flux levels in the core. As such, the SRM indication is used by the operator to monitor the approach to criticality and to determine when criticality is achieved. The SRMs are not fully withdrawn until the count rate is greater than a minimum allowed count rate (a control rod block is set at this condition). After SRM to intermediate range monitor (IRM) overlap is demonstrated (as required by SR 3.3.1.1.6), the SRMs are normally fully withdrawn from the core.
| |
| The SRM subsystem of the Neutron Monitoring System (NMS) consists of four channels. Each of the SRM channels can be bypassed, but only one at any given time, by the operation of a bypass switch. Each channel includes one detector that can be physically positioned in the core. Each detector assembly consists of a miniature fission chamber with associated cabling, signal conditioning equipment, and electronics associated with the various SRM functions. The signal conditioning equipment converts the current pulses from the fission chamber to analog DC currents that correspond to the count rate. Each channel also includes indication, alarm, and control rod blocks. However, this LCO specifies OPERABILITY requirements only for the monitoring and indication functions of the SRMs.
| |
| During refueling, shutdown, and low power operations, the primary indication of neutron flux levels is provided by the SRMs or special movable detectors connected to the normal SRM circuits. The SRMs provide monitoring of reactivity changes during fuel or control rod movement and give the control room operator early indication of unexpected subcritical multiplication that could be indicative of an approach to criticality.
| |
| APPLICABLE Prevention and mitigation of prompt reactivity excursions SAFETY ANALYSES during refueling and low power operation are provided by LCO 3.9.1, "Refueling Equipment Interlocks"; LCO 3.1.1, "SHUTDOWN MARGIN (SDM)"; LCO 3.3.1.1, "Reactor Protection (continued)
| |
| LaSalle 1 and 2 B 3.3.1.2-1 Revision 0
| |
| | |
| SRM Instrumentation B 3.3.1.2 BASES APPLICABLE System (RPS) Instrumentation," Intermediate Range Monitor SAFETY ANALYSES (IRM) Neutron Flux High and Average Power Range Monitor (continued) (APRM) Neutron FluxHigh, Setdown Functions; and LCO 3.3.2.1, "Control Rod Block Instrumentation."
| |
| The SRMs have no safety function and are not assumed to function during any UFSAR design basis accident or transient analysis. However, the SRMs provide the only on scale monitoring of neutron flux levels during startup and refueling. Therefore, they are being retained in the Technical Specifications.
| |
| LCO During startup in MODE 2, three of the four SRM channels are required to be OPERABLE to monitor the reactor flux level prior to and during control rod withdrawal, to monitor subcritical multiplication and reactor criticality, and to monitor neutron flux level and reactor period until the flux level is sufficient to maintain the IRM on Range 3 or above.
| |
| All channels but one are required in order to provide a representation of the overall core response during those periods when reactivity changes are occurring throughout the core.
| |
| In MODES 3 and 4, with the reactor shut down, two SRM channels provide redundant monitoring of flux levels in the core.
| |
| In MODE 5, during a spiral offload or reload, an SRM outside the fueled region will no longer be required to be OPERABLE, since it is not capable of monitoring neutron flux in the fueled region of the core. Thus, CORE ALTERATIONS are allowed in a quadrant with no OPERABLE SRM in an adjacent quadrant, as provided in the Table 3.3.1.2-1, footnote (b),
| |
| requirement that the bundles being spiral reloaded or spiral offloaded are all in a single fueled region containing at least one OPERABLE SRM is met. Spiral reloading and offloading encompass reloading or offloading a cell on the edges of a continuous fueled region (the cell can be reloaded or offloaded in any sequence).
| |
| In nonspiral routine operations, two SRMs are required to be OPERABLE to provide redundant monitoring of reactivity changes occurring in the reactor core. Because of the local nature of reactivity changes during refueling, adequate (continued)
| |
| LaSalle 1 and 2 B 3.3.1.2-2 Revision 0
| |
| | |
| SRM Instrumentation B 3.3.1.2 BASES LCO coverage is provided by requiring one SRM to be OPERABLE in (continued) the quadrant of the reactor core where CORE ALTERATIONS are being performed and the other SRM to be OPERABLE in an adjacent quadrant containing fuel. These requirements ensure that the reactivity of the core will be continuously monitored during CORE ALTERATIONS.
| |
| Special movable detectors, according to Table 3.3.1.2-1, footnote (c), may be used in MODE 5 in place of the normal SRM nuclear detectors. These special detectors must be connected to the normal SRM circuits in the NMS such that the applicable neutron flux indication can be generated.
| |
| These special detectors provide more flexibility in monitoring reactivity changes during fuel loading, since they can be positioned anywhere within the core during refueling. They must still meet the location requirements of SR 3.3.1.2.2, and all other required SRs for SRMs.
| |
| For an SRM channel to be considered OPERABLE, it must be providing neutron flux monitoring indication. In addition, in MODE 5, the required SRMs must be inserted to the normal operating level and be providing continuous visual indication in the control room.
| |
| APPLICABILITY The SRMs are required to be OPERABLE in MODE 2 prior to the IRMs being on scale on Range 3, and MODES 3, 4, and 5, to provide for neutron monitoring. In MODE 1, the APRMs provide adequate monitoring of reactivity changes in the core; therefore, the SRMs are not required. In MODE 2, with IRMs on Range 3 or above, the IRMs provide adequate monitoring and the SRMs are not required.
| |
| ACTIONS A.1 and B.1 In MODE 2, with the IRMs on Range 2 or below, SRMs provide the means of monitoring core reactivity and criticality.
| |
| With any number of the required SRMs inoperable, the ability to monitor is degraded. Therefore, a limited time is allowed to restore the inoperable channels to OPERABLE status.
| |
| Providing that at least one SRM remains OPERABLE, Required Action A.1 allows 4 hours to restore the required SRMs to OPERABLE status. This is a reasonable time since there is (continued)
| |
| LaSalle 1 and 2 B 3.3.1.2-3 Revision 0
| |
| | |
| SRM Instrumentation B 3.3.1.2 BASES ACTIONS A.1 and B.1 (continued) adequate capability remaining to monitor the core, limited risk of an event during this time, and sufficient time to take corrective actions to restore the required SRMs to OPERABLE status or to establish alternate IRM monitoring capability. During this time, control rod withdrawal and power increase are not precluded by this Required Action.
| |
| Having the ability to monitor the core with at least one SRM, proceeding to IRM Range 3 or greater (with overlap required by SR 3.3.1.1.6) and thereby exiting the Applicability of this LCO, is acceptable for ensuring adequate core monitoring and allowing continued operation.
| |
| With three required SRMs inoperable, Required Action B.1 allows no positive changes in reactivity (control rod withdrawal must be immediately suspended) due to the inability to monitor the changes. Required Action A.1 still applies and allows 4 hours to restore monitoring capability prior to requiring control rod insertion. This allowance is based on the limited risk of an event during this time, provided that no control rod withdrawals are allowed, and the desire to concentrate efforts on repair, rather than to immediately shut down, with no SRMs OPERABLE.
| |
| C.1 In MODE 2 with the IRMs on Range 2 or below, if the required number of SRMs is not restored to OPERABLE status within the allowed Completion Time, the reactor shall be placed in MODE 3. With all control rods fully inserted, the core is in its least reactive state with the most margin to criticality. The allowed Completion Time of 12 hours is reasonable, based on operating experience, to reach MODE 3 in an orderly manner and without challenging plant systems.
| |
| D.1 and D.2 With one or more required SRM channels inoperable in MODE 3 or 4, the neutron flux monitoring capability is degraded or nonexistent. The requirement to fully insert all insertable control rods ensures that the reactor will be at its minimum reactivity level while no neutron monitoring capability is available. Placing the reactor mode switch in the shutdown (continued)
| |
| LaSalle 1 and 2 B 3.3.1.2-4 Revision 0
| |
| | |
| SRM Instrumentation B 3.3.1.2 BASES ACTIONS D.1 and D.2 (continued) position prevents subsequent control rod withdrawal by maintaining a control rod block. The allowed Completion Time of 1 hour is sufficient to accomplish the Required Action, and takes into account the low probability of an event requiring the SRM occurring during this time.
| |
| E.1 and E.2 With one or more required SRMs inoperable in MODE 5, the capability to detect local reactivity changes in the core during refueling is degraded. CORE ALTERATIONS must be immediately suspended, and action must be immediately initiated to fully insert all insertable control rods in core cells containing one or more fuel assemblies.
| |
| Suspending CORE ALTERATIONS prevents the two most probable causes of reactivity changes, fuel loading and control rod withdrawal, from occurring. Inserting all insertable control rods ensures that the reactor will be at its minimum reactivity, given that fuel is present in the core.
| |
| Suspension of CORE ALTERATIONS shall not preclude completion of the movement of a component to a safe, conservative position.
| |
| Action (once required to be initiated) to insert control rods must continue until all insertable rods in core cells containing one or more fuel assemblies are inserted.
| |
| SURVEILLANCE As noted at the beginning of the SRs, the SRs for each SRM REQUIREMENTS Applicable MODE or other specified condition are found in the SRs column of Table 3.3.1.2-1.
| |
| SR 3.3.1.2.1 and SR 3.3.1.2.3 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to the same parameter indicated on other similar channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations (continued)
| |
| LaSalle 1 and 2 B 3.3.1.2-5 Revision 0
| |
| | |
| SRM Instrumentation B 3.3.1.2 BASES SURVEILLANCE SR 3.3.1.2.1 and SR 3.3.1.2.3 (continued)
| |
| REQUIREMENTS between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
| |
| Agreement criteria are determined by the plant staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.
| |
| SR 3.3.1.2.2 To provide adequate coverage of potential reactivity changes in the core, one SRM is required to be OPERABLE in the quadrant where CORE ALTERATIONS are being performed, and the other OPERABLE SRM must be in an adjacent quadrant containing fuel. Note 1 states that this SR is required to be met only during CORE ALTERATIONS. It is not required to be met at other times in MODE 5 since core reactivity changes are not occurring. This Surveillance consists of a review of plant logs to ensure that SRMs required to be OPERABLE for given CORE ALTERATIONS are, in fact, OPERABLE.
| |
| In the event that only one SRM is required to be OPERABLE, per Table 3.3.1.2-1, footnote (b), only the a. portion of this SR is effectively required. Note 2 clarifies that more than one of the three requirements can be met by the same OPERABLE SRM. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.1.2-6 Revision 51
| |
| | |
| SRM Instrumentation B 3.3.1.2 BASES SURVEILLANCE SR 3.3.1.2.4 REQUIREMENTS (continued) This Surveillance consists of a verification of the SRM instrument readout to ensure that the SRM reading is greater than a specified minimum count rate with the detector fully inserted. This ensures that the detectors are indicating count rates indicative of neutron flux levels within the core. With few fuel assemblies loaded, the SRMs will not have a high enough count rate to satisfy the SR. Therefore, allowances are made for loading sufficient "source" material, in the form of irradiated fuel assemblies, to establish the minimum count rate.
| |
| To accomplish this, the SR is modified by a Note that states that the count rate is not required to be met on an SRM that has less than or equal to four fuel assemblies adjacent to the SRM and no other fuel assemblies are in the associated core quadrant. With four or less fuel assemblies loaded around each SRM and no other fuel assemblies in the associated quadrant, even with a control rod withdrawn the configuration will not be critical. When movable detectors are being used, detector location must be selected such that each group of fuel assemblies is separated by at least two fuel cells from any other fuel assemblies.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.1.2.5 and SR 3.3.1.2.6 Performance of a CHANNEL FUNCTIONAL TEST demonstrates the associated channel will function properly. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and (continued)
| |
| LaSalle 1 and 2 B 3.3.1.2-7 Revision 51
| |
| | |
| SRM Instrumentation B 3.3.1.2 BASES SURVEILLANCE SR 3.3.1.2.5 and SR 3.3.1.2.6 (continued)
| |
| REQUIREMENTS Non-Technical Specifications tests at least once per refueling interval with applicable extensions. SR 3.3.1.2.5 is required in MODE 5 and the Frequency ensures that the channels are OPERABLE while core reactivity changes could be in progress. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.1.2.6 is required to be met in MODE 2 with IRMs on Range 2 or below and in MODES 3 and 4. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Verification of the signal to noise ratio also ensures that the detectors are inserted to a normal operating level. In a fully withdrawn condition, the detectors are sufficiently removed from the fueled region of the core to essentially eliminate neutrons from reaching the detector. Any count rate obtained while fully withdrawn is assumed to be "noise" only.
| |
| With few fuel assemblies loaded, the SRMs will not have a high enough count rate to determine the signal to noise ratio. Therefore, allowances are made for loading sufficient "source" material, in the form of irradiated fuel assemblies, to establish the conditions necessary to determine the signal to noise ratio. To accomplish this, SR 3.3.1.2.5 is modified by a Note that states that the determination of signal to noise ratio is not required to be met on an SRM that has less than or equal to four fuel assemblies adjacent to the SRM and no other fuel assemblies are in the associated core quadrant. With four or less fuel assemblies loaded around each SRM and no other fuel assemblies in the associated quadrant, even with a control rod withdrawn the configuration will not be critical.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.1.2-8 Revision 51
| |
| | |
| SRM Instrumentation B 3.3.1.2 BASES SURVEILLANCE SR 3.3.1.2.5 and SR 3.3.1.2.6 (continued)
| |
| REQUIREMENTS The Note to SR 3.3.1.2.6 allows the Surveillance to be delayed until entry into the specified condition of the Applicability. The SR must be performed in MODE 2 within 12 hours of entering MODE 2 with IRMs on Range 2 or below.
| |
| The allowance to enter the Applicability with the Frequency not met is reasonable, based on the limited time of 12 hours allowed after entering the Applicability and the inability to perform the Surveillance while at higher power levels.
| |
| Although the Surveillance could be performed while on IRM Range 3, the plant would not be expected to maintain steady state operation at this power level. In this event, the 12 hour Frequency is reasonable, based on the SRMs being otherwise verified to be OPERABLE (i.e., satisfactorily performing the CHANNEL CHECK) and the time required to perform the Surveillances.
| |
| SR 3.3.1.2.7 Performance of a CHANNEL CALIBRATION verifies the performance of the SRM detectors and associated circuitry.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The neutron detectors are excluded from the CHANNEL CALIBRATION (Note 1) because they cannot readily be adjusted. The detectors are fission chambers that are designed to have a relatively constant sensitivity over the range, and with an accuracy specified for a fixed useful life.
| |
| Note 2 to the Surveillance allows the Surveillance to be delayed until entry into the specified condition of the Applicability. The SR must be performed in MODE 2 within 12 hours of entering MODE 2 with IRMs on Range 2 or below. The allowance to enter the Applicability with the Frequency not met is reasonable, based on the limited time of 12 hours allowed after entering the Applicability and the inability to perform the Surveillance while at higher power levels.
| |
| Although the Surveillance could be performed while (continued)
| |
| LaSalle 1 and 2 B 3.3.1.2-9 Revision 51
| |
| | |
| SRM Instrumentation B 3.3.1.2 BASES SURVEILLANCE SR 3.3.1.2.7 (continued)
| |
| REQUIREMENTS on IRM Range 3, the plant would not be expected to maintain steady state operation at this power level. In this event, the 12 hour Frequency is reasonable, based on the SRMs being otherwise verified to be OPERABLE (i.e., satisfactorily performing the CHANNEL CHECK) and the time required to perform the Surveillances.
| |
| REFERENCES None.
| |
| LaSalle 1 and 2 B 3.3.1.2-10 Revision 0
| |
| | |
| OPRM Instrumentation B 3.3.1.3 B 3.3 INSTRUMENTATION B 3.3.1.3 OSCILLATION POWER RANGE MONITOR (OPRM) INSTRUMENTATION BASES BACKGROUND General Design Criteria 10 (GDC 10) requires the reactor core and associated coolant, control, and protection systems to be designed with appropriate margin to assure that acceptable fuel design limits are not exceeded during any condition of normal operation, including the effects of anticipated operational occurrences. Additionally, GDC 12 requires the reactor core and associated coolant, control and protection systems to be designed to assure that power oscillations which can result in conditions exceeding acceptable fuel design limits are either not possible or can be reliably and readily detected and suppressed. The OPRM System provides compliance with GDC 10 and GDC 12, thereby providing protection from exceeding the fuel minimum critical power ratio (MCPR) safety limit.
| |
| References 1, 2, and 3 describe three separate algorithms for detecting stability related oscillations: the period based detection algorithm, the amplitude based algorithm, and the growth rate algorithm. The OPRM System hardware implements these algorithms in microprocessor based modules. These modules execute the algorithms based on local power range monitor (LPRM) inputs and generate alarms and trips based on these calculations. These trips result in tripping the Reactor Protection System (RPS) when the appropriate RPS trip logic is satisfied, as described in the Bases for LCO 3.3.1.1, "Reactor Protection System (RPS)
| |
| Instrumentation." Only the period based detection algorithm is used for safety analysis. The remaining algorithms provide defense in depth and additional protection against unanticipated oscillations.
| |
| The period based detection algorithm detects a stability related oscillation based on the occurrence of a fixed number of consecutive LPRM signal period confirmations coincident with the LPRM signal peak to average amplitude exceeding a specified setpoint. Upon detection of a stability related oscillation, a trip is generated for that OPRM channel.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.1.3-1 Revision 30
| |
| | |
| OPRM Instrumentation B 3.3.1.3 BASES BACKGROUND The OPRM System consists of 4 OPRM trip channels, each (continued) channel consisting of two OPRM modules. Each OPRM module receives input from LPRMs. Each OPRM module also receives input from the RPS average power range monitor (APRM) power and flow signals to automatically enable the trip function of the OPRM module. The outputs of the OPRM trip channels input to the associated RPS trip channels which are configured into a one-out-of-two taken twice trip logic as describe in the Bases for Section 3.3.1.1.
| |
| Each OPRM module is continuously tested by a self-test function. On detection of any OPRM module failure, either a Trouble alarm or INOP alarm is activated. The OPRM module provides an INOP alarm when the self-test feature indicates that the OPRM module may not be capable of meeting its functional requirements.
| |
| APPLICABLE It has been shown that BWR cores may exhibit SAFETY ANALYSIS thermal-hydraulic reactor instabilities in high power and low flow portions of the core power to flow operating domain (Reference 4). GDC 10 requires the reactor core and associated coolant, control, and protection systems to be designed with appropriate margin to assure that acceptable fuel design limits are not exceed during any condition of normal operation, including the effects of anticipated operational occurrences. GDC 12 requires assurance that power oscillations which can result in conditions exceeding acceptable fuel design limits are either not possible or can be reliably and readily detected and suppressed. The OPRM System provides compliance with GDC 10 and GDC 12 by detecting the onset of oscillations and suppressing them by initiating a reactor scram. This assures that the MCPR safety limit will not be violated for anticipated oscillations.
| |
| The OPRM Instrumentation satisfies Criterion 3 of 10 CFR 50.36(c) (2) (ii).
| |
| The OPERABILITY of the OPRM System is dependent on the OPERABILITY of the four individual instrumentation channels with their setpoints within the specified normal setpoint.
| |
| Each channel must also respond within its assumed response time.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.1.3-2 Revision 23
| |
| | |
| OPRM Instrumentation B 3.3.1.3 BASES APPLICABLE The nominal setpoints for the OPRM Period Based Trip SAFETY ANALYSES Function are specified in the Core Operating Limits Report.
| |
| (continued) The trip setpoints are treated as nominal setpoints and do not require additional allowances for uncertainty.
| |
| Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter value and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state.
| |
| The OPRM period based setpoint is determined by cycle specific analysis based on positive margin between the Safety Limit MCPR and the Operating Limit MCPR minus the change in CPR (CPR). This methodology was approved for use by the NRC in Reference 5.
| |
| LCO Four channels of the OPRM System are required to be OPERABLE to ensure that stability related oscillations are detected and suppressed prior to exceeding the MCPR safety limit. Only one of the two OPRM modules (with an active period based detection algorithm) is required for OPRM channel OPERABILITY. The minimum number of LPRMs required to maintain the APRM system OPERABLE per LCO 3.3.1.1 provides an adequate number of LPRMs to maintain an OPRM channel OPERABLE.
| |
| APPLICABILITY The OPRM instrumentation is required to be OPERABLE in order to detect and suppress neutron flux oscillations in the event of thermal-hydraulic instability. As described in References 1, 2, 3, and 9, the region of anticipated oscillation is defined by THERMAL POWER 28.1% rated thermal power (RTP) and recirculation drive flow < 60% of rated recirculation drive flow. The OPRM trip is required to be enabled in this region, and the OPRM must be capable of enabling the trip function as a result of anticipated transients that place the core in that power/flow condition. Therefore the OPRM instrumentation is required to be OPERABLE with THERMAL POWER 25% RTP. It is not necessary for the OPRM instrumentation to be OPERABLE with THERMAL POWER < 25% RTP because the MCPR safety limit is not applicable below 25% RTP.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.1.3-3 Revision 49
| |
| | |
| OPRM Instrumentation B 3.3.1.3 BASES (continued)
| |
| ACTIONS The Note has been provided to modify the ACTIONS related to the OPRM instrumentation channels. Section 1.3 Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limit will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable OPRM instrumentation channel provide appropriate compensatory measures for separate inoperable channels. As such, this Note has been provided that allows a separate Condition entry for each inoperable OPRM instrumentation channel.
| |
| A.1, A.2 and A.3 Because of the reliability and on-line self-testing of the OPRM instrumentation and the redundancy of the RPS design, an allowable out of service time of 30 days has been shown to be acceptable (Ref. 6) to permit restoration of any inoperable channel to OPERABLE status. However, this out of service time is only acceptable provided the OPRM instrumentation still maintains OPRM trip capability (refer to Required Actions B.1 and B.2 Bases). The remaining OPERABLE OPRM channels continue to provide trip capability (see Condition B). The remaining OPRM modules have high reliability. With this high reliability, there is a low probability of a subsequent channel failure within the allowable out of service time. In addition, the OPRM modules continue to perform on-line self-testing and alert the operator if any further system degradation occurs.
| |
| If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the OPRM channel or associated RPS trip system must be placed in the tripped condition per Required Actions A.1 and A.2.
| |
| Placing the inoperable OPRM channel in trip (or the associated RPS trip system in trip) would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.1.3-4 Revision 23
| |
| | |
| OPRM Instrumentation B 3.3.1.3 BASES ACTIONS A.1, A.2 and A.3 (continued)
| |
| Alternately, if it is not desired to place the OPRM channel (or RPS trip system) in trip, the alternate method of detecting and suppressing thermal hydraulic instability oscillation is required (Required Action A.3). This alternate method is described in Reference 7. It consists of avoidance of the region where oscillations are possible, exiting this region if it is entered due to unforeseen circumstances, and increased operator awareness and monitoring for neutron flux oscillations while taking action to exit the region. If indications of oscillation, as described in Reference 7, are observed by the operator, the operator will take the actions described by procedures, which include initiating a manual scram of the reactor.
| |
| Continued operation with one OPRM channel inoperable, but not tripped, is permissible if the OPRM system maintains trip capability, since the combination of the alternate method and the OPRM trip capability provides adequate protection against oscillations.
| |
| B.1 and B.2 Required Action B.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped OPRM channels within the same RPS trip system result in not maintaining OPRM trip capability. The OPRM trip function is considered to be maintained when sufficient OPRM channels are OPERABLE or in trip (or the associated RPS trip system is in trip), such that both trip systems will generate a trip signal from the OPRM Period Based Trip Function on a valid signal.
| |
| Because of the low probability of the occurrence of an instability, 12 hours is an acceptable time to initiate the alternate method of detecting and suppressing thermal hydraulic instability oscillations described in Required Action A.3 above. The alternate method of detecting and suppressing thermal hydraulic instability oscillations avoids the region where oscillations are possible and would adequately address detection and mitigation in the event of instability oscillations. Based on industry operating experience with actual instability oscillations, the operator would be able to recognize instabilities during this time and take action to suppress them through a manual scram. Since plant operation is minimized in areas where (continued)
| |
| LaSalle 1 and 2 B 3.3.1.3-5 Revision 23
| |
| | |
| OPRM Instrumentation B 3.3.1.3 BASES ACTIONS B.1 and B.2 (continued) oscillations may occur, operation for 120 days without OPRM trip capability is considered acceptable with implementation of an alternate method of detecting and suppressing thermal hydraulic instability oscillations.
| |
| C.1 With any Required Action and associated Completion Time not met, the plant must be placed in a MODE or other specified condition in which the LCO does not apply. To achieve this status, THERMAL POWER must be reduced to < 25% RTP within 4 hours. Reducing THERMAL POWER to < 25% RTP places the plant in a region where instabilities cannot occur. The 4 hours is reasonable, based on operating experience, to reduce THERMAL POWER < 25% RTP from full power conditions in an orderly manner and without challenging plant systems.
| |
| SURVEILLANCE The Surveillances are modified by a Note to indicate that, REQUIREMENTS when a channel is placed in an inoperable status solely for the performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours, provided the associated Function maintains trip capability. Upon completion of the Surveillance, or expiration of the 6 hour allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken.
| |
| This Note is based on the RPS reliability analysis (Ref. 8) assumption of the average time required to perform channel surveillance. That analysis demonstrated that the 6 hours testing allowance does not significantly reduce the probability that the RPS will trip when necessary.
| |
| SR 3.3.1.3.1 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the channel will perform the intended function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by (continued)
| |
| LaSalle 1 and 2 B 3.3.1.3-6 Revision 23
| |
| | |
| OPRM Instrumentation B 3.3.1.3 BASES SURVEILLANCE SR 3.3.1.3.1 (continued)
| |
| REQUIREMENTS other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.1.3.2 LPRM gain settings are determined from the local flux profiles measured by the Traversing Incore Probe (TIP)
| |
| System. This establishes the relative local flux profile for appropriate representative input to the OPRM System.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.1.3.3 The CHANNEL CALIBRATION is a complete check of the instrument loop. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations, consistent with the plant specific setpoint methodology.
| |
| Calibration of the channel provides a check of the internal reference voltage and the internal processor clock frequency. It also compares the desired trip setpoint with those in the processor memory. Since the OPRM is a digital system, the internal reference voltage and processor clock frequency are, in turn, used to automatically calibrate the internal analog to digital converters. The nominal setpoints for the period based detection algorithm are specified in the COLR. As noted, neutron detectors are excluded from CHANNEL CALIBRATION because of difficulty of simulating a meaningful signal. Changes in neutron detector sensitivity are compensated for by performing the 2000 effective full power hour (EFPH) calibration against the TIPs (SR 3.3.1.3.2). SR 3.3.1.3.2 thus also ensures the operability of the OPRM instrumentation.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.1.3-7 Revision 51
| |
| | |
| OPRM Instrumentation B 3.3.1.3 BASES SURVEILLANCE SR 3.3.1.3.3 (continued)
| |
| REQUIREMENTS The nominal setpoints for the OPRM trip function for the period based detection algorithm (PBDA) are specified in the Core Operating Limits Report. The PBDA trip setpoints are the number of confirmation counts required to permit a trip signal and the peak to average amplitude required to generate a trip signal.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.1.3.4 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required trip logic for a specific channel. The functional testing of control rods, in LCO 3.1.3, "Control Rod OPERABILITY," and scram discharge volume (SDV) vent and drain valves, in LCO 3.1.8, "Scram Discharge Volume (SDV) Vent and Drain Valves," overlaps this Surveillance to provide complete testing of the assumed safety function. The OPRM self-test function may be utilized to perform this testing for those components that it is designed to monitor.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.1.3.5 This SR ensures that trips initiated from the OPRM System will not be bypassed (i.e., fail to enable) when THERMAL POWER is 28.1% RTP and recirculation drive flow is < 60%
| |
| of rated recirculation drive flow. This normally involves calibration of the bypass channels. The 28.1% RTP value is the plant specific value for the enable region, as described in Reference 9.
| |
| These values have been conservatively selected so that specific, additional uncertainty allowances need not be applied. Specifically, the THERMAL POWER, the Average Power Range Monitor (APRM) establishes the reference signal to enable the OPRM system at 28.1% RTP. Thus, the nominal (continued)
| |
| LaSalle 1 and 2 B 3.3.1.3-8 Revision 51
| |
| | |
| OPRM Instrumentation B 3.3.1.3 BASES SURVEILLANCE SR 3.3.1.3.5 (continued)
| |
| REQUIREMENTS setpoints corresponding to the values listed above (28.1% of RTP and 60% of rated recirculation drive flow) will be used to establish the enabled region of the OPRM System trips.
| |
| (References 1, 2, 5, 9, and 11)
| |
| If any bypass channel setpoint is nonconservative (i.e.,
| |
| the OPRM module is bypassed at 28.1% RTP and < 60% of rated recirculation drive flow), then the affected OPRM module is considered inoperable. Alternately, the bypass channel can be placed in the conservative condition (nonbypass). If placed in the nonbypass condition, this SR is met and the module is considered OPERABLE.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.1.3.6 This SR ensures that the individual channel response times are less than or equal to the maximum values assumed in the accident analysis. The OPRM self-test function may be utilized to perform this testing for those components it is designed to monitor. The RPS RESPONSE TIME acceptance criteria are included in Reference 10.
| |
| RPS RESPONSE TIME may be verified by actual response time measurements in any series of sequential, overlapping, or total channel measurements. As noted, neutron detectors are excluded from RPS RESPONSE TIME testing because the principles of detector operation virtually ensure an instantaneous response time. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. NEDC-39160, "BWR Owners Group Long-Term Stability Solutions Licensing Methodology," June 1991.
| |
| : 2. NEDO-39160, "BWR Owners Group Long-Term Stability Solutions Licensing Methodology," Supplement 1, March 1992.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.1.3-9 Revision 51
| |
| | |
| OPRM Instrumentation B 3.3.1.3 BASES REFERENCES 3. NRC Letter, A. Thandani to L. A. England, "Acceptance (continued) for Referencing of Topical Report NEDO-31960, Supplement 1, 'BWR Owners Group Long-Term Stability Solutions Licensing Methodology,'" July 12, 1994.
| |
| : 4. Generic Letter 94-02, "Long-Term Solutions and Upgrade of Interim Operating Recommendations for Thermal-Hydraulic Instabilities in Boiling Water Reactors," July 11, 1994.
| |
| : 5. NEDO-32465-A, "BWR Owners Group Reactor Stability Detect and Suppress Solution Licensing Basis Methodology and Reload Application," August 1996.
| |
| : 6. CENPD-400-P, Rev. 01 "Generic Topical Report for the ABB Option III Oscillation Power Range Monitor (OPRM)," May 1995.
| |
| : 7. BWROG Letter BWROG-9479, "Guidelines for Stability Interim Correction Action," June 6, 1994.
| |
| : 8. NEDC-30851-P-A, "Technical Specification Improvement Analysis for BWR Reactor Protection System,"
| |
| March 1988.
| |
| : 9. NEDC-32701P, "Power Uprate Safety Analysis Report for LaSalle County Station Units 1 and 2," Revision 2.
| |
| : 10. Technical Requirements Manual.
| |
| : 11. Letter from K. P. Donovan (BWR Owners Group) to U.S.
| |
| NRC, Guidelines for Stability Option III Enabled Region, dated September 17, 1996.
| |
| LaSalle 1 and 2 B 3.3.1.3-10 Revision 23
| |
| | |
| UNIT 1 Control Rod Block Contro ock Instrumentation B 3.3.2.1 B 3.3 INSTRUMENTATION ENTATION NTATION B 3.3.2.1 Control Rod Block Instrumentation BASES BACKGROUND Control rods provide the primary means for control of reactivity changes. Control rod block instrumentation includes channel sensors, logic circuitry, switches, and relays that are designed to ensure that specified fuel design limits are not exceeded for postulated transients and accidents. During high power operation, the rod block monitor (RBM) provides protection for control rod withdrawal error events. During low power operations, control rod blocks from the rod worth minimizer (RWM) enforce specific control rod sequences designed to mitigate the consequences of the control rod drop accident (CRDA). During shutdown conditions, control rod blocks from the Reactor Mode Switch-Shutdown Position Function ensure that all control rods remain inserted to prevent inadvertent criticalities.
| |
| The purpose of the RBM is to limit control rod withdrawal if localized neutron flux exceeds a predetermined setpoint during control rod manipulations (Ref. 1). It is assumed to function to block further control rod withdrawal to preclude a MCPR Safety Limit (SL) violation. The RBM supplies a trip signal to the Rod Control Management System (RCMS) to appropriately inhibit control rod withdrawal during power operation above the 30% RATED THERMAL POWER setpoint when a non peripheral control rod is selected. The RBM has two channels, either of which can initiate a control rod block when the channel output exceeds the control rod block setpoint. Each RBM inputs into both RCMS controllers. The RBM channel signal is generated by averaging a set of local power range monitor (LPRM) signals. One RBM channel averages the signals from LPRM detectors at the A and C positions in the assigned LPRM assemblies. The second RBM channel averages the signals from the LPRM detectors at the B and D positions. Assignment of LPRM assemblies to be used in RBM averaging is controlled by the selection of control rods. With no control rod selected, the RBM output is set to zero. However, when a control rod is selected, the gain of each (continued)
| |
| LaSalle 1 B 3.3.2.1-1 Revision 44
| |
| | |
| UNIT 1 Control Rod Block Contro ock Instrumentation B 3.3.2.1 BASES BACKGROUND RBM channel output is normalized to an assigned average (continued) power range monitor (APRM) channel. The assigned APRM channel is on the same RPS trip system as the RBM channel.
| |
| The gain setting is held constant during the movement of that particular control rod to provide an indication of the change in the relative local power level. If the APRM used to normalize the RBM reading is indicating 30% or a peripheral control rod is selected, the RBM is zeroed and the RBM is bypassed (Refs. 1 and 2).
| |
| If any LPRM detector assigned to an RBM is bypassed, the computed average signal is adjusted automatically to compensate for the number of LPRM signals. The minimum number of LPRM inputs required for each RBM channel to prevent an instrument inoperative alarm is four when using four LPRM assemblies, three when using three LPRM assemblies, and two when using two LPRM assemblies. If the normalizing APRM channel is bypassed, a second APRM channel automatically provides the normalizing signal (Refs. 1 and 2).
| |
| In addition, to preclude rod movement with an inoperable RBM, a downscale trip and an inoperable trip are provided.
| |
| The purpose of the RWM is to control rod patterns during startup and shutdown, such that only specified control rod sequences and relative positions are allowed over the operating range from all control rods inserted to 5% RTP or 300 psig reactor steam dome pressure. The sequences effectively limit the potential amount and rate of reactivity increase during a CRDA. Prescribed control rod sequences are stored in the RWM, which will initiate control rod withdrawal and insert blocks when the actual sequence deviates beyond allowances from the stored sequence. The RWM determines the actual sequence based on position indication for each control rod. The RWM also uses steam flow signals to determine when the reactor power is above the preset power level at which the RWM is automatically bypassed. The RWM programming is part of the sequence enforcement logic within each of the two RCMS controllers, and so normally operates with two channels. A rod block generated within either channel will prevent control rod withdrawal.
| |
| (continued)
| |
| LaSalle 1 B 3.3.2.1-2 Revision 91
| |
| | |
| 1 Control Rod Block Contro ock Instrumentation B 3.3.2.1 BASES BACKGROUND With the reactor mode switch in the shutdown position, a (continued) control rod withdrawal block is applied to all control rods to ensure that the shutdown condition is maintained. This Function prevents inadvertent criticality as the result of a control rod withdrawal during MODE 3 or 4, or during MODE 5 when the reactor mode switch is required to be in the shutdown position. The reactor mode switch has two channels, each inputting into a separate rod block circuit.
| |
| Each reactor mode switch channel has contacts permitting control rod withdrawal in the reactor mode switch positions of run, startup, and refuel interlocked with other plant conditions. With the reactor mode switch in shutdown, the RCMS circuits do not receive a permissive for control rod withdrawal. A rod block in either RCMS circuit will provide a control rod block to all control rods.
| |
| APPLICABLE 1. Rod Block Monitor SAFETY ANALYSES, LCO, and The RBM is designed to prevent violation of the MCPR APPLICABILITY SL and the cladding 1% plastic strain fuel design limit that may result from a single control rod withdrawal error (RWE) event. The analytical methods and assumptions used in evaluating the RWE event are summarized in Reference 4. The cycle-specific analysis considers the continuous withdrawal of the maximum worth control rod at its maximum drive speed from the reactor, which is operating at rated power with a control rod pattern that results in the core being placed on thermal design limits. The condition is analyzed to ensure that the results obtained are conservative; the approach also serves to demonstrate the function of the RBM.
| |
| The RBM Function satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| Two channels of the RBM are required to be OPERABLE, with their setpoints within the appropriate Allowable Values in the CORE OPERATING LIMITS REPORT to ensure that no single instrument failure can preclude a rod block from this Function. The actual setpoints are calibrated consistent with applicable setpoint methodology.
| |
| Nominal trip setpoints are specified in the setpoint calculations. The nominal setpoints are selected to ensure (continued)
| |
| LaSalle 1 B 3.3.2.1-3 Revision 44
| |
| | |
| UNIT 1 Control Rod Block Contro ock Instrumentation B 3.3.2.1 BASES APPLICABLE that the setpoints do not exceed the Allowable Values SAFETY ANALYSES, between successive CHANNEL CALIBRATIONS. Operation with a LCO, and trip setpoint less conservative than the nominal trip APPLICABILITY setpoint, but within its Allowable Value, is acceptable.
| |
| (continued) Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor power), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g.,
| |
| trip unit) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The trip setpoints are determined from the analytic limits, corrected for defined process, calibration, and instrument errors. The Allowable Values are then determined, based on the trip setpoint values, by accounting for the calibration based errors. These calibration based errors are limited to reference accuracy, instrument drift, errors associated with measurement and test equipment, and calibration tolerance of loop components. The trip setpoints and Allowable Values determined in this manner provide adequate protection because instrument uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for and appropriately applied for the instrumentation.
| |
| The RBM is assumed to mitigate the consequences of an RWE event when operating t 30% RTP and a non-peripheral control rod is selected. Below this power level or if a peripheral control rod is selected, the consequences of an RWE event will not exceed the MCPR SL and, therefore, the RBM is not required to be OPERABLE (Ref. 4).
| |
| : 2. Rod Worth Minimizer The RWM enforces the analyzed rod position sequence to ensure that the initial conditions of the CRDA analysis are not violated. The analytical methods and assumptions used in evaluating the CRDA are summarized in References 5, 6, and 7. Requirements that the control rod sequence is in compliance with the analyzed rod position sequence are specified in LCO 3.1.6, "Rod Pattern Control."
| |
| (continued)
| |
| LaSalle 1 B 3.3.2.1-4 Revision 91
| |
| | |
| UNIT 1 Control Rod Block Contro ock Instrumentation B 3.3.2.1 BASES APPLICABLE 2. Rod Worth Minimizer (continued)
| |
| SAFETY ANALYSES, LCO, and When performing a shutdown of the plant, an optional control APPLICABILITY rod sequence (Ref. 9) may be used if the coupling of each withdrawn control rod has been confirmed. The rods may be inserted without the need to stop at intermediate positions.
| |
| When using the Reference 9 control rod insertion sequence for shutdown, the rod worth minimizer may be reprogrammed to enforce the requirements of the improved control rod insertion process.
| |
| The RWM Function satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| Since the RWM is a system designed to act as a backup to operator control of the rod sequences, only one channel of the RWM is required to be OPERABLE (Ref. 7). The RWM function is included with the sequence enforcement logic in each of the two RCMS controllers, and so normally operates with two channels. Special circumstances provided for in the Required Action of LCO 3.1.3, "Control Rod OPERABILITY,"
| |
| and LCO 3.1.6 may necessitate bypassing the RWM to allow continued operation with fully inserted, out-of-sequence control rods, or to allow correction of a control rod pattern not in compliance with the analyzed rod position sequence. The RWM may be bypassed as required by these conditions, but then it must be considered inoperable and the Required Actions of this LCO followed.
| |
| Compliance with the analyzed rod position sequence, and therefore OPERABILITY of the RWM, is required in MODE 2 when THERMAL POWER is d 5% RTP and reactor steam dome pressure d 300 psig. When THERMAL POWER is ! 5% RTP or reactor steam dome pressure ! 300 psig, there is no possible control rod configuration that results in a control rod worth that could exceed the fuel cladding failure criteria during a CRDA (Refs. 6 and 7). In MODES 3 and 4, all control rods are required to be inserted into the core; therefore, a CRDA cannot occur. In MODE 5, since only a single control rod can be withdrawn from a core cell containing fuel assemblies, adequate SDM ensures that the consequences of a CRDA are acceptable, since the reactor will be subcritical.
| |
| Before entering MODE 1, the reactor has completed heat up and pressurization. Reactor steam dome pressure is therefore above 300 psig, and so constraints on the control rod pattern due to CRDA are not required in MODE 1.
| |
| (continued)
| |
| LaSalle 1 B 3.3.2.1-5 Revision 91
| |
| | |
| UNIT 1 Control Rod Block Contro ock Instrumentation B 3.3.2.1 BASES APPLICABLE 3. Reactor Mode SwitchShutdown Position SAFETY ANALYSES, LCO, and During MODES 3 and 4, and during MODE 5 when the reactor APPLICABILITY mode switch is in the shutdown position, the core is assumed (continued) to be subcritical; therefore, no positive reactivity insertion events are analyzed. The Reactor Mode Switch-Shutdown Position control rod withdrawal block ensures that the reactor remains subcritical by blocking control rod withdrawal, thereby preserving the assumptions of the safety analysis.
| |
| The Reactor Mode SwitchShutdown Position Function satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| Two channels are required to be OPERABLE to ensure that no single channel failure will preclude a rod block when required. There is no Allowable Value for this Function since the channels are mechanically actuated based solely on reactor mode switch position.
| |
| During shutdown conditions (MODES 3 and 4, and MODE 5 when the reactor mode switch is in the shutdown position), no positive reactivity insertion events are analyzed because assumptions are that control rod withdrawal blocks are provided to prevent criticality. Therefore, when the reactor mode switch is in the shutdown position, the control rod withdrawal block is required to be OPERABLE. During MODE 5 with the reactor mode switch in the refueling position, the refuel position one-rod-out interlock (LCO 3.9.2, "Refuel Position One-Rod-Out Interlock")
| |
| provides the required control rod withdrawal blocks.
| |
| ACTIONS A.1 With one RBM channel inoperable, the remaining OPERABLE channel is adequate to perform the control rod block function; however, overall reliability is reduced because a single failure in the remaining OPERABLE channel can result in no control rod block capability for the RBM. For this reason, Required Action A.1 requires restoration of the inoperable channel to OPERABLE status. The Completion Time of 24 hours is based on the low probability of an event occurring coincident with a failure in the remaining OPERABLE channel.
| |
| (continued)
| |
| LaSalle 1 B 3.3.2.1-6 Revision 39
| |
| | |
| UNIT 1 Control Rod Block Contro ock Instrumentation B 3.3.2.1 BASES ACTIONS B.1 (continued)
| |
| If Required Action A.1 is not met and the associated Completion Time has expired, the inoperable channel must be placed in trip within 1 hour. If both RBM channels are inoperable, the RBM is not capable of performing its intended function; thus, one channel must also be placed in trip. This initiates a control rod withdrawal block, thereby ensuring that the RBM function is met.
| |
| The 1 hour Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities and is acceptable because it minimizes risk while allowing time for restoration or tripping of inoperable channels.
| |
| C.1, C.2.1.1, C.2.1.2, and C.2.2 With the RWM inoperable during a reactor startup, the operator is still capable of enforcing the prescribed control rod sequence. However, the overall reliability is reduced because a single operator error can result in violating the control rod sequence. Therefore, control rod movement must be immediately suspended except by scram.
| |
| Alternatively, startup may continue if at least 12 control rods have already been withdrawn, or a reactor startup with an inoperable RWM during withdrawal of one or more of the first 12 control rods was not performed in the last 12 months. These requirements minimize the number of reactor startups initiated with the RWM inoperable.
| |
| Required Actions C.2.1.1 and C.2.1.2 require verification of these conditions by review of plant logs and control room indications. Once Required Action C.2.1.1 or C.2.1.2 is satisfactorily completed, control rod withdrawal may proceed in accordance with the restrictions imposed by Required Action C.2.2. Required Action C.2.2 allows for the RWM Function to be performed manually and requires a double check of compliance with the prescribed rod sequence by a second licensed operator (Reactor Operator or Senior Reactor Operator) or other task qualified member of the technical staff (e.g., shift technical advisor or reactor engineer).
| |
| The RWM may be bypassed under these conditions to allow continued operations. In addition, Required Actions of LCO 3.1.3 and LCO 3.1.6 may require bypassing the RWM, (continued)
| |
| LaSalle 1 B 3.3.2.1-7 Revision 39
| |
| | |
| UNIT 1 Control Rod Block Contro ock Instrumentation B 3.3.2.1 BASES ACTIONS C.1, C.2.1.1, C.2.1.2, and C.2.2 (continued) during which time the RWM must be considered inoperable with Condition C entered and its Required Actions taken.
| |
| D.1 With the RWM inoperable during a reactor shutdown, the operator is still capable of enforcing the prescribed control rod sequence. Required Action D.1 allows for the RWM Function to be performed manually and requires a double check of compliance with the prescribed rod sequence by a second licensed operator (Reactor Operator or Senior Reactor Operator) or other task qualified member of the technical staff (e.g., shift technical advisor or reactor engineer).
| |
| The RWM may be bypassed under these conditions to allow the reactor shutdown to continue.
| |
| E.1 and E.2 With one Reactor Mode SwitchShutdown Position control rod withdrawal block channel inoperable, the remaining OPERABLE channel is adequate to perform the control rod withdrawal block function. However, since the Required Actions are consistent with the normal action of an OPERABLE Reactor Mode SwitchShutdown Position Function (i.e., maintaining all control rods inserted), there is no distinction between having one or two channels inoperable.
| |
| In both cases (one or both channels inoperable), suspending all control rod withdrawal and initiating action to fully insert all insertable control rods in core cells containing one or more fuel assemblies will ensure that the core is subcritical with adequate SDM ensured by LCO 3.1.1. Control rods in core cells containing no fuel assemblies do not affect the reactivity of the core and are therefore not required to be inserted. Action must continue until all insertable control rods in core cells containing one or more fuel assemblies are fully inserted.
| |
| SURVEILLANCE As noted at the beginning of the SRs, the SRs for each REQUIREMENTS Control Rod Block instrumentation Function are found in the SRs column of Table 3.3.2.1-1.
| |
| (continued)
| |
| LaSalle 1 B 3.3.2.1-8 Revision 39
| |
| | |
| 1 Control Rod Block Contro ock Instrumentation B 3.3.2.1 BASES SURVEILLANCE The Surveillances are modified by a second Note to indicate REQUIREMENTS that when an RBM channel is placed in an inoperable status (continued) solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours provided the associated Function maintains control rod block capability. Upon completion of the Surveillance, or expiration of the 6 hour allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken.
| |
| This Note is based on the reliability analysis (Ref. 8) assumption of the average time required to perform channel Surveillance. That analysis demonstrated that the 6 hour testing allowance does not significantly reduce the probability that a control rod block will be initiated when necessary.
| |
| SR 3.3.2.1.1 A CHANNEL FUNCTIONAL TEST is performed for each RBM channel to ensure that the entire channel will perform the intended function. It includes the Reactor Manual Control Multiplexing System input. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.
| |
| Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.2.1.2 and SR 3.3.2.1.3 A CHANNEL FUNCTIONAL TEST is performed for the RWM to ensure that the entire system will perform the intended function.
| |
| A successful test of the required contact(s) of a channel relay may be performed by the verification of the (continued)
| |
| LaSalle 1 B 3.3.2.1-9 Revision 51
| |
| | |
| UNIT 1 Control Rod Block Contro ock Instrumentation B 3.3.2.1 BASES SURVEILLANCE SR 3.3.2.1.2 and SR 3.3.2.1.3 (continued)
| |
| REQUIREMENTS change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. The CHANNEL FUNCTIONAL TEST for the RWM is performed by attempting to withdraw a control rod not in compliance with the prescribed sequence and verifying a control rod block occurs and by verifying proper annunciation of the selection error of at least one out-of-sequence control rod. As noted in the SRs, SR 3.3.2.1.2 is not required to be performed until 1 hour after any control rod is withdrawn at d 5% RTP and d 300 psig reactor steam dome pressure in MODE 2 and SR 3.3.2.1.3 is not required to be performed until 1 hour after THERMAL POWER is d 5% RTP and d 300 psig reactor steam dome pressure in MODE 2. The Note to SR 3.3.2.1.2 allows entry into MODE 2 during a startup and entry into MODE 2 concurrent with a power reduction to d 5% RTP and reactor steam dome pressure is d 300 psig during a shutdown to perform the required Surveillance if the Frequency is not met per SR 3.0.2. The 1 hour allowances are based on operating experience and in consideration of providing a reasonable time in which to complete the SRs. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.2.1.4 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.
| |
| As noted, neutron detectors are excluded from the CHANNEL CALIBRATION because they are passive devices, with minimal (continued)
| |
| LaSalle 1 B 3.3.2.1-10 Revision 91
| |
| | |
| UNIT 1 Control Rod Block Contro ock Instrumentation B 3.3.2.1 BASES SURVEILLANCE SR 3.3.2.1.4 (continued)
| |
| REQUIREMENTS drift, and because of the difficulty of simulating a meaningful signal. Neutron detectors are adequately tested in SR 3.3.1.1.2 and SR 3.3.1.1.8.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.2.1.5 The RBM is automatically bypassed when power is below a specified value or if a peripheral control rod is selected.
| |
| The power level is determined from the APRM signals input to each RBM channel. The automatic bypass setpoint must be verified periodically to be < 30% RTP. In addition, it must also be verified that the RBM is not bypassed when a control rod that is not a peripheral control rod is selected (only one non-peripheral control rod is required to be verified).
| |
| If any bypass setpoint is nonconservative, then the affected RBM channel is considered inoperable. Alternatively, the APRM channel can be placed in the conservative condition to enable the RBM. If placed in this condition, the SR is met and the RBM channel is not considered inoperable. As noted, neutron detectors are excluded from the Surveillance because they are passive devices, with minimal drift, and because of the difficulty of simulating a meaningful signal. Neutron detectors are adequately tested in SR 3.3.1.1.2 and SR 3.3.1.1.8. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.2.1.6 The RWM is automatically bypassed when power is above a specified value. The power level is determined from steam flow signal. The automatic bypass setpoint must be verified periodically to be > 5% RTP. If the RWM low power setpoint is nonconservative, then the RWM is considered inoperable.
| |
| Alternately, the low power setpoint channel can be placed in the conservative condition (nonbypass). If placed in the nonbypassed condition, the SR is met and the RWM is not considered inoperable. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| (continued)
| |
| LaSalle 1 B 3.3.2.1-11 Revision 91
| |
| | |
| UNIT 1 Control Rod Block Contro ock Instrumentation B 3.3.2.1 BASES SURVEILLANCE SR 3.3.2.1.7 REQUIREMENTS (continued) A CHANNEL FUNCTIONAL TEST is performed for the Reactor Mode SwitchShutdown Position Function to ensure that the entire channel will perform the intended function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. The CHANNEL FUNCTIONAL TEST for the Reactor Mode SwitchShutdown Position Function is performed by attempting to withdraw any control rod with the reactor mode switch in the shutdown position and verifying a control rod block occurs.
| |
| As noted in the SR, the Surveillance is not required to be performed until 1 hour after the reactor mode switch is in the shutdown position, since testing of this interlock with the reactor mode switch in any other position cannot be performed without using jumpers, lifted leads, or movable links. This allows entry into MODES 3 and 4 if the Frequency is not met per SR 3.0.2. The 1 hour allowance is based on operating experience and in consideration of providing a reasonable time in which to complete the SRs.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.2.1.8 The RWM will only enforce the proper control rod sequence if the rod sequence is properly input into the RWM computer.
| |
| This SR ensures that the proper sequence is loaded into the RWM so that it can perform its intended function. The Surveillance is performed once prior to declaring RWM OPERABLE following loading of sequence into RWM, since this is when rod sequence input errors are possible.
| |
| (continued)
| |
| LaSalle 1 B 3.3.2.1-12 Revision 51
| |
| | |
| UNIT 1 Control Rod Block Contro ock Instrumentation B 3.3.2.1 BASES SURVEILLANCE SR 3.3.2.1.9 REQUIREMENTS (continued) LCO 3.1.3 and LCO 3.1.6 may require individual control rods to be bypassed (taken out of service) in the RWM to allow insertion of an inoperable control rod or correction of a control rod pattern not in compliance with the analyzed rod position sequence. With the control rods bypassed (taken out of service) in the RWM, the RWM will provide insert and withdraw blocks for bypassed control rods that are fully inserted and a withdraw block for bypassed control rods that are not fully inserted. To ensure the proper bypassing and movement of those affected control rods, a second licensed operator (Reactor Operator or Senior Reactor Operator) or other task qualified member of the technical staff (e.g.,
| |
| shift technical advisor or reactor engineer) must verify the bypassing and position of these control rods. Compliance with this SR allows the RWM to be OPERABLE with these control rods bypassed.
| |
| REFERENCES 1. UFSAR, Section 7.7.6.3.
| |
| : 2. UFSAR, Section 7.7.2.2.3.
| |
| : 3. UFSAR, Section 7.7.7.2.3.
| |
| : 4. UFSAR, Section 15.4.2.3.
| |
| : 5. UFSAR, Section 15.4.9.
| |
| : 6. "Modifications to the Requirements for Control Rod Drop Accident Mitigating Systems," BWR Owners' Group, July 1986.
| |
| : 7. NRC SER, "Acceptance of Referencing of Licensing Topical Report NEDE-24011-P-A," "General Electric Standard Application for Reactor Fuel, Revision 8, Amendment 17," December 27, 1987.
| |
| : 8. GENE-770-06-1-A, "Addendum to Bases for Changes to Surveillance Test Intervals and Allowed Out-of-Service Times for Selected Instrumentation Technical Specifications," December 1992.
| |
| : 9. NEDE-33885P-A, "GNF CRDA Application Methodology,"
| |
| Revision 1, March 2020.
| |
| LaSalle 1 B 3.3.2.1-13 Revision 91
| |
| | |
| UNIT 2 Control Rod Block Instrumentation Contro I B 3.3.2.1 B 3.3 INSTRUMENTATION ENTATION NTATION B 3.3.2.1 Control Rod Block Instrumentation BASES BACKGROUND Control rods provide the primary means for control of reactivity changes. Control rod block instrumentation includes channel sensors, logic circuitry, switches, and relays that are designed to ensure that specified fuel design limits are not exceeded for postulated transients and accidents. During high power operation, the rod block monitor (RBM) provides protection for control rod withdrawal error events. During low power operations, control rod blocks from the rod worth minimizer (RWM) enforce specific control rod sequences designed to mitigate the consequences of the control rod drop accident (CRDA). During shutdown conditions, control rod blocks from the Reactor Mode Switch-Shutdown Position Function ensure that all control rods remain inserted to prevent inadvertent criticalities.
| |
| The purpose of the RBM is to limit control rod withdrawal if localized neutron flux exceeds a predetermined setpoint during control rod manipulations (Ref. 1). It is assumed to function to block further control rod withdrawal to preclude a MCPR Safety Limit (SL) violation. The RBM supplies a trip signal to the Rod Control Management System (RCMS) to appropriately inhibit control rod withdrawal during power operation above the 30% RATED THERMAL POWER setpoint when a non peripheral control rod is selected. The RBM has two channels, either of which can initiate a control rod block when the channel output exceeds the control rod block setpoint. Each RBM inputs into both RCMS controllers. The RBM channel signal is generated by averaging a set of local power range monitor (LPRM) signals. One RBM channel averages the signals from LPRM detectors at the A and C positions in the assigned LPRM assemblies. The second RBM channel averages the signals from the LPRM detectors at the B and D positions. Assignment of LPRM assemblies to be used in RBM averaging is controlled by the selection of control rods. With no control rod selected, the RBM output is set to zero. However, when a control rod is selected, the gain of each (continued)
| |
| LaSalle 2 B 3.3.2.1-14 Revision 44
| |
| | |
| UNIT 2 Control Rod Block Instrumentation Contro I B 3.3.2.1 BASES BACKGROUND RBM channel output is normalized to an assigned average (continued) power range monitor (APRM) channel. The assigned APRM channel is on the same RPS trip system as the RBM channel.
| |
| The gain setting is held constant during the movement of that particular control rod to provide an indication of the change in the relative local power level. If the APRM used to normalize the RBM reading is indicating 30% or a peripheral control rod is selected, the RBM is zeroed and the RBM is bypassed (Refs. 1 and 2).
| |
| If any LPRM detector assigned to an RBM is bypassed, the computed average signal is adjusted automatically to compensate for the number of LPRM signals. The minimum number of LPRM inputs required for each RBM channel to prevent an instrument inoperative alarm is four when using four LPRM assemblies, three when using three LPRM assemblies, and two when using two LPRM assemblies. If the normalizing APRM channel is bypassed, a second APRM channel automatically provides the normalizing signal (Refs. 1 and 2).
| |
| In addition, to preclude rod movement with an inoperable RBM, a downscale trip and an inoperable trip are provided.
| |
| The purpose of the RWM is to control rod patterns during startup and shutdown, such that only specified control rod sequences and relative positions are allowed over the operating range from all control rods inserted to 10% RTP.
| |
| The sequences effectively limit the potential amount and rate of reactivity increase during a CRDA. Prescribed control rod sequences are stored in the RWM, which will initiate control rod withdrawal and insert blocks when the actual sequence deviates beyond allowances from the stored sequence. The RWM determines the actual sequence based on position indication for each control rod. The RWM also uses steam flow signals to determine when the reactor power is above the preset power level at which the RWM is automatically bypassed. The RWM programming is part of the sequence enforcement logic within each of the two RCMS controllers, and so normally operates with two channels. A rod block generated within either channel will prevent control rod withdrawal.
| |
| (continued)
| |
| LaSalle 2 B 3.3.2.1-15 Revision 44
| |
| | |
| UNIT 2 Control Rod Block Instrumentation Contro I B 3.3.2.1 BASES BACKGROUND With the reactor mode switch in the shutdown position, a (continued) control rod withdrawal block is applied to all control rods to ensure that the shutdown condition is maintained. This Function prevents inadvertent criticality as the result of a control rod withdrawal during MODE 3 or 4, or during MODE 5 when the reactor mode switch is required to be in the shutdown position. The reactor mode switch has two channels, each inputting into a separate rod block circuit.
| |
| Each reactor mode switch channel has contacts permitting control rod withdrawal in the reactor mode switch positions of run, startup, and refuel interlocked with other plant conditions. With the reactor mode switch in shutdown, the RCMS circuits do not receive a permissive for control rod withdrawal. A rod block in either RCMS circuit will provide a control rod block to all control rods.
| |
| APPLICABLE 1. Rod Block Monitor SAFETY ANALYSES, LCO, and The RBM is designed to prevent violation of the MCPR APPLICABILITY SL and the cladding 1% plastic strain fuel design limit that may result from a single control rod withdrawal error (RWE) event. The analytical methods and assumptions used in evaluating the RWE event are summarized in Reference 4. The cycle-specific analysis considers the continuous withdrawal of the maximum worth control rod at its maximum drive speed from the reactor, which is operating at rated power with a control rod pattern that results in the core being placed on thermal design limits. The condition is analyzed to ensure that the results obtained are conservative; the approach also serves to demonstrate the function of the RBM.
| |
| The RBM Function satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| Two channels of the RBM are required to be OPERABLE, with their setpoints within the appropriate Allowable Values in the CORE OPERATING LIMITS REPORT to ensure that no single instrument failure can preclude a rod block from this Function. The actual setpoints are calibrated consistent with applicable setpoint methodology.
| |
| Nominal trip setpoints are specified in the setpoint calculations. The nominal setpoints are selected to ensure (continued)
| |
| LaSalle 2 B 3.3.2.1-16 Revision 44
| |
| | |
| UNIT 2 Control Rod Block Instrumentation Contro I B 3.3.2.1 BASES APPLICABLE that the setpoints do not exceed the Allowable Values SAFETY ANALYSES, between successive CHANNEL CALIBRATIONS. Operation with a LCO, and trip setpoint less conservative than the nominal trip APPLICABILITY setpoint, but within its Allowable Value, is acceptable.
| |
| (continued) Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor power), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g.,
| |
| trip unit) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The trip setpoints are determined from the analytic limits, corrected for defined process, calibration, and instrument errors. The Allowable Values are then determined, based on the trip setpoint values, by accounting for the calibration based errors. These calibration based errors are limited to reference accuracy, instrument drift, errors associated with measurement and test equipment, and calibration tolerance of loop components. The trip setpoints and Allowable Values determined in this manner provide adequate protection because instrument uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for and appropriately applied for the instrumentation.
| |
| The RBM is assumed to mitigate the consequences of an RWE event when operating t 30% RTP and a non-peripheral control rod is selected. Below this power level or if a peripheral control rod is selected, the consequences of an RWE event will not exceed the MCPR SL and, therefore, the RBM is not required to be OPERABLE (Ref. 4).
| |
| : 2. Rod Worth Minimizer The RWM enforces the analyzed rod position sequence to ensure that the initial conditions of the CRDA analysis are not violated. The analytical methods and assumptions used in evaluating the CRDA are summarized in References 5, 6, and 7. The analyzed rod position sequence requires that control rods be moved in groups, with all control rods assigned to a specific group required to be within specified banked positions. Requirements that the control rod sequence is in compliance with the analyzed rod position sequence are specified in LCO 3.1.6, "Rod Pattern Control."
| |
| (continued)
| |
| LaSalle 2 B 3.3.2.1-17 Revision 39
| |
| | |
| 2 Control Rod Block Instrumentation Contro I B 3.3.2.1 BASES APPLICABLE 2. Rod Worth Minimizer (continued)
| |
| SAFETY ANALYSES, LCO, and When performing a shutdown of the plant, an optional control APPLICABILITY rod sequence (Ref. 9) may be used if the coupling of each withdrawn control rod has been confirmed. The rods may be inserted without the need to stop at intermediate positions.
| |
| When using the Reference 9 control rod insertion sequence for shutdown, the rod worth minimizer may be reprogrammed to enforce the requirements of the improved control rod insertion process.
| |
| The RWM Function satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| Since the RWM is a system designed to act as a backup to operator control of the rod sequences, only one channel of the RWM is required to be OPERABLE (Ref. 7). The RWM function is included with the sequence enforcement logic in each of the two RCMS controllers, and so normally operates with two channels. Special circumstances provided for in the Required Action of LCO 3.1.3, "Control Rod OPERABILITY,"
| |
| and LCO 3.1.6 may necessitate bypassing the RWM to allow continued operation with inoperable control rods, or to allow correction of a control rod pattern not in compliance with the analyzed rod position sequence. The RWM may be bypassed as required by these conditions, but then it must be considered inoperable and the Required Actions of this LCO followed.
| |
| Compliance with the analyzed rod position sequence, and therefore OPERABILITY of the RWM, is required in MODES 1 and 2 when THERMAL POWER is d 10% RTP. When THERMAL POWER is ! 10% RTP, there is no possible control rod configuration that results in a control rod worth that could exceed the 280 cal/gm fuel design limit during a CRDA (Refs. 6 and 7).
| |
| In MODES 3 and 4, all control rods are required to be inserted into the core; therefore, a CRDA cannot occur. In MODE 5, since only a single control rod can be withdrawn from a core cell containing fuel assemblies, adequate SDM ensures that the consequences of a CRDA are acceptable, since the reactor will be subcritical.
| |
| (continued)
| |
| LaSalle 2 B 3.3.2.1-18 Revision 51
| |
| | |
| UNIT 2 Control Rod Block Instrumentation Contro I B 3.3.2.1 BASES APPLICABLE 3. Reactor Mode SwitchShutdown Position SAFETY ANALYSES, LCO, and During MODES 3 and 4, and during MODE 5 when the reactor APPLICABILITY mode switch is in the shutdown position, the core is assumed (continued) to be subcritical; therefore, no positive reactivity insertion events are analyzed. The Reactor Mode Switch-Shutdown Position control rod withdrawal block ensures that the reactor remains subcritical by blocking control rod withdrawal, thereby preserving the assumptions of the safety analysis.
| |
| The Reactor Mode SwitchShutdown Position Function satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| Two channels are required to be OPERABLE to ensure that no single channel failure will preclude a rod block when required. There is no Allowable Value for this Function since the channels are mechanically actuated based solely on reactor mode switch position.
| |
| During shutdown conditions (MODES 3 and 4, and MODE 5 when the reactor mode switch is in the shutdown position), no positive reactivity insertion events are analyzed because assumptions are that control rod withdrawal blocks are provided to prevent criticality. Therefore, when the reactor mode switch is in the shutdown position, the control rod withdrawal block is required to be OPERABLE. During MODE 5 with the reactor mode switch in the refueling position, the refuel position one-rod-out interlock (LCO 3.9.2, "Refuel Position One-Rod-Out Interlock")
| |
| provides the required control rod withdrawal blocks.
| |
| ACTIONS A.1 With one RBM channel inoperable, the remaining OPERABLE channel is adequate to perform the control rod block function; however, overall reliability is reduced because a single failure in the remaining OPERABLE channel can result in no control rod block capability for the RBM. For this reason, Required Action A.1 requires restoration of the inoperable channel to OPERABLE status. The Completion Time of 24 hours is based on the low probability of an event occurring coincident with a failure in the remaining OPERABLE channel.
| |
| (continued)
| |
| LaSalle 2 B 3.3.2.1-19 Revision 39
| |
| | |
| UNIT 2 Control Rod Block Instrumentation Contro I B 3.3.2.1 BASES ACTIONS B.1 (continued)
| |
| If Required Action A.1 is not met and the associated Completion Time has expired, the inoperable channel must be placed in trip within 1 hour. If both RBM channels are inoperable, the RBM is not capable of performing its intended function; thus, one channel must also be placed in trip. This initiates a control rod withdrawal block, thereby ensuring that the RBM function is met.
| |
| The 1 hour Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities and is acceptable because it minimizes risk while allowing time for restoration or tripping of inoperable channels.
| |
| C.1, C.2.1.1, C.2.1.2, and C.2.2 With the RWM inoperable during a reactor startup, the operator is still capable of enforcing the prescribed control rod sequence. However, the overall reliability is reduced because a single operator error can result in violating the control rod sequence. Therefore, control rod movement must be immediately suspended except by scram.
| |
| Alternatively, startup may continue if at least 12 control rods have already been withdrawn, or a reactor startup with an inoperable RWM during withdrawal of one or more of the first 12 control rods was not performed in the last 12 months. These requirements minimize the number of reactor startups initiated with the RWM inoperable.
| |
| Required Actions C.2.1.1 and C.2.1.2 require verification of these conditions by review of plant logs and control room indications. Once Required Action C.2.1.1 or C.2.1.2 is satisfactorily completed, control rod withdrawal may proceed in accordance with the restrictions imposed by Required Action C.2.2. Required Action C.2.2 allows for the RWM Function to be performed manually and requires a double check of compliance with the prescribed rod sequence by a second licensed operator (Reactor Operator or Senior Reactor Operator) or other task qualified member of the technical staff (e.g., shift technical advisor or reactor engineer).
| |
| The RWM may be bypassed under these conditions to allow continued operations. In addition, Required Actions of LCO 3.1.3 and LCO 3.1.6 may require bypassing the RWM, (continued)
| |
| LaSalle 2 B 3.3.2.1-20 Revision 39
| |
| | |
| UNIT 2 Control Rod Block Instrumentation Contro I B 3.3.2.1 BASES ACTIONS C.1, C.2.1.1, C.2.1.2, and C.2.2 (continued) during which time the RWM must be considered inoperable with Condition C entered and its Required Actions taken.
| |
| D.1 With the RWM inoperable during a reactor shutdown, the operator is still capable of enforcing the prescribed control rod sequence. Required Action D.1 allows for the RWM Function to be performed manually and requires a double check of compliance with the prescribed rod sequence by a second licensed operator (Reactor Operator or Senior Reactor Operator) or other task qualified member of the technical staff (e.g., shift technical advisor or reactor engineer).
| |
| The RWM may be bypassed under these conditions to allow the reactor shutdown to continue.
| |
| E.1 and E.2 With one Reactor Mode SwitchShutdown Position control rod withdrawal block channel inoperable, the remaining OPERABLE channel is adequate to perform the control rod withdrawal block function. However, since the Required Actions are consistent with the normal action of an OPERABLE Reactor Mode SwitchShutdown Position Function (i.e., maintaining all control rods inserted), there is no distinction between having one or two channels inoperable.
| |
| In both cases (one or both channels inoperable), suspending all control rod withdrawal and initiating action to fully insert all insertable control rods in core cells containing one or more fuel assemblies will ensure that the core is subcritical with adequate SDM ensured by LCO 3.1.1. Control rods in core cells containing no fuel assemblies do not affect the reactivity of the core and are therefore not required to be inserted. Action must continue until all insertable control rods in core cells containing one or more fuel assemblies are fully inserted.
| |
| SURVEILLANCE As noted at the beginning of the SRs, the SRs for each REQUIREMENTS Control Rod Block instrumentation Function are found in the SRs column of Table 3.3.2.1-1.
| |
| (continued)
| |
| LaSalle 2 B 3.3.2.1-21 Revision 39
| |
| | |
| UNIT 2 Control Rod Block Instrumentation Contro I B 3.3.2.1 BASES SURVEILLANCE The Surveillances are modified by a second Note to indicate REQUIREMENTS that when an RBM channel is placed in an inoperable status (continued) solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours provided the associated Function maintains control rod block capability. Upon completion of the Surveillance, or expiration of the 6 hour allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken.
| |
| This Note is based on the reliability analysis (Ref. 8) assumption of the average time required to perform channel Surveillance. That analysis demonstrated that the 6 hour testing allowance does not significantly reduce the probability that a control rod block will be initiated when necessary.
| |
| SR 3.3.2.1.1 A CHANNEL FUNCTIONAL TEST is performed for each RBM channel to ensure that the entire channel will perform the intended function. It includes the Reactor Manual Control Multiplexing System input. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.
| |
| Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.2.1.2 and SR 3.3.2.1.3 A CHANNEL FUNCTIONAL TEST is performed for the RWM to ensure that the entire system will perform the intended function.
| |
| A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This (continued)
| |
| LaSalle 2 B 3.3.2.1-22 Revision 51
| |
| | |
| UNIT 2 Control Rod Block Instrumentation Contro I B 3.3.2.1 BASES SURVEILLANCE SR 3.3.2.1.2 and SR 3.3.2.1.3 (continued)
| |
| REQUIREMENTS is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. The CHANNEL FUNCTIONAL TEST for the RWM is performed by attempting to withdraw a control rod not in compliance with the prescribed sequence and verifying a control rod block occurs and by verifying proper annunciation of the selection error of at least one out-of-sequence control rod. As noted in the SRs, SR 3.3.2.1.2 is not required to be performed until 1 hour after any control rod is withdrawn at d 10% RTP in MODE 2 and SR 3.3.2.1.3 is not required to be performed until 1 hour after THERMAL POWER is d 10% RTP in MODE 1. The Note to SR 3.3.2.1.2 allows entry into MODE 2 on a startup and entry into MODE 2 concurrent with a power reduction to d 10% RTP during a shutdown to perform the required Surveillance if the Frequency is not met per SR 3.0.2. The Note to SR 3.3.2.1.3 allows a THERMAL POWER reduction to d 10% RTP in MODE 1 to perform the required Surveillance if the Frequency is not met per SR 3.0.2. The 1 hour allowances are based on operating experience and in consideration of providing a reasonable time in which to complete the SRs. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.2.1.4 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.
| |
| As noted, neutron detectors are excluded from the CHANNEL CALIBRATION because they are passive devices, with minimal drift, and because of the difficulty of simulating a meaningful signal. Neutron detectors are adequately tested in SR 3.3.1.1.2 and SR 3.3.1.1.8.
| |
| (continued)
| |
| LaSalle 2 B 3.3.2.1-23 Revision 51
| |
| | |
| UNIT 2 Control Rod Block Instrumentation Contro I B 3.3.2.1 BASES SURVEILLANCE SR 3.3.2.1.4 (continued)
| |
| REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.2.1.5 The RBM is automatically bypassed when power is below a specified value or if a peripheral control rod is selected.
| |
| The power level is determined from the APRM signals input to each RBM channel. The automatic bypass setpoint must be verified periodically to be < 30% RTP. In addition, it must also be verified that the RBM is not bypassed when a control rod that is not a peripheral control rod is selected (only one non-peripheral control rod is required to be verified).
| |
| If any bypass setpoint is nonconservative, then the affected RBM channel is considered inoperable. Alternatively, the APRM channel can be placed in the conservative condition to enable the RBM. If placed in this condition, the SR is met and the RBM channel is not considered inoperable. As noted, neutron detectors are excluded from the Surveillance because they are passive devices, with minimal drift, and because of the difficulty of simulating a meaningful signal. Neutron detectors are adequately tested in SR 3.3.1.1.2 and SR 3.3.1.1.8. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.2.1.6 The RWM is automatically bypassed when power is above a specified value. The power level is determined from steam flow signal. The automatic bypass setpoint must be verified periodically to be > 10% RTP. If the RWM low power setpoint is nonconservative, then the RWM is considered inoperable.
| |
| Alternately, the low power setpoint channel can be placed in the conservative condition (nonbypass). If placed in the nonbypassed condition, the SR is met and the RWM is not considered inoperable. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| (continued)
| |
| LaSalle 2 B 3.3.2.1-24 Revision 51
| |
| | |
| UNIT 2 Control Rod Block Instrumentation Contro I B 3.3.2.1 BASES SURVEILLANCE SR 3.3.2.1.7 REQUIREMENTS (continued) A CHANNEL FUNCTIONAL TEST is performed for the Reactor Mode SwitchShutdown Position Function to ensure that the entire channel will perform the intended function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. The CHANNEL FUNCTIONAL TEST for the Reactor Mode SwitchShutdown Position Function is performed by attempting to withdraw any control rod with the reactor mode switch in the shutdown position and verifying a control rod block occurs.
| |
| As noted in the SR, the Surveillance is not required to be performed until 1 hour after the reactor mode switch is in the shutdown position, since testing of this interlock with the reactor mode switch in any other position cannot be performed without using jumpers, lifted leads, or movable links. This allows entry into MODES 3 and 4 if the Frequency is not met per SR 3.0.2. The 1 hour allowance is based on operating experience and in consideration of providing a reasonable time in which to complete the SRs.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.2.1.8 The RWM will only enforce the proper control rod sequence if the rod sequence is properly input into the RWM computer.
| |
| This SR ensures that the proper sequence is loaded into the RWM so that it can perform its intended function. The Surveillance is performed once prior to declaring RWM OPERABLE following loading of sequence into RWM, since this is when rod sequence input errors are possible.
| |
| (continued)
| |
| LaSalle 2 B 3.3.2.1-25 Revision 51
| |
| | |
| UNIT 2 Control Rod Block Instrumentation Contro I B 3.3.2.1 BASES SURVEILLANCE SR 3.3.2.1.9 REQUIREMENTS (continued) LCO 3.1.3 and LCO 3.1.6 may require individual control rods to be bypassed (taken out of service) in the RWM to allow insertion of an inoperable control rod or correction of a control rod pattern not in compliance with the analyzed rod position sequence. With the control rods bypassed (taken out of service) in the RWM, the RWM will provide insert and withdraw blocks for bypassed control rods that are fully inserted and a withdraw block for bypassed control rods that are not fully inserted. To ensure the proper bypassing and movement of those affected control rods, a second licensed operator (Reactor Operator or Senior Reactor Operator) or other task qualified member of the technical staff (e.g.,
| |
| shift technical advisor or reactor engineer) must verify the bypassing and position of these control rods. Compliance with this SR allows the RWM to be OPERABLE with these control rods bypassed.
| |
| REFERENCES 1. UFSAR, Section 7.7.6.3.
| |
| : 2. UFSAR, Section 7.7.2.2.3.
| |
| : 3. UFSAR, Section 7.7.7.2.3.
| |
| : 6. UFSAR, Section 15.4.2.3.
| |
| : 7. UFSAR, Section 15.4.9.
| |
| : 6. "Modifications to the Requirements for Control Rod Drop Accident Mitigating Systems," BWR Owners' Group, July 1986.
| |
| : 7. NRC SER, "Acceptance of Referencing of Licensing Topical Report NEDE-24011-P-A," "General Electric Standard Application for Reactor Fuel, Revision 8, Amendment 17," December 27, 1987.
| |
| : 10. GENE-770-06-1-A, "Addendum to Bases for Changes to Surveillance Test Intervals and Allowed Out-of-Service Times for Selected Instrumentation Technical Specifications," December 1992.
| |
| : 11. NEDO-33091-A, Revision 2, "Improved BPWS Control Rod Insertion Process," July 2004.
| |
| LaSalle 2 B 3.3.2.1-26 Revision 51
| |
| | |
| Feedwater System and Main Turbine High Water Level Trip Instrumentation B 3.3.2.2 B 3.3 INSTRUMENTATION B 3.3.2.2 Feedwater System and Main Turbine High Water Level Trip Instrumentation BASES BACKGROUND The Feedwater System and Main Turbine High Water Level Trip Instrumentation is designed to detect a potential failure of the Feedwater Level Control System that causes excessive feedwater flow.
| |
| With excessive feedwater flow, the water level in the reactor vessel rises toward the high water level, Level 8 reference point, causing the trip of the two feedwater pump turbines, the motor-driven feedwater pump and the main turbine.
| |
| Reactor Vessel Water LevelHigh, Level 8 signals are provided by differential pressure transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level in the reactor vessel (variable leg). Four channels of Reactor Vessel Water LevelHigh, Level 8 instrumentation are provided as input to the initiation logic that trips the two feedwater pump turbines, the motor-driven feedwater pump and the main turbine. Trip channels A and B each receive an input from Reactor Vessel Water Level-High, Level 8 channels and trip channel C receives an input from two Reactor Vessel Water LevelHigh, Level 8 channels. Trip channel C has one instrument that shares the same narrow range variable leg with trip channel A, and a second instrument that shares the narrow range variable leg with the instrument of trip channel B. Each of the trip channels will trip if any Reactor Vessel Water LevelHigh, Level 8 channel trips. Each of the three trip channel outputs are provided as inputs to the individual trip logics associated with each feedwater pump turbine, the motor-driven feedwater pump, and the main turbine. The trip channel inputs are arranged in a two-out-of-three logic for each initiation logic. The channels include electronic equipment (e.g., trip units) that compares measured input signals with pre- established setpoints. When the setpoint is exceeded, the channel output relay actuates, which then outputs a feedwater system and main turbine trip signal to the trip logic.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.2.2-1 Revision 0
| |
| | |
| Feedwater System and Main Turbine High Water Level Trip Instrumentation B 3.3.2.2 BASES BACKGROUND A trip of the feedwater pump turbines and the motor-driven (continued) feedwater pump limits further increase in reactor vessel water level by limiting further addition of feedwater to the reactor vessel. A trip of the main turbine and closure of the stop valves protects the turbine from damage due to water entering the turbine.
| |
| APPLICABLE The Feedwater System and Main Turbine High Water Level Trip SAFETY ANALYSES Instrumentation is assumed to be capable of providing a trip of the feedwater turbines, the motor-driven feedwater pump, and the main turbine in the design basis transient analysis for a feedwater controller failure, maximum demand event (Ref. 1). The Level 8 trip indirectly initiates a reactor scram from the main turbine trip (above 25% RTP) and trips the feedwater pumps, thereby terminating the event. The reactor scram mitigates the reduction in MCPR.
| |
| Feedwater System and Main Turbine High Water Level Trip Instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The LCO requires four channels (combined into three trip channels) of the Reactor Vessel Water LevelHigh, Level 8 instrumentation to be OPERABLE to ensure that no single instrument failure or variable leg failure will prevent the feedwater pump turbines, the motor-driven feedwater pump, and main turbine to trip on a valid Level 8 signal. Two of the three trip channels are needed to provide trip signals in order for the feedwater and main turbine and motor-driven feedwater pump trips to occur. Each channel must have its setpoint set within the specified Allowable Value of SR 3.3.2.2.3. The Allowable Value is set to ensure that the thermal limits are not exceeded during the event. The actual setpoint is calibrated to be consistent with the applicable setpoint methodology assumptions. Nominal trip setpoints are specified in the setpoint calculations. The nominal setpoints are selected to ensure that the setpoints do not exceed the Allowable Value between successive CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.2.2-2 Revision 0
| |
| | |
| Feedwater System and Main Turbine High Water Level Trip Instrumentation B 3.3.2.2 BASES LCO Trip setpoints are those predetermined values of output at (continued) which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The trip setpoints are determined from the analytic limits, corrected for defined process, calibration, and instrument errors.
| |
| The Allowable Values are then determined, based on the trip setpoint values, by accounting for the calibration based errors. These calibration based errors are limited to reference accuracy, instrument drift, errors associated with measurement and test equipment, and calibration tolerance of loop components. The trip setpoints and Allowable Values determined in this manner provide adequate protection because instrument uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for and appropriately applied for the instrumentation.
| |
| APPLICABILITY The Feedwater System and Main Turbine High Water Level Trip Instrumentation is required to be OPERABLE at t 25% RTP to ensure that the fuel cladding integrity Safety Limit and the cladding 1% plastic strain limit are not violated during the feedwater controller failure, maximum demand event. As discussed in the Bases for LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)," LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)," and LCO 3.2.3, "LINEAR HEAT GENERATION RATE," sufficient margin to these limits exists below 25% RTP; therefore, these requirements are only necessary when operating at or above this power level.
| |
| ACTIONS A Note has been provided to modify the ACTIONS related to Feedwater System and Main Turbine High Water Level Trip Instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions (continued)
| |
| LaSalle 1 and 2 B 3.3.2.2-3 Revision 0
| |
| | |
| Feedwater System and Main Turbine High Water Level Trip Instrumentation B 3.3.2.2 BASES ACTIONS of the Condition continue to apply for each additional (continued) failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable Feedwater System and Main Turbine High Water Level Trip Instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable Feedwater System and Main Turbine High Water Level Trip Instrumentation channel.
| |
| A.1 With one or more channels inoperable and trip capability maintained, the remaining OPERABLE channels can provide the required trip signal. However, overall instrumentation reliability is reduced because a single failure in one of the remaining channels concurrent with feedwater controller failure, maximum demand event, or a variable leg failure may result in the instrumentation not being able to perform its intended function. Therefore, continued operation is only allowed for a limited time. If the inoperable channel cannot be restored to OPERABLE status within the Completion Time, the channel must be placed in the tripped condition per Required Action A.1. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue with no further restrictions.
| |
| Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in a feedwater turbine, motor-driven feedwater pump, or main turbine trip), Condition C must be entered and its Required Action taken.
| |
| The Completion Time of 7 days is based on the low probability of the event occurring coincident with a single failure in a remaining OPERABLE channel. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.
| |
| B.1 With the feedwater system and main turbine high water level trip capability not maintained, the feedwater system and main turbine high water level trip instrumentation cannot (continued)
| |
| LaSalle 1 and 2 B 3.3.2.2-4 Revision 89
| |
| | |
| Feedwater System and Main Turbine High Water Level Trip Instrumentation B 3.3.2.2 BASES ACTIONS B.1 (continued) perform its design function. Therefore, continued operation is only permitted for a 2 hour period, during which feedwater system and main turbine high water level trip capability must be restored. The trip capability is considered maintained when sufficient channels are OPERABLE or in trip such that the feedwater system and main turbine high water level trip logic will generate a trip signal on a valid signal. This requires two of the three trip channels to have one feedwater system and main turbine high water level channel OPERABLE or in trip. If the required channels cannot be restored to OPERABLE status or placed in trip, Condition C must be entered and its Required Action taken.
| |
| The 2 hour Completion Time is sufficient for the operator to take corrective action, and takes into account the likelihood of an event requiring actuation of Feedwater System and Main Turbine High Water Level Trip Instrumentation occurring during this period. It is also consistent with the 2 hour Completion Time provided in LCO 3.2.2 for Required Action A.1, since this instrumentation's purpose is to preclude a MCPR violation.
| |
| C.1 and C.2 With the channel(s) not restored to OPERABLE status or placed in trip, THERMAL POWER must be reduced to 25% RTP within 4 hours. As discussed in the Applicability section of the Bases, operation below 25% RTP results in sufficient margin to the required limits, and the Feedwater System and Main Turbine High Water Level Trip Instrumentation is not required to protect fuel integrity during the feedwater controller failure, maximum demand event. Alternatively, if a channel is inoperable solely due to an inoperable motor-driven feedwater pump breaker or feedwater stop valve, the affected feedwater pump(s) may be removed from service since this performs the intended function of the instrumentation.
| |
| The allowed Completion Time of 4 hours is based on operating experience to reduce THERMAL POWER to 25% RTP from full power conditions in an orderly manner and without challenging plant systems.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.2.2-5 Revision 0
| |
| | |
| Feedwater System and Main Turbine High Water Level Trip Instrumentation B 3.3.2.2 BASES (continued)
| |
| SURVEILLANCE The Surveillances are modified by a Note to indicate that REQUIREMENTS when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours provided the Function maintains feedwater system and main turbine high water level trip capability. Upon completion of the Surveillance, or expiration of the 6 hour allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Ref. 2) assumption that 6 hours is the average time required to perform channel Surveillance. That analysis demonstrated that the 6 hour testing allowance does not significantly reduce the probability that the feedwater pump turbines, motor-driven feedwater pump, and main turbine will trip when necessary.
| |
| SR 3.3.2.2.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.
| |
| Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels, or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
| |
| Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limits.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal, but more frequent, checks of channel status during normal operational use of the displays associated with the channels required by the LCO.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.2.2-6 Revision 51
| |
| | |
| Feedwater System and Main Turbine High Water Level Trip Instrumentation B 3.3.2.2 BASES SURVEILLANCE SR 3.3.2.2.2 REQUIREMENTS (continued) A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the channel will perform the intended function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.2.2.3 CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.2.2.4 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required trip logic for a specific channel. The system functional test of the feedwater and main turbine stop valves and the motor-driven feedwater pump breaker is included as part of this Surveillance and overlaps the LOGIC SYSTEM FUNCTIONAL TEST to provide (continued)
| |
| LaSalle 1 and 2 B 3.3.2.2-7 Revision 51
| |
| | |
| Feedwater System and Main Turbine High Water Level Trip Instrumentation B 3.3.2.2 BASES SURVEILLANCE SR 3.3.2.2.4 (continued)
| |
| REQUIREMENTS complete testing of the assumed safety function. Therefore, if a turbine stop valve or motor feedwater pump breaker is incapable of operating, the associated instrumentation would also be inoperable. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 15.1.2A.
| |
| : 2. GENE-770-06-1-A, "Bases for Changes to Surveillance Test Intervals and Allowed Out-Of-Service Times for Selected Instrumentation Technical Specifications,"
| |
| December 1992.
| |
| LaSalle 1 and 2 B 3.3.2.2-8 Revision 51
| |
| | |
| PAM Instrumentation B 3.3.3.1 B 3.3 INSTRUMENTATION B 3.3.3.1 Post Accident Monitoring (PAM) Instrumentation BASES BACKGROUND The primary purpose of the PAM instrumentation is to display, in the control room, plant variables that provide information required by the control room operators during accident situations. This information provides the necessary support for the operator to take the manual actions for which no automatic control is provided and that are required for safety systems to accomplish their safety functions for Design Basis Events. The instruments that monitor these variables are designated as Type A, Category I, and non-Type A, Category I in accordance with Regulatory Guide 1.97 (Ref. 1).
| |
| The OPERABILITY of the accident monitoring instrumentation ensures that there is sufficient information available on selected plant parameters to monitor and assess plant status and behavior following an accident. This capability is consistent with the recommendations of Reference 1.
| |
| APPLICABLE The PAM instrumentation LCO ensures the OPERABILITY of SAFETY ANALYSES Regulatory Guide 1.97, Type A, variables so that the control room operating staff can:
| |
| * Perform the diagnosis specified in the Emergency Operating Procedures (EOP). These variables are restricted to preplanned actions for the primary success path of Design Basis Accidents (DBAs)
| |
| (e.g., loss of coolant accident (LOCA)); and
| |
| * Take the specified, preplanned, manually controlled actions for which no automatic control is provided, which are required for safety systems to accomplish their safety function.
| |
| The PAM instrumentation LCO also ensures OPERABILITY of Category I, non-Type A, variables. This ensures the control room operating staff can:
| |
| * Determine whether systems important to safety are performing their intended functions; (continued)
| |
| LaSalle 1 and 2 B 3.3.3.1-1 Revision 0
| |
| | |
| PAM Instrumentation B 3.3.3.1 BASES APPLICABLE
| |
| * Determine the potential for causing a gross breach of SAFETY ANALYSES the barriers to radioactivity release; (continued)
| |
| * Determine whether a gross breach of a barrier has occurred; and
| |
| * Initiate action necessary to protect the public and to obtain an estimate of the magnitude of any impending threat.
| |
| The plant specific Regulatory Guide 1.97 analysis (Ref. 2) documents the process that identified Type A and Category I, non-Type A, variables.
| |
| PAM instrumentation that meets the definition of Type A in Regulatory Guide 1.97 satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). Category I, non-Type A, instrumentation is retained in the Technical Specifications (TS) because it is intended to assist operators in minimizing the consequences of accidents. Therefore, these Category I, non-Type A, variables are important for reducing public risk.
| |
| LCO LCO 3.3.3.1 requires two OPERABLE channels for all but one Function to ensure no single failure prevents the operators from being presented with the information necessary to determine the status of the unit and to bring the unit to, and maintain it in, a safe condition following an accident.
| |
| Furthermore, providing two channels allows a CHANNEL CHECK during the post accident phase to confirm the validity of displayed information.
| |
| The exception of the two channel requirement is primary containment isolation valve (PCIV) position. In this case, the important information is the status of the primary containment penetrations. The LCO requires one position indicator for each active (e.g., automatic) PCIV. This is sufficient to redundantly verify the isolation status of each isolable penetration either via indicated status of the active valve and prior knowledge of passive valve or via system boundary status. If a normally active PCIV is known to be closed and deactivated, position indication is not needed to determine status. Therefore, the position indication for closed and deactivated valves is not required to be OPERABLE.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.3.1-2 Revision 0
| |
| | |
| PAM Instrumentation B 3.3.3.1 BASES LCO Listed below is a discussion of the specified instrument (continued) Functions listed in Table 3.3.3.1-1.
| |
| : 1. Reactor Steam Dome Pressure Reactor steam dome pressure is a Type A and Category I variable provided to support monitoring of Reactor Coolant System (RCS) integrity and to verify operation of the Emergency Core Cooling Systems (ECCS). Two independent pressure transmitters with a range of 0 psig to 1500 psig monitor pressure. Wide range recorders are the primary indication used by the operator during an accident.
| |
| Therefore, the PAM Specification deals specifically with this portion of the instrument channel.
| |
| : 2. Reactor Vessel Water Level Reactor vessel water level is a Category I variable provided to support monitoring of core cooling and to verify operation of the ECCS. The wide range and fuel zone range water level channels provide the PAM Reactor Vessel Water Level Function. The range of the recorded/indicated level is from the top of the feedwater control range (just above the high level turbine trip point) down to a point just below the bottom of the active fuel. Reactor vessel water level is measured by six independent differential pressure transmitters (i.e., four wide range channels and two fuel zone range channels). These channels provide output to recorders and indicators. Each division of the required reactor vessel water level channels must include a recorder.
| |
| These instruments are the primary indication used by the operator during an accident. Therefore, the PAM Specification deals specifically with this portion of the instrument channel.
| |
| The reactor vessel water level instruments are uncompensated for variation in reactor water density and are calibrated to be most accurate at a specific vessel pressure and temperature. The wide range instruments are calibrated at 1000 psig reactor pressure with appropriate temperature compensation and no jet pump flow. The fuel zone range instruments are calibrated at saturated conditions at 0 psig with no jet pump flow.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.3.1-3 Revision 0
| |
| | |
| PAM Instrumentation B 3.3.3.1 BASES LCO 3. Suppression Pool Water Level (continued)
| |
| Suppression pool water level is a Type A and Category I variable provided to detect a breach in the reactor coolant pressure boundary (RCPB). This variable is also used to verify and provide long term surveillance of ECCS function.
| |
| The wide range suppression pool water level measurement provides the operator with sufficient information to assess the status of the RCPB and to assess the status of the water supply to the ECCS. The wide range water level indicators monitor the suppression pool level from 14 feet above normal level down to the lowest ECCS suction point. Two wide range suppression pool water level signals are transmitted from separate transmitters and are continuously displayed on two control room indicators, and separately recorded on two recorders in the control room. These instruments are the primary indication used by the operator during an accident.
| |
| Therefore, the PAM Specification deals specifically with this portion of the instrument channel.
| |
| : 4. Drywell Pressure Drywell pressure is a Type A and Category I variable provided to detect a breach of the RCPB and to verify ECCS functions that operate to maintain RCS integrity. There are four drywell pressure monitoring channels, two wide range channels and two narrow range channels. The combined range of these instruments is from -5 to 200 psig. The signals from the drywell pressure monitoring channels are continuously recorded and displayed on two control room recorders and the wide range channels are also displayed on indicators. These instruments are the primary indication used by the operator during an accident. Therefore, the PAM Specification deals specifically with this portion of the instrument channel.
| |
| : 5. Primary Containment Gross Gamma Radiation Primary containment gross gamma radiation is a Category 1 variable provided to monitor for the potential of significant radiation releases and to provide release assessment for use by operators in determining the need to invoke site emergency plans.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.3.1-4 Revision 0
| |
| | |
| PAM Instrumentation B 3.3.3.1 BASES LCO 5. Primary Containment Gross Gamma Radiation (continued)
| |
| Two redundant radiation detectors are located inside the drywell that have a range of 100 R/hr to 108 R/hr. These radiation monitors display on recorders located in the control room. Two radiation monitors/recorders are required to be OPERABLE (one per division). Therefore, the PAM Specification deals specifically with this portion of the instrument channel.
| |
| : 6. Penetration Flow Path Primary Containment Isolation Valve (PCIV) Position PCIV (excluding check valves, relief valves, manual valves, CRD solenoid valves, vacuum breakers, and excess flow check valves) position is a Category I variable provided for verification of containment integrity. In the case of PCIV position, the important information is the isolation status of the containment penetration. The LCO requires one channel of valve position indication in the control room to be OPERABLE for each active PCIV in a containment penetration flow path requiring post-accident valve position indication, i.e., two total channels of PCIV position indication for a penetration flow path with two active valves requiring post-accident valve position indication.
| |
| For containment penetrations with only one active PCIV having control room indication, Note (b) requires a single channel of valve position indication to be OPERABLE. This is sufficient to verify redundantly the isolation status of each isolable penetration via indicated status of the active valve, as applicable, and prior knowledge of passive valve or system boundary status. If a penetration is isolated, position indication for the PCIV(s) in the associated penetration flow path is not needed to determine status.
| |
| Therefore, the position indication for valves in an isolated penetration is not required to be OPERABLE. Each penetration is treated separately and each penetration flow path is considered a separate function. Therefore, separate Condition entry is allowed for each inoperable penetration flow path.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.3.1-5 Revision 0
| |
| | |
| PAM Instrumentation B 3.3.3.1 BASES LCO 6. Penetration Flow Path Primary Containment Isolation Valve (PCIV) Position (continued)
| |
| The indication for each PCIV is provided in the control room. Indicator lights illuminate to indicate PCIV position. Therefore, the PAM Specification deals specifically with this portion of the instrumentation channel.
| |
| 7,8 (Deleted)
| |
| : 9. Suppression Pool Water Temperature Suppression pool water temperature is a Type A and Category I variable provided to detect a condition that could potentially lead to containment breach, and to verify the effectiveness of ECCS actions taken to prevent containment breach. The suppression pool water temperature instrumentation allows operators to detect trends in suppression pool water temperature in sufficient time to take action to prevent steam quenching vibrations in the suppression pool. There are 14 total RTD instrument wells in the suppression pool. Each RTD well has two RTDs. Each (continued)
| |
| LaSalle 1 and 2 B 3.3.3.1-6 Revision 24
| |
| | |
| PAM Instrumentation B 3.3.3.1 BASES LCO 9. Suppression Pool Water Temperature (continued) channel receives input from the RTDs in 7 wells for a total of 14 RTDs. A channel is considered OPERABLE if it receives input from at least one OPERABLE RTD from each of the 7 wells. The RTDs are distributed throughout the pool area so as to be able to redundantly detect a stuck open safety/relief valve continuous discharge into the pool.
| |
| The output for each channel of sensors is recorded on an independent recorder in the control room. These recorders are the primary indication used by the operator during an accident. Therefore, the PAM Specification deals specifically with this portion of the instrument channels.
| |
| APPLICABILITY The PAM instrumentation LCO is applicable in MODES 1 and 2.
| |
| These variables are related to the diagnosis and preplanned actions required to mitigate DBAs. The applicable DBAs are assumed to occur in MODES 1 and 2. In MODES 3, 4, and 5, plant conditions are such that the likelihood of an event that would require PAM instrumentation is extremely low; therefore, PAM instrumentation is not required to be OPERABLE in these MODES.
| |
| ACTIONS A Note has been provided to modify the ACTIONS related to PAM instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required (continued)
| |
| LaSalle 1 and 2 B 3.3.3.1-7 Revision 24
| |
| | |
| PAM Instrumentation B 3.3.3.1 BASES ACTIONS Actions of the Condition continue to apply for each (continued) additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable PAM instrumentation channels provide appropriate compensatory measures for separate inoperable functions. As such, a Note has been provided that allows separate Condition entry for each inoperable PAM Function.
| |
| A.1 When one or more Functions have one required channel that is inoperable, the required inoperable channel must be restored to OPERABLE status within 30 days. The 30 day Completion Time is based on operating experience and takes into account the remaining OPERABLE channel or remaining isolation barrier (in the case of primary containment penetrations with only one PCIV), the passive nature of the instrument (no critical automatic action is assumed to occur from these instruments), and the low probability of an event requiring PAM instrumentation during this interval.
| |
| B.1 If a channel has not been restored to OPERABLE status in 30 days, this Required Action specifies initiation of actions in accordance with Specification 5.6.6, which requires a written report to be submitted to the NRC. This report discusses the results of the root cause evaluation of the inoperability and identifies proposed restorative actions. This Required Action is appropriate in lieu of a shutdown requirement since another OPERABLE channel is monitoring the Function, an alternative method of monitoring is available and given the likelihood of plant conditions that would require information provided by this instrumentation.
| |
| C.1 When one or more Functions have two required channels that are inoperable (i.e., two channels inoperable in the same Function), one channel in the Function should be restored to OPERABLE status within 7 days. The Completion Time of (continued)
| |
| LaSalle 1 and 2 B 3.3.3.1-8 Revision 0
| |
| | |
| PAM Instrumentation B 3.3.3.1 BASES ACTIONS C.1 (continued) 7 days is based on the relatively low probability of an event requiring PAM instrument operation and the availability of alternate means to obtain the required information. Continuous operation with two required channels inoperable in a Function is not acceptable because the alternate indications may not fully meet all performance qualification requirements applied to the PAM instrumentation. Therefore, requiring restoration of one inoperable channel of the Function limits the risk that the PAM Function will be in a degraded condition should an accident occur.
| |
| D.1 This Required Action directs entry into the appropriate Condition referenced in Table 3.3.3.1-1. The applicable Condition referenced in the Table is Function dependent.
| |
| Each time an inoperable channel has not met the Required Action of Condition C, and the associated Completion Time has expired, Condition D is entered for that channel and provides for transfer to the appropriate subsequent Condition.
| |
| E.1 For the majority of Functions in Table 3.3.3.1-1, if the Required Action and associated Completion Time of Condition C is not met, the plant must be placed in a MODE in which the LCO does not apply. This is done by placing the plant in at least MODE 3 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant condition from full power conditions in an orderly manner and without challenging plant systems.
| |
| F.1 Since alternate means of monitoring primary containment gross gamma radiation have been developed and tested, the Required Action is not to shut down the plant but rather to follow the directions of Specification 5.6.6. These (continued)
| |
| LaSalle 1 and 2 B 3.3.3.1-9 Revision 0
| |
| | |
| PAM Instrumentation B 3.3.3.1 BASES ACTIONS F.1 (continued) alternate means may be temporarily installed if the normal PAM channel cannot be restored to OPERABLE status within the allotted time. The report provided to the NRC should discuss the alternate means used, describe the degree to which the alternate means are equivalent to the installed PAM channels, justify the areas in which they are not equivalent, and provide a schedule for restoring the normal PAM channels.
| |
| SURVEILLANCE As noted at the beginning of the SRs, the following SRs REQUIREMENTS apply to each PAM instrumentation Function in Table 3.3.3.1-1.
| |
| The Surveillances are modified by a second Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours, provided the other required channel in the associated Function is OPERABLE. Upon completion of the Surveillance, or expiration of the 6 hour allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken.
| |
| The 6 hour testing allowance is acceptable since it does not significantly reduce the probability of properly monitoring post-accident parameters, when necessary.
| |
| SR 3.3.3.1.1 Performance of the CHANNEL CHECK ensures that a gross instrumentation failure has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.
| |
| Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.3.1-10 Revision 51
| |
| | |
| PAM Instrumentation B 3.3.3.1 BASES SURVEILLANCE SR 3.3.3.1.1 (continued)
| |
| REQUIREMENTS Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of those displays associated with the channels required by the LCO.
| |
| SR 3.3.3.1.2 (Deleted)
| |
| SR 3.3.3.1.3 For Function 6, the CHANNEL CALIBRATION shall consist of verifying that the position indication conforms to the actual valve position. CHANNEL CALIBRATION is a complete check of the instrument loop including the sensor. The test verifies that the channel responds to the measured parameter with the necessary range and accuracy. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. Regulatory Guide 1.97, "Instrumentation for Light-Water Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and Following an Accident," Revision 2, December 1980.
| |
| : 2. NRC Safety Evaluation Report, "Commonwealth Edison Company, LaSalle County Station, Unit Nos. 1 and 2, Conformance to Regulatory Guide 1.97," dated August 20, 1987.
| |
| LaSalle 1 and 2 B 3.3.3.1-11 Revision 51
| |
| | |
| Remote Shutdown Monitoring System B 3.3.3.2 B 3.3 INSTRUMENTATION B 3.3.3.2 Remote Shutdown Monitoring System BASES BACKGROUND The Remote Shutdown Monitoring System provides the control room operator with sufficient instrumentation to support maintaining the plant in a safe shutdown condition from a location other than the control room. This capability is necessary to protect against the possibility of the control room becoming inaccessible. A safe shutdown condition is defined as MODE 3. With the plant in MODE 3, the Reactor Core Isolation Cooling (RCIC) System, the safety/relief valves, and the Residual Heat Removal (RHR) System can be used to remove core decay heat and meet all safety requirements. The long term supply of water for the RCIC System and the ability to operate shutdown cooling from outside the control room allow extended operation in MODE 3.
| |
| In the event that the control room becomes inaccessible, the operators can monitor the status of the reactor and the suppression pool and the operation of the RHR and RCIC Systems at the remote shutdown panel and support maintaining the plant in MODE 3. The plant is in MODE 3 following a plant shutdown and can be maintained safely in MODE 3 for an extended period of time.
| |
| The OPERABILITY of the Remote Shutdown Monitoring System instrumentation Functions ensures that there is sufficient information available on selected plant parameters to support maintaining the plant in MODE 3 should the control room become inaccessible.
| |
| APPLICABLE The Remote Shutdown Monitoring System is required to provide SAFETY ANALYSES instrumentation at appropriate locations outside the control room with a design capability to support maintaining the plant in a safe condition in MODE 3.
| |
| The criteria governing the design and the specific system requirements of the Remote Shutdown Monitoring System are located in UFSAR, Section 7.4.4 (Ref. 1).
| |
| The Remote Shutdown Monitoring System is considered an important contributor to reducing the risk of accidents; as such, it meets Criterion 4 of 10 CFR 50.36(c)(2)(ii).
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.3.2-1 Revision 0
| |
| | |
| Remote Shutdown Monitoring System B 3.3.3.2 BASES (continued)
| |
| LCO The Remote Shutdown Monitoring System LCO provides the requirements for the OPERABILITY of the instrumentation necessary to support maintaining the plant in MODE 3 from a location other than the control room. The instrumentation Functions required are listed in the Technical Requirements Manual (Ref. 2).
| |
| The instrumentation is that required for:
| |
| * Reactor pressure vessel (RPV) pressure control;
| |
| * Decay heat removal; and
| |
| * RPV inventory control.
| |
| The Remote Shutdown Monitoring System is OPERABLE if all instrument channels needed to support the remote shutdown monitoring functions are OPERABLE with readouts displayed in the remote shutdown panel external to the control room.
| |
| The Remote Shutdown Monitoring System instruments covered by this LCO do not need to be energized to be considered OPERABLE. This LCO is intended to ensure that the instruments will be OPERABLE if plant conditions require that the Remote Shutdown Monitoring System be placed in operation.
| |
| APPLICABILITY The Remote Shutdown Monitoring System LCO is applicable in MODES 1 and 2. This is required so that the plant can be maintained in MODE 3 for an extended period of time from a location other than the control room.
| |
| This LCO is not applicable in MODES 3, 4, and 5. In these MODES, the plant is already subcritical and in a condition of reduced Reactor Coolant System energy. Under these conditions, considerable time is available to restore necessary instrument Functions if control room instruments become unavailable. Consequently, the LCO does not require OPERABILITY in MODES 3, 4, and 5.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.3.2-2 Revision 0
| |
| | |
| Remote Shutdown Monitoring System B 3.3.3.2 BASES (continued)
| |
| ACTIONS The Remote Shutdown Monitoring System is inoperable when each required function is not accomplished by at least one designated Remote Shutdown Monitoring System channel that satisfies the OPERABILITY criteria for the channel's Function. These criteria are outlined in the LCO section of the Bases.
| |
| A Note has been provided to modify the ACTIONS related to Remote Shutdown Monitoring System Functions. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable Remote Shutdown Monitoring System Functions provide appropriate compensatory measures for separate Functions.
| |
| As such, a Note has been provided that allows separate Condition entry for each inoperable Remote Shutdown Monitoring System Function.
| |
| A.1 Condition A addresses the situation where one or more required Functions of the Remote Shutdown Monitoring System is inoperable. This includes any required Function listed in Reference 2.
| |
| The Required Action is to restore the Function to OPERABLE status within 30 days. The Completion Time is based on operating experience and the low probability of an event that would require evacuation of the control room.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.3.2-3 Revision 19
| |
| | |
| Remote Shutdown Monitoring System B 3.3.3.2 BASES ACTIONS B.1 (continued)
| |
| If the Required Action and associated Completion Time of Condition A are not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. The allowed Completion Time is reasonable, based on operating experience, to reach the required MODE from full power conditions in an orderly manner and without challenging plant systems.
| |
| SURVEILLANCE The Surveillances are modified by a Note to indicate that REQUIREMENTS when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours. Upon completion of the Surveillance, or expiration of the 6 hour allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. The 6 hour testing allowance is acceptable since it does not significantly reduce the probability of properly monitoring remote shutdown parameters, when necessary.
| |
| SR 3.3.3.2.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.
| |
| Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.3.2-4 Revision 51
| |
| | |
| Remote Shutdown Monitoring System B 3.3.3.2 BASES SURVEILLANCE SR 3.3.3.2.1 (continued)
| |
| REQUIREMENTS Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit. As specified in the Surveillance, a CHANNEL CHECK is only required for those channels that are normally energized.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.3.2.2 CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. The test verifies the channel responds to measured parameter values with the necessary range and accuracy.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 7.4.4.
| |
| : 2. Technical Requirements Manual.
| |
| LaSalle 1 and 2 B 3.3.3.2-5 Revision 51
| |
| | |
| EOC-RPT Instrumentation B 3.3.4.1 B 3.3 INSTRUMENTATION B 3.3.4.1 End of Cycle Recirculation Pump Trip (EOC-RPT) Instrumentation BASES BACKGROUND The EOC-RPT instrumentation initiates a recirculation pump trip (RPT), if operating in fast speed, to reduce the peak reactor pressure and power resulting from turbine trip or generator load rejection transients to provide additional margin to the MCPR Safety Limit (SL).
| |
| The need for the additional negative reactivity in excess of that normally inserted on a scram reflects end of cycle reactivity considerations. Flux shapes at the end of cycle are such that the control rods may not be able to ensure that thermal limits are maintained by inserting sufficient negative reactivity during the first few feet of rod travel upon a scram caused by Turbine Control Valve (TCV)Fast Closure, Trip Oil PressureLow, or Turbine Stop Valve (TSV)-Closure. The physical phenomenon involved is that the void reactivity feedback due to a pressurization transient can add positive reactivity at a faster rate than the control rods can add negative reactivity.
| |
| The EOC-RPT instrumentation as shown in Reference 1 is comprised of sensors that detect initiation of closure of the TSVs, or fast closure of the TCVs, combined with relays and logic circuits, to actuate reactor recirculation pump downshift logic to trip each pump from fast speed (60 Hz).
| |
| The channels include instrument switches that actuate pre-established setpoints. When the setpoint is exceeded, the switch actuates, which then outputs an EOC-RPT signal to the trip logic to downshift the pumps. When the EOC-RPT breakers (3A, 3B, 4A, and 4B; the fast speed breakers) trip open, the recirculation pumps coast down under their own inertia, breakers 1A and 1B close to start the LFMG, and the low frequency breakers 2A and 2B close automatically on a motor speed interlock to operate the recirculation pumps on low speed (although the recirculation pump start in low speed is not part of the EOC-RPT Instrumentation safety function). The EOC-RPT has two identical trip systems, either of which can actuate an RPT.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.4.1-1 Revision 0
| |
| | |
| EOC-RPT Instrumentation B 3.3.4.1 BASES BACKGROUND Each EOC-RPT trip system is a two-out-of-two logic for each (continued) Function; thus, either two TSVClosure or two TCVFast Closure, Trip Oil PressureLow signals are required for a trip system to actuate. If either trip system actuates, both recirculation pumps, if operating in fast speed, will trip. There are two EOC-RPT breakers in series per recirculation pump. One trip system trips one of the two EOC-RPT breakers for each recirculation pump and the second trip system trips the other EOC-RPT breaker for each recirculation pump.
| |
| APPLICABLE The TSVClosure and the TCVFast Closure, Trip Oil SAFETY ANALYSES, PressureLow Functions are designed to trip the LCO, and recirculation pumps, if operating in fast speed, in the APPLICABILITY event of a turbine trip or generator load rejection to mitigate the neutron flux, heat flux and pressurization transients, and to increase the margin to the MCPR SL. The analytical methods and assumptions used in evaluating the turbine trip and generator load rejection, as well as other safety analyses that assume EOC-RPT, are summarized in References 2, 3, and 4.
| |
| To mitigate pressurization transient effects, the EOC-RPT must trip the recirculation pumps, if operating in fast speed, after initiation of initial closure movement of either the TSVs or the TCVs. The combined effects of this trip and a scram reduce fuel bundle power more rapidly than does a scram alone, resulting in an increased margin to the MCPR SL. Alternatively, MCPR limits for an inoperable EOC-RPT as specified in the COLR are sufficient to mitigate pressurization transient effects. The EOC-RPT function is automatically disabled when THERMAL POWER as sensed by turbine first stage pressure is < 25% RTP.
| |
| EOC-RPT instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| The OPERABILITY of the EOC-RPT is dependent on the OPERABILITY of the individual instrumentation channel Functions. Each Function must have a required number of OPERABLE channels in each trip system, with their setpoints within the specified Allowable Value of SR 3.3.4.1.2. The actual setpoint is calibrated consistent with applicable (continued)
| |
| LaSalle 1 and 2 B 3.3.4.1-2 Revision 0
| |
| | |
| EOC-RPT Instrumentation B 3.3.4.1 BASES APPLICABLE setpoint methodology assumptions. Channel OPERABILITY also SAFETY ANALYSES, includes the associated EOC-RPT breakers. Each channel LCO, and (including the associated EOC-RPT breakers) must also APPLICABILITY respond within its assumed response time.
| |
| (continued)
| |
| Allowable Values are specified for each EOC-RPT Function specified in the LCO. Nominal trip setpoints are specified in the setpoint calculations. The nominal setpoints are selected to ensure the setpoints do not exceed the Allowable Value between successive CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value. Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., TCV electrohydraulic control (EHC) pressure), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g.,
| |
| trip switches) change state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The trip setpoints are determined from the analytic limits, corrected for defined process, calibration, and instrument errors. The Allowable Values are then determined, based on the trip setpoint values, by accounting for the calibration based errors.
| |
| These calibration based errors are limited to reference accuracy, instrument drift, errors associated with measurement and test equipment, and calibration tolerance of loop components. The trip setpoints and Allowable Values determined in this manner provide adequate protection because instrument uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for and appropriately applied for the instrumentation.
| |
| The specific Applicable Safety Analysis, LCO, and Applicability discussions are listed below on a Function by Function basis.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.4.1-3 Revision 0
| |
| | |
| EOC-RPT Instrumentation B 3.3.4.1 BASES APPLICABLE Alternately, since this instrumentation protects against a SAFETY ANALYSES, MCPR SL violation with the instrumentation inoperable, LCO, and modifications to the MCPR limits (LCO 3.2.2) may be applied APPLICABILITY to allow this LCO to be met. The MCPR limit for the (continued) condition EOC-RPT inoperable is specified in the COLR.
| |
| Turbine Stop ValveClosure Closure of the TSVs and a main turbine trip result in the loss of a heat sink that produces reactor pressure, neutron flux, and heat flux transients that must be limited.
| |
| Therefore, an RPT is initiated on TSVClosure, in anticipation of the transients that would result from closure of these valves. EOC-RPT decreases reactor power and aids the reactor scram in ensuring the MCPR SL is not exceeded during the worst case transient.
| |
| Closure of the TSVs is determined by monitoring the position of each stop valve. There is one valve stem position switch associated with each stop valve, and the signal from each switch is assigned to a separate trip channel. The logic for the TSVClosure Function is such that two or more TSVs must be closed to produce an EOC-RPT. This Function must be enabled at THERMAL POWER 25% RTP. This is normally accomplished automatically by pressure switches sensing turbine first stage pressure; therefore, opening of the turbine bypass valves may affect the OPERABILITY of this Function. Four channels of TSVClosure, with two channels in each trip system, are available and required to be OPERABLE to ensure that no single instrument failure will preclude an EOC-RPT from this Function on a valid signal.
| |
| The TSVClosure Allowable Value is selected to detect imminent TSV closure.
| |
| This protection is required, consistent with the safety analysis assumptions, whenever THERMAL POWER is 25% RTP with any recirculating pump in fast speed. Below 25% RTP or with the recirculation in slow speed, the Reactor Vessel Steam Dome PressureHigh and the Average Power Range Monitor (APRM) Fixed Neutron FluxHigh Functions of the Reactor Protection System (RPS) are adequate to maintain the necessary safety margins.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.4.1-4 Revision 0
| |
| | |
| EOC-RPT Instrumentation B 3.3.4.1 BASES APPLICABLE TCVFast Closure, Trip Oil PressureLow SAFETY ANALYSES, LCO, and Fast closure of the TCVs during a generator load rejection APPLICABILITY results in the loss of a heat sink that produces reactor (continued) pressure, neutron flux, and heat flux transients that must be limited. Therefore, an RPT is initiated on TCVFast Closure, Trip Oil PressureLow in anticipation of the transients that would result from the closure of these valves. The EOC-RPT decreases reactor power and aids the reactor scram in ensuring that the MCPR SL is not exceeded during the worst case transient.
| |
| Fast closure of the TCVs is determined by measuring the EHC fluid pressure at each control valve. There is one pressure switch associated with each control valve, and the signal from each switch is assigned to a separate trip channel.
| |
| The logic for the TCVFast Closure, Trip Oil PressureLow Function is such that two or more TCVs must be closed (pressure switch trips) to produce an EOC-RPT. This Function must be enabled at THERMAL POWER 25% RTP. This is normally accomplished automatically by pressure switches sensing turbine first stage pressure; therefore, opening of the turbine bypass valves may affect the OPERABILITY of this Function. Four channels of TCVFast Closure, Trip Oil PressureLow with two channels in each trip system, are available and required to be OPERABLE to ensure that no single instrument failure will preclude an EOC-RPT from this Function on a valid signal. The TCVFast Closure, Trip Oil PressureLow Allowable Value is selected high enough to detect imminent TCV fast closure.
| |
| This protection is required consistent with the analysis, whenever the THERMAL POWER is 25% RTP with any recirculating pump in fast speed. Below 25% RTP or with recirculation pumps in slow speed, the Reactor Vessel Steam Dome PressureHigh and the APRM Fixed Neutron FluxHigh Functions of the RPS are adequate to maintain the necessary safety margins. The turbine first stage pressure/reactor power relationship for the setpoint of the automatic enable is identical to that described for TSV closure.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.4.1-5 Revision 0
| |
| | |
| EOC-RPT Instrumentation B 3.3.4.1 BASES (continued)
| |
| ACTIONS A Note has been provided to modify the ACTIONS related to EOC-RPT instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable EOC-RPT instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable EOC-RPT instrumentation channel.
| |
| A.1 and A.2 With one or more required channels inoperable, but with EOC-RPT trip capability maintained (refer to Required Action B.1 and B.2 Bases), the EOC-RPT System is capable of performing the intended function. However, the reliability and redundancy of the EOC-RPT instrumentation is reduced such that a single failure in the remaining trip system could result in the inability of the EOC-RPT System to perform the intended function. Therefore, only a limited time is allowed to restore compliance with the LCO. Because of the diversity of sensors available to provide trip signals, the low probability of extensive numbers of inoperabilities affecting all diverse Functions, and the low probability of an event requiring the initiation of an EOC-RPT, 72 hours is allowed to restore the inoperable channels (Required Action A.1) or apply the EOC-RPT inoperable MCPR limit. Alternately, the inoperable channels may be placed in trip (Required Action A.2) since this would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue. As noted in Required Action A.2, placing the channel in trip with no further restrictions is not allowed if the inoperable channel is the result of an inoperable breaker, since this may not adequately compensate for the inoperable breaker (e.g., the breaker may be (continued)
| |
| LaSalle 1 and 2 B 3.3.4.1-6 Revision 0
| |
| | |
| EOC-RPT Instrumentation B 3.3.4.1 BASES ACTIONS A.1 and A.2 (continued) inoperable such that it will not open). If it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an RPT), or if the inoperable channel is the result of an inoperable breaker, Condition C must be entered and its Required Actions taken.
| |
| B.1 and B.2 Required Actions B.1 and B.2 are intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in the Function not maintaining EOC-RPT trip capability. A Function is considered to be maintaining EOC-RPT trip capability when sufficient channels are OPERABLE or in trip, such that the EOC-RPT System will generate a trip signal from the given Function on a valid signal and both recirculation pumps, if operating in fast speed, can be tripped. This requires two channels of the Function, in the same trip system, to each be OPERABLE or in trip, and the associated EOC-RPT breakers to be OPERABLE or in trip.
| |
| Alternatively, Required Action B.2 requires the MCPR limit for inoperable EOC-RPT, as specified in the COLR, to be applied. This also restores the margin to MCPR assumed in the safety analysis.
| |
| The 2 hour Completion Time is sufficient for the operator to take corrective action, and takes into account the likelihood of an event requiring actuation of the EOC-RPT instrumentation during this period. It is also consistent with the 2 hour Completion Time provided in LCO 3.2.2, Required Action A.1, since this instrumentation's purpose is to preclude a MCPR violation.
| |
| C.1 and C.2 With any Required Action and associated Completion Time not met, THERMAL POWER must be reduced to < 25% RTP within 4 hours. Alternately, the associated recirculation pump fast speed breaker may be removed from service since this performs the intended function of the instrumentation. The (continued)
| |
| LaSalle 1 and 2 B 3.3.4.1-7 Revision 0
| |
| | |
| EOC-RPT Instrumentation B 3.3.4.1 BASES ACTIONS C.1 and C.2 (continued) allowed Completion Time of 4 hours is reasonable, based on operating experience, to reduce THERMAL POWER to < 25% RTP from full power conditions in an orderly manner and without challenging plant systems.
| |
| SURVEILLANCE The Surveillances are modified by a Note to indicate that REQUIREMENTS when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours, provided the associated Function maintains EOC-RPT trip capability. Upon completion of the Surveillance, or expiration of the 6 hour allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Ref. 5) assumption of the average time required to perform channel surveillance. That analysis demonstrated that the 6 hour testing allowance does not significantly reduce the probability that the recirculation pumps will trip when necessary.
| |
| SR 3.3.4.1.1 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the channel will perform the intended function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.4.1-8 Revision 51
| |
| | |
| EOC-RPT Instrumentation B 3.3.4.1 BASES SURVEILLANCE SR 3.3.4.1.2 REQUIREMENTS (continued) CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.4.1.3 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required trip logic for a specific channel. The system functional test of the pump breakers is included as a part of this test, overlapping the LOGIC SYSTEM FUNCTIONAL TEST, to provide complete testing of the associated safety function. Therefore, if a breaker is incapable of operating, the associated instrument channel would also be inoperable.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.4.1.4 This SR ensures that an EOC-RPT initiated from the TSV-Closure and TCVFast Closure, Trip Oil PressureLow Functions will not be inadvertently bypassed when THERMAL POWER is 25% RTP. This involves calibration of the bypass channels. Adequate margins for the instrument setpoint methodologies are incorporated into the actual setpoint.
| |
| Because main turbine bypass flow can affect this setpoint (continued)
| |
| LaSalle 1 and 2 B 3.3.4.1-9 Revision 51
| |
| | |
| EOC-RPT Instrumentation B 3.3.4.1 BASES SURVEILLANCE SR 3.3.4.1.4 (continued)
| |
| REQUIREMENTS nonconservatively (THERMAL POWER is derived from first stage pressure), the main turbine bypass valves must remain closed during an in-service calibration at THERMAL POWER 25% RTP, if performing the calibration using actual turbine first stage pressure, to ensure that the calibration remains valid. If any bypass channel's setpoint is nonconservative (i.e., the Functions are bypassed at 25% RTP either due to open main turbine bypass valves or other reasons), the affected TSVClosure and TCVFast Closure, Trip Oil PressureLow Functions are considered inoperable.
| |
| Alternatively, the bypass channel can be placed in the conservative condition (nonbypass). If placed in the nonbypass condition, this SR is met and the channel considered OPERABLE.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.4.1.5 This SR ensures that the individual channel response times are less than or equal to the maximum values assumed in the accident analysis. The EOC-RPT SYSTEM RESPONSE TIME acceptance criteria are included in Reference 6.
| |
| EOC-RPT SYSTEM RESPONSE TIME may be verified by actual response time measurements in any series of sequential, over lapping, or total channel measurements. However, the response time of the limit switches for the TSVClosure Function may be assumed to be the design limit switch response time and therefore, is excluded from the EOC-RPT SYSTEM RESPONSE TIME testing. This is allowed, as documented in Reference 7, since the actual measurement of the limit switch response time is not practicable as this test is done during the refueling outage when the turbine stop valves are fully closed, and thus the limit switch in the circuitry is open. The design limit switch response time is 10 ms.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.4.1-10 Revision 51
| |
| | |
| EOC-RPT Instrumentation B 3.3.4.1 BASES SURVEILLANCE SR 3.3.4.1.5 (continued)
| |
| REQUIREMENTS A Note to the Surveillance states that breaker arc suppression time may be assumed from the most recent performance of SR 3.3.4.1.6. This is allowed since the arc suppression time is short and does not appreciably change, due to the design of the breaker opening device and the fact that the breaker is not routinely cycled.
| |
| Response times cannot be determined at power because operation of final actuated devices is required. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.4.1.6 This SR ensures that the EOC-RPT breaker arc suppression time is provided to the EOC-RPT SYSTEM RESPONSE TIME test.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Figure G.3.3-2.
| |
| : 2. UFSAR, Sections 7.6.4, G.3.3.3.8.2, and G.5.1.
| |
| : 3. UFSAR, Sections 15.1.2A, 15.2.2A, 15.2.3, and 15.3A.
| |
| : 4. UFSAR, Section 7.6.4.2.1.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.4.1-11 Revision 51
| |
| | |
| EOC-RPT Instrumentation B 3.3.4.1 BASES REFERENCES 5. GENE-770-06-1-A, "Bases for Changes To Surveillance (continued) Test Intervals And Allowed Out-Of-Service Times For Selected Instrumentation Technical Specifications,"
| |
| December 1992.
| |
| : 6. Technical Requirements Manual.
| |
| : 7. Letter, W.G. Guldemond (NRC) to C. Reed (ComEd), dated January 28, 1987.
| |
| LaSalle 1 and 2 B 3.3.4.1-12 Revision 0
| |
| | |
| ATWS-RPT Instrumentation B 3.3.4.2 B 3.3 INSTRUMENTATION B 3.3.4.2 Anticipated Transient Without Scram Recirculation Pump Trip (ATWS-RPT) Instrumentation BASES BACKGROUND The ATWS-RPT System initiates a recirculation pump trip, adding negative reactivity, following events in which a scram does not but should occur, to lessen the effects of an ATWS event. Tripping the recirculation pumps adds negative reactivity from the increase in steam voiding in the core area as core flow decreases. When Reactor Vessel Water LevelLow Low, Level 2 or Reactor Steam Dome PressureHigh setpoint is reached, the recirculation pump motor breakers trip.
| |
| The ATWS-RPT System (Ref. 1) includes sensors, relays, bypass capability, circuit breakers, and switches that are necessary to cause initiation of a recirculation pump trip.
| |
| The channels include electronic equipment (e.g., trip units) that compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the channel then outputs an ATWS-RPT signal to the trip logic.
| |
| The ATWS-RPT consists of two independent trip systems, with two channels of Reactor Steam Dome PressureHigh and two channels of Reactor Vessel Water LevelLow Low, Level 2, in each trip system. Each ATWS-RPT trip system is a one-out-of-two taken twice logic for each Function. Thus, either two Reactor Water LevelLow Low, Level 2 signals or two Reactor PressureHigh signals or Reactor Water Level-Low Low, Level 2 signal and Reactor Pressure-High signal will trip a trip system. The outputs of the channels in a trip system are combined in a logic so that either trip system will trip both recirculation pumps (by tripping the respective fast speed and low frequency motor generator (LFMG) motor breakers).
| |
| There are two fast speed motor breakers and one LFMG output breaker provided for each of the two recirculation pumps for a total of six breakers. The output of each trip system is provided to one fast speed motor breaker (3A, 3B) and the LFMG output breaker (2A, 2B) for each pump.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.4.2-1 Revision 31
| |
| | |
| ATWS-RPT Instrumentation B 3.3.4.2 BASES (continued)
| |
| APPLICABLE The ATWS-RPT is not assumed to mitigate any accident or SAFETY ANALYSES, transient in the safety analysis. The ATWS-RPT initiates an LCO, and RPT to aid in preserving the integrity of the fuel cladding APPLICABILITY following events in which scram does not, but should, occur.
| |
| Based on its contribution to the reduction of overall plant risk, however, the instrumentation meets Criterion 4 of 10 CFR 50.36(c)(2)(ii).
| |
| The OPERABILITY of the ATWS-RPT is dependent on the OPERABILITY of the individual instrumentation channel Functions. Each Function must have a required number of OPERABLE channels in each trip system, with their setpoints within the specified Allowable Value of SR 3.3.4.2.3. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions. Channel OPERABILITY also includes the associated recirculation pump fast speed and LFMG breakers.
| |
| Allowable Values are specified for each ATWS-RPT Function specified in the LCO. Nominal trip setpoints are specified in the setpoint calculations. The nominal setpoints are selected to ensure the setpoints do not exceed the Allowable Value between CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value. Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the ATWS analysis. The trip setpoints are determined from the analytic limits, corrected for defined process, calibration, and instrument errors. The Allowable Values are then determined, based on the trip setpoint values, by accounting for the calibration based errors. These calibration based errors are limited to reference accuracy, instrument drift, errors associated with measurement and test equipment, and calibration tolerance of loop components. The trip setpoints and Allowable Values determined in this manner provide adequate protection (continued)
| |
| LaSalle 1 and 2 B 3.3.4.2-2 Revision 0
| |
| | |
| ATWS-RPT Instrumentation B 3.3.4.2 BASES APPLICABLE because instrument uncertainties, process effects, SAFETY ANALYSES, calibration tolerances, instrument drift, and severe LCO, and environment errors (for channels that must function in harsh APPLICABILITY environments as defined by 10 CFR 50.49) are accounted for (continued) and appropriately applied for the instrumentation.
| |
| The individual Functions are required to be OPERABLE in MODE 1 to protect against common mode failures of the Reactor Protection System by providing a diverse trip to mitigate the consequences of a postulated ATWS event. The Reactor Steam Dome PressureHigh and Reactor Vessel Water LevelLow Low, Level 2 Functions are required to be OPERABLE in MODE 1, since the reactor is producing significant power and the recirculation system could be at high flow. During this MODE, the potential exists for pressure increases or low water level, assuming an ATWS event. In MODE 2, the reactor is at low power and the recirculation system is at low flow; thus, the potential is low for a pressure increase or low water level, assuming an ATWS event. Therefore, the ATWS-RPT is not necessary. In MODES 3 and 4, the reactor is shut down with all control rods inserted; thus, an ATWS event is not significant and the possibility of a significant pressure increase or low water level is negligible. In MODE 5, the one-rod-out interlock ensures the reactor remains subcritical; thus, an ATWS event is not significant. In addition, the reactor pressure vessel (RPV) head is not fully tensioned and no pressure transient threat to the reactor coolant pressure boundary (RCPB) exists.
| |
| The specific Applicable Safety Analyses and LCO discussions are listed below on a Function by Function basis.
| |
| : a. Reactor Vessel Water LevelLow Low, Level 2 Low RPV water level indicates the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, the ATWS-RPT System is initiated at Level 2 to aid in maintaining level above the top of the active fuel. The reduction of core flow reduces the neutron flux and THERMAL POWER and, therefore, the rate of coolant boiloff.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.4.2-3 Revision 0
| |
| | |
| ATWS-RPT Instrumentation B 3.3.4.2 BASES APPLICABLE a. Reactor Vessel Water LevelLow Low, Level 2 SAFETY ANALYSES, (continued)
| |
| LCO, and APPLICABILITY Reactor vessel water level signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.
| |
| Four channels of Reactor Vessel LevelLow Low, Level 2, with two channels in each trip system, are available and required to be OPERABLE to ensure that no single instrument failure can preclude an ATWS-RPT from this Function on a valid signal. The Reactor Vessel Water LevelLow Low, Level 2, Allowable Value is chosen so that the system will not initiate after a Level 3 scram with feedwater still available.
| |
| : b. Reactor Steam Dome PressureHigh Excessively high RPV pressure may rupture the RCPB. An increase in the RPV pressure during reactor operation compresses the steam voids and results in a positive reactivity insertion. This increases neutron flux and THERMAL POWER, which could potentially result in fuel failure and RPV overpressurization. The Reactor Steam Dome PressureHigh Function initiates an RPT for transients that result in a pressure increase, counteracting the pressure increase by rapidly reducing core power generation. For the overpressurization event, the RPT aids in the mitigation of the ATWS event and, along with the safety/relief valves (S/RVs), limits the peak RPV pressure to less than the ASME Section III Code Service Level C limits (1500 psig).
| |
| The Reactor Steam Dome PressureHigh signals are initiated from four pressure transmitters that monitor reactor steam dome pressure. Four channels of Reactor Steam Dome Pressure- High, with two channels in each trip system, are available and required to be OPERABLE to ensure that no single instrument failure can preclude an ATWS-RPT from this Function on a valid signal. The Reactor Steam Dome Pressure- High Allowable Value is chosen to provide an adequate margin to the ASME Section III Code Service Level C allowable Reactor Coolant System pressure.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.4.2-4 Revision 0
| |
| | |
| ATWS-RPT Instrumentation B 3.3.4.2 BASES (continued)
| |
| ACTIONS A Note has been provided to modify the ACTIONS related to ATWS-RPT instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable ATWS-RPT instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable ATWS-RPT instrumentation channel.
| |
| A.1 and A.2 With one or more channels inoperable, but with ATWS-RPT trip capability for each Function maintained (refer to Required Action B.1 and C.1 Bases), the ATWS-RPT System is capable of performing the intended function. However, the reliability and redundancy of the ATWS-RPT instrumentation is reduced, such that a single failure in the remaining trip system could result in the inability of the ATWS-RPT System to perform the intended function. Therefore, only a limited time is allowed to restore the inoperable channels to OPERABLE status. Because of the diversity of sensors available to provide trip signals, the low probability of extensive numbers of inoperabilities affecting all diverse Functions, and the low probability of an event requiring the initiation of ATWS-RPT, 14 days is provided to restore the inoperable channel (Required Action A.1). Alternately, the inoperable channel may be placed in trip (Required Action A.2), since this would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue. As noted, placing the channel in trip with no further restrictions is not allowed if the inoperable channel is the result of an inoperable breaker, since this may not adequately compensate for the inoperable breaker (e.g., the breaker may be inoperable such that it will not open). Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. If it is not (continued)
| |
| LaSalle 1 and 2 B 3.3.4.2-5 Revision 89
| |
| | |
| ATWS-RPT Instrumentation B 3.3.4.2 BASES ACTIONS A.1 and A.2 (continued) desirable to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an RPT), or if the inoperable channel is the result of an inoperable breaker, Condition D must be entered and its Required Actions taken.
| |
| B.1 Required Action B.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in the Function not maintaining ATWS-RPT trip capability. A Function is considered to be maintaining ATWS-RPT trip capability when sufficient channels are OPERABLE or in trip such that the ATWS-RPT System will generate a trip signal from the given Function on a valid signal, and both recirculation pumps can be tripped. This requires two channels of the Function in the same trip system to each be OPERABLE or in trip, and the corresponding motor breakers associated with ATWS-RPT (one fast speed and one LFMG per pump) to be OPERABLE or in trip.
| |
| The 72 hour Completion Time is sufficient for the operator to take corrective action (e.g., restoration or tripping of channels) and takes into account the likelihood of an event requiring actuation of the ATWS-RPT instrumentation during this period and the fact that one Function is still maintaining ATWS-RPT trip capability.
| |
| C.1 Required Action C.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within both Functions result in both Functions not maintaining ATWS-RPT trip capability. The description of a Function maintaining ATWS-RPT trip capability is discussed in the Bases for Required Action B.1, above.
| |
| The 1 hour Completion Time is sufficient for the operator to take corrective action and takes into account the likelihood of an event requiring actuation of the ATWS-RPT instrumentation during this period.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.4.2-6 Revision 0
| |
| | |
| ATWS-RPT Instrumentation B 3.3.4.2 BASES ACTIONS D.1 and D.2 (continued)
| |
| With any Required Action and associated Completion Time not met, the plant must be brought to a MODE or other specified condition in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 2 within 6 hours (Required Action D.2). Alternately, the associated recirculation pump may be removed from service since this performs the intended Function of the instrumentation (Required Action D.1). The allowed Completion Time of 6 hours is reasonable, based on operating experience, both to reach MODE 2 from full power conditions and to remove a recirculation pump from service in an orderly manner and without challenging plant systems.
| |
| SURVEILLANCE The Surveillances are modified by a Note to indicate that REQUIREMENTS when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours provided the associated Function maintains ATWS-RPT trip capability. Upon completion of the Surveillance, or expiration of the 6 hour allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Ref. 2) assumption of the average time required to perform channel surveillance. That analysis demonstrated that the 6 hour testing allowance does not significantly reduce the probability that the recirculation pumps will trip when necessary.
| |
| SR 3.3.4.2.1 Performance of the CHANNEL CHECK ensures that gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.
| |
| Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or (continued)
| |
| LaSalle 1 and 2 B 3.3.4.2-7 Revision 51
| |
| | |
| ATWS-RPT Instrumentation B 3.3.4.2 BASES SURVEILLANCE SR 3.3.4.2.1 (continued)
| |
| REQUIREMENTS something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
| |
| Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the required channels of this LCO.
| |
| SR 3.3.4.2.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the channel will perform the intended function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.
| |
| Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.4.2-8 Revision 51
| |
| | |
| ATWS-RPT Instrumentation B 3.3.4.2 BASES SURVEILLANCE SR 3.3.4.2.3 REQUIREMENTS (continued) A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies that the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.4.2.4 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required trip logic for a specific channel. The system functional test of the pump breakers, included as part of this Surveillance, overlaps the LOGIC SYSTEM FUNCTIONAL TEST to provide complete testing of the assumed safety function. Therefore, if a breaker is incapable of operating, the associated instrument channel(s) would be inoperable.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Appendix G.3.1.2.
| |
| : 2. GENE-770-06-1-A, "Bases For Changes To Surveillance Test Intervals and Allowed Out-of-Service Times For Selected Instrumentation Technical Specifications,"
| |
| December 1992.
| |
| LaSalle 1 and 2 B 3.3.4.2-9 Revision 51
| |
| | |
| ECCS Instrumentation B 3.3.5.1 B 3.3 INSTRUMENTATION B 3.3.5.1 Emergency Core Cooling System (ECCS) Instrumentation BASES BACKGROUND The purpose of the ECCS instrumentation is to initiate appropriate responses from the systems to ensure that fuel is adequately cooled in the event of a design basis accident or transient.
| |
| For most anticipated operational occurrences (AOOs) and Design Basis Accidents (DBAs), a wide range of dependent and independent parameters are monitored.
| |
| The ECCS instrumentation actuates low pressure core spray (LPCS), low pressure coolant injection (LPCI), high pressure core spray (HPCS), Automatic Depressurization System (ADS),
| |
| and the diesel generators (DGs). The equipment involved with each of these systems is described in the Bases for LCO 3.5.1, "ECCSOperating," or LCO 3.8.1, "AC Sources-Operating."
| |
| Low Pressure Core Spray System The LPCS System may be initiated by either automatic or manual means. Automatic initiation occurs for conditions of Reactor Vessel Water LevelLow Low Low, Level 1 or Drywell PressureHigh. Reactor vessel water level is monitored by two redundant differential pressure transmitters, each providing input to a trip unit. Drywell pressure is monitored by two pressure switches. The outputs of the four signals (two trip units and two pressure switches) are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic. The logic will provide an initiation signal if both reactor vessel water level channels or both drywell pressure channels trip. In addition, the logic will provide an initiation signal if a certain combination of reactor vessel water level and drywell pressure channels trip. The LPCS initiation signal is a sealed in signal and must be manually reset. The LPCS initiation signal also provides an initiation signal to the Division 1 LPCI initiation logic. The logic can also be (continued)
| |
| LaSalle 1 and 2 B 3.3.5.1-1 Revision 0
| |
| | |
| ECCS Instrumentation B 3.3.5.1 BASES BACKGROUND Low Pressure Core Spray System (continued) initiated by use of a manual push button. Upon receipt of an initiation signal, the LPCS pump is automatically started if normal AC power is available; otherwise the pump is started immediately after AC power is available from the DG.
| |
| The LPCS test line isolation valve, which is also a primary containment isolation valve (PCIV), is closed on a LPCS initiation signal to allow full system flow assumed in the accident analysis and maintains containment isolation in the event LPCS is not operating.
| |
| The LPCS pump discharge flow is monitored by a flow switch that senses the differential pressure across a flow element in the pump discharge line. When the pump is running and discharge flow is low enough that pump overheating may occur, the minimum flow return line valve is opened. The valve is automatically closed if flow is above the minimum flow setpoint to allow the full system flow assumed in the accident analysis.
| |
| The LPCS System also monitors the pressure within the injection line and in the reactor vessel to ensure that, before the injection valve opens, the injection line pressure and reactor pressure have fallen to a value below the LPCS System's maximum design pressure. The pressure in the LPCS injection line is monitored by one pressure switch while reactor pressure is monitored by two pressure switches. The injection valve will receive an open permissive signal if the LPCS injection line pressure switch senses low pressure (one-out-of-one logic) and if any one of the reactor pressure switches sense low pressure (one-out-of-two logic). The reactor vessel pressure switches also provide a permissive signal in the Division 1 LPCI injection valve.
| |
| Low Pressure Coolant Injection Subsystems The LPCI is an operating mode of the Residual Heat Removal (RHR) System, with three LPCI subsystems. The LPCI subsystems may be initiated by automatic or manual means.
| |
| Automatic initiation occurs for conditions of Reactor Vessel Water LevelLow Low Low, Level 1 or Drywell PressureHigh.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.5.1-2 Revision 0
| |
| | |
| ECCS Instrumentation B 3.3.5.1 BASES BACKGROUND Low Pressure Coolant Injection Subsystems (continued)
| |
| Reactor vessel water level is monitored by two redundant differential pressure transmitters per division, each providing input to a trip unit. Drywell pressure is monitored by two pressure switches per division. The outputs of the four Division 2 LPCI (loops B and C) signals (two trip units and two pressure switches) are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic. The logic will provide an initiation signal if both reactor vessel water level channels or both drywell pressure channels trip. In addition, the logic will provide an initiation signal if certain combinations of reactor vessel water level and drywell pressure channels trip. The Division 1 LPCI (loop A) receives its initiation signal from the LPCS logic, which uses a similar one-out-of-two taken twice logic. The two divisions can also be initiated by use of a manual push button (one per division, with the LPCI A manual push button being common with LPCS). Once an initiation signal is received by the LPCI control circuitry, the signal is sealed in until manually reset.
| |
| Upon receipt of an initiation signal, the LPCI Pump C is automatically started if normal AC power is available; otherwise the pump is started immediately after power is available from the DG while LPCI pumps A and B are automatically started if offsite power is available; otherwise the pumps are started in approximately 5 seconds after AC power from the DG is available. These time delays limit the loading on the standby power sources.
| |
| Each LPCI subsystem's discharge flow is monitored by a flow switch that senses the differential pressure across a flow element in the pump discharge line. When a pump is running and discharge flow is low enough that pump overheating may occur, the respective minimum flow return line valve is opened. The valve is automatically closed if flow is above the minimum flow setpoint to allow the full system flow assumed in the analyses.
| |
| The RHR test line suppression pool cooling isolation and suppression pool spray isolation valves (which are also PCIVs) are closed on a LPCI initiation signal to allow full system flow assumed in the accident analysis and maintain containment isolated in the event LPCI is not operating.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.5.1-3 Revision 0
| |
| | |
| ECCS Instrumentation B 3.3.5.1 BASES BACKGROUND Low Pressure Coolant Injection Subsystems (continued)
| |
| The LPCI subsystems monitor the pressure within the associated injection line and in the reactor vessel to ensure that, prior to an injection valve opening, the injection line pressure and reactor pressure have fallen to a value below the LPCI subsystem's maximum design pressure.
| |
| The pressure within each LPCI injection line is monitored by one pressure switch, while reactor pressure is monitored by two pressure switches, per division. The associated injection valve will receive an open permissive signal if the LPCI injection line pressure switch senses low pressure (one-out-of-one logic) and if any one of the associated reactor pressure switches sense low pressure (one-out-of-two logic, per division). The Division 1 LPCI (loop A) receives its reactor pressure signals from the LPCS logic.
| |
| High Pressure Core Spray System The HPCS System may be initiated by either automatic or manual means. Automatic initiation occurs for conditions of Reactor Vessel Water LevelLow Low, Level 2 or Drywell PressureHigh. Reactor vessel water level is monitored by four redundant differential pressure transmitters and drywell pressure is monitored by four redundant pressure switches. Each differential pressure transmitter provides input to a trip unit. The outputs of the trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic. Each pressure switch provides input to a relay whose contact is arranged in a one-out-of-two taken twice logic. The logic can also be initiated by use of a manual push button. The HPCS System initiation signal is a sealed in signal and must be manually reset.
| |
| The HPCS pump discharge flow and pressure are monitored by a differential pressure switch and a pressure switch, respectively. When the pump is running (as indicated by the pressure switch) and discharge flow is low enough that pump overheating may occur, the minimum flow return line valve is opened. The valve is automatically closed if flow is above the minimum flow setpoint to allow full system flow assumed in the accident analyses.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.5.1-4 Revision 0
| |
| | |
| ECCS Instrumentation B 3.3.5.1 BASES BACKGROUND High Pressure Core Spray System (continued)
| |
| The HPCS full flow test line isolation valve to the suppression pool (which is also a PCIV) is closed on a HPCS initiation signal to allow full system flow assumed in the accident analyses and maintain containment isolated in the event HPCS is not operating.
| |
| The HPCS System provides makeup water to the reactor until the reactor vessel water level reaches the high water level (Level 8) trip, at which time the HPCS injection valve closes. The HPCS pump will continue to run on minimum flow.
| |
| The logic is two-out-of-two to provide high reliability of the HPCS System. The injection valve automatically reopens if a low low water level signal is subsequently received.
| |
| Automatic Depressurization System ADS may be initiated by either automatic or manual means.
| |
| Automatic initiation occurs when signals indicating Reactor Vessel Water LevelLow Low Low, Level 1; Drywell Pressure-High or ADS Drywell Pressure Bypass Timer; confirmed Reactor Vessel Water LevelLow, Level 3; and either LPCS or LPCI Pump Discharge PressureHigh are all present, and the ADS Initiation Timer has timed out. There are two differential pressure transmitters for Reactor Vessel Water LevelLow Low Low, Level 1, two pressure switches for Drywell PressureHigh, and one differential pressure transmitter for confirmed Reactor Vessel Water LevelLow, Level 3 in each of the two ADS trip systems.
| |
| Each of the transmitters connects to a trip unit, which then drives a relay whose contacts input to the initiation logic.
| |
| Each pressure switch drives a relay whose contact also inputs to the initiation logic.
| |
| Each ADS trip system (trip system A and trip system B) includes a time delay between satisfying the initiation logic and the actuation of the ADS valves. The time delay chosen is long enough that the HPCS has time to operate to recover to a level above Level 1, yet not so long that the LPCI and LPCS systems are unable to adequately cool the fuel if the HPCS fails to maintain level. An alarm in the control room is annunciated when either of the timers is running. Resetting the ADS initiation signals resets the ADS Initiation Timers.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.5.1-5 Revision 0
| |
| | |
| ECCS Instrumentation B 3.3.5.1 BASES BACKGROUND Automatic Depressurization System (continued)
| |
| The ADS also monitors the discharge pressures of the three LPCI pumps and the LPCS pump. Each ADS trip system includes two discharge pressure permissive switches from each of the two low pressure ECCS pumps in the associated Division (i.e., Division 1 ECCS inputs to ADS trip system A and Division 2 ECCS inputs to ADS trip system B). The signals are used as a permissive for ADS actuation, indicating that there is a source of core coolant available once the ADS has depressurized the vessel. Any one of the four low pressure pumps provides sufficient core coolant flow to permit automatic depressurization.
| |
| The ADS logic in each trip system is arranged in two strings. One string has a contact from each of the following variables: Reactor Vessel Water LevelLow Low Low, Level 1; Drywell PressureHigh or ADS Drywell Pressure Bypass Timer; Reactor Vessel Water LevelLow, Level 3; ADS Initiation Timer; and two low pressure ECCS Discharge PressureHigh contacts (one from each divisional pump).
| |
| The other string has a contact from each of the following variables: Reactor Vessel Water LevelLow Low Low, Level 1; Drywell PressureHigh; ADS Drywell Pressure Bypass Timer; and two low pressure ECCS Discharge PressureHigh contacts (one from each divisional pump). To initiate an ADS trip system, the following applicable contacts must close in the associated string: Reactor Vessel Water Level-Low Low Low, Level 1; Drywell PressureHigh or ADS Drywell Pressure Bypass Timer; Reactor Vessel Water Level-Low, Level 3 (one string only); ADS Initiation Timer (one string only); and one of the two low pressure ECCS Discharge PressureHigh contacts.
| |
| Either ADS trip system A or trip system B will cause all the ADS valves to open. Once the Drywell PressureHigh or ADS initiation signals are present, they are individually sealed in until manually reset.
| |
| Manual initiation is accomplished by arming and depressing both ADS A trip system strings (Division 1) or both ADS B trip system strings (Division 2) which will cause the ADS valves to open with no time delay. No permissive interlocks (continued)
| |
| LaSalle 1 and 2 B 3.3.5.1-6 Revision 0
| |
| | |
| ECCS Instrumentation B 3.3.5.1 BASES BACKGROUND Automatic Depressurization System (continued) are required for the manual initiation. Manual inhibit switches are provided in the control room for ADS; however, their function is not required for ADS OPERABILITY (provided ADS is not inhibited when required to be OPERABLE).
| |
| Diesel Generators The Division 1, 2, and 3 DGs may be initiated by either automatic or manual means. Automatic initiation occurs for conditions of Reactor Vessel Water LevelLow Low Low, Level 1 or Drywell PressureHigh for DGs 0 and 1A (2A), and Reactor Vessel Water LevelLow Low, Level 2 or Drywell PressureHigh for DG 1B (2B). DG 0 is common to both units and will start on an initiation signal from both units. The other DGs will only start on an initiation signal from the unit ECCS logic. The DGs are also initiated upon loss of voltage signals. (Refer to Bases for LCO 3.3.8.1, "Loss of Power (LOP) Instrumentation," for a discussion of these signals.) The DGs receive their initiation signals from the associated Divisions' ECCS logic (i.e., DG 0 receives an initiation signal from Division 1 ECCS (LPCS and LPCI A);
| |
| DG 1A/2A receives an initiation signal from Division 2 ECCS (LPCI B and LPCI C); and DG 1B/2B receives an initiation signal from Division 3 ECCS (HPCS)). The DGs can also be started manually from the control room and locally in the associated DG room. The DG initiation signal is a sealed in signal and must be manually reset. The DG initiation logic is reset by resetting the associated ECCS initiation logic.
| |
| Upon receipt of a LOCA initiation signal, each DG is automatically started, is ready to load in approximately 13 seconds, and will run in standby conditions (rated voltage and speed, with the DG output breaker open). The DGs will only energize their respective emergency buses if a loss of offsite power occurs. (Refer to Bases for LCO 3.3.8.1.)
| |
| APPLICABLE The actions of the ECCS are explicitly assumed in the safety SAFETY ANALYSES, analyses of References 1, 2, and 3. The ECCS is initiated LCO, and to preserve the integrity of the fuel cladding by limiting APPLICABILITY the post LOCA peak cladding temperature to less than the 10 CFR 50.46 limits.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.5.1-7 Revision 0
| |
| | |
| ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE ECCS instrumentation satisfies Criterion 3 of SAFETY ANALYSES, 10 CFR 50.36(c)(2)(ii). Certain instrumentation Functions LCO, and are retained for other reasons and are described below in APPLICABILITY the individual Functions discussion.
| |
| (continued)
| |
| The OPERABILITY of the ECCS instrumentation is dependent upon the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.5.1-1. Each Function must have a required number of OPERABLE channels, with their setpoints within the specified Allowable Values, where appropriate. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.
| |
| Each ECCS subsystem must also respond within its assumed response time. Table 3.3.5.1-1, Footnote (a), is added to show that certain ECCS instrumentation Functions are also required to be OPERABLE to perform DG initiation.
| |
| Allowable Values are specified for each ECCS Function specified in the Table. Nominal trip setpoints are specified in the setpoint calculations. The nominal setpoints are selected to ensure that the setpoints do not exceed the Allowable Value between CHANNEL CALIBRATIONS.
| |
| Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value. Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The trip setpoints are determined from the analytic limits, corrected for defined process, calibration, and instrument errors. The Allowable Values are then determined, based on the trip setpoint values, by accounting for the calibration based errors.
| |
| These calibration based errors are limited to reference accuracy, instrument drift, errors associated with measurement and test equipment, and calibration tolerance of loop components. The trip setpoints and Allowable Values determined in this manner provide adequate protection (continued)
| |
| LaSalle 1 and 2 B 3.3.5.1-8 Revision 76
| |
| | |
| ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE because instrument uncertainties, process effects, SAFETY ANALYSES, calibration tolerances, instrument drift, and severe LCO, and environment errors (for channels that must function in APPLICABILITY harsh environments as defined by 10 CFR 50.49) are accounted (continued) for and appropriately applied for the instrumentation.
| |
| In general, the individual Functions are required to be OPERABLE in the MODES or other specified conditions that may require ECCS (or DG) initiation to mitigate the consequences of a design basis accident or transient. To ensure reliable ECCS and DG function, a combination of Functions is required to provide primary and secondary initiation signals.
| |
| The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.
| |
| Low Pressure Core Spray and Low Pressure Coolant Injection Systems 1.a, 2.a. Reactor Vessel Water LevelLow Low Low, Level 1 Low reactor pressure vessel (RPV) water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result.
| |
| The low pressure ECCS and associated DGs are initiated at Level 1 to ensure that core spray and flooding functions are available to prevent or minimize fuel damage. The Reactor Vessel Water LevelLow Low Low, Level 1 is one of the Functions assumed to be OPERABLE and capable of initiating the ECCS during the transients analyzed in References 1 and 3. In addition, the Reactor Vessel Water LevelLow Low Low, Level 1 Function is directly assumed in the analysis of the recirculation line break (Ref. 2). The core cooling function of the ECCS, along with the scram action of the Reactor Protection System (RPS), ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.5.1-9 Revision 0
| |
| | |
| ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 1.a, 2.a. Reactor Vessel Water LevelLow Low Low, Level 1 SAFETY ANALYSES, (continued)
| |
| LCO, and APPLICABILITY Reactor Vessel Water LevelLow Low Low, Level 1 signals are initiated from four differential pressure transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. The Reactor Vessel Water LevelLow Low Low, Level 1 Allowable Value is chosen to allow time for the low pressure core flooding systems to activate and provide adequate cooling.
| |
| Two channels of Reactor Vessel Water LevelLow Low Low, Level 1 Function per associated Division are only required to be OPERABLE when the associated ECCS is required to be OPERABLE for automatic initiation, to ensure that no single instrument failure can preclude the ECCS function. (Two channels input to LPCS, LPCI A, and the associated Division 1 DG, while the other two channels input to LPCI B, LPCI C, and Division 2 DG).
| |
| 1.b, 2.b. Drywell PressureHigh High pressure in the drywell could indicate a break in the reactor coolant pressure boundary (RCPB). The low pressure ECCS and associated DGs are initiated upon receipt of the Drywell PressureHigh Function in order to minimize the possibility of fuel damage. The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.
| |
| High drywell pressure signals are initiated from four pressure switches that sense drywell pressure. The Allowable Value was selected to be as low as possible and be indicative of a LOCA inside primary containment.
| |
| The Drywell PressureHigh Function is required to be OPERABLE when the associated ECCS is required to be OPERABLE in conjunction with times when the primary containment is (continued)
| |
| LaSalle 1 and 2 B 3.3.5.1-10 Revision 76
| |
| | |
| ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 1.b, 2.b. Drywell PressureHigh (continued)
| |
| SAFETY ANALYSES, LCO, and required to be OPERABLE. Thus, four channels of the LPCS APPLICABILITY and LPCI Drywell PressureHigh Function are required to be OPERABLE in MODES 1, 2, and 3 to ensure that no single instrument failure can preclude ECCS initiation. (Two channels input to LPCS, LPCI A, and the Division 1 DG, while the other two channels input to LPCI B, LPCI C, and the Division 2 DG.) In MODES 4 and 5, the Drywell Pressure-High Function is not required since there is insufficient energy in the reactor to pressurize the primary containment to Drywell PressureHigh setpoint.
| |
| 1.c, 2.c. LPCI Pump A and Pump B StartTime Delay Relay The purpose of this time delay is to stagger the start of the two ECCS pumps that are in each of Divisions 1 and 2, thus limiting the starting transients on the 4.16 kV emergency buses. This Function is only necessary when power is being supplied from the standby power sources (DG). On ECCS initiation, the time delay is bypassed if the normal feed breaker to the Class 1E switchgear is closed. The LPCI Pump StartTime Delay Relays are assumed to be OPERABLE in the accident and transient analyses requiring ECCS initiation. That is, the analysis assumes that the pumps will initiate when required and excess loading will not cause failure of the standby power sources (DG).
| |
| There are two LPCI Pump StartTime Delay Relays, one in each of the RHR "A" and RHR "B" pump start logic circuits.
| |
| While each time delay relay is dedicated to a single pump start logic, a single failure of a LPCI Pump StartTime Delay Relay could result in the failure of the two low pressure ECCS pumps, powered from the emergency bus, to perform their intended function within the assumed ECCS RESPONSE TIMES (e.g., as in the case where both ECCS pumps on one emergency bus start simultaneously due to an inoperable time delay relay). This still leaves two of the four low pressure ECCS pumps OPERABLE; thus, the single failure criterion is met (i.e., loss of one instrument does not preclude ECCS initiation). The Allowable Value for the LPCI Pump StartTime Delay Relays is chosen to be short enough so that ECCS operation is not degraded.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.5.1-11 Revision 76
| |
| | |
| ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 1.c, 2.c. LPCI Pump A and Pump B StartTime Delay Relay SAFETY ANALYSES, (continued)
| |
| LCO, and APPLICABILITY Each LPCI Pump StartTime Delay Relay Function is required to be OPERABLE when the associated LPCI subsystem is required to be OPERABLE.
| |
| 1.d, 1.g, 2.d, 2.f. Reactor Steam Dome PressureLow (Injection Permissive) and LPCS and LPCI Injection Line PressureLow (Injection Permissive)
| |
| Low reactor steam dome pressure and injection line pressure signals are used as permissives for the low pressure ECCS subsystems. This ensures that, prior to opening the injection valves of the low pressure ECCS subsystems, the reactor pressure has fallen to a value below these subsystems maximum design pressure. The Reactor Steam Dome PressureLow (Injection Permissive) and LPCS and LPCI Injection Line PressureLow (Injection Permissive) are two of the Functions assumed to be OPERABLE and capable of permitting initiation of the ECCS during the transients analyzed in References 1 and 3. In addition, the Reactor Steam Dome PressureLow (Injection Permissive) and LPCS and LPCI Injection Line PressureLow (Injection Permissive)
| |
| Functions are directly assumed in the analysis of the recirculation line break (Ref. 2). The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.
| |
| The Reactor Steam Dome PressureLow (Injection Permissive) signals are initiated from four pressure switches that sense the reactor dome pressure. The LPCS and LPCI Injection Line PressureLow (Injection Permissive) signals are initiated from four pressure switches that sense the pressure in the injection line (one switch for each low pressure ECCS injection line). The Allowable Values are low enough to (continued)
| |
| LaSalle 1 and 2 B 3.3.5.1-12 Revision 76
| |
| | |
| ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 1.d, 1.g, 2.d, 2.f. Reactor Steam Dome PressureLow SAFETY ANALYSES, (Injection Permissive) and LPCS and LPCI Injection Line LCO, and PressureLow (Injection Permissive) (continued)
| |
| APPLICABILITY prevent overpressurizing the equipment in the low pressure ECCS, but high enough to ensure that the ECCS injection prevents the fuel peak cladding temperature from exceeding the limits of 10 CFR 50.46.
| |
| Two channels of Reactor Steam Dome PressureLow (Injection Permissive) Function per associated Division and one channel of LPCS and LPCI Injection Line PressureLow (Injection Permissive) per associated injection line are only required to be OPERABLE when the associated ECCS is required to be OPERABLE to ensure that no single instrument failure can preclude ECCS initiation. (Two channels of Reactor Vessel PressureLow (Injection Permissive) are required for LPCS and LPCI A, while two other channels are required for LPCI B and LPCI C. In addition, one channel of LPCS Injection Line PressureLow (Injection Permissive) is required for LPCS, while one channel of LPCI Injection Line Pressure is required for each LPCI subsystem).
| |
| 1.e, 1.f, 2.e. LPCS and LPCI Pump Discharge FlowLow (Bypass)
| |
| The minimum flow instruments are provided to protect the associated low pressure ECCS pump from overheating when the pump is operating and the associated injection valve is not sufficiently open. The minimum flow line valve is opened when low flow is sensed, and the valve is automatically closed when the flow rate is adequate to protect the pump.
| |
| The LPCI and LPCS Pump Discharge FlowLow (Bypass)
| |
| Functions are assumed to be OPERABLE and capable of closing the minimum flow valves to ensure that the low pressure ECCS flows assumed during the transients and accidents analyzed in References 1, 2, and 3 are met. The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.5.1-13 Revision 76
| |
| | |
| ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 1.e, 1.f, 2.e. LPCS and LPCI Pump Discharge FlowLow SAFETY ANALYSES, (Bypass) (continued)
| |
| LCO, and APPLICABILITY One flow switch per ECCS pump is used to detect the associated subsystems flow rate. The logic is arranged such that each switch causes its associated minimum flow valve to open when flow is low with the pump running. The logic will close the minimum flow valve once the closure setpoint is exceeded. The LPCI minimum flow valves are time delayed such that the valves will not open for approximately 8 seconds after the switches detect low flow. The time delay is provided to limit reactor vessel inventory loss during the startup of the RHR shutdown cooling mode. The Pump Discharge FlowLow (Bypass) Allowable Values are high enough to ensure that the pump flow rate is sufficient to protect the pump, yet low enough to ensure that the closure of the minimum flow valve is initiated to allow full flow into the core.
| |
| Each channel of Pump Discharge FlowLow (Bypass) Function (one LPCS channel and three LPCI channels) is only required to be OPERABLE when the associated ECCS is required to be OPERABLE, to ensure that no single instrument failure can preclude the ECCS function.
| |
| 1.h, 2.g. Manual Initiation The Manual Initiation push button channels introduce signals into the appropriate ECCS logic to provide manual initiation capability and are redundant to the automatic protective instrumentation. There is one push button for each of the two Divisions of low pressure ECCS (i.e., Division 1 ECCS, LPCS and LPCI A; Division 2 ECCS, LPCI B and LPCI C).
| |
| The Manual Initiation Function is not assumed in any accident or transient analyses in the UFSAR. However, the Function is retained for overall redundancy and diversity of the low pressure ECCS function as required by the NRC in the plant licensing basis.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.5.1-14 Revision 76
| |
| | |
| ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 1.h, 2.g. Manual Initiation (continued)
| |
| SAFETY ANALYSES, LCO, and There is no Allowable Value for this Function since the APPLICABILITY channels are mechanically actuated based solely on the position of the push buttons. Each channel of the Manual Initiation Function (one channel per division) is only required to be OPERABLE when the associated ECCS is required to be OPERABLE for automatic alignment and injection.
| |
| High Pressure Core Spray System 3.a. Reactor Vessel Water LevelLow Low, Level 2 Low RPV water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, the HPCS System and associated DG is initiated at Level 2 to maintain level above the top of the active fuel. The Reactor Vessel Water LevelLow Low, Level 2 is one of the Functions assumed to be OPERABLE and capable of initiating HPCS during the transients analyzed in References 1 and 3. The Reactor Vessel Water LevelLow Low, Level 2 Function associated with HPCS is directly assumed in the analysis of the recirculation line break (Ref. 2). The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.
| |
| Reactor Vessel Water LevelLow Low, Level 2 signals are initiated from four differential pressure transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. The Reactor Vessel Water LevelLow Low, Level 2 Allowable Value is chosen such that for complete loss of feedwater flow, the Reactor Core Isolation Cooling (RCIC) System flow with HPCS assumed to fail will be sufficient to avoid initiation of low pressure ECCS at Reactor Vessel Water LevelLow Low Low, Level 1.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.5.1-15 Revision 76
| |
| | |
| ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 3.a. Reactor Vessel Water LevelLow Low, Level 2 SAFETY ANALYSES, (continued)
| |
| LCO, and APPLICABILITY Four channels of Reactor Vessel Water LevelLow Low, Level 2 Function are only required to be OPERABLE when HPCS is required to be OPERABLE to ensure that no single instrument failure can preclude HPCS initiation.
| |
| 3.b. Drywell PressureHigh High pressure in the drywell could indicate a break in the RCPB. The HPCS System and associated DG are initiated upon receipt of the Drywell PressureHigh Function in order to minimize the possibility of fuel damage. The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.
| |
| Drywell PressureHigh signals are initiated from four pressure switches that sense drywell pressure. The Allowable Value was selected to be as low as possible and be indicative of a LOCA inside primary containment.
| |
| The Drywell PressureHigh Function is required to be OPERABLE when HPCS is required to be OPERABLE in conjunction with times when the primary containment is required to be OPERABLE. Thus, four channels of the HPCS Drywell Pressure-High Function are required to be OPERABLE in MODES 1, 2, and 3, to ensure that no single instrument failure can preclude ECCS initiation. In MODES 4 and 5, the Drywell PressureHigh Function is not required since there is insufficient energy in the reactor to pressurize the drywell to the Drywell PressureHigh Functions setpoint.
| |
| Refer to LCO 3.5.1 for the Applicability Bases for the HPCS System.
| |
| 3.c. Reactor Vessel Water LevelHigh, Level 8 High RPV water level indicates that sufficient cooling water inventory exists in the reactor vessel such that there is no danger to the fuel. Therefore, the Level 8 signal is used to close the HPCS injection valve to prevent overflow into the main steam lines (MSLs). The Reactor Vessel Water (continued)
| |
| LaSalle 1 and 2 B 3.3.5.1-16 Revision 76
| |
| | |
| ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 3.c. Reactor Vessel Water LevelHigh, Level 8 (continued)
| |
| SAFETY ANALYSES, LCO, and LevelHigh, Level 8 Function for HPCS isolation is not APPLICABILITY credited in the accident analysis. It is retained since it is a potentially significant contributor to risk.
| |
| Reactor Vessel Water LevelHigh, Level 8 signals for HPCS are initiated from two level transmitters from the narrow range water level measurement instrumentation. The Reactor Vessel Water LevelHigh, Level 8 Allowable Value is chosen to isolate flow from the HPCS System prior to water overflowing into the MSLs.
| |
| Two channels of Reactor Vessel Water LevelHigh, Level 8 Function are only required to be OPERABLE when HPCS is required to be OPERABLE to ensure that no single instrument failure can preclude HPCS initiation.
| |
| 3.d, 3.e. HPCS Pump Discharge PressureHigh (Bypass) and HPCS System Flow RateLow (Bypass)
| |
| The minimum flow instruments are provided to protect the HPCS pump from overheating when the pump is operating and the associated injection valve is not sufficiently open.
| |
| The minimum flow line valve is opened when low flow and high pump discharge pressure are sensed, and the valve is automatically closed when the flow rate is adequate to protect the pump or the discharge pressure is low (indicating the HPCS pump is not operating). The HPCS System Flow RateLow (Bypass) and HPCS Pump Discharge PressureHigh Functions are assumed to be OPERABLE and capable of closing the minimum flow valve to ensure that the ECCS flow assumed during the transients and accidents analyzed in References 1, 2, and 3 are met. The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.
| |
| One flow switch is used to detect the HPCS System's flow rate. The logic is arranged such that the switch causes the minimum flow valve to open, provided the HPCS pump discharge pressure, sensed by another switch, is high enough (continued)
| |
| LaSalle 1 and 2 B 3.3.5.1-17 Revision 76
| |
| | |
| ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 3.d, 3.e. HPCS Pump Discharge PressureHigh (Bypass) and SAFETY ANALYSES, HPCS System Flow RateLow (Bypass) (continued)
| |
| LCO, and APPLICABILITY (indicating the pump is operating). The logic will close the minimum flow valve once the closure setpoint is exceeded. (The valve will also close upon HPCS pump discharge pressure decreasing below the setpoint.)
| |
| The HPCS System Flow RateLow (Bypass) Allowable Values are high enough to ensure that pump flow rate is sufficient to protect the pump, yet low enough to ensure that the closure of the minimum flow valve is initiated to allow full flow into the core. The HPCS Pump Discharge PressureHigh (Bypass) Allowable Value is set high enough to ensure that the valve will not be open when the pump is not operating.
| |
| One channel of each Function is required to be OPERABLE when the HPCS is required to be OPERABLE.
| |
| 3.f. Manual Initiation The Manual Initiation push button channel introduces a signal into the HPCS logic to provide manual initiation capability and is redundant to the automatic protective instrumentation. There is one push button for the HPCS System.
| |
| The Manual Initiation Function is not assumed in any accident or transient analyses in the UFSAR. However, the Function is retained for overall redundancy and diversity of the HPCS function as required by the NRC in the plant licensing basis.
| |
| There is no Allowable Value for this Function since the channel is mechanically actuated based solely on the position of the push button. One channel of the Manual Initiation Function is only required to be OPERABLE when the HPCS System is required to be OPERABLE.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.5.1-18 Revision 76
| |
| | |
| ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE Automatic Depressurization System SAFETY ANALYSES, LCO, and 4.a, 5.a. Reactor Vessel Water LevelLow Low Low, Level 1 APPLICABILITY (continued) Low RPV water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, ADS receives one of the signals necessary for initiation from this Function. The Reactor Vessel Water LevelLow Low Low, Level 1 is one of the Functions assumed to be OPERABLE and capable of initiating the ADS during the accidents analyzed in Reference 2. The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.
| |
| Reactor Vessel Water LevelLow Low Low, Level 1 signals are initiated from four differential pressure transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. The Reactor Vessel Water LevelLow Low Low, Level 1 Allowable Value is chosen high enough to allow time for the low pressure core spray and injection systems to initiate and provide adequate cooling.
| |
| Four channels of Reactor Vessel Water LevelLow Low Low, Level 1 Function are only required to be OPERABLE when ADS is required to be OPERABLE to ensure that no single instrument failure can preclude ADS initiation. (Two channels input to ADS trip system A while the other two channels input to ADS trip system B). Refer to LCO 3.5.1 for ADS Applicability Bases.
| |
| 4.b, 5.b. Drywell PressureHigh High pressure in the drywell could indicate a break in the RCPB. Therefore, ADS receives one of the signals necessary for initiation from this Function in order to minimize the possibility of fuel damage. The Drywell PressureHigh is assumed to be OPERABLE and capable of initiating the ADS during the accidents analyzed in Reference 2. The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.5.1-19 Revision 0
| |
| | |
| ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 4.b, 5.b. Drywell PressureHigh (continued)
| |
| SAFETY ANALYSES, LCO, and Drywell Pressure High signals are initiated from four APPLICABILITY pressure switches that sense drywell pressure. The Allowable Value was selected to be as low as possible and be indicative of a LOCA inside primary containment.
| |
| Four channels of Drywell PressureHigh Function are only required to be OPERABLE when ADS is required to be OPERABLE to ensure that no single instrument failure can preclude ADS initiation. (Two channels input to ADS trip system A while the other two channels input to ADS trip system B.) Refer to LCO 3.5.1 for ADS Applicability Bases.
| |
| 4.c, 5.c. ADS Initiation Timer The purpose of the ADS Initiation Timer is to delay depressurization of the reactor vessel to allow the HPCS System time to maintain reactor vessel water level. Since the rapid depressurization caused by ADS operation is one of the most severe transients on the reactor vessel, its occurrence should be limited. By delaying initiation of the ADS Function, the operator is given the chance to monitor the success or failure of the HPCS System to maintain water level, and then to decide whether or not to allow ADS to initiate, to delay initiation further by recycling the timer, or to inhibit initiation permanently. The ADS Initiation Timer Function is assumed to be OPERABLE for the accident analyses of Reference 2 that require ECCS initiation and assume failure of the HPCS System.
| |
| There are two ADS Initiation Timer relays, one in each of the two ADS trip systems. The Allowable Value for the ADS Initiation Timer is chosen to be short enough so that there is still time after depressurization for the low pressure ECCS subsystems to provide adequate core cooling.
| |
| Two channels of the ADS Initiation Timer Function are only required to be OPERABLE when the ADS is required to be OPERABLE to ensure that no single instrument failure can preclude ADS initiation. (One channel inputs to ADS trip system A while the other channel inputs to ADS trip system B.) Refer to LCO 3.5.1 for ADS Applicability Bases.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.5.1-20 Revision 0
| |
| | |
| ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 4.d, 5.d. Reactor Vessel Water LevelLow, Level 3 SAFETY ANALYSES, (Confirmatory)
| |
| LCO, and APPLICABILITY The Reactor Vessel Water LevelLow, Level 3 Function (continued) (Confirmatory) is used by the ADS only as a confirmatory low water level signal. ADS receives one of the signals necessary for initiation from Reactor Vessel Water Level-Low Low Low, Level 1 signals. In order to prevent spurious initiation of the ADS due to spurious Level 1 signals, a Level 3 signal must also be received before ADS initiation commences.
| |
| Reactor Vessel Water LevelLow, Level 3 (Confirmatory) signals are initiated from two differential pressure transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. The Allowable Value for Reactor Vessel Water Level-Low, Level 3 (Confirmatory)is selected at the RPS Level 3 scram Allowable Value for convenience. Refer to LCO 3.3.1.1, "Reactor Protection System (RPS)
| |
| Instrumentation," for Bases discussion of this Function.
| |
| Two channels of Reactor Vessel Water LevelLow, Level 3 (Confirmatory) Function are only required to be OPERABLE when the ADS is required to be OPERABLE to ensure that no single instrument failure can preclude ADS initiation. (One channel inputs to ADS trip system A while the other channel inputs to ADS trip system B.) Refer to LCO 3.5.1 for ADS Applicability Bases.
| |
| 4.e, 4.f, 5.e. LPCS and LPCI Pump Discharge PressureHigh The Pump Discharge PressureHigh signals from the LPCS and LPCI pumps (indicating that the associated pump is running) are used as permissives for ADS initiation, indicating that there is a source of low pressure cooling water available once the ADS has depressurized the vessel. Pump Discharge PressureHigh is one of the Functions assumed to be OPERABLE and capable of permitting ADS initiation during the events analyzed in References 2 and 3 with an assumed HPCS failure. For these events, the ADS depressurizes the reactor vessel so that the low pressure ECCS can perform the (continued)
| |
| LaSalle 1 and 2 B 3.3.5.1-21 Revision 0
| |
| | |
| ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 4.e, 4.f, 5.e. LPCS and LPCI Pump Discharge PressureHigh SAFETY ANALYSES, (continued)
| |
| LCO, and APPLICABILITY core cooling functions. This core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.
| |
| Pump discharge pressure signals are initiated from eight pressure switches, two on the discharge side of each of the four low pressure ECCS pumps. In order to generate an ADS permissive in one trip system, it is necessary that only one pump (both channels for the pump) indicate the high discharge pressure condition. The Pump Discharge Pressure-High Allowable Value is less than the pump discharge pressure when the pump is operating in a full flow mode, and high enough to avoid any condition that results in a discharge pressure permissive when the LPCS and LPCI pumps are aligned for injection and the pumps are not running.
| |
| The actual operating point of this Function is not assumed in any transient or accident analysis.
| |
| Eight channels of LPCS and LPCI Pump Discharge Pressure High Function (two LPCS and two LPCI A channels input to ADS trip system A, while two LPCI B and two LPCI C channels input to ADS trip system B) are only required to be OPERABLE when the ADS is required to be OPERABLE to ensure that no single instrument failure can preclude ADS initiation.
| |
| Refer to LCO 3.5.1 for ADS Applicability Bases.
| |
| 4.g, 5.f. ADS Drywell Pressure Bypass Timer One of the signals required for ADS initiation is Drywell PressureHigh. However, if the event requiring ADS initiation occurs outside the drywell (for example, main steam line break outside primary containment), a high drywell pressure signal may never be present. Therefore, the ADS Drywell Pressure Bypass Timer is used to bypass the Drywell PressureHigh Function after a certain time period has elapsed. The ADS Drywell Pressure Bypass Timer Function instrumentation is retained in the TS because ADS is part of the primary success path for mitigation of a DBA.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.5.1-22 Revision 0
| |
| | |
| ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 4.g, 5.f. ADS Drywell Pressure Bypass Time (continued)
| |
| SAFETY ANALYSES, LCO, and There are four ADS Drywell Pressure Bypass Timer relays, two APPLICABILITY in each of the two ADS trip systems. The Allowable Value for the ADS Timer is chosen to be short enough that so that there is still time after depressurization for the low pressure ECCS subsystems to provide adequate core cooling.
| |
| Four channels of the ADS Drywell Pressure Bypass Timer Function are only required to be OPERABLE when the ADS is required to be OPERABLE to ensure that no single instrument failure can preclude ADS initiation. Refer to LCO 3.5.1 for ADS Applicability Bases.
| |
| 4.h, 5.g. Manual Initiation The Manual Initiation push button channels introduce signals into the ADS logic to provide manual initiation capability and are redundant to the automatic protective instrumentation. There are two push buttons for each ADS trip system (total of four).
| |
| The Manual Initiation Function is not assumed in any accident or transient analyses in the UFSAR. However, the Function is retained for overall redundancy and diversity of the ADS function as required by the NRC in the plant licensing basis.
| |
| There is no Allowable Value for this Function since the channel is mechanically actuated based solely on the position of the push buttons. Four channels of the Manual Initiation Function (two channels per ADS trip system) are only required to be OPERABLE when the ADS is required to be OPERABLE. Refer to LCO 3.5.1 for ADS Applicability Bases.
| |
| ACTIONS A Note has been provided to modify the ACTIONS related to ECCS instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each (continued)
| |
| LaSalle 1 and 2 B 3.3.5.1-23 Revision 0
| |
| | |
| ECCS Instrumentation B 3.3.5.1 BASES ACTIONS additional failure, with Completion Times based on initial (continued) entry into the Condition. However, the Required Actions for inoperable ECCS instrumentation channels provide appropriate compensatory measures for separate inoperable Condition entry for each inoperable ECCS instrumentation channel.
| |
| A.1 Required Action A.1 directs entry into the appropriate Condition referenced in Table 3.3.5.1-1. The applicable Condition specified in the Table is Function dependent.
| |
| Each time a channel is discovered to be inoperable, Condition A is entered for that channel and provides for transfer to the appropriate subsequent Condition.
| |
| B.1, B.2, and B.3 Required Actions B.1 and B.2 are intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function (or in some cases, within the same variable) result in redundant automatic initiation capability being lost for the feature(s). Loss of redundant automatic capability for the low pressure ECCS injection feature in both divisions occurs when the initiation capability is available to less than two pumps from any single variable. Required Action B.1 features would be those that are initiated by Functions 1.a, l.b, 2.a, and 2.b (i.e., low pressure ECCS and associated DGs). The Required Action B.2 feature would be HPCS System and associated DG. For Required Action B.1, redundant automatic initiation capability is lost if either (a) one or more Function 1.a channels and one or more Function 2.a channels are inoperable and untripped, or (b) one or more Function 1.b channels and one or more Function 2.b channels are inoperable and untripped. For Divisions 1 and 2, since each inoperable channel would have Required Action B.1 applied separately (refer to ACTIONS Note), each inoperable channel would only require the affected portion of the associated Division of low pressure ECCS and DG to be declared inoperable. However, since channels in both Divisions are inoperable and untripped, and the Completion Times started concurrently for the channels in both (continued)
| |
| LaSalle 1 and 2 B 3.3.5.1-24 Revision 0
| |
| | |
| ECCS Instrumentation B 3.3.5.1 BASES ACTIONS B.1, B.2, and B.3 (continued)
| |
| Divisions, this results in the affected portions in both Divisions of ECCS and DG being concurrently declared inoperable. For Required Action B.2, redundant automatic initiation capability (i.e., loss of automatic start capability for either Functions 3.a or 3.b) is lost if two Function 3.a or two Function 3.b parallel contacts (channels) are inoperable and untripped in the same trip system.
| |
| In this situation (loss of redundant automatic initiation capability), the 24 hour allowance of Required Action B.3 is not appropriate and the feature(s) associated with the inoperable, untripped channels must be declared inoperable within 1 hour. Notes are provided (the Note to Required Action B.1 and Required Action B.2) to delineate which Required Action is applicable for each Function that requires entry into Condition B if an associated channel is inoperable. This ensures that the proper loss of initiation capability check is performed.
| |
| The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."
| |
| For Required Action B.1, the Completion Time only begins upon discovery that a redundant feature in both Divisions (e.g., any Division 1 ECCS and Division 2 ECCS) cannot be automatically initiated due to inoperable, untripped channels within the same variable as described in the paragraph above. For Required Action B.2, the Completion Time only begins upon discovery that the HPCS System cannot be automatically initiated due to two inoperable, untripped channels (parallel contacts) for the associated Function in the same trip system. The 1 hour Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.5.1-25 Revision 76
| |
| | |
| ECCS Instrumentation B 3.3.5.1 BASES ACTIONS B.1, B.2, and B.3 (continued)
| |
| Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 24 hours has been shown to be acceptable (Ref. 4) to permit restoration of any inoperable channel to OPERABLE status. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. This Completion Time is modified by a Note to clarify that the Risk Informed Completion Time Program is not applicable to a Required Action associated with a Condition that represents a loss of safety function. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action B.3. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue. Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an initiation), Condition G must be entered and its Required Action taken.
| |
| C.1 and C.2 Required Action C.1 is intended to ensure that appropriate actions are taken if multiple, inoperable channels within the same Function (or in some cases, within the same variable) result in redundant automatic initiation capability being lost for the feature(s). Loss of redundant automatic initiation capability for the low pressure ECCS injection feature in both divisions occurs when the initiation capability is available to less than two pumps from any single variable.
| |
| Required Action C.1 features would be those that are initiated by Functions 1.c, and 2.c (i.e., low pressure ECCS). For Functions 1.c and 2.c, redundant automatic initiation capability is lost if the Function 1.c and Function 2.c channels are inoperable. Since each inoperable channel would have Required Action C.1 applied separately (refer to ACTIONS Note), each inoperable channel would only require the affected portion of the associated Division to be declared inoperable. However, since channels in both (continued)
| |
| LaSalle 1 and 2 B 3.3.5.1-26 Revision 89
| |
| | |
| ECCS Instrumentation B 3.3.5.1 BASES ACTIONS C.1 and C.2 (continued)
| |
| Divisions are inoperable, and the Completion Times started concurrently for the channels in both Divisions, this results in the affected portions in both Divisions being concurrently declared inoperable. For Functions 1.c and 2.c, the affected portions of the Division are LPCI A and LPCI B, respectively. In addition, the specific inoperability of these Functions should also be evaluated for impact on the DGs.
| |
| In this situation (loss of redundant automatic initiation capability), the 24 hour allowance of Required Action C.2 is not appropriate and the feature(s) associated with the inoperable channels must be declared inoperable within 1 hour.
| |
| The Note states that Required Action C.1 is only applicable for Functions 1.c and 2.c. The Required Action is not applicable to Functions 1.h, 2.g, and 3.f (which also require entry into this Condition if a channel in these Functions is inoperable), since they are the Manual Initiation Functions and are not assumed in any accident or transient analysis. Thus, a total loss of manual initiation capability for 24 hours (as allowed by Required Action C.2) is allowed. Required Action C.1 is also not applicable to Function 3.c (which also requires entry into this Condition if a channel in this Function is inoperable), since the loss of the Function was considered during the development of Reference 4 and considered acceptable for the 24 hours allowed by Required Action C.2.
| |
| The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."
| |
| For Required Action C.1, the Completion Time only begins upon discovery that the same feature in both Divisions (i.e., any Division 1 ECCS and Division 2 ECCS) cannot be automatically initiated due to inoperable channels within the same variable as described in the paragraph above. The 1 hour Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration of channels. Because of the (continued)
| |
| LaSalle 1 and 2 B 3.3.5.1-27 Revision 89
| |
| | |
| ECCS Instrumentation B 3.3.5.1 BASES ACTIONS C.1 and C.2 (continued) diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 24 hours has been shown to be acceptable (Ref. 4) to permit restoration of any inoperable channel to OPERABLE status. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. This Completion Time is modified by a Note to clarify that the Risk Informed Completion Time Program is not applicable to a Required Action associated with a Condition that represents a loss of safety function when trip capability is not maintained. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, Condition G must be entered and its Required Action taken. The Required Actions do not allow placing the channel in trip since this action would either cause the initiation or would not necessarily result in a safe state for the channel in all events.
| |
| D.1, D.2, D.3, and D.4 Required Action D.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, channels within the LPCS and LPCI Pump Discharge FlowLow (Bypass)
| |
| Functions, the Injection Line PressureLow (Injection Permissive), and the Reactor Steam Dome PressureLow (Injection Permissive) Functions result in redundant automatic initiation capability being lost for the feature(s). Loss of redundant automatic initiation capability for the low pressure ECCS injection feature in both divisions occurs when the initiation capability is available to less than two pumps from any single variable.
| |
| For the purposes of this Condition, the injection permissives on Reactor Steam Dome PressureLow and Injection Line PressureLow are considered the same variable. Similarly, Functions 1.e, 1.f, and 2.e are all minimum flow functions and considered the same variable.
| |
| For Required Action D.1, the features would be those that are initiated by Functions 1.d, 1.e, 1.f, 1.g, 2.d, 2.e, and 2.f (e.g., low pressure ECCS). Redundant automatic initiation capability is lost if three of the four channels associated with Functions 1.e, 1.f, and 2.e are inoperable.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.5.1-28 Revision 89
| |
| | |
| ECCS Instrumentation B 3.3.5.1 BASES ACTIONS D.1, D.2, D.3, and D.4 (continued)
| |
| For Function 1.d, redundant automatic initiation capability is lost if two Function 1.d channels are inoperable concurrent with either two inoperable Function 2.d channels or one inoperable Function 2.f channel. For Function 2.d, redundant automatic initiation capability is lost if two Function 2.d channels are inoperable concurrent with two inoperable 1.d channels or one inoperable 1.g channel. For Function 1.g, redundant automatic initiation capability is lost if two Function 1.g channels are inoperable concurrent with either two inoperable Function 2.d channels or one inoperable Function 2.f channel. For Function 2.f, redundant automatic initiation capability is lost if two Function 2.f channels are inoperable concurrent with two inoperable 1.d channels or one inoperable 1.g channel. Since each inoperable channel would have Required Action D.1 applied separately (refer to ACTIONS Note), each inoperable channel would only require the affected low pressure ECCS pump to be declared inoperable. However, since channels for more than one low pressure ECCS pump are inoperable, and the Completion Times started concurrently for the channels of the low pressure ECCS pumps, this results in the affected low pressure ECCS pumps being concurrently declared inoperable.
| |
| In this situation (loss of redundant automatic initiation capability), the Completion Times of Required Actions D.3 and D.4 are not appropriate and the feature(s) associated with each inoperable channel must be declared inoperable within 1 hour after discovery of loss of initiation capability for feature(s) in both Divisions. A Note is provided (The Note to Required Action D.1) to delineate that Required Action D.1 is only applicable to low pressure ECCS Functions. Required Action D.1 is not applicable to HPCS Functions 3.d and 3.e since the loss of one channel results in a loss of the Function (one-out-of-one logic). This loss was considered during the development of Reference 4 and considered acceptable for the 7 days allowed by Required Action D.4. Required Action D.2 is intended to ensure that (continued)
| |
| LaSalle 1 and 2 B 3.3.5.1-29 Revision 89
| |
| | |
| ECCS Instrumentation B 3.3.5.1 BASES ACTIONS D.1, D.2, D.3, and D.4 (continued) appropriate actions are taken if multiple, inoperable channels within the Reactor Steam Dome PressureLow (Injection Permissive) Function result in automatic initiation capability being lost for the features in one division. For Required Action D.2, the features would be those that are initiated by Functions 1.d and 2.d (e.g., low pressure ECCS). For Functions 1.d and 2.d, automatic initiation capability is lost in one division if two Function 1.d or two Function 2.d channels are inoperable.
| |
| In this situation, (loss of automatic initiation capability), the 7 day allowance of Required Action D.4 is not appropriate and the features associated with the inoperable channels must be declared inoperable within 24 hours after discovery of loss of initiation capability for features in one division. For Functions 1.g and 2.f, an allowable out of service time of 24 hours is provided by Required Action D.3. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. This Completion Time is modified by a Note to clarify that the Risk Informed Completion Time Program is not applicable to a Required Action associated with a Condition that represents a loss of safety function when trip capability is not maintained.
| |
| The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."
| |
| For Required Action D.1, the Completion Time only begins upon discovery that three channels of the Pump Discharge FlowLow (Bypass) Function cannot be automatically initiated due to inoperable channels or upon discovery of a loss of redundant initiation capability for the Reactor Steam Dome PressureLow (Injection Permissive) and Injection Line PressureLow (Injection Permissive)
| |
| Functions (as described above). The 1 hour Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration of channels. For Required Action D.2, the Completion Time only begins upon discovery that two Function 1.d or two Function 2.d channels cannot be automatically initiated due to inoperable channels. The 24 hour Completion Time from discovery of loss of initiation (continued)
| |
| LaSalle 1 and 2 B 3.3.5.1-30 Revision 89
| |
| | |
| ECCS Instrumentation B 3.3.5.1 BASES ACTIONS D.1, D.2, D.3, and D.4 (continued) capability for features in one division is acceptable because of the redundancy of the ECCS design, as shown in the reliability analysis of Reference 4.
| |
| If the instrumentation that controls the pump minimum flow valve is inoperable such that the valve will not automatically open, extended pump operation with no injection path available could lead to pump overheating and failure. If there were a failure of the instrumentation such that the valve would not automatically close, a portion of the pump flow could be diverted from the reactor injection path, causing insufficient core cooling. These consequences can be averted by the operator's manual control of the valve, which would be adequate to maintain ECCS pump protection and required flow. Furthermore, other ECCS pumps would be sufficient to complete the assumed safety function if no additional single failure were to occur. If a Reactor Vessel PressureLow (Injection Permissive) Function channel is inoperable, another channel exists to ensure the injection valves in the ECCS division can still open. The 7 day Completion Time of Required Action D.4 to restore the inoperable channel to OPERABLE status is reasonable based on the remaining capability of the associated ECCS subsystems, the redundancy available in the ECCS design, and the low probability of a DBA occurring during the allowed out of service time. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. This Completion Time is modified by a Note to clarify that the Risk informed Completion Time Program is not applicable to a Required Action associated with a Condition that represents a loss of safety function. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, Condition G must be entered and its Required Action taken. The Required Actions do not allow placing the channel in trip since this action would not necessarily result in a safe state for the channel in all events.
| |
| E.1 and E.2 Required Action E.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped (continued)
| |
| LaSalle 1 and 2 B 3.3.5.1-31 Revision 89
| |
| | |
| ECCS Instrumentation B 3.3.5.1 BASES ACTIONS E.1 and E.2 (continued) channels within similar ADS trip system Functions result in automatic initiation capability being lost for the ADS.
| |
| Automatic initiation capability is lost if either (a) one or more Function 4.a channels and one or more Function 5.a channels are inoperable and untripped, (b) one or more Function 4.b channels and one or more Function 5.b channels are inoperable and untripped, or (c) one Function 4.d channel and one Function 5.d channel are inoperable and untripped.
| |
| In this situation (loss of automatic initiation capability),
| |
| the 96 hour or 8 day allowance, as applicable, of Required Action E.2 is not appropriate, and all ADS valves must be declared inoperable within 1 hour after discovery of loss of ADS initiation capability in both trip systems.
| |
| The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."
| |
| For Required Action E.1, the Completion Time only begins upon discovery that the ADS cannot be automatically initiated due to inoperable, untripped channels within similar ADS trip system Functions as described in the paragraph above. The 1 hour Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.
| |
| Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 8 days has been shown to be acceptable (Ref. 4) to permit restoration of any inoperable channel to OPERABLE status if both HPCS and RCIC are OPERABLE. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. This Completion Time is modified by a Note to clarify that the Risk Informed Completion Time Program is not applicable to a Required Action associated with a Condition that represents a loss of safety function. If either HPCS or RCIC is inoperable, the time is shortened to 96 hours or in accordance with the Risk Informed Completion Time Program. If the status of HPCS or RCIC changes such (continued)
| |
| LaSalle 1 and 2 B 3.3.5.1-32 Revision 89
| |
| | |
| ECCS Instrumentation B 3.3.5.1 BASES ACTIONS E.1 and E.2 (continued)
| |
| (continued) that the Completion Time changes from 8 days to 96 hours or in accordance with the Risk Informed Completion Time Program, the 96 hours begins upon discovery of HPCS or RCIC inoperability. However, total time for an inoperable, untripped channel cannot exceed 8 days. If the status of HPCS or RCIC changes such that the Completion Time changes from 96 hours to 8 days, the "time zero" for beginning the 8 day "clock" begins upon discovery of the inoperable, untripped channel. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action E.2. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue. Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an initiation), Condition G must be entered and its Required Action taken.
| |
| F.1 and F.2 Required Action F.1 is intended to ensure that appropriate actions are taken if multiple, inoperable channels within similar ADS trip system Functions result in automatic initiation capability being lost for the ADS. Automatic initiation capability is lost if either (a) one Function 4.c channel and one Function 5.c channel are inoperable, (b) one or more Function 4.e channels and one or more Function 5.e channels are inoperable, (c) one or more Function 4.f channels and one or more Function 5.e channels are inoperable, or (d) one or more Function 4.g channels and one or more Function 5.f channels are inoperable.
| |
| In this situation (loss of automatic initiation capability),
| |
| the 96 hour or 8 day allowance, as applicable, of Required Action F.2 is not appropriate, and all ADS valves must be declared inoperable within 1 hour after discovery of loss of ADS initiation capability in both trip systems. The Note to Required Action F.1 states that Required Action F.1 is only applicable for Functions 4.c, 4.e, 4.f, 4.g, 5.c, 5.e, and 5.f. Required Action F.1 is not applicable to (continued)
| |
| LaSalle 1 and 2 B 3.3.5.1-33 Revision 89
| |
| | |
| ECCS Instrumentation B 3.3.5.1 BASES ACTIONS F.1 and F.2 (continued)
| |
| Functions 4.h and 5.g (which also require entry into this Condition if a channel in these Functions is inoperable),
| |
| since they are the Manual Initiation Functions and are not assumed in any accident or transient analysis. Thus, a total loss of manual initiation capability for 96 hours or 8 days (as allowed by Required Action F.2) is allowed.
| |
| The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."
| |
| For Required Action F.1, the Completion Time only begins upon discovery that the ADS cannot be automatically initiated due to inoperable channels within similar ADS trip system Functions, as described in the paragraph above. The 1 hour Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.
| |
| Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 8 days has been shown to be acceptable (Ref. 4) to permit restoration of any inoperable channel to OPERABLE status if both HPCS and RCIC are OPERABLE (Required Action F.2). Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. This Completion Time is modified by a Note to clarify that the Risk Informed Completion Time Program is not applicable to a Required Action associated with a Condition that represents a loss of safety function.
| |
| If either HPCS or RCIC is inoperable, the time is reduced to 96 hours or in accordance with the Risk Informed Completion Time Program. If the status of HPCS or RCIC changes such that the Completion Time changes from 8 days to 96 hours or in accordance with the Risk Informed Completion Time Program, the 96 hours begins upon discovery of HPCS or RCIC inoperability. However, total time for an inoperable channel cannot exceed 8 days. If the status of HPCS or RCIC changes such that the Completion Time changes from 96 hours to 8 days, the "time zero" for beginning the 8 day "clock" begins upon discovery of the inoperable channel. If the inoperable channel cannot be restored to OPERABLE status (continued)
| |
| LaSalle 1 and 2 B 3.3.5.1-34 Revision 89
| |
| | |
| ECCS Instrumentation B 3.3.5.1 BASES ACTIONS F.1 and F.2 (continued) within the allowable out of service time, Condition G must be entered and its Required Action taken. The Required Actions do not allow placing the channel in trip since this action would not necessarily result in a safe state for the channel in all events.
| |
| G.1 With any Required Action and associated Completion Time not met, the associated feature(s) may be incapable of performing the intended function and the supported feature(s) associated with the inoperable untripped channels must be declared inoperable immediately.
| |
| SURVEILLANCE As noted at the beginning of the SRs, the SRs for each ECCS REQUIREMENTS instrumentation Function are found in the SRs column of Table 3.3.5.1-1.
| |
| The Surveillances are modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours as follows: (a) for Functions 3.c, 3.d, 3.e, and 3.f; and (b) for Functions other than 3.c, 3.d, 3.e, and 3.f provided the associated Function or redundant Function maintains ECCS initiation capability. Upon completion of the Surveillance, or expiration of the 6 hour allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Ref. 4) assumption of the average time required to perform channel Surveillance. That analysis demonstrated that the 6 hour testing allowance does not significantly reduce the probability that the ECCS will initiate when necessary.
| |
| SR 3.3.5.1.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.5.1-35 Revision 89
| |
| | |
| ECCS Instrumentation B 3.3.5.1 BASES SURVEILLANCE SR 3.3.5.1.1 (continued)
| |
| REQUIREMENTS It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious.
| |
| A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
| |
| Agreement criteria are determined by the plant staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.
| |
| SR 3.3.5.1.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the channel will perform the intended function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.
| |
| Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.5.1-36 Revision 89
| |
| | |
| ECCS Instrumentation B 3.3.5.1 BASES SURVEILLANCE SR 3.3.5.1.3 and SR 3.3.5.1.4 REQUIREMENTS A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.5.1.5 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required initiation logic for a specific channel. The system functional testing performed in LCO 3.5.1, LCO 3.8.1, and LCO 3.8.2 overlaps this Surveillance to provide complete testing of the assumed safety function.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.5.1-37 Revision 89
| |
| | |
| ECCS Instrumentation B 3.3.5.1 BASES SURVEILLANCE SR 3.3.5.1.6 REQUIREMENTS This SR ensures that the individual channel response times are less than or equal to the maximum values assumed in the accident analysis. Response time testing acceptance criteria are included in Reference 5.
| |
| ECCS RESPONSE TIME may be verified by actual response time measurements in any series of sequential, overlapping, or total channel measurements. However, the measurement of instrument loop response times may be excluded if the conditions of Reference 6 are satisfied. If these conditions are satisfied, instrument loop response time may be allocated based on either assumed design instrument loop response time or the manufacturer's stated design instrument loop response time. When the requirements of Reference 6 are not satisfied, instrument loop response time must be measured. The instrument loop response times must be added to the remaining equipment response times (e.g., ECCS pump start time) to obtain the ECCS RESPONSE TIME. However, failure to meet the ECCS RESPONSE TIME due to a component other than instrumentation not within limits does not require the associated instrumentation to be declared inoperable; only the affected component (e.g., ECCS pump) is required to be declared inoperable.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.5.1-38 Revision 89
| |
| | |
| ECCS Instrumentation B 3.3.5.1 BASES (continued)
| |
| REFERENCES 1. UFSAR, Section 5.2.
| |
| : 2. UFSAR, Section 6.3.
| |
| : 3. UFSAR, Chapter 15.
| |
| : 4. NEDC-30936-P-A, "BWR Owners' Group Technical Specification Improvement Analyses for ECCS Actuation Instrumentation, Parts 1 and 2," December 1988.
| |
| : 5. Technical Requirements Manual.
| |
| : 6. NEDO-32291-A, "System Analyses for the Elimination of Selected Response Time Testing Requirements,"
| |
| October 1995.
| |
| LaSalle 1 and 2 B 3.3.5.1-39 Revision 89
| |
| | |
| RPV Water Inventory Control Instrumentation B 3.3.5.2 B 3.3 INSTRUMENTATION B 3.3.5.2 Reactor Pressure Vessel (RPV) Water Inventory Control Instrumentation BASES BACKGROUND The RPV contains penetrations below the top of the active fuel (TAF) that have the potential to drain the reactor coolant inventory to below the TAF. If the water level should drop below the TAF, the ability to remove decay heat is reduced, which could lead to elevated cladding temperatures and clad perforation. Safety Limit 2.1.1.3 requires the RPV water level to be above the top of the active irradiated fuel at all times to prevent such elevated cladding temperatures.
| |
| Technical Specifications are required by 10 CFR 50.36 to include limiting safety system settings (LSSS) for variables that have significant safety functions. LSSS are defined by the regulation as "Where a LSSS is specified for a variable on which a safety limit has been placed, the setting must be chosen so that automatic protective actions will correct the abnormal situation before a Safety Limit (SL) is exceeded."
| |
| The Analytical Limit is the limit of the process variable at which a safety action is initiated to ensure that a SL is not exceeded. Any automatic protection action that occurs on reaching the Analytical Limit therefore ensures that the SL is not exceeded. However, in practice, the actual settings for automatic protection channels must be chosen to be more conservative than the Analytical Limit to account for instrument loop uncertainties related to the setting at which the automatic protective action would actually occur.
| |
| The actual settings for the automatic isolation channels are the same as those established for the same functions in MODES 1, 2, and 3 in LCO 3.3.6.1, "Primary Containment Isolation Instrumentation."
| |
| With the unit in MODE 4 or 5, RPV water inventory control is not required to mitigate any events or accidents evaluated in the safety analyses. RPV water inventory control is required in MODES 4 and 5 to protect Safety Limit 2.1.1.3 and the fuel cladding barrier to prevent the release of radioactive material should a draining event occur. Under the definition of DRAIN TIME, some penetration flow paths may be excluded from the DRAIN TIME calculation if they will (continued)
| |
| LaSalle 1 and 2 B 3.3.5.2-1 Revision 9076
| |
| | |
| RPV Water Inventory Control Instrumentation B 3.3.5.2 BASES BACKGROUND be isolated by valves that will close automatically without (continued) offsite power prior to the RPV water level being equal to the TAF when actuated by RPV water level isolation instrumentation.
| |
| The purpose of the RPV Water Inventory Control Instrumentation is to support the requirements of LCO 3.5.2, "RPV Water Inventory Control," and the definition of DRAIN TIME. There are functions that support automatic isolation of Residual Heat Removal subsystem and Reactor Water Cleanup system penetration flow path(s) on low RPV water level.
| |
| APPLICABLE With the unit in MODE 4 or 5, RPV water inventory control is SAFETY not required to mitigate any events or accidents evaluated ANALYSES, LCO, in the safety analyses. RPV water inventory control is and APPLICABILITY required in MODES 4 and 5 to protect Safety Limit 2.1.1.3 and the fuel cladding barrier to prevent the release of radioactive material should a draining event occur.
| |
| A double-ended guillotine break of the Reactor Coolant System (RCS) is not considered in MODES 4 and 5 due to the reduced RCS pressure, reduced piping stresses, and ductile piping systems. Instead, an event is considered in which an initiating event allows draining of the RPV water inventory through a single penetration flow path with the highest flow rate, or the sum of the drain rates through multiple penetration flow paths susceptible to a common mode failure.
| |
| It is assumed, based on engineering judgment, that while in MODES 4 and 5, one ECCS injection/spray subsystem can be manually operated to maintain adequate reactor vessel water level.
| |
| As discussed in References 1, 2, 3, 4, and 5, operating experience has shown RPV water inventory to be significant to public health and safety. Therefore, RPV Water Inventory Control satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii).
| |
| Permissive and interlock setpoints are generally considered as nominal values without regard to measurement accuracy.
| |
| The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.5.2-2 Revision 9076
| |
| | |
| RPV Water Inventory Control Instrumentation B 3.3.5.2 BASES APPLICABLE RHR Shutdown Cooling System Isolation SAFETY ANALYSES, LCO, and 1.a. Reactor Vessel Water Level-Low, Level 3 APPLICABILITY (continued) The definition of DRAIN TIME allows crediting the closing of penetration flow paths that are capable of being automatically isolated by RPV water level isolation instrumentation prior to the RPV water level being equal to the TAF. The Reactor Vessel Water Level-Low, Level 3 Function is only required to be OPERABLE when automatic isolation of the associated RHR penetration flow path is credited in calculating DRAIN TIME.
| |
| Reactor Vessel Water LevelLow, Level 3 signals are initiated from differential pressure transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. While four channels (i.e., two channels per trip system) of the Reactor Vessel Water LevelLow, Level 3 Function are available, only two channels (all in the same trip system) are required to be OPERABLE.
| |
| The Reactor Vessel Water LevelLow, Level 3 Allowable Value was chosen to be the same as the RPS Reactor Vessel Water LevelLow, Level 3 Allowable Value (LCO 3.3.1.1) since the capability to cool the fuel may be threatened.
| |
| This Function isolates the Group 6 valves.
| |
| Reactor Water Cleanup (RWCU) System Isolation 2.a. Reactor Vessel Water Level-Low, Low, Level 2 The definition of DRAIN TIME allows crediting the closing of penetration flow paths that are capable of being automatically isolated by RPV water level isolation instrumentation prior to the RPV water level being equal to the TAF. The Reactor Vessel Water Level-Low Low, Level 2 Function associated with RWCU System isolation may be credited for automatic isolation of penetration flow paths associated with the RWCU System.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.5.2-3 Revision 9076
| |
| | |
| RPV Water Inventory Control Instrumentation B 3.3.5.2 BASES APPLICABLE 2.a. Reactor Vessel Water Level-Low, Low, Level 2 SAFETY ANALYSES, (continued)
| |
| LCO, and APPLICABILITY Reactor Vessel Water LevelLow Low, Level 2 signals are initiated from differential pressure transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. While four channels (two per tip system) of the Reactor Vessel Water LevelLow Low, Level 2 Function are available, only two channels (all in the same trip system) are required to be OPERABLE.
| |
| The Reactor Vessel Water LevelLow Low, Level 2 Allowable Value was chosen to be the same as the ECCS Reactor Vessel Water LevelLow Low, Level 2 Allowable Value (LCO 3.3.5.1),
| |
| since the capability to cool the fuel may be threatened.
| |
| The Reactor Vessel Water Level-Low Low, Level 2 Function is only required to be OPERABLE when automatic isolation of the associated penetration flow path is credited in calculating DRAIN TIME.
| |
| This Function isolates the Group 5 valves.
| |
| ACTIONS A Note has been provided to modify the ACTIONS related to RPV Water Inventory Control Instrumentation channels.
| |
| Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits will not result in separate entry into the Condition.
| |
| Section 1.3 also specifies that Required Actions continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable RPV Water Inventory Control instrumentation channels provide appropriate compensatory measures for separate inoperable Condition entry for each inoperable RPV Water Inventory Control instrumentation channel.
| |
| A.1, A.2.1, and A.2.2 RHR Shutdown Cooling System Isolation, Reactor Vessel Water Level-Low, Level 3, and Reactor Water Cleanup System, (continued)
| |
| LaSalle 1 and 2 B 3.3.5.2-4 Revision 9076
| |
| | |
| RPV Water Inventory Control Instrumentation B 3.3.5.2 BASES ACTIONS A.1, A.2.1, and A.2.2 (continued)
| |
| (continued)
| |
| Reactor Vessel Water Level-Low Low, Level 2 Functions are applicable when automatic isolation of the associated penetration flow path is credited in calculating Drain Time.
| |
| If the instrumentation is inoperable, Required Action A.1 directs immediate action to place the channel in trip. With the inoperable channel in the tripped condition, the remaining channel will isolate the penetration flow path on low water level. If both channels are inoperable and placed in trip, the penetration flow patch will be isolated.
| |
| Alternatively, Required Action A.2.1 requires that the associated penetration flow path(s) to be immediately declared incapable of automatic isolation. Required Action A.2.2 directs initiating action to calculate DRAIN TIME.
| |
| The calculation cannot credit automatic isolation of the affected penetration flow paths.
| |
| SURVEILLANCE The following SRs apply to each RPV Water Inventory Control REQUIREMENTS instrumentation Function in Table 3.3.5.2-1.
| |
| SR 3.3.5.2.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.
| |
| Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL FUNCTIONAL TEST.
| |
| Agreement criteria are determined by the plant staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.5.2-5 Revision 9076
| |
| | |
| RPV Water Inventory Control Instrumentation B 3.3.5.2 BASES SURVEILLANCE SR 3.3.5.2.1 (continued)
| |
| REQUIREMENTS The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.
| |
| SR 3.3.5.2.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the channel will perform the intended function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests.
| |
| Any setpoint adjustment shall be consistent with the assumptions of the current plant-specific setpoint methodology.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. Information Notice 84-81, "Inadvertent Reduction in Primary Coolant Inventory in Boiling Water Reactors During Shutdown and Startup," November 1984.
| |
| : 2. Information Notice 86-74, "Reduction of Reactor Coolant Inventory Because of Misalignment of RHR Valves," August 1986.
| |
| : 3. Generic Letter 92-04, "Resolution of the Issues Related to Reactor Vessel Water Level Instrumentation in BWRs Pursuant to 10 CFR 50.54(f)," August 1992.
| |
| : 4. NRC Bulletin 93-03, "Resolution of Issues Related to Reactor Vessel Water Level Instrumentation in BWRs,"
| |
| May 1993.
| |
| : 5. Information Notice 94-52, "Inadvertent Containment Spray and Reactor Vessel Draindown at Millstone 1,"
| |
| July 1994.
| |
| LaSalle 1 and 2 B 3.3.5.2-6 Revision 9076
| |
| | |
| RCIC System Instrumentation B 3.3.5.3 B 3.3 INSTRUMENTATION B 3.3.5.3 Reactor Core Isolation Cooling (RCIC) System Instrumentation BASES BACKGROUND The purpose of the RCIC System instrumentation is to initiate actions to ensure adequate core cooling when the reactor vessel is isolated from its primary heat sink (the main condenser) and normal coolant makeup flow from the Reactor Feedwater System is insufficient or unavailable, such that RCIC System initiation occurs and maintains sufficient reactor water level precluding initiation of the low pressure Emergency Core Cooling Systems (ECCS) pumps. A more complete discussion of RCIC System operation is provided in the Bases of LCO 3.5.3, "RCIC System."
| |
| The RCIC System may be initiated by either automatic or manual means. Automatic initiation occurs for conditions of Reactor Vessel Water Level LowLow, Level 2. The variable is monitored by four differential pressure transmitters that are connected to four trip units. The outputs of the trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic arrangement. The logic can also be initiated by use of a manual push button. Once initiated, the RCIC logic seals in and can be reset by the operator only when the reactor vessel water level signals have cleared.
| |
| The RCIC test line isolation valve is closed on a RCIC initiation signal to allow full system flow to the reactor vessel.
| |
| The RCIC System also monitors the water level in the condensate storage tank (CST), since there are two sources of water for RCIC operation. Reactor grade water in the CST is the normal source. Upon receipt of a RCIC initiation signal, the CST suction valve is automatically signaled to open (it is normally in the open position) unless the pump suction from the suppression pool valve is open. If the water level in the CST falls below a preselected level, first the suppression pool suction valve automatically opens and then the CST suction valve automatically closes. Two level switches are used to detect low water level in the CST. Either switch can cause the suppression pool suction valve to open. To prevent losing suction to the pump, (continued)
| |
| LaSalle 1 and 2 B 3.3.5.3-1 Revision 76
| |
| | |
| RCIC System Instrumentation B 3.3.5.3 BASES BACKGROUND the suction valves are interlocked so that one suction path (continued) must be open before the other automatically closes.
| |
| The RCIC System provides makeup water to the reactor until the reactor vessel water level reaches the high water level (Level 8) trip (two-out-of-two logic), at which time the RCIC turbine steam inlet isolation valve closes (the injection valve also closes due to the closure of the RCIC turbine steam inlet isolation valve). The RCIC System restarts if vessel level again drops to the low level initiation point (Level 2).
| |
| APPLICABLE The function of the RCIC System, to provide makeup SAFETY ANALYSES, coolant to the reactor, is to respond to transient LCO, and events. The RCIC System is not an Engineered Safety Feature APPLICABILITY System and no credit is taken in the safety analysis for RCIC System operation. Based on its contribution to the reduction of overall plant risk, however, the RCIC System, and therefore its instrumentation, meets Criterion 4 of 10 CFR 50.36(c)(2)(ii). Certain instrumentation Functions are retained for other reasons and are described below in the individual Functions discussion.
| |
| The OPERABILITY of the RCIC System instrumentation is dependent on the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.5.3-1. Each Function must have a required number of OPERABLE channels with their setpoints within the specified Allowable Values, where appropriate. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.
| |
| Allowable Values are specified for each RCIC System instrumentation Function specified in the Table. Nominal trip setpoints are specified in the setpoint calculations.
| |
| The nominal setpoints are selected to ensure that the setpoints do not exceed the Allowable Value between CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.5.3-2 Revision 76
| |
| | |
| RCIC System Instrumentation B 3.3.5.3 BASES APPLICABLE Trip setpoints are those predetermined values of output at SAFETY ANALYSES, which an action should take place. The setpoints are LCO, and compared to the actual process parameter (e.g., reactor APPLICABILITY vessel water level), and when the measured output value of (continued) the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state. The analytic limits (or design limits) are derived from the limiting values of the process parameters obtained from the safety analysis.
| |
| The trip setpoints are determined from the analytic limits, corrected for defined process, calibration, and instrument errors. The Allowable Values are then determined, based on the trip setpoint values, by accounting for the calibration based errors. These calibration based errors are limited to reference accuracy, instrument drift, errors associated with measurement and test equipment, and calibration tolerance of loop components. The trip setpoints and Allowable Values determined in this manner provide adequate protection because instrument uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for and appropriately applied for the instrumentation.
| |
| The individual Functions are required to be OPERABLE in MODE 1, and in MODES 2 and 3 with reactor steam dome pressure > 150 psig, since this is when RCIC is required to be OPERABLE. Refer to LCO 3.5.3 for Applicability Bases for the RCIC System.
| |
| The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.
| |
| : 1. Reactor Vessel Water LevelLow Low, Level 2 Low reactor pressure vessel (RPV) water level indicates that normal feedwater flow is insufficient to maintain reactor vessel water level and that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, the RCIC System is initiated at Level 2 to assist in maintaining water level above the top of the active fuel.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.5.3-3 Revision 76
| |
| | |
| RCIC System Instrumentation B 3.3.5.3 BASES APPLICABLE 1. Reactor Vessel Water LevelLow Low, Level 2 SAFETY ANALYSES, (continued)
| |
| LCO, and APPLICABILITY Reactor Vessel Water LevelLow Low, Level 2 signals are initiated from four differential pressure transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.
| |
| The Reactor Vessel Water LevelLow Low, Level 2 Allowable Value is set high enough such that for complete loss of feedwater flow, the RCIC System flow with high pressure core spray assumed to fail will be sufficient to avoid initiation of low pressure ECCS at Level 1.
| |
| Four channels of Reactor Vessel Water LevelLow Low, Level 2 Function are available and are required to be OPERABLE when RCIC is required to be OPERABLE to ensure that no single instrument failure can preclude RCIC initiation.
| |
| Refer to LCO 3.5.3 for RCIC Applicability Bases.
| |
| : 2. Reactor Vessel Water LevelHigh, Level 8 High RPV water level indicates that sufficient cooling water inventory exists in the reactor vessel such that there is no danger to the fuel. Therefore, the Level 8 signal is used to close the RCIC turbine steam inlet isolation valve to prevent overflow into the main steam lines (MSLs). (The injection valve also closes due to the closure of the RCIC turbine steam inlet isolation valve.)
| |
| Reactor Vessel Water LevelHigh, Level 8 signals for RCIC are initiated from two differential pressure transmitters from the narrow range water level measurement instrumentation, which sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.
| |
| The Reactor Vessel Water LevelHigh, Level 8 Allowable Value is high enough to preclude isolating the injection valve of the RCIC during normal operation, yet low enough to trip the RCIC System prior to water overflowing into the MSLs.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.5.3-4 Revision 76
| |
| | |
| RCIC System Instrumentation B 3.3.5.3 BASES APPLICABLE 2. Reactor Vessel Water LevelHigh, Level 8 (continued)
| |
| SAFETY ANALYSES, LCO, and Two channels of Reactor Vessel Water LevelHigh, Level 8 APPLICABILITY Function are available and are required to be OPERABLE when RCIC is required to be OPERABLE to ensure that no single instrument failure can preclude RCIC initiation. Refer to LCO 3.5.3 for RCIC Applicability Bases.
| |
| : 3. Condensate Storage Tank LevelLow Low level in the CST indicates the unavailability of an adequate supply of makeup water from this normal source.
| |
| Normally the suction valve between the RCIC pump and the CST is open and, upon receiving a RCIC initiation signal, water for RCIC injection would be taken from the CST. However, if the water level in the CST falls below a preselected level, first the suppression pool suction valve automatically opens and then the CST suction valve automatically closes. This ensures that an adequate supply of makeup water is available to the RCIC pump. To prevent losing suction to the pump, the suction valves are interlocked so that the suppression pool suction valve must be open before the CST suction valve automatically closes.
| |
| Two level switches are used to detect low water level in the CST. The Condensate Storage Tank LevelLow Function Allowable Value is set high enough to ensure adequate pump suction head while water is being taken from the CST.
| |
| Two channels of Condensate Storage Tank LevelLow Function are available and are required to be OPERABLE when RCIC is required to be OPERABLE to ensure that no single instrument failure can preclude RCIC swap to suppression pool source.
| |
| Refer to LCO 3.5.3 for RCIC Applicability Bases.
| |
| : 4. Manual Initiation The Manual Initiation push button channel introduces a signal into the RCIC System initiation logic that is redundant to the automatic protective instrumentation and provides manual initiation capability. There is one push button channel for the RCIC System.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.5.3-5 Revision 76
| |
| | |
| RCIC System Instrumentation B 3.3.5.3 BASES APPLICABLE 4. Manual Initiation (continued)
| |
| SAFETY ANALYSES, LCO, and The Manual Initiation Function is not assumed in any APPLICABILITY accident or transient analyses in the UFSAR. However, the Function is retained for overall redundancy and diversity of the RCIC function as required by the NRC in the plant licensing basis.
| |
| There is no Allowable Value for this Function since the channel is mechanically actuated based solely on the position of the push button. One channel of Manual Initiation is required to be OPERABLE when RCIC is required to be OPERABLE. Refer to LCO 3.5.3 for RCIC Applicability Bases.
| |
| ACTIONS A Note has been provided to modify the ACTIONS related to RCIC System instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable RCIC System instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable RCIC System instrumentation channel.
| |
| A.1 Required Action A.1 directs entry into the appropriate Condition referenced in Table 3.3.5.3-1 in the accompanying LCO. The applicable Condition referenced in the Table is Function dependent. Each time a channel is discovered to be inoperable, Condition A is entered for that channel and provides for transfer to the appropriate subsequent Condition.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.5.3-6 Revision 76
| |
| | |
| RCIC System Instrumentation B 3.3.5.3 BASES ACTIONS B.1 and B.2 (continued)
| |
| Required Action B.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in a complete loss of automatic initiation capability for the RCIC System. In this case, automatic initiation capability is lost if two Function 1 parallel contacts (channels) in the same trip system are inoperable and untripped. In this situation (loss of automatic initiation capability), the 24 hour allowance of Required Action B.2 is not appropriate, and the RCIC System must be declared inoperable within 1 hour after discovery of loss of RCIC initiation capability.
| |
| The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."
| |
| For Required Action B.1, the Completion Time only begins upon discovery that the RCIC System cannot be automatically initiated due to two inoperable, untripped Reactor Vessel Water LevelLow Low, Level 2 channels (parallel contacts) in the same trip system. The 1 hour Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.
| |
| Because of the redundancy of sensors available to provide initiation signals and the fact that the RCIC System is not credited in any accident or transient analysis, an allowable out of service time of 24 hours has been shown to be acceptable (Ref. 1) to permit restoration of any inoperable channel to OPERABLE status. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. This Completion Time is modified by a Note to clarify that the Risk Informed Completion Time Program is not applicable to a Required Action associated with a Condition that represents a loss of safety function.
| |
| If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action B.2. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue. Alternately, if it is not (continued)
| |
| LaSalle 1 and 2 B 3.3.5.3-7 Revision 89
| |
| | |
| RCIC System Instrumentation B 3.3.5.3 BASES ACTIONS B.1 and B.2 (continued) desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an initiation), Condition E must be entered and its Required Action taken.
| |
| C.1 A risk based analysis was performed and determined that an allowable out of service time of 24 hours (Ref. 1) is acceptable to permit restoration of any inoperable channel to OPERABLE status (Required Action C.1). A Required Action (similar to Required Action B.1), limiting the allowable out of service time if a loss of automatic RCIC initiation capability exists, is not required. This Condition applies to the Reactor Vessel Water LevelHigh, Level 8 Function, whose logic is arranged such that any inoperable channel will result in a loss of automatic RCIC initiation (high water level trip) capability. As stated above, this loss of automatic RCIC initiation (high water level trip) capability was analyzed and determined to be acceptable. This Condition also applies to the Manual Initiation Function.
| |
| Since this Function is not assumed in any accident or transient analysis, a total loss of manual initiation capability (Required Action C.1) for 24 hours is allowed.
| |
| The Required Action does not allow placing a channel in trip since this action would not necessarily result in the safe state for the channel in all events.
| |
| D.1, D.2.1, and D.2.2 Required Action D.1 is intended to ensure that appropriate actions are taken if multiple inoperable, untripped channels within the same Function result in automatic component initiation (RCIC source swapover) capability being lost for the feature(s). For Required Action D.1, the RCIC System is the only associated feature. In this case, automatic component initiation (RCIC source swapover) capability is lost if two Function 3 channels are inoperable and untripped. In this situation (loss of automatic suction swap), the 24 hour allowance of Required Actions D.2.1 and D.2.2 is not appropriate, and the RCIC System must be declared inoperable within 1 hour from discovery of loss of RCIC initiation capability. As noted, Required Action D.1 (continued)
| |
| LaSalle 1 and 2 B 3.3.5.3-8 Revision 89
| |
| | |
| RCIC System Instrumentation B 3.3.5.3 BASES ACTIONS D.1, D.2.1, and D.2.2 (continued) is only applicable if the RCIC pump suction is not aligned to the suppression pool since, if aligned, the Function is already performed.
| |
| The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."
| |
| For Required Action D.1, the Completion Time only begins upon discovery that the RCIC System cannot be automatically aligned to the suppression pool due to two inoperable, untripped channels in the same Function. The 1 hour Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.
| |
| Because of the redundancy of sensors available to provide initiation signals and the fact that the RCIC System is not assumed in any accident or transient analysis, an allowable out of service time of 24 hours has been shown to be acceptable (Ref. 1) to permit restoration of any inoperable channel to OPERABLE status. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. This Completion Time is modified by a Note to clarify that the Risk Informed Completion Time Program is not applicable to a Required Action associated with a Condition that represents a loss of safety function.
| |
| If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action D.2.1, which performs the intended function of the channel (shifting the suction source to the suppression pool). Alternatively, Required Action D.2.2 allows the manual alignment of the RCIC suction to the suppression pool within 24 hours, which also performs the intended function.
| |
| If Required Action D.2.1 or D.2.2 is performed, measures should be taken to ensure that the RCIC System piping remains filled with water. If it is not desired to perform Required Actions D.2.1 and D.2.2 (e.g., as in the case where shifting the suction source could drain down the RCIC suction piping), Condition E must be entered and its Required Action taken.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.5.3-9 Revision 89
| |
| | |
| RCIC System Instrumentation B 3.3.5.3 BASES (continued)
| |
| ACTIONS E.1 (continued)
| |
| With any Required Action and associated Completion Time not met, the RCIC System may be incapable of performing the intended function, and the RCIC System must be declared inoperable immediately.
| |
| SURVEILLANCE As noted in the beginning of the SRs, the SRs for each RCIC REQUIREMENTS System instrumentation Function are found in the SRs column of Table 3.3.5.3-1.
| |
| The Surveillances are modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed as follows:
| |
| (a) for up to 6 hours for Functions 2 and 4; and (b) for up to 6 hours for Functions 1 and 3 provided the associated Function maintains RCIC initiation capability. Upon completion of the Surveillance, or expiration of the 6 hour allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Ref. 1) assumption of the average time required to perform channel Surveillance. That analysis demonstrated that the 6 hour testing allowance does not significantly reduce the probability that the RCIC will initiate when necessary.
| |
| SR 3.3.5.3.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.
| |
| Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.5.3-10 Revision 89
| |
| | |
| RCIC System Instrumentation B 3.3.5.3 BASES SURVEILLANCE SR 3.3.5.3.1 (continued)
| |
| REQUIREMENTS Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.
| |
| SR 3.3.5.3.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the channel will perform the intended function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.5.3-11 Revision 89
| |
| | |
| RCIC System Instrumentation B 3.3.5.3 BASES SURVEILLANCE SR 3.3.5.3.3 REQUIREMENTS (continued) CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter with the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.5.3.4 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required initiation logic for a specific channel. The system functional testing performed in LCO 3.5.3 overlaps this Surveillance to provide complete testing of the safety function.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. GENE-770-06-2-A, "Addendum to Bases for Changes to Surveillance Test Intervals and Allowed Out-of-Service Times for Selected Instrumentation Technical Specifications," December 1992.
| |
| LaSalle 1 and 2 B 3.3.5.3-12 Revision 89
| |
| | |
| Primary Containment Isolation Instrumentation B 3.3.6.1 B 3.3 INSTRUMENTATION B 3.3.6.1 Primary Containment Isolation Instrumentation BASES BACKGROUND The primary containment isolation instrumentation automatically initiates closure of appropriate primary containment isolation valves (PCIVs). The function of the PCIVs, in combination with other accident mitigation systems, is to limit fission product release during and following postulated Design Basis Accidents (DBAs). Primary containment isolation within the time limits specified for those isolation valves designed to close automatically ensures that the release of radioactive material to the environment will be consistent with the assumptions used in the analyses for a DBA.
| |
| The isolation instrumentation includes the sensors, relays, and switches that are necessary to cause initiation of primary containment and reactor coolant pressure boundary (RCPB) isolation. Most channels include electronic equipment (e.g., trip units) that compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the channel output relay actuates, which then outputs a primary containment isolation signal to the isolation logic. Functional diversity is provided by monitoring a wide range of independent parameters. The input parameters to the isolation logic are (a) reactor vessel water level, (b) area and differential temperatures, (c) main steam line (MSL) flow measurement, (d) Standby Liquid Control (SLC) System initiation, (e) condenser vacuum loss, (f) main steam line pressure, (g) reactor core isolation cooling (RCIC) steam line flow and time delay relay, (h) reactor building ventilation exhaust plenum and fuel pool ventilation exhaust radiation, (i) RCIC steam line pressure, (j) RCIC turbine exhaust diaphragm pressure, (k) reactor water cleanup (RWCU) differential flow and time delay relay, (l) reactor vessel pressure, and (m) drywell pressure. Redundant sensor input signals are provided from each such isolation initiation parameter. In addition, manual isolation of the logics is provided.
| |
| The primary containment isolation instrumentation has inputs to the trip logic from the isolation Functions listed below.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.6.1-1 Revision 0
| |
| | |
| Primary Containment Isolation Instrumentation B 3.3.6.1 BASES BACKGROUND 1. Main Steam Line Isolation (continued)
| |
| Most Main Steam Line Isolation Functions receive inputs from four channels. One channel associated with each Function inputs to one of four trip strings. Two trip strings make up a trip system and both trip systems must actuate to cause isolation of all main steam isolation valves (MSIVs). Any channel will trip the associated trip string. Only one trip string must trip to trip the associated trip system. The trip strings are arranged in one-out-of-two taken twice logic to initiate isolation of all MSIVs. The outputs from the same channels are arranged into two two-out-of-two trip systems to isolate all MSL drain valves. One two-out-of-two trip system is associated with the inboard valves and the other two-out-of-two trip system is associated with the outboard valves.
| |
| One exception to this arrangement is the Main Steam Line FlowHigh Function. This Function uses 16 flow channels, four for each steam line. One channel from each steam line inputs to one of four trip strings. Two trip strings make up each trip system, and both trip systems must trip to cause an MSL isolation. Each trip string has four inputs (one per MSL), any one of which will trip the trip string.
| |
| The trip strings are arranged in a one-out-of-two taken twice logic. Therefore, this is effectively a one-out-of-eight taken twice logic arrangement to initiate isolation of the MSIVs. Similarly, the 16 flow channels are connected into two two-out-of-two trip systems (effectively, two one-out-of-four twice logic), with one trip system isolating the inboard MSL drain valves and the other two-out-of-two trip system isolating the outboard MSL drain valves.
| |
| The other exception to this arrangement is the Manual Initiation Function. The MSIV manual isolation logic is similar to the other MSIV isolation logic in that each trip string is associated with a manual isolation pushbutton in a one-out-of-two taken twice logic as described above.
| |
| However, the MSL drain isolation valves are isolated by a single manual isolation pushbutton; the outboard MSL drain isolation valves isolate from the B channel manual isolation pushbutton and the inboard MSL drain valve isolates from the D channel manual isolation pushbutton. The A and C channel manual isolation pushbuttons only directly affect the manual (continued)
| |
| LaSalle 1 and 2 B 3.3.6.1-2 Revision 0
| |
| | |
| Primary Containment Isolation Instrumentation B 3.3.6.1 BASES BACKGROUND 1. Main Steam Line Isolation (continued) isolation of the MSIVs. The same channel B and D manual isolation pushbuttons are used for the logic of other Group isolation valves.
| |
| MSL Isolation Functions isolate the Group 1 valves.
| |
| : 2. Primary Containment Isolation Most Primary Containment Isolation Functions receive inputs from four channels. The outputs from these channels are arranged into two two-out-of-two trip systems. One trip system initiates isolation of all automatic inboard PCIVs, while the other trip system initiates isolation of all automatic outboard PCIVs. Each trip system closes one of the two valves on each penetration with automatic isolation so that operation of either trip system isolates the penetration. An exception to this arrangement are the Traversing In-core Probe (TIP) System valve/drives. For these valves and drive mechanisms, only one trip system (the inboard valve system) is provided. When the trip system actuates, the drive mechanisms withdraw the TIPs and, when the TIPs are fully withdrawn, the ball valves close. This exception to the arrangement, which has been previously approved by the NRC as part of the issuance of the Operating Licenses, is described in UFSAR Table 6.2-21 (Ref. 1).
| |
| Reactor Vessel Water LevelLow, Level 3 isolates the Group 7 valves. Reactor Vessel Water LevelLow Low, Level 2 isolates the Group 2, 3, and 4 valves. Reactor Vessel Water LevelLow Low Low, Level 1 isolates the Group 10 valves.
| |
| Drywell PressureHigh isolates the Group 2, 4, 7, and 10 valves. Reactor Building Ventilation Exhaust Plenum RadiationHigh isolates the Group 4 valves. Fuel Pool Ventilation Exhaust RadiationHigh isolates the Group 4 valves. Manual Initiation Functions isolate the Group 2, 4, 7, and 10 valves.
| |
| : 3. Reactor Core Isolation Cooling System Isolation Most Functions receive input from two channels, with each channel in one trip system using one-out-of-one logic. One of the two trip systems is connected to the inboard steam (continued)
| |
| LaSalle 1 and 2 B 3.3.6.1-3 Revision 0
| |
| | |
| Primary Containment Isolation Instrumentation B 3.3.6.1 BASES BACKGROUND 3. Reactor Core Isolation Cooling System Isolation (continued) valves and the other trip system is connected to the outboard steam valve on the RCIC penetration so that operation of either trip system isolates the penetration.
| |
| Two exceptions to this arrangement are the RCIC Steam Supply PressureLow and RCIC Turbine Exhaust Diaphragm Pressure-High Functions. These Functions receive input from four steam supply pressure channels and four turbine exhaust diaphragm pressure channels, respectively. The outputs from these channels are connected into two two-out-of-two trip systems, each trip system isolating the inboard or outboard RCIC steam valves. In addition, the RCIC System Isolation Manual Initiation Function has only one channel, which isolates the outboard RCIC steam valve only (provided an automatic initiation signal is present).
| |
| One additional exception involves the Drywell PressureHigh Function and the RCIC Steam Supply PressureLow Functions.
| |
| The Drywell PressureHigh Function does not provide an isolation to the inboard and outboard RCIC steam valves (Group 8 valves). The logic is arranged such that RCIC Steam Supply PressureLow coincident with Drywell Pressure-High isolates the Group 9 valves. The Drywell Pressure-High Function receives inputs from four drywell pressure channels. The outputs from these channels are connected into two one-out-of-two trip systems with coincident RCIC Steam Supply Pressure also connected into the same trip systems arranged in a similar manner (one-out-of-two). One of the two trip systems is connected to the inboard RCIC turbine exhaust vacuum breaker line isolation valve and the other trip system is connected to the outboard RCIC turbine exhaust vacuum breaker line isolation valve (Group 9 valves).
| |
| RCIC System Isolation Functions isolate the Group 8 and 9 valves.
| |
| : 4. Reactor Water Cleanup System Isolation Most Functions receive input from two channels with each channel in one trip system using one-out-of-one logic.
| |
| Functions 4.c, 4.d, 4.e and 4.f (RWCU Heat Exchanger Area TemperatureHigh, RWCU Heat Exchanger Area Ventilation Differential TemperatureHigh, RWCU Pump and Valve Area (continued)
| |
| LaSalle 1 and 2 B 3.3.6.1-4 Revision 0
| |
| | |
| Primary Containment Isolation Instrumentation B 3.3.6.1 BASES BACKGROUND 4. Reactor Water Cleanup System Isolation (continued)
| |
| TemperatureHigh, and RWCU Pump and Valve Area Ventilation Differential TemperatureHigh, respectively) have one channel in each trip system in each area for a total of four channels per Function, for Functions 4.c and 4.d and a total of six channels per Function for Functions 4.e and 4.f, but the logic is the same (one-out-of-one per area). Each of the two trip systems is connected to one of the two valves on the RWCU penetration so that operation of either trip system isolates the penetration. The exceptions to this arrangement are the Reactor Vessel Water LevelLow Low, Level 2 and the SLC System Initiation Functions. The Reactor Vessel Water LevelLow Low, Level 2 Function receives input from four reactor vessel water level channels. The outputs from the reactor vessel water level channels are connected into two two-out-of-two trip systems, each trip system isolating one of the two RWCU valves. The Standby Liquid Control (SLC) System initiation has two channels, one from each SLC pump start circuit, in a single trip system. The two channels are connected in a one-out-of-two logic. This trip system isolates the RWCU inlet outboard valve.
| |
| RWCU Isolation Functions isolate the Group 5 valves.
| |
| : 5. RHR Shutdown Cooling System Isolation The Shutdown Cooling Isolation Function receives input signals from instrumentation for the Reactor Vessel Water LevelLow, Level 3, Reactor Vessel PressureHigh, and Manual Initiation Functions. The Reactor Vessel Water LevelLow Function receives input from four channels while the Reactor Vessel PressureHigh Function receives input from two channels. The outputs from the Reactor Vessel Water LevelLow channels are connected into two two-out-of-two trip systems. The Reactor Vessel Pressure-High Function is arranged into two one-out-of-one trip systems. The Manual Initiation Function uses two channels, one for each trip system.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.6.1-5 Revision 0
| |
| | |
| Primary Containment Isolation Instrumentation B 3.3.6.1 BASES BACKGROUND 5. Shutdown Cooling System Isolation (continued)
| |
| One of the two trip systems is connected to the outboard valve associated with the reactor vessel head spray injection penetration, the shutdown cooling return penetration, and the shutdown cooling suction penetration while the other trip system is connected to the inboard valves on the shutdown cooling suction penetration and the shutdown cooling return check valve bypasses.
| |
| The RHR Shutdown Cooling Isolation Functions isolate the Group 6 valves.
| |
| APPLICABLE The isolation signals generated by the primary containment SAFETY ANALYSES, isolation instrumentation are implicitly assumed in the LCO, and safety analyses of References 2 and 3 to initiate closure of APPLICABILITY valves to limit offsite doses. Refer to LCO 3.6.1.3, "Primary Containment Isolation Valves (PCIVs)," Applicable Safety Analyses Bases, for more detail.
| |
| Primary containment isolation instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). Certain instrumentation Functions are retained for other reasons and are described below in the individual Functions discussion.
| |
| The OPERABILITY of the primary containment instrumentation is dependent on the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.6.1-1. Each Function must have a required number of OPERABLE channels, with their setpoints within the specified Allowable Values, where appropriate. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions. Each channel must also respond within its assumed response time, where appropriate.
| |
| Allowable Values are specified for each Primary Containment Isolation Function specified in the Table. Nominal trip setpoints are specified in the setpoint calculations. The nominal setpoints are selected to ensure that the setpoints do not exceed the Allowable Value between CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable. A channel is inoperable if its actual trip setpoint is not within its required (continued)
| |
| LaSalle 1 and 2 B 3.3.6.1-6 Revision 0
| |
| | |
| Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE Allowable Value. Trip setpoints are those predetermined SAFETY ANALYSES, values of output at which an action should take place. The LCO, and setpoints are compared to the actual process parameter APPLICABILITY (e.g., reactor vessel water level), and when the measured (continued) output value of the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The trip setpoints are determined from the analytic limits, corrected for defined process, calibration, and instrument errors. The Allowable Values are then determined, based on the trip setpoint values, by accounting for the calibration based errors. These calibration based errors are limited to reference accuracy, instrument drift, errors associated with measurement and test equipment, and calibration tolerance of loop components. The trip setpoints and Allowable Values determined in this manner provide adequate protection because instrument uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for and appropriately applied for the instrumentation.
| |
| Certain Emergency Core Cooling Systems (ECCS) and RCIC valves (e.g., minimum flow) also serve the dual function of automatic PCIVs. The signals that isolate these valves are also associated with the automatic initiation of the ECCS and RCIC. Some instrumentation and ACTIONS associated with these signals are addressed in LCO 3.3.5.1, "ECCS Instrumentation," and LCO 3.3.5.3, "RCIC System Instrumentation," and are not included in this LCO.
| |
| In general, the individual Functions are required to be OPERABLE in MODES 1, 2, and 3 consistent with the Applicability for LCO 3.6.1.1, "Primary Containment."
| |
| Functions that have different Applicabilities are discussed below in the individual Functions discussion.
| |
| The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.6.1-7 Revision 76
| |
| | |
| Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 1. Main Steam Line Isolation SAFETY ANALYSES, LCO, and 1.a. Reactor Vessel Water LevelLow Low Low, Level 1 APPLICABILITY (continued) Low reactor pressure vessel (RPV) water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result.
| |
| Therefore, isolation of the MSIVs and other interfaces with the reactor vessel occurs to prevent offsite dose limits from being exceeded. The Reactor Vessel Water LevelLow Low Low, Level 1 Function is one of the many Functions assumed to be OPERABLE and capable of providing isolation signals. The Reactor Vessel Water LevelLow Low Low, Level 1 Function associated with isolation is assumed in the analysis of the recirculation line break (Ref. 2). The isolation of the MSL on Level 1 supports actions to ensure that offsite dose limits are not exceeded for a DBA.
| |
| Reactor vessel water level signals are initiated from four differential pressure transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water LevelLow Low Low, Level 1 Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
| |
| The Reactor Vessel Water LevelLow Low Low, Level 1 Allowable Value is chosen to be the same as the ECCS Level 1 Allowable Value (LCO 3.3.5.1) to ensure that the MSLs isolate on a potential loss of coolant accident (LOCA) to prevent offsite doses from exceeding 10 CFR 50.67 limits.
| |
| This Function isolates the Group 1 valves.
| |
| 1.b. Main Steam Line PressureLow Low MSL pressure indicates that there may be a problem with the turbine pressure regulation, which could result in a low reactor vessel water level condition and the RPV cooling down more than 100qF/hour if the pressure loss is allowed to continue. The Main Steam Line PressureLow Function is directly assumed in the analysis of the pressure regulator failure event (Ref. 4). The closure of the MSIVs ensures (continued)
| |
| LaSalle 1 and 2 B 3.3.6.1-8 Revision 48
| |
| | |
| Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 1.b. Main Steam Line PressureLow (continued)
| |
| SAFETY ANALYSES, LCO, and that the RPV temperature change limit (100qF/hour) is not APPLICABILITY reached. In addition, this Function supports actions to ensure that Safety Limit 2.1.1.1 is not exceeded. (This Function closes the MSIVs during the depressurization transient in order to maintain reactor steam dome pressure
| |
| > 700 psia. The MSIV closure results in a scram, thus reducing reactor power to < 25% RTP.)
| |
| The MSL low pressure signals are initiated from four pressure switches that are connected downstream of the MSL header prior to each main turbine stop valve. The pressure switches are arranged such that, even though physically separated from each other, each switch is able to detect low MSL pressure. Four channels of Main Steam Line Pressure-Low Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
| |
| The Allowable Value was selected to be high enough to prevent excessive RPV depressurization.
| |
| The Main Steam Line PressureLow Function is only required to be OPERABLE in MODE 1 since this is when the assumed transient can occur (Ref. 4).
| |
| This Function isolates the Group 1 valves.
| |
| 1.c. Main Steam Line FlowHigh Main Steam Line FlowHigh is provided to detect a break of the MSL and to initiate closure of the MSIVs. If the steam were allowed to continue flowing out of the break, the reactor would depressurize and the core could uncover. If the RPV water level decreases too far, fuel damage could occur. Therefore, the isolation is initiated on high flow to prevent or minimize core damage. The Main Steam Line FlowHigh Function is directly assumed in the analysis of the main steam line break (MSLB) accident (Ref. 5). The isolation action, along with the scram function of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46 and offsite doses do not exceed the 10 CFR 100 limits.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.6.1-9 Revision 68
| |
| | |
| Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 1.c. Main Steam Line FlowHigh (continued)
| |
| SAFETY ANALYSES, LCO, and The MSL flow signals are initiated from 16 differential APPLICABILITY pressure switches that are connected to the four MSLs (the differential pressure switches sense differential pressure across a flow element). The switches are arranged such that, even though physically separated from each other, all four connected to one steam line would be able to detect the high flow. Four channels of Main Steam Line FlowHigh Function for each MSL (two channels per trip system) are available and are required to be OPERABLE so that no single instrument failure will preclude detecting a break in any individual MSL.
| |
| The Allowable Value is chosen to ensure that offsite dose limits are not exceeded due to the break.
| |
| This Function isolates the Group 1 valves.
| |
| 1.d. Condenser VacuumLow The Condenser VacuumLow Function is provided to prevent overpressurization of the main condenser in the event of a loss of the main condenser vacuum (Ref. 6). Since the integrity of the condenser is an assumption in offsite dose calculations (Ref. 7), the Condenser VacuumLow Function is assumed to be OPERABLE and capable of initiating closure of the MSIVs. The closure of the MSIVs is initiated to prevent the addition of steam that would lead to additional condenser pressurization and possible rupture of the diaphragm installed to protect the turbine exhaust hood, thereby preventing a potential radiation leakage path following an accident.
| |
| Condenser vacuum pressure signals are derived from four pressure switches that sense the pressure in the condenser.
| |
| Four channels of Condenser VacuumLow Function are available and are required to be OPERABLE to ensure no single instrument failure can preclude the isolation function.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.6.1-10 Revision 0
| |
| | |
| Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 1.d. Condenser VacuumLow (continued)
| |
| SAFETY ANALYSES, LCO, and The Allowable Value is chosen to prevent damage to the APPLICABILITY condenser due to pressurization, thereby ensuring its integrity for offsite dose analysis. As noted (footnote (a) to Table 3.3.6.1-1), the channels are not required to be OPERABLE in MODES 2 and 3, when all turbine stop valves (TSVs) are closed, since the potential for condenser overpressurization is minimized. Switches are provided to manually bypass the channels when all TSVs are closed.
| |
| This Function isolates the Group 1 valves.
| |
| 1.e Main Steam Line Tunnel Differential TemperatureHigh Differential TemperatureHigh is provided to detect a leak in a main steam line, and provides diversity to the high flow instrumentation. The isolation occurs when a very small leak has occurred. If the small leak is allowed to continue without isolation, offsite dose limits may be reached. However, credit for these instruments is not taken in any transient or accident analysis in the UFSAR, since bounding analyses are performed for large breaks such as MSLBs.
| |
| Eight thermocouples provide input to the Main Steam Line Tunnel Differential TemperatureHigh Function. The output of these thermocouples is used to determine the differential temperature. Each channel consists of a differential temperature instrument that receives inputs from thermocouples that are located in the inlet and outlet of the main steam line tunnel for a total of four available channels. Four channels of Main Steam Line Tunnel Differential TemperatureHigh Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
| |
| The differential temperature monitoring Allowable Value is chosen to detect a leak equivalent to 100 gpm.
| |
| These Functions isolate the Group 1 valves.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.6.1-11 Revision 0
| |
| | |
| Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 1.f. Manual Initiation SAFETY ANALYSES, LCO, and The Manual Initiation push button channels introduce signals APPLICABILITY into the MSL isolation logic that are redundant to the (continued) automatic protective instrumentation and provide manual isolation capability. There is no specific UFSAR safety analysis that takes credit for this Function. It is retained for overall redundancy and diversity of the isolation function as required by the NRC in the plant licensing basis.
| |
| There are four push buttons for the logic, with two manual initiation push buttons per trip system. Four channels of Manual Initiation Function are available and are required to be OPERABLE in MODES 1, 2, and 3, since these are the MODES in which the MSL Isolation automatic Functions are required to be OPERABLE.
| |
| There is no Allowable Value for this Function since the channels are mechanically actuated based solely on the position of the push buttons.
| |
| This Function isolates the Group 1 valves.
| |
| : 2. Primary Containment Isolation 2.a Reactor Vessel Water LevelLow Low, Level 2 Low RPV water level indicates the capability to cool the fuel may be threatened. The valves whose penetrations communicate with the primary containment are isolated to limit the release of fission products. The isolation of the primary containment on Level 2 supports actions to ensure that offsite dose limits of 10 CFR 50.67 are not exceeded.
| |
| The Reactor Vessel Water LevelLow Low, Level 2 Function associated with isolation is implicitly assumed in the UFSAR analysis as these leakage paths are assumed to be isolated post LOCA.
| |
| Reactor Vessel Water LevelLow Low, Level 2 signals are initiated from differential pressure transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual (continued)
| |
| LaSalle 1 and 2 B 3.3.6.1-12 Revision 48
| |
| | |
| Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 2.a Reactor Vessel Water LevelLow Low, Level 2 SAFETY ANALYSES, (continued)
| |
| LCO, and APPLICABILITY water level (variable leg) in the vessel. Four channels of Reactor Vessel Water LevelLow Low, Level 2 Function are available and are required to be OPERABLE to ensure no single instrument failure can preclude the isolation function.
| |
| This Function isolates the Group 2, 3, and 4 valves.
| |
| 2.b Drywell PressureHigh High drywell pressure can indicate a break in the RCPB inside the drywell. The isolation of some of the PCIVs on high drywell pressure supports actions to ensure that offsite dose limits of 10 CFR 50.67 are not exceeded. The Drywell PressureHigh Function associated with isolation of the primary containment is implicitly assumed in the UFSAR accident analysis as these leakage paths are assumed to be isolated post LOCA.
| |
| High drywell pressure signals are initiated from pressure switches that sense the pressure in the drywell. Four channels of Drywell PressureHigh Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
| |
| The Allowable Value was selected to be the same as the RPS Drywell PressureHigh Allowable Value (LCO 3.3.1.1), since this may be indicative of a LOCA inside primary containment.
| |
| This Function isolates the Group 2, 4, 7, and 10 valves.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.6.1-13 Revision 73
| |
| | |
| Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 2.c. Reactor Building Ventilation Exhaust Plenum SAFETY ANALYSES, RadiationHigh LCO, and APPLICABILITY High ventilation exhaust radiation is an indication of (continued) possible gross failure of the fuel cladding. The release may have originated from the primary containment due to a break in the RCPB or refueling floor due to a fuel handling accident. When Reactor Building Ventilation Exhaust RadiationHigh is detected, valves whose penetrations communicate with the primary containment atmosphere are isolated to limit the release of fission products.
| |
| The Reactor Building Ventilation Exhaust Plenum Radiation-High signals are initiated from radiation detectors that are located in the reactor building return air riser above the upper area of the steam tunnel prior to the reactor building ventilation isolation dampers. The signal from each detector is input to an individual monitor whose trip outputs are assigned to an isolation channel.
| |
| Four channels of Reactor Building Ventilation Exhaust Plenum RadiationHigh Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
| |
| The Allowable Values are chosen to promptly detect gross failure of the fuel cladding and to ensure offsite doses remain below 10 CFR 20 and 10 CFR 50.67 limits.
| |
| These Functions isolate the Group 4 valves.
| |
| 2.d. Fuel Pool Ventilation Exhaust RadiationHigh High fuel pool ventilation exhaust radiation indicates increased airborne radioactivity levels in secondary containment refuel floor area which could be due to fission gases from the fuel pool resulting from a refueling accident. Since the primary and secondary containments may be in communication, the vent and purge valves for primary containment isolation are also provided with an isolation signal. Therefore, Fuel Pool Ventilation Exhaust Radiation-High Function initiates an isolation to assure timely closure of valves to protect against substantial releases of radioactive materials to the environment. While this Function is identified as initiating the Standby Gas Treatment System for a spent fuel cask drop accident (continued)
| |
| LaSalle 1 and 2 B 3.3.6.1-14 Revision 48
| |
| | |
| Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 2.d. Fuel Pool Ventilation Exhaust RadiationHigh SAFETY ANALYSES, (continued)
| |
| LCO, and APPLICABILITY (Ref. 3), it is not assumed in any limiting accident or transient analysis in the UFSAR because other leakage paths (e.g., MSIVs) are more limiting.
| |
| The fuel pool ventilation exhaust radiation signals are initiated from radiation detectors located in the reactor building exhaust ducting coming from the refuel floor. The signal from each detector is input to an individual monitor whose trip output is assigned to an isolation channel. Four channels of Fuel Pool Ventilation Exhaust RadiationHigh Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
| |
| The Allowable Value is chosen to be the same as the Fuel Pool Ventilation Exhaust RadiationHigh Function (LCO 3.3.6.2, "Secondary Containment Isolation Instrumentation")
| |
| to provide a conservative isolation of this potential release path during this abnormal condition of increased airborne radioactivity.
| |
| This Function isolates the Group 4 valves.
| |
| 2.e. Reactor Vessel Water LevelLow Low Low, Level 1 Low RPV water level indicates the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, isolation of the primary containment occurs to prevent offsite dose limits from being exceeded. The Reactor Vessel Water LevelLow Low Low, Level 1 Function is one of the many Functions assumed to be OPERABLE and capable of providing isolation signals. The Reactor Vessel Water LevelLow Low Low, Level 1 Function associated with isolation is implicitly assumed in the UFSAR analysis as these leakage paths are assumed to be isolated post LOCA.
| |
| Reactor vessel water level signals are initiated from level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water LevelLow (continued)
| |
| LaSalle 1 and 2 B 3.3.6.1-15 Revision 0
| |
| | |
| Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 2.e. Reactor Vessel Water LevelLow Low Low, Level 1 SAFETY ANALYSES, (continued)
| |
| LCO, and APPLICABILITY Low Low, Level 1 Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
| |
| The Reactor Vessel Water LevelLow Low Low, Level 1 Allowable Value is chosen to be the same as the ECCS Reactor Vessel Water LevelLow Low Low, Level 1 Allowable Value (LCO 3.3.5.1) to ensure the valves are isolated to prevent offsite doses from exceeding 10 CFR 100 limits.
| |
| This Function isolates the Group 10 valves.
| |
| 2.f. Reactor Vessel Water LevelLow, Level 3 Low RPV water level indicates the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, the valves whose penetrations communicate with the primary containment are isolated to limit the release of fission products. The isolation of the primary containment on Level 3 supports actions to ensure that offsite dose limits of 10 CFR 100 are not exceeded. The Reactor Vessel Water LevelLow, Level 3 Function associated with isolation is implicitly assumed in the UFSAR analysis as these leakage paths are assumed to be isolated post LOCA.
| |
| Reactor Vessel Water LevelLow, Level 3 signals are initiated from differential pressure transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of the Reactor Vessel Water LevelLow, Level 3 Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
| |
| The Reactor Vessel Water LevelLow, Level 3 Allowable Value was chosen to be the same as the RPS Reactor Vessel Water LevelLow, Level 3 Allowable Value (LCO 3.3.1.1) since the capability to cool the fuel may be threatened.
| |
| This Function isolates the Group 7 valves.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.6.1-16 Revision 0
| |
| | |
| Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 2.g. Manual Initiation SAFETY ANALYSES, LCO, and The Manual Initiation push button channels introduce signals APPLICABILITY into the primary containment isolation logic that are (continued) redundant to the automatic protective instrumentation and provide manual isolation capability. There is no specific UFSAR safety analysis that takes credit for this Function.
| |
| It is retained for overall redundancy and diversity of the isolation function as required by the NRC in the plant licensing basis.
| |
| There are two push buttons for the logic, one manual initiation push button per trip system. Two channels of the Manual Initiation Function are available and are required to be OPERABLE in MODES 1, 2, and 3, since these are the MODES in which the Primary Containment Isolation automatic Functions are required to be OPERABLE.
| |
| There is no Allowable Value for this Function since the channels are mechanically actuated based solely on the position of the push buttons.
| |
| This Function isolates the Group 2, 4, 7, and 10 valves.
| |
| : 3. Reactor Core Isolation Cooling System Isolation 3.a. RCIC Steam Line FlowHigh RCIC Steam Line FlowHigh Function is provided to detect a break of the RCIC steam lines and initiates closure of the steam line isolation valves. If the steam is allowed to continue flowing out of the break, the reactor will depressurize and core uncovery can occur. Therefore, the isolation is initiated on high flow to prevent or minimize core damage. The isolation action, along with the scram function of the Reactor Protection System (RPS), ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46. Specific credit for this Function is not assumed in any UFSAR accident analyses since the bounding analysis is performed for large breaks such as recirculation and MSL breaks. However, these instruments prevent the RCIC steam line break from becoming bounding.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.6.1-17 Revision 0
| |
| | |
| Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 3.a. RCIC Steam Line FlowHigh (continued)
| |
| SAFETY ANALYSES, LCO, and The RCIC Steam Line FlowHigh signals are initiated from APPLICABILITY two differential pressure switches that are connected to the system steam lines. Two channels of RCIC Steam Line Flow-High Functions are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
| |
| The Allowable Value is chosen to be low enough to ensure that the trip occurs to prevent fuel damage and maintains the MSLB event as the bounding event.
| |
| This Function isolates the Group 8 valves.
| |
| 3.b. RCIC Steam Line FlowTimer The RCIC Steam Line FlowTimer is provided to prevent false isolations on RCIC Steam Line FlowHigh during system startup transients and therefore improves system reliability. This Function is not assumed in any UFSAR transient or accident analyses since the bounding analysis is performed for large breaks such as recirculation and MSL breaks. However, these instruments prevent the RCIC steam line break from being bounding.
| |
| The RCIC Steam Line FlowTimer Function delays the RCIC Steam Line FlowHigh signals by use of time delay relays.
| |
| When an RCIC Steam Line FlowHigh signal is generated, the time delay relays delay the tripping of the associated RCIC isolation trip system for a short time. Two channels of RCIC Steam Line FlowTimer Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
| |
| The Allowable Value was chosen to be long enough to prevent false isolations due to system starts but not so long as to impact offsite dose calculations.
| |
| This Function isolates the Group 8 valves.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.6.1-18 Revision 0
| |
| | |
| Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 3.c. RCIC Steam Supply PressureLow SAFETY ANALYSES, LCO, and Low RCIC steam supply pressure indicates that the pressure APPLICABILITY of the steam in the RCIC turbine may be too low to continue (continued) operation of the RCIC turbine. This isolation is for equipment protection and is not assumed in any transient or accident analysis in the UFSAR. However, it also provides a diverse signal to indicate a possible system break. These instruments are included in the Technical Specifications (TS) because of the potential for risk due to possible failure of the instruments preventing RCIC initiations.
| |
| Therefore, they meet Criterion 4 of 10 CFR 50.36(c)(2)(ii).
| |
| The RCIC Steam Supply PressureLow signals are initiated from four pressure switches that are connected to the RCIC steam line. Four channels of RCIC Steam Supply Pressure-Low Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
| |
| The Allowable Value is selected to be high enough to prevent damage to the RCIC turbines.
| |
| This Function isolates the Group 8 valves. This Function coincident with Drywell PressureHigh also isolates the Group 9 valves.
| |
| 3.d. RCIC Turbine Exhaust Diaphragm PressureHigh High turbine exhaust diaphragm pressure indicates that the pressure may be too high to continue operation of the RCIC turbine. That is, one of two exhaust diaphragms has ruptured and pressure is reaching turbine casing pressure limits. This isolation is for equipment protection and is not assumed in any transient or accident analysis in the UFSAR. These instruments are included in the TS because of the potential for risk due to possible failure of the instruments preventing RCIC initiations. Therefore, they meet Criterion 4 of 10 CFR 50.36(c)(2)(ii).
| |
| The RCIC Turbine Exhaust Diaphragm PressureHigh signals are initiated from four pressure switches that are connected to the area between the rupture diaphragms on the RCIC turbine exhaust line. Four channels of RCIC Turbine Exhaust (continued)
| |
| LaSalle 1 and 2 B 3.3.6.1-19 Revision 0
| |
| | |
| Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 3.d. RCIC Turbine Exhaust Diaphragm PressureHigh SAFETY ANALYSES, (continued)
| |
| LCO, and APPLICABILITY Diaphragm PressureHigh Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
| |
| The Allowable Value is selected to be low enough to prevent damage to the RCIC turbine.
| |
| This Function isolates the Group 8 valves.
| |
| 3.e, 3.f, 3.g, 3.h. Area and Differential TemperatureHigh Area and Differential Temperatures are provided to detect a leak from the RCIC steam piping. The isolation occurs when a very small leak has occurred and is diverse to the high flow instrumentation. If the small leak is allowed to continue without isolation, offsite dose limits may be reached. These Functions are not assumed in any UFSAR transient or accident analysis, since bounding analyses are performed for large breaks such as recirculation or MSL breaks.
| |
| Area TemperatureHigh signals are initiated from thermocouples that are located in the area that is being monitored. Two instruments monitor each area. Four channels for Area TemperatureHigh Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
| |
| There are two for the RCIC equipment room and two for the RCIC steam line tunnel area.
| |
| There are 8 thermocouples (four for the RCIC equipment room and four for the RCIC steam line tunnel area) that provide input to the Differential TemperatureHigh Function. The output of these thermocouples is used to determine the differential temperature. Each channel consists of a differential temperature instrument that receives inputs from thermocouples that are located in the inlet and outlet of the area cooling system for a total of four (two for the RCIC equipment room and two for the RCIC steam line tunnel area) available channels.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.6.1-20 Revision 0
| |
| | |
| Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 3.e, 3.f, 3.g, 3.h. Area and Differential TemperatureHigh SAFETY ANALYSES, (continued)
| |
| LCO, and APPLICABILITY The Allowable Values are set low enough to detect a leak equivalent to 25 gpm.
| |
| This Function isolates the Group 8 valves.
| |
| 3.i. Drywell PressureHigh High drywell pressure can indicate a break in the RCPB. The RCIC isolation of the turbine exhaust is provided to prevent communication with the drywell when high drywell pressure exists. A potential leakage path exists via the turbine exhaust. The isolation is delayed until the system becomes unavailable for injection (i.e., low steam line pressure).
| |
| The isolation of the RCIC turbine exhaust by Drywell PressureHigh is indirectly assumed in the UFSAR accident analysis because the turbine exhaust leakage path is not assumed to contribute to offsite doses.
| |
| High drywell pressure signals are initiated from pressure switches that sense the pressure in the drywell. Four channels of RCIC Drywell PressureHigh Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
| |
| The Allowable Value was selected to be the same as the ECCS Drywell PressureHigh Allowable Value (LCO 3.3.5.1), since this is indicative of a LOCA inside primary containment.
| |
| This Function coincident with RCIC Steam Supply Pressure-Low isolates the Group 9 valves.
| |
| 3.j. Manual Initiation The Manual Initiation push button channel introduces a signal into the RCIC System isolation logic that is redundant to the automatic protective instrumentation and provides manual isolation capability when a system initiation signal is present. There is no specific UFSAR safety analysis that takes credit for this Function. It is (continued)
| |
| LaSalle 1 and 2 B 3.3.6.1-21 Revision 0
| |
| | |
| Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 3.j. Manual Initiation (continued)
| |
| SAFETY ANALYSES, LCO, and retained for overall redundancy and diversity of the APPLICABILITY isolation function as required by the NRC in the plant licensing basis.
| |
| There is one push button for RCIC. One channel of Manual Initiation Function is available and is required to be OPERABLE in MODES 1, 2, and 3 since these are the MODES in which the RCIC System Isolation automatic Functions are required to be OPERABLE. As noted (footnote (b) to Table 3.3.6.1-1), this Function only provides input into one of the two trip systems.
| |
| There is no Allowable Value for this Function since the channels are mechanically actuated based solely on the position of the push buttons.
| |
| This Function, coincident with a Reactor Vessel Water Level-Low Low, Level 2, isolates the outboard Group 8 valve.
| |
| : 4. Reactor Water Cleanup System Isolation 4.a. Differential FlowHigh The high differential flow signal is provided to detect a break in the RWCU System. This will detect leaks in the RWCU System when area or differential temperature would not provide detection (i.e., a cold leg break). Should the reactor coolant continue to flow out of the break, offsite dose limits may be exceeded. Therefore, isolation of the RWCU System is initiated when high differential flow is sensed to prevent exceeding offsite doses. A time delay (Function 4.b, described below) is provided to prevent spurious trips during most RWCU operational transients.
| |
| This Function is not assumed in any UFSAR transient or accident analysis, since bounding analyses are performed for large breaks such as MSLBs.
| |
| The high differential flow signals are initiated from one differential pressure transmitter monitoring inlet flow (from the reactor vessel) and two transmitters monitoring system outlet flow to the two available flow paths (normal return to feedwater and discharge flow to either the main (continued)
| |
| LaSalle 1 and 2 B 3.3.6.1-22 Revision 0
| |
| | |
| Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 4.a. Differential FlowHigh (continued)
| |
| SAFETY ANALYSES, LCO, and condenser or radwaste). The outputs of the transmitters are APPLICABILITY compared (in a summer) and the outputs are sent to two alarm trip units. If the difference between the inlet and outlet flow is too large, each alarm trip unit generates an isolation signal. Two channels of Differential FlowHigh Function are available and are required to be OPERABLE to ensure that no single instrument failure (other than the common transmitters and summers) can preclude the isolation function.
| |
| The Differential FlowHigh Allowable Value ensures that the break of the RWCU piping is detected.
| |
| This Function isolates the Group 5 valves.
| |
| 4.b. Differential FlowTimer The Differential FlowTimer is provided to avoid RWCU System isolations due to operational transients (such as pump starts and mode changes). During these transients the inlet and return flows become unbalanced for short time periods and Differential FlowHigh will be sensed without an RWCU System break being present. Credit for this Function is not assumed in the UFSAR accident or transient analysis, since bounding analyses are performed for large breaks such as MSLBs.
| |
| The Differential FlowTimer Function delays the Differential FlowHigh signals by use of time delay relays.
| |
| When a Differential FlowHigh signal is generated, the time delay relays delay the tripping of the associated RWCU isolation trip system for a short time. Two channels of Differential FlowTimer Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
| |
| The Differential FlowTimer Allowable Value is selected to ensure that the MSLB outside containment remains the limiting break for UFSAR analysis for offsite dose calculations.
| |
| This Function isolates the Group 5 valves.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.6.1-23 Revision 0
| |
| | |
| Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 4.c, 4.d, 4.e, 4.f, 4.g, 4.h. 4.i, 4.j, Area SAFETY ANALYSES, Differential TemperatureHigh LCO, and APPLICABILITY Area and Differential TemperatureHigh is provided to (continued) detect a leak from the RWCU System. The isolation occurs even when very small leaks have occurred and is diverse to the high differential flow instrumentation for the hot portions of the RWCU System. If the small leak continues without isolation, offsite dose limits may be reached.
| |
| Credit for these instruments is not taken in any transient or accident analysis in the UFSAR, since bounding analyses are performed for large breaks such as MSLBs.
| |
| Area TemperatureHigh signals are initiated from temperature elements that are located in the room that is being monitored. There are fourteen thermocouples that provide input to the Area TemperatureHigh Function (two per area). Fourteen channels are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. There are four channels for the RWCU heat exchanger area (two in each heat exchanger room), six channels for the RWCU pump and valve room (two in each of the three rooms), two channels for the holdup pipe area, and two channels for the filter/demineralizer valve room area.
| |
| There are twenty eight thermocouples that provide input to the Differential TemperatureHigh Function. The output of these thermocouples is used to determine the differential temperature. Each channel consists of a differential temperature instrument that receives inputs from thermocouples that are located in the inlet and outlet of the area cooling system for a total of fourteen available channels (two per area). Fourteen channels are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. There are four channels for the RWCU heat exchanger area, six channels for the RWCU pump and valve room, two channels for the holdup pipe area, and two for the filter/demineralizer valve room area.
| |
| The Area and Differential TemperatureHigh Allowable Values are set low enough to detect a leak equivalent to 25 gpm.
| |
| These Functions isolate the Group 5 valves.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.6.1-24 Revision 0
| |
| | |
| Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 4.k. Reactor Vessel Water LevelLow Low, Level 2 SAFETY ANALYSES, LCO, and Low RPV water level indicates the capability to cool the APPLICABILITY fuel may be threatened. Should RPV water level decrease too (continued) far, fuel damage could result. Therefore, isolation of some reactor vessel interfaces occurs to isolate the potential sources of a break. The isolation of the RWCU System on Level 2 supports actions to ensure that fuel peak cladding temperature remains below the limits of 10 CFR 50.46. The Reactor Vessel Water LevelLow Low, Level 2 Function associated with RWCU isolation is not directly assumed in any transient or accident analysis, since bounding analyses are performed for large breaks such as MSLBs.
| |
| Reactor Vessel Water LevelLow Low, Level 2 signals are initiated from differential pressure transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water LevelLow Low, Level 2 Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
| |
| The Reactor Vessel Water LevelLow Low, Level 2 Allowable Value was chosen to be the same as the ECCS Reactor Vessel Water LevelLow Low, Level 2 Allowable Value (LCO 3.3.5.1),
| |
| since the capability to cool the fuel may be threatened.
| |
| This Function isolates the Group 5 valves.
| |
| 4.l. SLC System Initiation The isolation of the RWCU System is required when the SLC System has been initiated to prevent dilution and removal of the boron solution by the RWCU System (Ref. 8). SLC System initiation signals are initiated from the two SLC pump start signals.
| |
| Two channels (one from each pump) of SLC System Initiation Function are available and are required to be OPERABLE in MODES 1 and 2, since these are the only MODES where the reactor can be critical. In addition, both channels are required to be OPERABLE in MODES 1, 2, and 3, since the SLC System is also designed to maintain suppression pool pH (continued)
| |
| LaSalle 1 and 2 B 3.3.6.1-25 Revision 48
| |
| | |
| Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 4.l. SLC System Initiation (continued)
| |
| SAFETY ANALYSES, LCO, and above 7 following a LOCA to ensure that iodine will be APPLICABILITY retained in the suppression pool water. These MODES are consistent with the Applicability for the SLC System (LCO 3.1.7, "SLC System"). As noted (footnote (b) to Table 3.3.6.1-1), this Function only provides input into one of two trip systems.
| |
| There is no Allowable Value associated with this Function since the channels are mechanically actuated based solely on the position of the SLC System initiation switches.
| |
| This Function isolates the outboard Group 5 valve.
| |
| 4.m. Manual Initiation The Manual Initiation push button channels introduce signals into the RWCU System isolation logic that are redundant to the automatic protective instrumentation and provide manual isolation capability. There is no specific UFSAR safety analysis that takes credit for this Function. It is retained for overall redundancy and diversity of the isolation function as required by the NRC in the plant licensing basis.
| |
| There are two push buttons for the logic, one manual initiation push button per trip system. Two channels of the Manual Initiation Function are available and are required to be OPERABLE in MODES 1, 2, and 3 since these are the MODES in which the RWCU System Isolation automatic Functions are required to be OPERABLE.
| |
| There is no Allowable Value for this Function, since the channels are mechanically actuated based solely on the position of the push buttons.
| |
| This Function isolates the Group 5 valves.
| |
| : 5. RHR Shutdown Cooling System Isolation 5.a. Reactor Vessel Water LevelLow, Level 3 Low RPV water level indicates the capability to cool the (continued)
| |
| LaSalle 1 and 2 B 3.3.6.1-26 Revision 48
| |
| | |
| Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 5.a. Reactor Vessel Water LevelLow, Level 3 (continued)
| |
| SAFETY ANALYSES, LCO, and fuel may be threatened. Should RPV water level decrease too APPLICABILITY far, fuel damage could result. Therefore, isolation of some reactor vessel interfaces occurs to begin isolating the potential sources of a break. The Reactor Vessel Water LevelLow, Level 3 Function associated with RHR Shutdown Cooling System isolation is not directly assumed in any transient or accident analysis, since bounding analyses are performed for large breaks such as MSLBs. The RHR Shutdown Cooling System isolation on Level 3 supports actions to ensure that the RPV water level does not drop below the top of the active fuel during a vessel draindown event caused by a leak (e.g., pipe break or inadvertent valve opening) in the RHR Shutdown Cooling System.
| |
| Reactor Vessel Water LevelLow, Level 3 signals are initiated from differential pressure transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels (two channels per trip system) of the Reactor Vessel Water LevelLow, Level 3 Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
| |
| The Reactor Vessel Water LevelLow, Level 3 Function is only required to be OPERABLE in MODE 3 to prevent this potential flow path from lowering reactor vessel level to the top of the fuel. In MODES 1 and 2, the Reactor Vessel PressureHigh Function and administrative controls ensure that this flow path remains isolated to prevent unexpected loss of inventory via this flow path.
| |
| The Reactor Vessel Water LevelLow, Level 3 Allowable Value was chosen to be the same as the RPS Reactor Vessel Water LevelLow, Level 3 Allowable Value (LCO 3.3.1.1) since the capability to cool the fuel may be threatened.
| |
| This Function isolates the Group 6 valves.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.6.1-27 Revision 76
| |
| | |
| Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 5.b. Reactor Vessel PressureHigh SAFETY ANALYSES, LCO, and The Shutdown Cooling System Reactor Vessel PressureHigh APPLICABILITY Function is provided to isolate the shutdown cooling portion (continued) of the RHR System. This interlock is provided only for equipment protection to prevent an intersystem LOCA scenario and credit for the interlock is not assumed in the accident or transient analysis in the UFSAR.
| |
| The Reactor Vessel PressureHigh signals are initiated from two pressure switches. Two channels of Reactor Vessel PressureHigh Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
| |
| The Allowable Value (corrected for cold water head and reactor vessel flooded) was chosen to be low enough to protect the system equipment from overpressurization.
| |
| This Function isolates the Group 6 valves.
| |
| 5.c. Manual Initiation The Manual Initiation push button channels introduce signals into the RHR Shutdown Cooling System isolation logic that are redundant to the automatic protective instrumentation and provide manual isolation capability. There is no specific UFSAR safety analysis that takes credit for this Function. It is retained for overall redundancy and diversity of the isolation function as required by the NRC in the plant licensing basis.
| |
| There is one push button for the logic per trip system. Two channels of the Manual Initiation Function are available and are required to be OPERABLE in MODES 1, 2, and 3 since these are the MODES in which the RHR Shutdown Cooling System Isolation automatic Functions are required to be OPERABLE.
| |
| While certain automatic Functions are required in MODES 4 and 5, the Manual Initiation Function is not required in MODES 4 and 5, since there are other means (i.e., means other than the Manual Initiation push buttons) to manually isolate the RHR Shutdown Cooling System from the control room.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.6.1-28 Revision 0
| |
| | |
| Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 5.c. Manual Initiation (continued)
| |
| SAFETY ANALYSES, LCO, and There is no Allowable Value for this Function, since the APPLICABILITY channels are mechanically actuated based solely on the position of the push buttons.
| |
| This Function isolates the Group 6 valves.
| |
| ACTIONS Note 1 has been provided to modify the ACTIONS related to primary containment isolation instrumentation channels.
| |
| Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits will not result in separate entry into the Condition.
| |
| Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable primary containment isolation instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable primary containment isolation instrumentation channel.
| |
| Note 2 indicates that when automatic isolation capability is lost for Function 1.e, Main Steam Line Tunnel Differential TemperatureHigh (i.e., when both trip systems are inoperable for Function 1.e) due to required Reactor Building Ventilation System corrective maintenance, filter changes, damper cycling, or for performance of required Surveillances, entry into the associated Conditions and Required Actions may be delayed for up to 4 hours.
| |
| Similarly, Note 3 indicates that when automatic isolation capability is lost for Function 1.e due to a loss of reactor building ventilation or for performance of SR 3.6.4.1.3 or SR 3.6.4.1.4, entry into the associated Conditions and Required Actions may be delayed for up to 12 hours. Upon completion of the activities or expiration of the time allowance, the channels must be returned to OPERABLE status or the applicable Conditions entered and Required Actions taken. These Notes are necessary so that testing and (continued)
| |
| LaSalle 1 and 2 B 3.3.6.1-29 Revision 0
| |
| | |
| Primary Containment Isolation Instrumentation B 3.3.6.1 BASES ACTIONS required Surveillances specified in LCO 3.6.4.1, "Secondary (continued) Containment," LCO 3.6.4.2, "Secondary Containment Isolation Valves (SCIV)," and LCO 3.6.4.3, "Standby Gas Treatment (SGT) System," can be performed without inducing an isolation of the MSIVs. The 4 hour and 12 hour allowances provide sufficient time to safely perform the testing. The 12 hour allowance also provides sufficient time to identify and correct minor reactor building ventilation system problems. Since the design of the Unit 1 and Unit 2 reactor buildings is such that they share a common area of the refuel floor (i.e., the reactor buildings are not separated on the refuel floor), operation of either unit's ventilation system will affect the other unit's building differential pressure. Performance of testing to verify secondary containment integrity requirements and minor correctable problems could require a dual unit outage (without the Notes).
| |
| A.1 Because of the diversity of sensors available to provide isolation signals and the redundancy of the isolation design, an allowable out of service time of 12 hours or 24 hours, depending on the Function (12 hours for those Functions that have channel components common to RPS instrumentation and 24 hours for those Functions that do not have channel components common to RPS instrumentation), has been shown to be acceptable (Refs. 9 and 10) to permit restoration of any inoperable channel to OPERABLE status.
| |
| This out of service time is only acceptable provided the associated Function is still maintaining isolation capability (refer to Required Action B.1 Bases).
| |
| Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.
| |
| If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action A.1. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue with no further restrictions.
| |
| Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an isolation), Condition C must be entered and its Required Action taken.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.6.1-30 Revision 89
| |
| | |
| Primary Containment Isolation Instrumentation B 3.3.6.1 BASES ACTIONS B.1 (continued)
| |
| Required Action B.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in redundant automatic isolation capability being lost for the associated penetration flow path(s). The MSIVs portion of the MSL isolation Functions are considered to be maintaining isolation capability when sufficient channels are OPERABLE or in trip such that both trip systems will generate a trip signal from the given Function on a valid signal. The MSL drain valves portion of the MSL isolation Functions and the other isolation Functions are considered to be maintaining isolation capability when sufficient channels are OPERABLE or in trip such that one trip system will generate a trip signal from the given Function on a valid signal. This ensures that one of the two PCIVs in the associated penetration flow path can receive an isolation signal from the given Function. For the MSIVs portion of Functions 1.a, 1.b, 1.d, and 1.e, this would require both trip systems to have one channel OPERABLE or in trip. For the MSL drain valves portion of Functions 1.a, 1.b, 1.d, and 1.e, this would require one trip system to have two channels, each OPERABLE or in trip. For the MSIVs portion of Function 1.c, this would require both trip systems to have one channel, associated with each MSL, OPERABLE or in trip. For the MSL drain valves portion of Function 1.c, this would require one trip system to have two channels, associated with each MSL, each OPERABLE or in trip. For Functions 2.a, 2.b, 2.c, 2.d, 2.e, 2.f, 3.c (for Group 8 valves) 3.d, 4.k, and 5.a, this would require one trip system to have two channels, each OPERABLE or in trip. For Functions 3.a, 3.b, 3.c (for Group 9 valves), 3.e, 3.f, 3.g, 3.h, 3.i, 4.a, 4.b, 4.g, 4.h, 4.i, 4.j, 4.l, and 5.b, this would require one trip system to have one channel OPERABLE or in trip. For Functions 4.c, 4.d, 4.e, and 4.f each Function consists of channels that monitor several different areas. Therefore, this would require one channel per area to be OPERABLE or in trip (the channels are not required to be in the same trip system).
| |
| The Condition does not include the Manual Initiation Functions (Functions 1.f, 2.g, 3.j, 4.m, and 5.c), since they are not assumed in any accident or transient analysis.
| |
| Thus, a total loss of manual initiation capability for 24 hours (as allowed by Required Action A.1) is allowed.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.6.1-31 Revision 0
| |
| | |
| Primary Containment Isolation Instrumentation B 3.3.6.1 BASES ACTIONS B.1 (continued)
| |
| The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. The Completion Time is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.
| |
| C.1 Required Action C.1 directs entry into the appropriate Condition referenced in Table 3.3.6.1-1. The applicable Condition specified in Table 3.3.6.1-1 is Function and MODE or other specified condition dependent and may change as the Required Action of a previous Condition is completed. Each time an inoperable channel has not met any Required Action of Condition A or B and the associated Completion Time has expired, Condition C will be entered for that channel and provides for transfer to the appropriate subsequent Condition.
| |
| D.1, D.2.1, and D.2.2 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the associated MSLs may be isolated (Required Action D.1), and if allowed (i.e., plant safety analysis allows operation with an MSL isolated), plant operation with the MSL isolated may continue. Isolating the affected MSL accomplishes the safety function of the inoperable channel. This Required Action will generally only be used if a Function 1.c channel is inoperable and untripped. The associated MSL(s) to be isolated are those whose Main Steam Line FlowHigh Function channel(s) are inoperable. Alternatively, the plant must be placed in a MODE or other specified condition in which the LCO does not apply. This is done by placing the plant in at least MODE 3 within 12 hours and in MODE 4 within 36 hours (Required Actions D.2.1 and D.2.2). The Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.6.1-32 Revision 0
| |
| | |
| Primary Containment Isolation Instrumentation B 3.3.6.1 BASES ACTIONS E.1 (continued)
| |
| If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the plant must be placed in a MODE or other specified condition in which the LCO does not apply. This is done by placing the plant in at least MODE 2 within 6 hours.
| |
| The allowed Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 2 from full power conditions in an orderly manner and without challenging plant systems.
| |
| F.1 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, plant operation may continue if the affected penetration flow path(s) is isolated. Isolating the affected penetration flow path(s) accomplishes the safety function of the inoperable channels.
| |
| For some of the Area and Differential TemperatureHigh Functions, the affected penetration flow path(s) may be considered isolated by isolating only that portion of the system in the associated room monitored by the inoperable channel. That is, if the RWCU pump room A Area Temperature-High channel is inoperable, the A pump room area can be isolated while allowing continued RWCU operation utilizing the B RWCU pump.
| |
| Alternatively, if it is not desired to isolate the affected penetration flow path(s) (e.g., as in the case where isolating the penetration flow path(s) could result in a reactor scram), Condition H must be entered and its Required Actions taken.
| |
| The Completion Time is acceptable because it minimizes risk while allowing sufficient time for plant operations personnel to isolate the affected penetration flow path(s).
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.6.1-33 Revision 0
| |
| | |
| Primary Containment Isolation Instrumentation B 3.3.6.1 BASES ACTIONS G.1 (continued)
| |
| If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, plant operations may continue if the affected penetration flow path(s) is isolated. Isolating the affected penetration flow path(s) accomplishes the safety function of the inoperable channels.
| |
| The 24 hour Completion Time is acceptable due to the fact that these Functions (Manual Initiation) are not assumed in any accident or transient analysis in the UFSAR.
| |
| Alternately, if it is not desired to isolate the affected penetration flow path(s) (e.g., as in the case where isolating the penetration flow path(s) could result in a reactor scram), Condition H must be entered and its Required Actions taken.
| |
| H.1 and H.2 If the channel is not restored to OPERABLE status or placed in trip, or any Required Action of Condition F or G is not met and the associated Completion Time has expired, the plant must be placed in a MODE or other specified condition in which the LCO does not apply. This is done by placing the plant in at least MODE 3 within 12 hours and in MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
| |
| I.1 and I.2 If the channel is not restored to OPERABLE status within the allowed Completion Time, the associated SLC subsystem(s) is declared inoperable or the RWCU System is isolated. Since this Function is required to ensure that the SLC System performs its intended function, sufficient remedial measures are provided by declaring the associated SLC subsystem inoperable or isolating the RWCU System.
| |
| The Completion Time of 1 hour is acceptable because it minimizes risk while allowing sufficient time for personnel to isolate the RWCU System.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.6.1-34 Revision 0
| |
| | |
| Primary Containment Isolation Instrumentation B 3.3.6.1 BASES ACTIONS J.1 (continued)
| |
| If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the associated penetration flow path should be closed. However, if the shutdown cooling function is needed to provide core cooling, these Required Actions allow the penetration flow path to remain unisolated provided action is immediately initiated to restore the channel to OPERABLE status. ACTIONS must continue until the channel is restored to OPERABLE status.
| |
| SURVEILLANCE As noted at the beginning of the SRs, the SRs for each REQUIREMENTS Primary Containment Isolation Instrumentation Function are found in the SRs column of Table 3.3.6.1-1.
| |
| The Surveillances are also modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours provided the associated Function maintains isolation capability. Upon completion of the Surveillance, or expiration of the 6 hour allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analyses (Refs. 9 and 10) assumption of the average time required to perform channel surveillance. That analysis demonstrated that the 6 hour testing allowance does not significantly reduce the probability that the PCIVs will isolate the penetration flow path(s) when necessary.
| |
| SR 3.3.6.1.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.6.1-35 Revision 9051
| |
| | |
| Primary Containment Isolation Instrumentation B 3.3.6.1 BASES SURVEILLANCE SR 3.3.6.1.1 (continued)
| |
| REQUIREMENTS Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
| |
| Agreement criteria are determined by the plant staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.
| |
| SR 3.3.6.1.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the channel will perform the intended function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.6.1-36 Revision 51
| |
| | |
| Primary Containment Isolation Instrumentation B 3.3.6.1 BASES SURVEILLANCE SR 3.3.6.1.3 and SR 3.3.6.1.4 REQUIREMENTS (continued) CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations, consistent with the plant specific setpoint methodology.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.6.1.5 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required isolation logic for a specific channel. The system functional testing performed on PCIVs in LCO 3.6.1.3 overlaps this Surveillance to provide complete testing of the assumed safety function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.6.1.6 This SR ensures that the individual channel response times are less than or equal to the maximum values assumed in the accident analysis. Testing is performed only on channels where the assumed response time does not correspond to the diesel generator (DG) start time. For channels assumed to respond within the DG start time, sufficient margin exists in the 13 second start time when compared to the typical channel response time (milliseconds) so as to assure adequate response without a specific measurement test. The instrument response times must be added to the MSIV closure times to obtain the ISOLATION SYSTEM RESPONSE TIME.
| |
| However, failure to meet the ISOLATION SYSTEM RESPONSE TIME (continued)
| |
| LaSalle 1 and 2 B 3.3.6.1-37 Revision 51
| |
| | |
| Primary Containment Isolation Instrumentation B 3.3.6.1 BASES SURVEILLANCE SR 3.3.6.1.6 (continued)
| |
| REQUIREMENTS due to a MSIV closure time not within limits does not require the associated instrumentation to be declared inoperable; only the MSIV is required to be declared inoperable.
| |
| ISOLATION SYSTEM RESPONSE TIME acceptance criteria are included in Reference 11.
| |
| ISOLATION SYSTEM RESPONSE TIME may be verified by actual response time measurements in any series of sequential, overlapping, or total channel measurements. However, the sensor for Function 1.c is allowed to be excluded from specific ISOLATION SYSTEM RESPONSE TIME measurement if the conditions of Reference 12 are satisfied. If these conditions are satisfied, sensor response time may be allocated based on either assumed design sensor response time or the manufacturer's stated design response time.
| |
| When the requirements of Reference 12 are not satisfied, sensor response time must be measured. Also, regardless of whether or not the sensor response time is measured, the response time of the remaining portion of the channel, including the trip unit and relay logic, is required to be measured. The sensor and relay/logic components for Functions 1.a and 1.b are assumed to operate at the design response time and therefore, are excluded from specific RPS RESPONSE TIME measurement. This allowance is supported by References 12 and 13, which determined that significant degradation of the channel response time can be detected during performance of other Technical Specification surveillance requirements.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Table 6.2-21.
| |
| : 2. UFSAR, Section 6.2.1.1.
| |
| : 3. UFSAR, Chapter 15.
| |
| : 4. UFSAR, Section 15.1.3.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.6.1-38 Revision 51
| |
| | |
| Primary Containment Isolation Instrumentation B 3.3.6.1 BASES REFERENCES 5. UFSAR, Section 15.6.4.
| |
| (continued)
| |
| : 6. UFSAR, Section 15.2.5
| |
| : 7. UFSAR, Section 15.4.9.
| |
| : 8. UFSAR, Section 9.3.5.
| |
| : 9. NEDC-31677-P-A, "Technical Specification Improvement Analysis for BWR Isolation Actuation Instrumentation,"
| |
| July 1990.
| |
| : 10. NEDC-30851-P-A, Supplement 2, "Technical Specifications Improvement Analysis for BWR Isolation Instrumentation Common to RPS and ECCS Instrumentation," March 1989.
| |
| : 11. Technical Requirements Manual.
| |
| : 12. NEDO-32291-A, "System Analyses for the Elimination of Selected Response Time Testing Requirements," October 1995.
| |
| : 13. NEDO-32291-A Supplement 1, System Analysis for the Elimination of Selected Response Time Testing Requirements, October 1999.
| |
| LaSalle 1 and 2 B 3.3.6.1-39 Revision 15
| |
| | |
| Secondary Containment Isolation Instrumentation B 3.3.6.2 B 3.3 INSTRUMENTATION B 3.3.6.2 Secondary Containment Isolation Instrumentation BASES BACKGROUND The secondary containment isolation instrumentation automatically initiates closure of appropriate secondary containment isolation valves (SCIVs) and starts the Standby Gas Treatment (SGT) System. The function of these systems, in combination with other accident mitigation systems, is to limit fission product release during and following postulated Design Basis Accidents (DBAs) (Refs. 1 and 2),
| |
| such that offsite radiation exposures are maintained within the requirements of 10 CFR 100 that are part of the NRC staff approved licensing basis. Secondary containment isolation and establishment of vacuum with the SGT System within the assumed time limits ensures that fission products that are released during certain operations that take place inside primary containment or during certain operations when primary containment is not required to be OPERABLE or that take place outside primary containment, are maintained within applicable limits.
| |
| The isolation instrumentation includes the sensors, relays, and switches that are necessary to cause initiation of secondary containment isolation. Most channels include electronic equipment (e.g., trip units) that compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the channel output relay actuates, which then outputs a secondary containment isolation signal to the isolation logic. Functional diversity is provided by monitoring a wide range of independent parameters. The input parameters to the isolation logic are (a) reactor vessel water level, (b) drywell pressure, (c) reactor building ventilation exhaust plenum radiation, and (d) fuel pool ventilation exhaust radiation. Redundant sensor input signals from each parameter are provided for initiation of isolation parameters. In addition, manual initiation of the logic is provided.
| |
| For each secondary containment isolation instrumentation Function, the logic receives input from four channels. The output from these channels are arranged into two two-out-of-two trip systems. In addition to the isolation function, the SGT subsystems are initiated. There are two SGT (continued)
| |
| LaSalle 1 and 2 B 3.3.6.2-1 Revision 0
| |
| | |
| Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES BACKGROUND subsystems with both subsystems being initiated by each (continued) trip system. Automatically isolated secondary containment penetrations are isolated by two isolation valves. Each trip system initiates isolation of one of two SCIVs so that operation of either trip system isolates the associated penetrations.
| |
| APPLICABLE The isolation signals generated by the secondary containment SAFETY ANALYSES, isolation instrumentation are implicitly assumed in the LCO, and safety analyses of References 1 and 2 to initiate closure of APPLICABILITY the SCIVs and start the SGT System to limit offsite doses.
| |
| Refer to LCO 3.6.4.2, "Secondary Containment Isolation Valves (SCIVs)," and LCO 3.6.4.3, "Standby Gas Treatment (SGT) System," Applicable Safety Analyses Bases for more detail of the safety analyses.
| |
| The secondary containment isolation instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). Certain instrumentation Functions are retained for other reasons and are described below in the individual Functions discussion.
| |
| The OPERABILITY of the secondary containment isolation instrumentation is dependent upon the OPERABILITY of the individual instrumentation channel Functions. Each Function must have the required number of OPERABLE channels with their setpoints set within the specified Allowable Values, as shown in Table 3.3.6.2-1. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.
| |
| Allowable Values are specified for each Function specified in the Table. Nominal trip setpoints are specified in setpoint calculations. The nominal setpoints are selected to ensure that the setpoints do not exceed the Allowable Values between CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value.
| |
| Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor (continued)
| |
| LaSalle 1 and 2 B 3.3.6.2-2 Revision 0
| |
| | |
| Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES APPLICABLE vessel water level), and when the measured output value of SAFETY ANALYSES, the process parameter exceeds the setpoint, the associated LCO, and device (e.g., trip unit) changes state. The analytic limits APPLICABILITY are derived from the limiting values of the process (continued) parameters obtained from the safety analysis. The trip setpoints are determined from the analytic limits, corrected for defined process, calibration, and instrument errors.
| |
| The Allowable Values are then determined, based on the trip setpoint values, by accounting for the calibration based errors. These calibration based errors are limited to reference accuracy, instrument drift, errors associated with measurement and test equipment, and calibration tolerance of loop components. The trip setpoints and Allowable Values determined in this manner provide adequate protection because instrument uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for and appropriately applied for the instrumentation.
| |
| In general, the individual Functions are required to be OPERABLE in the MODES or other specified conditions when SCIVs and the SGT System are required.
| |
| The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.
| |
| : 1. Reactor Vessel Water LevelLow Low, Level 2 Low reactor pressure vessel (RPV) water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result.
| |
| An isolation of the secondary containment and actuation of the SGT System are initiated in order to minimize the potential of an offsite dose release. The Reactor Vessel Water LevelLow Low, Level 2 Function is one of the Functions assumed to be OPERABLE and capable of providing isolation and initiation signals. The isolation and initiation of systems on Reactor Vessel Water LevelLow Low, Level 2 support actions to ensure that any offsite releases are within the limits calculated in the safety analysis (Ref. 1).
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.6.2-3 Revision 0
| |
| | |
| Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES APPLICABLE 1. Reactor Vessel Water LevelLow Low, Level 2 SAFETY ANALYSES, (continued)
| |
| LCO, and APPLICABILITY Reactor Vessel Water LevelLow Low, Level 2 signals are initiated from differential pressure transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water LevelLow Low, Level 2 Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
| |
| The Reactor Vessel Water LevelLow Low, Level 2 Allowable Value was chosen to be the same as the High Pressure Core Spray (HPCS)/Reactor Core Isolation Cooling (RCIC) Reactor Vessel Water LevelLow Low, Level 2 Allowable Value (LCO 3.3.5.1, "Emergency Core Cooling System (ECCS)
| |
| Instrumentation," and LCO 3.3.5.3, "Reactor Core Isolation Cooling (RCIC) System Instrumentation"), since this could indicate the capability to cool the fuel is being threatened.
| |
| The Reactor Vessel Water LevelLow Low, Level 2 Function is required to be OPERABLE in MODES 1, 2, and 3 where considerable energy exists in the Reactor Coolant System (RCS); thus, there is a probability of pipe breaks resulting in significant releases of radioactive steam and gas. In MODES 4 and 5, the probability and consequences of these events are low due to the RCS pressure and temperature limitations of these MODES; thus, this Function is not required.
| |
| : 2. Drywell PressureHigh High drywell pressure can indicate a break in the reactor coolant pressure boundary (RCPB). An isolation of the secondary containment and actuation of the SGT System are initiated in order to minimize the potential of an offsite dose release. The isolation and initiation of systems on Drywell PressureHigh supports actions to ensure that any offsite releases are within the limits calculated in the (continued)
| |
| LaSalle 1 and 2 B 3.3.6.2-4 Revision 76
| |
| | |
| Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES APPLICABLE 2. Drywell PressureHigh (continued)
| |
| SAFETY ANALYSES, LCO, and safety analysis. However, the Drywell PressureHigh APPLICABILITY Function associated with isolation is not assumed in any UFSAR accident or transient analysis. It is retained for the overall redundancy and diversity of the secondary containment isolation instrumentation as required by the NRC approved licensing basis.
| |
| High drywell pressure signals are initiated from pressure switches that sense the pressure in the drywell. Four channels of Drywell PressureHigh Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
| |
| The Allowable Value was chosen to be the same as the RPS Drywell PressureHigh Function Allowable Value (LCO 3.3.1.1) since this is indicative of a loss of coolant accident.
| |
| The Drywell PressureHigh Function is required to be OPERABLE in MODES 1, 2, and 3 where considerable energy exists in the RCS; thus, there is a probability of pipe breaks resulting in significant releases of radioactive steam and gas. This Function is not required in MODES 4 and 5 because the probability and consequences of these events are low due to the RCS pressure and temperature limitations of these MODES.
| |
| 3, 4. Reactor Building Ventilation Exhaust Plenum and Fuel Pool Ventilation Exhaust RadiationHigh High secondary containment exhaust radiation is an indication of possible gross failure of the fuel cladding.
| |
| The release may have originated from the primary containment due to a break in the RCPB or the refueling floor due to a fuel handling accident. When Exhaust RadiationHigh is detected, secondary containment isolation and actuation of the SGT System are initiated to limit the release of fission products as assumed in the UFSAR safety analyses (Refs. 1 and 2).
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.6.2-5 Revision 0
| |
| | |
| Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES APPLICABLE 3, 4. Reactor Building Ventilation Exhaust Plenum and Fuel SAFETY ANALYSES, Pool Ventilation Exhaust RadiationHigh (continued)
| |
| LCO, and APPLICABILITY Reactor Building Ventilation Exhaust Plenum RadiationHigh signals are initiated from radiation detectors that are located in the reactor building return air riser above the upper area of the steam tunnel prior to the reactor building ventilation isolation dampers. Fuel Pool Ventilation Exhaust RadiationHigh signals are initiated from radiation detectors that are located in the reactor building exhaust ducting coming from the refuel floor. The signal from each detector is input to an individual monitor whose trip outputs are assigned to an isolation channel. Four channels of Reactor Building Ventilation Exhaust Plenum Radiation-High Function and four channels of Fuel Pool Ventilation Exhaust RadiationHigh Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
| |
| The Allowable Values are chosen to promptly detect gross failure of the fuel cladding.
| |
| The Reactor Building Ventilation Exhaust Plenum and Fuel Pool Ventilation Exhaust RadiationHigh Functions are required to be OPERABLE in MODES 1, 2, and 3 where considerable energy exists; thus, there is a probability of pipe breaks resulting in significant releases of radioactive steam and gas. In MODES 4 and 5, the probability and consequences of these events are low due to the RCS pressure and temperature limitations of these MODES; thus, these Functions are not required. In addition, the Functions are required to be OPERABLE during CORE ALTERATIONS and movement of irradiated fuel assemblies in the secondary containment because the capability of detecting radiation releases due to fuel failures (due to dropped fuel assemblies) must be provided to ensure that offsite dose limits are not exceeded.
| |
| : 5. Manual Initiation The Manual Initiation push button channels introduce signals into the secondary containment isolation logic that are redundant to the automatic protective instrumentation channels, and provide manual isolation capability. There is (continued)
| |
| LaSalle 1 and 2 B 3.3.6.2-6 Revision 76
| |
| | |
| Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES APPLICABLE 5. Manual Initiation (continued)
| |
| SAFETY ANALYSES, LCO, and no specific UFSAR safety analysis that takes credit for this APPLICABILITY Function. It is retained for the overall redundancy and diversity of the secondary containment isolation instrumentation as required by the NRC approved licensing basis.
| |
| There is one manual initiation push button for the logic per trip system. Two channels of the Manual Initiation Function are available and are required to be OPERABLE in MODES 1, 2, and 3 and during CORE ALTERATIONS and movement of irradiated fuel assemblies in the secondary containment, since these are the MODES and other specified conditions in which the Secondary Containment Isolation automatic Functions are required to be OPERABLE. There is no Allowable Value for this Function since the channels are mechanically actuated based solely on the position of the push buttons.
| |
| ACTIONS A Note has been provided to modify the ACTIONS related to secondary containment isolation instrumentation channels.
| |
| Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits will not result in separate entry into the Condition.
| |
| Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable secondary containment isolation instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable secondary containment isolation instrumentation channel.
| |
| A.1 Because of the diversity of sensors available to provide isolation signals and the redundancy of the isolation design, an allowable out of service time of 12 hours or 24 hours, depending on the Function (12 hours for those (continued)
| |
| LaSalle 1 and 2 B 3.3.6.2-7 Revision 76
| |
| | |
| Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES ACTIONS A.1 (continued)
| |
| Functions that have channel components common to RPS instrumentation and 24 hours for those Functions that do not have channel components common to RPS instrumentation), has been shown to be acceptable (Refs. 3 and 4) to permit restoration of any inoperable channel to OPERABLE status.
| |
| This out of service time is only acceptable provided the associated Function is still maintaining isolation capability (refer to Required Action B.1 Bases). If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action A.1.
| |
| Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue. Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an isolation),
| |
| Condition C must be entered and its Required Actions taken.
| |
| B.1 Required Action B.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in a complete loss of automatic isolation capability for the associated penetration flow path(s) or a complete loss of automatic initiation capability for the SGT System. A Function is considered to be maintaining isolation capability when sufficient channels are OPERABLE or in trip, such that one trip system will generate a trip signal from the given Function on a valid signal. This ensures that one of the two SCIVs in the associated penetration flow path and the SGT subsystems can be initiated on an isolation signal from the given Function. For the Functions with two two-out-of-two logic trip systems (Functions 1, 2, 3, and 4), this would require one trip system to have two channels, each OPERABLE or in trip. The Condition does not include the Manual Initiation Function (Function 5), since it is not assumed in any accident or transient analysis.
| |
| Thus, a total loss of manual initiation capability for 24 hours (as allowed by Required Action A.1) is allowed.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.6.2-8 Revision 0
| |
| | |
| Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES ACTIONS B.1 (continued)
| |
| The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. The 1 hour Completion Time is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.
| |
| C.1.1, C.1.2, C.2.1, and C.2.2 If any Required Action and associated Completion Time are not met, the ability to isolate the secondary containment and start the SGT System cannot be ensured. Therefore, further actions must be performed to ensure the ability to maintain the secondary containment function. Isolating the associated penetration flow path(s) and starting the associated SGT subsystem(s) (Required Actions C.1.1 and C.2.1) performs the intended function of the instrumentation and allows operations to continue. The method used to place the SGT subsystem(s) in operation must provide for automatically reinitiating the subsystem(s) upon restoration of power following a loss of power to the SGT subsystem(s).
| |
| Alternatively, declaring the associated SCIV(s) or SGT subsystem(s) inoperable (Required Actions C.1.2 and C.2.2) is also acceptable since the Required Actions of the respective LCOs (LCO 3.6.4.2 and LCO 3.6.4.3) provide appropriate actions for the inoperable components.
| |
| Although each Secondary Containment Isolation Instrumentation trip system is capable of initiating both SGT subsystems, for the purpose of Required Actions C.2.1 and C.2.2, only one SGT subsystem is associated with each trip system. The unit SGT subsystem is associated with the trip system whose SGT initiation logic is powered by the unit Division 2 DC electrical power subsystem. The opposite unit SGT subsystem is associated with the trip system whose SGT initiation logic is powered by the opposite unit Division 2 DC electrical power subsystem. Associating the SGT subsystems in this manner ensures that appropriate actions are taken to address a loss of the ability to accommodate a single failure or a loss of the required radioactivity release control function.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.6.2-9 Revision 6
| |
| | |
| Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES ACTIONS C.1.1, C.1.2, C.2.1, and C.2.2 (continued)
| |
| One hour is sufficient for plant operations personnel to establish required plant conditions or to declare the associated components inoperable without challenging plant systems.
| |
| SURVEILLANCE As noted at the beginning of the SRs, the SRs for each REQUIREMENTS Secondary Containment Isolation instrumentation Function are located in the SRs column of Table 3.3.6.2-1.
| |
| The Surveillances are also modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours, provided the associated Function maintains isolation capability. Upon completion of the Surveillance, or expiration of the 6 hour allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Action(s) taken.
| |
| This Note is based on the reliability analysis (Refs. 3 and 4) assumption of the average time required to perform channel surveillance. That analysis demonstrated that the 6 hour testing allowance does not significantly reduce the probability that the SCIVs will isolate the associated penetration flow paths and the SGT System will initiate when necessary.
| |
| SR 3.3.6.2.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the indicated parameter for one instrument channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.6.2-10 Revision 51
| |
| | |
| Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES SURVEILLANCE SR 3.3.6.2.1 (continued)
| |
| REQUIREMENTS Agreement criteria are determined by the plant staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.
| |
| SR 3.3.6.2.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the channel will perform the intended function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.6.2.3 CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.6.2-11 Revision 51
| |
| | |
| Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES SURVEILLANCE SR 3.3.6.2.3 (continued)
| |
| REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.6.2.4 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required isolation logic for a specific channel. The system functional testing, performed on SCIVs and the SGT System in LCO 3.6.4.2 and LCO 3.6.4.3, respectively, overlaps this Surveillance to provide complete testing of the assumed safety function.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 15.6.5.
| |
| : 2. UFSAR, Section 15.7.4.
| |
| : 3. NEDC-31677-P-A, "Technical Specification Improvement Analysis for BWR Isolation Actuation Instrumentation,"
| |
| July 1990.
| |
| : 4. NEDC-30851-P-A Supplement 2, "Technical Specifications Improvement Analysis for BWR Isolation Instrumentations Common to RPS and ECCS Instrumentation," March 1989.
| |
| LaSalle 1 and 2 B 3.3.6.2-12 Revision 51
| |
| | |
| CRAF System Instrumentation B 3.3.7.1 B 3.3 INSTRUMENTATION B 3.3.7.1 Control Room Area Filtration (CRAF) System Instrumentation BASES BACKGROUND The CRAF System is designed to provide a radiologically controlled environment to ensure the habitability of the control room for the safety of control room operators under all plant conditions. Two independent CRAF subsystems are each capable of fulfilling the stated safety function. The instrumentation and controls for the CRAF System automatically initiate action to isolate and pressurize the control room area to minimize the consequences of radioactive material in the control room area environment.
| |
| In the event of a Control Room Air Intake RadiationHigh signal, the CRAF System is automatically placed in the pressurization mode. In this mode the normal outside air supply to the system is closed and is diverted to the emergency makeup filter train where it passes through a charcoal filter and is delivered to the suction of the control room return air fan and the suction of the auxiliary electric equipment room supply fan. Recirculated control room air is combined with the emergency makeup filter train air and delivered to the control room area via the supply fan. The addition of outside air through the emergency filter train will keep the control room area slightly pressurized with respect to surrounding areas. A description of the CRAF System is provided in the Bases for LCO 3.7.4, "Control Room Area Filtration (CRAF) System."
| |
| The CRAF System (Ref. 1) instrumentation has 4 trip systems, two for each of the air intakes: two trip systems initiate one CRAF subsystem, while the other trip systems initiate the other CRAF subsystem. For each CRAF subsystem, the associated two trip systems are arranged in a one-out-of-two logic (i.e., either trip system can actuate the CRAF subsystem). Each trip system receives input from two Control Room Air Intake RadiationHigh channels. The Control Room Air Intake RadiationHigh channels are arranged in a two-out-of-two logic for each trip system.
| |
| The channels include electronic equipment (e.g., trip units)
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.7.1-1 Revision 0
| |
| | |
| CRAF System Instrumentation B 3.3.7.1 BASES BACKGROUND that compares measured input signals with pre-established (continued) setpoints. When the setpoint is exceeded, the channel output relay actuates, which then outputs a CRAF System initiation signal to the initiation logic.
| |
| APPLICABLE The ability of the CRAF System to maintain the habitability SAFETY ANALYSES of the control room area is explicitly assumed for certain accidents as discussed in the UFSAR safety analyses (Refs. 2 and 3). CRAF System operation ensures that the radiation exposure of control room personnel, through the duration of any one of the postulated accidents, does not exceed the limits set by 10 CFR 50.67.
| |
| CRAF System instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO High radiation at the intake ducts of the control room outside air intakes is an indication of possible gross failure of the fuel cladding. The release may have originated from the primary containment due to a break in the RCPB or the refueling floor due to a fuel handling accident. When control room air intake high radiation is detected, the associated CRAF subsystem is automatically initiated in the pressurization mode since this radiation release could result in radiation exposure to control room personnel.
| |
| The Control Room Air Intake RadiationHigh Function consists of eight independent monitors, with four monitors associated with one CRAF subsystem and the other four monitors associated with the other CRAF subsystem. Each of the four monitors associated with a CRAF subsystem are arranged in two trip systems, with each trip system containing two radiation monitors. Eight channels of the Control Room Air Intake RadiationHigh Function are available and required to be OPERABLE to ensure no single instrument failure can preclude CRAF System initiation. The Allowable Value was selected to ensure protection of the control room personnel.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.7.1-2 Revision 48
| |
| | |
| CRAF System Instrumentation B 3.3.7.1 BASES LCO Each channel must have its setpoint set within the specified (continued) Allowable Value of SR 3.3.7.1.3. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions. Nominal trip setpoints are specified in the setpoint calculations. These nominal setpoints are selected to ensure that the setpoints do not exceed the Allowable Value between successive CHANNEL CALIBRATIONS. Operation with a trip setpoint that is less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value.
| |
| Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., control room air intake radiation), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The trip setpoints are determined from the analytic limits, corrected for defined process, calibration, and instrument errors.
| |
| The Allowable Values are then determined, based on the trip setpoint values, by accounting for the calibration based errors. These calibration based errors are limited to reference accuracy, instrument drift, errors associated with measurement and test equipment, and calibration tolerance of loop components. The trip setpoints and Allowable Values determined in this manner provide adequate protection because instrument uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for and appropriately applied for the instrumentation.
| |
| APPLICABILITY The Control Room Air Intake RadiationHigh Function is required to be OPERABLE in MODES 1, 2, and 3, and during CORE ALTERATIONS and movement of irradiated fuel in the secondary containment to ensure that control room personnel are protected during a LOCA or a fuel handling event.
| |
| During MODES 4 and 5, when these specified conditions are not in progress (e.g., CORE ALTERATIONS), the probability of a LOCA or fuel damage is low; thus, the Function is not required.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.7.1-3 Revision 76
| |
| | |
| CRAF System Instrumentation B 3.3.7.1 BASES (continued)
| |
| ACTIONS A Note has been provided to modify the ACTIONS related to CRAF System instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable CRAF System instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable CRAF System instrumentation channel.
| |
| A.1 and A.2 Because of the redundancy of sensors available to provide initiation signals and the redundancy of the CRAF System design, an allowable out of service time of 6 hours is provided to permit restoration of any inoperable channel to OPERABLE status. However, this out of service time is only acceptable provided the Function is still maintaining CRAF subsystem initiation capability. A Function is considered to be maintaining CRAF subsystem initiation capability when sufficient channels are OPERABLE or in trip, such that at least one trip system will generate an initiation signal on a valid signal. This would require one trip system to have two channels, each OPERABLE or in trip. In this situation (loss of CRAF subsystem initiation capability), the 6 hour allowance of Required Action A.2 is not appropriate. If the Function is not maintaining CRAF subsystem initiation capability, the CRAF subsystem must be declared inoperable within 1 hour of discovery of loss of CRAF subsystem initiation capability.
| |
| This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." For Required Action A.1, the Completion Time only begins upon discovery that the CRAF subsystem cannot be automatically initiated due to inoperable, untripped Control (continued)
| |
| LaSalle 1 and 2 B 3.3.7.1-4 Revision 0
| |
| | |
| CRAF System Instrumentation B 3.3.7.1 BASES ACTIONS A.1 and A.2 (continued)
| |
| Room Air Intake RadiationHigh channels in both trip systems in any air intake. The 1 hour Completion Time is acceptable because it minimizes risk while allowing time for restoring or tripping of channels. If it is not desired to declare the CRAF subsystem inoperable, Condition B may be entered and Required Action B.1 taken.
| |
| If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition, per Required Action A.2. Placing the inoperable channel in trip performs the intended function of the channel. Alternately, if it is the second channel and it is not desired to place the channel in trip (e.g., as in the case where it is not desired to start the subsystem), Condition B must be entered and its Required Actions taken.
| |
| The 6 hour Completion Time is based on the consideration that this Function provides the primary signal to start the CRAF subsystem, thus ensuring that the design basis of the CRAF subsystem is met.
| |
| B.1 and B.2 With any Required Action and associated Completion Time not met, the associated CRAF subsystem must be placed in the pressurization mode of operation (Required Action B.1) to ensure that control room personnel will be protected in the event of a Design Basis Accident. The method used to place the CRAF subsystem in operation must provide for automatically reinitiating the subsystem upon restoration of power following a loss of power to the CRAF subsystem(s).
| |
| Alternately, if it is not desired to start the subsystem, the CRAF subsystem associated with inoperable, untripped channels must be declared inoperable within 1 hour.
| |
| The 1 hour Completion Time is intended to allow the operator time to place the CRAF subsystem in operation. The 1 hour Completion Time is acceptable because it minimizes risk while allowing time for restoration or tripping of channels, or for placing the associated CRAF subsystem in operation.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.7.1-5 Revision 0
| |
| | |
| CRAF System Instrumentation B 3.3.7.1 BASES (continued)
| |
| SURVEILLANCE The Surveillances are modified by a Note to indicate REQUIREMENTS that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours, provided the associated Function maintains CRAF subsystem initiation capability. Upon completion of the surveillance, or expiration of the 6 hour allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Refs. 4 and 5) assumption of the average time required to perform channel surveillance. That analysis demonstrated that the 6 hour testing allowance does not significantly reduce the probability that the CRAF System will initiate when necessary.
| |
| SR 3.3.7.1.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the indicated parameter for one instrument channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
| |
| Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal, but more frequent, checks of channel status during normal operational use of the displays associated with channels required by the LCO.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.7.1-6 Revision 51
| |
| | |
| CRAF System Instrumentation B 3.3.7.1 BASES SURVEILLANCE SR 3.3.7.1.2 REQUIREMENTS (continued) A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the channel will perform the intended function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.7.1.3 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.7.1.4 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required initiation logic for a specific channel. The system functional testing performed in LCO 3.7.4, "Control Room Area Filtration (CRAF) System,"
| |
| overlaps this Surveillance to provide complete testing of the assumed safety function.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.7.1-7 Revision 51
| |
| | |
| CRAF System Instrumentation B 3.3.7.1 BASES SURVEILLANCE SR 3.3.7.1.4 (continued)
| |
| REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Sections 7.3.4 and 9.4.1.
| |
| : 2. UFSAR, Section 6.4.
| |
| : 3. UFSAR, Chapter 15.
| |
| : 4. GENE-770-06-1A, "Bases for Changes to Surveillance Test Intervals and Allowed Out-of-Service Times for Selected Instrumentation Technical Specifications,"
| |
| December 1992.
| |
| : 5. NEDC-31677P-A, "Technical Specification Improvement Analysis for BWR Isolation Actuation Instrumentation,"
| |
| July 1990.
| |
| LaSalle 1 and 2 B 3.3.7.1-8 Revision 51
| |
| | |
| LOP Instrumentation B 3.3.8.1 B 3.3 INSTRUMENTATION B 3.3.8.1 Loss of Power (LOP) Instrumentation BASES BACKGROUND Successful operation of the required safety functions of the Emergency Core Cooling Systems (ECCS) is dependent upon the availability of adequate power sources for energizing the various components such as pump motors, motor operated valves, and the associated control components. The LOP instrumentation monitors the 4.16 kV emergency buses.
| |
| Offsite power is the preferred source of power for the 4.16 kV emergency buses. If the monitors determine that insufficient voltage is available, the buses are disconnected from the offsite power sources and connected to the onsite diesel generator (DG) power sources.
| |
| Each 4.16 kV emergency bus has its own independent LOP instrumentation and associated trip logic. The voltage for the Division 1, 2, and 3 buses is monitored at two levels, which can be considered as two different undervoltage functions: loss of voltage and degraded voltage.
| |
| For Division 1 and 2, each loss of voltage and degraded voltage function is monitored by two instruments per bus whose output trip contacts are arranged in a two-out-of-two logic configuration per bus (Ref. 1). The loss of voltage signal is generated when a loss of voltage occurs for a specific time interval. Lower voltage conditions will result in decreased trip times for the inverse time undervoltage relays. The degraded voltage signal is generated when a degraded voltage occurs for a specified time interval; the time interval is dependent upon whether a loss of coolant accident signal is present. The relays utilized are inverse time delay voltage relays or instantaneous voltage relays with a time delay.
| |
| For Division 3, the degraded voltage function logic is the same as for Divisions 1 and 2, but the Division 3 loss of voltage function logic is different. The Division 3 DG will auto-start if either one of the two bus undervoltage relays (with a time delay) actuates and the DG output breaker will automatically close with the same undervoltage permissive provided that the Division 3 bus main feeder breaker is open and the DG speed and voltage permissives are met. The Division 3 bus main feed breaker trip logic includes two (continued)
| |
| LaSalle 1 and 2 B 3.3.8.1-1 Revision 0
| |
| | |
| LOP Instrumentation B 3.3.8.1 BASES BACKGROUND trip systems. Each trip system consists of an undervoltage (continued) relay on the 4.16 kV bus (with a time delay) and an undervoltage relay on the system auxiliary transformer (SAT) side of the main feed breaker to the 4.16 kV bus (with no time delay) arranged in a two-out-of-two logic. The trip setting of the SAT undervoltage relay is maintained such that it trips prior to the bus undervoltage relay. Either trip system will open (trip) the main feed breaker to the bus.
| |
| A loss of voltage signal or degraded voltage signal results in the start of the associated DG, the trip of the normal and alternate offsite power supply breakers to the associated 4.16 kV emergency bus, and (for Divisions 1 and 2 only) the shedding of the appropriate 4.16 kV bus loads.
| |
| APPLICABLE The LOP instrumentation is required for the Engineered SAFETY ANALYSES, Safety Features to function in any accident with a loss of LCO, and offsite power. The required channels of LOP instrumentation APPLICABILITY ensure that the ECCS and other assumed systems powered from the DGs provide plant protection in the event of any of the analyzed accidents in References 2, 3, and 4 in which a loss of offsite power is assumed. The initiation of the DGs on loss of offsite power, and subsequent initiation of the ECCS, ensure that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.
| |
| Accident analyses credit the loading of at least two of the DGs based on the loss of offsite power coincident with a loss of coolant accident (LOCA). The diesel starting and loading times have been included in the delay time associated with each safety system component requiring DG supplied power following a loss of offsite power.
| |
| The LOP instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| The OPERABILITY of the LOP instrumentation is dependent upon the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.8.1-1. Each Function must have a required number of OPERABLE channels per 4.16 kV emergency bus, with their setpoints within the specified Allowable Values. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.8.1-2 Revision 0
| |
| | |
| LOP Instrumentation B 3.3.8.1 BASES APPLICABLE The Allowable Values are specified for each Function in the SAFETY ANALYSES, Table. Nominal trip setpoints are specified in the setpoint LCO, and calculations. The nominal setpoints are selected to ensure APPLICABILITY that the setpoint does not exceed the Allowable Value (continued) between CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within the Allowable Value, is acceptable. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value. Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., degraded voltage), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The trip setpoints are determined from the analytic limits, corrected for defined process, calibration, and instrument errors. The Allowable Values are then determined, based on the trip setpoint values, by accounting for the calibration based errors. These calibration based errors are limited to reference accuracy, instrument drift, errors associated with measurement and test equipment, and calibration tolerance of loop components. The trip setpoints and Allowable Values determined in this manner provide adequate protection because instrument uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for and appropriately applied for the instrumentation.
| |
| The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.
| |
| 4.16 kV Emergency Bus Undervoltage 1.a, 1.b, 2.a, 2.b. 4.16 kV Emergency Bus Undervoltage (Loss of Voltage)
| |
| Loss of voltage on a 4.16 kV emergency bus indicates that offsite power may be completely lost to the respective emergency bus and is unable to supply sufficient power for proper operation of the applicable equipment. Therefore, (continued)
| |
| LaSalle 1 and 2 B 3.3.8.1-3 Revision 00
| |
| | |
| LOP Instrumentation B 3.3.8.1 BASES APPLICABLE 4.16 kV Emergency Bus Undervoltage SAFETY ANALYSES, LCO, and 1.a, 1.b, 2.a, 2.b. 4.16 kV Emergency Bus Undervoltage APPLICABILITY (Loss of Voltage) (continued) the power supply to the bus is transferred from the offsite power supply to DG power. This transfer is initiated when the voltage on the bus drops below the relay settings with a short time delay. The transfer occurs prior to the bus voltage dropping below the minimum Loss of Voltage Function Allowable Value but after the voltage drops below the maximum Loss of Voltage Function Allowable Value (loss of voltage with a short time delay). The short time delay prevents inadvertent relay actuations due to momentary voltage dips. For Divisions 1 and 2, the time delay varies inversely with decreasing voltage. For Division 3, the time delay is a fixed value. The time delay values are bounded by the upper and lower Allowable Values, as applicable.
| |
| This ensures that adequate power will be available to the required equipment.
| |
| The Bus Undervoltage Allowable Values are low enough to prevent inadvertent power supply transfer since they are below the minimum expected voltage during normal and emergency operation, but high enough to ensure power is available to the required equipment. The Time Delay Allowable Values are long enough to provide time for the offsite power supply to recover to normal voltages, but short enough to ensure that power is available to the required equipment.
| |
| Two channels of each 4.16 kV Emergency Bus Undervoltage (Loss of Voltage) Function per associated emergency bus are required to be OPERABLE when the associated DG is required to be OPERABLE to ensure that no single instrument failure can preclude the DG function. For the Division 1 and 2 4.16 kV emergency buses, the Loss of Voltage Functions are
| |
| : 1) 4.16 kV Basis and 2) Time Delay. For the Division 3 4.16 kV emergency bus, the Loss of Voltage Functions are: 1) 4.16 kV Basis and 2) Time Delay. Refer to LCO 3.8.1, "AC SourcesOperating," for Applicability Bases for the DGs.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.8.1-4 Revision 90
| |
| | |
| LOP Instrumentation B 3.3.8.1 BASES APPLICABLE 1.c, 1.d, 1.e, 2.c, 2.d, 2.e. 4.16 kV Emergency Bus SAFETY ANALYSES, Undervoltage (Degraded Voltage)
| |
| LCO, and APPLICABILITY A reduced voltage condition on a 4.16 kV emergency bus (continued) indicates that while offsite power may not be completely lost to the respective emergency bus, power may be insufficient for starting large motors without risking damage to the motors that could disable the ECCS function.
| |
| Therefore, power supply to the bus is transferred from offsite power to onsite DG power when the voltage on the bus drops below the Degraded Voltage Function Allowable Values (degraded voltage with a time delay). This ensures that adequate power will be available to the required equipment.
| |
| The Bus Undervoltage Allowable Values are low enough to prevent inadvertent power supply transfer, but high enough to ensure that sufficient power is available to the required equipment. The Time Delay Allowable Values are long enough to provide time for the offsite power supply to recover to normal voltages, but short enough to ensure that sufficient power is available to the required equipment.
| |
| Two channels of each 4.16 kV Emergency Bus Undervoltage (Degraded Voltage) Function per associated emergency bus are required to be OPERABLE when the associated DG is required to be OPERABLE to ensure that no single instrument failure can preclude the DG function. The Degraded Voltage Functions are: 1) 4.16 kV Basis; 2) Time Delay, No LOCA; and
| |
| : 3) Time Delay, LOCA.
| |
| The Degraded Voltage Time Delay, LOCA, Function is dependent on whether a LOCA signal is present at the time of the degraded voltage condition. The LOCA signal for Division 1 and 2 buses is generated by either the Reactor Vessel Water Level - Low Low Low, Level 1, or Drywell Pressure - High, ECCS Instrumentation. The LOCA signal for Division 3 is (continued)
| |
| LaSalle 1 and 2 B 3.3.8.1-5 Revision 13
| |
| | |
| LOP Instrumentation B 3.3.8.1 BASES APPLICABLE 1.c, 1.d, 1.e, 2.c, 2.d, 2.e. 4.16 kV Emergency Bus SAFETY ANALYSES, Undervoltage (Degraded Voltage) (continued)
| |
| LCO, and APPLICABILITY generated by either the Reactor Vessel Water Level - Low Low, Level 2 or Drywell Pressure - High ECCS Instrumentation. The required OPERABILITY of this instrumentation is identified on Table 3.3.5.1-1, "Emergency Core Cooling System Instrumentation." Two footnotes have been provided for the Degraded Voltage Time Delay, LOCA, Function to modify its OPERABILITY consistent with the OPERABILITY requirements of the ECCS Instrumentation that generate the associated LOCA signal. Per footnote (a), the Degraded Voltage Time Delay, LOCA, Function is not required to be OPERABLE in MODES 4 and 5 since the associated ECCS subsystems are not required to initiate automatically in MODES 4 and 5. Additionally, footnote (b) states the Degraded Voltage Time Delay, LOCA, Function is not required to be OPERABLE when the reactor vessel is defueled. These footnotes are acceptable because the Degraded Voltage Time Delay, No LOCA, Function provides adequate protection to ensure that other required systems powered from the DG(s) function as designed in any non-LOCA accident in which a loss of offsite power is assumed.
| |
| ACTIONS A Note has been provided to modify the ACTIONS related to LOP instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable LOP instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable LOP instrumentation channel.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.8.1-6 Revision 76
| |
| | |
| LOP Instrumentation B 3.3.8.1 BASES ACTIONS A.1 (continued)
| |
| With one or more channels of a Function inoperable, the Function may not be capable of performing the intended function. Therefore, only 1 hour is allowed to restore the inoperable channel to OPERABLE status. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. This Completion Time is modified by a Note to clarify that the Risk Informed Completion Time Program is not applicable to a Required Action associated with a Condition that represents a loss of safety function. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action A.1. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue. Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the channel in trip would result in a DG initiation), Condition B must be entered and its Required Action taken.
| |
| The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. The 1 hour Completion Time is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.
| |
| B.1 If any Required Action and associated Completion Time is not met, the associated Function may not be capable of performing the intended function. Therefore, the associated DG(s) are declared inoperable immediately. This requires entry into applicable Conditions and Required Actions of LCO 3.8.1 which provide appropriate actions for the inoperable DG(s).
| |
| SURVEILLANCE As noted at the beginning of the SRs, the SRs for each LOP REQUIREMENTS Instrumentation Function are located in the SRs column of Table 3.3.8.1-1.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.8.1-7 Revision 9089
| |
| | |
| LOP Instrumentation B 3.3.8.1 BASES SURVEILLANCE The Surveillances are modified by a Note to indicate that REQUIREMENTS when a channel is placed in an inoperable status solely for (continued) performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 2 hours provided the associated Function maintains LOP initiation capability. LOP initiation capability is maintained provided the associated Function can perform the load shed and control scheme for two of the three 4.16 kV emergency buses. Upon completion of the Surveillance, or expiration of the 2 hour allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken.
| |
| SR 3.3.8.1.1 and SR 3.3.8.1.3 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the channel will perform the intended function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.8.1.2 and SR 3.3.8.1.4 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary (continued)
| |
| LaSalle 1 and 2 B 3.3.8.1-8 Revision 51
| |
| | |
| LOP Instrumentation B 3.3.8.1 BASES SURVEILLANCE SR 3.3.8.1.2 and SR 3.3.8.1.4 (continued)
| |
| REQUIREMENTS range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.8.1.5 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required actuation logic for a specific channel. The system functional testing performed in LCO 3.8.1 overlaps this Surveillance to provide complete testing of the assumed safety functions. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 8.2.3.3.
| |
| : 2. UFSAR, Section 5.2.
| |
| : 3. UFSAR, Section 6.3.
| |
| : 4. UFSAR, Chapter 15.
| |
| LaSalle 1 and 2 B 3.3.8.1-9 Revision 9051
| |
| | |
| RPS Electric Power Monitoring B 3.3.8.2 B 3.3 INSTRUMENTATION B 3.3.8.2 Reactor Protection System (RPS) Electric Power Monitoring BASES BACKGROUND The RPS Electric Power Monitoring System is provided to isolate the RPS bus from the motor generator (MG) set or the alternate power supply in the event of overvoltage, undervoltage, or underfrequency. This system protects the loads connected to the RPS bus against unacceptable voltage and frequency conditions (Ref. 1) and forms an important part of the primary success path for the essential safety circuits. Some of the essential equipment powered from the RPS buses includes the RPS logic, scram solenoids, and various valve isolation logic.
| |
| The RPS Electric Power Monitoring assembly will detect any abnormal high or low voltage or low frequency condition in the outputs of the two MG sets or the alternate power supply and will de-energize its respective RPS bus, thereby causing all safety functions normally powered by this bus to de-energize.
| |
| In the event of failure of an RPS Electric Power Monitoring System (e.g., both inseries electric power monitoring assemblies), the RPS loads may experience significant effects from the unregulated power supply. Deviation from the nominal conditions can potentially cause damage to the scram and MSIV trip solenoids and other Class 1E devices.
| |
| In the event of a low voltage condition, for an extended period of time, the scram and MSIV trip solenoids can chatter and potentially lose their pneumatic control capability, resulting in a loss of primary scram and MSIV closure action.
| |
| In the event of an overvoltage condition, the RPS and isolation logic relays and scram solenoids, as well as the main steam isolation valve trip solenoids, may experience a voltage higher than their design voltage. If the overvoltage condition persists for an extended time period, it may cause equipment degradation and the loss of plant safety function.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.8.2-1 Revision 0
| |
| | |
| RPS Electric Power Monitoring B 3.3.8.2 BASES BACKGROUND Two redundant Class 1E circuit breakers are connected in (continued) series between each RPS bus and its MG set, and between each RPS bus and the alternate power supply. Each of these circuit breakers has an associated independent set of Class 1E overvoltage, undervoltage, and underfrequency sensing logic. Together, a circuit breaker and its sensing logic constitute an electric power monitoring assembly. If the output of the inservice MG set or alternate power supply exceeds the predetermined limits of overvoltage, undervoltage, or underfrequency, a trip coil driven by this logic circuitry opens the circuit breaker, which removes the associated power supply from service.
| |
| APPLICABLE RPS Electric Power Monitoring is necessary to meet the SAFETY ANALYSES assumptions of the safety analyses by ensuring that the equipment powered from the RPS buses can perform its intended function. RPS Electric Power Monitoring provides protection to the RPS and other systems that receive power from the RPS buses, by disconnecting the RPS bus from the power supply under specified conditions that could damage the RPS bus powered equipment.
| |
| RPS Electric Power Monitoring satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The OPERABILITY of each RPS electric power monitoring assembly is dependent upon the OPERABILITY of the overvoltage, undervoltage, and underfrequency logic, as well as the OPERABILITY of the associated circuit breaker. Two electric power monitoring assemblies are required to be OPERABLE for each inservice power supply. This provides redundant protection against any abnormal voltage or frequency conditions to ensure that no single RPS electric power monitoring assembly failure can preclude the function of RPS bus powered components. Each of the inservice electric power monitoring assembly trip logic setpoints is required to be within the specific Allowable Value. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.8.2-2 Revision 0
| |
| | |
| RPS Electric Power Monitoring B 3.3.8.2 BASES LCO Allowable Values are specified for each RPS electric power (continued) monitoring assembly trip logic (refer to SR 3.3.8.2.2).
| |
| Nominal trip setpoints are specified in the setpoint calculations. The nominal setpoints are selected to ensure that the setpoints do not exceed the Allowable Value between CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value. Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., overvoltage), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., trip coil) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The trip setpoints are determined from the analytic limits, corrected for defined process, calibration, and instrument errors.
| |
| The Allowable Values are then determined, based on the trip setpoint values, by accounting for the calibration based errors. These calibration based errors are limited to reference accuracy, instrument drift, errors associated with measurement and test equipment, and calibration tolerance of loop components. The trip setpoints and Allowable Values determined in this manner provide adequate protection because instrument uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for and appropriately applied for the instrumentation.
| |
| The Allowable Values for the instrument settings are based on the RPS providing ! 57 Hz and 120 V 10%. The most limiting voltage requirement and associated line losses determine the settings of the electric power monitoring instrument channels. The settings are calculated based on the loads on the buses and RPS MG set or alternate power supply being 120 VAC and 60 Hz.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.8.2-3 Revision 0
| |
| | |
| RPS Electric Power Monitoring B 3.3.8.2 BASES (continued)
| |
| APPLICABILITY The operation of the RPS electric power monitoring assemblies is essential to disconnect the RPS bus powered components from the inservice MG set or alternate power supply during abnormal voltage or frequency conditions.
| |
| Since the degradation of a nonclass 1E source supplying power to the RPS bus can occur as a result of any random single failure, the OPERABILITY of the RPS electric power monitoring assemblies is required when the RPS bus powered components are required to be OPERABLE. This results in the RPS Electric Power Monitoring System OPERABILITY being required in MODES 1, 2, and 3, MODES 4 and 5, with residual heat removal (RHR) shutdown cooling isolation valves open, MODE 5 with any control rod withdrawn from a core cell containing one or more fuel assemblies, during movement of irradiated fuel assemblies in the secondary containment, and during CORE ALTERATIONS.
| |
| ACTIONS A.1 If one RPS electric power monitoring assembly for an inservice power supply (MG set or alternate) is inoperable, or one RPS electric power monitoring assembly on each inservice power supply is inoperable, the OPERABLE assembly will still provide protection to the RPS bus powered components under degraded voltage or frequency conditions.
| |
| However, the reliability and redundancy of the RPS Electric Power Monitoring System are reduced and only a limited time (72 hours) is allowed to restore the inoperable assembly(s) to OPERABLE status. If the inoperable assembly(s) cannot be restored to OPERABLE status, the associated power supply must be removed from service (Required Action A.1). This places the RPS bus in a safe condition. An alternate power supply with OPERABLE power monitoring assemblies may then be used to power the RPS bus.
| |
| The 72 hour Completion Time takes into account the remaining OPERABLE electric power monitoring assembly and the low probability of an event requiring RPS Electric Power Monitoring protection occurring during this period. It allows time for plant operations personnel to take corrective actions or to place the plant in the required condition in an orderly manner and without challenging plant systems.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.8.2-4 Revision 76
| |
| | |
| RPS Electric Power Monitoring B 3.3.8.2 BASES ACTIONS A.1 (continued)
| |
| Alternatively, if it is not desired to remove the power supply(s) from service (e.g., as in the case where removing the power supply(s) from service would result in a scram or isolation), Condition C, D, E, or F as applicable, must be entered and its Required Actions taken.
| |
| B.1 If both power monitoring assemblies for an inservice power supply (MG set or alternate) are inoperable, or both power monitoring assemblies in each inservice power supply are inoperable, the system protective function is lost. In this condition, 1 hour is allowed to restore one assembly to OPERABLE status for each inservice power supply. If one inoperable assembly for each inservice power supply cannot be restored to OPERABLE status, the associated power supplies must be removed from service within 1 hour (Required Action B.1). An alternate power supply with OPERABLE assemblies may then be used to power one RPS bus.
| |
| The 1 hour Completion Time is sufficient for the plant operations personnel to take corrective actions and is acceptable because it minimizes risk while allowing time for restoration or removal from service of the electric power monitoring assemblies.
| |
| Alternately, if it is not desired to remove the power supply(s) from service (e.g., as in the case where removing the power supply(s) from service would result in a scram or isolation), Condition C, D, E, or F as applicable, must be entered and its Required Actions taken.
| |
| C.1 If any Required Action and associated Completion Time of Condition A or B are not met in MODE 1, 2, or 3, the plant must be brought to a MODE in which overall plant risk is minimized. The plant shutdown is accomplished by placing the plant in MODE 3 within 12 hours. Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 2) and because the time spent in MODE 3 to (continued)
| |
| LaSalle 1 and 2 B 3.3.8.2-5 Revision 32
| |
| | |
| RPS Electric Power Monitoring B 3.3.8.2 BASES ACTIONS C.1 (continued) perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
| |
| D.1 and D.2 If any Required Action and associated Completion Time of Condition A or B are not met in MODE 4 or 5 with RHR SDC isolation valves open, action must be immediately initiated to either restore one electric power monitoring assembly to OPERABLE status for the inservice power source supplying the required instrumentation powered from the RPS bus (Required Action D.1) or to isolate the RHR SDC System (Required Action D.2). Required Action D.1 is provided because the RHR SDC System may be needed to provide core cooling. All actions must continue until the applicable Required Actions are completed.
| |
| E.1 If any Required Action and associated Completion Time of Condition A or B are not met in MODE 5 with any control rod withdrawn from a core cell containing one or more fuel assemblies, the operator must immediately initiate action to fully insert all insertable control rods in core cells containing one or more fuel assemblies (Required Action E.1). This Required Action results in the least reactive condition for the reactor core and ensures that the safety function of the RPS (e.g., scram of control rods) is not required.
| |
| F.1.1, F.1.2, F.2.1, and F.2.2 If any Required Action and associated Completion Time of Condition A or B are not met during movement of irradiated fuel assemblies in the secondary containment or during CORE ALTERATIONS, the ability to isolate the secondary (continued)
| |
| LaSalle 1 and 2 B 3.3.8.2-6 Revision 76
| |
| | |
| RPS Electric Power Monitoring B 3.3.8.2 BASES ACTIONS F.1.1, F.1.2, F.2.1, and F.2.2 (continued) containment and start the Standby Gas Treatment (SGT) System cannot be ensured. Therefore, actions must be immediately performed to ensure the ability to maintain the secondary containment and SGT System functions. Isolating the affected penetration flow path(s) and starting the associated SGT subsystem(s) (Required Actions F.1.1 and F.2.1) performs the intended function of the instrumentation the RPS electric power monitoring assemblies is protecting, and allows operations to continue.
| |
| Alternatively, immediately declaring the associated secondary containment isolation valve(s) or SGT subsystem(s) inoperable (Required Action F.1.2 and F.2.2) is also acceptable since the Required Actions of the respective LCOs (LCO 3.6.4.2 and LCO 3.6.4.3) provide appropriate actions for the inoperable components.
| |
| SURVEILLANCE SR 3.3.8.2.1 REQUIREMENTS A CHANNEL FUNCTIONAL TEST is performed on each overvoltage, undervoltage, and underfrequency channel to ensure that the channel will perform the intended function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.
| |
| As noted in the Surveillance, the CHANNEL FUNCTIONAL TEST is only required to be performed while the plant is in a condition in which the loss of the RPS bus will not jeopardize steady state power operation (the design of the system is such that the power source must be removed from service to conduct the Surveillance). The 24 hours is intended to indicate an outage of sufficient duration to (continued)
| |
| LaSalle 1 and 2 B 3.3.8.2-7 Revision 76
| |
| | |
| RPS Electric Power Monitoring B 3.3.8.2 BASES SURVEILLANCE SR 3.3.8.2.1 (continued)
| |
| REQUIREMENTS allow for scheduling and proper performance of the Surveillance. The Note in the Surveillance is based on guidance provided in Generic Letter 91-09 (Ref. 3). The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.8.2.2 CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies that the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.3.8.2.3 Performance of a system functional test demonstrates that, with a required system actuation (simulated or actual) signal, the logic of the system will automatically trip open the associated power monitoring assembly circuit breaker.
| |
| The system functional test shall include actuation of the protective relays, tripping logic, and output circuit breakers. Only one signal per power monitoring assembly is required to be tested. This Surveillance overlaps with the CHANNEL CALIBRATION to provide complete testing of the safety function. The system functional test of the Class 1E circuit breakers is included as part of this test to provide complete testing of the safety function. If the breakers are incapable of operating, the associated electric power monitoring assembly would be inoperable.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.3.8.2-8 Revision 51
| |
| | |
| RPS Electric Power Monitoring B 3.3.8.2 BASES (continued)
| |
| REFERENCES 1. UFSAR, Section 8.3.1.1.3.
| |
| : 2. NEDC-32988-A, Revision 2, "Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants," December 2002.
| |
| : 3. NRC Generic Letter 91-09, "Modification of Surveillance Interval for the Electric Protective Assemblies in Power Supplies for the Reactor Protection System."
| |
| LaSalle 1 and 2 B 3.3.8.2-9 Revision 51
| |
| | |
| Recirculation Loops Operating B 3.4.1 B 3.4 REACTOR COOLANT SYSTEM (RCS)
| |
| B 3.4.1 Recirculation Loops Operating BASES BACKGROUND The Reactor Recirculation System is designed to provide a forced coolant flow through the core to remove heat from the fuel. The forced coolant flow removes heat at a faster rate from the fuel than would be possible with just natural circulation. The forced flow, therefore, allows operation at significantly higher power than would otherwise be possible. The recirculation system also controls reactivity over a wide span of reactor power by varying the recirculation flow rate to control the void content of the moderator. The Reactor Recirculation System consists of two recirculation pump loops external to the reactor vessel.
| |
| These loops provide the piping path for the driving flow of water to the reactor vessel jet pumps. Each external loop contains a two speed motor driven recirculation pump, a flow control valve, associated piping, jet pumps, valves, and instrumentation. The recirculation loops are part of the reactor coolant pressure boundary and are located inside the drywell structure. The jet pumps are reactor vessel internals.
| |
| The recirculated coolant consists of saturated water from the steam separators and dryers that has been subcooled by incoming feedwater. This water passes down the annulus between the reactor vessel wall and the core shroud. A portion of the coolant flows from the vessel, through the two external recirculation loops, and becomes the driving flow for the jet pumps. Each of the two external recirculation loops discharges high pressure flow into an external manifold, from which individual recirculation inlet lines are routed to the jet pump risers within the reactor vessel. The remaining portion of the coolant mixture in the annulus becomes the suction flow for the jet pumps. This flow enters the jet pump at suction inlets and is accelerated by the driving flow. The drive flow and suction flow are mixed in the jet pump throat section and result in partial pressure recovery. The total flow then passes through the jet pump diffuser section into the area below the core (lower plenum), gaining sufficient head in the process to drive the required flow upward through the core.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.4.1-1 Revision 0
| |
| | |
| Recirculation Loops Operating B 3.4.1 BASES BACKGROUND The subcooled water enters the bottom of the fuel channels (continued) and contacts the fuel cladding, where heat is transferred to the coolant. As it rises, the coolant begins to boil, creating steam voids within the fuel channel that continue until the coolant exits the core. Because of reduced moderation, the steam voiding introduces negative reactivity that must be compensated for to maintain or to increase reactor power. The recirculation flow control allows operators to increase recirculation flow and sweep some of the voids from the fuel channel, overcoming the negative reactivity void effect. Thus, the reason for having variable recirculation flow is to compensate for reactivity effects of boiling over a wide range of power generation (i.e., approximately 65 to 100% RTP) without having to move control rods and disturb desirable flux patterns.
| |
| Each recirculation loop is manually started from the control room. The recirculation flow control valves provide regulation of individual recirculation loop drive flows.
| |
| The flow in each loop can be manually or automatically controlled.
| |
| APPLICABLE The operation of the Reactor Recirculation System is SAFETY ANALYSES an initial condition assumed in the design basis loss of coolant accident (LOCA) (Ref. 1). During a LOCA caused by a recirculation loop pipe break, the intact loop is assumed to provide coolant flow during the first few seconds of the accident. The initial core flow decrease is rapid because the recirculation pump in the broken loop ceases to pump reactor coolant to the vessel almost immediately. The pump in the intact loop coasts down relatively slowly. This pump coastdown governs the core flow response for the next several seconds until the jet pump suction is uncovered (Ref. 2). The analyses assume that both loops are operating at the same flow prior to the accident. However, the LOCA analysis was reviewed for the case with a flow mismatch between the two loops, with the pipe break assumed to be in the loop with the higher flow. While the flow coastdown and core response are potentially more severe in this assumed case (since the intact loop starts at a lower flow rate and the core response is the same as if both loops were operating at a lower flow rate), a small mismatch has been determined to be acceptable based on engineering judgement.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.4.1-2 Revision 23
| |
| | |
| Recirculation Loops Operating B 3.4.1 BASES APPLICABLE The recirculation system is also assumed to have sufficient SAFETY ANALYSES flow coastdown characteristics to maintain fuel thermal (continued) margins during abnormal operational transients (Ref. 2),
| |
| which are analyzed in Chapter 15 of the UFSAR.
| |
| A plant specific LOCA analysis has been performed assuming only one operating recirculation loop. This analysis has demonstrated that, in the event of a LOCA caused by a pipe break in the operating recirculation loop, the Emergency Core Cooling System response will provide adequate core cooling, provided the APLHGR and LHGR requirements are modified accordingly (Ref. 3).
| |
| The transient analyses in Chapter 15 of the UFSAR have also been performed for single recirculation loop operation (Ref. 3) and demonstrate sufficient flow coastdown characteristics to maintain fuel thermal margins during the abnormal operational transients analyzed provided the MCPR requirements are modified. During single recirculation loop operation, modification to the Reactor Protection System average power range monitor (APRM) and the Rod Block Monitor (RBM) Allowable Values is also required to account for the different relationships between recirculation drive flow and reactor core flow. The APLHGR, LHGR, and MCPR limits for single loop operation are specified in the COLR. The APRM Flow Biased Simulated Thermal Power-Upscale Allowable Value is in LCO 3.3.1.1, "Reactor Protection System (RPS)
| |
| Instrumentation." The Rod Block Monitor-Upscale Allowable Value is specified in the COLR.
| |
| Recirculation loops operating satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO Two recirculation loops are normally required to be in operation with their flows matched within the limits specified in SR 3.4.1.1 to ensure that during a LOCA caused by a break of the piping of one recirculation loop the assumptions of the LOCA analysis are satisfied. With the limits specified in SR 3.4.1.1 not met, the recirculation loop with the lower flow must be considered not in operation. With only one recirculation loop in operation, (continued)
| |
| LaSalle 1 and 2 B 3.4.1-3 Revision 23
| |
| | |
| Recirculation Loops Operating B 3.4.1 BASES LCO modifications to the required APLHGR limits (LCO 3.2.1, (continued) "AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)"),
| |
| MCPR limits (LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)"), LHGR limits (LCO 3.2.3, LINEAR HEAT GENERATION RATE (LHGR)), APRM Flow Biased Simulated Thermal Power Upscale Allowable Value (LCO 3.3.1.1), and the Rod Block MonitorUpscale Allowable Value (LCO 3.3.2.1) must be applied to allow continued operation consistent with the assumptions of Reference 3.
| |
| APPLICABILITY In MODES 1 and 2, requirements for operation of the Reactor Recirculation System are necessary since there is considerable energy in the reactor core and the limiting design basis transients and accidents are assumed to occur.
| |
| In MODES 3, 4, and 5, the consequences of an accident are reduced and the coastdown characteristics of the recirculation loops are not important.
| |
| ACTIONS A.1 With no recirculation loops in operation, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to MODE 3 within 12 hours. In this condition, the recirculation loops are not required to be operating because of the reduced severity of design basis accidents and minimal dependence on the recirculation loop coastdown characteristics. The allowed Completion Time of 12 hours is reasonable, based on operating experience to reach MODE 3 from the full power condition in an orderly manner and without challenging plant systems.
| |
| B.1 and C.1 With both recirculation loops operating but the flows not matched, the flows must be matched within 2 hours. If matched flows are not restored, the recirculation loop with lower flow must be declared "not in operation," as required by Required Action B.1. This Required Action does not require tripping the recirculation pump in the lowest flow loop when the mismatch between total jet pump flows of the (continued)
| |
| LaSalle 1 and 2 B 3.4.1-4 Revision 23
| |
| | |
| Recirculation Loops Operating B 3.4.1 BASES ACTIONS B.1 and C.1 (continued) two loops is greater than the required limits. However, in cases where large flow mismatches occur, low flow or reverse flow can occur in the low flow loop jet pumps, causing vibration of the jet pumps. If zero or reverse flow is detected, the condition should be alleviated by changing flow control valve position to re-establish forward flow or by tripping the pump.
| |
| With the requirements of the LCO not met for reasons other than Conditions A or B (e.g., one loop is "not in operation"), compliance with the LCO must be restored within 24 hours. A recirculation loop is considered not in operation when the pump in that loop is idle or when the mismatch between total jet pump flows of the two loops is greater than required limits for greater than 2 hours (i.e.,
| |
| Required Action B.1 has been taken). Should a LOCA occur with one recirculation loop not in operation, the core flow coastdown and resultant core response may not be bounded by the LOCA analyses. Therefore, only a limited time is allowed to restore the inoperable loop to operating status.
| |
| Alternatively, if the single loop requirements of the LCO are applied to the APLHGR, LHGR, and MCPR operating limits and RPS and RBM Allowable Values, operation with only one recirculation loop would satisfy the requirements of the LCO and the initial conditions of the accident sequence.
| |
| The 2 hour and 24 hour Completion Times are based on the low probability of an accident occurring during this time period, on a reasonable time to complete the Required Action, and on frequent core monitoring by operators allowing abrupt changes in core flow conditions to be quickly detected.
| |
| D.1 If the Required Action and associated Completion Time of Condition C is not met, the unit is required to be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours.
| |
| In this condition, the recirculation loops are not required (continued)
| |
| LaSalle 1 and 2 B 3.4.1-5 Revision 23
| |
| | |
| Recirculation Loops Operating B 3.4.1 BASES ACTIONS D.1 (continued) to be operating because of the reduced severity of DBAs and minimal dependence on the recirculation loop coastdown characteristics. The allowed Completion Time of 12 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.
| |
| SURVEILLANCE SR 3.4.1.1 REQUIREMENTS This SR ensures the recirculation loop flows are within the allowable limits for mismatch. At low core flow (i.e.,
| |
| < 70% of rated core flow), the APLHGR, LHGR, and MCPR requirements provide larger margins to the fuel cladding integrity Safety Limit such that the potential adverse effect of early boiling transition during a LOCA is reduced.
| |
| A larger flow mismatch can therefore be allowed when core flow is < 70% of rated core flow. The recirculation loop jet pump flow, as used in this Surveillance, is the summation of the flows from all of the jet pumps associated with a single recirculation loop.
| |
| The mismatch is measured in terms of percent of rated core flow. If the flow mismatch exceeds the specified limits, the loop with the lower flow is considered not in operation.
| |
| This SR is not required when both loops are not in operation since the mismatch limits are meaningless during single loop or natural circulation operation. The Surveillance must be performed within 24 hours after both loops are in operation.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Sections 6.3 and 15.6.5.
| |
| : 2. UFSAR, Appendix G.3.1.2.
| |
| : 3. UFSAR, Section 6.B.
| |
| LaSalle 1 and 2 B 3.4.1-6 Revision 51
| |
| | |
| FCVs B 3.4.2 B 3.4 REACTOR COOLANT SYSTEM (RCS)
| |
| B 3.4.2 Flow Control Valves (FCVs)
| |
| BASES BACKGROUND The Reactor Recirculation System is described in the Background section of the Bases for LCO 3.4.1, "Recirculation Loops Operating," which discusses the operating characteristics of the system and how this affects the design basis transient and accident analyses. The FCVs are part of the Reactor Recirculation System.
| |
| The Recirculation Flow Control System consists of the electronic and hydraulic components necessary for the positioning of the two hydraulically actuated FCVs. The recirculation loop flow rate can be rapidly changed within the expected flow range, in response to rapid changes in system demand. Limits on the system response are required to minimize the impact on core flow response during certain accidents and transients. Solid state control logic will generate an FCV "motion inhibit" signal in response to any one of several hydraulic power unit or analog control circuit failure signals. The "motion inhibit" signal causes hydraulic power unit shutdown and hydraulic isolation such that the FCVs fail "as is."
| |
| APPLICABLE The FCV stroke rate is limited to 11% per second in SAFETY ANALYSES the opening and closing directions on a control signal failure of maximum demand. This stroke rate is an assumption of the analysis of the recirculation flow control failures on decreasing and increasing flow (Refs. 1 and 2).
| |
| During a LOCA caused by a recirculation loop pipe break, the intact loop is assumed to provide coolant flow during the first few seconds of the accident. The initial core flow decrease is rapid because the recirculation pump in the broken loop ceases to pump almost immediately since it has lost suction. The pump in the intact loop coasts down relatively slowly. This pump coastdown governs the core flow response for the next several seconds (Ref. 3), because the FCV is assumed to fail "as is" due to a motion inhibit as a result of a high drywell pressure interlock. In addition, the closure of a recirculation FCV concurrent with a loss of coolant accident (LOCA) was analyzed during (continued)
| |
| LaSalle 1 and 2 B 3.4.2-1 Revision 0
| |
| | |
| FCVs B 3.4.2 BASES APPLICABLE initial licensing and found to be acceptable for a maximum SAFETY ANALYSES closure rate of 11% of stroke per second, since this event (continued) involves multiple failures.
| |
| Flow control valves satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO An FCV in each operating recirculation loop must be OPERABLE to ensure that the assumptions of the design basis transient and accident analyses are satisfied.
| |
| APPLICABILITY In MODES 1 and 2, the FCVs are required to be OPERABLE, since during these conditions there is considerable energy in the reactor core, and the limiting design basis transients and accidents are assumed to occur. In MODES 3, 4, and 5, the consequences of a transient or accident are reduced and OPERABILITY of the flow control valves is not important.
| |
| ACTIONS A Note has been provided to modify the ACTIONS related to FCVs. Section 1.3, Completion Times, specifies once a Condition has been entered, subsequent divisions, subsystems, components or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition.
| |
| Section 1.3 also specifies Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition.
| |
| However, the Required Actions for inoperable FCVs provide appropriate compensatory measures for separate inoperable FCVs. As such, a Note has been provided that allows separate Condition entry for each inoperable FCV.
| |
| A.1 With one or two required FCVs inoperable, the assumptions of the design basis transient and accident analyses may not be met and the inoperable FCV must be returned to OPERABLE status or hydraulically locked within 4 hours.
| |
| Opening an FCV faster than the limit could result in a more severe flow runout transient. Closing an FCV faster than (continued)
| |
| LaSalle 1 and 2 B 3.4.2-2 Revision 0
| |
| | |
| FCVs B 3.4.2 BASES ACTIONS A.1 (continued) the limit could result in a more severe coolant flow decrease transient. Both conditions could result in violation of the Safety Limit MCPR. The FCVs are designed to lockup (high drywell pressure interlock) under LOCA conditions. When the FCVs "lock-up", the recirculation flow coastdown is adequate and the resulting calculated clad temperatures are acceptable. In addition, it has been calculated with the FCVs closing at the specified limit, the resulting calculated clad temperatures will also be acceptable. Closing an FCV faster than the limit assumed in the LOCA analysis (Ref. 3) could affect the recirculation flow coastdown, resulting in higher peak clad temperatures.
| |
| Therefore, if an FCV is inoperable, deactivating the valve will essentially lock the valve in position, which will prohibit the FCV from adversely affecting the DBA and transient analyses. Continued operation is allowed in this Condition.
| |
| The 4 hour Completion Time is a reasonable time period to complete the Required Action, while limiting the time of operation with an inoperable FCV.
| |
| B.1 If the FCVs are not deactivated ("locked up") within the associated Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 12 hours. This brings the unit to a condition where the flow coastdown characteristics of the recirculation loop are not important. The allowed Completion Time of 12 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems.
| |
| SURVEILLANCE SR 3.4.2.1 REQUIREMENTS Hydraulic power unit pilot operated 4-way valves located between the servo valves and the common "open" and "close" lines are required to close in the event of a loss of hydraulic pressure. When closed, these valves inhibit FCV motion by blocking hydraulic pressure from the servo valve (continued)
| |
| LaSalle 1 and 2 B 3.4.2-3 Revision 0
| |
| | |
| FCVs B 3.4.2 BASES SURVEILLANCE SR 3.4.2.1 (continued)
| |
| REQUIREMENTS to the common open and close lines as well as to the alternate subloop. This Surveillance verifies FCV lockup on a loss of hydraulic pressure.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.4.2.2 This SR ensures the overall average rate of FCV movement at all positions is maintained within the analyzed limits.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 15.3.2.
| |
| : 2. UFSAR, Section 15.4.5.
| |
| : 3. UFSAR, Appendix G.
| |
| LaSalle 1 and 2 B 3.4.2-4 Revision 51
| |
| | |
| Jet Pumps B 3.4.3 B 3.4 REACTOR COOLANT SYSTEM (RCS)
| |
| B 3.4.3 Jet Pumps BASES BACKGROUND The Reactor Recirculation System is described in the Background section of the Bases for LCO 3.4.1, "Recirculation Loops Operating," which discusses the operating characteristics of the system and how these characteristics affect the Design Basis Accident (DBA) analyses.
| |
| The jet pumps are part of the Reactor Recirculation System and are designed to provide forced circulation through the core to remove heat from the fuel. The jet pumps are located in the annular region between the core shroud and the vessel inner wall. Because the jet pump suction elevation is at two thirds core height, the vessel can be reflooded and coolant level maintained at two thirds core height even with the complete break of the recirculation loop pipe that is located below the jet pump suction elevation.
| |
| Each reactor coolant recirculation loop contains 10 jet pumps. Recirculated coolant passes down the annulus between the reactor vessel wall and the core shroud. A portion of the coolant flows from the vessel, through the two external recirculation loops, and becomes the driving flow for the jet pumps. Each of the two external recirculation loops discharges high pressure flow into an external manifold from which individual recirculation inlet lines are routed to the jet pump risers within the reactor vessel. The remaining portion of the coolant mixture in the annulus becomes the suction flow for the jet pumps. This flow enters the jet pump at suction inlets and is accelerated by the drive flow.
| |
| The drive flow and suction flow are mixed in the jet pump throat section. The total flow then passes through the jet pump diffuser section into the area below the core (lower plenum), gaining sufficient head in the process to drive the required flow upward through the core.
| |
| APPLICABLE Jet pump OPERABILITY is an explicit assumption in the design SAFETY ANALYSES basis loss of coolant accident (LOCA) analysis evaluated in Reference 1.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.4.3-1 Revision 0
| |
| | |
| Jet Pumps B 3.4.3 BASES APPLICABLE The capability of reflooding the core to two-thirds core SAFETY ANALYSES height is dependent upon the structural integrity of the jet (continued) pumps. If the structural system, including the beam holding a jet pump in place, fails, jet pump displacement and performance degradation could occur, resulting in an increased flow area through the jet pump and a lower core flooding elevation. This could adversely affect the water level in the core during the reflood phase of a LOCA as well as the assumed blowdown flow during a LOCA.
| |
| Jet pumps satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The structural failure of any of the jet pumps could cause significant degradation in the ability of the jet pumps to allow reflooding to two thirds core height during a LOCA.
| |
| OPERABILITY of all jet pumps is required to ensure that operation of the Reactor Recirculation System will be consistent with the assumptions used in the licensing basis analysis (Ref. 1).
| |
| APPLICABILITY In MODES 1 and 2, the jet pumps are required to be OPERABLE since there is a large amount of energy in the reactor core and since the limiting DBAs are assumed to occur in these MODES. This is consistent with the requirements for operation of the Reactor Recirculation System (LCO 3.4.1).
| |
| In MODES 3, 4, and 5, the Reactor Recirculation System is not required to be in operation, and when not in operation sufficient flow is not available to evaluate jet pump OPERABILITY.
| |
| ACTIONS A.1 An inoperable jet pump can increase the blowdown area and reduce the capability to reflood during a design basis LOCA.
| |
| If one or more of the jet pumps are inoperable, the plant must be brought to a MODE in which the LCO does not apply.
| |
| To achieve this status, the plant must be brought to MODE 3 within 12 hours. The allowed Completion Time of 12 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.4.3-2 Revision 0
| |
| | |
| Jet Pumps B 3.4.3 BASES (continued)
| |
| SURVEILLANCE SR 3.4.3.1 REQUIREMENTS This SR is designed to detect significant degradation in jet pump performance that precedes jet pump failure (Ref. 2).
| |
| This SR is required to be performed only when the loop has forced recirculation flow since surveillance checks and measurements can only be performed during jet pump operation. The jet pump failure of concern is a complete mixer displacement due to jet pump beam failure. Jet pump plugging is also of concern since it adds flow resistance to the recirculation loop. Significant degradation is indicated if any two of the three specified criteria confirm unacceptable deviations from established patterns or relationships. The allowable deviations from the established patterns have been developed based on the variations experienced at plants during normal operation and with jet pump assembly failures (Refs. 2 and 3). Since refueling activities (fuel assembly replacement or shuffle, as well as any modifications to fuel support orifice size or core plate bypass flow) can affect the relationship between core flow, jet pump flow, and recirculation loop flow, these relationships may need to be re-established each cycle.
| |
| Similarly, initial entry into extended single loop operation may also require establishment of these relationships.
| |
| During the initial weeks of operation under such conditions, while baselining new "established patterns", engineering judgement of the daily Surveillance results is used to detect significant abnormalities which could indicate a jet pump failure. In addition, during two recirculation loop operation, the jet pump SR should be performed with balanced recirculation loop drive flows (drive flow mismatch less than 5%) to ensure an accurate indication of jet pump performance.
| |
| The recirculation flow control valve (FCV) operating characteristics (loop flow characteristics versus FCV position) are determined by the flow resistance from the loop suction through the jet pump nozzles. A change in the relationship may indicate a flow restriction, loss in pump hydraulic performance, leak, or new flow path between the recirculation pump discharge and jet pump nozzle. For this criterion, the loop flow versus FCV position relationship must be verified. When both recirculation loops are operating, the established FCV position should include the (continued)
| |
| LaSalle 1 and 2 B 3.4.3-3 Revision 0
| |
| | |
| Jet Pumps B 3.4.3 BASES SURVEILLANCE SR 3.4.3.1 (continued)
| |
| REQUIREMENTS loop flow characteristics for two recirculation loop operation. When only one recirculation loop is operating, the established FCV position should include the loop flow characteristics for single loop operation.
| |
| Total calculated core flow can be determined from either the established THERMAL POWER-core flow relationship or the core plate differential pressure-core flow relationship. Once this relationship has been established, increased or reduced indicated total core flow from the calculated total core flow may be an indication of failures in one or several jet pumps. When determining calculated total core flow in single recirculation loop operation using the core plate differential pressure-core flow relationship, the calculated total core flow value should be derived using the established core plate differential pressure - core flow relationship for two recirculation loop operation.
| |
| Individual jet pumps in a recirculation loop typically do not have the same flow. The unequal flow is due to the drive flow manifold, which does not distribute flow equally to all risers. The jet pump diffuser to lower plenum differential pressure pattern or relationship of one jet pump to the loop average is repeatable. An appreciable change in this relationship is an indication that increased (or reduced) resistance has occurred in one of the jet pumps.
| |
| The deviations from normal are considered indicative of a potential problem in the recirculation drive flow or jet pump system (Ref. 2). Normal flow ranges and established jet pump differential pressure patterns are established by plotting historical data as discussed in Reference 2.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by two Notes. Note 1 allows this Surveillance not to be performed until 4 hours after the associated recirculation loop is in operation, since these (continued)
| |
| LaSalle 1 and 2 B 3.4.3-4 Revision 51
| |
| | |
| Jet Pumps B 3.4.3 BASES SURVEILLANCE SR 3.4.3.1 (continued)
| |
| REQUIREMENTS checks can only be performed during jet pump operation. The 4 hours is an acceptable time to establish conditions appropriate for data collection and evaluation.
| |
| Note 2 allows this SR not to be performed until 24 hours after THERMAL POWER exceeds 25% RTP. During low flow conditions, jet pump noise approaches the threshold response of the associated flow instrumentation and precludes the collection of repeatable and meaningful data. The 24 hours is an acceptable time to establish conditions appropriate to perform this SR.
| |
| REFERENCES 1. UFSAR, Section 6.3 and Appendices G.2.2.2 and G.3.2.2.3.
| |
| : 2. GE Service Information Letter No. 330.
| |
| : 3. NUREG/CR-3052, "Closeout of IE Bulletin 80-07: BWR Jet Pump Assembly Failure," November 1984.
| |
| LaSalle 1 and 2 B 3.4.3-5 Revision 0
| |
| | |
| S/RVs B 3.4.4 B 3.4 REACTOR COOLANT SYSTEM (RCS)
| |
| B 3.4.4 Safety/Relief Valves (S/RVs)
| |
| BASES BACKGROUND The American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code (Ref. 1) requires the Reactor Pressure Vessel be protected from overpressure during upset conditions by self actuated safety valves. As part of the nuclear pressure relief system, the size and number of safety/relief valves (S/RVs) are selected such that peak pressure in the nuclear system will not exceed the ASME Code limits for the reactor coolant pressure boundary (RCPB).
| |
| The S/RVs are located on the main steam lines between the reactor vessel and the first isolation valve within the drywell. Each S/RV discharges steam through a discharge line to a point below the minimum water level in the suppression pool.
| |
| The S/RVs can actuate by either of two modes: the safety mode or the relief mode (however, for the purpose of this LCO, only the safety mode is required). In the safety mode (or spring mode of operation), the direct action of the steam pressure in the main steam lines will act against a spring loaded disk that will pop open when the valve inlet pressure exceeds the spring force. In the relief mode (or power actuated mode of operation), a pneumatic piston/cylinder and mechanical linkage assembly are used to open the valve by overcoming the spring force, even with the valve inlet pressure equal to 0 psig. The pneumatic operator is arranged so that its malfunction will not prevent the valve disk from lifting if steam inlet pressure reaches the spring lift set pressures. In the relief mode, valves may be opened manually or automatically at the selected preset pressure. Seven of the S/RVs that provide the safety and relief function are part of the Automatic Depressurization System specified in LCO 3.5.1, "ECCS-Operating." The instrumentation associated with the relief valve function for the ADS function is discussed in LCO 3.3.5.1, "Emergency Core Cooling Systems (ECCS)
| |
| Instrumentation."
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.4.4-1 Revision 0
| |
| | |
| S/RVs B 3.4.4 BASES (continued)
| |
| APPLICABLE The overpressure protection system must accommodate the SAFETY ANALYSES most severe pressure transient. Evaluations have determined that the most severe transient is the closure of all main steam isolation valves (MSIVs) followed by reactor scram on high neutron flux (i.e., failure of the direct scram associated with MSIV position) (Ref. 2). For the purpose of the analyses, 12 of the S/RVs are assumed to operate in the safety mode. The analysis results demonstrate that the design S/RV capacity is capable of maintaining reactor pressure below the ASME Code limit of 110% of vessel design pressure (110% x 1250 psig = 1375 psig). This LCO helps to ensure that the acceptance limit of 1375 psig is met during the design basis event.
| |
| From an overpressure standpoint, the design basis events are bounded by the MSIV closure with flux scram event described above. For other pressurization events, such as a turbine trip or generator load rejection with Main Turbine Bypass System failure, the S/RVs are assumed to function. The opening of the valves during the pressurization event mitigates the increase in reactor vessel pressure, which affects the MINIMUM CRITICAL POWER RATIO (MCPR) during these events. The number of S/RVs required to mitigate these events is bounded by the number required to be OPERABLE by the LCO.
| |
| S/RVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The safety function of 12 S/RVs is required to be OPERABLE.
| |
| The requirements of this LCO are applicable only to the capability of the S/RVs to mechanically open to relieve excess pressure when the lift setpoint is exceeded (safety mode). In Reference 2, an evaluation was performed to establish the parametric relationship between the peak vessel pressure and the number of OPERABLE S/RVs. The results show that with a minimum of 12 S/RVs in the safety mode OPERABLE, the ASME Code limit of 1375 psig is not exceeded.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.4.4-2 Revision 4
| |
| | |
| S/RVs B 3.4.4 BASES LCO The S/RV safety setpoints are established to ensure the ASME (continued) Code limit on peak reactor pressure is satisfied. The ASME Code specifications require the lowest safety valve be set at or below vessel design pressure (1250 psig) and the highest safety valve be set so the total accumulated pressure does not exceed 110% of the design pressure for overpressurization conditions. The transient evaluations in Reference 3 involving the safety mode are based on these setpoints, but also include the additional uncertainties of
| |
| + 3% and - 5% of the nominal setpoint to account for potential setpoint drift to provide an added degree of conservatism.
| |
| Operation with fewer valves OPERABLE than specified, or with setpoints outside the ASME limits, could result in a more severe reactor response to a transient than predicted, possibly resulting in the ASME Code limit on reactor pressure being exceeded.
| |
| The S/RVs are required to be OPERABLE to limit peak pressure in the main steam lines and maintain reactor pressure within acceptable limits during events that cause rapid pressurization, so that MCPR is not exceeded.
| |
| APPLICABILITY In MODES 1, 2, and 3, the specified number of S/RVs must be OPERABLE since there may be considerable energy in the reactor core and the limiting design basis transients are assumed to occur. The S/RVs may be required to provide pressure relief to limit peak reactor pressure.
| |
| In MODE 4, decay heat is low enough for the RHR System to provide adequate cooling, and reactor pressure is low enough that the overpressure limit is unlikely to be approached by assumed operational transients or accidents. In MODE 5, the reactor vessel head is unbolted or removed and the reactor is at atmospheric pressure. The S/RV function is not needed during these conditions.
| |
| ACTIONS A.1 and A.2 With less than the minimum number of required S/RVs OPERABLE, a transient may result in the violation of the ASME Code limit on reactor pressure. If one or more required S/RVs are inoperable, the plant must be brought to (continued)
| |
| LaSalle 1 and 2 B 3.4.4-3 Revision 76
| |
| | |
| S/RVs B 3.4.4 BASES ACTIONS A.1 and A.2 (continued) a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
| |
| SURVEILLANCE SR 3.4.4.1 REQUIREMENTS This Surveillance demonstrates that the required S/RVs will open at the pressures assumed in the safety analysis of Reference 2. The demonstration of the S/RV safety function lift settings must be performed during shutdown, since this is a bench test, and in accordance with the INSERVICE TESTING PROGRAM. The lift setting pressure shall correspond to ambient conditions of the valves at nominal operating temperatures and pressures. The S/RV setpoint is + 3% and
| |
| - 5% for OPERABILITY; however, the valves are reset to +/- 1%
| |
| during the Surveillance to allow for drift. Additionally, during the performance of this Surveillance, the S/RV will be manually actuated by providing air to the valve actuator to verify the performance of the valve actuator, lever and pivot mechanism to open the valve. A Note is provided to allow up to two of the required 12 S/RVs to be physically replaced with S/RVs with lower setpoints. This provides operational flexibility which maintains the assumptions in the overpressure protection analysis.
| |
| The Frequency is specified in the INSERVICE TESTING PROGRAM which requires the valves be subjected to a bench test during refueling outages. The Frequency is acceptable based on industry standards and operating history.
| |
| REFERENCES 1. ASME, Boiler and Pressure Vessel Code, Section III.
| |
| : 2. UFSAR, Section 5.2.2.1.3.
| |
| : 3. UFSAR, Chapter 15.
| |
| : 4. ASME Code for Operation and Maintenance of Nuclear Power Plants (OM Code).
| |
| LaSalle 1 and 2 B 3.4.4-4 Revision 76
| |
| | |
| RCS Operational LEAKAGE B 3.4.5 B 3.4 REACTOR COOLANT SYSTEM (RCS)
| |
| B 3.4.5 RCS Operational LEAKAGE BASES BACKGROUND The RCS includes systems and components that contain or transport the coolant to or from the reactor core. The pressure containing components of the RCS and the portions of connecting systems out to and including the isolation valves define the reactor coolant pressure boundary (RCPB).
| |
| The joints of the RCPB components are welded or bolted.
| |
| During plant life, the joint and valve interfaces can produce varying amounts of reactor coolant LEAKAGE, through either normal operational wear or mechanical deterioration.
| |
| Limits on RCS operational LEAKAGE are required to ensure appropriate action is taken before the integrity of the RCPB is impaired. This LCO specifies the types and limits of LEAKAGE. This protects the RCS pressure boundary described in 10 CFR 50.2, 10 CFR 50.55a(c), and GDC 55 of 10 CFR 50, Appendix A (Refs. 1, 2, and 3).
| |
| The safety significance of leaks from the RCPB varies widely depending on the source, rate, and duration. Therefore, detection of LEAKAGE in the drywell is necessary. Methods for quickly separating the identified LEAKAGE from the unidentified LEAKAGE are necessary to provide the operators quantitative information to permit them to take corrective action should a leak occur detrimental to the safety of the facility or the public.
| |
| A limited amount of leakage inside the drywell is expected from auxiliary systems that cannot be made 100% leaktight.
| |
| Leakage from these systems should be detected and isolated from the drywell atmosphere, if possible, so as not to mask RCS operational LEAKAGE detection.
| |
| This LCO deals with protection of the RCPB from degradation and the core from inadequate cooling, in addition to preventing the accident analyses radiation release assumptions from being exceeded. The consequences of violating this LCO include the possibility of a loss of coolant accident.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.4.5-1 Revision 0
| |
| | |
| RCS Operational LEAKAGE B 3.4.5 BASES (continued)
| |
| APPLICABLE The allowable RCS operational LEAKAGE limits are based on SAFETY ANALYSES the predicted and experimentally observed behavior of pipe cracks. The normally expected background LEAKAGE due to equipment design and the detection capability of the instrumentation for determining system LEAKAGE were also considered. The evidence from experiments suggests, for LEAKAGE even greater than the specified unidentified LEAKAGE limits, the probability is small that the imperfection or crack associated with such LEAKAGE would grow rapidly.
| |
| The unidentified LEAKAGE flow limit allows time for corrective action before the RCPB could be significantly compromised. The 5 gpm limit is a small fraction of the calculated flow from a critical crack in the primary system piping. Crack behavior from experimental programs (Refs. 4 and 5) shows leak rates of hundreds of gallons per minute will precede crack instability (Ref. 6).
| |
| The low limit on increase in unidentified LEAKAGE assumes a failure mechanism of intergranular stress corrosion cracking (IGSCC) that produces tight cracks. This flow increase limit is capable of providing an early warning of such deterioration.
| |
| No applicable safety analysis assumes the total LEAKAGE limit. The total LEAKAGE limit considers RCS inventory makeup capability and drywell sump capacity.
| |
| RCS operational LEAKAGE satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO RCS operational LEAKAGE shall be limited to:
| |
| : a. Pressure Boundary LEAKAGE Pressure boundary LEAKAGE is prohibited as the leak itself could cause further RCPB deterioration, resulting in higher LEAKAGE.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.4.5-2 Revision 91
| |
| | |
| RCS Operational LEAKAGE B 3.4.5 BASES LCO b. Unidentified LEAKAGE (continued)
| |
| Five gpm of unidentified LEAKAGE is allowed as a reasonable minimum detectable amount that the drywell atmosphere monitoring, drywell sump flow monitoring, and drywell air cooler condensate flow rate monitoring equipment can detect within a reasonable time period.
| |
| Separating the sources of LEAKAGE (i.e., LEAKAGE from an identified source versus LEAKAGE from an unidentified source) is necessary for prompt identification of potentially adverse conditions, assessment of the safety significance, and corrective action.
| |
| : c. Total LEAKAGE The total LEAKAGE limit is based on a reasonable minimum detectable amount. The limit also accounts for LEAKAGE from known sources (identified LEAKAGE).
| |
| Violation of this LCO indicates an unexpected amount of LEAKAGE and, therefore, could indicate new or additional degradation in an RCPB component or system.
| |
| : d. Unidentified LEAKAGE Increase An unidentified LEAKAGE increase of ! 2 gpm within the previous 24 hour period indicates a potential flaw in the RCPB and must be quickly evaluated to determine the source and extent of the LEAKAGE. The increase is measured relative to the steady state value; temporary changes in LEAKAGE rate as a result of transient conditions (e.g., startup) are not considered. As such, the 2 gpm increase limit is only applicable in MODE 1 when operating pressures and temperatures are established.
| |
| APPLICABILITY In MODES 1, 2, and 3, the RCS operational LEAKAGE LCO applies because the potential for RCPB LEAKAGE is greatest when the reactor is pressurized.
| |
| In MODES 4 and 5, RCS operational LEAKAGE limits are not required since the reactor is not pressurized and stresses in the RCPB materials and potential for LEAKAGE are reduced.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.4.5-3 Revision 91
| |
| | |
| RCS Operational LEAKAGE B 3.4.5 BASES (continued)
| |
| ACTIONS A.1 If pressure boundary LEAKAGE exists, the affected component, pipe, or vessel must be isolated from the RCS by a closed manual valve, closed and de-activated automatic valve, blind flange, or check valve within 4 hours. While in this condition, structural integrity of the system should be considered because the structural integrity of the part of the system within the isolation boundary must be maintained under all licensing basis conditions, including consideration of the potential for further degradation of the isolated location. Normal LEAKAGE past the isolation device is acceptable as it will limit RCS LEAKAGE and is included in identified or unidentified LEAKAGE. This action is necessary to prevent further deterioration of the RCPB.
| |
| B.1 With RCS unidentified or total LEAKAGE greater than the limits, actions must be taken to reduce the leak. Because the LEAKAGE limits are conservatively below the LEAKAGE that would constitute a critical crack size, 4 hours is allowed to reduce the LEAKAGE rates before the reactor must be shut down. If an unidentified LEAKAGE has been identified and quantified, it may be reclassified and considered as identified LEAKAGE. However, the total LEAKAGE limit would remain unchanged.
| |
| C.1 and C.2 An unidentified LEAKAGE increase of > 2 gpm within a 24 hour period is an indication of a potential flaw in the RCPB and must be quickly evaluated. Although the increase does not necessarily violate the absolute unidentified LEAKAGE limit, certain susceptible components must be determined not to be the source of the LEAKAGE increase within the required Completion Time. For an unidentified LEAKAGE increase greater than required limits, an alternative to reducing LEAKAGE increase to within limits (i.e., reducing the leakage rate such that the current rate is less than the "2 gpm increase in the previous 24 hours" limit; either by isolating the source or other possible methods) is to verify the source of the unidentified leakage increase is not material susceptible to IGSCC.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.4.5-4 Revision 91
| |
| | |
| RCS Operational LEAKAGE B 3.4.5 BASES ACTIONS C.1 and C.2 (continued)
| |
| The 4 hour Completion Time is needed to properly reduce the LEAKAGE increase or verify the source before the reactor must be shut down.
| |
| D.1 and D.2 If any Required Action and associated Completion Time is not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
| |
| SURVEILLANCE SR 3.4.5.1 REQUIREMENTS The RCS LEAKAGE is monitored by a variety of instruments designed to provide alarms when LEAKAGE is indicated and to quantify the various types of LEAKAGE. Leakage detection instrumentation is discussed in more detail in the Bases for LCO 3.4.7, "RCS Leakage Detection Instrumentation." Sump level and flow rate are typically monitored to determine actual LEAKAGE rates. However, any method may be used to quantify LEAKAGE provided the method has suitable sensitivity to satisfy the requirements of LCO 3.4.5. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. 10 CFR 50.2.
| |
| : 2. 10 CFR 50.55a(c).
| |
| : 3. 10 CFR 50, Appendix A, GDC 55.
| |
| : 4. GEAP-5620, "Failure Behavior in ASTM A106 B Pipes Containing Axial Through-Wall Flaws," April 1968.
| |
| : 5. NUREG-75/067, "Investigation and Evaluation of Cracking in Austenitic Stainless Steel Piping of Boiling Water Reactor Plants," October 1975.
| |
| : 6. UFSAR, Section 5.2.5.5.2.
| |
| LaSalle 1 and 2 B 3.4.5-5 Revision 91
| |
| | |
| RCS PIV Leakage B 3.4.6 B 3.4 REACTOR COOLANT SYSTEM (RCS)
| |
| B 3.4.6 RCS Pressure Isolation Valve (PIV) Leakage BASES BACKGROUND The function of RCS PIVs is to separate the high pressure RCS from an attached low pressure system. This protects the RCS pressure boundary described in 10 CFR 50.2, 10 CFR 50.55a(c), and GDC 55 of 10 CFR 50, Appendix A (Refs. 1, 2, and 3). PIVs are designed to meet the requirements of Reference 4. During their lives, these valves can produce varying amounts of reactor coolant leakage through either normal operational wear or mechanical deterioration.
| |
| The RCS PIV LCO allows RCS high pressure operation when leakage through these valves exists in amounts that do not compromise safety. The PIV leakage limit applies to each individual valve. Leakage through these valves is not included in any allowable LEAKAGE specified in LCO 3.4.5, "RCS Operational LEAKAGE."
| |
| Although this Specification provides a limit on allowable PIV leakage rate, its main purpose is to prevent overpressure failure of the low pressure portions of connecting systems. The leakage limit is an indication that the PIVs between the RCS and the connecting systems are degraded or degrading. PIV leakage could lead to overpressure of the low pressure piping or components.
| |
| Failure consequences could be a loss of coolant accident (LOCA) outside of containment, an unanalyzed accident which could degrade the ability for low pressure injection.
| |
| A study (Ref. 5) evaluated various PIV configurations to determine the probability of intersystem LOCAs. This study concluded that periodic leakage testing of the PIVs can substantially reduce intersystem LOCA probability.
| |
| PIVs are provided to isolate the RCS from the following connected systems:
| |
| : a. Residual Heat Removal (RHR) System;
| |
| : b. Low Pressure Core Spray System; (continued)
| |
| LaSalle 1 and 2 B 3.4.6-1 Revision 0
| |
| | |
| RCS PIV Leakage B 3.4.6 BASES BACKGROUND c. High Pressure Core Spray System; and (continued)
| |
| : d. Reactor Core Isolation Cooling System.
| |
| The PIVs are listed in the Technical Requirements Manual (Ref. 6).
| |
| APPLICABLE Reference 5 evaluated various PIV configurations, leakage SAFETY ANALYSES testing of the valves, and operational changes to determine the effect on the probability of intersystem LOCAs. This study concluded that periodic leakage testing of the PIVs can substantially reduce the probability of an intersystem LOCA.
| |
| PIV leakage is not considered in any Design Basis Accident analyses. This Specification provides for monitoring the condition of the reactor coolant pressure boundary (RCPB) to detect PIV degradation that has the potential to cause a LOCA outside of containment.
| |
| RCS PIV leakage satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO RCS PIV leakage is leakage into closed systems connected to the RCS. Isolation valve leakage is usually on the order of drops per minute. Leakage that increases significantly suggests that something is operationally wrong and corrective action must be taken. Violation of this LCO could result in continued degradation of a PIV, which could lead to overpressurization of a low pressure system and the loss of the integrity of a fission product barrier.
| |
| The LCO PIV leakage limit is 0.5 gpm per nominal inch of valve size with a maximum limit of 5 gpm (Ref. 4).
| |
| Reference 7 permits leakage testing at a lower pressure differential than between the specified maximum RCS pressure and the normal pressure of the connected system during RCS operation (the maximum pressure differential). The observed rate may be adjusted to the maximum pressure differential by assuming leakage is directly proportional to the pressure differential to the one-half power.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.4.6-2 Revision 0
| |
| | |
| RCS PIV Leakage B 3.4.6 BASES (continued)
| |
| APPLICABILITY In MODES 1, 2, and 3, this LCO applies because the PIV leakage potential is greatest when the RCS is pressurized.
| |
| In MODE 3, valves in the RHR flowpath are not required to meet the requirements of this LCO when in, or during transition to or from, the RHR shutdown cooling mode of operation.
| |
| In MODES 4 and 5, leakage limits are not provided because the lower reactor coolant pressure results in a reduced potential for leakage and for a LOCA outside the containment. Accordingly, the potential for the consequences of reactor coolant leakage is far lower during these MODES.
| |
| ACTIONS The ACTIONS are modified by two Notes. Note 1 has been provided to modify the ACTIONS related to RCS PIV flow paths. Section 1.3, Completion Times, specifies once a Condition has been entered, subsequent divisions, subsystems, components or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition.
| |
| Section 1.3 also specifies Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition.
| |
| However, the Required Actions for the Condition of RCS PIV leakage limits exceeded provide appropriate compensatory measures for separate, affected RCS PIV flow paths. As such, a Note has been provided that allows separate Condition entry for each affected RCS PIV flow path. Note 2 requires an evaluation of affected systems if a PIV is inoperable. The leakage may have affected system OPERABILITY, or isolation of a leaking flow path with an alternate valve may have degraded the ability of the interconnected system to perform its safety function. As a result, the applicable Conditions and Required Actions for systems made inoperable by PIVs must be entered. This ensures appropriate remedial actions are taken, if necessary, for the affected systems.
| |
| A.1 and A.2 If leakage from one or more RCS PIVs is not within limit, the flow path must be isolated by at least one closed (continued)
| |
| LaSalle 1 and 2 B 3.4.6-3 Revision 0
| |
| | |
| RCS PIV Leakage B 3.4.6 BASES ACTIONS A.1 and A.2 (continued) manual, de-activated automatic, or check valve within 4 hours. Required Action A.1 and Required Action A.2 are modified by a Note stating that the valves used for isolation must meet the same leakage requirements as the PIVs and must be on the RCPB or the high pressure portion of the system.
| |
| Four hours provides time to reduce leakage in excess of the allowable limit and to isolate the flow path if leakage cannot be reduced while corrective actions to reseat the leaking PIVs are taken. The 4 hours allows time for these actions and restricts the time of operation with leaking valves.
| |
| Required Action A.2 specifies that the double isolation barrier of two valves be restored by closing another valve qualified for isolation or restoring one leaking PIV. The 72 hour Completion Time after exceeding the limit considers the time required to complete the Required Action, the low probability of a second valve failing during this time period, and the low probability of a pressure boundary rupture of the low pressure ECCS piping when overpressurized to reactor pressure (Ref. 7).
| |
| B.1 and B.2 If leakage cannot be reduced or the system isolated, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours and to MODE 4 within 36 hours. This action may reduce the leakage and also reduces the potential for a LOCA outside the containment. The Completion Times are reasonable, based on operating experience, to achieve the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
| |
| SURVEILLANCE SR 3.4.6.1 REQUIREMENTS Performance of leakage testing on each RCS PIV is required to verify that leakage is below the specified limit and to identify each leaking valve. The leakage limit of 0.5 gpm (continued)
| |
| LaSalle 1 and 2 B 3.4.6-4 Revision 0
| |
| | |
| RCS PIV Leakage B 3.4.6 BASES SURVEILLANCE SR 3.4.6.1 (continued)
| |
| REQUIREMENTS per inch of nominal valve diameter up to 5 gpm maximum applies to each valve. Leakage testing requires a stable pressure condition. As stated in the LCO section of the Bases, the test pressure may be at a lower pressure than the maximum pressure differential (at the maximum pressure of 1050 psig) provided the observed leakage rate is adjusted in accordance with Reference 4. For the two PIVs tested in series, the leakage requirement applies to each valve individually and not to the combined leakage across both valves (i.e., the leakage acceptance criteria is the criteria for one valve to account for the condition where all of the leakage is through one valve). If the PIVs are not individually leakage tested, one valve may have failed completely and not be detected if the other valve in series meets the leakage requirement. In this situation, the protection provided by redundant valves would be lost.
| |
| The Frequency required by the INSERVICE TESTING PROGRAM is within the ASME OM Code Frequency requirement and is based on the need to perform this Surveillance under the conditions that apply during an outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.
| |
| This SR is modified by a Note that states the leakage Surveillance is only required to be performed in MODES 1 and 2. Entry into MODE 3 is permitted for leakage testing at high differential pressures with stable conditions not possible in the lower MODES.
| |
| REFERENCES 1. 10 CFR 50.2.
| |
| : 2. 10 CFR 50.55a(c).
| |
| : 3. 10 CFR 50, Appendix A, GDC 55.
| |
| : 4. ASME Code for Operation and Maintenance of Nuclear Power Plants (OM Code).
| |
| : 5. NUREG-0677, "The Probability of Intersystem LOCA:
| |
| Impact Due to Leak Testing and Operational Changes,"
| |
| May 1980.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.4.6-5 Revision 70
| |
| | |
| RCS PIV Leakage B 3.4.6 BASES REFERENCES 6. Technical Requirements Manual.
| |
| (continued)
| |
| : 7. NEDC-31339, "BWR Owners Group Assessment of Emergency Core Cooling System Pressurization in Boiling Water Reactors," November 1986.
| |
| LaSalle 1 and 2 B 3.4.6-6 Revision 0
| |
| | |
| RCS Leakage Detection Instrumentation B 3.4.7 B 3.4 REACTOR COOLANT SYSTEM (RCS)
| |
| B 3.4.7 RCS Leakage Detection Instrumentation BASES BACKGROUND GDC 30 of 10 CFR 50, Appendix A (Ref. 1), requires means for detecting and, to the extent practical, identifying the location of the source of RCS LEAKAGE. Regulatory Guide 1.45, Revision 0, (Ref. 2) describes acceptable methods for selecting leakage detection systems.
| |
| Limits on LEAKAGE from the reactor coolant pressure boundary (RCPB) are required so that appropriate action can be taken before the integrity of the RCPB is impaired (Ref. 2).
| |
| Leakage detection systems for the RCS are provided to alert the operators when leakage rates above normal background levels are detected and also to supply quantitative measurement of rates. In addition to meeting the OPERABILITY requirements, the monitors are typically set to provide the most sensitive response without causing an excessive number of spurious alarms. The Bases for LCO 3.4.5, "RCS Operational LEAKAGE," discuss the limits on RCS LEAKAGE rates.
| |
| Systems for separating the LEAKAGE of an identified source from an unidentified source are necessary to provide prompt and quantitative information to the operators to permit them to take immediate corrective action.
| |
| LEAKAGE from the RCPB inside the drywell is detected by at least one of three independently monitored variables, such as drywell air cooler condensate flow rate, sump flow rate, and drywell gaseous and particulate radioactivity levels. The primary means of quantifying LEAKAGE in the drywell is the drywell floor drain sump flow monitoring system.
| |
| The drywell floor drain sump flow monitoring system monitors the LEAKAGE collected in the floor drain sump. This unidentified LEAKAGE consists of LEAKAGE from control rod drives, valve flanges or packings, floor drains, the closed cooling water subsystems, and drywell air cooling unit condensate drains, and any LEAKAGE not collected in the drywell equipment drain sump. The drywell floor drain sump has a weir level transmitter that supplies floor drain sump fill-up rate flow indication in the main control room. The drywell floor drain sump flow monitoring system contains an additional method of measuring drywell floor drain sump flow (continued)
| |
| LaSalle 1 and 2 B 3.4.7-1 Revision 53
| |
| | |
| RCS Leakage Detection Instrumentation B 3.4.7 BASES BACKGROUND through the use of a magnetic flow meter. The flow meter is (continued) installed on the piping that runs parallel to the sump pump piping. When in use, the magnetic flow meter measures a continuous flow in the line and will display a flow rate in the control room.
| |
| The floor drain sump has level switches that start and stop the sump pumps when required. The sump pump which is selected Lead starts on a high level in the sump. The other pump starts, and a control room alarm is annunciated, if the sump level reaches the high-high level. The pumps stop when low level is reached in the sump. A timer starts each time the first sump pump starts. A second timer starts when the pump is stopped. If the pump takes longer than a given time to pump down the sump, or if the pump starts too soon after the previous pumpdown, an alarm is sounded in the control room indicating a higher than normal sump fill-up rate.
| |
| A flow monitor in the discharge line of the drywell floor drain sump pumps provides flow input to a flow totalizer, which is indicated in the control room. The magnetic flow meter indication also provides an input to the flow totalizer. The totalizer inputs can be swapped using hand switches located in the Auxiliary Electric Equipment Room and the Reactor Building. Both monitors cannot be used simultaneously. The flow totalizer can be used to quantify the amount of inputs.
| |
| The drywell air monitoring systems continuously monitor the drywell atmosphere for airborne particulate and gaseous radioactivity. A sudden increase of radioactivity, which may be attributed to RCPB steam or reactor water LEAKAGE, is annunciated in the control room.
| |
| Condensate from the drywell coolers is routed to the drywell floor drain sump and is monitored by a flow transmitter that provides indication and alarms in the control room. This drywell air cooler condensate flow rate monitoring system serves as an added indicator, but not quantifier, of RCS unidentified LEAKAGE.
| |
| APPLICABLE A threat of significant compromise to the RCPB exists if the SAFETY ANALYSES barrier contains a crack that is large enough to propagate (continued)
| |
| LaSalle 1 and 2 B 3.4.7-2 Revision 53
| |
| | |
| RCS Leakage Detection Instrumentation B 3.4.7 BASES APPLICABLE rapidly. LEAKAGE rate limits are set low enough to detect SAFETY ANALYSES the LEAKAGE emitted from a single crack in the RCPB (Refs. 3 (continued) and 4). A control room alarm allows the operators to evaluate the significance of the indicated LEAKAGE and, if necessary, shut down the reactor for further investigation and corrective action. The allowed LEAKAGE rates are well below the rates predicted for critical crack sizes (Ref. 5).
| |
| Therefore, these actions provide adequate response before a significant break in the RCPB can occur.
| |
| RCS leakage detection instrumentation satisfies Criterion 1 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO This LCO requires instruments of diverse monitoring principles to be OPERABLE to provide confidence that small amounts of unidentified LEAKAGE are detected in time to allow actions to place the plant in a safe condition, when RCS LEAKAGE indicates possible RCPB degradation.
| |
| The LCO requires three instruments to be OPERABLE.
| |
| The drywell floor drain sump flow monitoring system is required to quantify the unidentified LEAKAGE rate from the RCS. Thus, for the system to be considered OPERABLE, either the flow monitoring or the sump level monitoring portion of the system must be OPERABLE and capable of determining the leakage rate. The identification of an increase in unidentified LEAKAGE will be delayed by the time required for the unidentified LEAKAGE to travel to the drywell floor drain sump and it may take longer than one hour to detect a 1 gpm increase in unidentified LEAKAGE, depending on the origin and magnitude of the LEAKAGE. This sensitivity is acceptable for containment sump monitor OPERABILITY.
| |
| The reactor coolant contains radioactivity that, when released to the drywell, can be detected by the gaseous or particulate drywell atmospheric radioactivity monitor. Only one of the two detectors is required to be OPERABLE.
| |
| Radioactivity detection systems are included for monitoring both particulate and gaseous activities because of their sensitivities and rapid responses to RCS LEAKAGE, but have recognized limitations. Reactor coolant radioactivity levels will be low during initial reactor startup and for a few weeks thereafter, until activated corrosion products have been formed and fission products appear from fuel (continued)
| |
| LaSalle 1 and 2 B 3.4.7-3 Revision 53
| |
| | |
| RCS Leakage Detection Instrumentation B 3.4.7 BASES LCO element cladding contamination or cladding defects. If (continued) there are few fuel element cladding defects and low levels of activation products, it may not be possible for the drywell gaseous or particulate atmospheric radioactivity monitors to detect a 1 gpm increase within 1 hour during normal operation. However, the drywell gaseous or particulate atmospheric radioactivity monitor is OPERABLE when it is capable of detecting a 1 gpm increase in unidentified LEAKAGE within 1 hour given an RCS activity equivalent to that assumed in the design calculations for the monitors (Reference 6).
| |
| An increase in humidity of the drywell atmosphere could indicate the release of water vapor to the drywell. Drywell air cooler condensate flow rate is instrumented to detect when there is an increase above the normal value by 1 gpm.
| |
| The time required to detect a 1 gpm increase above the normal value varies based on environmental and system conditions and may take longer than 1 hour. This sensitivity is acceptable for drywell air cooler condensate flow rate monitor OPERABILITY.
| |
| The LCO is satisfied when monitors of diverse measurement means are available. Thus, the drywell floor drain sump flow monitoring system, in combination with a drywell gaseous or particulate atmospheric radioactivity monitor and the drywell air cooler condensate flow rate monitoring system, provides an acceptable minimum.
| |
| APPLICABILITY In MODES 1, 2, and 3, leakage detection systems are required to be OPERABLE to support LCO 3.4.5. This Applicability is consistent with that for LCO 3.4.5.
| |
| ACTIONS A.1 With the drywell floor drain sump flow monitoring system inoperable, no other form of sampling can provide the equivalent information to quantify leakage. However, the drywell atmospheric activity monitor and the drywell air cooler condensate flow rate monitor will provide indications of changes in leakage.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.4.7-4 Revision 53
| |
| | |
| RCS Leakage Detection Instrumentation B 3.4.7 BASES ACTIONS A.1 (continued)
| |
| With the drywell floor drain sump flow monitoring system inoperable, but with RCS unidentified and total LEAKAGE being determined (SR 3.4.5.1), operation may continue for 30 days. The 30 day Completion Time of Required Action A.1 is acceptable, based on operating experience, considering the multiple forms of leakage detection that are still available.
| |
| B.1 With both gaseous and particulate drywell atmospheric monitoring channels inoperable (i.e., the required drywell atmospheric monitoring system), grab samples of the drywell atmosphere shall be taken and analyzed to provide periodic leakage information. Provided a sample is obtained and analyzed every 12 hours, the plant may continue operation since at least one other form of drywell leakage detection (i.e., air cooler condensate flow rate monitor) is available.
| |
| The 12 hour interval provides periodic information that is adequate to detect LEAKAGE.
| |
| C.1 With the required drywell air cooler condensate flow rate monitoring system inoperable, SR 3.4.7.1 is performed every 8 hours to provide periodic information of activity in the drywell at a more frequent interval than the routine Frequency of SR 3.4.7.1. The 8 hour interval provides periodic information that is adequate to detect LEAKAGE and recognizes that other forms of leakage detection are available. However, this Required Action is modified by a Note that allows this action to be not applicable if the required drywell atmospheric monitoring system is inoperable. Consistent with SR 3.0.1, Surveillances are not required to be performed on inoperable equipment.
| |
| D.1, D.2, D.3.1, and D.3.2 With the drywell floor drain sump flow monitoring system and the drywell air cooler condensate flow rate monitoring system inoperable, the only means of detecting LEAKAGE is the drywell atmospheric gaseous radiation monitor. A Note (continued)
| |
| LaSalle 1 and 2 B 3.4.7-5 Revision 53
| |
| | |
| RCS Leakage Detection Instrumentation B 3.4.7 BASES ACTIONS D.1, D.2, D.3.1, and D.3.2 (continued) clarifies this applicability of the Condition. The drywell atmospheric gaseous radiation monitor typically cannot detect a 1 gpm leak within one hour when RCS activity is low. In addition, this configuration does not provide the required diverse means of leakage detection. Indirect methods of monitoring RCS leakage must be implemented. Grab samples of the drywell atmosphere must be taken and analyzed and monitoring of RCS leakage by administrative means must be performed every 12 hours to provide alternate periodic information.
| |
| Administrative means of monitoring RCS leakage include monitoring and trending parameters that may indicate an increase in RCS leakage. There are diverse alternative mechanisms from which appropriate indicators may be selected based on plant conditions. It is not necessary to utilize all of these methods, but a method or methods should be selected considering the current plant conditions and historical or expected sources of unidentified leakage. The administrative methods are drywell floor drain sump flow measurement, drywell equipment drain sump, drywell cooler drain flow, drywell pressure, drywell temperature, drywell air sampling, reactor vessel head closure seal annulus pressure, reactor water recirculation pump seal flow rate, safety/relief valve discharge piping temperature, valve packing leakage, component cooling water system outlet temperatures, component cooling water system makeup, reactor recirculation system pump seal pressure and temperature, reactor recirculation system pump motor cooler temperatures, drywell cooling fan outlet temperatures, reactor building chiller amperage, and control rod drive system flange temperatures. These indications, coupled with the drywell atmospheric grab samples, are sufficient to alert the operating staff to an unexpected increase in unidentified LEAKAGE.
| |
| The 12 hour interval is sufficient to detect increasing RCS leakage. The Required Action provides 7 days to restore another RCS leakage monitor to OPERABLE status to regain the intended leakage detection diversity. The 7 day Completion Time ensures that the plant will not be operated in a degraded configuration for a lengthy time period.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.4.7-6 Revision 53
| |
| | |
| RCS Leakage Detection Instrumentation B 3.4.7 BASES ACTIONS E.1 and E.2 (continued)
| |
| With both the gaseous and particulate drywell atmospheric monitor channels and the drywell air cooler condensate flow rate monitor inoperable, the only means of detecting LEAKAGE is the drywell floor drain sump flow monitor. This Condition does not provide the required diverse means of leakage detection. The Required Action is to restore either of the inoperable monitors to OPERABLE status within 30 days to regain the intended leakage detection diversity. The 30 day Completion Time ensures that the plant will not be operated in a degraded configuration for a lengthy time period.
| |
| F.1 and F.2 If any Required Action of Condition A, B, C, D, or E cannot be met within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions in an orderly manner and without challenging plant systems.
| |
| G.1 With all required monitors inoperable, no required automatic means of monitoring LEAKAGE are available, and immediate plant shutdown in accordance with LCO 3.0.3 is required.
| |
| SURVEILLANCE The Surveillances are modified by a Note to indicate that REQUIREMENTS when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours, provided the other required instrumentation (the drywell sump flow monitoring system, drywell atmospheric monitoring channel, or the drywell air cooler condensate flow monitoring system, as applicable) is OPERABLE. Upon (continued)
| |
| LaSalle 1 and 2 B 3.4.7-7 Revision 53
| |
| | |
| RCS Leakage Detection Instrumentation B 3.4.7 BASES SURVEILLANCE completion of the Surveillance, or expiration of the 6 hour REQUIREMENTS allowance, the channel must be returned to OPERABLE status (continued) or the applicable Condition entered and Required Actions taken. The 6 hour testing allowance is acceptable since it does not significantly reduce the probability of properly monitoring RCS leakage.
| |
| SR 3.4.7.1 This SR requires the performance of a CHANNEL CHECK of the required drywell atmospheric monitoring system. The check gives reasonable confidence that the channel is operating properly. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.4.7.2 This SR requires the performance of a CHANNEL FUNCTIONAL TEST of the required RCS leakage detection instrumentation.
| |
| The test ensures that the monitors can perform their function in the desired manner. The test also verifies the alarm function and relative accuracy of the instrument string. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.4.7.3 This SR requires the performance of a CHANNEL CALIBRATION of the required RCS leakage detection instrumentation channels.
| |
| The calibration verifies the accuracy of the instrument string, including the instruments located inside the drywell. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.4.7-8 Revision 53
| |
| | |
| RCS Leakage Detection Instrumentation B 3.4.7 BASES REFERENCES 1. 10 CFR 50, Appendix A, GDC 30.
| |
| : 2. Regulatory Guide 1.45, Revision 0, "Reactor Coolant Pressure Boundary Leakage Detection Systems,"
| |
| May 1973.
| |
| : 3. GEAP-5620, "Failure Behavior in ASTM A106B Pipes Containing Axial Through-Wall Flaws," April 1968.
| |
| : 4. NUREG-75/067, "Investigation and Evaluation of Cracking in Austenitic Stainless Steel Piping of Boiling Water Reactor Plants," October 1975.
| |
| : 5. UFSAR, Section 5.2.5.5.2.
| |
| : 6. UFSAR, Section 5.2.5.1.1.
| |
| LaSalle 1 and 2 B 3.4.7-9 Revision 53
| |
| | |
| RCS Specific Activity B 3.4.8 B 3.4 REACTOR COOLANT SYSTEM (RCS)
| |
| B 3.4.8 RCS Specific Activity BASES BACKGROUND During circulation, the reactor coolant acquires radioactive materials due to release of fission products from fuel leaks into the coolant and activation of corrosion products in the reactor coolant. These radioactive materials in the coolant can plate out in the RCS, and, at times, an accumulation will break away to spike the normal level of radioactivity.
| |
| The release of coolant during a Design Basis Accident (DBA) could send radioactive materials into the environment.
| |
| Limits on the maximum allowable level of radioactivity in the reactor coolant are established to ensure, in the event of a release of any radioactive material to the environment during a DBA, radiation doses are maintained within the limits of 10 CFR 100 (Ref. 1).
| |
| This LCO contains iodine specific activity limits. The iodine isotopic activities per gram of reactor coolant are expressed in terms of a DOSE EQUIVALENT I-131. The allowable levels are intended to limit the 2 hour radiation dose to an individual at the site boundary to a small fraction of the 10 CFR 100 limit.
| |
| APPLICABLE Analytical methods and assumptions involving radioactive SAFETY ANALYSES material in the primary coolant are presented in the UFSAR (Ref. 2). The specific activity in the reactor coolant (the source term) is an initial condition for evaluation of the consequences of an accident due to a main steam line break (MSLB) outside containment. No fuel damage is postulated in the MSLB accident, and the release of radioactive material to the environment is assumed to end when the main steam isolation valves (MSIVs) close completely.
| |
| This MSLB release forms the basis for determining offsite doses (Ref. 2). The limits on the specific activity of the primary coolant ensure that the 2 hour thyroid and whole body doses at the site boundary, resulting from an MSLB (continued)
| |
| LaSalle 1 and 2 B 3.4.8-1 Revision 0
| |
| | |
| RCS Specific Activity B 3.4.8 BASES APPLICABLE outside containment during steady state operation, will not SAFETY ANALYSES exceed 10% of the dose guidelines of 10 CFR 100.
| |
| (continued)
| |
| The limit on specific activity is a value from a parametric evaluation of typical site locations. This limit is conservative because the evaluation considered more restrictive parameters than for a specific site, such as the location of the site boundary and the meteorological conditions of the site.
| |
| RCS specific activity satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The specific iodine activity is limited to 0.2 Ci/gm DOSE EQUIVALENT I-131. This limit ensures the source term assumed in the safety analysis for the MSLB is not exceeded, so any release of radioactivity to the environment during an MSLB is less than a small fraction of the 10 CFR 100 limits.
| |
| APPLICABILITY In MODE 1, and MODES 2 and 3 with any main steam line not isolated, limits on the primary coolant radioactivity are applicable since there is an escape path for release of radioactive material from the primary coolant to the environment in the event of an MSLB outside of primary containment.
| |
| In MODES 2 and 3 with the main steam lines isolated, such limits do not apply since an escape path does not exist. In MODES 4 and 5, no limits are required since the reactor is not pressurized and the potential for leakage is reduced.
| |
| ACTIONS A.1 and A.2 When the reactor coolant specific activity exceeds the LCO DOSE EQUIVALENT I-131 limit, but is 4.0 Ci/gm, samples must be analyzed for DOSE EQUIVALENT I-131 at least once every 4 hours. In addition, the specific activity must be restored to the LCO limit within 48 hours. The Completion Time of once every 4 hours is based on the time needed to take and analyze a sample. The 48 hour Completion Time to (continued)
| |
| LaSalle 1 and 2 B 3.4.8-2 Revision 0
| |
| | |
| RCS Specific Activity B 3.4.8 BASES ACTIONS A.1 and A.2 (continued) restore the activity level provides a reasonable time for temporary coolant activity increases (iodine spikes or crud bursts) to be cleaned up with the normal processing systems.
| |
| A Note permits the use of the provisions of LCO 3.0.4.c.
| |
| This allowance permits entry into the applicable MODE(S) while relying on the ACTIONS. This allowance is acceptable due to the significant conservatism incorporated into the specific activity limit, the low probability of an event which is limiting due to exceeding this limit, and the ability to restore transient specific activity excursions while the plant remains at, or proceeds to power operation.
| |
| B.1, B.2.1, B.2.2.1, and B.2.2.2 If the DOSE EQUIVALENT I-131 cannot be restored to 0.2 Ci/gm within 48 hours, or if at any time it is > 4.0 Ci/gm, it must be determined at least every 4 hours and all the main steam lines must be isolated within 12 hours.
| |
| Isolating the main steam lines precludes the possibility of releasing radioactive material to the environment in an amount that is more than a small fraction of the requirements of 10 CFR 100 during a postulated MSLB accident.
| |
| Alternately, the plant can be brought to MODE 3 within 12 hours and to MODE 4 within 36 hours. This option is provided for those instances when isolation of main steam lines is not desired (e.g., due to the decay heat loads).
| |
| In MODE 4, the requirements of the LCO are no longer applicable.
| |
| The Completion Time of once every 4 hours is the time needed to take and analyze a sample. The 12 hour Completion Time is reasonable, based on operating experience, to isolate the main steam lines in an orderly manner and without challenging plant systems. Also, the allowed Completion Times for Required Actions B.2.2.1 and B.2.2.2 for bringing the plant to MODES 3 and 4 are reasonable, based on (continued)
| |
| LaSalle 1 and 2 B 3.4.8-3 Revision 19
| |
| | |
| RCS Specific Activity B 3.4.8 BASES ACTIONS B.1, B.2.1, B.2.2.1, and B.2.2.2 (continued) operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
| |
| SURVEILLANCE SR 3.4.8.1 REQUIREMENTS This Surveillance is performed to ensure iodine remains within limit during normal operation. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by a Note that requires this Surveillance to be performed only in MODE 1 because the level of fission products generated in other MODES is much less.
| |
| REFERENCES 1. 10 CFR 100.11.
| |
| : 2. UFSAR, Section 15.6.4.5.
| |
| LaSalle 1 and 2 B 3.4.8-4 Revision 51
| |
| | |
| RHR Shutdown Cooling SystemHot Shutdown B 3.4.9 B 3.4 REACTOR COOLANT SYSTEM (RCS)
| |
| B 3.4.9 Residual Heat Removal (RHR) Shutdown Cooling SystemHot Shutdown BASES BACKGROUND Irradiated fuel in the shutdown reactor core generates heat during the decay of fission products and increases the temperature of the reactor coolant. This decay heat must be removed to reduce the temperature of the reactor coolant to d 200qF in preparation for performing Refueling or Cold Shutdown maintenance operations, or the decay heat must be removed for maintaining the reactor in the Hot Shutdown condition.
| |
| The two redundant, manually controlled shutdown cooling subsystems of the RHR System provide decay heat removal.
| |
| Each loop consists of a motor driven pump, a heat exchanger, and associated piping and valves. Both loops have a common suction from the same recirculation loop. Each pump discharges the reactor coolant, after circulation through the respective heat exchanger, to the reactor via the associated recirculation loop. The RHR heat exchangers transfer heat to the Residual Heat Removal Service Water System (LCO 3.7.1, "Residual Heat Removal Service Water (RHRSW) System").
| |
| APPLICABLE Decay heat removal by the RHR System in the shutdown cooling SAFETY ANALYSES mode is not required for mitigation of any event or accident evaluated in the safety analyses. Decay heat removal is, however, an important safety function that must be accomplished or core damage could result.
| |
| The RHR Shutdown Cooling System meets Criterion 4 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO Two RHR shutdown cooling subsystems are required to be OPERABLE, and, when no recirculation pump is in operation, one shutdown cooling subsystem must be in operation. An OPERABLE RHR shutdown cooling subsystem consists of one OPERABLE RHR pump, one heat exchanger, and the associated piping and valves. Each shutdown cooling subsystem is considered OPERABLE if it can be manually aligned (remote or (continued)
| |
| LaSalle 1 and 2 B 3.4.9-1 Revision 0
| |
| | |
| RHR Shutdown Cooling SystemHot Shutdown B 3.4.9 BASES LCO local) in the shutdown cooling mode for removal of decay (continued) heat. In MODE 3, one RHR shutdown cooling subsystem can provide the required cooling, but two subsystems are required to be OPERABLE to provide redundancy. Operation of one subsystem can maintain or reduce the reactor coolant temperature as required. To ensure adequate core flow to allow for accurate average reactor coolant temperature monitoring, nearly continuous operation is required.
| |
| Management of gas voids is important to RHR Shutdown Cooling System OPERABILITY.
| |
| Note 1 permits both RHR shutdown cooling subsystems and recirculation pumps to not be in operation for a period of 2 hours in an 8 hour period. Note 2 allows one RHR shutdown cooling subsystem to be inoperable for up to 2 hours for performance of surveillance tests. These tests may be on the affected RHR System or on some other plant system or component that necessitates placing the RHR System in an inoperable status during the performance. This is permitted because the core heat generation can be low enough and the heatup rate slow enough to allow some changes to the RHR subsystems or other operations requiring RHR flow interruption and loss of redundancy.
| |
| APPLICABILITY In MODE 3 with reactor vessel pressure below the RHR cut in permissive pressure (i.e., the actual pressure at which the interlock resets) the RHR Shutdown Cooling System must be OPERABLE and one RHR shutdown cooling subsystem shall be operated in the shutdown cooling mode to remove decay heat to reduce or maintain coolant temperature. With an RHR shutdown cooling subsystem not in operation, a recirculation pump is required to be in operation.
| |
| In MODES 1 and 2, and in MODE 3 with reactor vessel pressure greater than or equal to the RHR cut-in permissive pressure, this LCO is not applicable. Operation of the RHR System in the shutdown cooling mode is not allowed above this pressure because the RCS pressure may exceed the design pressure of the shutdown cooling piping. Decay heat removal at reactor pressures greater than or equal to the RHR cut-in permissive pressure is typically accomplished by condensing the steam in the main condenser. Additionally, in MODE 2, the OPERABILITY requirements for the Emergency Core Cooling Systems (ECCS) (LCO 3.5.1, "ECCSOperating") do not allow placing the RHR shutdown cooling subsystem into operation.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.4.9-2 Revision 60
| |
| | |
| RHR Shutdown Cooling SystemHot Shutdown B 3.4.9 BASES APPLICABILITY The requirements for decay heat removal in MODES 4 and 5 are (continued) discussed in LCO 3.4.10, "Residual Heat Removal (RHR)
| |
| Shutdown Cooling SystemCold Shutdown"; LCO 3.9.8, "Residual Heat Removal (RHR)High Water Level"; and LCO 3.9.9, "Residual Heat Removal (RHR)Low Water Level."
| |
| ACTIONS A Note has been provided to modify the ACTIONS related to RHR shutdown cooling subsystems. Section 1.3, Completion Times, specifies once a Condition has been entered, subsequent divisions, subsystems, components or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable shutdown cooling subsystems provide appropriate compensatory measures for separate inoperable shutdown cooling subsystems. As such, a Note has been provided that allows separate Condition entry for each inoperable RHR shutdown cooling subsystem.
| |
| A.1 With one RHR shutdown cooling subsystem inoperable for decay heat removal, except as permitted by LCO Note 2, the overall reliability is reduced, however, because a single failure in the OPERABLE subsystem could result in reduced RHR shutdown cooling capability. Therefore an alternate method of decay heat removal must be provided.
| |
| With both RHR shutdown cooling subsystems inoperable, an alternate method of decay heat removal must be provided in addition to that provided for the initial RHR shutdown cooling subsystem inoperability. This re-establishes backup decay heat removal capabilities, similar to the requirements of the LCO. The 1 hour Completion Time is based on the decay heat removal function and the probability of a loss of the available decay heat removal capabilities. Furthermore, verification of the functional availability of these alternate method(s) must be reconfirmed every 24 hours thereafter. This will provide assurance of continued heat removal capability.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.4.9-3 Revision 87
| |
| | |
| RHR Shutdown Cooling SystemHot Shutdown B 3.4.9 BASES ACTIONS A.1 (continued)
| |
| The required cooling capacity of the alternate method should be sufficient to maintain or reduce temperature. Decay heat removal by ambient losses can be considered as, or contributing to, the alternate method capability. Alternate methods that can be used include (but are not limited to) the Condensate/Feed and Main Steam Systems, the Reactor Water Cleanup System (by itself or using feed and bleed in combination with the Control Rod Drive System or Condensate/Feed System), a combination of an ECCS pump and S/RVs, or an inoperable but functional RHR shutdown cooling subsystem.
| |
| B.1 If the required alternate method(s) of decay heat removal cannot be verified within one hour, immediate action must be taken to restore the inoperable RHR shutdown cooling subsystem(s) to OPERABLE status. The Required Action will restore redundant decay heat removal paths. The immediate Completion Time reflects the importance of maintaining the availability of two paths for heat removal.
| |
| C.1, C.2, and C.3 With no RHR shutdown cooling subsystem and no recirculation pump in operation, except as is permitted by LCO Note 1, reactor coolant circulation by the RHR shutdown cooling subsystem or one recirculation pump must be restored without delay.
| |
| Until RHR or recirculation pump operation is re-established, an alternate method of reactor coolant circulation must be placed into service. This will provide the necessary circulation for monitoring coolant temperature. The 1 hour Completion Time is based on the coolant circulation function and is modified such that the 1 hour is applicable (continued)
| |
| LaSalle 1 and 2 B 3.4.9-4 Revision 87
| |
| | |
| RHR Shutdown Cooling SystemHot Shutdown B 3.4.9 BASES ACTIONS C.1, C.2, and C.3 (continued) separately for each occurrence involving a loss of coolant circulation. Furthermore, verification of the functioning of the alternate method must be reconfirmed every 12 hours thereafter. This will provide assurance of continued temperature monitoring capability.
| |
| During the period when the reactor coolant is being circulated by an alternate method (other than by the required RHR shutdown cooling subsystem or recirculation pump), the reactor coolant temperature and pressure must be periodically monitored to ensure proper function of the alternate method. The once per hour Completion Time is deemed appropriate.
| |
| SURVEILLANCE SR 3.4.9.1 REQUIREMENTS This Surveillance verifies that one RHR shutdown cooling subsystem or recirculation pump is in operation and circulating reactor coolant. The required flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This Surveillance is modified by a Note allowing sufficient time to align the RHR System for shutdown cooling operation after clearing the pressure interlock that isolates the system, or for placing a recirculation pump in operation.
| |
| The Note takes exception to the requirements of the Surveillance being met (i.e., forced coolant circulation is not required for this initial 2 hour period), which also allows entry into the Applicability of this Specification in accordance with SR 3.0.4 since the Surveillance will not be "not met" at the time of entry into the Applicability.
| |
| SR 3.4.9.2 RHR Shutdown Cooling System piping and components have the potential to develop voids and pockets of entrained gases.
| |
| Preventing and managing gas intrusion and accumulation is necessary for proper operation of the RHR shutdown cooling subsystems and may also prevent water hammer, pump (continued)
| |
| LaSalle 1 and 2 B 3.4.9-5 Revision 87
| |
| | |
| RHR Shutdown Cooling SystemHot Shutdown B 3.4.9 BASES SURVEILLANCE SR 3.4.9.2 (continued)
| |
| REQUIREMENTS cavitation, and pumping of noncondensible gas into the reactor vessel.
| |
| Selection of RHR Shutdown Cooling System locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.
| |
| The RHR Shutdown Cooling System is OPERABLE when it is sufficiently filled with water. Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criteria for gas volume at the suction or discharge of a pump), the Surveillance is not met. If it is determined by subsequent evaluation that the RHR Shutdown Cooling System is not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water), the Surveillance may be declared met.
| |
| Accumulated gas should be eliminated or brought within the acceptance criteria limits.
| |
| RHR Shutdown Cooling System locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative subset of susceptible locations. Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum (continued)
| |
| LaSalle 1 and 2 B 3.4.9-6 Revision 60
| |
| | |
| RHR Shutdown Cooling SystemHot Shutdown B 3.4.9 BASES SURVEILLANCE SR 3.4.9.2 (continued)
| |
| REQUIREMENTS potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.
| |
| This SR is modified by a Note that states the SR is not required to be performed until 12 hours after reactor steam dome pressure is less than the RHR cut in permissive pressure. In a rapid shutdown, there may be insufficient time to verify all susceptible locations prior to entering the Applicability.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation.
| |
| REFERENCES None.
| |
| LaSalle 1 and 2 B 3.4.9-7 Revision 60
| |
| | |
| RHR Shutdown Cooling SystemCold Shutdown B 3.4.10 B 3.4 REACTOR COOLANT SYSTEM (RCS)
| |
| B 3.4.10 Residual Heat Removal (RHR) Shutdown Cooling SystemCold Shutdown BASES BACKGROUND Irradiated fuel in the shutdown reactor core generates heat during the decay of fission products and increases the temperature of the reactor coolant. This decay heat must be removed to maintain the temperature of the reactor coolant at d 200qF in preparation for performing refueling maintenance operations, or the decay heat must be removed for maintaining the reactor in the Cold Shutdown condition.
| |
| The two redundant, manually controlled shutdown cooling subsystems of the RHR System provide decay heat removal.
| |
| Each loop consists of a motor driven pump, a heat exchanger, and associated piping and valves. Both loops have a common suction from the same recirculation loop. Each pump discharges the reactor coolant, after circulation through the respective heat exchanger, to the reactor via separate feedwater lines or to the reactor via the associated recirculation loop. The RHR heat exchangers transfer heat to the Residual Heat Removal Service Water (RHRSW) System.
| |
| APPLICABLE Decay heat removal by the RHR System in the shutdown cooling SAFETY ANALYSES mode is not required for mitigation of any event or accident evaluated in the safety analyses. Decay heat removal is, however, an important safety function that must be accomplished or core damage could result.
| |
| The RHR Shutdown Cooling System meets Criterion 4 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO Two RHR shutdown cooling subsystems are required to be OPERABLE, and, when no recirculation pump is in operation, one RHR shutdown cooling subsystem must be in operation. An OPERABLE RHR shutdown cooling subsystem consists of one OPERABLE RHR pump, one heat exchanger, the necessary portions of the RHRSW System and Ultimate Heat Sink capable of providing cooling to the heat exchanger, and the associated piping and valves. Each shutdown cooling (continued)
| |
| LaSalle 1 and 2 B 3.4.10-1 Revision 0
| |
| | |
| RHR Shutdown Cooling SystemCold Shutdown B 3.4.10 BASES LCO subsystem is considered OPERABLE if it can be manually (continued) aligned (remote or local) in the shutdown cooling mode for removal of decay heat. In MODE 4, one RHR shutdown cooling subsystem can provide the required cooling, but two subsystems are required to be OPERABLE to provide redundancy. Operation of one subsystem can maintain and reduce the reactor coolant temperature as required. To ensure adequate core flow to allow for accurate average reactor coolant temperature monitoring, nearly continuous operation is required. Management of gas voids is important to RHR Shutdown Cooling System OPERABILITY.
| |
| Note 1 allows both RHR shutdown cooling subsystems to be inoperable during hydrostatic testing. This is allowed since the RHR Shutdown Cooling System is not designed to operate at the Reactor Coolant System pressures achieved during hydrostatic testing. This is acceptable since adequate reactor coolant circulation will be achieved by operation of a reactor recirculation pump and since systems are available to control reactor coolant temperature.
| |
| Note 2 permits both RHR shutdown cooling subsystems and recirculation pumps to not be in operation for a period of 2 hours in an 8 hour period. Note 3 allows one RHR shutdown cooling subsystem to be inoperable for up to 2 hours for performance of surveillance tests. These tests may be on the affected RHR System or on some other plant system or component that necessitates placing the RHR System in an inoperable status during the performance. This is permitted because the core heat generation can be low enough and the heatup rate slow enough to allow some changes to the RHR subsystems or other operations requiring RHR flow interruption and loss of redundancy.
| |
| APPLICABILITY In MODE 4, the RHR Shutdown Cooling System must be OPERABLE and one RHR shutdown cooling subsystem shall be operated in the shutdown cooling mode to remove decay heat to maintain coolant temperature below 200qF. With an RHR shutdown cooling subsystem not in operation, a recirculation pump is required to be in operation.
| |
| In MODES 1 and 2, and in MODE 3 with reactor vessel pressure greater than or equal to the RHR cut-in permissive pressure, this LCO is not applicable. Operation of the RHR System in the shutdown cooling mode is not allowed above this (continued)
| |
| LaSalle 1 and 2 B 3.4.10-2 Revision 60
| |
| | |
| RHR Shutdown Cooling SystemCold Shutdown B 3.4.10 BASES APPLICABILITY pressure because the RCS pressure may exceed the design (continued) pressure of the shutdown cooling piping. Decay heat removal at reactor pressures greater than or equal to the RHR cut-in permissive pressure is typically accomplished by condensing the steam in the main condenser. Additionally, in MODE 2 below this pressure, the OPERABILITY requirements for the Emergency Core Cooling Systems (ECCS) (LCO 3.5.1, "ECCS-Operating") do not allow placing the RHR shutdown cooling subsystem into operation.
| |
| The requirements for decay heat removal in MODE 3 below the cut-in permissive pressure and in MODE 5 are discussed in LCO 3.4.9, "Residual Heat Removal (RHR) Shutdown Cooling SystemHot Shutdown"; LCO 3.9.8, "Residual Heat Removal (RHR)High Water Level"; and LCO 3.9.9, "Residual Heat Removal (RHR)Low Water Level."
| |
| ACTIONS A Note has been provided to modify the ACTIONS related to RHR shutdown cooling subsystems. Section 1.3, Completion Times, specifies once a Condition has been entered, subsequent divisions, subsystems, components or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable shutdown cooling subsystems provide appropriate compensatory measures for separate inoperable shutdown cooling subsystems. As such, a Note has been provided that allows separate Condition entry for each inoperable RHR shutdown cooling subsystem.
| |
| A.1 With one of the two RHR shutdown cooling subsystems inoperable, except as permitted by LCO Notes 1 and 3, the remaining subsystem is capable of providing the required decay heat removal. However, the overall reliability is reduced. Therefore, an alternate method of decay heat removal must be provided. With both RHR shutdown cooling subsystems inoperable, an alternate method of decay heat (continued)
| |
| LaSalle 1 and 2 B 3.4.10-3 Revision 13
| |
| | |
| RHR Shutdown Cooling SystemCold Shutdown B 3.4.10 BASES ACTIONS A.1 (continued) removal must be provided in addition to that provided for the initial RHR shutdown cooling subsystem inoperability.
| |
| This re-establishes backup decay heat removal capabilities, similar to the requirements of the LCO. The 1 hour Completion Time is based on the decay heat removal function and the probability of a loss of the available decay heat removal capabilities. Furthermore, verification of the functional availability of these alternate method(s) must be reconfirmed every 24 hours thereafter. This will provide assurance of continued heat removal capability.
| |
| The required cooling capacity of the alternate method should be sufficient to maintain or reduce temperature. Decay heat removal by ambient losses can be considered as, or contributing to, the alternate method capability. Alternate methods that can be used include (but are not limited to) the Condensate/Feed and Main Steam Systems, the Reactor Water Cleanup System (by itself or using feed and bleed in combination with the Control Rod Drive System or Condensate/Feed System), a combination of an ECCS pump and S/RVs, or an inoperable but functional RHR shutdown cooling subsystem.
| |
| B.1 If the required alternate method(s) of decay heat removal cannot be verified within one hour, immediate action must be taken to restore the inoperable RHR shutdown cooling subsystem(s) to OPERABLE status. The Required Action will restore redundant decay heat removal paths. The immediate Completion Time reflects the importance of maintaining the availability of two paths for heat removal.
| |
| C.1 and C.2 With no RHR shutdown cooling subsystem and no recirculation pump in operation, except as is permitted by LCO Notes 1 and 2, and until RHR or recirculation pump operation is re-established, an alternate method of reactor coolant circulation must be placed into service. This will provide the necessary circulation for monitoring coolant (continued)
| |
| LaSalle 1 and 2 B 3.4.10-4 Revision 87
| |
| | |
| RHR Shutdown Cooling SystemCold Shutdown B 3.4.10 BASES ACTIONS C.1 and C.2 (continued) temperature. The 1 hour Completion Time is based on the coolant circulation function and is modified such that the 1 hour is applicable separately for each occurrence involving a loss of coolant circulation. Furthermore, verification of the functioning of the alternate method must be reconfirmed every 12 hours thereafter. This will provide assurance of continued temperature monitoring capability.
| |
| During the period when the reactor coolant is being circulated by an alternate method (other than by the required RHR shutdown cooling subsystem or recirculation pump), the reactor coolant temperature and pressure must be periodically monitored to ensure proper function of the alternate method. The once per hour Completion Time is deemed appropriate.
| |
| SURVEILLANCE SR 3.4.10.1 REQUIREMENTS This Surveillance verifies that one RHR shutdown cooling subsystem or recirculation pump is in operation and circulating reactor coolant. The required flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.4.10.2 RHR Shutdown Cooling System piping and components have the potential to develop voids and pockets of entrained gases.
| |
| Preventing and managing gas intrusion and accumulation is necessary for proper operation of the RHR shutdown cooling subsystems and may also prevent water hammer, pump cavitation, and pumping of noncondensible gas into the reactor vessel.
| |
| Selection of RHR Shutdown Cooling System locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and (continued)
| |
| LaSalle 1 and 2 B 3.4.10-5 Revision 87
| |
| | |
| RHR Shutdown Cooling SystemCold Shutdown B 3.4.10 BASES SURVEILLANCE SR 3.4.10.2 (continued)
| |
| REQUIREMENTS elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.
| |
| The RHR Shutdown Cooling System is OPERABLE when it is sufficiently filled with water. Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criteria for gas volume at the suction or discharge of a pump), the Surveillance is not met. If it is determined by subsequent evaluation that the RHR Shutdown Cooling System is not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water), the Surveillance may be declared met.
| |
| Accumulated gas should be eliminated or brought within the acceptance criteria limits.
| |
| RHR Shutdown Cooling System locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative subset of susceptible locations. Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.4.10-6 Revision 87
| |
| | |
| RHR Shutdown Cooling SystemCold Shutdown B 3.4.10 BASES SURVEILLANCE SR 3.4.10.2 (continued)
| |
| REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation.
| |
| REFERENCES None.
| |
| LaSalle 1 and 2 B 3.4.10-7 Revision 87
| |
| | |
| RCS P/T Limits B 3.4.11 B 3.4 REACTOR COOLANT SYSTEM (RCS)
| |
| B 3.4.11 RCS Pressure and Temperature (P/T) Limits BASES BACKGROUND All components of the RCS are designed to withstand effects of cyclic loads due to system pressure and temperature changes. These loads are introduced by startup (heatup) and shutdown (cooldown) operations, power transients, and reactor trips. This LCO limits the pressure and temperature changes during RCS heatup and cooldown, within the design assumptions and the stress limits for cyclic operation.
| |
| The Specification contains P/T limit curves for heatup, cooldown, inservice leak and hydrostatic testing, and criticality and also limits the maximum rate of change of reactor coolant temperature. The P/T limit curves are applicable for 32 effective full power years.
| |
| Each P/T limit curve defines an acceptable region for normal operation. The usual use of the curves is operational guidance during heatup or cooldown maneuvering, when pressure and temperature indications are monitored and compared to the applicable curve to determine that operation is within the allowable region.
| |
| The LCO establishes operating limits that provide a margin to brittle failure of the reactor vessel and piping of the reactor coolant pressure boundary (RCPB). The vessel is the component most subject to brittle failure. Therefore, the LCO limits apply mainly to the vessel.
| |
| 10 CFR 50, Appendix G (Ref. 1), requires the establishment of P/T limits for material fracture toughness requirements of the RCPB materials. Reference 1 requires an adequate margin to brittle failure during normal operation, anticipated operational occurrences, and system hydrostatic tests. It mandates the use of the American Society of Mechanical Engineers (ASME) Code, Section III, Appendix G (Ref. 2).
| |
| The actual shift in the RTNDT of the vessel material will be established periodically by removing and evaluating the irradiated reactor vessel material specimens, in accordance with ASTM E 185 (Ref. 3) and 10 CFR 50, Appendix H (continued)
| |
| LaSalle 1 and 2 B 3.4.11-1 Revision 50
| |
| | |
| RCS P/T Limits B 3.4.11 BASES BACKGROUND (Ref. 4). The operating P/T limit curves will be adjusted, (continued) as necessary, based on the evaluation findings and the recommendations of Reference 5.
| |
| The P/T limit curves are composite curves established by superimposing limits derived from stress analyses of those portions of the reactor vessel and head that are the most restrictive. At any specific pressure, temperature, and temperature rate of change, one location within the reactor vessel will dictate the most restrictive limit. Across the span of the P/T limit curves, different locations are more restrictive, and, thus, the curves are composites of the most restrictive regions.
| |
| The non-nuclear heatup and cooldown curve applies during heatups with non-nuclear heat (e.g., recirculation pump heat) and during cooldowns when the reactor is not critical (e.g., following a scram). The curve provides the minimum reactor vessel metal temperatures based on the most limiting vessel stress.
| |
| The P/T criticality limits include the Reference 1 requirement that they be at least 40!F above the non-critical heatup curve or the cooldown curve and not lower than the minimum permissible temperature for the inservice leak and hydrostatic testing.
| |
| The consequence of violating the LCO limits is that the RCS has been operated under conditions that can result in brittle failure of the RCPB, possibly leading to a nonisolable leak or loss of coolant accident. In the event these limits are exceeded, an evaluation must be performed to determine the effect on the structural integrity of the RCPB components. The ASME Code, Section XI, Appendix E (Ref. 6), provides a recommended methodology for evaluating an operating event that causes an excursion outside the limits.
| |
| APPLICABLE The P/T limits are not derived from Design Basis Accident SAFETY ANALYSES (DBA) analyses. They are prescribed during normal operation to avoid encountering pressure, temperature, and temperature rate of change conditions that might cause undetected flaws to propagate and cause nonductile failure of the RCPB, a condition that is unanalyzed. Reference 5 establishes the methodology for determining the P/T limits. Since the (continued)
| |
| LaSalle 1 and 2 B 3.4.11-2 Revision 16
| |
| | |
| RCS P/T Limits B 3.4.11 BASES APPLICABLE P/T limits are not derived from any DBA, there are no SAFETY ANALYSES acceptance limits related to the P/T limits. Rather, the (continued) P/T limits are acceptance limits themselves since they preclude operation in an unanalyzed condition.
| |
| RCS P/T limits satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The elements of this LCO are:
| |
| : a. RCS pressure and temperature are within the limits specified in Figures 3.4.11-1, 3.4.11-2, 3.4.11-3, 3.4.11-4, 3.4.11-5, and 3.4.11-6, heatup and cooldown rates are 100!F in any 1 hour period during RCS heatup, cooldown, and inservice leak and hydrostatic testing, and the RCS temperature change during system leakage and hydrostatic testing is 20!F in any 1 hour period when the RCS temperature and pressure are not within the limits of Figure 3.4.11-2 and 3.4.11-5 as applicable;
| |
| : b. The temperature difference between the reactor vessel bottom head coolant and the reactor pressure vessel (RPV) coolant is 145!F during recirculation pump startup in MODES 1, 2, 3, and 4;
| |
| : c. The temperature difference between the reactor coolant in the respective recirculation loop and in the reactor vessel is 50!F during recirculation pump startup in MODES 1, 2, 3, and 4;
| |
| : d. RCS pressure and temperature are within the applicable criticality limits specified in Figures 3.4.11-3 and 3.4.11-6, prior to achieving criticality; and
| |
| : e. The reactor vessel flange and the head flange temperatures are # 72!F for Unit 1 and # 86!F for Unit 2 when tensioning the reactor vessel head bolting studs and when the reactor head is tensioned.
| |
| These limits define allowable operating regions and permit a large number of operating cycles while also providing a wide margin to nonductile failure.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.4.11-3 Revision 13
| |
| | |
| RCS P/T Limits B 3.4.11 BASES LCO The rate of change of temperature limits control the (continued) thermal gradient through the vessel wall and are used as inputs for calculating the heatup, cooldown, and inservice leak and hydrostatic testing P/T limit curves. Thus, the LCO for the rate of change of temperature restricts stresses caused by thermal gradients and also ensures the validity of the P/T limit curves.
| |
| Violation of the limits places the reactor vessel outside of the bounds of the stress analyses and can increase stresses in other RCS components. The consequences depend on several factors, as follows:
| |
| : a. The severity of the departure from the allowable operating pressure temperature regime or the severity of the rate of change of temperature;
| |
| : b. The length of time the limits were violated (longer violations allow the temperature gradient in the thick vessel walls to become more pronounced); and
| |
| : c. The existence, size, and orientation of flaws in the vessel material.
| |
| APPLICABILITY The potential for violating a P/T limit exists at all times.
| |
| For example, P/T limit violations could result from ambient temperature conditions that result in the reactor vessel metal temperature being less than the minimum allowed temperature for boltup. Therefore, this LCO is applicable even when fuel is not loaded in the core.
| |
| ACTIONS A.1 and A.2 Operation outside the P/T limits while in MODE 1, 2, or 3 must be corrected so that the RCPB is returned to a condition that has been verified by stress analyses.
| |
| The 30 minute Completion Time reflects the urgency of restoring the parameters to within the analyzed range. Most violations will not be severe, and the activity can be accomplished in this time in a controlled manner.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.4.11-4 Revision 0
| |
| | |
| RCS P/T Limits B 3.4.11 BASES ACTIONS A.1 and A.2 (continued)
| |
| Besides restoring operation within limits, an engineering evaluation is required to determine if RCS operation can continue. The evaluation must verify the RCPB integrity remains acceptable and must be completed if continued operation is desired. Several methods may be used, including comparison with pre-analyzed transients in the stress analyses, new analyses, or inspection of the components. ASME Code, Section XI, Appendix E (Ref. 6), may be used to support the evaluation. However, its use is restricted to evaluation of the vessel beltline.
| |
| The 72 hour Completion Time is reasonable to accomplish the evaluation of a mild violation. More severe violations may require special, event specific stress analyses or inspections. A favorable evaluation must be completed if continued operation is desired.
| |
| Condition A is modified by a Note requiring Required Action A.2 be completed whenever the Condition is entered.
| |
| The Note emphasizes the need to perform the evaluation of the effects of the excursion outside the allowable limits.
| |
| Restoration alone per Required Action A.1 is insufficient because higher than analyzed stresses may have occurred and may have affected the RCPB integrity.
| |
| B.1 and B.2 If a Required Action and associated Completion Time of Condition A are not met, the plant must be brought to a lower MODE because either the RCS remained in an unacceptable P/T region for an extended period of increased stress, or a sufficiently severe event caused entry into an unacceptable region. Either possibility indicates a need for more careful examination of the event, best accomplished with the RCS at reduced pressure and temperature. With the reduced pressure and temperature conditions, the possibility of propagation of undetected flaws is decreased.
| |
| Pressure and temperature are reduced by bringing the plant to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, (continued)
| |
| LaSalle 1 and 2 B 3.4.11-5 Revision 0
| |
| | |
| RCS P/T Limits B 3.4.11 BASES ACTIONS B.1 and B.2 (continued) based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
| |
| C.1 and C.2 Operation outside the P/T limits in other than MODES 1, 2, and 3 (including defueled conditions) must be corrected so that the RCPB is returned to a condition that has been verified by stress analyses. The Required Action must be initiated without delay and continued until the limits are restored.
| |
| Besides restoring the P/T limit parameters to within limits, an engineering evaluation is required to determine if RCS operation is allowed. This evaluation must verify that the RCPB integrity is acceptable and must be completed before approaching criticality or heating up to > 200!F. Several methods may be used, including comparison with pre-analyzed transients, new analyses, or inspection of the components.
| |
| ASME Section XI, Appendix E (Ref. 6), may be used to support the evaluation; however, its use is restricted to evaluation of the beltline.
| |
| Condition C is modified by a Note requiring Required Action C.2 be completed whenever the Condition is entered. The Note emphasizes the need to perform the evaluation of the effects of the excursion outside the allowable limits.
| |
| Restoration alone per Required Action C.1 is insufficient because higher than analyzed stresses may have occurred and may have affected the RCPB integrity.
| |
| SURVEILLANCE SR 3.4.11.1 REQUIREMENTS Verification that operation is within limits is required when RCS pressure and temperature conditions are undergoing planned changes. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.4.11-6 Revision 51
| |
| | |
| RCS P/T Limits B 3.4.11 BASES SURVEILLANCE SR 3.4.11.1 (continued)
| |
| REQUIREMENTS The limits of Figures 3.4.11-1, 3.4.11-2, 3.4.11-3, 3.4.11-4, 3.4.11-5, and 3.4.11-6 are met when operation is to the right of the applicable curve.
| |
| Surveillance for heatup, cooldown, or inservice leak and hydrostatic testing may be discontinued when the criteria given in the relevant plant procedure for ending the activity are satisfied.
| |
| This SR has been modified by a Note that requires this Surveillance to be performed only during system heatup and cooldown operations and inservice leak and hydrostatic testing.
| |
| SR 3.4.11.2 A separate limit is used when the reactor is approaching criticality. Consequently, the RCS pressure and temperature must be verified within the appropriate limits before withdrawing control rods that will make the reactor critical. The limits of Figures 3.4.11-3 and 3.4.11-6 are met when operation is to the right of the applicable curve.
| |
| Performing the Surveillance within 15 minutes before control rod withdrawal for the purpose of achieving criticality provides adequate assurance that the limits will not be exceeded between the time of the Surveillance and the time of the control rod withdrawal.
| |
| SR 3.4.11.3 and SR 3.4.11.4 Differential temperatures within the applicable limits ensure that thermal stresses resulting from the startup of an idle recirculation pump will not exceed design allowances. In addition, compliance with these limits ensures that the assumptions of the analysis for the startup of an idle recirculation loop (Ref. 8) are satisfied.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.4.11-7 Revision 51
| |
| | |
| RCS P/T Limits B 3.4.11 BASES SURVEILLANCE SR 3.4.11.3 and SR 3.4.11.4 (continued)
| |
| REQUIREMENTS Performing the Surveillance within 15 minutes before starting the idle recirculation pump provides adequate assurance that the limits will not be exceeded between the time of the Surveillance and the time of the idle pump start.
| |
| An acceptable means of demonstrating compliance with the temperature differential requirement in SR 3.4.11.3 is to compare temperatures of the reactor pressure vessel steam space coolant and the bottom head drain line coolant.
| |
| An acceptable means of demonstrating compliance with the temperature differential requirement in SR 3.4.11.4 is to compare the temperatures of the operating recirculation loop and the idle loop.
| |
| SR 3.4.11.3 and SR 3.4.11.4 have been modified by a Note that requires the Surveillance to be met only in MODES 1, 2, 3, and 4 during a recirculation pump startup since this is when the stresses occur. In MODE 5, the overall stress on limiting components is lower; therefore, T limits are not required.
| |
| SR 3.4.11.5, SR 3.4.11.6, and SR 3.4.11.7 Limits on the reactor vessel flange and head flange temperatures are generally bounded by the other P/T limits during system heatup and cooldown. However, operations approaching MODE 4 from MODE 5 and in MODE 4 with RCS temperature less than or equal to certain specified values require assurance that these temperatures meet the LCO limits.
| |
| The flange temperatures must be verified to be above the limits before and periodically while tensioning the vessel head bolting studs to ensure that once the head is tensioned the limits are satisfied. When in MODE 4 with RCS temperature 77!F for Unit 1 and 91!F for Unit 2, checks of the flange temperatures are required because of the reduced margin to the limits. When in MODE 4 with RCS temperature 92!F for (continued)
| |
| LaSalle 1 and 2 B 3.4.11-8 Revision 51
| |
| | |
| RCS P/T Limits B 3.4.11 BASES SURVEILLANCE SR 3.4.11.5, SR 3.4.11.6, and SR 3.4.11.7 (continued)
| |
| REQUIREMENTS Unit 1 and 106!F for Unit 2, monitoring of the flange temperature is required to ensure the temperatures are within the specified limits.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.4.11.5 is modified by a Note that requires the Surveillance to be performed only when tensioning the reactor vessel head bolting studs. SR 3.4.11.6 is modified by a Note that requires the Surveillance to be initiated 30 minutes after RCS temperature 77!F for Unit 1 and 91!F for Unit 2 in MODE 4, SR 3.4.11.7 is modified by a Note that requires the Surveillance to be initiated 12 hours after RCS temperature 92!F for Unit 1 and 106!F for Unit 2 in MODE 4. The Notes contained in these SRs are necessary to specify when the reactor vessel flange and head flange temperatures are required to be verified to be within the specified limits.
| |
| REFERENCES 1. 10 CFR 50, Appendix G.
| |
| : 2. ASME, Boiler and Pressure Vessel Code, Section III, Appendix G.
| |
| : 3. ASTM E 185.
| |
| : 4. 10 CFR 50, Appendix H.
| |
| : 5. Regulatory Guide 1.99, Revision 2, May 1988.
| |
| : 6. ASME, Boiler and Pressure Vessel Code, Section XI, Appendix E.
| |
| : 7. UFSAR, Section 15.4.4.
| |
| LaSalle 1 and 2 B 3.4.11-9 Revision 51
| |
| | |
| Reactor Steam Dome Pressure B 3.4.12 B 3.4 REACTOR COOLANT SYSTEM (RCS)
| |
| B 3.4.12 Reactor Steam Dome Pressure BASES BACKGROUND The reactor steam dome pressure is an assumed value in the determination of compliance with reactor pressure vessel overpressure protection criteria and is also an assumed initial condition of Design Basis Accidents (DBAs) and transients.
| |
| APPLICABLE The reactor steam dome pressure of 1020 psig is an SAFETY ANALYSES initial condition of the vessel overpressure protection analysis of Reference 1. This analysis assumes an initial maximum reactor steam dome pressure and evaluates the response of the pressure relief system, primarily the safety/relief valves, during the limiting pressurization transient. The determination of compliance with the overpressure criteria is dependent on the initial reactor steam dome pressure; therefore, the limit on this pressure ensures that the assumptions of the overpressure protection analysis are conserved. Reference 2 also assumes an initial reactor steam dome pressure for the analysis of DBAs and transients used to determine the limits for fuel cladding integrity MCPR (see Bases for LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)") and 1% cladding plastic strain (see Bases for LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)" and LCO 3.2.3, "LINEAR HEAT GENERATION RATE (LHGR)"). The nominal reactor operating pressure is approximately 1005 psig. Transient analyses typically use the nominal or a design dome pressure as input to the analysis. Small deviations (5 to 10 psi) from the nominal pressure are not expected to change most of the transient analyses results. However, sensitivity studies for fast pressurization events (main turbine generator load rejection without bypass, turbine trip without bypass, and feedwater controller failure) indicate that the delta-CPR may increase for lower initial pressures. Therefore, the fast pressurization events have considered a bounding initial pressure based on a typical operating range to assure a conservative delta-CPR and operating limit.
| |
| Reactor steam dome pressure satisfies the requirements of Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.4.12-1 Revision 0
| |
| | |
| Reactor Steam Dome Pressure B 3.4.12 BASES (continued)
| |
| LCO The specified reactor steam dome pressure limit of 1020 psig ensures the plant is operated within the assumptions of the reactor overpressure analysis. Operation above the limit may result in a transient response more severe than analyzed.
| |
| APPLICABILITY In MODES 1 and 2, the reactor steam dome pressure is required to be less than or equal to the limit. In these MODES, the reactor may be generating significant steam, and events that may challenge the overpressure limits are possible.
| |
| In MODES 3, 4, and 5, the limit is not applicable because the reactor is shut down. In these MODES, the reactor pressure is well below the required limit, and no anticipated events will challenge the overpressure limits.
| |
| ACTIONS A.1 With the reactor steam dome pressure greater than the limit, prompt action should be taken to reduce pressure to below the limit and return the reactor to operation within the bounds of the analyses. The 15 minute Completion Time is reasonable considering the importance of maintaining the pressure within limits. This Completion Time also ensures that the probability of an accident while pressure is greater than the limit is minimal.
| |
| B.1 If the reactor steam dome pressure cannot be restored to within the limit within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. The allowed Completion Time of 12 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.4.12-2 Revision 0
| |
| | |
| Reactor Steam Dome Pressure B 3.4.12 BASES (continued)
| |
| SURVEILLANCE SR 3.4.12.1 REQUIREMENTS Verification that reactor steam dome pressure is 1020 psig ensures that the initial condition of the vessel overpressure protection analysis is met. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 5.2.2.2.1.
| |
| : 2. UFSAR, Chapter 15.
| |
| LaSalle 1 and 2 B 3.4.12-3 Revision 51
| |
| | |
| ECCSOperating B 3.5.1 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS), REACTOR PRESSURE VESSEL (RPV)
| |
| WATER INVENTORY CONTROL, AND REACTOR CORE ISOLATION COOLING (RCIC)
| |
| SYSTEM B 3.5.1 ECCSOperating BASES BACKGROUND The ECCS is designed, in conjunction with the primary and secondary containment, to limit the release of radioactive materials to the environment following a loss of coolant accident (LOCA). The ECCS uses two independent methods (flooding and spraying) to cool the core during a LOCA. The ECCS network is composed of the High Pressure Core Spray (HPCS) System, the Low Pressure Core Spray (LPCS) System, and the low pressure coolant injection (LPCI) mode of the Residual Heat Removal (RHR) System. The ECCS also consists of the Automatic Depressurization System (ADS). The suppression pool provides the required source of water for the ECCS.
| |
| On receipt of an initiation signal, ECCS pumps automatically start; the system aligns, and the pumps inject water, taken from the suppression pool, into the Reactor Coolant System (RCS) as RCS pressure is overcome by the discharge pressure of the ECCS pumps. Although the system is initiated, ADS action is delayed, allowing the operator to interrupt the timed sequence if the system is not needed. The HPCS pump discharge pressure almost immediately exceeds that of the RCS, and the pump injects coolant into the spray sparger above the core. If the break is small, HPCS will maintain coolant inventory, as well as vessel level, while the RCS is still pressurized. If HPCS fails, it is backed up by ADS in combination with LPCI and LPCS. In this event, the ADS timed sequence would be allowed to time out and open the selected safety/relief valves (S/RVs), depressurizing the RCS and allowing the LPCI and LPCS to overcome RCS pressure and inject coolant into the vessel. If the break is large, RCS pressure initially drops rapidly, and the LPCI and LPCS systems cool the core.
| |
| Water from the break returns to the suppression pool where it is used again and again. Water in the suppression pool is circulated through a heat exchanger cooled by the Residual Heat Removal Service Water (RHRSW) System.
| |
| Depending on the location and size of the break, portions of (continued)
| |
| LaSalle 1 and 2 B 3.5.1-1 Revision 76
| |
| | |
| ECCSOperating B 3.5.1 BASES BACKGROUND the ECCS may be ineffective; however, the overall design is (continued) effective in cooling the core regardless of the size or location of the piping break.
| |
| All ECCS subsystems are designed to ensure that no single active component failure will prevent automatic initiation and successful operation of the minimum required ECCS subsystems.
| |
| The LPCS System (Ref. 1) consists of a motor driven pump, a spray sparger above the core, piping, and valves to transfer water from the suppression pool to the sparger. The LPCS System is designed to provide cooling to the reactor core when the reactor pressure is low. Upon receipt of an initiation signal, the LPCS pump is automatically started when AC power is available. When the RPV pressure drops sufficiently, LPCS flow to the RPV begins. A full flow test line is provided to route water to the suppression pool to allow testing of the LPCS System without spraying water into the RPV.
| |
| LPCI is an independent operating mode of the RHR System.
| |
| There are three LPCI subsystems. Each LPCI subsystem (Ref. 2) consists of a motor driven pump, piping, and valves to transfer water from the suppression pool to the core.
| |
| Each LPCI subsystem has its own suction and discharge piping and separate vessel nozzle that connects with the core shroud through internal piping. The LPCI subsystems are designed to provide core cooling at low RPV pressure. Upon receipt of an initiation signal, each LPCI pump is automatically started. (If AC power is supplied by the diesel generators, C pump starts immediately when AC power is available and A and B pumps approximately 5 seconds after AC power is available). When the RPV pressure drops sufficiently, LPCI flow to the RPV begins. RHR System valves in the LPCI flow path are automatically positioned to ensure the proper flow path for water from the suppression pool to inject into the core. A full flow test line is provided to route water to the suppression pool to allow testing of each LPCI pump without injecting water into the RPV.
| |
| The HPCS System (Ref. 3) consists of a single motor driven pump, a spray sparger above the core, and piping and valves (continued)
| |
| LaSalle 1 and 2 B 3.5.1-2 Revision 0
| |
| | |
| ECCSOperating B 3.5.1 BASES BACKGROUND to transfer water from the suppression pool to the sparger.
| |
| (continued) The HPCS System is designed to provide core cooling over a wide range of RPV pressures (0 psid to 1200 psid, vessel to suction source). Upon receipt of an initiation signal, the HPCS pump automatically starts (when AC power is available) and valves in the flow path begin to open. Since the HPCS System is designed to operate over the full range of expected RPV pressures, HPCS flow begins as soon as the necessary valves are open. A full flow test line is provided to route water to the suppression pool to allow testing of the HPCS System during normal operation without spraying water into the RPV.
| |
| The ECCS pumps are provided with minimum flow bypass lines, which discharge to the suppression pool. The valves in these lines automatically open to prevent pump damage due to overheating when other discharge line valves are closed or RPV pressure is greater than the LPCS or LPCI pump discharge pressures following system initiation. To ensure rapid delivery of water to the RPV and to minimize water hammer effects, the ECCS discharge line "keep fill" systems are designed to maintain all pump discharge lines filled with water.
| |
| The ADS (Ref. 4) consists of 7 of the 13 S/RVs. It is designed to provide depressurization of the primary system during a small break LOCA if HPCS fails or is unable to maintain required water level in the RPV. ADS operation reduces the RPV pressure to within the operating pressure range of the low pressure ECCS subsystems (LPCS and LPCI),
| |
| so that these subsystems can provide core cooling.
| |
| The Drywell Pneumatic System discharges from the air receiver (or nitrogen receiver when the primary containment is inerted) and after filtration is divided into two supply headers, one of which supplies all the ADS accumulators with approximately 175 psig air (or nitrogen). There is a check valve between each ADS accumulator and the supply. Drywell Pneumatic System low header pressure and high ADS pressure are alarmed in the control room.
| |
| The accumulators for the ADS valves are normally maintained by the Drywell Pneumatic System compressors. There are two full-capacity compressors which cycle as needed to maintain (continued)
| |
| LaSalle 1 and 2 B 3.5.1-3 Revision 6
| |
| | |
| ECCSOperating B 3.5.1 BASES BACKGROUND pressure in the drywell pneumatic receiver tank. Nitrogen (continued) bottle banks provide a backup source to maintain the ADS accumulators charged following isolation of the normal pneumatic supply. Each bottle bank also has an additional reserve nitrogen bottle that can be valved in during the change out of the four bottles in the bottle bank. Each ADS accumulator is provided with a pressure switch to detect low pressure (< 150 psig). These pressure switches are provided with alarms in the control room. A control room alarm is also annunciated for low pressure in the ADS nitrogen bottle banks.
| |
| APPLICABLE The ECCS performance is evaluated for the entire spectrum of SAFETY ANALYSES break sizes for a postulated LOCA. The accidents for which ECCS operation is required are presented in References 5, 6, and 7. The required analyses and assumptions are defined in 10 CFR 50 (Ref. 8), and the results of these analyses are described in Reference 9.
| |
| This LCO helps to ensure that the following acceptance criteria for the ECCS, established by 10 CFR 50.46 (Ref. 10), will be met following a LOCA assuming the worst case single active component failure in the ECCS:
| |
| : a. Maximum fuel element cladding temperature is d 2200qF;
| |
| : b. Maximum cladding oxidation is d 0.17 times the total cladding thickness before oxidation;
| |
| : c. Maximum hydrogen generation from zirconium water reaction is d 0.01 times the hypothetical amount that would be generated if all of the metal in the cladding surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react;
| |
| : d. The core is maintained in a coolable geometry; and
| |
| : e. Adequate long term cooling capability is maintained.
| |
| The limiting single failures are discussed in Reference 11.
| |
| For the LOCA evaluation model which covers the entire spectrum of break sizes (large breaks to small breaks),
| |
| failure of the HPCS ECCS subsystem in Division 3 due to failure of its associated diesel generator is, in general, (continued)
| |
| LaSalle 1 and 2 B 3.5.1-4 Revision 45
| |
| | |
| ECCSOperating B 3.5.1 BASES APPLICABLE the most severe failure. The remaining OPERABLE ECCS SAFETY ANALYSES subsystems, which include one spray subsystem, provide the (continued) capability to adequately cool the core, under near-term and long-term conditions, and prevent excessive fuel damage.
| |
| For all LOCA analyses, only six ADS valves are assumed to function. An additional analysis has been performed which assumes five ADS valves function, however in this analysis all low pressure and high pressure ECCS subsystems are also assumed to be available.
| |
| The ECCS satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO Each ECCS injection/spray subsystem and six ADS valves are required to be OPERABLE. The ECCS injection/spray subsystems are defined as the three LPCI subsystems, the LPCS System, and the HPCS System. The low pressure ECCS injection/spray subsystems are defined as the LPCS System and the three LPCI subsystems. Management of gas voids is important to ECCS injection/spray subsystem OPERABILITY.
| |
| With less than the required number of ECCS subsystems OPERABLE during a limiting design basis LOCA concurrent with the worst case single failure, the limits specified in 10 CFR 50.46 (Ref. 10) could potentially be exceeded. All ECCS subsystems must therefore be OPERABLE to satisfy the single failure criterion required by 10 CFR 50.46 (Ref. 10).
| |
| A LPCI subsystem is not OPERABLE during alignment and operation for decay heat removal since transferring from the shutdown cooling mode to the LPCI mode could result in pump cavitation and voiding in the suction piping, resulting in the potential to damage the RHR System, including water hammer. This is necessary since the RHR System is required to operate in the shutdown cooling mode to remove decay heat and sensible heat from the reactor. At these low pressures and decay heat levels, a reduced complement of ECCS subsystems should provide the required core cooling, thereby allowing operation of RHR shutdown cooling when necessary.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.5.1-5 Revision 61
| |
| | |
| ECCSOperating B 3.5.1 BASES (continued)
| |
| APPLICABILITY All ECCS subsystems are required to be OPERABLE during MODES 1, 2, and 3 when there is considerable energy in the reactor core and core cooling would be required to prevent fuel damage in the event of a break in the primary system piping. In MODES 2 and 3, the ADS function is not required when pressure is d 150 psig because the low pressure ECCS subsystems (LPCS and LPCI) are capable of providing flow into the RPV below this pressure. Requirements for MODES 4 and 5 are specified in LCO 3.5.2, "RPV Water Inventory Control."
| |
| ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable HPCS subsystem. There is an increased risk associated with entering a MODE or other specified condition in the Applicability with an inoperable HPCS subsystem and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.
| |
| A.1 If any one low pressure ECCS injection/spray subsystem is inoperable, the inoperable subsystem must be restored to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program. In this Condition, the remaining OPERABLE subsystems provide adequate core cooling during a LOCA. However, overall ECCS reliability is reduced because a single failure in one of the remaining OPERABLE subsystems concurrent with a LOCA may result in the ECCS not being able to perform its intended safety function. The 7 day Completion Time is based on a reliability study (Ref. 12) that evaluated the impact on ECCS availability by assuming that various components and subsystems were taken out of service. The results were used to calculate the average availability of ECCS equipment needed to mitigate the consequences of a LOCA as a function of allowed outage times (i.e., Completion Times).
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.5.1-6 Revision 89
| |
| | |
| ECCSOperating B 3.5.1 BASES ACTIONS B.1 and B.2 (continued)
| |
| If the HPCS System is inoperable, and the RCIC System is immediately verified to be OPERABLE (when RCIC is required to be OPERABLE), the HPCS System must be restored to OPERABLE status within 14 days or in accordance with the Risk Informed Completion Time Program. In this Condition, adequate core cooling is ensured by the OPERABILITY of the redundant and diverse low pressure ECCS injection/spray subsystems in conjunction with the ADS. Also, the RCIC System will automatically provide makeup water at most reactor operating pressures. Immediate verification of RCIC OPERABILITY is therefore required when HPCS is inoperable and RCIC is required to be OPERABLE. This may be performed by an administrative check, by examining logs or other information, to determine if RCIC is out of service for maintenance or other reasons. It is not necessary to perform the Surveillances needed to demonstrate the OPERABILITY of the RCIC System. However, if the OPERABILITY of the RCIC System cannot be immediately verified and RCIC is required to be OPERABLE, Condition D must be entered. If a single active component fails concurrent with a design basis LOCA, there is a potential, depending on the specific failure, that the minimum required ECCS equipment will not be available. A 14 day Completion Time is based on the results of a reliability study (Ref. 12) and has been found to be acceptable through operating experience.
| |
| C.1 With two ECCS injection subsystems inoperable or one ECCS injection and the low pressure ECCS spray subsystem (LPCS) inoperable, at least one ECCS injection/spray subsystem must be restored to OPERABLE status within 72 hours or in accordance with the Risk Informed Completion Time Program.
| |
| In this Condition, the remaining OPERABLE subsystems provide adequate core cooling during a LOCA. However, overall ECCS reliability is reduced in this Condition because a single failure in one of the remaining OPERABLE subsystems concurrent with a design basis LOCA may result in the ECCS not being able to perform its intended safety function.
| |
| Since the ECCS availability is reduced relative to Condition A, a more restrictive Completion Time is imposed.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.5.1-7 Revision 89
| |
| | |
| ECCSOperating B 3.5.1 BASES ACTIONS C.1 (continued)
| |
| (continued)
| |
| The 72 hour Completion Time is based on a reliability study, as provided in Reference 12.
| |
| D.1 If any Required Action and associated Completion Time of Condition A, B, or C are not met, the plant must be brought to a MODE in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 15) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
| |
| E.1 The LCO requires six ADS valves to be OPERABLE to provide the ADS function. Reference 11 contains the results of an evaluation of the effect of one required ADS valve being out of service. Per this evaluation, operation of only five ADS valves will provide the required depressurization. However, overall reliability of the ADS is reduced because a single failure in the OPERABLE ADS valves could result in a reduction in depressurization capability. Therefore, operation is only allowed for a limited time. The 14 day Completion Time is based on a reliability study (Ref. 12) and has been found to be acceptable through operating experience. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.5.1-8 Revision 89
| |
| | |
| ECCSOperating B 3.5.1 BASES ACTIONS F.1 (continued)
| |
| If any Required Action and associated Completion Time of Condition E is not met, the plant must be brought to a MODE in which overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 15) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
| |
| G.1 and G.2 If two or more required ADS valves are inoperable or if the ADS accumulator backup compressed gas system is inoperable, there is a reduction in the depressurization capability.
| |
| The plant must be brought to a condition in which the LCO does not apply. An inoperable backup compressed gas system could impact the operability of the associated ADS valves.
| |
| To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and reactor steam dome pressure reduced to 150 psig within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
| |
| H.1 When multiple ECCS subsystems are inoperable, as stated in Condition G, the plant is in a condition outside of the design basis. Therefore, LCO 3.0.3 must be entered immediately.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.5.1-9 Revision 45
| |
| | |
| ECCSOperating B 3.5.1 BASES (continued)
| |
| SURVEILLANCE SR 3.5.1.1 REQUIREMENTS The ECCS injection/spray subsystem flow path piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the ECCS injection/spray subsystems and may also prevent a water hammer, pump cavitation, and pumping of noncondensible gas into the reactor vessel.
| |
| Selection of ECCS injection/spray subsystem locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.
| |
| The ECCS injection/spray subsystem is OPERABLE when it is sufficiently filled with water. Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criteria for gas volume at the suction or discharge of a pump), the Surveillance is not met. If it is determined by subsequent evaluation that the ECCS injection/spray subsystems are not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water), the Surveillance may be declared met.
| |
| Accumulated gas should be eliminated or brought within the acceptance criteria limits.
| |
| ECCS injection/spray subsystem locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative subset of susceptible locations. Monitoring may not be practical for locations that are inaccessible due to radiological or (continued)
| |
| LaSalle 1 and 2 B 3.5.1-10 Revision 60
| |
| | |
| ECCSOperating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.1 (continued)
| |
| REQUIREMENTS environmental conditions, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation.
| |
| SR 3.5.1.2 Verifying the correct alignment for manual, power operated, and automatic valves in the ECCS flow paths provides assurance that the proper flow paths will exist for ECCS operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an initiation signal is allowed to be in a nonaccident position provided the valve will automatically reposition in the proper stroke time. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves potentially capable of being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| The Surveillance is modified by a Note which exempts system vent flow paths opened under administrative control. The administrative control should be proceduralized and include stationing a dedicated individual at the system vent flow path who is in continuous communication with the operators (continued)
| |
| LaSalle 1 and 2 B 3.5.1-11 Revision 60
| |
| | |
| ECCSOperating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.2 (continued)
| |
| REQUIREMENTS in the control room. This individual will have a method to rapidly close the system vent flow path if directed.
| |
| SR 3.5.1.3 Verification that ADS accumulator supply header pressure is t 150 psig assures adequate pneumatic pressure for reliable ADS operation. The accumulator on each ADS valve provides pneumatic pressure for valve actuation. The ADS valve accumulators are sized to provide two cycles of the ADS valves upon loss of the nitrogen supply (Ref. 13). The ECCS safety analysis assumes only one actuation to achieve the depressurization required for operation of the low pressure ECCS. The accumulator supply header pressure verification may be accomplished by monitoring control room alarms. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.5.1.4 Verification that ADS accumulator backup compressed gas system bottle pressure is t 500 psig or that the ADS accumulator backup compressed gas system reserve bottle pressure is 1100 psig assures availability of an adequate backup pneumatic supply to the ADS accumulators following a loss of the drywell pneumatic supply (Ref 15). The reserve bottle is only utilized during bottle changeouts and once valved in, the reserve bottle will be verified to have a minimum bottle pressure of 1100 psig. The reserve bottle will allow bottle change out without affecting the operating unit or requiring entry into TS LCO 3.5.1.G. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.5.1.5 The performance requirements of the ECCS pumps are determined through application of the 10 CFR 50, Appendix K, criteria (Ref. 8). This periodic Surveillance is performed (in accordance with the ASME OM Code requirements for the ECCS pumps) to verify that the ECCS pumps will develop the (continued)
| |
| LaSalle 1 and 2 B 3.5.1-12 Revision 60
| |
| | |
| ECCSOperating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.5 (continued)
| |
| REQUIREMENTS flow rates required by the respective analyses. The ECCS pump flow rates ensure that adequate core cooling is provided to satisfy the acceptance criteria of 10 CFR 50.46 (Ref. 10).
| |
| The pump flow rates are verified against a test line pressure that was determined during preoperational testing to be equivalent to the RPV pressure expected during a LOCA.
| |
| Under these conditions, the total system pump outlet pressure is adequate to overcome the elevation head pressure between the pump suction and the vessel discharge, the piping friction losses, and RPV pressure present during LOCAs. The Frequency for this Surveillance is in accordance with the INSERVICE TESTING PROGRAM requirements.
| |
| SR 3.5.1.6 The ECCS subsystems are required to actuate automatically to perform their design functions. This Surveillance verifies that, with a required system initiation signal (actual or simulated), the automatic initiation logic of HPCS, LPCS, and LPCI will cause the systems or subsystems to operate as designed, including actuation of the system throughout its emergency operating sequence, automatic pump startup, and actuation of all automatic valves to their required position. This Surveillance also ensures that the HPCS System injection valve will automatically reopen on an RPV low water level (Level 2) signal received subsequent to an RPV high water level (Level 8) injection valve closure signal. The LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.1 overlaps this Surveillance to provide complete testing of the assumed safety function.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by a Note that excludes vessel injection/spray during the Surveillance. Since all active components are testable and full flow can be demonstrated by recirculation through the test line, coolant injection into the RPV is not required during the Surveillance.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.5.1-13 Revision 70
| |
| | |
| ECCSOperating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.7 REQUIREMENTS (continued) The ADS designated S/RVs are required to actuate automatically upon receipt of specific initiation signals.
| |
| A system functional test is performed to demonstrate that the mechanical portions of the ADS function (i.e.,
| |
| solenoids) operate as designed when initiated either by an actual or simulated initiation signal, causing proper actuation of all the required components. SR 3.5.1.8 and the LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.1 overlap this Surveillance to provide complete testing of the assumed safety function.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by a Note that excludes valve actuation since the valves are individually tested in accordance with SR 3.5.1.8. This also prevents an RPV pressure blowdown.
| |
| SR 3.5.1.8 A manual actuation of each required ADS actuator is performed to verify that the valve, actuator, and solenoids are functioning properly. SR 3.4.4.1, SR 3.5.1.7 and the LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.1 overlap this Surveillance to provide complete testing of the assumed safety function.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by a Note that excludes the valve actuation since valve OPERABILITY is demonstrated for ADS valves by successful operation of a sample of S/RVs. The sample population of S/RVs tested each refueling outage to satisfy SR 3.4.4.1 are stroked in the relief mode during "as found" testing to verify proper operation of the ADS valve. The successful performance of the test sample of S/RVs provides reasonable assurance that all ADS valves will perform in a similar fashion. Additionally, after the S/RVs are replaced, the relief mode actuator of the newly installed S/RVs are uncoupled from the S/RV stem and cycled (continued)
| |
| LaSalle 1 and 2 B 3.5.1-14 Revision 60
| |
| | |
| ECCSOperating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.8 (continued)
| |
| REQUIREMENTS to ensure that no damage has occurred during transportation and installation. This verifies that each replaced S/RV will properly perform its intended safety function.
| |
| REFERENCES 1. UFSAR, Section 6.3.2.2.3.
| |
| : 2. UFSAR, Section 6.3.2.2.4.
| |
| : 3. UFSAR, Section 6.3.2.2.1.
| |
| : 4. UFSAR, Section 6.3.2.2.2.
| |
| : 5. UFSAR, Section 15.2.8.
| |
| : 6. UFSAR, Section 15.6.4.
| |
| : 7. UFSAR, Section 15.6.5.
| |
| : 8. 10 CFR 50, Appendix K.
| |
| : 9. UFSAR, Section 6.3.3.
| |
| : 10. 10 CFR 50.46.
| |
| : 11. UFSAR, Section 6.3.3.3.
| |
| : 12. Memorandum from R.L. Baer (NRC) to V. Stello, Jr.
| |
| (NRC), "Recommended Interim Revisions to LCO's for ECCS Components," December 1, 1975.
| |
| : 13. UFSAR, Section 7.3.1.2.
| |
| : 14. ASME Code for Operation and Maintenance of Nuclear Power Plants (OM Code).
| |
| : 15. NEDC-32988-A, Revision 2, "Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants," December 2002.
| |
| : 16. Design Analysis L-003263, Rev. 2.
| |
| LaSalle 1 and 2 B 3.5.1-15 Revision 60
| |
| | |
| RPV Water Inventory Control B 3.5.2 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS), REACTOR PRESSURE VESSEL (RPV)
| |
| WATER INVENTORY CONTROL, AND REACTOR CORE ISOLATION COOLING (RCIC)
| |
| SYSTEM B 3.5.2 RPV Water Inventory Control BASES BACKGROUND The RPV contains penetrations below the top of the active fuel (TAF) that have the potential to drain the reactor coolant inventory to below the TAF. If the water level should drop below the TAF, the ability to remove decay heat is reduced, which could lead to elevated cladding temperatures and clad perforation. Safety Limit 2.1.1.3 requires the RPV water level to be above the top of the active irradiated fuel at all times to prevent such elevated cladding temperatures.
| |
| APPLICABLE With the unit in MODE 4 or 5, RPV water inventory control is SAFETY ANALYSES not required to mitigate any events or accidents evaluated in the safety analyses. RPV water inventory control is required in MODES 4 and 5 to protect Safety Limit 2.1.1.3 and the fuel cladding barrier to prevent the release of radioactive material to the environment should an unexpected draining event occur.
| |
| A double-ended guillotine break of the Reactor Coolant System (RCS) is not considered in MODES 4 and 5 due to the reduced RCS pressure, reduced piping stresses, and ductile piping systems. Instead, an event is considered in which an initiating event allows draining of the RPV water inventory through a single penetration flow path with the highest flow (continued)
| |
| LaSalle 1 and 2 B 3.5.2-1 Revision 9076
| |
| | |
| RPV Water Inventory Control B 3.5.2 BASES APPLICABLE rate, or the sum of the drain rates through multiple SAFETY ANALYSES penetration flow paths susceptible to a common mode failure (continued) (an event that creates a drain path through multiple vessel penetrations located below top of active fuel, such as loss of normal power, or a single human error). It is assumed, based on engineering judgment, that while in MODES 4 and 5, one low pressure ECCS injection/spray subsystem can maintain adequate reactor vessel water level.
| |
| As discussed in References 1, 2, 3, 4, and 5, operating experience has shown RPV water inventory to be significant to public health and safety. Therefore, RPV Water Inventory Control satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The RPV water level must be controlled in MODES 4 and 5 to ensure that if an unexpected draining event should occur, the reactor coolant water level remains above the top of the active irradiated fuel as required by Safety Limit 2.1.1.3.
| |
| The Limiting Condition for Operation (LCO) requires the DRAIN TIME of RPV water inventory to the TAF to be 36 hours. A DRAIN TIME of 36 hours is considered reasonable to identify and initiate action to mitigate unexpected draining of reactor coolant. An event that could cause loss of RPV water inventory and result in the RPV water level reaching the TAF in greater than 36 hours does not represent a significant challenge to Safety Limit 2.1.1.3 and can be managed as part of normal plant operation.
| |
| One ECCS injection/spray subsystem is required to be OPERABLE and capable of being manually aligned and started from the control room to provide defense-in-depth should an unexpected draining event occur. OPERABILITY of the ECCS injection/spray subsystem includes any necessary valves, instrumentation, or controls needed to manually align and start the subsystem from the control room. An ECCS injection/spray subsystem is defined as either one of the three Low Pressure Coolant Injection (LPCI) subsystems, the Low Pressure Core Spray (LPCS) System, or the High Pressure (continued)
| |
| LaSalle 1 and 2 B 3.5.2-2 Revision 9076
| |
| | |
| RPV Water Inventory Control B 3.5.2 BASES LCO Core Spray (HPCS) System. The LPCI subsystem and the LPCS (continued) System consist of one motor driven pump, piping, and valves to transfer water from the suppression pool to the RPV. The HPCS System consists of one motor driven pump, piping, and valves to transfer water from the suppression pool to the RPV. The necessary portions of the Diesel Generator Cooling Water System are also required to provide appropriate cooling to each required ECCS injection/spray subsystem.
| |
| Management of gas voids is important to ECCS injection/spray subsystem OPERABILITY.
| |
| A required ECCS subsystem may be aligned with the pump control switch in pull-to-lock and associated ECCS subsystem injection valves may be configured to allow throttling to control RPV makeup flow rates. Operators must be able to take manual action from the control room to provide makeup to the RPV as-necessary with the pump and associated injection valve in this alignment without delay.
| |
| The LCO is modified by a Note which allows a required LPCI subsystem (A or B) to be considered OPERABLE during alignment and operation for decay heat removal, if capable of being manually realigned to the LPCI mode and is not otherwise inoperable. Alignment and operation for decay heat removal includes: a) when the system is realigned to or from the RHR shutdown cooling mode and; b) when the system is in the RHR shutdown cooling mode, whether or not the RHR pump is operating. This allowance is necessary since the RHR System may be required to operate in the shutdown cooling mode to remove decay heat and sensible heat from the reactor. Because of the restrictions on DRAIN TIME, sufficient time will be available to manually align and operate the required LPCI subsystem to maintain RPV inventory prior to RPV water level reaching the TAF.
| |
| APPLICABILITY RPV water inventory control is required in MODES 4 and 5.
| |
| Requirements on water inventory control during other MODES are contained in LCOs in Section 3.3, "Instrumentation," and other LCOs in Section 3.5, "ECCS, RPV Water Inventory Control, and RCIC System." RPV Water Inventory Control is required to protect Safety Limit 2.1.1.3 which is applicable whenever irradiated fuel is in the reactor vessel.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.5.2-3 Revision 9076
| |
| | |
| RPV Water Inventory Control B 3.5.2 BASES (continued)
| |
| ACTIONS A.1 and B.1 If the required ECCS injection/spray subsystem is inoperable, it must be restored to OPERABLE status within 4 hours. In this Condition, the LCO controls on DRAIN TIME minimize the possibility that an unexpected draining event could necessitate the use of the ECCS injection/spray subsystem, however the defense-in-depth provided by the ECCS injection/spray subsystem is lost. The 4 hour Completion Time for restoring the required ECCS injection/spray subsystem to OPERABLE status is based on engineering judgment that considers the LCO controls on DRAIN TIME and the low probability of a an unexpected draining event that would result in a loss of RPV water inventory. If the inoperable ECCS injection/spray subsystem is not restored to OPERABLE status within the required Completion Time, action must be initiated immediately to establish a method of water injection capable of operating without offsite electrical power. The method of water injection includes the necessary instrumentation and controls, water sources, and pumps and valves needed to add water to the RPV or refueling cavity should an unexpected draining event occur. The method of water injection may be operated manually, and may consist of one or more systems or subsystems, and must be able to access water inventory capable of maintaining the RPV water level above the TAF for 36 hours. If recirculation of injected water would occur, it may be credited in determining the necessary water volume.
| |
| C.1, C.2, and C.3 With the DRAIN TIME less than 36 hours but greater than or equal to 8 hours, compensatory measures should be taken to ensure the ability to implement mitigating actions should an unexpected draining event occur. Should a draining event lower the reactor coolant level to below the TAF, there is potential for damage to the reactor fuel cladding and release of radioactive material. Additional actions are taken to ensure that radioactive material will be contained, diluted, and processed prior to being released to the environment.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.5.2-4 Revision 76
| |
| | |
| RPV Water Inventory Control B 3.5.2 BASES ACTIONS C.1, C.2, and C.3 (continued)
| |
| The secondary containment provides a controlled volume in which fission products can be contained, diluted, and processed prior to release to the environment. Required Action C.1 requires verification of the capability to establish the secondary containment boundary in less than the DRAIN TIME. The required verification confirms actions to establish the secondary containment boundary are preplanned and necessary materials are available. The secondary containment boundary is considered established when one Standby Gas Treatment (SGT) subsystem is capable of maintaining a negative pressure in the secondary containment with respect to the environment.
| |
| Verification that the secondary containment boundary can be established must be performed within 4 hours. The required verification is an administrative activity and does not require manipulation or testing of equipment. Secondary containment penetration flow paths form a part of the secondary containment boundary. A secondary containment penetration flow path can be considered isolated when one barrier in the flow path is in place. Examples of suitable barriers include, but are not limited to, a closed secondary containment isolation valve (SCIV), a closed manual valve, a blind flange, or another sealing device that sufficiently seals the penetration flow path. The planned actions are not required to restore secondary containment to an OPERABLE status, only sufficiently sealed to allow one division of SGT to maintain a negative pressure with respect to the environment. Required Action C.2 requires verification of the capability to isolate each secondary containment penetration flow path in less than the DRAIN TIME. The required verification confirms actions to isolate the secondary containment penetration flow paths are preplanned and necessary materials are available. Power operated dampers are not required to receive automatic isolation signals if they can be closed manually within the required time. Verification that the secondary containment penetration flow paths can be isolated must be performed within 4 hours. The required verification is an administrative activity and does not require manipulation or testing of equipment.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.5.2-5 Revision 76
| |
| | |
| RPV Water Inventory Control B 3.5.2 BASES ACTIONS C.1, C.2, and C.3 (continued)
| |
| One SGT subsystem is capable of maintaining the secondary containment at a negative pressure with respect to the environment and filter gaseous releases. Required Action C.3 requires verification of the capability to place one SGT subsystem in operation in less than the DRAIN TIME. The required verification confirms actions to place a SGT subsystem in operation are preplanned and necessary materials are available. Verification that a SGT subsystem can be placed in operation must be performed within 4 hours.
| |
| The required verification is an administrative activity and does not require manipulation or testing of equipment.
| |
| Required Actions C.1, C.2, and C.3 are considered to be met when secondary containment, secondary containment penetrations, and the Standby Gas Treatment System are OPERABLE in accordance with LCO 3.6.4.1, LCO 3.6.4.2, and LCO 3.6.4.3.
| |
| D.1, D.2, D.3, and D.4 With the DRAIN TIME less than 8 hours, mitigating actions are implemented in case an unexpected draining event should occur. Note that if the DRAIN TIME is less than 1 hour, Required Action E.1 is also applicable.
| |
| Required Action D.1 requires immediate action to establish an additional method of water injection augmenting the ECCS injection/spray subsystem required by the LCO. The additional method of water injection includes the necessary instrumentation and controls, water sources, and pumps and valves needed to add water to the RPV or refueling cavity should an unexpected draining event occur. The Note to Required Action D.1 states that either the ECCS injection/spray subsystem or the additional method of water injection must be capable of operating without offsite electrical power. The additional method of water injection may be manually initiated and may consist of one or more system or subsystems. The additional method of water injection must be able to access water inventory capable of being injected to maintain the RPV water level above the TAF for 36 hours. The additional method of water injection and the ECCS injection/spray subsystem may share all or part (continued)
| |
| LaSalle 1 and 2 B 3.5.2-6 Revision 9076
| |
| | |
| RPV Water Inventory Control B 3.5.2 BASES ACTIONS D.1, D.2, D.3, and D.4 (continued) of the same water sources. If recirculation of injected water would occur, it may be credited in determining the required water volume.
| |
| Should a draining event lower the reactor coolant level to below the TAF, there is potential for damage to the reactor fuel cladding and release of radioactive material.
| |
| Additional actions are taken to ensure that radioactive material will be contained, diluted, and processed prior to being released to the environment.
| |
| The secondary containment provides a control volume in which fission products can be contained, diluted, and processed prior to release to the environment. Required Action D.2 requires that actions be immediately initiated to establish the secondary containment boundary. With the secondary containment boundary established, one SGT subsystem is capable of maintaining a negative pressure in the secondary containment with respect to the environment.
| |
| The secondary containment penetrations form a part of the secondary containment boundary. Required Action D.3 requires that actions be immediately initiated to verify that each secondary containment penetration flow path is isolated or to verify that it can be manually isolated from the control room. Examples of manual isolation from the control room could include the use of manual isolation pushbuttons, control switches, or placing a sufficient number of radiation monitor channels in trip from either unit. A secondary containment penetration flow path can be considered isolated when one barrier in the flow path is in place. Examples of suitable barriers include, but are not limited to, a closed secondary containment isolation valve (SCIV), a closed manual valve, a blind flange, or another sealing device that sufficiently seals the penetration flow path. The actions are not required to restore secondary containment to an OPERABLE status, only sufficiently sealed to allow one division of SGT to maintain a negative pressure with respect to the environment.
| |
| One SGT subsystem is capable of maintaining the secondary containment at a negative pressure with respect to the environment and filter gaseous releases. Required (continued)
| |
| LaSalle 1 and 2 B 3.5.2-7 Revision 9076
| |
| | |
| RPV Water Inventory Control B 3.5.2 BASES ACTIONS D.1, D.2, D.3, and D.4 (continued)
| |
| (continued)
| |
| Action D.4 requires that actions be immediately initiated to verify that at least one SGT subsystem is capable of being placed in operation. The required verification is an administrative activity and does not require manipulation or testing of equipment.
| |
| Required Actions D.2, D.3, and D.4 are considered to be met when secondary containment, secondary containment penetrations, and the Standby Gas Treatment System are OPERABLE in accordance with LCO 3.6.4.1, LCO 3.5.4.2, and LCO 3.6.4.3.
| |
| E.1 If the Required Actions and associated Completion Times of Conditions C or D are not met or if the DRAIN TIME is less than 1 hour, actions must be initiated immediately to restore the DRAIN TIME to 36 hours. In this condition, there may be insufficient time to respond to an unexpected draining event to prevent the RPV water inventory from reaching the TAF. Note that Required Actions D.1, D.2, D.3, and D.4 are also applicable when DRAIN TIME is less than 1 hour.
| |
| SURVEILLANCE SR 3.5.2.1 REQUIREMENTS This Surveillance verifies that the DRAIN TIME of RPV water inventory to the TAF is 36 hours. The period of 36 hours is considered reasonable to identify and initiate action to mitigate draining of reactor coolant. Loss of RPV water inventory that would result in the RPV water level reaching the TAF in greater than 36 hours does not represent a significant challenge to Safety Limit 2.1.1.3 and can be managed as part of normal plant operation.
| |
| The definition of DRAIN TIME states that realistic cross-sectional areas and drain rates are used in the calculation.
| |
| A realistic drain rate may be determined using a single, step-wise, or integrated calculation considering the changing RPV water level during a draining event. For a Control Rod RPV penetration flow path with the Control Rod Drive Mechanism removed and not replaced with a blank (continued)
| |
| LaSalle 1 and 2 B 3.5.2-8 Revision 9076
| |
| | |
| RPV Water Inventory Control B 3.5.2 BASES SURVEILLANCE SR 3.5.2.1 (continued)
| |
| REQUIREMENTS flange, the realistic cross-sectional area is based on the control rod blade seated in the control rod guide tube. If the control rod blade will be raised from the penetration to adjust or verify seating of the blade, the exposed cross-sectional area of the RPV penetration flow path is used.
| |
| The definition of DRAIN TIME excludes from the calculation those penetration flow paths connected to an intact closed system, or isolated by manual or automatic valves that are, blank flanges, or other devices that prevent flow of reactor coolant through the penetration flow paths. A blank flange or other bolted device must be connected with a sufficient number of bolts to prevent draining. Normal or expected leakage from closed systems or past isolation devices is permitted. Determination that a system is intact and closed or isolated must consider the status of branch lines.
| |
| The Residual Heat Removal (RHR) Shutdown Cooling System is only considered an intact closed system when misalignment issues (Reference 6) have been precluded by functional valve interlocks or by isolation devices, such that redirection of RPV water out of an RHR subsystem is precluded. Further, RHR Shutdown Cooling System is only considered an intact closed system if its controls have not been transferred to Remote Shutdown, which disables the interlocks and isolation signals.
| |
| The exclusion of a single penetration flow path, or multiple penetration flow paths susceptible to a common mode failure, from the determination of DRAIN TIME should consider the effects of temporary alterations in support of maintenance (rigging, scaffolding, temporary shielding, piping plugs, freeze seals, etc.). If reasonable controls are implemented to prevent such temporary alterations from causing a draining event from a closed system or between the RPV and the isolation device, the effect of the temporary alterations on DRAIN TIME need not be considered.
| |
| Reasonable controls include, but are not limited to, controls consistent with the guidance in NUMARC 93-01, "Industry Guideline for Monitoring the Effectiveness of (continued)
| |
| LaSalle 1 and 2 B 3.5.2-9 Revision 9076
| |
| | |
| RPV Water Inventory Control B 3.5.2 BASES SURVEILLANCE SR 3.5.2.1 (continued)
| |
| REQUIREMENTS Maintenance at Nuclear Power Plants," Revision 4, NUMARC 91-06, "Guidelines for Industry Actions to Assess Shutdown Management," or commitments to NUREG-0612, "Control of Heavy Loads at Nuclear Power Plants."
| |
| Surveillance Requirement 3.0.1 requires SRs to be met between performances. Therefore, any changes in plant conditions that would change the DRAIN TIME requires that a new DRAIN TIME be determined.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.5.2.2 and SR 3.5.2.3 The minimum water level of -12 ft 7 in (referenced to a plant elevation of 699 ft 11 in) required for the suppression pool, equivalent to a contained water volume of 70,000 ft3, is periodically verified to ensure that the suppression pool will provide adequate net positive suction head (NPSH) for the ECCS pumps, recirculation volume, and vortex prevention. With the suppression pool water level less than the required limit, all ECCS injection/spray subsystems are inoperable.
| |
| The Surveillance Frequencies are controlled under the Surveillance Frequency Control Program.
| |
| SR 3.5.2.4 The Bases provided for SR 3.5.1.1 are applicable to SR 3.5.2.4.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.5.2-10 Revision 9076
| |
| | |
| RPV Water Inventory Control B 3.5.2 BASES (continued)
| |
| SURVEILLANCE SR 3.5.2.5 REQUIREMENTS Verifying that the required ECCS injection/spray subsystem can be manually aligned, and the pump started and operated for at least 10 minutes demonstrates that the subsystem is available to mitigate a draining event. This SR is modified by two Notes. Note 1 states that testing the ECCS injection/spray subsystem may be done through the test return line to avoid overfilling the refueling cavity. Note 2 states that credit for meeting the SR may be taken for normal system operation that satisfies the SR, such as using the RHR mode of LPCI for 10 minutes. The minimum operating time of 10 minutes was based on engineering judgement.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.5.2.6 Verifying that each valve credited for automatically isolating a penetration flow path actuates to the isolation position on an actual or simulated RPV water level isolation signal is required to prevent RPV water inventory from dropping below the TAF should an unexpected draining event occur.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.5.2.7 This Surveillance verifies that the required LCPI subsystem, LPCS System, or HPCS can be manually aligned and started from the control room, including any necessary valve alignment, instrumentation, or controls, to transfer water from the suppression pool or CST to the RPV.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by a Note that excludes vessel injection/spray during the Surveillance. Since all active components are testable and full flow can be demonstrated (continued)
| |
| LaSalle 1 and 2 B 3.5.2-11 Revision 9076
| |
| | |
| RPV Water Inventory Control B 3.5.2 BASES SURVEILLANCE SR 3.5.2.7 (continued)
| |
| REQUIREMENTS (continued) by recirculation through the full flow test line, coolant injection into the RPV is not required during the Surveillance.
| |
| REFERENCES 1. Information Notice 84-81, "Inadvertent Reduction in Primary Coolant Inventory in Boiling Water Reactors During Shutdown and Startup," November 1984.
| |
| : 2. Information Notice 86-74, "Reduction of Reactor Coolant Inventory Because of Misalignment of RHR Valves," August 1986.
| |
| : 3. Generic Letter 92-04, "Resolution of the Issues Related to Reactor Vessel Water Level Instrumentation in BWRs Pursuant to 10 CFR 50.54(f)," August 1992.
| |
| : 4. NRC Bulletin 93-03, "Resolution of Issues Related to Reactor Vessel Water Level Instrumentation in BWRs,"
| |
| May 1993.
| |
| : 5. Information Notice 94-52, "Inadvertent Containment Spray and Reactor Vessel Draindown at Millstone 1,"
| |
| July 1994.
| |
| : 6. General Electric Service Information Letter No. 388, "RHR Valve Misalignment During Shutdown Cooling Operation for BWR 3/4/5/6," February 1983.
| |
| LaSalle 1 and 2 B 3.5.2-12 Revision 9076
| |
| | |
| RCIC System B 3.5.3 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS), REACTOR PRESSURE VESSEL (RPV)
| |
| WATER INVENTORY CONTROL, AND REACTOR CORE ISOLATION COOLING (RCIC)
| |
| SYSTEM B 3.5.3 RCIC System BASES BACKGROUND The RCIC System is not part of the ECCS; however, the RCIC System is included with the ECCS section because of their similar functions.
| |
| The RCIC System is designed to operate either automatically or manually following reactor pressure vessel (RPV) isolation accompanied by a loss of coolant flow from the feedwater system to provide adequate core cooling and control of RPV water level. Under these conditions, the High Pressure Core Spray (HPCS) and RCIC systems perform similar functions. The RCIC System design requirements ensure that the criteria of Reference 1 are satisfied.
| |
| The RCIC System (Ref. 2) consists of a steam driven turbine pump unit, piping and valves to provide steam to the turbine, as well as piping and valves to transfer water from the suction source to the core via the head spray nozzle. A 1 H2 purge line is connected from the injection line to the reactor head vent to prevent hydrogen buildup (Ref. 4). The purge line contains an orifice to minimize RCIC flow bypassing the RPV and ensures that sufficient injection flow is delivered to the RPV.
| |
| Suction piping is provided from the condensate storage tank (CST) and the suppression pool. Pump suction is normally aligned to the CST to minimize injection of suppression pool water into the RPV. However, if the CST water supply is low an automatic transfer to the suppression pool water source ensures a water supply for continuous operation of the RCIC System. The steam supply to the turbine is piped from main steam line B, upstream of the inboard main steam line isolation valve.
| |
| The RCIC System is designed to provide core cooling for a wide range of reactor pressures, 135 psig to 1185 psig.
| |
| Upon receipt of an initiation signal, the RCIC turbine accelerates to a specified speed. As the RCIC flow increases, the turbine control valve is automatically adjusted to maintain design flow. Exhaust steam from the (continued)
| |
| LaSalle 1 and 2 B 3.5.3-1 Revision 76
| |
| | |
| RCIC System B 3.5.3 BASES BACKGROUND RCIC turbine is discharged to the suppression pool. A full (continued) flow test line is provided to route water to the CST or the suppression pool to allow testing of the RCIC System during normal operation without injecting water into the RPV.
| |
| The RCIC pump is provided with a minimum flow bypass line, which discharges to the suppression pool. The valve in this line automatically opens to prevent pump damage due to overheating when other discharge line valves are closed. To ensure rapid delivery of water to the RPV and to minimize water hammer effects, the RCIC System discharge line "keep fill" system is designed to maintain the pump discharge line filled with water.
| |
| APPLICABLE The function of the RCIC System is to respond to transient SAFETY ANALYSES events by providing makeup coolant to the reactor. The RCIC System is not an Engineered Safety Feature System and no credit is taken in the safety analyses for RCIC System operation. Based on its contribution to the reduction of overall plant risk, the system satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The OPERABILITY of the RCIC System provides adequate core cooling such that actuation of any of the ECCS subsystems is not required in the event of RPV isolation accompanied by a loss of feedwater flow. The RCIC System has sufficient capacity to maintain RPV inventory during an isolation event. Management of gas voids is important to RCIC System OPERABILITY.
| |
| APPLICABILITY The RCIC System is required to be OPERABLE in MODE 1, and MODES 2 and 3 with reactor steam dome pressure ! 150 psig since RCIC is the primary non-ECCS water source for core cooling when the reactor is isolated and pressurized. In MODES 2 and 3 with reactor steam dome pressure d 150 psig, and in MODES 4 and 5, RCIC is not required to be OPERABLE since the ECCS injection/spray subsystems can provide sufficient flow to the vessel.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.5.3-2 Revision 76
| |
| | |
| RCIC System B 3.5.3 BASES (continued)
| |
| ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable RCIC system. There is an increased risk associated with entering a MODE or other specified condition in the Applicability with an inoperable RCIC system and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCOO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.
| |
| A.1 and A.2 If the RCIC System is inoperable during MODE 1, or MODES 2 or 3 with reactor steam dome pressure ! 150 psig, and the HPCS System is immediately verified to be OPERABLE, the RCIC System must be restored to OPERABLE status within 14 days or in accordance with the Risk Informed Completion Time Program. In this Condition, loss of the RCIC System will not affect the overall plant capability to provide makeup inventory at high RPV pressure since the HPCS System is the only high pressure system assumed to function during a loss of coolant accident (LOCA). OPERABILITY of the HPCS is therefore immediately verified when the RCIC System is inoperable. This may be performed as an administrative check, by examining logs or other information, to determine if the HPCS is out of service for maintenance or other reasons. Verification does not require performing the Surveillances needed to demonstrate the OPERABILITY of the HPCS System. If the OPERABILITY of the HPCS System cannot be immediately verified, however, Condition B must be entered.
| |
| For transients and certain abnormal events with no LOCA, RCIC (as opposed to HPCS) is the preferred source of makeup coolant because of its relatively small capacity, which allows easier control of RPV water level. Therefore, a limited time is allowed to restore the inoperable RCIC to OPERABLE status.
| |
| The 14 day Completion Time is based on a reliability study (Ref. 3) that evaluated the impact on ECCS availability, assuming that various components and subsystems were taken out of service. The results were used to calculate the average availability of ECCS equipment needed to mitigate the consequences of a LOCA as a function of allowed outage times (AOTs). Because of the similar functions of the HPCS and RCIC, the AOTs (i.e., Completion Times) determined for the HPCS are also applied to RCIC.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.5.3-3 Revision 89
| |
| | |
| RCIC System B 3.5.3 BASES ACTIONS (continued) B.1 and B.2 If the RCIC System cannot be restored to OPERABLE status within the associated Completion Time, or if the HPCS System is simultaneously inoperable, the plant must be brought to a condition in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and reactor steam dome pressure reduced to d 150 psig within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
| |
| SURVEILLANCE SR 3.5.3.1 REQUIREMENTS The RCIC System flow path piping and components have the potential to develop voids and pockets of entrained gases.
| |
| Preventing and managing gas intrusion and accumulation is necessary for proper operation of the RCIC System and may also prevent a water hammer, pump cavitation, and pumping of noncondensible gas.
| |
| Selection of RCIC System locations susceptible to gas accumulation is based on a self-assessment of the piping configuration to identify where gases may accumulate and remain even after the system is filled and vented, and to identify vulnerable potential degassing flow paths. The review is supplemented by verification that installed high-point vents are actually at the system high points, including field verification to ensure pipe shapes and construction tolerances have not inadvertently created additional high points. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.
| |
| The RCIC System is OPERABLE when it is sufficiently filled with water. Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criteria for gas volume at the suction or discharge of a pump), the Surveillance is not met. If it is determined by subsequent evaluation that the RCIC Systems (continued)
| |
| LaSalle 1 and 2 B 3.5.3-4 Revision 60
| |
| | |
| RCIC System B 3.5.3 BASES SURVEILLANCE SR 3.5.3.1 (continued)
| |
| REQUIREMENTS are not rendered inoperable by the accumulated gas (i.e.,
| |
| the system is sufficiently filled with water), the Surveillance may be declared met. Accumulated gas should be eliminated or brought within the acceptance criteria limits.
| |
| RCIC System locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative sub-set of susceptible locations. Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety.
| |
| For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation.
| |
| SR 3.5.3.2 Verifying the correct alignment for manual, power operated, and automatic valves (including the RCIC pump flow controller) in the RCIC flow path provides assurance that the proper flow path will exist for RCIC operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position since these were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an initiation signal is allowed to be in a nonaccident position provided the valve will automatically reposition in the proper stroke time.
| |
| This SR does not require any testing or valve manipulation; (continued)
| |
| LaSalle 1 and 2 B 3.5.3-5 Revision 60
| |
| | |
| RCIC System B 3.5.3 BASES SURVEILLANCE SR 3.5.3.2 (continued)
| |
| REQUIREMENTS rather, it involves verification that those valves capable of potentially being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves. For the RCIC System, this SR also includes the steam flow path for the turbine and the flow controller position.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| The Surveillance is modified by a Note which exempts system vent flow paths opened under administrative control. The administrative control should be proceduralized and include stationing a dedicated individual at the system vent flow path who is in continuous communication with the operators in the control room. This individual will have a method to rapidly close the system vent flow path if directed.
| |
| SR 3.5.3.3 and SR 3.5.3.4 The RCIC pump flow rates ensure that the system can maintain reactor coolant inventory during pressurized conditions with the RPV isolated. The flow tests for the RCIC System are performed at two different pressure ranges such that system capability to provide rated flow against a test line pressure corresponding to reactor pressure is tested both at the higher and lower operating ranges of the system. The required system head should overcome the RPV pressure and associated discharge line losses. Adequate reactor steam pressure must be available to perform these tests.
| |
| Additionally, adequate steam flow must be passing through the main turbine or turbine bypass valves to continue to control reactor pressure when the RCIC System diverts steam flow. Therefore, sufficient time is allowed after adequate pressure and flow are achieved to perform these SRs.
| |
| Reactor steam pressure must be t 920 psig to perform SR 3.5.3.3 and t 135 psig to perform SR 3.5.3.4. Adequate steam flow is represented by at least one turbine bypass valve opened 50%. Reactor startup is allowed prior to performing the low pressure Surveillance because the reactor pressure is low and the time to satisfactorily perform the Surveillance is short. The reactor pressure is allowed to be increased to normal operating pressure since it is (continued)
| |
| LaSalle 1 and 2 B 3.5.3-6 Revision 60
| |
| | |
| RCIC System B 3.5.3 BASES SURVEILLANCE SR 3.5.3.3 and SR 3.5.3.4 (continued)
| |
| REQUIREMENTS assumed that the low pressure test has been satisfactorily completed and there is no indication or reason to believe that RCIC is inoperable. Therefore, these SRs are modified by Notes that state the Surveillances are not required to be performed until 12 hours after the reactor steam pressure and flow are adequate to perform the test. The 12 hours allowed for the flow tests after the required pressure and flow are reached are sufficient to achieve stable conditions for testing and provides a reasonable time to complete the SRs. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.5.3.5 The RCIC System is required to actuate automatically to perform its design function. This Surveillance verifies that with a required system initiation signal (actual or simulated) the automatic initiation logic of RCIC will cause the system to operate as designed, i.e., actuation of the system throughout its emergency operating sequence, which includes automatic pump startup and actuation of all automatic valves to their required positions. This Surveillance also ensures that the RCIC System will automatically restart on an actual or simulated RPV low water level (Level 2) signal received subsequent to an actual or simulated RPV high water level (Level 8) shutdown signal, and that the suction is automatically transferred from the CST to the suppression pool. The LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.3 overlaps this Surveillance to provide complete testing of the assumed design function.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by a Note that excludes vessel injection during the Surveillance. Since all active components are testable and full flow can be demonstrated by recirculation through the test line, coolant injection into the RPV is not required during the Surveillance.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.5.3-7 Revision 76
| |
| | |
| RCIC System B 3.5.3 BASES (continued)
| |
| REFERENCES 1. 10 CFR 50, Appendix A, GDC 33.
| |
| : 2. UFSAR, Section 5.4.6.2.
| |
| : 3. Memorandum from R.L. Baer (NRC) to V. Stello, Jr.
| |
| (NRC), "Recommended Interim Revisions to LCO's for ECCS Components," December 1, 1975.
| |
| : 4. GE Service Information Letter (SIL) No. 643, "Potential for Radiolytic Gas Detonation," June 14, 2002.
| |
| LaSalle 1 and 2 B 3.5.3-8 Revision 60
| |
| | |
| Primary Containment B 3.6.1.1 B 3.6 CONTAINMENT SYSTEMS B 3.6.1.1 Primary Containment BASES BACKGROUND The function of the primary containment is to isolate and contain fission products released from the Reactor Primary System following a design basis Loss of Coolant Accident (LOCA) and to confine the postulated release of radioactive material to within limits. The primary containment consists of a steel lined, reinforced concrete vessel, which surrounds the Reactor Primary System and provides an essentially leak tight barrier against an uncontrolled release of radioactive material to the environment.
| |
| Additionally, this structure provides shielding from the fission products that may be present in the primary containment atmosphere following accident conditions.
| |
| The isolation devices for the penetrations in the primary containment boundary are a part of the primary containment leak tight barrier. To maintain this leak tight barrier:
| |
| : a. All penetrations required to be closed during accident conditions are either:
| |
| : 1. capable of being closed by an OPERABLE automatic containment isolation system, or
| |
| : 2. closed by manual valves, blind flanges, or de-activated automatic valves secured in their closed positions, except as provided in LCO 3.6.1.3, "Primary Containment Isolation Valves (PCIVs)";
| |
| : b. Primary containment air locks are OPERABLE, except as provided in LCO 3.6.1.2, "Primary Containment Air Locks";
| |
| : c. All equipment hatches are closed and sealed; and
| |
| : d. The sealing mechanism associated with each primary containment penetration (e.g., welds, bellows, or 0-rings) is OPERABLE.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.1.1-1 Revision 0
| |
| | |
| Primary Containment B 3.6.1.1 BASES BACKGROUND This Specification ensures that the performance of the (continued) primary containment, in the event of a Design Basis Accident (DBA), meets the assumptions used in the safety analyses of References 1 and 2. SR 3.6.1.1.1 leakage rate requirements are in conformance with 10 CFR 50, Appendix J (Ref. 3),
| |
| Option B, as modified by approved exemptions.
| |
| APPLICABLE The safety design basis for the primary containment is that SAFETY ANALYSES it must withstand the pressures and temperatures of the limiting DBA without exceeding the design leakage rate.
| |
| The DBA that postulates the maximum release of radioactive material within primary containment is a LOCA. In the analysis of this accident, it is assumed that primary containment is OPERABLE such that release of fission products to the environment is controlled by the rate of primary containment leakage.
| |
| Analytical methods and assumptions involving the primary containment are presented in References 1 and 2. The safety analyses assume a nonmechanistic fission product release following a DBA, which forms the basis for determination of offsite doses. The fission product release is, in turn, based on an assumed leakage rate from the primary containment. OPERABILITY of the primary containment ensures that the leakage rate assumed in the safety analyses is not exceeded.
| |
| The maximum allowable leakage rate for the primary containment (La) is 1.0% by weight of the containment air per 24 hours at the design basis LOCA maximum peak containment pressure (Pa) of 42.6 psig (Ref. 4).
| |
| Primary containment satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO Primary containment OPERABILITY is maintained by limiting leakage to ! 1.0 La, except prior to the first startup after performing a required Primary Containment Leakage Rate Testing Program leakage test. At this time, the applicable leakage limits must be met. In addition, the leakage from the drywell to the suppression chamber must be limited to ensure the primary containment pressure does not exceed (continued)
| |
| LaSalle 1 and 2 B 3.6.1.1-2 Revision 65
| |
| | |
| Primary Containment B 3.6.1.1 BASES LCO design limits. Compliance with this LCO will ensure a (continued) primary containment configuration, including equipment hatches, that is structurally sound and that will limit leakage to those leakage rates assumed in the safety analysis. Individual leakage rates specified for the primary containment air locks are addressed in LCO 3.6.1.2.
| |
| APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, primary containment is not required to be OPERABLE in MODES 4 and 5 to prevent leakage of radioactive material from primary containment.
| |
| ACTIONS A.1 In the event that primary containment is inoperable, primary containment must be restored to OPERABLE status within 1 hour. The 1 hour Completion Time provides a period of time to correct the problem that is commensurate with the importance of maintaining primary containment OPERABILITY during MODES 1, 2, and 3. This time period also ensures that the probability of an accident (requiring primary containment OPERABILITY) occurring during periods where primary containment is inoperable is minimal.
| |
| B.1 If primary containment cannot be restored to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which overall plant risk is minimized.
| |
| To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 5), because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.1.1-3 Revision 32
| |
| | |
| Primary Containment B 3.6.1.1 BASES (continued)
| |
| SURVEILLANCE SR 3.6.1.1.1 REQUIREMENTS Maintaining the primary containment OPERABLE requires compliance with the visual examinations and leakage rate test requirements of the Primary Containment Leakage Rate Testing Program. Failure to meet air lock leakage testing limit (SR 3.6.1.2.1), or main steam isolation valve leakage limit (SR 3.6.1.3.10) does not necessarily result in a failure of this SR. The impact of the failure to meet these SRs must be evaluated against the Type A, B, and C acceptance criteria of the Primary Containment Leakage Rate Testing Program.
| |
| As left leakage prior to the first startup after performing a required Primary Containment Leakage Rate Testing Program leakage test is required to be 0.6 La for combined Type B and C leakage, and ! 0.75 La for overall Type A leakage. At all other times between required leakage rate tests, the acceptance criteria is based on an overall Type A leakage limit of ! 1.0 La. At ! 1.0 La the offsite dose consequences are bounded by the assumptions of the safety analysis. The Frequency is required by the Primary Containment Leakage Rate Testing Program.
| |
| SR 3.6.1.1.2 The structural integrity of the primary containment is ensured by the successful completion of the Inservice Inspection Program for Post Tensioning Tendons and by associated visual inspections of the steel liner and penetrations for evidence of deterioration or breach of integrity. This ensures that the structural integrity of the primary containment will be maintained in accordance with the provisions of the Inservice Inspection Program for Post Tensioning Tendons. Testing and Frequency are consistent with the recommendations of 10 CFR 50.55a (Ref. 6), except that the Unit 1 and 2 primary containments shall be treated as twin containments even though the Initial Structural Integrity tests were not within two years of each other.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.1.1-4 Revision 32
| |
| | |
| Primary Containment B 3.6.1.1 BASES SURVEILLANCE SR 3.6.1.1.3 REQUIREMENTS (continued) Maintaining the pressure suppression function of the primary containment requires limiting the leakage from the drywell to the suppression chamber. Thus, if an event were to occur that pressurized the drywell, the steam would be directed through the downcomers into the suppression pool. This SR measures drywell-to-suppression chamber differential pressure during a 1 hour period to ensure that the leakage paths that would bypass the suppression pool are within allowable limits.
| |
| Satisfactory performance of this SR can be achieved by establishing a known differential pressure (# 1.5 psid) between the drywell and the suppression chamber and verifying that the measured bypass leakage is ! 10% of the acceptable A/ k design value of 0.030 ft2. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. One test failure increases the test Frequency to 48 months. Two consecutive test failures, however, would indicate unexpected primary containment degradation, in this event, increasing the Frequency to once every 24 months is required until the situation is remedied as evidenced by passing two consecutive tests.
| |
| SR 3.6.1.1.4 Maintaining the pressure suppression function of the primary containment requires limiting the leakage form the drywell to the suppression chamber. Thus, if an event were to occur that pressurizes the drywell, the steam would be directed through the downcomers into the suppression pool. This SR measures the individual drywell to suppression chamber vacuum relief valve bypass leakage to ensure that the leakage paths that would bypass the suppression pool are within allowable limits.
| |
| Satisfactory performance of this SR can be achieved by establishing a known differential pressure (> 1.5 psid) between the drywell side and the suppression chamber side of the drywell to suppression chamber vacuum relief valve and verifying that the measured bypass leakage is < 1.2% of the acceptable A/ k design value of 0.030 ft2. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.1.1-5 Revision 51
| |
| | |
| Primary Containment B 3.6.1.1 BASES SURVEILLANCE SR 3.6.1.1.4 (continued)
| |
| REQUIREMENTS The SR is modified by a Note stating that performance of SR 3.6.1.1.3 satisfies this Surveillance Requirement. This is acceptable since drywell to suppression chamber vacuum relief valve leakage is included in the measurement of the drywell to suppression chamber bypass leakage required by SR 3.6.1.1.3.
| |
| SR 3.6.1.1.5 Maintaining the pressure suppression function of the primary containment requires limiting the leakage form the drywell to the suppression chamber. Thus, if an event were to occur that pressurizes the drywell, the steam would be directed through the downcomers into the suppression pool. This SR determines the total drywell to suppresssion chamber vacuum relief valve bypass leakage to ensure that the leakage paths that would bypass the suppression pool are within allowable limits.
| |
| Satisfactory performance of this SR can be achieved by summing the individual drywell to suppression chamber vacuum relief valve bypass leakage form SR 3.6.1.1.4 and verifying that the measured bypass leakage is < 3.0% of the acceptable A/ k design value of 0.030 ft2. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| The SR is modified by a Note stating that performance of SR 3.6.1.1.3 satisfies this Surveillance Requirement. This is acceptable since drywell to suppression chamber vacuum relief valve leakage is included in the measurement of the drywell to suppression chamber bypass leakage required by SR 3.6.1.1.3.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.1.1-6 Revision 51
| |
| | |
| Primary Containment B 3.6.1.1 BASES (continued)
| |
| REFERENCES 1. UFSAR, Section 6.2.
| |
| : 2. UFSAR, Section 15.6.5.
| |
| : 3. 10 CFR 50, Appendix J, Option B.
| |
| : 4. UFSAR, Section 6.2.6.1.
| |
| : 5. NEDC-32988-A, Revision 2, "Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants," December 2002.
| |
| : 6. 10 CFR 50.55a.
| |
| LaSalle 1 and 2 B 3.6.1.1-7 Revision 32
| |
| | |
| Primary Containment Air Lock B 3.6.1.2 B 3.6 CONTAINMENT SYSTEMS B 3.6.1.2 Primary Containment Air Lock BASES BACKGROUND A double-door primary containment air lock has been built into the primary containment to provide personnel access to the primary containment and to provide primary containment isolation during the process of personnel entry and exit.
| |
| The air lock is designed to withstand the same loads, temperatures, and peak design internal and external pressures as the primary containment (Ref. 1). As part of the primary containment, the air lock limits the release of radioactive material to the environment during normal unit operation and through a range of transients and accidents up to and including postulated Design Basis Accidents (DBAs).
| |
| Each air lock door has been designed and tested to certify its ability to withstand pressure in excess of the maximum expected pressure following a DBA in primary containment.
| |
| Each of the doors has double, compressible seals and local leak rate testing capability to ensure pressure integrity.
| |
| To effect a leak tight seal, the air lock design uses pressure sealed doors (i.e., an increase in primary containment internal pressure results in an increased sealing on each door.).
| |
| The air lock is nominally a right circular cylinder, 10 ft in diameter, with doors at each end that are interlocked to prevent simultaneous opening. The air lock is provided with limit switches on both doors that provide remote indication of door position via an alarm in the control room that indicates when an air lock door is open. During periods when primary containment is not required to be OPERABLE, the air lock interlock mechanism may be disabled, allowing both doors of the air lock to remain open for extended periods when frequent primary containment entry is necessary. Under some conditions, as allowed by this LCO, the primary containment may be accessed through the air lock when the door interlock mechanism has failed, by manually performing the interlock function.
| |
| The primary containment air lock forms part of the primary containment pressure boundary. As such, air lock integrity and leak tightness are essential for maintaining primary (continued)
| |
| LaSalle 1 and 2 B 3.6.1.2-1 Revision 0
| |
| | |
| Primary Containment Air Lock B 3.6.1.2 BASES BACKGROUND containment leakage rate to within limits in the event of a (continued) DBA. Not maintaining air lock integrity or leak tightness may result in a leakage rate in excess of that assumed in the safety analysis.
| |
| APPLICABLE The DBA that postulates the maximum release of radioactive SAFETY ANALYSES material within primary containment is a LOCA. In the analysis of this accident, it is assumed that primary containment is OPERABLE, such that release of fission products to the environment is controlled by the rate of primary containment leakage. The primary containment is designed with a maximum allowable leakage rate (La) of 1.0%
| |
| by weight of the containment air mass per 24 hours at the Design Basis LOCA maximum peak containment pressure (Pa) of 42.6 psig (Ref. 2). This allowable leakage rate forms the basis for the acceptance criteria imposed on the SRs associated with the air lock.
| |
| Primary containment air lock OPERABILITY is also required to minimize the amount of fission product gases that may escape primary containment through the air lock and contaminate and pressurize the secondary containment.
| |
| Primary containment air lock satisfies Criterion 3 of the 10 CFR 50.36(c)(2)(ii).
| |
| LCO As part of the primary containment pressure boundary, the air lock safety function is related to control of containment leakage following a DBA. Thus, the air lock structural integrity and leak tightness are essential to the successful mitigation of such an event.
| |
| The primary containment air lock is required to be OPERABLE.
| |
| For the air lock to be considered OPERABLE, the air lock interlock mechanism must be OPERABLE, the air lock must be in compliance with the Type B air lock leakage test, and both air lock doors must be OPERABLE. The interlock allows only one air lock door to be open at a time. This provision ensures that a gross breach of primary containment does not exist when primary containment is required to be OPERABLE.
| |
| Closure of a single door in the air lock is sufficient to (continued)
| |
| LaSalle 1 and 2 B 3.6.1.2-2 Revision 65
| |
| | |
| Primary Containment Air Lock B 3.6.1.2 BASES LCO provide a leak tight barrier following postulated events.
| |
| (continued) Nevertheless, both doors are kept closed when the air lock is not being used for normal entry into or exit from primary containment.
| |
| APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, the primary containment air lock is not required to be OPERABLE in MODES 4 and 5 to prevent leakage of radioactive material from primary containment.
| |
| ACTIONS The ACTIONS are modified by Note 1, which allows entry and exit to perform repairs of the affected air lock component.
| |
| If the outer door is inoperable, then it may be easily accessed for most repairs. If the inner door is the one that is inoperable, however, then a short time exists when the primary containment boundary is not intact (during access through the OPERABLE door). The allowance to open the OPERABLE door, even if it means the primary containment boundary is temporarily not intact, is acceptable due to the low probability of an event that could pressurize the primary containment during the short time in which the OPERABLE door is expected to be open. The required administrative controls consist of stationing a dedicated individual to assure closure of the OPERABLE door except during the entry and exit and to assure the OPERABLE door is relocked after completion of the containment entry and exit.
| |
| The ACTIONS are modified by a second Note, which ensures appropriate remedial actions are taken when necessary, if airlock leakage results in exceeding overall containment leakage rate acceptance criteria. Pursuant to LCO 3.0.6, ACTIONS are not required even if primary containment leakage is exceeding leakage La. Therefore, the Note is added to require ACTIONS for LCO 3.6.1.1, "Primary Containment," to be taken in this event.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.1.2-3 Revision 0
| |
| | |
| Primary Containment Air Lock B 3.6.1.2 BASES ACTIONS A.1, A.2, and A.3 (continued)
| |
| With one primary containment air lock door inoperable, the OPERABLE door must be verified closed (Required Action A.1).
| |
| This ensures that a leak tight primary containment barrier is maintained by the use of an OPERABLE air lock door. This action must be completed within 1 hour. The 1 hour Completion Time is consistent with the ACTIONS of LCO 3.6.1.1, which requires that primary containment be restored to OPERABLE status within 1 hour.
| |
| In addition, the air lock penetration must be isolated by locking closed the OPERABLE air lock door within the 24 hour Completion Time. The 24 hour Completion Time is considered reasonable for locking the OPERABLE air lock door, considering the OPERABLE door of the air lock is being maintained closed.
| |
| Required Action A.3 ensures that the air lock penetration has been isolated by the use of a locked closed OPERABLE air lock door. This ensures that an acceptable primary containment leakage boundary is maintained. The Completion Time of once per 31 days is based on engineering judgment and is considered adequate given the low likelihood of a locked door being mispositioned and other administrative controls. Required Action A.3 is modified by a Note that applies to air lock doors located in high radiation areas or areas with limited access due to inerting and allows these doors to be verified locked closed by use of administrative controls. Allowing verification by administrative controls is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of the door, once it has been verified to be in the proper position, is small.
| |
| The Required Actions have been modified by two Notes.
| |
| Note 1 ensures that only the Required Actions and associated Completion Times of Condition C are required if both doors in the air lock are inoperable. With both doors in the air lock inoperable, an OPERABLE door is not available to be closed. Required Actions C.1 and C.2 are the appropriate remedial actions. The exception of Note 1 does not affect tracking the Completion Time from the initial entry into Condition A; only the requirement to comply with the (continued)
| |
| LaSalle 1 and 2 B 3.6.1.2-4 Revision 0
| |
| | |
| Primary Containment Air Lock B 3.6.1.2 BASES ACTIONS A.1, A.2, and A.3 (continued)
| |
| Required Actions. Note 2 allows use of the air lock for entry and exit for 7 days under administrative controls.
| |
| This 7 day restriction begins when the air lock is discovered inoperable.
| |
| Primary containment entry may be required to perform Technical Specifications (TS) Surveillances and Required Actions, as well as other activities inside primary containment that are required by TS or activities that support TS-required equipment. This Note is not intended to preclude performing other activities (i.e., non-TS-related activities) if the primary containment was entered, using the inoperable air lock, to perform an allowed activity listed above. The required administrative controls consist of stationing a dedicated individual to assure closure of the OPERABLE door except during periods of entry and exit, and to assure the OPERABLE door is relocked after completion of the containment entry and exit This allowance is acceptable due to the low probability of an event that could pressurize the primary containment during the short time that the OPERABLE door is expected to be open.
| |
| B.1, B.2, and B.3 With the air lock interlock mechanism inoperable, the Required Actions and associated Completion Times are consistent with those specified in Condition A.
| |
| The Required Actions have been modified by two Notes.
| |
| Note 1 ensures that only the Required Actions and associated Completion Times of Condition C are required if both doors in the air lock are inoperable. With both doors in the air lock inoperable, an OPERABLE door is not available to be closed. Required Actions C.1 and C.2 are the appropriate remedial actions. Note 2 allows entry into and exit from the primary containment under the control of a dedicated individual stationed at the air lock to ensure that only one door is opened at a time (i.e., the individual performs the function of the interlock).
| |
| Required Action B.3 is modified by a Note that applies to air lock doors located in high radiation areas or areas with limited access due to inerting and allows these doors to be (continued)
| |
| LaSalle 1 and 2 B 3.6.1.2-5 Revision 0
| |
| | |
| Primary Containment Air Lock B 3.6.1.2 BASES ACTIONS B.1, B.2, and B.3 (continued) verified locked closed by use of administrative controls.
| |
| Allowing verification by administrative controls is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of the door, once it has been verified to be in the proper position, is small.
| |
| C.1, C.2, and C.3 With the air lock inoperable for reasons other than those described in Condition A or B, Required Action C.1 requires action to be immediately initiated to evaluate containment overall leakage rates using current air lock leakage test results. An evaluation is acceptable since it is overly conservative to immediately declare the primary containment inoperable if both doors in the air lock have failed a seal test or if the overall air lock leakage is not within limits. In many instances (e.g., only one seal per door has failed) primary containment remains OPERABLE, yet only 1 hour (according to LCO 3.6.1.1) would be provided to restore the air lock door to OPERABLE status prior to requiring a plant shutdown. In addition, even with both doors failing the seal test, the overall containment leakage rate can still be within limits.
| |
| Required Action C.2 requires that one door in the primary containment air locks must be verified closed. This Required Action must be completed within the 1 hour Completion Time. This specified time period is consistent with the ACTIONS of LCO 3.6.1.1, which require that primary containment be restored to OPERABLE status within 1 hour.
| |
| Additionally, the air lock must be restored to OPERABLE status within 24 hours (Required Action C.3).
| |
| Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.
| |
| The 24 hour Completion Time is reasonable for restoring the inoperable air lock to OPERABLE status considering that at least one door is maintained closed in the air lock.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.1.2-6 Revision 89
| |
| | |
| Primary Containment Air Lock B 3.6.1.2 BASES ACTIONS D.1 and D.2 (continued)
| |
| If the inoperable primary containment air lock cannot be restored to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
| |
| SURVEILLANCE SR 3.6.1.2.1 REQUIREMENTS Maintaining the primary containment air lock OPERABLE requires compliance with the leakage rate test requirements of the Primary Containment Leakage Rate Testing Program.
| |
| This SR reflects the leakage rate testing requirements with regard to air lock leakage (Type B leakage tests). The acceptance criteria were established as a small fraction of the total allowable primary containment leakage. The periodic testing requirements verify that the air lock leakage does not exceed the allowed fraction of the overall primary containment leakage rate. The Frequency is required by the Primary Containment Leakage Rate Testing Program.
| |
| The SR has been modified by two Notes. Note 1 states that an inoperable air lock door does not invalidate the previous successful performance of the overall air lock leakage test.
| |
| This is considered reasonable since either air lock door is capable of providing a fission product barrier in the event of a DBA. Note 2 has been added to this SR, requiring the results to be evaluated against the acceptance criteria which is applicable to SR 3.6.1.1.1. This ensures that air lock leakage is properly accounted for in determining the combined Types B and C primary containment leakage rate.
| |
| SR 3.6.1.2.2 The air lock interlock mechanism is designed to prevent simultaneous opening of both doors in the air lock. Since both the inner and outer doors of the air lock are designed to withstand the maximum expected post accident primary (continued)
| |
| LaSalle 1 and 2 B 3.6.1.2-7 Revision 0
| |
| | |
| Primary Containment Air Lock B 3.6.1.2 BASES SURVEILLANCE SR 3.6.1.2.2 (continued)
| |
| REQUIREMENTS containment pressure (Ref. 2), closure of either door will support primary containment OPERABILITY. Thus, the interlock feature supports primary containment OPERABILITY while the air lock is being used for personnel transit in and out of the containment. Periodic testing of this interlock demonstrates that the interlock will function as designed and that simultaneous inner and outer door opening will not inadvertently occur. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 3.8.1.1.3.5.1.
| |
| : 2. UFSAR, Section 6.2.6.1.
| |
| LaSalle 1 and 2 B 3.6.1.2-8 Revision 51
| |
| | |
| PCIVs B 3.6.1.3 B 3.6 CONTAINMENT SYSTEMS B 3.6.1.3 Primary Containment Isolation Valves (PCIVs)
| |
| BASES BACKGROUND The function of the PCIVs, in combination with other accident mitigation systems, is to limit fission product release during and following postulated Design Basis Accidents (DBAs) to within limits. Primary containment isolation within the time limits specified for those PCIVs designed to close automatically ensures that the release of radioactive material to the environment will be consistent with the assumptions used in the analyses for a DBA.
| |
| The OPERABILITY requirements for PCIVs help ensure that an adequate primary containment boundary is maintained during and after an accident by minimizing potential paths to the environment. Therefore, the OPERABILITY requirements provide assurance that the primary containment function assumed in the safety analysis will be maintained. These isolation devices consist of either passive devices or active (automatic) devices. Manual valves, de-activated automatic valves secured in their closed position (including check valves with flow through the valve secured), blind flanges (which include plugs and caps as listed in Reference 1), and closed systems are considered passive devices. Check valves, or other automatic valves designed to close without operator action following an accident, are considered active devices. Two barriers in series are provided for each penetration, except for penetrations isolated by excess flow check valves, so that no single credible failure or malfunction of an active component can result in a loss of isolation or leakage that exceeds limits assumed in the safety analysis. One of these barriers may be a closed system.
| |
| The 8 and 26 inch primary containment purge valves are PCIVs that are qualified for use during all operational conditions. The 8 and 26 inch primary containment purge valves are normally maintained closed in MODES 1, 2, and 3 to ensure the primary containment boundary is maintained.
| |
| However, these purge valves may be open when being used for inerting, de-inerting pressure control, ALARA, or air quality considerations since they are fully qualified.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.1.3-1 Revision 0
| |
| | |
| PCIVs B 3.6.1.3 BASES (continued)
| |
| APPLICABLE The PCIVs LCO was derived from the assumptions related SAFETY ANALYSES to minimizing the loss of reactor coolant inventory, and establishing the primary containment boundary during major accidents. As part of the primary containment boundary, PCIV OPERABILITY supports leak tightness of primary containment. Therefore, the safety analysis of any event requiring isolation of primary containment is applicable to this LCO.
| |
| The DBAs that result in a release of radioactive material for which the consequences are mitigated by PCIVs are a loss of coolant accident (LOCA) and a main steam line break (MSLB) (Refs. 2 and 3). In the analysis for each of these accidents, it is assumed that PCIVs are either closed or function to close within the required isolation time following event initiation. This ensures that potential paths to the environment through PCIVs (including primary containment purge valves) are minimized. Of the events analyzed in References 2 and 3, the LOCA is the most limiting event due to radiological consequences. For the MSLB, the closure time of the main steam isolation valves (MSIVs) is a significant variable from a radiological standpoint. The MSIVs are required to close within 3 to 5 seconds since the 3 second closure time is assumed in the MSIV closure (the most severe overpressurization transient) analysis (Ref. 4) and the 5 second closure time is assumed in the MSLB analysis (Ref. 3). Likewise, it is assumed that the primary containment isolates such that release of fission products to the environment is controlled.
| |
| The DBA analysis assumes that isolation of the primary containment is complete and leakage terminated, except for the maximum allowable leakage prior to fuel damage.
| |
| The single failure criterion required to be imposed in the conduct of unit safety analyses was considered in the original design of the primary containment purge valves.
| |
| Two valves in series on each purge line provide assurance that both the supply and exhaust lines could be isolated even if a single failure occurred.
| |
| PCIVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.1.3-2 Revision 0
| |
| | |
| PCIVs B 3.6.1.3 BASES (continued)
| |
| LCO PCIVs form a part of the primary containment boundary. The PCIV safety function is related to minimizing the loss of reactor coolant inventory and establishing the primary containment boundary during a DBA.
| |
| The power operated, automatic isolation valves are required to have isolation times within limits and actuate on an automatic isolation signal. The valves covered by this LCO are listed with their associated stroke times in the Technical Requirements Manual (Ref. 1).
| |
| The normally closed manual PCIVs are considered OPERABLE when the valves are closed and blind flanges are in place, or open under administrative controls. Normally closed automatic PCIVs which are required by design (e.g., to meet 10 CFR 50 Appendix R requirements) to be de-activated and closed, are considered OPERABLE when the valves are de-activated and closed. These passive isolation valves and devices are those listed in Reference 1. MSIVs and hydrostatically tested valves must meet additional leakage rate requirements. Other PCIV leakage rates are addressed by LCO 3.6.1.1, "Primary Containment," as Type B or C testing.
| |
| This LCO provides assurance that the PCIVs will perform their designed safety functions to minimize the loss of reactor coolant inventory and establish the primary containment boundary during accidents.
| |
| APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.1.3-3 Revision 76
| |
| | |
| PCIVs B 3.6.1.3 BASES (continued)
| |
| ACTIONS The ACTIONS are modified by a Note allowing penetration flow path(s) to be unisolated intermittently under administrative controls. These controls consist of stationing a dedicated operator at the controls of the valve, who is in continuous communication with the control room. In this way, the penetration can be rapidly isolated when a need for primary containment isolation is indicated.
| |
| A second Note has been added to provide clarification that, for the purpose of this LCO, separate Condition entry is allowed for each penetration flow path. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable PCIV.
| |
| Complying with the Required Actions may allow for continued operation, and subsequent inoperable PCIVs are governed by subsequent Condition entry and application of associated Required Actions.
| |
| The ACTIONS are modified by Notes 3 and 4. Note 3 ensures appropriate remedial actions are taken, if necessary, if the affected system(s) are rendered inoperable by an inoperable PCIV (e.g., an Emergency Core Cooling System subsystem is inoperable due to a failed open test return valve). Note 4 ensures appropriate remedial actions are taken when the primary containment leakage limits are exceeded. Pursuant to LCO 3.0.6, these ACTIONS are not required even when the associated LCO is not met. Therefore, Notes 3 and 4 are added to require the proper actions be taken.
| |
| A.1 and A.2 With one or more penetration flow paths with one PCIV inoperable, except for MSIV leakage rate or hydrostatically tested line leakage rate not within limit, the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, a blind flange, and a check valve with flow through the valve secured. For penetrations isolated in accordance with Required Action A.1, the device used to isolate the (continued)
| |
| LaSalle 1 and 2 B 3.6.1.3-4 Revision 0
| |
| | |
| PCIVs B 3.6.1.3 BASES ACTIONS A.1 and A.2 (continued) penetration should be the closest available one to the primary containment. The Required Action must be completed within the 4 hour Completion Time (8 hours for main steam lines) or in accordance with the Risk Informed Completion Time Program. The specified time period of 4 hours is reasonable considering the time required to isolate the penetration and the relative importance of supporting primary containment OPERABILITY during MODES 1, 2, and 3.
| |
| For main steam lines, an 8 hour Completion Time is allowed.
| |
| Alternatively, a Completion Time can be determined in accordance with the Risk informed Completion Time Program.
| |
| The Completion Time of 8 hours for the main steam lines allows a period of time to restore the MSIVs to OPERABLE status given the fact that MSIV closure will result in isolation of the main steam line(s) and a potential for plant shutdown.
| |
| For affected penetrations that have been isolated in accordance with Required Action A.1, the affected penetration flow path must be verified to be isolated on a periodic basis. This is necessary to ensure that primary containment penetrations required to be isolated following an accident, and no longer capable of being automatically isolated, will be in the isolation position should an event occur. This Required Action does not require any testing or device manipulation. Rather, it involves verification that those devices outside the primary containment and capable of being mispositioned are in the correct position. The Completion Time for this verification of "once per 31 days following isolation for isolation devices outside primary containment" is appropriate because the devices are operated under administrative controls and the probability of their misalignment is low. For devices inside the primary containment, the specified time period of "prior to entering MODE 2 or 3 from MODE 4 if primary containment was de-inerted while in MODE 4, if not performed within the previous 92 days," is based on engineering judgment and is considered reasonable in view of the inaccessibility of the devices and the existence of other administrative controls ensuring that device misalignment is an unlikely possibility.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.1.3-5 Revision 89
| |
| | |
| PCIVs B 3.6.1.3 BASES ACTIONS A.1 and A.2 (continued)
| |
| Condition A is modified by a Note indicating that this Condition is only applicable to those penetration flow paths with two or more PCIVs. For penetration flow paths with one PCIV, Condition C provides appropriate Required Actions.
| |
| Required Action A.2 is modified by two Notes. Note 1 applies to isolation devices located in high radiation areas and allows them to be verified by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Note 2 applies to isolation devices that are locked, sealed, or otherwise secured in position and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since the function of locking, sealing, or securing components is to ensure that these devices are not inadvertently repositioned. Therefore, the probability of misalignment, once they have been verified to be in the proper position, is low.
| |
| B.1 With one or more penetration flow paths with two or more PCIVs inoperable, except for MSIV leakage rate or hydrostatically tested line leakage rate not within limit, either the inoperable PCIVs must be restored to OPERABLE status or the affected penetration flow path must be isolated within 1 hour. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure.
| |
| Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange. The 1 hour Completion Time is consistent with the ACTIONS of LCO 3.6.1.1.
| |
| Condition B is modified by a Note indicating this Condition is only applicable to penetration flow paths with two or more PCIVs. For penetration flow paths with one PCIV, Condition C provides the appropriate Required Actions.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.1.3-6 Revision 89
| |
| | |
| PCIVs B 3.6.1.3 BASES ACTIONS C.1 and C.2 (continued)
| |
| When one or more penetration flow paths with one PCIV inoperable, except for MSIV leakage rate or hydrostatically tested line leakage rate not within limit, the inoperable valve must be restored to OPERABLE status or the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange. A check valve may not be used to isolate the affected penetration. The Completion Time of 4 hours for valves other than EFCVs and in penetrations with a closed system is reasonable considering the time required to isolate the penetration and the relative importance of supporting primary containment OPERABILITY during MODES 1, 2, and 3. The Completion Time of 72 hours for penetrations with a closed system is reasonable considering the relative stability of the closed system (hence, reliability) to act as a penetration isolation boundary and the relative importance of supporting primary containment OPERABILITY during MODES 1, 2, and 3. The closed system must meet the requirements of Reference 5. The Completion Time of 72 hours for EFCVs is also reasonable considering the instrument and the small pipe diameter of penetration (hence, reliability) to act as a penetration isolation boundary and the small pipe diameter of the affected penetration. In the event the affected penetration is isolated in accordance with Required Action C.1, the affected penetration flow path must be verified to be isolated on a periodic basis. This is necessary to ensure that primary containment penetrations required to be isolated following an accident are isolated. This Required Action does not require any testing or valve manipulation.
| |
| Rather, it involves verification that these devices outside containment and capable of potentially being mispositioned are in the correct position. The Completion Time of "once per 31 days" following isolation is appropriate because the devices are operated under administrative controls and the probability of their misalignment is low.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.1.3-7 Revision 89
| |
| | |
| PCIVs B 3.6.1.3 BASES ACTIONS C.1 and C.2 (continued)
| |
| Condition C is modified by a Note indicating this Condition is applicable only to those penetration flow paths with only one PCIV. For penetration flow paths with two or more PCIVs, Conditions A and B provide the appropriate Required Actions. This Note is necessary since this Condition is written specifically to address those penetrations with a single PCIV.
| |
| Required Action C.2 is modified by two Notes. Note 1 applies to isolation devices located in high radiation areas and allows them to be verified by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Note 2 applies to isolation devices that are locked, sealed, or otherwise secured in position and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since the function of locking, sealing, or securing components is to ensure that these devices are not inadvertently repositioned. Therefore, the probability of misalignment, once they have been verified to be in the proper position, is low.
| |
| D.1 With the MSIV leakage rate (SR 3.6.1.3.10) or hydrostatically tested line leakage rate (SR 3.6.1.3.11) not within limit, the assumptions of the safety analysis may not be met. Therefore, the leakage rate must be restored to within limit within the Completion Times appropriate for each type of valve leakage: a) hydrostatically tested line leakage not on a closed system is required to be restored within 4 hours; b) MSIV leakage is required to be restored within 8 hours; and c) hydrostatically tested line leakage on a closed system is required to be restored within 72 hours. Restoration can be accomplished by isolating the penetration that caused the limit to be exceeded by use of one closed and de-activated automatic valve, closed manual valve, or blind flange. When a penetration is isolated, the (continued)
| |
| LaSalle 1 and 2 B 3.6.1.3-8 Revision 0
| |
| | |
| PCIVs B 3.6.1.3 BASES ACTIONS D.1 (continued) leakage rate for the isolated penetration is assumed to be the actual pathway leakage through the isolation device. If two isolation devices are used to isolate the penetration, the leakage rate is assumed to be the lesser actual pathway leakage of the two devices. The 4 hour Completion Time for hydrostatically tested line leakage not on a closed system is reasonable considering the time required to restore leakage by isolating the penetration and the relative importance of the hydrostatically tested line leakage to the overall containment function. The Completion Time of 8 hours for MSIV leakage allows a period of time to restore the MSIV leakage rate to within limit given the fact that MSIV closure will result in isolation of the main steam line(s) and a potential for plant shutdown. The 72 hour Completion Time for hydrostatically tested line leakage on a closed system is acceptable based on the available water seal expected to remain as a gaseous fission product boundary during the accident, and, in many cases, the associated closed system. The closed system must meet the requirements of Reference 5.
| |
| E.1 and E.2 If any Required Action and associated Completion Time cannot be met in MODE 1, 2, or 3, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.1.3-9 Revision 76
| |
| | |
| PCIVs B 3.6.1.3 BASES (continued)
| |
| SURVEILLANCE SR 3.6.1.3.1 REQUIREMENTS This SR verifies that the 8 inch and 26 inch primary containment purge valves are closed as required or, if open, opened for an allowable reason.
| |
| The SR is modified by a Note stating that the SR is not required to be met when the purge valves are open for the stated reasons. The Note states that these valves may be opened for inerting, de-inerting, pressure control, ALARA, or air quality considerations for personnel entry, or for Surveillances that require the valves to be open, provided the drywell purge valves and suppression chamber purge valves are not open simultaneously. This is required to prevent a bypass path between the suppression chamber and the drywell, which would allow steam and gases from a LOCA to bypass the downcomers to the suppression pool. These primary containment purge valves are capable of closing in the environment following a LOCA. Therefore, these valves are allowed to be open for limited periods of time. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.6.1.3.2 This SR verifies that each primary containment isolation manual valve and blind flange that is located outside primary containment and not locked, sealed, or otherwise secured and is required to be closed during accident conditions, is closed. The SR helps to ensure that post (continued)
| |
| LaSalle 1 and 2 B 3.6.1.3-10 Revision 76
| |
| | |
| PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.2 (continued)
| |
| REQUIREMENTS accident leakage of radioactive fluids or gases outside of the primary containment boundary is within design limits.
| |
| This SR does not require any testing or valve manipulation.
| |
| Rather, it involves verification that those PCIVs outside primary containment, and capable of being mispositioned, are in the correct position. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR does not apply to valves that are locked, sealed, or otherwise secured in the closed position, since these were verified to be in the correct position upon locking, sealing, or securing.
| |
| Two Notes are added to this SR. The first Note applies to valves and blind flanges located in high radiation areas and allows them to be verified by use of administrative controls. Allowing verification by administrative controls is considered acceptable, since access to these areas is typically restricted during MODES 1, 2, and 3 for ALARA reasons. Therefore, the probability of misalignment of these PCIVs, once they have been verified to be in the proper position, is low. A second Note is included to clarify that PCIVs open under administrative controls are not required to meet the SR during the time the PCIVs are open. These controls consist of stationing a dedicated operator at the controls of the valve, who is in continuous communication with the control room. In this way, the penetration can be rapidly isolated when a need for primary containment isolation is indicated.
| |
| SR 3.6.1.3.3 This SR verifies that each primary containment manual isolation valve and blind flange located inside primary containment and not locked, sealed, or otherwise secured and required to be closed during accident conditions, is closed.
| |
| The SR helps to ensure that post accident leakage of radioactive fluids or gases outside the primary containment boundary is within design limits. For PCIVs inside primary (continued)
| |
| LaSalle 1 and 2 B 3.6.1.3-11 Revision 51
| |
| | |
| PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.3 (continued)
| |
| REQUIREMENTS containment, the Frequency of "prior to entering MODE 2 or 3 from MODE 4 if primary containment was de-inerted while in MODE 4, if not performed within the previous 92 days," is appropriate since these PCIVs are operated under administrative controls and the probability of their misalignment is low. This SR does not apply to valves that are locked, sealed, or otherwise secured in the closed position, since these were verified to be in the correct position upon locking, sealing, or securing.
| |
| Two Notes are added to this SR. The first Note allows valves and blind flanges located in high radiation areas to be verified by use of administrative controls. Allowing verification by administrative controls is considered acceptable since the primary containment is inerted and access to these areas is typically restricted during MODES 1, 2, and 3 for ALARA and personnel safety.
| |
| Therefore, the probability of misalignment of these PCIVs, once they have been verified to be in their proper position, is low. A second Note is included to clarify that PCIVs that are open under administrative controls are not required to meet the SR during the time that the PCIVs are open.
| |
| These controls consist of stationing a dedicated operator at the controls of the valve, who is in continuous communication with the control room. In this way, the penetration can be rapidly isolated when a need for primary containment isolation is indicated.
| |
| SR 3.6.1.3.4 The traversing incore probe (TIP) shear isolation valves are actuated by explosive charges. Surveillance of explosive charge continuity provides assurance that TIP valves will actuate when required. Other administrative controls, such as those that limit the shelf life and operating life, as applicable, of the explosive charges, must be followed. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.1.3-12 Revision 51
| |
| | |
| PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.5 REQUIREMENTS (continued) Verifying the isolation time of each power operated, automatic PCIV is within limits is required to demonstrate OPERABILITY. MSIVs may be excluded from this SR since MSIV full closure isolation time is demonstrated by SR 3.6.1.3.6.
| |
| The isolation time test ensures that each valve will isolate in a time period less than or equal to that assumed in the safety analysis. The Frequency of this SR is in accordance with the INSERVICE TESTING PROGRAM.
| |
| SR 3.6.1.3.6 Verifying that the full closure isolation time of each MSIV is within the specified limits is required to demonstrate OPERABILITY. The full closure isolation time test ensures that the MSIV will isolate in a time period that does not exceed the times assumed in the DBA and transient analyses.
| |
| The Frequency of this SR is in accordance with the INSERVICE TESTING PROGRAM.
| |
| SR 3.6.1.3.7 Automatic PCIVs close on a primary containment isolation signal to prevent leakage of radioactive material from primary containment following a DBA. This SR ensures that each automatic PCIV will actuate to its isolation position on a primary containment isolation signal. The LOGIC SYSTEM FUNCTIONAL TEST in LCO 3.3.6.1, "Primary Containment Isolation Instrumentation," overlaps this SR to provide complete testing of the safety function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.1.3-13 Revision 70
| |
| | |
| PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.8 REQUIREMENTS (continued) This SR requires a demonstration that a representative sample of reactor instrumentation line EFCVs are OPERABLE by verifying that each valve actuates to the isolation position on an actual or simulated instrumentation line break condition. The representative sample consists of an approximately equal number of EFCVs, such that each EFCV is tested at least once every 10 years (nominal). This SR provides assurance that the reactor instrumentation line EFCVs will perform as designed. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| The nominal 10 year interval is based on other performance-based testing programs, such as Inservice Testing (snubbers) and Option B to 10 CFR 50, Appendix J. Furthermore, any EFCV failures will be evaluated to determine if additional testing in that test interval is warranted to ensure overall reliability is maintained. Operating experience has demonstrated that these components are highly reliable and that failures to isolate are very infrequent. Therefore, testing of a representative sample was concluded to be acceptable from a reliability standpoint.
| |
| Instrumentation lines that connect to the containment atmosphere, such as those which measure drywell pressure, or monitor the containment atmosphere or suppression pool water level, are considered extensions of primary containment. A failure of one of these instrumentation lines during normal operation would not result in the closure of the associated EFCV, since normal operating containment pressure is not sufficient to operate the valve. Such EFCVs will only close with a downstream line break concurrent with a LOCA. Since these conditions are beyond the plant design basis, EFCV closure is not needed and containment atmospheric instrumentation line EFCVs need not be tested (Ref. 6).
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.1.3-14 Revision 77
| |
| | |
| PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.9 REQUIREMENTS (continued) The TIP shear isolation valves are actuated by explosive charges. An in place functional test is not possible with this design. The explosive squib is removed and tested to provide assurance that the valves will actuate when required. The replacement charge for the explosive squib shall be from the same manufactured batch as the one fired or from another batch that has been certified by having one of the batch successfully fired. Other administrative controls, such as those that limit the shelf life and operating life, as applicable, of the explosive charges, must be followed. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.6.1.3.10 The analyses in Reference 2 are based on leakage that is less than the specified leakage rate. Leakage through any one main steam line must be d 200 scfh and through all four main steam lines must be d 400 scfh when tested at Pt (25.0 psig). This ensures that MSIV leakage is properly accounted for in determining the overall primary containment leakage rate. The Frequency is required by the Primary Containment Leakage Rate Testing Program.
| |
| SR 3.6.1.3.11 Surveillance of hydrostatically tested lines provides assurance that the calculation assumptions of Reference 2 are met. The acceptance criteria for the combined leakage of all hydrostatically tested lines is 1 gpm times the total number of hydrostatically tested PCIVs when tested at t 1.1 Pa, or other acceptable criteria based upon satisfying the acceptance criteria of 10 CFR 50.67, regarding the site radiological analysis. The combined leakage rates must be demonstrated in accordance with the leakage test Frequency required by the Primary Containment Leakage Rate Testing Program.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.1.3-15 Revision 77
| |
| | |
| PCIVs B 3.6.1.3 BASES (continued)
| |
| REFERENCES 1. Technical Requirements Manual.
| |
| : 2. UFSAR, Section 15.6.5.
| |
| : 3. UFSAR, Section 15.6.4.
| |
| : 4. UFSAR, Section 15.2.4.
| |
| : 5. UFSAR, Section 6.2.4.2.3.
| |
| : 6. NEDO-32977-A, "Excess Flow Check Valve Testing Relaxation," June 2000 LaSalle 1 and 2 B 3.6.1.3-16 Revision 77
| |
| | |
| Drywell and Suppression Chamber Pressure B 3.6.1.4 B 3.6 CONTAINMENT SYSTEMS B 3.6.1.4 Drywell and Suppression Chamber Pressure BASES BACKGROUND The drywell and suppression chamber internal pressure is limited during normal operation to preserve the initial conditions assumed in the accident analyses for a Design Basis Accident (DBA) or loss of coolant accident (LOCA).
| |
| Transient events, which include inadvertent drywell spray initiation, can reduce the drywell and suppression chamber internal pressure. Without an appropriate limit on the minimum drywell and suppression chamber internal pressure
| |
| (-0.5 psig), the design limit for negative containment differential pressure of 5.0 psid could be exceeded (Ref. 1).
| |
| The limitation on the maximum drywell and suppression chamber internal pressure (0.75 psig) provides added assurance that the peak LOCA drywell and suppression chamber pressure does not exceed the design value of 45 psig (Ref. 1).
| |
| APPLICABLE Primary containment performance for the DBA is evaluated for SAFETY ANALYSES the entire spectrum of break sizes for postulated LOCAs inside containment (Ref. 2). Among the inputs to the design basis analysis is the initial drywell and suppression chamber internal pressure. The initial pressure limitation requirements ensure that peak primary containment pressure for a DBA LOCA does not exceed the design value of 45 psig and that peak negative pressure for an inadvertent drywell spray event does not exceed the design value of 5.0 psid.
| |
| Primary containment pressure satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO A limitation on the drywell and suppression chamber internal pressure of -0.5 psig and +0.75 psig is required to ensure that primary containment initial conditions are consistent with the initial safety analyses assumptions so (continued)
| |
| LaSalle 1 and 2 B 3.6.1.4-1 Revision 0
| |
| | |
| Drywell and Suppression Chamber Pressure B 3.6.1.4 BASES LCO that containment pressures remain within design values (cont'd) during a LOCA and the design value of containment negative pressure is not exceeded during an inadvertent operation of drywell sprays.
| |
| APPLICABILITY In MODES 1, 2, and 3, a DBA could result in a release of radioactive material to primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, maintaining drywell and suppression chamber internal pressure within limits is not required in MODE 4 or 5.
| |
| ACTIONS A.1 When drywell or suppression chamber internal pressure is not within the limits of the LCO, drywell and suppression chamber internal pressure must be restored to within limits within 1 hour. The Required Action is necessary to return operation to within the bounds of the primary containment analysis. The 1 hour Completion Time is consistent with the ACTIONS of LCO 3.6.1.1, "Primary Containment," which requires that primary containment be restored to OPERABLE status within 1 hour.
| |
| B.1 and B.2 If drywell and suppression chamber internal pressure cannot be restored to within limits within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.1.4-2 Revision 0
| |
| | |
| Drywell and Suppression Chamber Pressure B 3.6.1.4 BASES (continued)
| |
| SURVEILLANCE SR 3.6.1.4.1 REQUIREMENTS Verifying that drywell and suppression chamber internal pressure is within limits ensures that operation remains within the limits assumed in the primary containment analysis. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 6.2.1.1.3.
| |
| : 2. UFSAR, Section 6.2.1.1.3.1.
| |
| LaSalle 1 and 2 B 3.6.1.4-3 Revision 51
| |
| | |
| Drywell Air Temperature B 3.6.1.5 B 3.6 CONTAINMENT SYSTEMS B 3.6.1.5 Drywell Air Temperature BASES BACKGROUND Heat loads from the drywell, as well as piping and equipment, add energy to the airspace and raise airspace temperature. Coolers included in the unit design remove this energy and maintain an appropriate average temperature.
| |
| The average airspace temperature affects the calculated response to postulated Design Basis Accidents (DBAs). This drywell air temperature limit is an initial condition input for the Reference 1 safety analyses.
| |
| APPLICABLE Primary containment performance for the DBA is evaluated for SAFETY ANALYSES a entire spectrum of break sizes for postulated loss of coolant accidents (LOCAs) inside containment (Ref. 1).
| |
| Among the inputs to the design basis analysis is the initial drywell average air temperature. Analyses assume an initial average drywell temperature of 135°F. Maintaining the expected initial conditions ensures that safety analyses remain valid and ensures that the peak LOCA primary drywell temperature does not exceed the maximum allowable temperature of 340°F (Ref. 1). Exceeding this design temperature may result in the degradation of the primary containment structure under accident loads. Equipment inside primary containment, and needed to mitigate the effects of a DBA, is designed to operate and be capable of operating under environmental conditions expected for the accident.
| |
| Drywell air temperature satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO With an initial drywell average air temperature less than or equal to the LCO temperature limit, the peak accident temperature is maintained below the drywell design temperature. As a result, the ability of primary containment to perform its design function is ensured.
| |
| APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to primary containment. In MODES 4 and 5, the probability and consequences of these events are (continued)
| |
| LaSalle 1 and 2 B 3.6.1.5-1 Revision 0
| |
| | |
| Drywell Air Temperature B 3.6.1.5 BASES APPLICABILITY reduced due to the pressure and temperature limitations of (continued) these MODES. Therefore, maintaining drywell average air temperature within the limit is not required in MODE 4 or 5.
| |
| ACTIONS A.1 When drywell average air temperature is not within the limit of the LCO, it must be restored within 8 hours. This Required Action is necessary to return operation to within the bounds of the primary containment analysis. The 8 hour Completion Time is acceptable, considering the sensitivity of the analysis to variations in this parameter, and provides sufficient time to correct minor problems.
| |
| B.1 and B.2 If the drywell average air temperature cannot be restored to within the limit within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
| |
| SURVEILLANCE SR 3.6.1.5.1 REQUIREMENTS Verifying that the drywell average air temperature is within the LCO limit ensures that operation remains within the limits assumed for the primary containment analyses. The drywell average air temperature is determined using the average temperature of the operating return air plenum(s) upstream of the primary containment ventilation heat exchanger coil and cabinet located at elevation 740 ft 0 inches, azimuth 248°, and elevation 740 ft 0 inches, azimuth 76°. This provides a representative sample of the overall drywell atmosphere.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.1.5-2 Revision 0
| |
| | |
| Drywell Air Temperature B 3.6.1.5 BASES SURVEILLANCE SR 3.6.1.5.1 (continued)
| |
| REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| | |
| REFERENCES 1. UFSAR, Section 6.2.
| |
| LaSalle 1 and 2 B 3.6.1.5-3 Revision 51
| |
| | |
| Suppression Chamber-to-Drywell Vacuum Breakers B 3.6.1.6 B 3.6 CONTAINMENT SYSTEMS B 3.6.1.6 Suppression Chamber-to-Drywell Vacuum Breakers BASES BACKGROUND The function of the suppression-chamber-to-drywell vacuum breakers is to relieve vacuum in the drywell. There are four vacuum breakers located outside the primary containment which form an extension of the primary containment boundary.
| |
| The vacuum relief valves are mounted in special piping between the drywell and the suppression chamber, which allow air and steam flow from the suppression chamber to the drywell when the drywell is at a negative pressure with respect to the suppression chamber. Therefore, suppression chamber-to-drywell vacuum breakers prevent an excessive negative differential pressure across the wetwell drywell boundary. Each vacuum breaker is a self actuating valve with one vacuum breaker in each line. Manual isolation valves are located on each side of each vacuum breaker.
| |
| A negative differential pressure across the drywell wall is caused by rapid depressurization of the drywell. Events that cause this rapid depressurization are cooling cycles, inadvertent drywell spray actuation, and steam condensation from sprays or subcooled water reflood of a break in the event of a primary system rupture. Cooling cycles result in minor pressure transients in the drywell that occur slowly and are normally controlled by heating and ventilation equipment. Spray actuation or spill of subcooled water out of a break results in more significant pressure transients and becomes important in sizing the vacuum breakers.
| |
| In the event of a primary system rupture, steam condensation within the drywell results in the most severe pressure transient. Following a primary system rupture, air in the drywell is purged into the suppression chamber free airspace, leaving the drywell full of steam. Subsequent condensation of the steam can be caused in two possible ways, namely, Emergency Core Cooling Systems flow from a recirculation line break, or drywell spray actuation following a loss of coolant accident (LOCA). These two cases determine the maximum depressurization rate of the drywell.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.1.6-1 Revision 0
| |
| | |
| Suppression Chamber-to-Drywell Vacuum Breakers B 3.6.1.6 BASES BACKGROUND In addition, the water column in the Mark II Vent System (continued) downcomer is controlled by the drywell-to-suppression chamber differential pressure. If the drywell pressure is less than the suppression chamber pressure, there will be an increase in the downcomer water column height. This will result in an increase in the water clearing inertia in the event of a postulated LOCA, resulting in an increase in the peak drywell pressure. This in turn will result in an increase in the pool swell dynamic loads. The vacuum breakers limit the height of the waterleg in the downcomer during normal operation.
| |
| APPLICABLE Analytical methods and assumptions involving the SAFETY ANALYSES suppression chamber-to-drywell vacuum breakers are presented in Reference 1 as part of the accident response of the primary containment systems. Suppression chamber-to-drywell vacuum breakers are provided as part of the primary containment to limit the negative differential pressure across the drywell and suppression chamber walls to maintain the structural integrity of primary containment.
| |
| The safety analyses assume that the vacuum breakers are closed initially and are fully open at a differential pressure of 1.0 psid (Refs. 1 and 2). Additionally, one of the four vacuum breakers is assumed to fail in a closed position (Refs. 1 and 2). The results of the analyses show that the design pressure is not exceeded even under the worst case accident scenario. The vacuum breaker opening differential pressure setpoint and the requirement that four vacuum breakers be OPERABLE (the additional vacuum breaker is required to meet the single failure criterion) are a result of the requirement placed on the vacuum breakers to limit the downcomer waterleg height. Design Basis Accident (DBA) analyses assume the vacuum breakers to be closed initially and to remain closed and leak tight until the suppression pool is at a positive pressure relative to the drywell.
| |
| The suppression chamber-to-drywell vacuum breakers satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.1.6-2 Revision 0
| |
| | |
| Suppression Chamber-to-Drywell Vacuum Breakers B 3.6.1.6 BASES (continued)
| |
| LCO All vacuum breakers must be OPERABLE to provide assurance that the vacuum breakers will open so that drywell-to-suppression chamber negative differential pressure remains below the design value. This LCO also ensures that all suppression chamber-to-drywell vacuum breakers are closed (except during testing or when the vacuum breakers are performing their intended design function). The manual isolation valves in each vacuum breaker line must also be open for the associated vacuum breaker to be considered OPERABLE. The requirement that the vacuum breakers be closed ensures that there is no excessive bypass leakage should a LOCA occur.
| |
| APPLICABILITY In MODES 1, 2, and 3, a DBA could result in excessive negative differential pressure across the drywell wall, caused by the rapid depressurization of the drywell. The event that results in the limiting rapid depressurization of the drywell is the primary system rupture that purges the drywell of air and fills the drywell free airspace with steam. Subsequent condensation of the steam would result in depressurization of the drywell. The limiting pressure and temperature of the primary system prior to a DBA occur in MODES 1, 2, and 3. Excessive negative pressure inside the drywell could occur due to inadvertent actuation of drywell sprays.
| |
| In MODES 4 and 5, the probability and consequences of these events are reduced by the pressure and temperature limitations in these MODES; therefore, maintaining suppression chamber-to-drywell vacuum breakers OPERABLE is not required in MODE 4 or 5.
| |
| ACTIONS A.1 With one of the vacuum breakers inoperable for opening (e.g., the vacuum breaker is not open and may be stuck closed or not within its opening setpoint limit, so that it would not function as designed during an event that depressurized the drywell), the remaining three OPERABLE vacuum breakers are capable of providing the vacuum relief function. However, overall system reliability is reduced because a single failure in one of the remaining vacuum breakers could result in an excessive suppression chamber-to-drywell differential pressure during a DBA. Therefore, (continued)
| |
| LaSalle 1 and 2 B 3.6.1.6-3 Revision 0
| |
| | |
| Suppression Chamber-to-Drywell Vacuum Breakers B 3.6.1.6 BASES ACTIONS A.1 (continued) with one of the four vacuum breakers inoperable, 72 hours is allowed to restore the inoperable vacuum breaker to OPERABLE status so that plant conditions are consistent with those assumed for the design basis analysis. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. The 72 hour Completion Time is considered acceptable due to the low probability of an event in which the remaining vacuum breaker capability would not be adequate.
| |
| B.1 If a required suppression chamber-to-drywell vacuum breaker is inoperable for opening and is not restored to OPERABLE status within the required Completion Time, the plant must be brought to a condition in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 3) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
| |
| C.1 and C.2 With one vacuum breaker not closed, communication between the drywell and suppression chamber airspace exists, and, as a result, there is the potential for primary containment overpressurization due to this bypass leakage if a LOCA were to occur. Therefore, both manual isolation valves in the affected vacuum breaker line must be closed. A short time is allowed to close the manual valves due to the low probability of an event that would pressurize primary containment. The required 4 hour Completion Time is considered adequate to perform this activity. With both (continued)
| |
| LaSalle 1 and 2 B 3.6.1.6-4 Revision 89
| |
| | |
| Suppression Chamber-to-Drywell Vacuum Breakers B 3.6.1.6 BASES ACTIONS C.1 and C.2 (continued) manual isolation valves closed, the vacuum breaker is not capable of performing the vacuum relief function. While the remaining three OPERABLE vacuum breakers are capable of providing the vacuum relief function, the overall reliability is reduced because a single failure in one of the remaining vacuum breakers could result in an excessive suppression chamber-to-drywell differential pressure during a DBA. Therefore, under this condition, 72 hours is allowed to restore the inoperable vacuum breaker to OPERABLE status so that the plant conditions are consistent with those assumed for the design basis analysis. The 72 hour Completion Time is considered acceptable due to the low probability of an event in which the remaining vacuum breaker capability would not be adequate.
| |
| D.1 and D.2 If the open suppression chamber-to-drywell vacuum breaker cannot be closed within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
| |
| E.1 With two or more vacuum breakers inoperable, an excessive suppression chamber-to-drywell differential pressure could occur during a DBA. Therefore, an immediate plant shutdown in accordance with LCO 3.0.3 is required.
| |
| SURVEILLANCE SR 3.6.1.6.1 REQUIREMENTS Each vacuum breaker is verified closed to ensure that this potential large bypass leakage path is not present. This Surveillance is performed by observing the vacuum breaker position indication or by verifying that a differential pressure of 0.25 psid between the suppression chamber and (continued)
| |
| LaSalle 1 and 2 B 3.6.1.6-5 Revision 32
| |
| | |
| Suppression Chamber-to-Drywell Vacuum Breakers B 3.6.1.6 BASES SURVEILLANCE SR 3.6.1.6.1 (continued)
| |
| REQUIREMENTS drywell is maintained for 1 hour without makeup. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. Two Notes are added to this SR.
| |
| The first Note allows suppression chamber-to-drywell vacuum breakers opened in conjunction with the performance of a Surveillance to not be considered as failing this SR. These periods of opening vacuum breakers are controlled by plant procedures and do not represent inoperable vacuum breakers.
| |
| The second Note is included to clarify that vacuum breakers open due to an actual differential pressure are not considered as failing this SR.
| |
| SR 3.6.1.6.2 Each vacuum breaker must be manually cycled to ensure that it opens adequately to perform its design function and returns to the fully closed position. This ensures that the safety analysis assumptions are valid. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. In addition, this functional test is required within 12 hours after a discharge of steam to the suppression chamber from the safety/relief valves.
| |
| SR 3.6.1.6.3 Verification of the vacuum breaker opening setpoint of d 0.5 psid from the closed position is necessary to ensure that the safety analysis assumption regarding vacuum breaker full open differential pressure of 1.0 psid is valid. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.1.6-6 Revision 51
| |
| | |
| Suppression Chamber-to-Drywell Vacuum Breakers B 3.6.1.6 BASES (continued)
| |
| REFERENCES 1. UFSAR, Section 6.2.1.
| |
| : 2. FSAR, Response to NRC Question 021.4.
| |
| : 3. NEDC-32988-A, Revision 2, "Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants," December 2002.
| |
| LaSalle 1 and 2 B 3.6.1.6-7 Revision 32
| |
| | |
| Suppression Pool Average Temperature B 3.6.2.1 B 3.6 CONTAINMENT SYSTEMS B 3.6.2.1 Suppression Pool Average Temperature BASES BACKGROUND The primary containment utilizes a Mark II over/under pressure suppression configuration, with the suppression pool located at the bottom of the primary containment. The suppression pool is designed to absorb the decay heat and sensible heat released during a reactor blowdown from safety/relief valve discharges or from a loss of coolant accident (LOCA). The suppression pool must also condense steam from the Reactor Core Isolation Cooling System turbine exhaust and provides the main emergency water supply source for the reactor vessel. The suppression pool must quench all the steam released through the downcomer lines during a loss of coolant accident (LOCA). This is the essential mitigative feature of a pressure suppression containment that ensures that the peak containment pressure is maintained below the design value (45 psig). Suppression pool average temperature (along with LCO 3.6.2.2, "Suppression Pool Water Level") is a key indication of the capacity of the suppression pool to fulfill these requirements.
| |
| The technical concerns that lead to the development of suppression pool average temperature limits are as follows:
| |
| : a. Complete steam condensation;
| |
| : b. Primary containment peak pressure and temperature;
| |
| : c. Condensation oscillation (CO) loads; and
| |
| : d. Chugging loads.
| |
| APPLICABLE The postulated DBA against which the primary containment SAFETY ANALYSES performance is evaluated is the entire spectrum of postulated pipe breaks within the primary containment.
| |
| Inputs to the safety analyses include initial suppression pool water volume and suppression pool temperature (Reference 1 for LOCAs and References 1 and 2 for the suppression pool temperature analyses required by Reference 3). An initial pool temperature of 105°F is (continued)
| |
| LaSalle Unit 1 and 2 B 3.6.2.1-1 Revision 0
| |
| | |
| Suppression Pool Average Temperature B 3.6.2.1 BASES APPLICABLE assumed for the Reference 1 analyses. Reactor shutdown at a SAFETY ANALYSES pool temperature of 110°F and vessel depressurization at a (continued) pool temperature of 120°F are assumed for the Reference 1 and 2 analyses.
| |
| Suppression pool average temperature satisfies Criteria 2 and 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO A limitation on the suppression pool average temperature is required to assure that the primary containment conditions assumed for the safety analyses are met. This limitation subsequently ensures that peak primary containment pressures and temperatures do not exceed maximum allowable values during a postulated DBA or any transient resulting in heatup of the suppression pool. The LCO requirements are as follows:
| |
| : a. Average temperature 105°F with THERMAL POWER
| |
| > 1% RTP. This requirement ensures that licensing bases initial conditions are met. This requirement also ensures that the plant has testing flexibility, and was selected to provide margin below the 110°F limit at which reactor shutdown is required.
| |
| : b. Average temperature 110°F with THERMAL POWER 1% RTP. This requirement ensures that the plant will be shut down at > 110°F. The pool is designed to absorb decay heat and sensible heat but could be heated beyond design limits by the steam generated if the reactor is not shut down.
| |
| At 1% RTP, heat input is approximately equal to normal system heat losses.
| |
| APPLICABILITY In MODES 1, 2, and 3, a DBA could cause significant heatup of the suppression pool. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES.
| |
| Therefore, maintaining suppression pool average temperature within limits is not required in MODE 4 or 5.
| |
| (continued)
| |
| LaSalle Unit 1 and 2 B 3.6.2.1-2 Revision 0
| |
| | |
| Suppression Pool Average Temperature B 3.6.2.1 BASES (continued)
| |
| ACTIONS A.1, A.2, and A.3 With the suppression pool average temperature above the specified limit and when above the specified power limit, the initial conditions exceed the conditions assumed for the Reference 1 and 2 analyses. However, primary containment cooling capability still exists, and the primary containment pressure suppression function will occur at temperatures well above that assumed for safety analyses. Therefore, continued operation is allowed for a limited time. The 24 hour Completion Time is adequate to allow the suppression pool temperature to be restored to below the limit.
| |
| Additionally, when pool temperature is > 105°F, increased monitoring of the pool temperature is required to ensure it remains 110°F. The once per hour Completion Time is adequate based on past experience, which has shown that suppression pool temperature increases relatively slowly except when testing that adds heat to the pool is being performed. Furthermore, the once per hour Completion Time is considered adequate in view of other indications in the control room, including alarms, to alert the operator to an abnormal suppression pool average temperature condition. In addition, testing that adds heat to the suppression pool must be immediately suspended to preserve the pool heat absorption capability.
| |
| B.1 If the suppression pool average temperature cannot be restored to within limits within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, THERMAL POWER must be reduced to 1% RTP within 12 hours. The 12 hour Completion Time is reasonable, based on operating experience, to reduce reactor power from full power in an orderly manner and without challenging plant systems.
| |
| C.1, C.2, and C.3 Suppression pool average temperature > 110°F requires that the reactor be shut down immediately. This is accomplished by placing the reactor mode switch in the shutdown position.
| |
| Further cooldown to MODE 4 within 36 hours is required at (continued)
| |
| LaSalle Unit 1 and 2 B 3.6.2.1-3 Revision 0
| |
| | |
| Suppression Pool Average Temperature B 3.6.2.1 BASES ACTIONS C.1, C.2, and C.3 (continued) normal cooldown rates (provided pool temperature remains 120°F). Additionally, when pool temperature is > 110°F, increased monitoring of pool temperature is required to ensure that it remains 120°F. The once per 30 minute Completion Time is adequate, based on operating experience.
| |
| Given the high pool temperature in this condition, the monitoring Frequency is increased to twice that of Condition A. Furthermore, the 30 minute Completion Time is considered adequate in view of other indications available in the control room to alert the operator to an abnormal suppression pool average temperature condition.
| |
| D.1 and D.2 If suppression pool average temperature cannot be maintained 120°F, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the reactor pressure must be reduced to < 200 psig within 12 hours and the plant must be brought to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner without challenging plant systems.
| |
| Continued addition of heat to the suppression pool with pool temperature > 120°F could result in exceeding the design basis maximum allowable values for primary containment temperature or pressure. Furthermore, if a blowdown were to occur when temperature was > 120°F, the maximum allowable bulk and local temperatures could be exceeded very quickly.
| |
| SURVEILLANCE SR 3.6.2.1.1 REQUIREMENTS The suppression pool average temperature is regularly monitored to ensure that the required limits are satisfied.
| |
| Average temperature is determined by taking an arithmetic average of the OPERABLE suppression pool water temperature channels, and may include an allowance for temperature stratification. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| (continued)
| |
| LaSalle Unit 1 and 2 B 3.6.2.1-4 Revision 51
| |
| | |
| Suppression Pool Average Temperature B 3.6.2.1 BASES SURVEILLANCE SR 3.6.2.1.1 (continued)
| |
| REQUIREMENTS The 5 minute Frequency during testing is justified by the rates at which testing will heat up the suppression pool, has been shown to be acceptable based on operating experience, and provides assurance that allowable pool temperatures are not exceeded. The Frequency is further justified in view of other indications available in the control room, including alarms, to alert the operator to an abnormal suppression pool average temperature condition.
| |
| | |
| REFERENCES 1. UFSAR, Section 6.2.
| |
| : 2. LaSalle County Station Mark II Design Assessment Report, Section 6.2, June 1981.
| |
| : 3. NUREG-0783.
| |
| LaSalle Unit 1 and 2 B 3.6.2.1-5 Revision 51
| |
| | |
| Suppression Pool Water Level B 3.6.2.2 B 3.6 CONTAINMENT SYSTEMS B 3.6.2.2 Suppression Pool Water Level BASES BACKGROUND The primary containment utilizes a Mark II over/under pressure suppression configuration, with the suppression pool located at the bottom of the primary containment. The suppression pool is designed to absorb the decay heat and sensible heat released during a reactor blowdown from safety/relief valve (S/RV) discharges or from a loss of coolant accident (LOCA). The suppression pool must also condense steam from the Reactor Core Isolation Cooling (RCIC) System turbine exhaust and provides the main emergency water supply source for the reactor vessel. The suppression pool volume ranges between 128,800 ft3 at the low water level limit of -4.5 inches and 131,900 ft3 at the high water level limit of 3 inches. The level is referenced to a plant elevation of 699 ft 11 inches.
| |
| If the suppression pool water level is too low, an insufficient amount of water would be available to adequately condense the steam from the S/RV quenchers, main vents, or RCIC turbine exhaust lines. Low suppression pool water level could also result in an inadequate emergency makeup water source to the Emergency Core Cooling System.
| |
| The lower volume would also absorb less steam energy before heating up excessively. Therefore, a minimum suppression pool water level is specified.
| |
| If the suppression pool water level is too high, it could result in excessive clearing loads from S/RV discharges and excessive pool swell loads resulting from a Design Basis Accident (DBA) LOCA. Therefore, a maximum pool water level is specified. This LCO specifies an acceptable range to prevent the suppression pool water level from being either too high or too low.
| |
| APPLICABLE Initial suppression pool water level affects suppression SAFETY ANALYSES pool temperature response calculations, calculated drywell pressure for a DBA, calculated pool swell loads for a DBA LOCA, and calculated loads due to S/RV discharges.
| |
| Suppression pool water level must be maintained within the limits specified so that the safety analysis of Reference 1 remains valid.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.2.2-1 Revision 0
| |
| | |
| Suppression Pool Water Level B 3.6.2.2 BASES APPLICABLE Suppression pool water level satisfies Criteria 2 and 3 of SAFETY ANALYSES 10 CFR 50.36(c)(2)(ii).
| |
| (continued)
| |
| LCO A limit that suppression pool water level be ! -4.5 inches and 3 inches (referenced to plant elevation 699 ft 11 inches) is required to ensure that the primary containment conditions assumed for the safety analysis are met. Either the high or low water level limits were used in the safety analysis, depending upon which is conservative for a particular calculation.
| |
| APPLICABILITY In MODES 1, 2, and 3, a DBA could cause significant loads on the primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced because of the pressure and temperature limitations in these MODES. The requirements for maintaining suppression pool water level within limits in MODE 4 or 5 is addressed in LCO 3.5.2, "RPV Water Inventory Control."
| |
| ACTIONS A.1 With suppression pool water level outside the limits, the conditions assumed for the safety analysis are not met. If water level is below the minimum level, the pressure suppression function still exists as long as the downcomers are covered, RCIC turbine exhausts are covered, and S/RV quenchers are covered. If suppression pool water level is above the maximum level, protection against overpressurization still exists due to the margin in the peak containment pressure analysis and the capability of the suppression pool sprays. Therefore, continued operation for a limited time is allowed. The 2 hour Completion Time is sufficient to restore suppression pool water level to within specified limits. Also, it takes into account the low probability of an event impacting the suppression pool water level occurring during this interval.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.2.2-2 Revision 76
| |
| | |
| Suppression Pool Water Level B 3.6.2.2 BASES ACTIONS B.1 and B.2 (continued)
| |
| If suppression pool water level cannot be restored to within limits within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
| |
| SURVEILLANCE SR 3.6.2.2.1 REQUIREMENTS Verification of the suppression pool water level is to ensure that the required limits are satisfied. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| | |
| REFERENCES 1. UFSAR, Section 6.2.
| |
| LaSalle 1 and 2 B 3.6.2.2-3 Revision 51
| |
| | |
| RHR Suppression Pool Cooling B 3.6.2.3 B 3.6 CONTAINMENT SYSTEMS B 3.6.2.3 Residual Heat Removal (RHR) Suppression Pool Cooling BASES BACKGROUND Following a Design Basis Accident (DBA), the RHR Suppression Pool Cooling System removes heat from the suppression pool.
| |
| The suppression pool is designed to absorb the sudden input of heat from the primary system. In the long term, the pool continues to absorb residual heat generated by fuel in the reactor core. Some means must be provided to remove heat from the suppression pool so that the temperature inside the primary containment remains within design limits. This function is provided by two redundant RHR suppression pool cooling subsystems. The purpose of this LCO is to ensure that both subsystems are OPERABLE in applicable MODES.
| |
| Each RHR subsystem contains a pump and a heat exchanger and is manually initiated and independently controlled. The two RHR subsystems perform the suppression pool cooling function by circulating water from the suppression pool through the RHR heat exchangers and returning it to the suppression pool. RHR service water, circulating through the tube side of the heat exchangers, exchanges heat with the suppression pool water and discharges this heat to the external heat sink.
| |
| The heat removal capability of one RHR subsystem is sufficient to limit the peak suppression pool water temperature for loss of coolant accidents (LOCAs) and transient events such as turbine trip or stuck open safety/relief valve (S/RV) to values less than design limits (Ref. 4). S/RV leakage and Reactor Core Isolation Cooling System testing increase suppression pool temperature more slowly. The RHR Suppression Pool Cooling System is also used to lower the suppression pool water bulk temperature following such events.
| |
| APPLICABLE Reference 1 contains the results of analyses used to predict SAFETY ANALYSES primary containment pressure and temperature following large and small break LOCAs. The intent of the analyses is to demonstrate that the heat removal capacity of the RHR Suppression Pool Cooling System is adequate to maintain the primary containment conditions within design limits. The (continued)
| |
| LaSalle 1 and 2 B 3.6.2.3-1 Revision 38
| |
| | |
| RHR Suppression Pool Cooling B 3.6.2.3 BASES APPLICABLE suppression pool temperature is calculated to remain below SAFETY ANALYSES the design limit.
| |
| (continued)
| |
| The RHR Suppression Pool Cooling System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO During a DBA, a minimum of one RHR suppression pool cooling subsystem is required to maintain the primary containment peak pressure and temperature below the design limits (Ref. 1). To ensure that these requirements are met, two RHR suppression pool cooling subsystems must be OPERABLE.
| |
| Therefore, in the event of an accident, at least one subsystem is OPERABLE, assuming the worst case single active failure. An RHR suppression pool cooling subsystem is OPERABLE when the pump, a heat exchanger, and associated piping, valves, instrumentation, and controls are OPERABLE.
| |
| Management of gas voids is important to RHR Suppression Pool Cooling System OPERABILITY.
| |
| APPLICABILITY In MODES 1, 2, and 3, a DBA could cause both a release of radioactive material to primary containment and a heatup and pressurization of primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. Therefore, the RHR Suppression Pool Cooling System is not required to be OPERABLE in MODE 4 or 5.
| |
| ACTIONS A.1 With one RHR suppression pool cooling subsystem inoperable, the inoperable subsystem must be restored to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program. In this condition, the remaining RHR suppression pool cooling subsystem is adequate to perform the primary containment cooling function. However, the overall reliability is reduced because a single failure in the OPERABLE subsystem could result in reduced primary containment cooling capability. The 7 day Completion Time is acceptable in light of the redundant RHR suppression pool cooling capabilities afforded by the OPERABLE subsystem and the low probability of a DBA occurring during this period.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.2.3-2 Revision 89
| |
| | |
| RHR Suppression Pool Cooling B 3.6.2.3 BASES ACTIONS B.1 (continued)
| |
| If one RHR suppression pool cooling subsystem is inoperable and is not restored to OPERABLE status within the required Completion Time, the plant must be brought to a condition in which the overall plant risk is minimized.
| |
| To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 3) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
| |
| C.1 With two RHR suppression pool cooling subsystems inoperable, one subsystem must be restored to OPERABLE status within 8 hours. In this condition, there is a substantial loss of the primary containment pressure and temperature mitigation function. The 8 hour Completion Time is based on this loss of function and is considered acceptable due to the low probability of a DBA and the potential avoidance of a plant shutdown transient that could result in the need for the RHR suppression pool cooling subsystems to operate.
| |
| D.1 and D.2 If any Required Action and associated Completion Time of Condition C cannot be met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.2.3-3 Revision 60
| |
| | |
| RHR Suppression Pool Cooling B 3.6.2.3 BASES (continued)
| |
| SURVEILLANCE SR 3.6.2.3.1 REQUIREMENTS Verifying the correct alignment for manual and power operated valves in the RHR suppression pool cooling mode flow path provides assurance that the proper flow path exists for system operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position since these valves were verified to be in the correct position prior to being locked, sealed, or secured. A valve is also allowed to be in the nonaccident position, provided it can be aligned to the accident position within the time assumed in the accident analysis. This is acceptable, since the RHR suppression pool cooling mode is manually initiated. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.6.2.3.2 Verifying each required RHR pump develops a flow rate t 7200 gpm, while operating in the suppression pool cooling mode with flow through the associated heat exchanger, ensures that peak suppression pool temperature can be maintained below the design limits during a DBA (Ref. 1). The flow verification is also a normal test of centrifugal pump performance required by ASME OM Code (Ref. 2). This test confirms one point on the pump design curve, and the results are indicative of overall performance. Such inservice tests confirm component OPERABILITY and detect incipient failures by indicating abnormal performance. The Frequency of this SR is in accordance with the INSERVICE TESTING PROGRAM.
| |
| SR 3.6.2.3.3 RHR Suppression Pool Cooling System piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the RHR suppression pool cooling subsystems and may also prevent water hammer and pump cavitation.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.2.3-4 Revision 70
| |
| | |
| RHR Suppression Pool Cooling B 3.6.2.3 BASES SURVEILLANCE SR 3.6.2.3.3 (continued)
| |
| REQUIREMENTS Selection of RHR Suppression Pool Cooling System locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.
| |
| The RHR Suppression Pool Cooling System is OPERABLE when it is sufficiently filled with water. Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criteria for gas volume at the suction or discharge of a pump), the Surveillance is not met. If it is determined by subsequent evaluation that the RHR Suppression Pool Cooling System is not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water), the Surveillance may be declared met. Accumulated gas should be eliminated or brought within the acceptance criteria limits.
| |
| RHR Suppression Pool Cooling System locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative subset of susceptible locations. Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety.
| |
| For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of (continued)
| |
| LaSalle 1 and 2 B 3.6.2.3-5 Revision 60
| |
| | |
| RHR Suppression Pool Cooling B 3.6.2.3 BASES SURVEILLANCE SR 3.6.2.3.3 (continued)
| |
| REQUIREMENTS the results should be sufficient to assure system OPERABILITY during the Surveillance interval.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation.
| |
| REFERENCES 1. UFSAR, Section 6.2.
| |
| : 2. ASME Code for Operation and Maintenance of Nuclear Power Plants (OM Code).
| |
| : 3. NEDC-32988-A, Revision 2, "Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants," December 2002.
| |
| : 4. Design Analysis L-002874, Rev. 0A, LaSalle County Station Power Uprate Project Task 400: Containment System (GE-NE-A1300384-02-01-R3)," June 4, 2008.
| |
| LaSalle 1 and 2 B 3.6.2.3-6 Revision 60
| |
| | |
| RHR Suppression Pool Spray B 3.6.2.4 B 3.6 CONTAINMENT SYSTEMS B 3.6.2.4 Residual Heat Removal (RHR) Suppression Pool Spray BASES BACKGROUND Following a Design Basis Accident (DBA), the RHR Suppression Pool Spray System removes heat from the suppression chamber airspace. The suppression pool is designed to absorb the sudden input of heat from the primary system from a DBA or a rapid depressurization of the reactor pressure vessel (RPV) through safety/relief valves. The heat addition to the suppression pool results in increased steam in the suppression chamber, which increases primary containment pressure. Steam blowdown from a DBA can also bypass the suppression pool and end up in the suppression chamber airspace. Some means must be provided to remove heat from the suppression chamber so that the pressure and temperature inside primary containment remain within analyzed design limits. This function is provided by two redundant RHR suppression pool spray subsystems. The purpose of this LCO is to ensure that both subsystems are OPERABLE in applicable MODES.
| |
| Each of the two RHR suppression pool spray subsystems contains one pump and one heat exchanger, which are manually initiated and independently controlled. The two subsystems perform the suppression pool spray function by circulating water from the suppression pool through the RHR heat exchangers and returning it to the suppression pool spray sparger. The sparger only accommodates a small portion of the total RHR pump flow; the remainder of the flow returns to the suppression pool through the suppression pool cooling return line (provided the associated valve is open). Thus, both suppression pool cooling and suppression pool spray functions are normally performed when the Suppression Pool Spray System is initiated. Either RHR suppression pool spray subsystem is sufficient to condense the steam from small bypass leaks from the drywell to the suppression chamber airspace during the postulated DBA.
| |
| APPLICABLE Reference 1 contains the results of analyses used to predict SAFETY ANALYSES primary containment pressure and temperature following large and small break loss of coolant accidents. The intent of the analyses is to demonstrate that the pressure reduction (continued)
| |
| LaSalle 1 and 2 B 3.6.2.4-1 Revision 0
| |
| | |
| RHR Suppression Pool Spray B 3.6.2.4 BASES APPLICABLE capacity of the RHR Suppression Pool Spray System is SAFETY ANALYSES adequate to maintain the primary containment conditions (continued) within design limits. The time history for primary containment pressure is calculated to demonstrate that the maximum pressure remains below the design limit.
| |
| The RHR Suppression Pool Spray System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO In the event of a DBA, a minimum of one RHR suppression pool spray subsystem is required to mitigate potential bypass leakage paths and maintain the primary containment peak pressure below the design limits (Ref. 1). To ensure that these requirements are met, two RHR suppression pool spray subsystems must be OPERABLE. Therefore, in the event of an accident, at least one subsystem is OPERABLE assuming the worst case single active failure. An RHR suppression pool spray subsystem is OPERABLE when one of the pumps and associated piping, valves, instrumentation, and controls are OPERABLE. Management of gas voids is important to RHR Suppression Pool Spray System OPERABILITY.
| |
| APPLICABILITY In MODES 1, 2, and 3, a DBA could cause pressurization of primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining RHR suppression pool spray subsystems OPERABLE is not required in MODE 4 or 5.
| |
| ACTIONS A.1 With one RHR suppression pool spray subsystem inoperable, the inoperable subsystem must be restored to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program. In this condition, the remaining OPERABLE RHR suppression pool spray subsystem is adequate to perform the primary containment bypass leakage mitigation function.
| |
| However, the overall reliability is reduced because a single failure in the OPERABLE subsystem could result in reduced primary containment bypass mitigation capability. The 7 day Completion Time was chosen in light of the redundant RHR suppression pool spray capabilities afforded by the OPERABLE subsystem and the low probability of a DBA occurring during this period.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.2.4-2 Revision 89
| |
| | |
| RHR Suppression Pool Spray B 3.6.2.4 BASES ACTIONS B.1 (continued)
| |
| With both RHR suppression pool spray subsystems inoperable, at least one subsystem must be restored to OPERABLE status within 8 hours. In this condition, there is a substantial loss of the primary containment bypass leakage mitigation function. The 8 hour Completion Time is based on this loss of function and is considered acceptable due to the low probability of a DBA and because alternative methods to reduce pressure in the primary containment are available.
| |
| C.1 If any Required Action and associated Completion Time cannot be met, the plant must be brought to a MODE in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 3) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short.
| |
| However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
| |
| SURVEILLANCE SR 3.6.2.4.1 REQUIREMENTS Verifying the correct alignment for manual and power operated valves in the RHR suppression pool spray mode flow path provides assurance that the proper flow paths will exist for system operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve is also allowed to be in the nonaccident position provided it can be aligned to the accident position within the time assumed in the accident analysis. This is acceptable since the RHR suppression pool spray mode is manually initiated. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the (continued)
| |
| LaSalle 1 and 2 B 3.6.2.4-3 Revision 32
| |
| | |
| RHR Suppression Pool Spray B 3.6.2.4 BASES SURVEILLANCE SR 3.6.2.4.1 (continued)
| |
| REQUIREMENTS correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.6.2.4.2 Verifying each required RHR pump develops a flow rate t 450 gpm through the spray sparger while operating in the suppression pool spray mode helps ensure that the primary containment pressure can be maintained below the design limits during a DBA (Ref. 1). The normal test of centrifugal pump performance required by the ASME OM Code (Ref. 2) is covered by the requirements of LCO 3.6.2.3, "RHR Suppression Pool Cooling." The Frequency of this SR is in accordance with the INSERVICE TESTING PROGRAM.
| |
| SR 3.6.2.4.3 RHR Suppression Pool Spray System piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the RHR suppression pool spray subsystems and may also prevent water hammer and pump cavitation.
| |
| Selection of RHR Suppression Pool Spray System locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.
| |
| The RHR Suppression Pool Spray System is OPERABLE when it is sufficiently filled with water. Acceptance criteria are established for the volume of accumulated gas at susceptible (continued)
| |
| LaSalle 1 and 2 B 3.6.2.4-4 Revision 70
| |
| | |
| RHR Suppression Pool Spray B 3.6.2.4 BASES SURVEILLANCE SR 3.6.2.4.3 (continued)
| |
| REQUIREMENTS locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criteria for gas volume at the suction or discharge of a pump), the Surveillance is not met. If it is determined by subsequent evaluation that the RHR Suppression Pool Spray System is not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water), the Surveillance may be declared met.
| |
| Accumulated gas should be eliminated or brought within the acceptance criteria limits.
| |
| RHR Suppression Pool Spray System locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative subset of susceptible locations. Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.2.4-5 Revision 60
| |
| | |
| RHR Suppression Pool Spray B 3.6.2.4 BASES (continued)
| |
| REFERENCES 1. UFSAR, Section 6.2.1.1.3.
| |
| : 2. ASME Code for Operation and Maintenance of Nuclear Power Plants (OM Code).
| |
| : 3. NEDC-32998-A, Revision 2, "Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants," December 2002.
| |
| LaSalle 1 and 2 B 3.6.2.4-6 Revision 60
| |
| | |
| Primary Containment Hydrogen Recombiners B 3.6.3.1 B 3.6 CONTAINMENT SYSTEMS B 3.6.3.1 Primary Containment Hydrogen Recombiners - Deleted LaSalle 1 and 2 B 3.6.3.1-1 Revision 19
| |
| | |
| Primary Containment Oxygen Concentration B 3.6.3.2 B 3.6 CONTAINMENT SYSTEMS B 3.6.3.2 Primary Containment Oxygen Concentration BASES BACKGROUND The primary containment is designed to withstand events that generate hydrogen either due to the zirconium metal water reaction in the core or due to radiolysis. The primary method to control hydrogen is to inert the primary containment. With the primary containment inerted, that is, oxygen concentration < 4.0 volume percent (v/o), a combustible mixture cannot be present in the primary containment for any hydrogen concentration. An event that rapidly generates hydrogen from zirconium metal water reaction will result in excessive hydrogen in primary containment, but oxygen concentration will remain < 4.0 v/o and no combustion can occur. This LCO ensures that oxygen concentration does not exceed 4.0 v/o during operation in the applicable conditions.
| |
| APPLICABLE The Reference 1 calculations assume that the primary SAFETY ANALYSES containment is inerted when a Design Basis Accident loss of coolant accident occurs. Thus, the hydrogen assumed to be released to the primary containment as a result of metal water reaction in the reactor core will not produce combustible gas mixtures in the primary containment.
| |
| Primary containment oxygen concentration satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The primary containment oxygen concentration is maintained
| |
| < 4.0 v/o to ensure that an event that produces any amount of hydrogen does not result in a combustible mixture inside primary containment.
| |
| APPLICABILITY The primary containment oxygen concentration must be within the specified limit when primary containment is inerted.
| |
| The primary containment must be inert in MODES 1 and 2, since this is the condition with the highest probability of an event that could produce hydrogen.
| |
| LaSalle 1 and 2 B 3.6.3.2-1 Revision 85
| |
| | |
| Primary Containment Oxygen Concentration B 3.6.3.2 BASES ACTIONS A.1 If oxygen concentration is t 4.0 v/o while operating in MODES 1 or 2 oxygen concentration must be restored to
| |
| < 4.0 v/o within 72 hours. The 72 hour Completion Time is allowed when oxygen concentration is t 4.0 v/o because the low probability and long duration of an event that would generate significant amounts of hydrogen occurring during this period.
| |
| A Note permits the use of the provisions of LCO 3.0.4.c.
| |
| This allowance permits entry into the applicable MODE(S) while relying on the ACTIONS. This allowance is acceptable because inerting the primary containment prevents containment access without an appropriate breathing apparatus. Therefore, the primary containment is inerted as late as possible in the plant startup and de-inerted as soon as possible in the plant shutdown. It is acceptable to intentionally enter Required Action A.1 prior to a shutdown in order to begin de-inerting the primary containment prior to exiting the Applicability. Similarly, intentional entry into Required Action A.1 during startup conditions is acceptable per Technical Specification 3.0.4.c.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.3.2-2 Revision 85
| |
| | |
| Primary Containment Oxygen Concentration B 3.6.3.2 BASES ACTIONS B.1 (continued)
| |
| If oxygen concentration cannot be restored to within limits within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in MODE 3 within 12 hours. The 12 hour Completion Time is reasonable, based on operating experience, to reduce reactor power from full power conditions in an orderly manner and without challenging plant systems.
| |
| SURVEILLANCE SR 3.6.3.2.1 REQUIREMENTS The primary containment must be determined to be inerted by verifying that oxygen concentration is < 4.0 v/o. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 6.2.5.
| |
| LaSalle 1 and 2 B 3.6.3.2-3 Revision 85
| |
| | |
| Secondary Containment B 3.6.4.1 B 3.6 CONTAINMENT SYSTEMS B 3.6.4.1 Secondary Containment BASES BACKGROUND The function of the secondary containment is to contain dilute, and hold up fission products that may leak from primary containment following a Design Basis Accident (DBA).
| |
| In conjunction with operation of the Standby Gas Treatment (SGT) System and closure of certain valves whose lines penetrate the secondary containment, the secondary containment is designed to reduce the activity level of the fission products prior to release to the environment and to isolate and contain fission products that are released during certain operations that take place inside primary containment, when primary containment is not required to be OPERABLE, or that take place outside primary containment.
| |
| The secondary containment is a structure that completely encloses the primary containment and those components that may be postulated to contain primary system fluid. This structure forms a control volume that serves to hold up and dilute the fission products. It is possible for the pressure in the control volume to rise relative to the environmental pressure (e.g., due to pump/motor heat load additions). To prevent ground level exfiltration while allowing the secondary containment to be designed as a conventional structure, the secondary containment requires support systems to maintain the control volume pressure at less than the external pressure. Requirements for these systems are specified separately in LCO 3.6.4.2, "Secondary Containment Isolation Valves (SCIVs)," and LCO 3.6.4.3, "Standby Gas Treatment (SGT) System."
| |
| APPLICABLE There are two principal accidents for which credit is SAFETY ANALYSES taken for secondary containment OPERABILITY. These are a LOCA (Ref. 1) and a fuel handling accident (Ref. 2). The secondary containment performs no active function in response to each of these limiting events; however, its leak tightness is required to ensure that the release of radioactive materials from the primary containment is restricted to those leakage paths and associated leakage rates assumed in the accident analysis, and that fission products entrapped within the secondary containment (continued)
| |
| LaSalle 1 and 2 B 3.6.4.1-1 Revision 0
| |
| | |
| Secondary Containment B 3.6.4.1 BASES APPLICABLE structure will be treated by the SGT System prior to SAFETY ANALYSES discharge to the environment.
| |
| (continued)
| |
| Secondary containment satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO An OPERABLE secondary containment provides a control volume into which fission products that bypass or leak from primary containment, or are released from the reactor coolant pressure boundary components located in secondary containment, can be diluted and processed prior to release to the environment. For the secondary containment to be considered OPERABLE, it must have adequate leak tightness to ensure that the required vacuum can be established and maintained.
| |
| APPLICABILITY In MODES 1, 2, and 3, a LOCA could lead to a fission product release to primary containment that leaks to secondary containment. Therefore, secondary containment OPERABILITY is required during the same operating conditions that require primary containment OPERABILITY.
| |
| In MODES 4 and 5, the probability and consequences of the LOCA are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining secondary containment OPERABLE is not required in MODE 4 or 5 to ensure a control volume, except for other situations for which significant releases of radioactive material can be postulated, such as during CORE ALTERATIONS, or during movement of irradiated fuel assemblies in the secondary containment.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.4.1-2 Revision 76
| |
| | |
| Secondary Containment B 3.6.4.1 BASES (continued)
| |
| ACTIONS A.1 If secondary containment is inoperable, it must be restored to OPERABLE status within 4 hours. The 4 hour Completion Time provides a period of time to correct the problem that is commensurate with the importance of maintaining secondary containment during MODES 1, 2, and 3. This time period also ensures that the probability of an accident (requiring secondary containment OPERABILITY) occurring during periods where secondary containment is inoperable is minimal.
| |
| B.1 If the secondary containment cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 3), because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
| |
| C.1 and C.2 Movement of irradiated fuel assemblies in the secondary containment and CORE ALTERATIONS can be postulated to cause fission product release to the secondary containment. In such cases, the secondary containment is the only barrier to release of fission products to the environment. CORE ALTERATIONS and movement of irradiated fuel assemblies must be immediately suspended if the secondary containment is inoperable.
| |
| Suspension of these activities shall not preclude completing an action that involves moving a component to a safe position.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.4.1-3 Revision 76
| |
| | |
| Secondary Containment B 3.6.4.1 BASES ACTIONS C.1 and C.2 (continued)
| |
| Required Action C.1 has been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 4 or 5, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, in either case, inability to suspend movement of irradiated fuel assemblies would not be a sufficient reason to require a reactor shutdown.
| |
| SURVEILLANCE SR 3.6.4.1.1 REQUIREMENTS This SR ensures that the secondary containment boundary is sufficiently leak tight to preclude exfiltration. The SR is modified by a Note which states the SR is not required to be met for up to 4 hours if an analysis demonstrates that one SGT subsystem remains capable of establishing the required secondary containment vacuum. Use of the Note is expected to be infrequent but may be necessitated by situations in which secondary containment vacuum may be less than the required containment vacuum, such as, but not limited to, wind gusts or failure or change of operating normal ventilation subsystems. These conditions do not indicate any change in the leak tightness of the secondary containment boundary. The analysis should consider the actual conditions (equipment configuration, temperature, atmospheric pressure, wind conditions, measured secondary containment vacuum, etc.) to determine whether, if an accident requiring secondary containment to be OPERABLE were to occur, one train of SGT could establish the assumed secondary containment vacuum within the time assumed in the accident analysis. If so, the SR may be considered met for a period up to 4 hours. The 4 hour limit is based on the expected short duration of the situations when the Note would be applied. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.6.4.1.2 Verifying that one secondary containment access door in each access opening is closed provides adequate assurance that exfiltration from the secondary containment will not occur.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.4.1-4 Revision 76
| |
| | |
| Secondary Containment B 3.6.4.1 BASES SURVEILLANCE SR 3.6.4.1.2 (continued)
| |
| REQUIREMENTS An access opening contains at least one inner and one outer door. In some cases a secondary containment barrier contains multiple inner or multiple outer doors. For these cases, the access openings share the inner door or the outer door, i.e., the access openings have a common inner door or outer door. The intent is to not breach the secondary containment, which is achieved by maintaining the inner or outer portion of the barrier closed except when the access opening is being used for entry and exit; i.e., all inner doors closed or all outer doors closed. Thus each access opening has one door closed. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.6.4.1.3 and SR 3.6.4.1.4 The SGT System exhausts the secondary containment atmosphere to the environment through appropriate treatment equipment.
| |
| Each SGT subsystem is designed to drawdown pressure in the secondary containment to ! 0.25 inches of vacuum water gauge in 300 seconds and maintain pressure in the secondary containment at ! 0.25 inches of vacuum water gauge for 1 hour at a flow rate of 4400 cfm. To ensure that all fission products released to secondary containment are treated, SR 3.6.4.1.3 and SR 3.6.4.1.4 verify that a pressure in the secondary containment that is less than the pressure external to the secondary containment boundary can rapidly be established and maintained. When the SGT System is operating as designed, the establishment and maintenance of secondary containment pressure cannot be accomplished if the secondary containment boundary is not intact.
| |
| Establishment of this pressure is confirmed by SR 3.6.4.1.3, which demonstrates that the secondary containment can be drawn down to ! 0.25 inches of vacuum water gauge in 900 seconds using one SGT subsystem. SR 3.6.4.1.4 demonstrates that the pressure in the secondary containment can be maintained ! 0.25 inches of vacuum water gauge for 1 hour using one SGT subsystem at a flow rate 4400 cfm.
| |
| This flow rate is the assumed secondary containment leak rate during the drawdown period. The 1 hour test period allows secondary containment to be in thermal equilibrium at (continued)
| |
| LaSalle 1 and 2 B 3.6.4.1-5 Revision 72
| |
| | |
| Secondary Containment B 3.6.4.1 BASES SURVEILLANCE SR 3.6.4.1.3 and SR 3.6.4.1.4 (continued)
| |
| REQUIREMENTS steady state conditions. The primary purpose of the SRs is to ensure secondary containment boundary integrity. The secondary purpose of these SRs is to ensure that the SGT subsystem being tested functions as designed. There is a separate LCO with Surveillance Requirements that serves the primary purpose of ensuring OPERABILITY of the SGT System.
| |
| These SRs need not be performed with each SGT subsystem.
| |
| The SGT subsystem used for these Surveillances is staggered to ensure that in addition to the requirements of LCO 3.6.4.3, either SGT subsystem will perform this test.
| |
| The inoperability of the SGT System does not necessarily constitute a failure of these Surveillances relative to secondary containment OPERABILITY. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.6.4.1.5 Verifying that secondary containment equipment hatches are closed ensures that the infiltration of outside air of such a magnitude as to prevent maintaining the desired negative pressure does not occur and provides adequate assurance that exfiltration from the secondary containment will not occur.
| |
| In this application, the term "sealed" has no connotation of leak tightness. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 15.6.5.
| |
| : 2. UFSAR, Section 15.7.4.
| |
| : 3. NEDC-32988-A, Revision 2, "Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants," December 2002.
| |
| LaSalle 1 and 2 B 3.6.4.1-6 Revision 68
| |
| | |
| SCIVs B 3.6.4.2 B 3.6 CONTAINMENT SYSTEMS B 3.6.4.2 Secondary Containment Isolation Valves (SCIVs)
| |
| BASES BACKGROUND The function of the SCIVs, in combination with other accident mitigation systems, is to limit fission product release during and following postulated Design Basis Accidents (DBAs) (Refs. 1 and 2). Secondary containment isolation within the time limits specified for those isolation valves designed to close automatically ensures that fission products that leak from primary containment following a DBA, that are released during certain operations when primary containment is not required to be OPERABLE, or that take place outside primary containment, are maintained within the secondary containment boundary.
| |
| The OPERABILITY requirements for SCIVs help ensure that an adequate secondary containment boundary is maintained during and after an accident by minimizing potential paths to the environment. These isolation devices are either passive or active (automatic). Manual valves, de-activated automatic valves secured in their closed position (including check valves with flow through the valve secured), and blind flanges are considered passive devices.
| |
| Automatic SCIVs (i.e., dampers) close on a secondary containment isolation signal to establish a boundary for untreated radioactive material within secondary containment following a DBA or other accidents.
| |
| Other penetrations required to be closed during accident conditions are isolated by the use of valves in the closed position or blind flanges.
| |
| APPLICABLE The SCIVs must be OPERABLE to ensure the secondary SAFETY ANALYSES containment barrier to fission product releases is established. The principal accidents for which the secondary containment boundary is required are a loss of coolant accident (Ref. 1) and fuel handling accident (Ref. 2). The secondary containment performs no active function in response to each of these limiting events, but (continued)
| |
| LaSalle 1 and 2 B 3.6.4.2-1 Revision 0
| |
| | |
| SCIVs B 3.6.4.2 BASES APPLICABLE the boundary established by SCIVs is required to ensure that SAFETY ANALYSES leakage from the primary containment is processed by the (continued) Standby Gas Treatment (SGT) System before being released to the environment.
| |
| Maintaining SCIVs OPERABLE with isolation times within limits ensures that fission products will remain trapped inside secondary containment so that they can be treated by the SGT System prior to discharge to the environment.
| |
| SCIVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO SCIVs form a part of the secondary containment boundary. The SCIV safety function is related to control of offsite radiation releases resulting from DBAs.
| |
| The power operated, automatic isolation valves are considered OPERABLE when their isolation times are within limits and the valves actuate on an automatic isolation signal. The valves covered by this LCO, along with their associated stroke times, are listed in the Technical Requirements Manual (Ref. 3).
| |
| The normally closed manual SCIVs are considered OPERABLE when the valves are closed and blind flanges are in place, or open under administrative controls. These passive isolation valves or devices are listed in Reference 3.
| |
| APPLICABILITY In MODES 1, 2, and 3, a DBA could lead to a fission product release to the primary containment that leaks to the secondary containment. Therefore, OPERABILITY of SCIVs is required.
| |
| In MODES 4 and 5, the probability and consequences of these events are reduced due to pressure and temperature limitations in these MODES. Therefore, maintaining SCIVs OPERABLE is not required in MODE 4 or 5, except for other situations under which significant releases of radioactive material can be postulated, such as during CORE ALTERATIONS or during movement of irradiated fuel assemblies in the secondary containment.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.4.2-2 Revision 76
| |
| | |
| SCIVs B 3.6.4.2 BASES (continued)
| |
| ACTIONS The ACTIONS are modified by three Notes. The first Note allows penetration flow paths to be unisolated intermittently under administrative controls. These controls consist of stationing a dedicated operator, who is in continuous communication with the control room, at the controls of the isolation device. In this way, the penetration can be rapidly isolated when the need for secondary containment isolation is indicated.
| |
| The second Note provides clarification that, for the purpose of this LCO, separate Condition entry is allowed for each penetration flow path. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable SCIV. Complying with the Required Actions may allow for continued operation, and subsequent inoperable SCIVs are governed by subsequent Condition entry and application of associated Required Actions.
| |
| The third Note ensures appropriate remedial actions are taken, if necessary, if the affected system(s) are rendered inoperable by an inoperable SCIV.
| |
| A.1 and A.2 In the event that there are one or more penetration flow paths with one SCIV inoperable, the affected penetration flow path(s) must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure.
| |
| Isolation barriers that meet this criteria are a closed and de-activated automatic SCIV, a closed manual valve, and a blind flange. For penetrations isolated in accordance with Required Action A.1, the device used to isolate the penetration should be the closest available device to secondary containment. This Required Action must be completed within the 8 hour Completion Time. The specified time period is reasonable considering the time required to isolate the penetration and the low probability of a DBA, which requires the SCIVs to close, occurring during this short time.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.4.2-3 Revision 0
| |
| | |
| SCIVs B 3.6.4.2 BASES ACTIONS A.1 and A.2 (continued)
| |
| For affected penetrations that have been isolated in accordance with Required Action A.1, the affected penetration must be verified to be isolated on a periodic basis. This is necessary to ensure that secondary containment penetrations required to be isolated following an accident, but no longer capable of being automatically isolated, will be in the isolation position should an event occur. The Completion Time of once per 31 days is appropriate because the isolation devices are operated under administrative controls and the probability of their misalignment is low. This Required Action does not require any testing or device manipulation. Rather, it involves verification that the affected penetration remains isolated.
| |
| Required Action A.2 is modified by two Notes. Note 1 applies to isolation devices located in high radiation areas and allows them to be verified by use of administrative controls. Allowing verification by administrative controls is considered acceptable, since access to these areas is typically restricted. Note 2 applies to isolation devices that are locked, sealed, or otherwise secured in position and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since the function of locking, sealing, or securing components is to ensure that these devices are not inadvertently repositioned. Therefore, the probability of misalignment, once they have been verified to be in the proper position, is low.
| |
| B.1 With two SCIVs in one or more penetration flow paths inoperable, the affected penetration flow path must be isolated within 4 hours. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure.
| |
| Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange. The 4 hour Completion Time is reasonable, considering the time required to isolate the penetration and the low probability of a DBA, which requires the SCIVs to close, occurring during this short time.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.4.2-4 Revision 0
| |
| | |
| SCIVs B 3.6.4.2 BASES ACTIONS B.1 (continued)
| |
| The Condition has been modified by a Note stating that Condition B is only applicable to penetration flow paths with two isolation valves. This clarifies that only Condition A is entered if one SCIV is inoperable in each of two penetrations.
| |
| C.1 and C.2 If any Required Action and associated Completion Time cannot be met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
| |
| D.1 and D.2 If any Required Action and associated Completion Time cannot be met, the plant must be placed in a condition in which the LCO does not apply. If applicable, CORE ALTERATIONS and the movement of irradiated fuel assemblies in the secondary containment must be immediately suspended. Suspension of these activities shall not preclude completion of movement of a component to a safe position.
| |
| Required Action D.1 has been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 4 or 5, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, in either case, inability to suspend movement of irradiated fuel assemblies would not be a sufficient reason to require a reactor shutdown.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.4.2-5 Revision 76
| |
| | |
| SCIVs B 3.6.4.2 BASES (continued)
| |
| SURVEILLANCE SR 3.6.4.2.1 REQUIREMENTS This SR verifies each secondary containment isolation manual valve and blind flange that is not locked, sealed, or otherwise secured and is required to be closed during accident conditions is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside of the secondary containment boundary is within design limits. This SR does not require any testing or valve manipulation. Rather, it involves verification that those SCIVs in secondary containment that are capable of being mispositioned are in the correct position.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. This SR does not apply to valves that are locked, sealed, or otherwise secured in the closed position, since these were verified to be in the correct position upon locking, sealing, or securing.
| |
| Two Notes have been added to this SR. The first Note applies to valves and blind flanges located in high radiation areas and allows them to be verified by use of administrative controls. Allowing verification by administrative controls is considered acceptable, since access to these areas is typically restricted during MODES 1, 2, and 3 for ALARA reasons. Therefore, the probability of misalignment of these SCIVs, once they have been verified to be in the proper position, is low.
| |
| A second Note has been included to clarify that SCIVs that are open under administrative controls are not required to meet the SR during the time the SCIVs are open. These controls consist of stationing a dedicated operator at the controls of the valve, who is in continuous communication with the control room. In this way, the penetration can be rapidly isolated when a need for secondary containment isolation is indicated.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.4.2-6 Revision 51
| |
| | |
| SCIVs B 3.6.4.2 BASES SURVEILLANCE SR 3.6.4.2.2 REQUIREMENTS (continued)
| |
| Verifying the isolation time of each power operated, automatic SCIV is within limits is required to demonstrate OPERABILITY. The isolation time test ensures that the SCIV will isolate in a time period less than or equal to that assumed in the safety analyses. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.6.4.2.3 Verifying that each automatic SCIV closes on a secondary containment isolation signal is required to prevent leakage of radioactive material from secondary containment following a DBA or other accidents. This SR ensures that each automatic SCIV will actuate to the isolation position on a secondary containment isolation signal. The LOGIC SYSTEM FUNCTIONAL TEST in LCO 3.3.6.2, "Secondary Containment Isolation Instrumentation," overlaps this SR to provide complete testing of the safety function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 15.6.5.
| |
| : 2. UFSAR, Section 15.7.4.
| |
| : 3. Technical Requirements Manual.
| |
| LaSalle 1 and 2 B 3.6.4.2-7 Revision 51
| |
| | |
| SGT System B 3.6.4.3 B 3.6 CONTAINMENT SYSTEMS B 3.6.4.3 Standby Gas Treatment (SGT) System BASES BACKGROUND The SGT System is required by 10 CFR 50, Appendix A, GDC 41, "Containment Atmosphere Cleanup" (Ref. 1). The function of the SGT System is to ensure that radioactive materials that leak from the primary containment into the secondary containment following a Design Basis Accident (DBA) are filtered and adsorbed prior to exhausting to the environment.
| |
| The SGT System consists of two independent subsystems that are shared between Unit 1 and Unit 2, each with its own set of ductwork, dampers, charcoal filter train, and controls.
| |
| Each SGT System discharges to the plant vent stack through a common exhaust pipe.
| |
| Each charcoal filter train consists of (components listed in order of the direction of the air flow):
| |
| : a. A centrifugal filter unit fan and centrifugal cooling fan;
| |
| : b. A demister;
| |
| : c. An electric heater;
| |
| : d. A prefilter bank;
| |
| : e. A high efficiency particulate air (HEPA) filter bank;
| |
| : f. A charcoal adsorber; and
| |
| : g. A second HEPA filter bank.
| |
| The sizing of the SGT System equipment and components is based on the results of an infiltration analysis. Each SGT subsystem is capable of processing the secondary containment volume, which includes both Unit 1 and Unit 2. The internal pressure of the SGT System boundary region is maintained at a negative pressure of 0.25 inch water gauge when the system is in operation, which represents the internal pressure required to ensure zero exfiltration of air from the building.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.4.3-1 Revision 0
| |
| | |
| SGT System B 3.6.4.3 BASES BACKGROUND The demister is provided to remove entrained water in the (continued) air, while the electric heater reduces the relative humidity of the airstream to ! 70% (Ref. 2). The prefilter removes large particulate matter, while the HEPA filter is provided to remove fine particulate matter and protect the charcoal from fouling. The charcoal adsorber removes gaseous elemental iodine and organic iodides, and the final HEPA filter is provided to collect any carbon fines exhausted from the charcoal adsorber.
| |
| The SGT System automatically starts and operates in response to actuation signals from either Unit 1 or Unit 2 indicative of conditions or an accident that could require operation of the system. Following initiation, both supply fans start.
| |
| SGT System flows are controlled automatically by flow control dampers located up stream of the supply fans.
| |
| APPLICABLE The design basis for the SGT System is to mitigate the SAFETY ANALYSES consequences of a loss of coolant accident and fuel handling accidents (Refs. 3 and 4). For all events analyzed, the SGT System is shown to be automatically initiated to reduce, via filtration and adsorption, the radioactive material released to the environment.
| |
| The SGT System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO Following a DBA, a minimum of one SGT subsystem is required to maintain the secondary containment at a negative pressure with respect to the environment and to process gaseous releases. Meeting the LCO requirements for two OPERABLE subsystems ensures operation of at least one SGT subsystem in the event of a single active failure.
| |
| APPLICABILITY In MODES 1, 2, and 3, a DBA could lead to a fission product release to primary containment that leaks to secondary containment. Therefore, SGT System OPERABILITY is required during these MODES.
| |
| In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining the SGT System OPERABLE is not required in MODE 4 or 5, except for (continued)
| |
| LaSalle 1 and 2 B 3.6.4.3-2 Revision 0
| |
| | |
| SGT System B 3.6.4.3 BASES APPLICABILITY other situations under which significant releases of (continued) radioactive material can be postulated, such as during CORE ALTERATIONS or during movement of irradiated fuel assemblies in the secondary containment.
| |
| ACTIONS A.1 With one SGT subsystem inoperable, the inoperable subsystem must be restored to OPERABLE status within 7 days. In this condition, the remaining OPERABLE SGT subsystem is adequate to perform the required radioactivity release control function. However, the overall system reliability is reduced because a single failure in the OPERABLE subsystem could result in the radioactivity release control function not being adequately performed. The 7 day Completion Time is based on consideration of such factors as the availability of the OPERABLE redundant SGT subsystem and the low probability of a DBA occurring during this period.
| |
| B.1 If the SGT subsystem cannot be restored to OPERABLE status within the required Completion Time in MODE 1, 2, or 3, the plant must be brought to a MODE in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 5) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
| |
| C.1, C.2.1, and C.2.2 During movement of irradiated fuel assemblies in the secondary containment or during CORE ALTERATIONS when Required Action A.1 cannot be completed within the required Completion Time, the OPERABLE SGT subsystem should be (continued)
| |
| LaSalle 1 and 2 B 3.6.4.3-3 Revision 76
| |
| | |
| SGT System B 3.6.4.3 BASES ACTIONS C.1, C.2.1, and C.2.2 (continued) immediately placed in operation. This Required Action ensures that the remaining subsystem is OPERABLE, that no failures that could prevent automatic actuation will occur, and that any other failure would be readily detected.
| |
| An alternative to Required Action C.1 is to immediately suspend activities that represent a potential for releasing radioactive material to the secondary containment, thus placing the unit in a condition that minimizes risk. If applicable, CORE ALTERATIONS and movement of irradiated fuel assemblies must be immediately suspended. Suspension of these activities shall not preclude completion of movement of a component to a safe position.
| |
| The Required Actions of Condition C have been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 4 or 5, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, in either case, inability to suspend movement of irradiated fuel assemblies would not be a sufficient reason to require a reactor shutdown.
| |
| D.1 If both SGT subsystems are inoperable in MODE 1, 2, or 3, the SGT system may not be capable of supporting the required radioactivity release control function. Therefore, the plant must be brought to a MODE in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 5) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.4.3-4 Revision 76
| |
| | |
| SGT System B 3.6.4.3 BASES ACTIONS E.1 and E.2 (continued)
| |
| When two SGT subsystems are inoperable, if applicable, CORE ALTERATIONS and movement of irradiated fuel assemblies in the secondary containment must be immediately suspended.
| |
| Suspension of these activities shall not preclude completion of movement of a component to a safe position.
| |
| Required Action E.1 has been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 4 or 5, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, in either case, inability to suspend movement of irradiated fuel assemblies would not be a sufficient reason to require a reactor shutdown.
| |
| SURVEILLANCE SR 3.6.4.3.1 REQUIREMENTS Operating (from the control room) each SGT subsystem for 15 continuous minutes ensures that both subsystems are OPERABLE and that all associated controls are functioning properly. It also ensures that blockage, fan or motor failure, or excessive vibration can be detected for corrective action. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.6.4.3.2 This SR verifies that the required SGT filter testing is performed in accordance with the Ventilation Filter Testing Program (VFTP). The SGT System filter tests are in accordance with ANSI/ASME N510-1989 (Ref. 6). The VFTP includes testing HEPA filter performance, charcoal adsorber efficiency, minimum system flow rate, and the physical properties of the activated charcoal (general use and following specific operations). Specified test frequencies and additional information are discussed in detail in the VFTP.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.6.4.3-5 Revision 76
| |
| | |
| SGT System B 3.6.4.3 BASES SURVEILLANCE SR 3.6.4.3.3 REQUIREMENTS (continued) This SR requires verification that each SGT subsystem starts upon receipt of an actual or simulated initiation signal.
| |
| The LOGIC SYSTEM FUNCTIONAL TEST in LCO 3.3.6.2, "Secondary Containment Isolation Instrumentation," overlaps this SR to provide complete testing of the safety function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. 10 CFR 50, Appendix A, GDC 41.
| |
| : 2. UFSAR, Section 6.5.1.
| |
| : 3. UFSAR, Section 15.6.5.
| |
| : 4. UFSAR, Section 15.7.4
| |
| : 5. NEDC-32988-A, Revision 2, "Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants," December 2002.
| |
| : 6. ANSI/ASME N510-1989.
| |
| LaSalle 1 and 2 B 3.6.4.3-6 Revision 76
| |
| | |
| RHRSW System B 3.7.1 B 3.7 PLANT SYSTEMS B 3.7.1 Residual Heat Removal Service Water (RHRSW) System BASES BACKGROUND The RHRSW System is designed to provide cooling water for the Residual Heat Removal (RHR) System heat exchangers, required for a safe reactor shutdown following a Design Basis Accident (DBA) or transient. The RHRSW System is operated whenever the RHR heat exchangers are required to operate in the shutdown cooling mode or in the suppression pool cooling or spray mode of the RHR System. The RHRSW System also provides cooling water to the RHR pump seal coolers which are required for RHR pump operation during the shutdown cooling mode in MODE 3.
| |
| The RHRSW System consists of two independent and redundant subsystems. Each subsystem is made up of two pumps (together capable of providing a nominal flow of 7400 gpm),
| |
| a suction source, valves, piping, heat exchanger, and associated instrumentation. Either of the two subsystems is capable of providing the required cooling capacity with both pumps operating to maintain safe shutdown conditions. The two subsystems are separated from each other so that failure of one subsystem will not affect the OPERABILITY of the other subsystem. The RHRSW System is designed with sufficient redundancy so that no single active component failure can prevent it from achieving its design function.
| |
| The RHRSW System is described in the UFSAR, Section 9.2.1, Reference 1.
| |
| The RHRSW and the Diesel Generator Cooling Water subsystems are subsystems to the Core Standby Cooling System (CSCS)
| |
| Equipment Cooling Water System (ECWS). The CSCSECWS consists of three independent piping subsystems corresponding to essential electrical power supply Divisions 1, 2, and 3. The CSCSECWS subsystems take suction from the service water tunnel located in the Lake Screen House.
| |
| The RHRSW subsystems are manually initiated. Cooling water is then pumped from the service water tunnel by the RHRSW pumps to the supported system and components (RHR heat exchangers and RHR pump seal coolers). After removing heat from its supported systems and components, the water from the RHRSW subsystem is discharged to the CSCS Pond (i.e.,
| |
| the Ultimate Heat Sink) through a discharge line that is (continued)
| |
| LaSalle 1 and 2 B 3.7.1-1 Revision 0
| |
| | |
| RHRSW System B 3.7.1 BASES BACKGROUND common to the corresponding divisional discharge from the (continued) other unit. The discharge line terminates in the discharge structure at an elevation above the normal CSCS Pond level.
| |
| The system is initiated manually from the control room. In addition, the Division 2 RHRSW subsystem may be initiated manually from the remote shutdown panel in the auxiliary electric equipment room. If operating during a loss of offsite power, the system is automatically load shed to allow the diesel generators to automatically power only that equipment necessary to reflood the core. The system can be manually started any time after the LOCA.
| |
| APPLICABLE The RHRSW System removes heat from the suppression pool to SAFETY ANALYSES limit the suppression pool temperature and primary containment pressure following a LOCA. This ensures that the primary containment can perform its function of limiting the release of radioactive materials to the environment following a LOCA. The ability of the RHRSW System to support long term cooling of the reactor or primary containment is discussed in the UFSAR, Chapters 6 and 15 (Refs. 2 and 3, respectively). These analyses explicitly assume that the RHRSW System will provide adequate cooling support to the equipment required for safe shutdown. These analyses include the evaluation of the long term primary containment response after a design basis LOCA.
| |
| The safety analyses for long term cooling were performed for various combinations of RHR System failures. The worst case single failure that would affect the performance of the RHRSW System is any failure that would disable one subsystem of the RHRSW System. As discussed in the UFSAR, Section 6.2.2.3.1 (Ref. 4) for these analyses, manual initiation of the OPERABLE RHRSW subsystem and the associated RHR System is assumed to occur 10 minutes after a DBA. The RHRSW flow assumed in the analyses is 7400 gpm with two pumps operating in one loop. In this case, the maximum suppression chamber water temperature and pressure described in UFSAR 6.2 remain well below the design temperature of 275qF and maximum design pressure of 45 psig.
| |
| The RHRSW System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.7.1-2 Revision 38
| |
| | |
| RHRSW System B 3.7.1 BASES (continued)
| |
| LCO Two RHRSW subsystems are required to be OPERABLE to provide the required redundancy to ensure that the system functions to remove post accident heat loads, assuming the worst case single active failure occurs coincident with the loss of offsite power.
| |
| An RHRSW subsystem is considered OPERABLE when:
| |
| : a. Two pumps are OPERABLE; and
| |
| : b. An OPERABLE flow path is capable of taking suction from the CSCS service water tunnel and transferring the water to the associated RHR heat exchanger at the assumed flow rate.
| |
| An adequate suction source is not addressed in this LCO since the minimum net positive suction head and the maximum suction source temperature are covered by the requirements specified in LCO 3.7.3, "Ultimate Heat Sink (UHS)."
| |
| APPLICABILITY In MODES 1, 2, and 3, the RHRSW System is required to be OPERABLE to support the OPERABILITY of the RHR System for primary containment cooling (LCO 3.6.2.3, "Residual Heat Removal (RHR) Suppression Pool Cooling" and decay heat removal (LCO 3.4.9, "Residual Heat Removal (RHR) Shutdown Cooling SystemHot Shutdown"). The Applicability is therefore consistent with the requirements of these systems.
| |
| In MODES 4 and 5, the OPERABILITY requirements of the RHRSW System are determined by the systems it supports and therefore, the requirements are not the same for all facets of operation in MODES 4 and 5. Thus, the LCOs of the RHR Shutdown Cooling System (LCO 3.4.10, "Residual Heat Removal (RHR) Shutdown Cooling SystemCold Shutdown," LCO 3.9.8, "Residual Heat Removal (RHR)High Water Level," and LCO 3.9.9, "Residual Heat Removal (RHR)Low Water Level"),
| |
| which require portions of the RHRSW System to be OPERABLE, will govern RHRSW System operation in MODES 4 and 5.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.7.1-3 Revision 0
| |
| | |
| RHRSW System B 3.7.1 BASES (continued)
| |
| ACTIONS A.1 Required Action A.1 is intended to handle the inoperability of one RHRSW subsystem. The Completion Time of 7 days is allowed to restore the RHRSW subsystem to OPERABLE status.
| |
| Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.
| |
| With the unit in this condition, the remaining OPERABLE RHRSW subsystem is adequate to perform the RHRSW heat removal function. However, the overall reliability is reduced because a single failure in the OPERABLE RHRSW subsystem could result in loss of RHRSW function. The Completion Time is based on the redundant RHRSW capabilities afforded by the OPERABLE subsystem and the low probability of an event occurring requiring RHRSW during this period.
| |
| The Required Action is modified by a Note indicating that the applicable Conditions of LCO 3.4.9, be entered and Required Actions taken if the inoperable RHRSW subsystem results in inoperable RHR shutdown cooling. This is an exception to LCO 3.0.6 and ensures the proper actions are taken for these components.
| |
| B.1 If one RHRSW subsystem is inoperable and not restored within the provided Completion Time, the plant must be brought to a condition in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 6) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.7.1-4 Revision 89
| |
| | |
| RHRSW System B 3.7.1 BASES ACTIONS C.1 (continued)
| |
| With both RHRSW subsystems inoperable (e.g., both subsystems with inoperable pump(s) or flow paths, or one subsystem with an inoperable pump and one subsystem with an inoperable flow path), the RHRSW System is not capable of performing its intended function. At least one subsystem must be restored to OPERABLE status within 8 hours. The 8 hour Completion Time for restoring one RHRSW subsystem to OPERABLE status, is based on the Completion Times provided for the RHR suppression pool cooling and spray functions.
| |
| The Required Action is modified by a Note indicating that the applicable Conditions of LCO 3.4.9, be entered and Required Actions taken if the inoperable RHRSW subsystem results in inoperable RHR shutdown cooling. This is an exception to LCO 3.0.6 and ensures the proper actions are taken for these components.
| |
| D.1 and D.2 If any Required Action and associated Completion Time of Condition C is not met, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 12 hours and in MODE 4 within 36 hours. The allowed Completion Time is reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.7.1-5 Revision 42
| |
| | |
| RHRSW System B 3.7.1 BASES (continued)
| |
| SURVEILLANCE SR 3.7.1.1 REQUIREMENTS Verifying the correct alignment for each manual, power operated, and automatic valve in each RHRSW subsystem flow path provides assurance that the proper flow paths will exist for RHRSW operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves are verified to be in the correct position prior to locking, sealing, or securing. A valve is also allowed to be in the nonaccident position, and yet considered in the correct position, provided it can be realigned to its accident position. This is acceptable because the RHRSW System is a manually initiated system.
| |
| This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 9.2.1.
| |
| : 2. UFSAR, Chapter 6.
| |
| : 3. UFSAR, Chapter 15.
| |
| : 4. UFSAR, Section 6.2.2.3.1.
| |
| : 5. Risk Management Document SA-1354, Rev. 0, LaSalle Division 1 and 2 CSCS Valve Replacement Project -
| |
| Temporary Extension of Technical Specification Completion Times, December 02, 2004.
| |
| : 6. NEDC-32988-A, Revision 2, "Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants," December 2002.
| |
| LaSalle 1 and 2 B 3.7.1-6 Revision 51
| |
| | |
| DGCW System B 3.7.2 B 3.7 PLANT SYSTEMS B 3.7.2 Diesel Generator Cooling Water (DGCW) System BASES BACKGROUND The DGCW System is designed to provide cooling water for the removal of heat from the standby diesel generators, low pressure core spray (LPCS) pump motor cooling coils, and Emergency Core Cooling System (ECCS) cubicle area cooling coils that support equipment required for a safe reactor shutdown following a design basis accident (DBA) or transient.
| |
| The DGCW System consists of three independent cooling water headers (Divisions 1, 2, and 3), and their associated pumps, valves, and instrumentation. The pump and header for the Division 1 DGCW subsystem is common to both units (and supplies cooling to equipment on both units). The other divisions have independent pumps and suction headers.
| |
| The following combinations of DGCW pumps are sized to provide sufficient cooling capacity to support the required safety related systems during safe shutdown of the unit following a loss of coolant accident (LOCA):
| |
| : a. The Division 1 and 2 DGCW pumps;
| |
| : b. The Division 1 and 3 DGCW pumps and opposite unit Division 2 DGCW pump; or
| |
| : c. The Division 2 and 3 DGCW pumps.
| |
| The Division 1 DGCW subsystem services its associated Diesel Generator (DG) and ECCS cubicle area coolers, and the LPCS pump motor cooler. The Division 2 DGCW subsystem services its associated DG and ECCS cubicle area cooler. The Division 3 DGCW subsystem services the High Pressure Core Spray (HPCS) DG and its associated ECCS cubicle area cooler.
| |
| The opposite unit Division 2 DGCW subsystem services its associated DG for support of systems required by both units.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.7.2-1 Revision 0
| |
| | |
| DGCW System B 3.7.2 BASES BACKGROUND The DGCW and the Residual Heat Removal Service Water (RHRSW)
| |
| (continued) subsystems are subsystems to the Core Standby Cooling System (CSCS)Equipment Cooling Water System (ECWS). The CSCS ECWS consists of three independent piping subsystems corresponding to essential electrical power supply Divisions 1, 2, and 3. The CSCSECWS subsystems take a suction from the service water tunnel located in the Lake Screen House.
| |
| Each DGCW pump auto-starts upon receipt of a diesel generator (DG) start signal when power is available to the pump's electrical bus or on start of ECCS cubicle area coolers. The Division 1 DGCW pump also auto-starts upon receipt of a start signal for the LPCS pump. Cooling water is then pumped from the service water tunnel by the DGCW pumps to the supported systems and components (i.e., the DGs, LPCS pump motor cooler, and the ECCS cubicle area coolers). After removing heat from these systems and components, the water from the DGCW subsystem is discharged to the CSCS pond (i.e., the Ultimate Heat Sink) through a discharge line that is common to the corresponding divisional discharge from the other unit. The discharge line terminates in the discharge structure at an elevation above the normal CSCS Pond level. A complete description of the DGCW System is presented in the UFSAR, Section 9.2.1 (Ref. 1).
| |
| APPLICABLE The ability of the DGCW System to provide adequate cooling SAFETY ANALYSES to the DGs, LPCS pump motor cooling coils and ECCS cubicle area cooling coils is an implicit assumption for the safety analyses presented in UFSAR, Chapters 6 and 15 (Refs. 2 and 3, respectively). The ability to provide onsite emergency AC power is dependent on the ability of the DGCW System to cool the DGs.
| |
| The DGCW System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The Division 1, 2, and 3, and the opposite unit's Division 2 DGCW subsystems are required to be OPERABLE to ensure the effective operation of the DGs, the LPCS pump motor, and the ECCS equipment supported by the ECCS cubicle area coolers during a DBA or transient. The OPERABILITY of each DGCW (continued)
| |
| LaSalle 1 and 2 B 3.7.2-2 Revision 2
| |
| | |
| DGCW System B 3.7.2 BASES LCO subsystem is based on having an OPERABLE pump and an (continued) OPERABLE flow path capable of taking suction from the CSCS water tunnel and transferring cooling water to the associated diesel generator, LPCS pump motor cooling coils, and ECCS cubicle area cooling coils, as required.
| |
| An adequate suction source is not addressed in this LCO since the minimum net positive suction head of the DGCW pump and the maximum suction source temperature are covered by the requirements specified in LCO 3.7.3, "Ultimate Heat Sink (UHS)."
| |
| APPLICABILITY In MODES 1, 2, and 3, the DGCW subsystems are required to support the OPERABILITY of equipment serviced by the DGCW subsystems and required to be OPERABLE in these MODES.
| |
| In MODES 4 and 5, the OPERABILITY requirements of the DGCW subsystems are determined by the systems they support.
| |
| Therefore, the requirements are not the same for all facets of operation in MODES 4 and 5. Thus, the LCOs of the systems supported by the DGCW subsystems will govern DGCW System OPERABILITY requirements in MODES 4 and 5.
| |
| ACTIONS The ACTIONS Table is modified by a Note indicating that separate Condition entry is allowed for each DGCW subsystem.
| |
| This is acceptable, since the Required Actions for the Condition provide appropriate compensatory actions for each inoperable DGCW subsystem. Complying with the Required Actions for one inoperable DGCW subsystem may allow for continued operation, and subsequent inoperable DGCW subsystem(s) are governed by separate Condition entry and application of associated Required Actions.
| |
| A.1 Condition A is modified by two Notes indicating that this Condition is not applicable during installation of Division 1 and Division 2 CSCS isolation valves during Unit 1 Refueling Outages prior to July 1, 2024, and during Unit 2 Refueling Outages prior to July 1, 2023, while the outage unit is in MODE 4, 5, or defueled. For Unit 1, the use of this Note, once for Division 1 and once for (continued)
| |
| LaSalle 1 and 2 B 3.7.2-3 Revision 76
| |
| | |
| DGCW System B 3.7.2 BASES ACTIONS A.1 (continued)
| |
| Division 2, will occur during Refueling Outages 18, 19, or
| |
| : 20. For Unit 2, the use of this Note, once for Division 1 and once for Division 2, will occur during Refueling Outages 17, 18, or 19. Either Division 1 or Division 2 CSCS isolation valve installation is performed on the outage unit during a single Refueling Outage and this note may not be used in subsequent outages for the same unit and division.
| |
| When the specified DGCW subsystem(s) are inoperable during the CSCS isolation valve installation, Condition B provides appropriate Required Actions.
| |
| If one or more DGCW subsystems are inoperable, the associated DG(s) and ECCS components supported by the affected DGCW loop, including LPCS pump motor cooling coils or ECCS cubicle area cooling coils, as applicable, cannot perform their intended function and must be immediately declared inoperable. In accordance with LCO 3.0.6, this also requires entering into the Applicable Conditions and Required Actions for LCO 3.4.9, RHR Shutdown Cooling System
| |
| -Hot Shutdown, LCO 3.5.1, "ECCS-Operating, LCO 3.5.3, RCIC System, LCO 3.6.2.3, RHR Suppression Pool Cooling, LCO 3.6.2.4, RHR Suppression Pool Spray, and LCO 3.8.1, "AC Sources Operating, as appropriate.
| |
| B.1 Condition B is modified by two Notes indicating that this Condition is only applicable during installation of Division 1 and Division 2 CSCS isolation valves during Unit 1 Refueling Outages prior to July 1, 2024, and during Unit 2 Refueling Outages prior to July 1, 2023, while the outage unit is in MODE 4, 5, or defueled. For Unit 1, the use of this Note, once for Division 1 and once for Division 2, will occur during Refueling Outages 18, 19, or
| |
| : 20. For Unit 2, the use of this Note, once for Division 1 and once for Division 2, will occur during Refueling Outages 17, 18, or 19. Either Division 1 or Division 2 CSCS isolation valve installation is performed on the outage unit during a single refueling outage and this note may not be used in subsequent outages for the same unit and division.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.7.2-4 Revision 76
| |
| | |
| DGCW System B 3.7.2 BASES ACTIONS B.1 (continued)
| |
| Required Action B.1 is intended to handle the inoperability of one DGCW subsystem during installation of CSCS isolation valves. The Completion Time of 7 days is allowed to restore the DGCW subsystem to OPERABLE status. During installation of each CSCS isolation valve a mechanical line stop will be used to maintain availability of the CSCS system and DGCW subsystem for the online Unit. The line stops are designed to the same or greater pressure rating and seismic design as the CSCS piping.
| |
| If the DGCW subsystem for the online Unit is not maintained available while in this Condition, Condition A should be entered immediately.
| |
| C.1 and C.2 If the Required Action and associated Completion Time of Condition B is not met, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 12 hours and in MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| SURVEILLANCE SR 3.7.2.1 REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves in each DGCW subsystem flow path provides assurance that the proper flow paths will exist for DGCW subsystem operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve is also allowed to be in the nonaccident position, and yet be considered in the correct position provided it can be automatically realigned to its accident position, within the required time. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.7.2-5 Revision 76
| |
| | |
| DGCW System B 3.7.2 BASES SURVEILLANCE SR 3.7.2.1 (continued)
| |
| REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.7.2.2 This SR ensures that each DGCW subsystem pump will automatically start to provide required cooling to the associated DG, LPCS pump motor cooling coils, and ECCS cubicle area cooling coils, as applicable, when the associated DG starts and the respective bus is energized.
| |
| For the Division 1 DGCW subsystem, this SR also ensures the DGCW pump automatically starts on receipt of a start signal for the unit LPCS pump. These starts may be performed using actual or simulated initiation signals.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 9.2.1.
| |
| : 2. UFSAR, Chapter 6.
| |
| : 3. UFSAR, Chapter 15.
| |
| : 4. Risk Management Document SA-1354, Rev. 0, LaSalle Division 1 and 2 CSCS Valve Replacement Project -
| |
| Temporary Extension of Technical Specification Completion Times, December 02, 2004.
| |
| LaSalle 1 and 2 B 3.7.2-6 Revision 76
| |
| | |
| UHS B 3.7.3 B 3.7 PLANT SYSTEMS B 3.7.3 Ultimate Heat Sink (UHS)
| |
| BASES BACKGROUND The UHS (i.e., the Core Standby Cooling System (CSCS) Pond) consists of the volume of water remaining in the cooling lake following the failure of the main dike. This water has a depth of approximately 5 feet and a top water elevation established at 690 feet. The volume of the remaining water in the cooling lake is sufficient to permit a safe shutdown and cooldown of the station for 30 days with no water makeup for both accident and normal conditions (Regulatory Guide 1.27, Ref. 1).
| |
| The CSCS Pond provides a source of water to the service water tunnel from which the Residual Heat Removal Service Water (RHRSW) and Diesel Generator Cooling Water (DGCW) pumps take suction. The service water tunnel is filled from the CSCS Pond by six inlet lines which connect to the circulating water pump forebays. Prior to entering the service water tunnel inlet pipes, the water is strained by the Lake Screen House traveling screens to prevent large pieces of debris from entering the system and blocking flow or damaging equipment. However, because the traveling screens are not safety related, a 54-inch bypass line around the screens, isolated by a normally closed manual valve, is provided to assure a continuous supply of CSCS Pond water to the service water tunnel.
| |
| Additional information on the design and operation of the CSCS Pond is provided in UFSAR, Sections 9.2.1 and 9.2.6 (Refs. 2 and 3). The excavation slopes of the CSCS Pond and flume are designed to be stable under all conditions of emergency operation while providing the capability to supply adequate cooling water to equipment required for safe reactor shutdown.
| |
| APPLICABLE The volume of the CSCS pond is sized to permit the safe SAFETY ANALYSES shutdown and cooldown of the units for a 30 day period with no additional makeup water source available for both normal and accident conditions (Ref. 2).
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.7.3-1 Revision 29
| |
| | |
| UHS B 3.7.3 BASES APPLICABLE The UHS post-accident temperature is based on heat removal SAFETY ANALYSES calculations (Ref. 5) that analyze for a maximum allowable (continued) post-accident inlet cooling water temperature of 107°F. To account for the worst-case scenario and to apply conservatism, the maximum initial CSCS pond cooling water temperature is reduced by 0.75qF to account for instrument uncertainty (Ref. 6) and a minimum additional margin of 0.25°F, to ensure the cooling water temperature supplied to the plant from the CSCS pond remains d 107°F at all times.
| |
| There are four temperature measuring devices located in the Circulating Water inlet thermowells (i.e., two per unit).
| |
| The 0.75qF allowance bounds the instrument uncertainty associated with any combination of operable temperature measurement devices.
| |
| The UHS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO OPERABILITY of the UHS is based on a maximum water temperature being supplied to the plant within the Acceptable Operation region defined by Figure 3.7.3-1 and a minimum pond water level at or above elevation 690 ft mean sea level. In addition, to ensure the volume of water available in the CSCS pond is sufficient to maintain adequate long term cooling, average sediment deposition (in the intake flume and in the pond) must be d 6 inches.
| |
| APPLICABILITY In MODES 1, 2, and 3, the UHS is required to be OPERABLE to support OPERABILITY of the equipment serviced by the UHS, and is required to be OPERABLE in these MODES.
| |
| In MODES 4 and 5, the OPERABILITY requirements of the UHS are determined by the systems it supports. Therefore, the requirements are not the same for all facets of operation in MODES 4 and 5. The LCOs of the systems supported by the UHS will govern UHS OPERABILITY requirements in MODES 4 and 5.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.7.3-2 Revision 88
| |
| | |
| UHS B 3.7.3 BASES (continued)
| |
| ACTIONS A.1 If the CSCS pond is inoperable, due to average sediment deposition > 6 inches (in the intake flume, CSCS pond, or both) action must be taken to restore the inoperable UHS to an OPERABLE status within 90 days. The 90 day Completion Time is reasonable based on the low probability of an accident occurring during that time, historical data corroborating the low probability of continued degradation (i.e., further excessive sediment deposition) of the CSCS pond during that time, and the time required to complete the Required Action.
| |
| B.1 and B.2 If the CSCS pond cannot be restored to OPERABLE status within the associated Completion Time, or the CSCS pond is determined inoperable for reasons other than Condition A (e.g., inoperable due to the temperature of the cooling water supplied to the plant from the CSCS pond in the Unacceptable Operation region defined by Figure 3.7.3-1),
| |
| the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 12 hours and in MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.7.3-3 Revision 88
| |
| | |
| UHS B 3.7.3 BASES (continued)
| |
| SURVEILLANCE SR 3.7.3.1 REQUIREMENTS Verification of the temperature of the water supplied to the plant from the CSCS pond ensures that the heat removal capabilities of the RHRSW System and DGCW System are within the assumptions of the DBA analysis. To ensure that the maximum post-accident temperature of water supplied to the plant is not exceeded (i.e., 107qF evaluated in Ref. 4), the temperature during normal plant operation must be within the limits described by Figure 3.7.3-1 (Ref. 3). This is to account for the CSCS pond design requirement that it provide adequate cooling water supply to the plant (i.e.,
| |
| temperature d 107qF) for 30 days without makeup, while taking into account solar heat loads and plant decay heat during the worst historical weather conditions. In addition, since the lake temperature follows a diurnal cycle (it heats up during the day and cools off at night), the allowable initial UHS temperature varies with the time of day. The allowable initial UHS temperatures, based on the actual sediment level and the time of day have been determined by analysis (Ref. 5). The limiting initial UHS temperatures determined in this analysis ensure the maximum post-accident temperature of 107qF is not exceeded. These temperatures are analytical limits that do not include instrument uncertainty or additional margin. These limiting initial temperatures remain bounded by the SR 3.7.3.1 limits described by Figure 3.7.3-1. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| With water temperature of the UHS greater than or equal to 101°F, SR 3.7.3.1 is performed once per hour to monitor the water temperature of the UHS and verify the temperature is within the limits of Figure 3.7.3-1 more frequently. The once per hour Frequency takes into consideration UHS temperature variations and the increased monitoring frequency needed to ensure the design basis temperature limit of 107°F is not exceeded.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.7.3-4 Revision 88
| |
| | |
| UHS B 3.7.3 BASES SURVEILLANCE SR 3.7.3.2 REQUIREMENTS (continued) This SR ensures adequate long term (30 days) cooling can be maintained, by verifying the average sediment level in the intake flume and the CSCS pond is d 6 inches. Sediment level is determined by a series of sounding cross-sections compared to as-built soundings. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. Regulatory Guide 1.27, Revision 2, January 1976.
| |
| : 2. UFSAR, Section 9.2.1.
| |
| : 3. UFSAR, Section 9.2.6.
| |
| : 4. EC 388666, Rev. 0, "Revise Design Analyses for UHS Temperature of 107qF."
| |
| : 5. L-002457, Rev. 8, "LaSalle County Station Ultimate Heat Sink Analysis."
| |
| : 6. L-003230, Rev. 1b, "CW Inlet Temperature Uncertainty Analysis."
| |
| : 7. EC 632116, "Evaluation Of UHS Initial Temperature for Support of License Amendment Request TS 3.7.3" LaSalle 1 and 2 B 3.7.3-5 Revision 88
| |
| | |
| CRAF System B 3.7.4 B 3.7 PLANT SYSTEMS B 3.7.4 Control Room Area Filtration (CRAF) System BASES BACKGROUND The CRAF System provides a protected environment from which occupants can control the unit following an uncontrolled release of radioactivity, hazardous chemicals or smoke. The Control Room Area Heating Ventilation and Air Conditioning (HVAC) System is comprised of the Control Room HVAC System and the Auxiliary Electric Equipment Room (AEER) HVAC System. The Control Room HVAC System is common to both units and serves the control room, main security control center, and the control room habitability storage room (toilet room). The AEER HVAC System is common to both units and services the auxiliary electrical equipment rooms. The control room area is comprised of the areas covered by the Control Room and AEER HVAC Systems.
| |
| The CRE is the area within the confines of the CRE boundary that contains the spaces that control room occupants inhabit to control the unit during normal and accident conditions. This area encompasses the control room and AEER, and may encompass other non-critical areas to which frequent personnel access or continuous occupancy is not necessary in the event of an accident.
| |
| The CRE is protected for normal operation, natural events, and accident conditions. The CRE boundary is the combination of walls, floor, roof, ducting, doors, penetrations and equipment that physically form the CRE. The OPERABILITY of the CRE boundary must be maintained to ensure that the inleakage of unfiltered air into the CRE will not exceed the inleakage assumed in the licensing basis analysis of design basis accident (DBA) consequences to CRE occupants. The CRE and its boundary are defined in the Control Room Envelope Habitability Program.
| |
| The safety related function of the CRAF System used to control radiation exposure consists of two independent and redundant high efficiency air filtration subsystems (i.e., the emergency makeup air filter units (EMUs) for treatment of outside supply air).
| |
| Recirculation filters are also provided for treatment of recirculated air. Each EMU subsystem consists of a demister, an electric heater, a prefilter, a high efficiency particulate air (HEPA) filter, (continued)
| |
| LaSalle 1 and 2 B 3.7.4-1 Revision 36
| |
| | |
| CRAF System B 3.7.4 BASES BACKGROUND an activated charcoal adsorber section, a second HEPA (continued) filter, a fan, and the associated ductwork, dampers, doors, barriers, and instrumentation and controls. Demisters remove water droplets from the airstream. The electric heater reduces the relative humidity of the air entering the EMUs. Prefilters and HEPA filters remove particulate matter that may be radioactive. The charcoal adsorbers provide a holdup period for gaseous iodine, allowing time for decay.
| |
| Each Control Room and AEER Ventilation System has a charcoal recirculation filter in the supply of the system that is normally bypassed. In addition, the OPERABILITY of the CRAF System is dependent upon portions of the Control Room Area HVAC System, including the control room and auxiliary electric equipment room outside air intakes, supply fans, ducts, dampers, etc.
| |
| In addition to the safety related standby emergency filtration function, parts of the CRAF System that are shared with the Control Room Area HVAC System are operated to maintain the CRE environment during normal operation.
| |
| Upon receipt of a high radiation signal from the outside air intake (indicative of conditions that could result in radiation exposure to CRE occupants), the CRAF System automatically isolates the normal outside air supply to the Control Room Area HVAC System, and diverts the minimum outside air requirement through the EMUs before delivering it to the CRE. The recirculation filters for the control room and AEER must be manually placed in service within 4 hours of receipt of any control room high radiation alarm.
| |
| The CRAF System is designed to maintain a habitable environment in the CRE for a 30 day continuous occupancy after a DBA, without exceeding a 5 rem TEDE dose. CRAF System operation in maintaining the CRE habitability is discussed in the UFSAR, Sections 6.4, 6.5.1, and 9.4.1 (Refs. 1, 2, and 3, respectively).
| |
| APPLICABLE The ability of the CRAF System to maintain the SAFETY ANALYSES habitability of the CRE is an explicit assumption for the safety analyses presented in the UFSAR, Chapters 6 and 15 (Refs. 4 and 5, respectively). The pressurization mode of the CRAF System is assumed to operate following a DBA. The (continued)
| |
| LaSalle 1 and 2 B 3.7.4-2 Revision 48
| |
| | |
| CRAF System B 3.7.4 BASES APPLICABLE radiological doses to CRE occupants as a result of the SAFETY ANALYSES various DBAs are summarized in Reference 5. No single (continued) active failure will cause the loss of outside or recirculated air from the CRE.
| |
| The CRAF System provides protection from smoke and hazardous chemicals to the CRE occupants. The analysis of hazardous chemical releases demonstrates that the toxicity limits are not exceeded in the CRE following a hazardous chemical release (Ref. 1). The evaluation of a smoke challenge demonstrates that it will not result in the inability of the CRE occupants to control the reactor either from the control room or from the remote shutdown panels (Ref. 3).
| |
| The CRAF System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO Two redundant subsystems of the CRAF System are required to be OPERABLE to ensure that at least one is available, if a single active failure disables the other subsystem. Total CRAF System failure, such as from a loss of both ventilation subsystems or from an inoperable CRE boundary, could result in exceeding a dose of 5 rem TEDE to the CRE occupants in the event of a DBA.
| |
| Each CRAF subsystem is considered OPERABLE when the individual components necessary to limit CRE occupant exposure are OPERABLE. A subsystem is considered OPERABLE when its associated EMU is OPERABLE and the associated charcoal recirculation filters for the control room and AEER are OPERABLE. An EMU is considered OPERABLE when its associated:
| |
| : a. Fan is OPERABLE;
| |
| : b. HEPA filter and charcoal adsorber are not excessively restricting flow and are capable of performing their filtration functions; and
| |
| : c. Heater, demister, ductwork, valves, and dampers are OPERABLE, and air circulation through the EMU can be maintained.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.7.4-3 Revision 48
| |
| | |
| CRAF System B 3.7.4 BASES LCO Additionally, the portions of the Control Room Area HVAC (continued) System that supply the outside air to the EMUs are required to be OPERABLE. This includes the outside air intakes, associated dampers and ductwork.
| |
| In order for the CRAF subsystems to be considered OPERABLE, the CRE boundary must be maintained such that the CRE occupant dose from a large radioactive release does not exceed the calculated dose in the licensing basis consequence analysis for DBAs, and that CRE occupants are protected from hazardous chemicals and smoke.
| |
| The LCO is modified by a Note allowing the CRE boundary to be opened intermittently under administrative controls.
| |
| This Note only applies to openings in the CRE boundary that can be rapidly restored to the design condition, such as doors, hatches, floor plugs, and access panels. For entry and exit through doors, the administrative control of the opening is performed by the person(s) entering or exiting the area. For other openings, these controls should be proceduralized and consist of stationing a dedicated individual at the opening who is in continuous communication with the operators in the CRE. This individual will have a method to rapidly close the opening and to restore the CRE boundary to a condition equivalent to the design condition when a need for the CRAF System to be in the pressurization mode of operation is indicated.
| |
| APPLICABILITY In MODES 1, 2, and 3, the CRAF System must be OPERABLE to ensure that the CRE will remain habitable during and following a DBA, since the DBA could lead to a fission product release.
| |
| In MODES 4 and 5, the probability and consequences of a DBA are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining the CRAF System OPERABLE is not required in MODE 4 or 5, except during movement of irradiated fuel assemblies in the secondary containment and during CORE ALTERATIONS.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.7.4-4 Revision 76
| |
| | |
| CRAF System B 3.7.4 BASES (continued)
| |
| ACTIONS A.1 With one CRAF subsystem inoperable, for reasons other than an inoperable CRE boundary, the inoperable CRAF subsystem must be restored to OPERABLE status within 7 days. With the unit in this condition, the remaining OPERABLE CRAF subsystem is adequate to perform the CRE occupant protection function. However, the overall reliability is reduced because a failure in the OPERABLE subsystem could result in loss of CRAF System function. The 7 day Completion Time is based on the low probability of a DBA occurring during this time period, and that the remaining subsystem can provide the required capabilities.
| |
| B.1, B.2, and B.3 If the unfiltered inleakage of potentially contaminated air past the CRE boundary and into the CRE can result in CRE occupant radiological dose greater than the calculated dose of the licensing basis analyses of DBA consequences (allowed to be up to 5 rem TEDE), or inadequate protection of CRE occupants from hazardous chemicals or smoke, the CRE boundary is inoperable. Actions must be taken to restore an OPERABLE CRE boundary within 90 days.
| |
| During the period that the CRE boundary is considered inoperable, action must be initiated to implement mitigating actions to lessen the effect on CRE occupants from the potential hazards of a radiological or chemical event or a challenge from smoke. Actions must be taken within 24 hours to verify that in the event of a DBA, the mitigating actions will ensure that CRE occupant radiological exposures will not exceed the calculated dose of the licensing basis analyses of DBA consequences, and that CRE occupants are protected from hazardous chemicals and smoke. These mitigating actions (i.e., actions that are taken to offset the consequences of the inoperable CRE boundary) should be preplanned for implantation upon entry into the condition, regardless of whether entry is intentional or unintentional.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.7.4-5 Revision 76
| |
| | |
| CRAF System B 3.7.4 BASES ACTIONS B.1, B.2, and B.3 (continued)
| |
| The 24 hour completion time is reasonable based on the low probability of a DBA occurring during this time period, and the use of mitigating actions. The 90 day Completion Time is reasonable based on the determination that the mitigating actions will ensure protection of CRE occupants within analyzed limits while limiting the probability that CRE occupants will have to implement protective measures that may adversely affect their ability to control the reactor and maintain it in a safe shutdown condition in the event of a DBA. In addition, the 90 day Completion Time is a reasonable time to diagnose, plan and possibly repair, and test most problems with the CRE boundary.
| |
| C.1 In MODE 1, 2, or 3, if the inoperable CRAF subsystem or the CRE boundary cannot be restored to OPERABLE status within the required Completion Time, the unit must be placed in a MODE that minimizes overall plant risk. To achieve this status, the unit must be placed in at least MODE 3 within 12 hours. Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 6) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| D.1, D.2.1, and D.2.2 LCO 3.0.3 is not applicable while in MODE 4 or 5. However, since irradiated fuel assembly movement can occur in MODE 1, 2, or 3, the Required Actions of Condition D are modified by a Note indicating that LCO 3.0.3 does not apply. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations.
| |
| Entering LCO 3.0.3 while in MODE 1, 2, or 3 would require (continued)
| |
| LaSalle 1 and 2 B 3.7.4-6 Revision 76
| |
| | |
| CRAF System B 3.7.4 BASES ACTIONS D.1, D.2.1, and D.2.2 (continued) the unit to be shutdown, but would not require immediate suspension of movement of irradiated fuel assemblies. The Note to the ACTIONS, "LCO 3.0.3 is not applicable," ensures that the actions for immediate suspension of irradiated fuel assembly movement are not postponed due to entry into LCO 3.0.3.
| |
| During movement of irradiated fuel assemblies in the secondary containment or during CORE ALTERATIONS, if the inoperable CRAF subsystem cannot be restored to OPERABLE status within the required Completion Time, the OPERABLE CRAF subsystem may be placed in the pressurization mode.
| |
| This action ensures that the remaining subsystem is OPERABLE, that no failures that would prevent automatic actuation will occur, and that any active failure will be readily detected.
| |
| An alternative to Required Action D.1 is to immediately suspend activities that present a potential for releasing radioactivity that might require the CRAF System to be in the pressurization mode of operation. This places the unit in a condition that minimizes the accident risk.
| |
| If applicable, CORE ALTERATIONS and movement of irradiated fuel assemblies in the secondary containment must be suspended immediately. Suspension of these activities shall not preclude completion of movement of a component to a safe position.
| |
| E.1 If both CRAF subsystems are inoperable in MODE 1, 2, or 3, for reasons other than an inoperable CRE boundary (i.e., Condition B), the CRAF System may not be capable of performing the intended function. Therefore, the plant must be brought to a MODE in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in (continued)
| |
| LaSalle 1 and 2 B 3.7.4-7 Revision 76
| |
| | |
| CRAF System B 3.7.4 BASES ACTIONS E.1 (continued)
| |
| MODE 4 (Ref. 6) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions is an orderly manner and without challenging plant systems.
| |
| F.1 and F.2 LCO 3.0.3 is not applicable while in MODE 4 or 5. However, since irradiated fuel assembly movement can occur in MODE 1, 2, or 3, the Required Actions of Condition F are modified by a Note indicating that LCO 3.0.3 does not apply. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations.
| |
| Entering LCO 3.0.3 while in MODE 1, 2, or 3 would require the unit to be shutdown, but would not require immediate suspension of movement of irradiated fuel assemblies. The Note to the ACTIONS, "LCO 3.0.3 is not applicable," ensures that the actions for immediate suspension of irradiated fuel assembly movement are not postponed due to entry into LCO 3.0.3.
| |
| During movement of irradiated fuel assemblies in the secondary containment or during CORE ALTERATIONS, with two CRAF subsystems inoperable, or with one or more CRAF subsystems inoperable due to an inoperable CRE boundary, action must be taken immediately to suspend activities that present a potential for releasing radioactivity that might require the CRAF System to be in the pressurization mode of operation. This places the unit in a condition that minimizes the accident risk.
| |
| If applicable, CORE ALTERATIONS and movement of irradiated fuel assemblies in the secondary containment must be suspended immediately. Suspension of these activities shall not preclude completion of movement of a component to a safe position.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.7.4-8 Revision 76
| |
| | |
| CRAF System B 3.7.4 BASES (continued)
| |
| SURVEILLANCE SR 3.7.4.1 REQUIREMENTS This SR verifies that a subsystem in a standby mode starts on demand and continues to operate. Standby systems should be checked periodically to ensure that they start and function properly. Operation with the heaters on for ! 15 continuous minutes demonstrates OPERABILITY of the system.
| |
| Periodic operation ensures that heater failure, blockage, fan or motor failure, or excessive vibration can be detected for corrective action. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.7.4.2 This SR verifies that flow can be manually realigned through the CRAF System recirculation filters and maintained for
| |
| ! 15 minutes. Standby systems should be checked periodically to ensure that they function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.7.4.3 This SR verifies that the required CRAF testing is performed in accordance with Specification 5.5.8, "Ventilation Filter Testing Program (VFTP)." The CRAF filter tests are in accordance with ANSI/ASME N510-1989 (Ref. 7). The VFTP includes testing HEPA filter performance, charcoal adsorber efficiency, system flow rate, and the physical properties of the activated charcoal (general use and following specific operations). Specific test Frequencies and additional information are discussed in detail in the VFTP.
| |
| SR 3.7.4.4 This SR verifies that each CRAF subsystem automatically switches to the pressurization mode of operation on an actual or simulated air intake radiation monitors initiation (continued)
| |
| LaSalle 1 and 2 B 3.7.4-9 Revision 58
| |
| | |
| CRAF System B 3.7.4 BASES SURVEILLANCE SR 3.7.4.4 (continued)
| |
| REQUIREMENTS signal. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.7.1.4 overlaps this SR to provide complete testing of the safety function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.7.4.5 This SR verifies the OPERBILITY of the CRE boundary by testing for unfiltered air inleakage past the CRE boundary and into the CRE. The details of the testing are specified in the Control Room Envelope Habitability Program.
| |
| The CRE is considered habitable when the radiological dose to CRE occupants calculated in the licensing basis analyses of DBA consequences is no more than 5 rem TEDE and the CRE occupants are protected from hazardous chemicals and smoke.
| |
| This SR verifies that the unfiltered air inleakage into the CRE is no greater than the flow rates assumed in the licensing basis analyses of DBA consequences. When the unfiltered air inleakage is greater than the assumed flow rate, Condition B must be entered. Required Action B.3 allows time to restore the CRE boundary to OPERABLE status provided mitigating actions can ensure that the CRE remains within the licensing basis habitability limits for the occupants following an accident. Compensatory measures are discussed in Regulatory Guide 1.196, Section C.2.7.3 (Ref.
| |
| 8), which endorses, with exceptions, NEI 99-03, Section 8.4 and Appendix F (Ref. 9). These compensatory measures may also be used as mitigating actions as required by Required Action B.2. Temporary analytical methods may also be used as compensatory measures to restore OPERABILITY (Ref. 10).
| |
| Options for restoring the CRE boundary to OPERABLE status include changing the licensing basis DBA consequence analysis, repairing the CRE boundary, or a combination of these actions. Depending upon the nature of the problem and the corrective action, a full scope inleakage test may not be necessary to establish that the CRE boundary has been restored to OPERABLE status.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.7.4-10 Revision 51
| |
| | |
| CRAF System B 3.7.4 BASES (continued)
| |
| REFERENCES 1. UFSAR, Section 6.4.
| |
| : 2. UFSAR, Section 6.5.1.
| |
| : 3. UFSAR, Section 9.4.1.
| |
| : 4. UFSAR, Chapter 6.
| |
| : 5. UFSAR, Chapter 15.
| |
| : 6. NEDC-32988-A, Revision 2, "Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants," December 2002.
| |
| : 7. ANSI/ASME N510-1989.
| |
| : 8. Regulatory Guide 1.196.
| |
| : 9. NEI 99-03, "Control Room Habitability Assessment,"
| |
| June 2001.
| |
| : 10. Letter from Eric J. Leeds (NRC) to James W. Davis (NEI) dated January 30, 2004, " NEI Draft White Paper, Use of Generic Letter 91-18 Process and Alternative Source Terms in the Context of Control Room Habitability," (ADAMS Accession No. ML040300694).
| |
| LaSalle 1 and 2 B 3.7.4-11 Revision 36
| |
| | |
| Control Room Area Ventilation AC System B 3.7.5 B 3.7 PLANT SYSTEMS B 3.7.5 Control Room Area Ventilation Air Conditioning (AC) System BASES BACKGROUND The Control Room Area Ventilation AC System provides temperature control for the control room area. The control room area is comprised of the control room and the Auxiliary Electric Equipment Rooms (AEERs).
| |
| The Control Room Area Ventilation AC System is comprised of two independent, redundant subsystems that provide cooling and heating of control room air and the auxiliary electric equipment rooms air. Each Control Room Area Ventilation AC subsystem consists of a Control Room AC subsystem and an AEER AC subsystem. The associated Control Room AC and AEER AC subsystems share a common outside air intake with a common emergency makeup air filter unit. The Control Room AC System is common to both units and serves the control room, main security control center, and the control room habitability storage room (toilet room). The AEER AC System is common to both units and services the AEERs.
| |
| Each Control Room Area Ventilation AC subsystem is powered from a Division 2 power source. One subsystem is powered from Unit 1 Division 2 and the other subsystem is powered from Unit 2 Division 2.
| |
| Each control room AC and AEER AC subsystem consists of a supply air filter, supply and return air fans, direct expansion cooling coils, an air-cooled condenser, a refrigerant compressor and receiver, heating coils, ductwork, dampers, and instrumentation and controls to provide temperature control for their respective areas.
| |
| However, the heating coils are not safety related.
| |
| The Control Room Area Ventilation AC System is designed to provide a controlled environment under both normal and accident conditions. A single control room area ventilation AC subsystem provides the required temperature control to maintain a suitable control room and AEER environment for a sustained occupancy of at least the required normal and emergency shift crew complements. The design conditions for (continued)
| |
| LaSalle 1 and 2 B 3.7.5-1 Revision 0
| |
| | |
| Control Room Area Ventilation AC System B 3.7.5 BASES BACKGROUND habitability of the control room and AEER environment are (continued) 65!F to 85!F and a maximum of 50% relative humidity. The Control Room Area Ventilation AC System operation in maintaining the temperatures of the control room and AEERs is discussed in the UFSAR, Sections 6.4 and 9.4.1 (Refs. 1 and 2, respectively).
| |
| APPLICABLE The design basis of the Control Room Area Ventilation AC SAFETY ANALYSES System is to maintain temperatures of the control room and AEERs for a 30 day period after a Design Basis Accident (DBA).
| |
| The Control Room Area Ventilation AC System components are arranged in redundant safety related subsystems. During emergency operation, the Control Room Area Ventilation AC System maintains a habitable environment and ensures the OPERABILITY of components in the control room and AEERs. A single active failure of a component of the Control Room Area Ventilation AC System, assuming a loss of offsite power, does not impair the ability of the system to perform its design function. Redundant detectors and controls are provided for control room and AEERs temperature control.
| |
| The Control Room Area Ventilation AC System is designed in accordance with Seismic Category I requirements, with exceptions described in UFSAR Section 9.4.1.1.1.1 (Ref. 3).
| |
| The Control Room Area Ventilation AC System is capable of removing sensible and latent heat loads from the control room and AEERs, including consideration of equipment heat loads and personnel occupancy requirements to ensure equipment OPERABILITY.
| |
| The Control Room Area Ventilation AC System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO Two independent and redundant subsystems of the Control Room Area Ventilation AC System are required to be OPERABLE to ensure that at least one subsystem is available, assuming a single failure disables the other subsystem. Total system failure could result in the equipment operating temperature exceeding limits.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.7.5-2 Revision 0
| |
| | |
| Control Room Area Ventilation AC System B 3.7.5 BASES LCO The Control Room Area Ventilation AC System is considered (continued) OPERABLE when the individual components necessary to maintain the control room and AEERs temperatures are OPERABLE in both subsystems. These components include the supply and return air fans, direct expansion cooling coils, an air-cooled condenser, a refrigerant compressor and receiver, ductwork, dampers, and instrumentation and controls.
| |
| APPLICABILITY In MODE 1, 2, or 3, the Control Room Area Ventilation AC System must be OPERABLE to ensure that the control room and AEERs temperatures will not exceed equipment OPERABILITY limits during operation of the Control Room Area Filtration (CRAF) System in the pressurization mode.
| |
| In MODES 4 and 5, the probability and consequences of a Design Basis Accident are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining the Control Room Area Ventilation AC System OPERABLE is not required in MODE 4 or 5, except during movement of irradiated fuel assemblies in the secondary containment and during CORE ALTERATIONS.
| |
| ACTIONS A.1 With one control room area ventilation AC subsystem inoperable, the inoperable control room area ventilation AC subsystem must be restored to OPERABLE status within 30 days. With the unit in this condition, the remaining OPERABLE control room area ventilation AC subsystem is adequate to perform the control room air conditioning function. However, the overall reliability is reduced because a single failure in the OPERABLE subsystem could result in loss of the control room area ventilation air conditioning function. The 30 day Completion Time is based (continued)
| |
| LaSalle 1 and 2 B 3.7.5-3 Revision 76
| |
| | |
| Control Room Area Ventilation AC System B 3.7.5 BASES ACTIONS A.1 (continued) on the low probability of an event occurring requiring operation of the CRAF System in the pressurization mode and the consideration that the remaining subsystem can provide the required protection.
| |
| B.1 and B.2 If both control room area ventilation AC subsystems are inoperable, the control room area ventilation AC system may not be capable of performing its intended function.
| |
| Therefore, the control room area temperature is required to be monitored to ensure that temperature is being maintained low enough that equipment in the control room area is not adversely affected. With the control room area temperature being maintained within the temperature limit, 72 hours is allowed to restore a control room area ventilation AC subsystem to OPERABLE status. The Completion Time is reasonable considering that the control room area temperature is being maintained within limits and the low probability of an event occurring requiring control room area isolation.
| |
| C.1 In MODE 1, 2, or 3, if the inoperable control room area ventilation AC subsystem(s) cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE that minimizes overall plant risk. To achieve this status the unit must be placed in at least MODE 3 within 12 hours. Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 4) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state.
| |
| The allowed Completion Time is reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.7.5-4 Revision 34
| |
| | |
| Control Room Area Ventilation AC System B 3.7.5 BASES ACTIONS D.1, D.2.1, and D.2.2 (continued)
| |
| LCO 3.0.3 is not applicable while in MODE 4 or 5. However, since irradiated fuel assembly movement can occur in MODE 1, 2, or 3, the Required Actions of Condition D are modified by a Note indicating that LCO 3.0.3 does not apply. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations.
| |
| Entering LCO 3.0.3 while in MODE 1, 2, or 3 would require the unit to be shutdown, but would not require immediate suspension of movement of irradiated fuel assemblies. The Note to the ACTIONS, "LCO 3.0.3 is not applicable," ensures that the actions for immediate suspension of irradiated fuel assembly movement are not postponed due to entry into LCO 3.0.3.
| |
| During movement of irradiated fuel assemblies in the secondary containment or during CORE ALTERATIONS, if Required Action A.1 cannot be completed within the required Completion Time, the OPERABLE control room AC subsystem may be placed immediately in operation.
| |
| This action ensures that the remaining subsystem is OPERABLE, that no failures that would prevent actuation will occur, and that any active failure will be readily detected.
| |
| An alternative to Required Action D.1 is to immediately suspend activities that present a potential for releasing radioactivity that might require isolation of the control room. This places the unit in a condition that minimizes risk.
| |
| If applicable, CORE ALTERATIONS and movement of irradiated fuel assemblies in the secondary containment must be suspended immediately. Suspension of these activities shall not preclude completion of movement of a component to a safe position.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.7.5-5 Revision 76
| |
| | |
| Control Room Area Ventilation AC System B 3.7.5 BASES ACTIONS E.1 and E.2 (continued)
| |
| The Required Actions of Condition E.1 are modified by a Note indicating that LCO 3.0.3 does not apply. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations.
| |
| Therefore, inability to suspend movement of irradiated fuel assemblies is not sufficient reason to require a reactor shutdown.
| |
| During movement of irradiated fuel assemblies in the secondary containment or during CORE ALTERATIONS, if Required Actions B.1 and B.2 cannot be met within the required Completion Times action must be taken to immediately suspend activities that present a potential for releasing radioactivity that might require isolation of the control room. This places the unit in a condition that minimizes risk.
| |
| If applicable, CORE ALTERATIONS and handling of irradiated fuel in the secondary containment must be suspended immediately. Suspension of these activities shall not preclude completion of movement of a component to a safe position.
| |
| SURVEILLANCE SR 3.7.5.1 REQUIREMENTS This SR monitors the control room and AEER temperatures for indication of Control Room Area Ventilation AC System performance. Trending of control room area temperature will provide a qualitative assessment of refrigeration unit OPERABILITY. Limiting the average temperature of the Control Room and AEER to less than or equal to 85!F provides a threshold beyond which the operating control room area ventilation AC subsystem is no longer demonstrating capability to perform its function. This threshold provides margin to temperature limits at which equipment qualification requirements could be challenged. Subsystem operation is routinely alternated to support planned maintenance and to ensure each subsystem provides reliable service. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.7.5-6 Revision 76
| |
| | |
| Control Room Area Ventilation AC System B 3.7.5 BASES SURVEILLANCE SR 3.7.5.2 REQUIREMENTS (continued) Verifying proper breaker alignment and power available to the control room area ventilation AC subsystems provides assurance of the availability of the system function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 6.4.
| |
| : 2. UFSAR, Section 9.4.1.
| |
| : 3. UFSAR, Section 9.4.1.1.1.1.
| |
| : 4. NEDC-32988-A, Revision 2, "Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants," December 2002.
| |
| LaSalle 1 and 2 B 3.7.5-7 Revision 51
| |
| | |
| Main Condenser Offgas B 3.7.6 B 3.7 PLANT SYSTEMS B 3.7.6 Main Condenser Offgas BASES BACKGROUND During unit operation, steam from the low pressure turbine is exhausted directly into the main condenser. Air and noncondensible gases are collected in the main condenser, then exhausted through the steam jet air ejectors (SJAEs) to the Main Condenser Offgas System. The offgas from the main condenser normally includes radioactive gases.
| |
| The Main Condenser Offgas System has been incorporated into the unit design to reduce the gaseous radwaste emission.
| |
| This system uses a catalytic recombiner to recombine radiolytically dissociated hydrogen and oxygen. The gaseous mixture is cooled by the offgas condenser; the water and condensibles are stripped out by the offgas condenser and water separator. The radioactivity of the remaining gaseous mixture (i.e., the offgas recombiner effluent) is monitored downstream of the water separator prior to entering the holdup line.
| |
| APPLICABLE The main condenser offgas gross gamma activity rate is an SAFETY ANALYSES initial condition of the Main Condenser Offgas System failure event as discussed in the UFSAR, Section 15.7.1.1 (Ref. 1). The analysis assumes a gross failure in the Main Condenser Offgas System that results in the rupture of the Main Condenser Offgas System pressure boundary. The gross gamma activity rate is controlled to ensure that during the event, the calculated offsite doses will be well within the limits of 10 CFR 100 (Ref. 2).
| |
| The main condenser offgas limits satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO To ensure compliance with the assumptions of the Main Condenser Offgas System failure event (Ref. 1), the fission product release rate should be consistent with a noble gas release to the reactor coolant of 100 Ci/Mwt-second after decay of 30 minutes. The LCO is conservatively established based on the safety analysis discussed in Reference 1.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.7.6-1 Revision 0
| |
| | |
| Main Condenser Offgas B 3.7.6 BASES (continued)
| |
| APPLICABILITY The LCO is applicable when steam is being exhausted to the main condenser and the resulting noncondensibles are being processed via the Main Condenser Offgas System. This occurs during MODE 1, and during MODES 2 and 3 with any main steam line not isolated and the SJAE in operation. In MODES 4 and 5, main steam is not being exhausted to the main condenser and the requirements are not applicable.
| |
| ACTIONS A.1 If the offgas radioactivity rate limit is exceeded, 72 hours is allowed to restore the gross gamma activity rate to within the limit. The 72 hour Completion Time is reasonable, based on engineering judgment considering the time required to complete the Required Action, the large margins associated with permissible dose and exposure limits, and the low probability of a Main Condenser Offgas System rupture occurring.
| |
| B.1, B.2 and B.3 If the gross gamma activity rate is not restored to within the limits within the associated Completion Time, all main steam lines or the SJAE must be isolated. This isolates the Main Condenser Offgas System from significant sources of radioactive steam. The main steam lines are considered isolated if at least one main steam isolation valve in each main steam line is closed, and at least one main steam line drain valve in each drain line is closed. The 12 hour Completion Time is reasonable, based on operating experience, to perform the actions from full power conditions in an orderly manner and without challenging unit systems.
| |
| An alternative to Required Actions B.1 and B.2 is to place the unit in a MODE in which the overall plant risk is minimized. To achieve this status, the unit must be placed in at least MODE 3 within 12 hours. Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 3) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to (continued)
| |
| LaSalle 1 and 2 B 3.7.6-2 Revision 32
| |
| | |
| Main Condenser Offgas B 3.7.6 BASES ACTIONS B.1, B.2 and B.3 (continued)
| |
| OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| SURVEILLANCE SR 3.7.6.1 REQUIREMENTS This SR requires an isotopic analysis of a representative offgas sample taken prior to the holdup line to ensure that the required limits are satisfied. The noble gases to be sampled are Xe-133, Xe-135, Xe-135m, Xe-138, Kr-85m, Kr-87, and Kr-88. If the measured rate of radioactivity increases significantly (by 50% after correcting for expected increases due to changes in THERMAL POWER), an isotopic analysis is also performed within 4 hours after the increase is noted (as indicated by the offgas pre-treatment noble gas activity monitor), to ensure that the increase is not indicative of a sustained increase in the radioactivity rate. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by a Note indicating that the SR is not required to be performed until 31 days after any main steam line is not isolated and the SJAE is in operation. Only in this condition can radioactive fission gases be in the Main Condenser Offgas System at significant rates.
| |
| REFERENCES 1. UFSAR, Section 15.7.1.
| |
| : 2. 10 CFR 100.
| |
| : 3. NEDC-32988-A, Revision 2, "Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants," December 2002.
| |
| LaSalle 1 and 2 B 3.7.6-3 Revision 51
| |
| | |
| Main Turbine Bypass System B 3.7.7 B 3.7 PLANT SYSTEMS B 3.7.7 Main Turbine Bypass System BASES BACKGROUND The Main Turbine Bypass System is designed to control steam pressure when reactor steam generation exceeds turbine requirements during unit startup, sudden load reduction, and cooldown. It allows excess steam flow from the reactor to the condenser without going through the turbine. The bypass capacity of the system is approximately 25% of the Nuclear Steam Supply System rated steam flow. Sudden load reductions within the capacity of the steam bypass can be accommodated without reactor scram. The Main Turbine Bypass System consists of five valves mounted on a valve manifold connected to the main steam lines between the main steam isolation valves and the main turbine stop valves. Each of these valves is sequentially operated by hydraulic cylinders. The bypass valves are controlled by the pressure regulation function of the Turbine Electro Hydraulic Control System, as discussed in the UFSAR, Section 7.7.5.2 (Ref. 1).
| |
| The bypass valves are normally closed, and the pressure regulator controls the turbine control valves, directing all steam flow to the turbine. If the speed governor or the load limiter restricts steam flow to the turbine, the pressure regulator controls the system pressure by opening the bypass valves. When the bypass valves open, the steam flows from the bypass valve outlet manifold, through connecting piping, to the pressure breakdown assemblies, where a series of orifices are used to further reduce the steam pressure before the steam enters the condenser (Ref. 2).
| |
| APPLICABLE The Main Turbine Bypass System is assumed to function during SAFETY ANALYSES the turbine trip, turbine generator load rejection, and feedwater controller failure maximum demand transients, described in the UFSAR, Sections 15.2.3, 15.2.2A, and 15.1.2A (Refs. 3, 4, and 5, respectively). Opening the bypass valves during the pressurization event mitigates the increase in reactor vessel pressure, which affects the MCPR during the event. An inoperable Main Turbine Bypass System may result in an MCPR penalty.
| |
| The Main Turbine Bypass System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii)
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.7.7-1 Revision 0
| |
| | |
| Main Turbine Bypass System B 3.7.7 BASES (continued)
| |
| LCO The Main Turbine Bypass System is required to be OPERABLE to limit peak pressure in the main steam lines and maintain reactor pressure within acceptable limits during events that cause rapid pressurization, such that the Safety Limit MCPR is not exceeded. With the Main Turbine Bypass System inoperable, modifications to the MCPR limits (LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)") may be applied to allow continued operation.
| |
| An OPERABLE Main Turbine Bypass System requires the bypass valves to open in response to increasing main steam line pressure or reactor dome pressure as selected by the operator. This response is within the assumptions of the applicable analysis (Refs. 3, 4, and 5). The MCPR limit for the inoperable Main Turbine Bypass System is specified in the COLR.
| |
| APPLICABILITY The Main Turbine Bypass System is required to be OPERABLE at 25% RTP to ensure that the fuel cladding integrity Safety Limit is not violated during the turbine trip, feedwater controller failure maximum demand, and turbine generator load rejection transients. As discussed in the Bases for LCO 3.2.2 sufficient margin to these limits exists
| |
| < 25% RTP. Therefore, these requirements are only necessary when operating at or above this power level.
| |
| ACTIONS A.1 If the Main Turbine Bypass System is inoperable (one or more bypass valves inoperable), and the MCPR limits for an inoperable Main Turbine Bypass System, as specified in the COLR, are not applied, the assumptions of the design basis transient analysis may not be met. Under such circumstances, prompt action should be taken to restore the Main Turbine Bypass System to OPERABLE status or adjust the MCPR limits accordingly. The 2 hour Completion Time is reasonable, based on the time to complete the Required Action and the low probability of an event occurring during this period requiring the Main Turbine Bypass System.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.7.7-2 Revision 37
| |
| | |
| Main Turbine Bypass System B 3.7.7 BASES ACTIONS B.1 (continued)
| |
| If the Main Turbine Bypass System cannot be restored to OPERABLE status and the MCPR limits for an inoperable Main Turbine Bypass System are not applied, THERMAL POWER must be reduced to < 25% RTP. As discussed in the Applicability section, operation at < 25% RTP results in sufficient margin to the required limits, and the Main Turbine Bypass System is not required to protect fuel integrity during the turbine trip, turbine generator load rejection, and feedwater controller failure maximum demand transients. The 4 hour Completion Time is reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
| |
| SURVEILLANCE SR 3.7.7.1 REQUIREMENTS Cycling each main turbine bypass valve through one complete cycle of full travel demonstrates that the valves are mechanically OPERABLE and will function when required. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.7.7.2 The Main Turbine Bypass System is required to actuate automatically to perform its design function. This SR demonstrates that, with the required simulated system initiation signals, the valves will actuate to their required position. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.7.7-3 Revision 51
| |
| | |
| Main Turbine Bypass System B 3.7.7 BASES SURVEILLANCE SR 3.7.7.3 REQUIREMENTS (continued) This SR ensures that the TURBINE BYPASS SYSTEM RESPONSE TIME, as defined in the transient analysis inputs for the cycle, is in compliance with the assumptions of the appropriate safety analyses. The response time limits are specified in the Technical Requirements Manual (Ref. 6).
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Section 7.7.5.2.
| |
| : 2. UFSAR, Section 10.4.4.
| |
| : 3. UFSAR, Section 15.2.3.
| |
| : 4. UFSAR, Section 15.2.2A.
| |
| : 5. UFSAR, Section 15.1.2A.
| |
| : 6. Technical Requirements Manual.
| |
| LaSalle 1 and 2 B 3.7.7-4 Revision 51
| |
| | |
| Spent Fuel Storage Pool Water Level B 3.7.8 B 3.7 PLANT SYSTEMS B 3.7.8 Spent Fuel Storage Pool Water Level BASES BACKGROUND The minimum water level in the spent fuel storage pool meets the assumptions of iodine decontamination factors following a fuel handling accident.
| |
| A general description of the spent fuel storage pool design is found in the UFSAR, Section 9.1.2 (Ref. 1). The assumptions of the fuel handling accident are found in the UFSAR, Sections 9.1.2 and 15.7.4 (Refs. 1 and 2, respectively).
| |
| APPLICABLE The water level above the irradiated fuel assemblies is an SAFETY ANALYSES explicit assumption of the fuel handling accident (Ref. 2).
| |
| A fuel handling accident is evaluated to ensure that the radiological consequences (calculated control room operator dose and doses at the exclusion area and low population zone boundaries) are below the 10 CFR 50.67 (Ref. 3) exposure guidelines, as modified by Regulatory Guide 1.183, Table 6.
| |
| A fuel handling accident could release a fraction of the fission product inventory by breaching the fuel rod cladding as discussed in the Regulatory Guide 1.183 (Ref. 4).
| |
| The fuel handling accident is evaluated for the dropping of an irradiated fuel assembly onto the reactor core. The consequences of a fuel handling accident over the spent fuel storage pool are less severe than those of the fuel handling accident over the reactor core (Ref. 2). The water level in the spent fuel storage pool provides for absorption of water soluble fission product gases and transport delays of soluble and insoluble gases that must pass through the water before being released to the secondary containment atmosphere. This absorption and transport delay reduces the potential radioactivity of the release during a fuel handling accident.
| |
| The spent fuel storage pool water level satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.7.8-1 Revision 48
| |
| | |
| Spent Fuel Storage Pool Water Level B 3.7.8 BASES (continued)
| |
| LCO The specified water level preserves the assumption of the fuel handling accident analysis (Ref. 2). As such, it is the minimum required for fuel movement within the spent fuel storage pool.
| |
| APPLICABILITY This LCO applies whenever movement of irradiated fuel assemblies occurs in the spent fuel storage pool or whenever movement of new fuel assemblies occurs in the spent fuel storage pool with irradiated fuel assemblies seated in the spent fuel storage pool, since the potential for a release of fission products exists.
| |
| ACTIONS A.1 Required Action A.1 is modified by a Note indicating that LCO 3.0.3 does not apply. If moving fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, inability to suspend movement of fuel assemblies is not a sufficient reason to require a reactor shutdown.
| |
| When the initial conditions for an accident cannot be met, steps should be taken to preclude the accident from occurring. With the spent fuel storage pool level less than required, the movement of fuel assemblies in the spent fuel storage pool is suspended immediately. Suspension of this activity shall not preclude completion of movement of a fuel assembly to a safe position. This effectively precludes a spent fuel handling accident from occurring.
| |
| SURVEILLANCE SR 3.7.8.1 REQUIREMENTS This SR verifies that sufficient water is available in the event of a fuel handling accident. The water level in the spent fuel storage pool must be checked periodically. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.7.8-2 Revision 51
| |
| | |
| Spent Fuel Storage Pool Water Level B 3.7.8 BASES (continued)
| |
| REFERENCES 1. UFSAR, Section 9.1.2.
| |
| : 2. UFSAR, Section 15.7.4.
| |
| : 3. 10 CFR 50.67.
| |
| : 4. Regulatory Guide 1.183, July 2000.
| |
| LaSalle 1 and 2 B 3.7.8-3 Revision 48
| |
| | |
| AC SourcesOperating B 3.8.1 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.1 AC SourcesOperating BASES BACKGROUND The unit Class 1E AC Electrical Power Distribution System AC sources consist of the offsite power sources and the onsite standby power sources (diesel generators (DGs)). As required by 10 CFR 50, Appendix A, GDC 17 (Ref. 1), the design of the AC electrical power system provides independence and redundancy to ensure an available source of power to the Engineered Safety Feature (ESF) systems.
| |
| The Class 1E AC distribution system supplies electrical power to three divisional load groups, Divisions 1, 2, and 3, with each division powered by an independent Class 1E 4.16 kV emergency bus (refer to LCO 3.8.7, "Distribution SystemsOperating"). The Division 2 emergency bus associated with each unit is shared by each unit since some systems are common to both units. The opposite unit Division 2 emergency bus supports equipment required to be OPERABLE by LCO 3.6.4.3, "Standby Gas Treatment (SGT)
| |
| System," LCO 3.7.4, "Control Room Area Filtration (CRAF)
| |
| System," and LCO 3.7.5, "Control Room Area Ventilation Air Conditioning (AC) System." Division 1 and 2 emergency buses have access to two offsite power supplies (one normal and one alternate). The alternate offsite power source is normally supplied via the opposite unit system auxiliary transformer (SAT) and the opposite unit circuit path. The alternate offsite circuit path includes the associated opposite unit's 4.16 kV emergency bus, unit tie breakers, and associated interconnecting bus to the given unit's 4.16 kV emergency bus. Division 3 load group has access to one offsite power supply (respective unit's SAT). Division 2 and 3 emergency buses on each unit have a dedicated onsite DG. The Division 1 emergency bus of both units share a common DG. The ESF systems of any two of the three divisions provide for the minimum safety functions necessary to shut down the unit and maintain it in a safe shutdown condition.
| |
| Offsite power is supplied to the switchyard from the transmission network. From the switchyard two electrically (continued)
| |
| LaSalle 1 and 2 B 3.8.1-1 Revision 19
| |
| | |
| AC SourcesOperating B 3.8.1 BASES BACKGROUND and physically separated circuits provide AC power to the (continued) unit onsite Class 1E 4.16 kV emergency buses. The unit SAT provides the normal source of offsite power to the respective unit's Division 1, 2, and 3 4.16 kV emergency buses. In the event of a loss of unit SAT, the Division 1 and 2 emergency buses fast transfer to the UAT (which is connected to the main generator output). The only exception to the fast transfer is that the UAT feed and bus tie breakers to the Division 1 and 2 emergency buses will not fast transfer for concurrent LOCA and loss of the SAT. This transfer is prevented with a LOCA signal present to ensure that the ESF loads are not subject to three start attempts in the case of a concurrent LOCA and loss of the SAT. The UAT is rated to carry all onsite power to the unit, but is not considered an offsite source unless it is being backfed with the main generator disconnect links removed. The Division 3 emergency bus has no second offsite power source, and will automatically be supplied by the Division 3 DG after the bus is deenergized. The Division 1 and 2 emergency buses can be manually transferred to the alternate offsite power source through the unit ties on a dead bus transfer or on a live bus transfer if the DG is supplying power to the bus. The offsite AC electrical power sources are designed and located so as to minimize to the extent practical the likelihood of their simultaneous failure under operating and postulated accident and environmental conditions. A detailed description of the offsite power network and circuits to the onsite Class 1E 4.16 kV emergency buses is found in UFSAR, Chapter 8 (Ref. 2).
| |
| A qualified offsite circuit consists of all breakers, transformers, switches, interrupting devices, cabling, and controls required to transmit power from the offsite transmission network to the onsite Class 1E emergency buses.
| |
| Onsite standby power is provided by a total of five DGs for both units. The onsite standby power source for each Division 2 and 3 4.16 kV emergency bus on each unit is a dedicated DG. (DGs 1A and 1B for Unit 1 and DGs 2A and 2B for Unit 2). The onsite standby power source for the Division 1 emergency bus on each unit is a common DG (DG 0).
| |
| Each DG will start on emergency bus degraded voltage or undervoltage from its associated 4.16 kV emergency bus (refer to LCO 3.3.8.1, "Loss of Power (LOP)
| |
| Instrumentation"). The Division 2 and 3 DGs will start on an Emergency Core Cooling System (ECCS) actuation signal (continued)
| |
| LaSalle 1 and 2 B 3.8.1-2 Revision 67
| |
| | |
| AC SourcesOperating B 3.8.1 BASES BACKGROUND (reactor vessel low water level or high drywell pressure)
| |
| (continued) from the respective unit. The Division 1 DG (common DG) will start on an ECCS actuation signal (reactor vessel low water level or high drywell pressure) from either unit.
| |
| Although the DGs start on an ECCS actuation signal from the respective unit, the DGs are not connected to the 4.16 kV emergency bus unless an undervoltage condition occurs on the bus.
| |
| In the event of a loss of offsite power, the ESF electrical loads are automatically connected to the DGs, as required, in sufficient time to provide for safe reactor shutdown and to mitigate the consequences of a Design Basis Accident (DBA) such as a loss of coolant accident (LOCA).
| |
| If an undervoltage condition occurs on a Division 1 or 2 emergency bus, the associated DG starts, bus loads are shed, the DG will automatically connect to the emergency bus, and loads necessary for safe shutdown of the unit are connected automatically or manually. If an ECCS actuation signal is present concurrent with an undervoltage condition on the Division 1 or 2 emergency bus, the associated DG starts, bus loads are shed as required, the DG will automatically connect to the emergency bus, and the required ESF loads are automatically connected. Sequencing of Division 1 and 2 emergency loads is accomplished by time delay relays so that overloading of the DG is prevented. The Division 3 emergency bus has no shedding or sequencing.
| |
| The DGs satisfy the following Regulatory Guide 1.9 (Ref. 3) ratings:
| |
| : a. 2600 kW - continuous;
| |
| : b. 2860 kW - 2000 hour;
| |
| : c. 2987 kW - 7 day;
| |
| : d. 2860 kW - 2 hours in any 24 hour period (10%
| |
| overload); and
| |
| : e. 3040 kW - 30 minute.
| |
| LaSalle 1 and 2 B 3.8.1-3 Revision 0
| |
| | |
| AC SourcesOperating B 3.8.1 BASES (continued)
| |
| APPLICABLE The initial conditions of DBA and transient analyses in the SAFETY ANALYSES UFSAR, Chapter 6 (Ref. 4) and Chapter 15 (Ref. 5), assume ESF systems are OPERABLE. The AC electrical power sources are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor Coolant System (RCS), and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution Limits; Section 3.5, Emergency Core Cooling System (ECCS) and Reactor Core Isolation Cooling (RCIC) System; and Section 3.6, Containment Systems.
| |
| The OPERABILITY of the AC electrical power sources is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit. This includes maintaining the onsite or offsite AC sources OPERABLE during accident conditions in the event of:
| |
| : a. An assumed loss of all offsite power or all onsite AC power; and
| |
| : b. A worst case single failure.
| |
| AC sources satisfy the requirements of Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO Two qualified circuits (normal and alternate) between the offsite transmission network and the onsite Class 1E Distribution System, three separate and independent unit DGs, and the opposite unit's DG capable of supporting the opposite unit Division 2 onsite Class 1E AC electrical power distribution subsystem to power the equipment required to be OPERABLE by LCO 3.6.4.3, LCO 3.7.4, and LCO 3.7.5 ensure availability of the required power to shut down the reactor and maintain it in a safe shutdown condition after an anticipated operational occurrence (AOO) or a postulated DBA. A specific LCO requirement for a qualified circuit to provide power to the opposite unit Division 2 4.16 kV emergency bus is not provided since the alternate qualified circuit to the units Division 2 4.16 kV emergency bus encompasses the circuit path to the opposite unit Division 2 4.16 kV emergency bus.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.1-4 Revision 57
| |
| | |
| AC SourcesOperating B 3.8.1 BASES LCO Qualified offsite circuits are those that are described in (continued) the UFSAR and are part of the licensing basis for the unit.
| |
| Each offsite circuit must be capable of maintaining rated frequency and voltage, and accepting required loads during an accident, while connected to the emergency buses. For the normal offsite circuit, the OPERABLE qualified offsite circuit consists of the required incoming breaker(s) and disconnects from the 345 kV switchyard to and including the SAT, the respective circuit path to and including the feeder breakers to the required unit Division 1, 2, and 3 4.16 kV emergency buses.
| |
| For the alternate offsite circuit, the OPERABLE qualified offsite circuit consists of the required incoming breaker(s) and disconnects from the 345 kV switchyard to and including the SAT or UAT (backfeed mode), to and including the opposite unit 4.16 kV emergency bus, the opposite unit circuit path to and including the unit tie breakers (breakers 1414, 1424, 2414, 2424), and the respective circuit path to the required Division 1 and 2 4.16 kV emergency buses.
| |
| Each unit DG must be capable of starting, accelerating to rated speed and voltage, and connecting to its respective ESF bus on detection of bus undervoltage. This sequence must be accomplished within 13 seconds. Each DG must also be capable of accepting required loads within the assumed loading sequence intervals, and must continue to operate until offsite power can be restored to the 4.16 kV emergency buses. These capabilities are required to be met from a variety of initial conditions such as DG in standby with engine hot and DG in standby with engine at ambient conditions. Additional DG capabilities must be demonstrated to meet required Surveillances, e.g., capability of the Division 1 and 2 DGs to revert to standby status on an ECCS signal while operating in parallel test mode. Proper sequencing of loads, including tripping of nonessential loads, is a required function for DG OPERABILITY.
| |
| The opposite unit's DG must be capable of starting, accelerating to rated speed and voltage, and connecting to the opposite unit's Division 2 Class 1E AC electrical power distribution subsystem on detection of bus undervoltage.
| |
| This sequence must be accomplished within 13 seconds and is required to be met from the same variety of initial conditions specified for the unit DGs.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.1-5 Revision 0
| |
| | |
| AC SourcesOperating B 3.8.1 BASES LCO In addition, day tank storage and fuel oil transfer system (continued) requirements must be met for each required DG.
| |
| The AC sources in one division must be separate and independent (to the extent possible) of the AC sources in the other division(s). For the DGs, the separation and independence are complete. For the offsite AC sources, the separation and independence are to the extent practical. A qualified circuit may be connected to all divisions of either unit, with manual transfer capability to the other circuit OPERABLE, and not violate separation criteria. A qualified circuit that is not connected to the 4.16 kV emergency buses is required to have OPERABLE manual transfer capability (from the control room) to the associated 4.16 kV emergency buses to support OPERABILITY of that qualified circuit.
| |
| APPLICABILITY The AC sources are required to be OPERABLE in MODES 1, 2, and 3 to ensure that:
| |
| : a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients; and
| |
| : b. Adequate core cooling is provided and containment OPERABILITY and other vital functions are maintained in the event of a postulated DBA.
| |
| Note 1 has been added taking exception to the Applicability requirements for Division 3 sources, provided the High Pressure Core Spray (HPCS) System is declared inoperable.
| |
| This exception is intended to allow declaring of the Division 3 inoperable either in lieu of declaring the Division 3 source inoperable, or at any time subsequent to entering ACTIONS for an inoperable Division 3 source. This exception is acceptable since, with the Division 3 inoperable and the associated ACTIONS entered, the Division 3 AC sources provide no additional assurance of meeting the above criteria. In addition, when this Note allowance is being used, both AC sources could be inoperable such that the Division 3 AC distribution subsystem is de-energized. In this case (the Division 3 AC electrical power distribution subsystem inoperable), LCO 3.0.6 would not preclude entry into the Distribution System ACTIONS since, with the Division 3 AC sources not required OPERABLE as (continued)
| |
| LaSalle 1 and 2 B 3.8.1-6 Revision 0
| |
| | |
| AC SourcesOperating B 3.8.1 BASES APPLICABILITY allowed by this Note, the Division 3 AC sources cannot be (continued) considered as a support system to the Division 3 AC distribution subsystem. Thus, as required by LCO 3.0.2, the Distribution System-Operating ACTIONS for the inoperable Division 3 AC electrical power distribution subsystem must be entered.
| |
| Note 2 has been added taking exception to the Applicability requirements for the required opposite unit's Division 2 DG in LCO 3.8.1.c, provided the associated required equipment is inoperable (i.e., one SGT subsystem, one control room area filtration subsystem, and one control room area ventilation air conditioning subsystem). This exception is intended to allow declaring the opposite unit's Division 2 supported equipment inoperable either in lieu of declaring the opposite unit's Division 2 DG inoperable, or at any time subsequent to entering ACTIONS for an inoperable opposite unit Division 2 DG. This exception is acceptable since, with the opposite unit powered Division 2 equipment inoperable and the associated ACTIONS entered, the opposite unit Division 2 DG provides no additional assurance of meeting the above criteria.
| |
| AC power requirements for MODES 4 and 5 and other conditions in which AC sources are required are covered in LCO 3.8.2, "AC SourcesShutdown."
| |
| ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable DG. There is an increased risk associated with entering a MODE or other specified condition in the Applicability with an inoperable DG and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in in this circumstance.
| |
| A.1 To ensure a highly reliable power source remains, it is necessary to verify the availability of the remaining required offsite circuits on a more frequent basis. Since (continued)
| |
| LaSalle 1 and 2 B 3.8.1-7 Revision 19
| |
| | |
| AC SourcesOperating B 3.8.1 BASES ACTIONS A.1 (continued) the Required Action only specifies "perform," a failure of SR 3.8.1.1 acceptance criteria does not result in the Required Action not met. However, if a second required circuit fails SR 3.8.1.1, the second offsite circuit is inoperable, and Condition D, for two required offsite circuits inoperable, is entered.
| |
| A.2 Required Action A.2, which only applies if the division cannot be powered from an offsite source, is intended to provide assurance that an event with a coincident single failure of the associated DG does not result in a complete loss of safety function of critical systems. These features are designed with redundant safety related divisions (i.e.,
| |
| single division systems are not included, although, for this Required Action, Division 3 (HPCS System) is considered redundant to Division 1 and 2 ECCS). Redundant required features failures consist of inoperable features associated with a division redundant to the division that has no offsite power available.
| |
| The Completion Time for Required Action A.2 is intended to allow time for the operator to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." In this Required Action, the Completion Time only begins on discovery that both:
| |
| : a. The division has no offsite power available to supply its loads; and
| |
| : b. A redundant required feature on another division is inoperable.
| |
| If, at any time during the existence of this Condition (one required offsite circuit inoperable), a redundant required feature subsequently becomes inoperable, this Completion Time begins to be tracked.
| |
| Discovering no offsite power available to one division of the onsite Class 1E Power Distribution System coincident with one or more inoperable redundant required support or (continued)
| |
| LaSalle 1 and 2 B 3.8.1-8 Revision 19
| |
| | |
| AC SourcesOperating B 3.8.1 BASES ACTIONS A.2 (continued) supported features, or both, that are associated with the other division that has offsite power, results in starting the Completion Time for the Required Action.
| |
| Twenty-four hours is acceptable because it minimizes risk while allowing time for restoration before the unit is subjected to transients associated with shutdown.
| |
| The remaining OPERABLE offsite circuit and DGs are adequate to supply electrical power to the onsite Class 1E Distribution System. Thus, on a component basis, single failure protection may have been lost for the required feature's function; however, function is not lost. The 24 hour Completion Time takes into account the component OPERABILITY of the redundant counterpart to the inoperable required feature. Additionally, the 24 hour Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.
| |
| A.3 According to Regulatory Guide 1.93 (Ref. 6), operation may continue in Condition A for a period that should not exceed 72 hours.
| |
| With one required offsite circuit inoperable, the reliability of the offsite system is degraded, and the potential for a loss of offsite power is increased, with attendant potential for a challenge to the plant safety systems. In this condition, however, the remaining OPERABLE offsite circuit and DGs are adequate to supply electrical power to the onsite Class 1E distribution system.
| |
| The Completion Time takes into account the capacity and capability of the remaining AC sources, reasonable time for repairs, and the low probability of a DBA occurring during this period. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.1-9 Revision 89
| |
| | |
| AC SourcesOperating B 3.8.1 BASES ACTIONS B.1 To ensure a highly reliable power source remains, it is necessary to verify the availability of the remaining required offsite circuit on a more frequent basis. Since the Required Action only specifies "perform," a failure of SR 3.8.1.1 acceptance criteria does not result in a Required Action being not met. However, if a circuit fails to pass SR 3.8.1.1, it is inoperable. Upon offsite circuit inoperability, additional Conditions must then be entered.
| |
| B.2 Required Action B.2 is intended to provide assurance that a loss of offsite power, during the period that the DG is inoperable as described in Condition B, does not result in a complete loss of safety function of critical systems. These features are designed with redundant safety related divisions (i.e., single division systems are not included, although, for this Required Action, Division 3 (HPCS System)
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.1-10 Revision 81
| |
| | |
| AC SourcesOperating B 3.8.1 BASES ACTIONS B.2 (continued) is considered redundant to Division 1 and 2 ECCS).
| |
| Redundant required features failures consist of inoperable features associated with a division redundant to the division that has an inoperable DG.
| |
| The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."
| |
| In this Required Action, the Completion Time only begins on discovery that both:
| |
| : a. An inoperable DG exists; and
| |
| : b. A redundant required feature on another division is inoperable.
| |
| If, at any time during the existence of this Condition (DG inoperable as described in Condition B), a redundant required feature subsequently becomes inoperable, this Completion Time begins to be tracked.
| |
| Discovering required DG(s) inoperable coincident with one or more redundant required support or supported features, or both, that are associated with the redundant OPERABLE DG(s),
| |
| results in starting the Completion Time for the Required Action. Four hours from the discovery of these events existing concurrently is acceptable because it minimizes risk while allowing time for restoration before subjecting the unit to transients associated with shutdown.
| |
| The remaining OPERABLE DGs and offsite circuits are adequate to supply electrical power to the onsite Class 1E Distribution System. Thus, on a component basis, single failure protection for the required feature's function may have been lost; however, function has not been lost. The 4 hour Completion Time takes into account the component OPERABILITY of the redundant counterpart to the inoperable required feature. Additionally, the 4 hour Completion Time takes into account the capacity and capability of the remaining AC sources, reasonable time for repairs, and low probability of a DBA occurring during this period.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.1-11 Revision 19
| |
| | |
| AC SourcesOperating B 3.8.1 BASES ACTIONS B.3.1 and B.3.2 (continued)
| |
| Required Action B.3.1 provides an allowance to avoid unnecessary testing of OPERABLE DGs. If it can be determined that the cause of the inoperable DG(s) does not exist on the OPERABLE DG(s), SR 3.8.1.2 does not have to be performed. If the cause of inoperability exists on other DGs, the other DGs are declared inoperable upon discovery, and Condition F, G or I of LCO 3.8.1 is entered, as applicable.
| |
| Once the failure is repaired, and the common cause failure no longer exists, Required Action B.3.1 is satisfied. If the cause of the initial inoperable DG cannot be confirmed not to exist on the remaining DG(s), performance of SR 3.8.1.2 suffices to provide assurance of continued OPERABILITY of those DG(s). In the event the inoperable DG(s) is restored to OPERABLE status prior to completing either B.3.1 or B.3.2, the station corrective action program will continue to evaluate the common cause possibility.
| |
| This continued evaluation, however, is no longer under the 24 hour constraint imposed while in Condition B.
| |
| If while a DG is inoperable, a new problem with the DG is discovered that would have prevented the DG from performing its specified safety function, a separate entry into Condition B is not required. The new DG problem should be addressed in accordance with the station corrective action program.
| |
| According to Generic Letter 84-15 (Ref. 7), 24 hours is reasonable time to confirm that the OPERABLE DG(s) are not affected by the same problem as the inoperable DG.
| |
| B.4 In this condition, the remaining OPERABLE DGs and offsite circuits are adequate to supply electrical power to the onsite Class 1E distribution system. The 14 day Completion Time takes into account the capacity and capability of the remaining AC sources, reasonable time for repairs, and low probability of a DBA occurring during this period.
| |
| Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.1-12 Revision 89
| |
| | |
| AC SourcesOperating B 3.8.1 BASES ACTIONS Condition C Condition C is modified by a Note indicating that this Condition is not applicable to the Division 2 DG and the opposite unit Division 2 DG during installation of Division 2 CSCS isolation valves during a single Unit 1 refueling outage completed prior to July 1, 2024, and during a single Unit 2 refueling outage completed prior to July 1, 2023, while the outage unit is in MODE 4, 5, or defueled. For Unit 1, the one-time use of this Note will occur during Refueling Outage 18, 19, or 20. For Unit 2, the one-time use of this Note will occur during Refueling Outage 17, 18, or 19. When the Division 2 DGs are inoperable during the CSCS isolation valve maintenance, Conditions B and G provide appropriate Required Actions.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.1-13 Revision 81
| |
| | |
| AC SourcesOperating B 3.8.1 BASES ACTIONS C.1 (continued)
| |
| To ensure a highly reliable power source remains, it is necessary to verify the availability of the remaining required offsite circuit on a more frequent basis. Since the Required Action only specifies "perform," a failure of SR 3.8.1.1 acceptance criteria does not result in a Required Action being not met. However, if a circuit fails to pass SR 3.8.1.1, it is inoperable. Upon offsite circuit inoperability, additional Conditions must then be entered.
| |
| C.2 Required Action C.2 is intended to provide assurance that a loss of offsite power, during the period that the DG(s) is inoperable as described in Condition C, does not result in a complete loss of safety function of critical systems. These features are designed with redundant safety related divisions (i.e., single division systems are not included, although, for this Required Action, Division 3 (HPCS System) is considered redundant to Division 1 and 2 ECCS).
| |
| Redundant required features failures consist of inoperable features associated with a division redundant to the division that has an inoperable DG.
| |
| The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."
| |
| In this Required Action, the Completion Time only begins on discovery that both:
| |
| : a. An inoperable DG exists; and
| |
| : b. A redundant required feature on another division is inoperable.
| |
| If, at any time during the existence of this Condition (DG(s) inoperable as described in Condition C), a redundant required feature subsequently becomes inoperable, this Completion Time begins to be tracked.
| |
| Discovering required DG(s) inoperable coincident with one or more redundant required support or supported features, or both, that are associated with the redundant OPERABLE DG(s),
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.1-14 Revision 76
| |
| | |
| AC SourcesOperating B 3.8.1 BASES ACTIONS C.2 (continued) results in starting the Completion Time for the Required Action. Four hours from the discovery of these events existing concurrently is acceptable because it minimizes risk while allowing time for restoration before subjecting the unit to transients associated with shutdown.
| |
| The remaining OPERABLE DGs and offsite circuits are adequate to supply electrical power to the onsite Class 1E Distribution System. Thus, on a component basis, single failure protection for the required feature's function may have been lost; however, function has not been lost. The 4 hour Completion Time takes into account the component OPERABILITY of the redundant counterpart to the inoperable required feature. Additionally, the 4 hour Completion Time takes into account the capacity and capability of the remaining AC sources, reasonable time for repairs, and low probability of a DBA occurring during this period.
| |
| C.3.1 and C.3.2 Required Action C.3.1 provides an allowance to avoid unnecessary testing of OPERABLE DGs. If it can be determined that the cause of the inoperable DG(s) does not exist on the OPERABLE DG(s), SR 3.8.1.2 does not have to be performed. If the cause of inoperability exists on other DGs, the other DGs are declared inoperable upon discovery, and Condition F or I of LCO 3.8.1 is entered, as applicable.
| |
| Once the failure is repaired, and the common cause failure no longer exists, Required Action C.3.1 is satisfied. If the cause of the initial inoperable DG cannot be confirmed not to exist on the remaining DG(s), performance of SR 3.8.1.2 suffices to provide assurance of continued OPERABILITY of those DG(s).
| |
| In the event the inoperable DG(s) is restored to OPERABLE status prior to completing either C.3.1 or C.3.2, the station corrective action program will continue to evaluate the common cause possibility. This continued evaluation, however, is no longer under the 24 hour constraint imposed while in Condition C.
| |
| According to Generic Letter 84-15 (Ref. 7), 24 hours is reasonable time to confirm that the OPERABLE DG(s) are not (continued)
| |
| LaSalle 1 and 2 B 3.8.1-15 Revision 76
| |
| | |
| AC SourcesOperating B 3.8.1 BASES ACTIONS C.3.1 and C.3.2 (continued) affected by the same problem as the inoperable DG.
| |
| C.4 According to Regulatory Guide 1.93 (Ref. 6), operation may continue in Condition C for a period that should not exceed 72 hours. In this condition, the remaining OPERABLE DGs and offsite circuits are adequate to supply electrical power to the onsite Class 1E distribution system. The 72 hour Completion Time takes into account the capacity and capability of the remaining AC sources, reasonable time for repairs, and low probability of a DBA occurring during this period. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. This Completion Time is modified by a Note to clarify that the Risk Informed Completion Time Program is not applicable to a Required Action associated with a Condition that represents a loss of safety function.
| |
| D.1 and D.2 Required Action D.1 addresses actions to be taken in the event of concurrent failure of redundant required features.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.1-16 Revision 89
| |
| | |
| AC SourcesOperating B 3.8.1 BASES ACTIONS D.1 and D.2 (continued)
| |
| Required Action D.1 reduces the vulnerability to a loss of function. The Completion Time for taking these actions is reduced to 12 hours from that allowed with only one division without offsite power (Required Action A.2). The rationale for the reduction to 12 hours is that Regulatory Guide 1.93 (Ref. 6) allows a Completion Time of 24 hours for two required offsite circuits inoperable, based upon the assumption that two complete safety divisions are OPERABLE.
| |
| When a concurrent redundant required feature failure exists, this assumption is not the case, and a shorter Completion Time of 12 hours is appropriate. These features are designed with redundant safety related divisions (i.e.,
| |
| single division systems are not included in the list, although, for this Required Action, Division 3 (HPCS System) is considered redundant to Division 1 and 2 ECCS).
| |
| Redundant required features failures consist of any of these features that are inoperable, because any inoperability is on a division redundant to a division with inoperable offsite circuits.
| |
| The Completion Time for Required Action D.1 is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." In this Required Action, the Completion Time only begins on discovery that both:
| |
| : a. Two required offsite circuits are inoperable; and
| |
| : b. A redundant required feature is inoperable.
| |
| If, at any time during the existence of this Condition (two offsite circuits inoperable), a redundant required feature subsequently becomes inoperable, this Completion Time begins to be tracked.
| |
| According to Regulatory Guide 1.93 (Ref. 6), operation may continue in Condition D for a period that should not exceed 24 hours. This level of degradation means that the offsite electrical power system may not have the capability to effect a safe shutdown and to mitigate the effects of an accident; however, the onsite AC sources have not been degraded. This level of degradation generally corresponds (continued)
| |
| LaSalle 1 and 2 B 3.8.1-17 Revision 76
| |
| | |
| AC SourcesOperating B 3.8.1 BASES ACTIONS D.1 and D.2 (continued) to a total loss of the immediately accessible offsite power sources.
| |
| Because of the normally high availability of the offsite sources, this level of degradation may appear to be more severe than other combinations of two AC sources inoperable that involve one or more DGs inoperable. However, two factors tend to decrease the severity of this degradation level:
| |
| : a. The configuration of the redundant AC electrical power system that remains available is not susceptible to a single bus or switching failure; and
| |
| : b. The time required to detect and restore an unavailable offsite power source is generally much less than that required to detect and restore an unavailable onsite AC source.
| |
| With two of the required offsite circuits inoperable, sufficient onsite AC sources are available to maintain the unit in a safe shutdown condition in the event of a DBA or transient. In fact, a simultaneous loss of offsite AC sources, a LOCA, and a worst case single failure were postulated as a part of the design basis in the safety analysis. Thus, the 24 hour Completion Time provides a period of time to effect restoration of one of the offsite circuits commensurate with the importance of maintaining an AC electrical power system capable of meeting its design criteria. According to Regulatory Guide 1.93 (Ref. 6), with the available offsite AC sources two less than required by the LCO, operation may continue for 24 hours. If two offsite sources are restored within 24 hours, unrestricted operation may continue. If only one offsite source is restored within 24 hours, power operation continues in accordance with Condition A. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.
| |
| E.1 and E.2 Pursuant to LCO 3.0.6, the Distribution System ACTIONS would not be entered even if all AC sources to it were inoperable, resulting in de-energization. Therefore, the (continued)
| |
| LaSalle 1 and 2 B 3.8.1-18 Revision 89
| |
| | |
| AC SourcesOperating B 3.8.1 BASES ACTIONS E.1 and E.2 (continued)
| |
| Required Actions of Condition E are modified by a Note to indicate that when Condition E is entered with no AC source to any required division (i.e., the division is de-energized), Actions for LCO 3.8.7, "Distribution Systems Operating," must be immediately entered. This allows Condition E to provide requirements for the loss of an offsite circuit and one required unit DG without regard to whether a division is de-energized. LCO 3.8.7 provides the appropriate restrictions for a de-energized division.
| |
| According to Regulatory Guide 1.93 (Ref. 6), operation may continue in Condition E for a period that should not exceed 12 hours. In Condition E, individual redundancy is lost in both the offsite electrical power system and the onsite AC electrical power system. Since power system redundancy is provided by two diverse sources of power, however, the reliability of the power systems in this Condition may appear higher than that in Condition D (loss of both required offsite circuits). This difference in reliability is offset by the susceptibility of this power system configuration to a single bus or switching failure. The 12 hour Completion Time takes into account the capacity and capability of the remaining AC sources, reasonable time for repairs, and low probability of a DBA occurring during this period. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.
| |
| Condition F Condition F is modified by a Note indicating that this Condition is not applicable during installation of Division 2 CSCS isolation valves during a single Unit 1 Refueling Outage completed prior to July 1, 2024, and during a single Unit 2 Refueling Outage completed prior to July 1, 2023, while the outage Unit is in MODE 4, 5, or defueled. For Unit 1, the one-time use of this Note will occur during Refueling Outage 18, 19, or 20. For Unit 2, the one-time use of this Note will occur during Refueling Outage 17, 18, or 19. When the Division 2 DGs are inoperable during the CSCS isolation valve maintenance, Conditions B and G provide appropriate Required Actions.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.1-19 Revision 89
| |
| | |
| AC SourcesOperating B 3.8.1 BASES ACTIONS F.1 (continued)
| |
| With two required unit DGs inoperable or both required Division 2 DGs inoperable, there is no more than two remaining standby AC sources. Thus, with an assumed loss of offsite electrical power, sufficient standby AC sources may not be available to power the minimum required ESF functions. Since the offsite electrical power system is the only source of AC power for the majority of ESF equipment at this level of degradation, the risk associated with continued operation for a very short time could be less than that associated with an immediate controlled shutdown (the immediate shutdown could cause grid instability, which could result in a total loss of AC power). Since any inadvertent generator trip could also result in a total loss of offsite AC power, however, the time allowed for continued operation is severely restricted. The intent here is to avoid the risk associated with an immediate controlled shutdown and to minimize the risk associated with this level of degradation.
| |
| According to Regulatory Guide 1.93 (Ref. 6), with Division 1 and 2 unit DGs inoperable, operation may continue for a period that should not exceed 2 hours. This Completion Time assumes complete loss of onsite (DG) AC capability to power the minimum loads needed to respond to analyzed events.
| |
| In the event the unit Division 3 DG in conjunction with a unit Division 1 or 2 DG is inoperable, with a unit Division 1 or 2 DG remaining, a significant spectrum of breaks would be capable of being responded to with onsite power. Even the worst case event would be mitigated to some extent-an extent greater than a typical two division design in which this condition represents a complete loss of function.
| |
| Given the remaining function, a 72 hour Completion Time is appropriate. At the end of this 72 hour period, the unit Division 3 system (HPCS System) could be declared inoperable (See Applicability Note 1) and this Condition could be exited with only one remaining required unit DG inoperable.
| |
| However, with a unit Division 1 or 2 DG remaining inoperable and the HPCS System declared inoperable, a redundant required feature failure exists, according to Required Action B.3 or C.2.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.1-20 Revision 89
| |
| | |
| AC SourcesOperating B 3.8.1 BASES ACTIONS F.1 (continued)
| |
| In the event the required opposite unit Division 2 DG is inoperable in conjunction with a unit Division 2 DG inoperable, the opposite unit Division 2 subsystems (e.g.,
| |
| SGT subsystem) could be declared inoperable at the end of the 2 hour Completion Time (see Applicability Note 2) and this Condition could be exited with only one required unit DG remaining inoperable. However, with the given unit Division 2 DG remaining inoperable and the opposite unit Division 2 subsystems declared inoperable, redundant required feature failures exist, according to Required Action C.2.
| |
| Condition G Condition G is modified by a Note indicating that this Condition is only applicable during installation of Division 2 CSCS isolation valves during a single Unit 1 refueling outage completed prior to July 1, 2024, and during a single Unit 2 refueling outage completed prior to July 1, 2023, while the outage unit is in MODE 4, 5, or defueled. For Unit 1, the one-time use of this Note will occur during Refueling Outage 18, 19, or 20. For Unit 2, the one-time use of this Note will occur during Refueling Outage 17, 18, or 19.
| |
| G.1 With both required Division 2 DGs inoperable, there are no more than two remaining OPERABLE standby AC sources. Thus, with an assumed loss of offsite electrical power, sufficient standby AC sources may not be available to power the minimum required Division 2 ESF functions. Since the offsite electrical power system is the only source of AC power for the Division 2 ESF equipment at this level of degradation, the risk associated with continued operation during the Division 2 CSCS valve replacement maintenance must be mitigated by the use of mechanical line stops to maintain the availability of the Division 2 CSCS system for the online Unit. The line stops are designed to the same or greater pressure rating and seismic design as the CSCS piping. At least one required Division 2 DG must be (continued)
| |
| LaSalle 1 and 2 B 3.8.1-21 Revision 89
| |
| | |
| AC SourcesOperating B 3.8.1 BASES ACTIONS G.1 (continued) restored to OPERABLE status within 7 days of entry into Condition G.
| |
| If at least one Division 2 DG is not maintained available while in this Condition, Condition H should be entered immediately.
| |
| If, at any time when in this Condition (both required Division 2 DGs inoperable), an additional required DG subsequently becomes inoperable, Condition I should be entered immediately.
| |
| H.1 If the inoperable AC electrical power sources cannot be restored to OPERABLE status within the associated Completion Time, the unit must be brought to a MODE in which the overall plant risk is minimized. To achieve this status, the unit must be brought to MODE 3 within 12 hours.
| |
| Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 11) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short.
| |
| However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
| |
| I.1 Condition I corresponds to a level of degredation in which all redundancy in the AC electrical power supplies has been lost. At this severely degraded level, any further losses in the AC electrical power system will cause a loss of function. Therefore, no additional time is justified for continued operation. The unit is required by LCO 3.0.3 to commence a controlled shutdown.
| |
| SURVEILLANCE The AC sources are designed to permit inspection and REQUIREMENTS testing of all important areas and features, especially (continued)
| |
| LaSalle 1 and 2 B 3.8.1-22 Revision 89
| |
| | |
| AC SourcesOperating B 3.8.1 BASES SURVEILLANCE those that have a standby function, in accordance with REQUIREMENTS 10 CFR 50, GDC 18 (Ref. 8). Periodic component tests are (continued) supplemented by extensive functional tests during refueling outages under simulated accident conditions. The SRs for demonstrating the OPERABILITY of the DGs are consistent with the recommendations of Regulatory Guide 1.9 (Ref. 3) and Regulatory Guide 1.137 (Ref. 9).
| |
| The Surveillances are modified by two Notes to clearly identify how the Surveillances apply to the given unit and opposite unit's Division 2 DGs. Note 1 states that SR 3.8.1.1 through SR 3.8.1.20 are applicable only to the given unit AC electrical power sources and Note 2 states that SR 3.8.1.21 is applicable to the opposite unit's Division 2 DG. These Notes are necessary since the opposite unit AC electrical power source is not required to meet all of the requirements of the given unit AC electrical power sources (e.g., the opposite unit DG is not required to start on the opposite unit's ECCS initiation signal to support OPERABILITY of the given unit).
| |
| Where the SRs discussed herein specify voltage and frequency tolerances, the following summary is applicable. The minimum steady state output voltage of 4010 V is greater than 90% of the nominal 4160 V output voltage. This value, which is conservative with respect to the value specified in ANSI C84.1 (Ref. 10), allows for voltage drop to the terminals of 4000 V motors whose minimum operating voltage is specified as 90%, or 3600 V. It also allows for voltage drops to motors and other equipment down through the 120 V level where minimum operating voltage is also usually specified as 90% of name plate rating. The specified maximum steady state output voltage of 4310 V is within the maximum operating voltage of 110% specified for 4000 V motors. It ensures that for a lightly loaded distribution system, the voltage at the terminals of 4000 V motors is no more than the maximum rated operating voltages. The specified minimum and maximum frequencies of the DG are 58.8 Hz and 61.2 Hz, respectively. These values are equal to +/- 2% of the 60 Hz nominal frequency and are derived from the recommendations given in Regulatory Guide 1.9 (Ref. 3).
| |
| SR 3.8.1.1 This SR ensures proper circuit continuity for the offsite (continued)
| |
| LaSalle 1 and 2 B 3.8.1-23 Revision 89
| |
| | |
| AC SourcesOperating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.1 (continued)
| |
| REQUIREMENTS AC electrical power supply to the onsite distribution network and availability of offsite AC electrical power.
| |
| The breaker alignment for the ESF Division 1 and 2 buses verifies that each breaker is in its correct position to ensure that the distribution buses and loads are connected to their power source and that appropriate independence of offsite circuits is maintained. The breaker alignment for the ESF Division 3 buses verifies that each breaker is in its correct position to ensure that distribution buses and loads are connected or capable of being connected to their power source and that appropriate independence of offsite circuits is maintained. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.8.1.2 and SR 3.8.1.7 These SRs help to ensure the availability of the standby electrical power supply to mitigate DBAs and transients and maintain the unit in a safe shutdown condition.
| |
| To minimize the wear on moving parts that do not get lubricated when the engine is not running, these SRs have been modified by Notes (Note 1 for SR 3.8.1.7 and Note 1 for SR 3.8.1.2) to indicate that all DG starts for these Surveillances may be preceded by an engine prelube period and followed by a warmup period prior to loading, as recommended by the manufacturer.
| |
| For the purposes of SR 3.8.1.2, the DGs are started from normal standby conditions and for the purposes of SR 3.8.1.7, the DGs are started from ambient standby conditions. Normal standby conditions for a DG means that the diesel engine jacket water and lube oil are being continuously circulated and temperature is being maintained consistent with manufacturer recommendations. Ambient standby conditions for a DG mean that the diesel engine jacket water and lube oil temperatures are within the prescribed temperature bands of these subsystems when the DG has been at rest for an extended period with the pre-lube oil and jacket water circulating systems operational.
| |
| In order to reduce stress and wear on diesel engines, the manufacturer has recommended that the starting speed of DGs be limited, that warmup be limited to this lower speed, and (continued)
| |
| LaSalle 1 and 2 B 3.8.1-24 Revision 89
| |
| | |
| AC SourcesOperating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.2 and SR 3.8.1.7 (continued)
| |
| REQUIREMENTS that DGs be gradually accelerated to synchronous speed prior to loading. These start procedures are the intent of Note 2 of SR 3.8.1.2.
| |
| SR 3.8.1.7 requires that the DG starts from standby conditions and achieves required voltage and frequency within 13 seconds. The 13 second start requirement supports the assumptions in the design basis LOCA analysis (Ref. 5).
| |
| The 13 second start requirement may not be applicable to SR 3.8.1.2 (see Note 2 of SR 3.8.1.2), when a modified start procedure as described above is used. If a modified start is not used, the 13 second start requirement of SR 3.8.1.7 applies. Since SR 3.8.1.7 does require a 13 second start, it is more restrictive than SR 3.8.1.2, and it may be performed in lieu of SR 3.8.1.2.
| |
| In addition, the DG is required to maintain proper voltage and frequency limits after steady state is achieved. The voltage and frequency limits are normally achieved within 13 seconds. The time for the DG to reach steady state operation, unless the modified DG start method is employed, is periodically monitored and the trend evaluated to identify degradation of governor and voltage regulator performance.
| |
| To minimize testing of the common DG, Note 3 of SR 3.8.1.2 and Note 2 of SR 3.8.1.7 allow a single test for the common DG (instead of two tests, one for each unit) to satisfy the requirements of both units. This is allowed since the main purpose of the Surveillance can be met by performing the test on either unit. However, to the extent practicable, the tests should be alternated between units. If the DG fails one of these Surveillances, the DG should be considered inoperable on both units, unless the cause of the failure can be directly related to only one unit.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.8.1.3 This Surveillance demonstrates that the DGs are capable of synchronizing and accepting greater than or equal to 90% of the DG continuous load rating. A minimum run time of 60 minutes is required to stabilize engine temperatures, (continued)
| |
| LaSalle 1 and 2 B 3.8.1-25 Revision 89
| |
| | |
| AC SourcesOperating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.3 (continued)
| |
| REQUIREMENTS while minimizing the time that the DG is connected to the offsite source.
| |
| Although no power factor requirements are established by this SR, the DG is normally operated at a power factor between 0.8 lagging and 1.0 when running synchronized with the grid. The 0.8 power factor value is the design rating of the machine at a particular kVA. The 1.0 power factor value is an operational limitation condition where the reactive power component is zero, which minimizes the reactive heating of the generator. Operating the generator at a power factor between 0.8 lagging and 1.0 avoids adverse conditions associated with underexciting the generator and more closely represents the generator operating requirements when performing its safety function (running isolated on its associated 4160 V emergency bus). The load band is provided to avoid routine overloading of the DG. Routine overloading may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain DG OPERABILITY.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| Note 1 modifies this Surveillance to indicate that diesel engine runs for this Surveillance may include gradual loading, as recommended by the manufacturer, so that mechanical stress and wear on the diesel engine are minimized.
| |
| Note 2 modifies this Surveillance by stating that momentary transients because of changing bus loads do not invalidate this test.
| |
| Note 3 indicates that this Surveillance must be conducted on only one DG at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations.
| |
| Note 4 stipulates a prerequisite requirement for performance of this SR. A successful DG start must precede this test to credit satisfactory performance.
| |
| To minimize testing of the common DG, Note 5 allows a single test of the common DG (instead of two tests, one for (continued)
| |
| LaSalle 1 and 2 B 3.8.1-26 Revision 89
| |
| | |
| AC SourcesOperating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.3 (continued)
| |
| REQUIREMENTS each unit) to satisfy the requirements for both units. This is allowed since the main purpose of the Surveillance can be met by performing the test on either unit. However, to the extent practicable, the test should be alternated between units. If the DG fails one of these Surveillances, the DG should be considered inoperable on both units, unless the cause of the failure can be directly related to only one unit.
| |
| SR 3.8.1.4 This SR provides verification that the level of fuel oil in the day tank is at or above the level at which the low level alarm is annunciated. The level is expressed as an equivalent volume in gallons, and is selected to ensure adequate fuel oil for a minimum of 50 minutes of DG operation at rated capacity.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.8.1.5 Microbiological fouling is a major cause of fuel oil degradation. There are numerous bacteria that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive. Removal of water from the fuel oil day tanks eliminates the necessary environment for bacterial survival. This is most effective means in controlling microbiological fouling. In addition, it eliminates the potential for water entrainment in the fuel oil during DG operation. Water may come from any of several sources, including condensation, rain water, contaminated fuel oil, and breakdown of the fuel oil by bacteria.
| |
| Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. This SR is for preventive maintenance.
| |
| The presence of water does not necessarily represent a failure of this SR provided that accumulated water is removed during performance of this Surveillance.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.1-27 Revision 89
| |
| | |
| AC SourcesOperating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.6 REQUIREMENTS (continued) This Surveillance demonstrates that each required fuel oil transfer pump operates and automatically transfers fuel oil from its associated storage tank to its associated day tank.
| |
| It is required to support the continuous operation of standby power sources. This Surveillance provides assurance that the fuel oil transfer pump is OPERABLE, the fuel oil piping system is intact, the fuel delivery piping is not obstructed, and the controls and control systems for automatic fuel transfer systems are OPERABLE.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.8.1.8 Transfer of each Division 1 and 2 4.16 kV emergency bus power supply from the normal offsite circuit to the alternate offsite circuit demonstrates the OPERABILITY of the alternate circuit distribution network to power the Division 1 and 2 shutdown loads. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by a Note. The reason for the Note is that, during operation with the reactor critical, performance of this SR could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, plant safety systems. This restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modifications, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed Surveillance, a successful Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk (continued)
| |
| LaSalle 1 and 2 B 3.8.1-28 Revision 89
| |
| | |
| AC SourcesOperating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.8 (continued)
| |
| REQUIREMENTS of a plant shutdown and startup to determine that plant safety is maintained or enhanced when the Surveillance is performed in MODE 1 or 2. Risk insights or deterministic methods may be used for this assessment. Credit may be taken for unplanned events that satisfy this SR.
| |
| SR 3.8.1.9 Each DG is provided with an engine overspeed trip to prevent damage to the engine. Recovery from the transient caused by the loss of a large load could cause diesel engine overspeed, which, if excessive, might result in a trip of the engine. This Surveillance demonstrates the DG load response characteristics and capability to reject the largest single load without exceeding predetermined frequency and while maintaining a specified margin to the overspeed trip. The load referenced for the Division 1 DG is the 1190 kW low pressure core spray pump; for the Division 2 DG, the 638 kW residual heat removal (RHR) pump; and for the Division 3 DG the 2421 kW HPCS pump. This Surveillance may be accomplished by:
| |
| : a. Tripping the DG output breaker with the DG carrying greater than or equal to its associated single largest post-accident load while paralleled to offsite power, or while solely supplying the bus; or
| |
| : b. Tripping its associated single largest post-accident load with the DG solely supplying the bus.
| |
| Consistent with Regulatory Guide 1.9 (Ref. 3), the load rejection test is acceptable if the diesel speed does not exceed 75% of the difference between nominal speed and the overspeed trip setpoint, or 15% above nominal speed, whichever is lower. This corresponds to 66.7 Hz, which is the nominal speed plus 75% of the difference between nominal speed and the overspeed trip setpoint. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR has been modified by two Notes. The reason for Note 1 is that during operation with the reactor critical, performance of this SR could cause perturbations to the (continued)
| |
| LaSalle 1 and 2 B 3.8.1-29 Revision 89
| |
| | |
| AC SourcesOperating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.9 (continued)
| |
| REQUIREMENTS electrical distribution systems that could challenge continued steady state operation and, as a result, plant safety systems (Note 1 is not applicable to the Division 3 DG). This restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g. post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed Surveillance, a successful Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when the Surveillance is performed in MODE 1 or 2. Risk insights or deterministic methods may be used for this assessment. Credit may be taken for unplanned events that satisfy this SR. To minimize testing of the common DG, Note 2 allows a single test of the common DG (instead of two tests, one for each unit) to satisfy the requirements for both units. This is allowed since the main purpose of the Surveillance can be met by performing the test on either unit. If the DG fails one of these Surveillances, the DG should be considered inoperable on both units, unless the cause of the failure can be directly related to only one unit.
| |
| SR 3.8.1.10 Consistent with Regulatory Guide 1.9 (Ref. 3), paragraph C.2.2.8, this Surveillance demonstrates the DG capability to reject a full load without overspeed tripping or exceeding the predetermined voltage limits. The DG full load rejection may occur because of a system fault or inadvertent breaker tripping. This Surveillance ensures proper engine generator load response under the simulated test conditions.
| |
| This test simulates the loss of the total connected load that the DG experiences following a full load rejection and verifies that the DG does not trip upon (continued)
| |
| LaSalle 1 and 2 B 3.8.1-30 Revision 89
| |
| | |
| AC SourcesOperating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.10 (continued)
| |
| REQUIREMENTS loss of the load. These acceptance criteria provide DG damage protection. While the DG is not expected to experience this transient during an event, and continues to be available, this response ensures that the DG is not degraded for future application, including reconnection to the bus if the trip initiator can be corrected or isolated.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR has been modified by two Notes. The reason for Note 1 is that during operation with the reactor critical, performance of this SR could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, plant safety systems (Note 1 is not applicable to the Division 3 DG). This restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed Surveillance, a successful Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when the Surveillance is performed in MODE 1 or 2. Risk insights or deterministic methods may be used for this assessment. Credit may be taken for unplanned events that satisfy this SR. To minimize testing of the common DG, Note 2 allows a single test of the common DG (instead of two tests, one for each unit) to satisfy the requirements for both units. This is allowed since the main purpose of the Surveillance can be met by performing the test on either unit. If the DG fails one of these Surveillances, the DG should be considered inoperable on both units, unless the cause of the failure can be directly related to only one unit.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.1-31 Revision 89
| |
| | |
| AC SourcesOperating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.11 REQUIREMENTS (continued) Consistent with Regulatory Guide 1.9 (Ref. 3),
| |
| paragraph C.2.2.4, this Surveillance demonstrates the as designed operation of the standby power sources during loss of the offsite source. This test verifies all actions encountered from the loss of offsite power, including shedding of the nonessential loads (Divisions 1 and 2 only) and energization of the emergency buses and respective loads from the DG. It further demonstrates the capability of the DG to automatically achieve the required voltage and frequency within the specified time.
| |
| The DG auto-start and energization of permanently connected loads time of 13 seconds is derived from requirements of the accident analysis for responding to a design basis large break LOCA (Ref. 5). The Surveillance should be continued for a minimum of 5 minutes in order to demonstrate that all starting transients have decayed and stability has been achieved.
| |
| The requirement to verify the connection and power supply of permanently connected loads and auto-connected loads is intended to satisfactorily show the relationship of these loads to the DG loading logic. In certain circumstances, many of these loads cannot actually be connected or loaded without undue hardship or potential for undesired operation.
| |
| For instance, ECCS injection valves are not desired to be stroked open, systems are not capable of being operated at full flow, or RHR systems performing a decay heat removal function are not desired to be realigned to the ECCS mode of operation. In lieu of actual demonstration of the connection and loading of these loads, testing that adequately shows the capability of the DG system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by two Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. The prelube period shall be consistent with manufacturer recommendations. For the purpose of this testing, the DGs must be started from normal standby conditions, that is, (continued)
| |
| LaSalle 1 and 2 B 3.8.1-32 Revision 89
| |
| | |
| AC SourcesOperating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.11 (continued)
| |
| REQUIREMENTS with the engine jacket water and lube oil being continuously circulated and temperature is being maintained consistent with manufacturer recommendations. The reason for Note 2 is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge plant safety systems (Note 2 is not applicable to the Division 3 DG). This restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow portions of the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial Surveillance, a successful partial Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when portions of the Surveillance are performed in MODE 1 or 2.
| |
| Risk insights or deterministic methods may be used for this assessment. Credit may be taken for unplanned events that satisfy this SR.
| |
| SR 3.8.1.12 Consistent with Regulatory Guide 1.9 (Ref. 3), paragraph C.2.2.5, this Surveillance demonstrates that the DG automatically starts and achieves the required voltage and frequency within the specified time (13 seconds) from the design basis actuation signal (LOCA signal). In addition, the DG is required to maintain proper voltage and frequency limits after steady state is achieved. The voltage and frequency limits are normally achieved within 13 seconds.
| |
| The time for the DG to reach the steady state voltage and frequency limits is periodically monitored and the trend evaluated to identify degradation of governor and voltage regulator performance. The DG is required to operate for (continued)
| |
| LaSalle 1 and 2 B 3.8.1-33 Revision 89
| |
| | |
| AC SourcesOperating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.12 (continued)
| |
| REQUIREMENTS t 5 minutes. The 5 minute period provides sufficient time to demonstrate stability.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by two Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. The prelube period shall be consistent with manufacturer recommendations. For the purpose of this testing, the DGs must be started from normal standby conditions, that is, with the engine jacket water and lube oil being continuously circulated and temperature is being maintained consistent with manufacturer recommendations. The reason for Note 2 is that during operation with the reactor critical, performance of this SR could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, plant safety systems (Note 2 is not applicable to the Division 3 DG). This restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow portions of the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial Surveillance, a successful partial Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial Surveillance; as well as the operator procedures available to cope with these outcomes.
| |
| These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when portions of the Surveillance are performed in MODE 1 or 2. Risk insights or deterministic methods may be used for this assessment. Credit may be taken for unplanned events that satisfy this SR.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.1-34 Revision 89
| |
| | |
| AC SourcesOperating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.13 REQUIREMENTS (continued) Consistent with Regulatory Guide 1.9 (Ref. 3) paragraph C.2.2.12, this Surveillance demonstrates that DG non-critical protective functions (e.g., high jacket water temperature) are bypassed on a loss of voltage signal concurrent with an ECCS initiation test signal and critical protective functions (engine overspeed and generator differential current) trip the DG to avert substantial damage to the DG unit. The non-critical trips are bypassed during DBAs and provide an alarm on an abnormal engine condition. This alarm provides the operator with sufficient time to react appropriately. The DG availability to mitigate the DBA is more critical than protecting the engine against minor problems that are not immediately detrimental to emergency operation of the DG.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by a Note. The reason for the Note is that performing the Surveillance removes a required DG from service (The Note is not applicable to the Division 3 DG).
| |
| This restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed Surveillance, a successful Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when the Surveillance is performed in MODE 1 or 2. Risk insights or deterministic methods may be used for this assessment. Credit may be taken for unplanned events that satisfy this SR.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.1-35 Revision 89
| |
| | |
| AC SourcesOperating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.14 REQUIREMENTS (continued) Consistent with Regulatory Guide 1.9 (Ref. 3),
| |
| paragraph C.2.2.9, this Surveillance requires demonstration that the DGs can start and run continuously near full load capability for an interval of not less than 24 hours, 22 hours of which is at a load equivalent to 92% and 100% of the continuous rating of the DG, and 2 hours of which is at a load between the 2000 hour rating and the 7 day rating of the DG. The DG starts for this Surveillance can be performed either from normal standby or hot conditions. The provisions for prelube and warmup, discussed in SR 3.8.1.2, and for gradual loading, discussed in SR 3.8.1.3, are applicable to this SR.
| |
| In order to ensure that the DG is tested under conditions that bound all credible design basis events, testing must be performed at a power factor as close to the accident load power factor as practicable. The accident kVAR load defines the power factor limit in the isochronous mode. Based on this relationship, if the reactive power (kVAR) level for the DG is maintained above the calculated accident load limiting value while the real power (kW) is maintained within a specified 90 to 100% operating band during the 22-hour surveillance period, the power factor limit will be met. During the 2-hour period that the DG is operated 2860 kW, the power factor limit will be restricted by the DG overload ratings. Continuous operation of the DG above the overload rating will accelerate wear and may negatively impact the machines reliability and result in more frequent teardown inspections.
| |
| The DG 2-hour overload limit within any 24-hour period allows up to 3420 kVA of apparent power. This kVA limit is based on values of 2860 kW (DG 24-hour rated limit) and 1876 kVAR (Operations kVAR loading limit with DG at 2860 kW). Therefore, the kVAR output of the DG during the 2-hour overload period should be maintained at a level that will ensure that the 3420 kVA limit is not exceeded. The established 3420 kVA value is slightly less than the generator manufacturers rating limit to provide margin for operating tolerances. The specific power factor limit for the emergency diesel generators is contained in the design basis loading calculations and varies for each particular DG. The kW and kVAR operating bands provided in the DG (continued)
| |
| LaSalle 1 and 2 B 3.8.1-36 Revision 89
| |
| | |
| AC SourcesOperating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.14 (continued)
| |
| REQUIREMENTS operating surveillances for performance of the 24-hour endurance tests envelope the accident kVAR load and therefore, the power factor requirements. This power factor is chosen to bound the actual worst case inductive loading that the DG could experience under design basis accident conditions.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This Surveillance is modified by four Notes. Note 1 states that momentary transients due to changing bus loads do not invalidate this test. The load band is provided to avoid routine overloading of the DG. Routine overloading may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain DG OPERABILITY. Similarly, momentary power factor transients above the limit do not invalidate the test. The reason for Note 2 is that during operation with the reactor critical, performance of this SR could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, plant safety systems. However, it is acceptable to perform this SR in MODES 1 and 2 provided the other two DGs are OPERABLE, since a perturbation can only affect one divisional DG. If during performance of this SR one of the other DGs becomes inoperable, this Surveillance is to be suspended. In addition, this restriction from normally performing the Surveillance in MODE 1 or 2 with any of the remaining two DGs inoperable is further amplified to allow the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed Surveillance, a successful Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant (continued)
| |
| LaSalle 1 and 2 B 3.8.1-37 Revision 89
| |
| | |
| AC SourcesOperating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.14 (continued)
| |
| REQUIREMENTS safety is maintained or enhanced when the Surveillance is performed in MODE 1 or 2 with any of the remaining two DGs inoperable . Risk insights or deterministic methods may be used for this assessment. Credit may be taken for unplanned events that satisfy this SR. Note 3 is provided in recognition that under certain conditions, it is necessary to allow the surveillance to be conducted at a power factor other than the specified limit. During the Surveillance, the DG is normally operated paralleled to the grid, which is not the configuration when the DG is performing its safety function following a loss of offsite power (with or without a LOCA). Given the parallel configuration to the grid during the Surveillance, the grid voltage may be such that the DG field excitation level needed to obtain the specified power factor could result in a transient voltage within the DG windings higher than the recommended values if the DG output breaker were to trip during the Surveillance.
| |
| Therefore, the power factor shall be maintained as close as practicable to the specified limit while still ensuring that if the DG output breaker were to trip during the Surveillance that the maximum DG winding voltage would not be exceeded. To minimize testing of the common DG, Note 4 allows a single test of the common DG (instead of two tests, one for each unit) to satisfy the requirements for both units. This is allowed since the main purpose of the Surveillance can be met by performing the test on either unit. If the DG fails one of these Surveillances, the DG should be considered inoperable on both units, unless the cause of the failure can be directly related to only one unit.
| |
| SR 3.8.1.15 This Surveillance demonstrates that the diesel engine can restart from a hot condition, such as subsequent to shutdown from normal Surveillances, and achieve the required voltage and frequency within 13 seconds. The 13 second time is derived from the requirements of the accident analysis for responding to a design basis large break LOCA (Ref. 5). In addition, the DG is required to maintain proper voltage and frequency limits after steady state is achieved. The voltage and frequency limits are (continued)
| |
| LaSalle 1 and 2 B 3.8.1-38 Revision 89
| |
| | |
| AC SourcesOperating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.15 (continued)
| |
| REQUIREMENTS normally achieved within 13 seconds. The time for the DG to reach the steady state voltage and frequency limits is periodically monitored and the trend evaluated to identify degradation of governor and voltage regulator performance.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR has been modified by three Notes. Note 1 ensures that the test is performed with the diesel sufficiently hot.
| |
| The requirement that the diesel has operated for at least 2 hours at 92% to 100% of full load conditions prior to performance of this Surveillance is based on manufacturer recommendations for achieving hot conditions. The load band is provided to avoid routine overloading of the DG. Routine overloads may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain DG OPERABILITY. Momentary transients due to changing bus loads do not invalidate this test. Note 2 allows all DG starts to be preceded by an engine prelube period to minimize wear and tear on the diesel during testing. The prelube period shall be consistent with manufacturer recommendations. To minimize testing of the common DG, Note 3 allows a single test of the common DG (instead of two tests, one for each unit) to satisfy the requirements for both units. This is allowed since the main purpose of the Surveillance can be met by performing the test on either unit. If the DG fails one of these Surveillances, the DG should be considered inoperable on both units, unless the cause of the failure can be directly related to only one unit.
| |
| SR 3.8.1.16 Consistent with Regulatory Guide 1.9 (Ref. 3),
| |
| paragraph C.2.2.11, this Surveillance ensures that the manual synchronization and automatic load transfer from the DG to the offsite source can be made and that the DG can be returned to ready-to-load status when offsite power is restored. It also ensures that the auto-start logic is reset to allow the DG to reload if a subsequent loss of offsite power occurs. The DG is considered to be in ready-to-load status when the DG is at rated speed and (continued)
| |
| LaSalle 1 and 2 B 3.8.1-39 Revision 89
| |
| | |
| AC SourcesOperating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.16 (continued)
| |
| REQUIREMENTS voltage, the output breaker is open and can receive an auto-close signal on bus undervoltage, and the individual load time delay relays are reset.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge plant safety systems (The Note is not applicable to the Division 3 DG). This restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed Surveillance, a successful Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when the Surveillance is performed in MODE 1 or 2. Risk insights or deterministic methods may be used for this assessment. Credit may be taken for unplanned events that satisfy this SR.
| |
| SR 3.8.1.17 Consistent with Regulatory Guide 1.9 (Ref. 3), paragraph C.2.2.13, demonstration of the parallel test mode override ensures that the DG availability under accident conditions is not compromised as the result of testing. Interlocks to the LOCA sensing circuits cause the Divisions 1 and 2 DGs to automatically reset to ready-to-load operation if an ECCS initiation signal is received during operation in the test mode. Ready-to-load operation is defined as the DG running at rated speed and voltage with the DG output (continued)
| |
| LaSalle 1 and 2 B 3.8.1-40 Revision 80
| |
| | |
| AC SourcesOperating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.17 REQUIREMENTS (continued) breaker open. These provisions for automatic switchover are required by IEEE-308 (Ref. 11), paragraph 6.2.6(2).
| |
| The Division 3 DG overcurrent trip of the SAT feeder breaker to the respective Division 3 emergency bus demonstrates the ability of the Division 3 DG to remain connected to the emergency bus and supplying the necessary loads.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR has been modified by a Note. The reason for the Note is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems (The Note is not applicable to the Division 3 DG). This restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow portions of the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial Surveillance, a successful partial Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when portions of the Surveillance are performed in MODE 1 or 2.
| |
| Risk insights or deterministic methods may be used for this assessment. Credit may be taken for unplanned events that satisfy this SR.
| |
| SR 3.8.1.18 Under accident conditions with loss of offsite power loads are sequentially connected to the bus by the individual (continued)
| |
| LaSalle 1 and 2 B 3.8.1-41 Revision 89
| |
| | |
| AC SourcesOperating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.18 (continued)
| |
| REQUIREMENTS time delay relays. The sequencing logic controls the permissive and starting signals to motor breakers to prevent overloading of the DGs due to high motor starting currents.
| |
| The -10% load sequence time interval limit ensures that a sufficient time interval exists for the DG to restore frequency and voltage prior to applying the next load.
| |
| There is no upper limit for the load sequence time interval since, for a single load interval (i.e., the time between two load blocks), the capability of the DG to restore frequency and voltage prior to applying the second load is not negatively affected by a longer than designed load interval, and if there are additional load blocks (i.e., the design includes multiple load intervals), then the lower limit requirements (-10%) will ensure that sufficient time exists for the DG to restore frequency and voltage prior to applying the remaining load blocks (i.e., all load intervals must be t 90% of the design interval). Reference 2 provides a summary of the automatic loading of emergency buses.
| |
| Since only the Division 1 and 2 DGs have more than one load block, this SR is only applicable to these DGs.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by a Note. The reason for the Note is that performing the Surveillance during these MODES would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge plant safety systems. This restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow portions of the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial Surveillance, a successful partial Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial Surveillance; as well as the operator procedures available to cope with these outcomes (continued)
| |
| LaSalle 1 and 2 B 3.8.1-42 Revision 89
| |
| | |
| AC SourcesOperating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.18 (continued)
| |
| REQUIREMENTS These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when portions of the Surveillance are performed in MODE 1 or 2. Risk insights or deterministic methods may be used for this assessment. Credit may be taken for unplanned events that satisfy this SR.
| |
| SR 3.8.1.19 In the event of a DBA coincident with a loss of offsite power, the DGs are required to supply the necessary power to ESF systems so that the fuel, RCS, and containment design limits are not exceeded.
| |
| This Surveillance demonstrates the DG operation, as discussed in the Bases for SR 3.8.1.11, during a loss of offsite power actuation test signal in conjunction with an ECCS initiation signal. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the DG system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by two Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. The prelube period shall be consistent with manufacturer recommendations. For the purpose of this testing, the DGs must be started from normal standby conditions, that is, with the engine jacket water and lube oil being continuously circulated and temperature is being maintained consistent with manufacturer recommendations. The reason for Note 2 is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge plant safety systems (Note 2 is not applicable to the Division 3 DG). This restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow portions of the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing (continued)
| |
| LaSalle 1 and 2 B 3.8.1-43 Revision 89
| |
| | |
| AC SourcesOperating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.19 (continued)
| |
| REQUIREMENTS following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial Surveillance, a successful partial Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when portions of the Surveillance are performed in MODE 1 or 2.
| |
| Risk insights or deterministic methods may be used for this assessment. Credit may be taken for unplanned events that satisfy this SR.
| |
| SR 3.8.1.20 This Surveillance demonstrates that the unit DG starting independence has not been compromised. Also, this Surveillance demonstrates that each engine can achieve proper frequency and voltage within the specified time when the unit DGs are started simultaneously.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by a Note. The reason for the Note is to minimize wear on the DG during testing. The prelube period shall be consistent with manufacturer recommendations. For the purpose of this testing, the DGs must be started from normal standby conditions, that is, with the engine jacket water and lube oil continuously circulated and temperature is being maintained consistent with manufacturer recommendations.
| |
| SR 3.8.1.21 With the exception of this Surveillance, all other Surveillances of this Specification (SR 3.8.1.1 through SR 3.8.1.20) are applied to the given unit AC sources.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.1-44 Revision 89
| |
| | |
| AC SourcesOperating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.21 (continued)
| |
| REQUIREMENTS This Surveillance is provided to direct that appropriate Surveillances for the required opposite unit AC source is governed by the applicable opposite unit Technical Specifications. Performance of the applicable opposite unit Surveillances will satisfy the opposite unit requirements as well as satisfy the given unit Surveillance Requirement.
| |
| Exceptions are noted to the opposite unit SRs of LCO 3.8.1.
| |
| SR 3.8.1.20 is excepted since only one opposite unit DG is required by the given unit Specification. SR 3.8.1.12, SR 3.8.1.13, SR 3.8.1.17, SR 3.8.1.18, and SR 3.8.1.19 are excepted since these SRs test the opposite unit's ECCS initiation signal, which is not required for the AC electrical power sources to be OPERABLE on a given unit.
| |
| The Frequency required by the applicable opposite unit SR also governs performance of that SR for the given unit.
| |
| As noted, if the opposite unit is in MODE 4 or 5, or moving irradiated fuel assemblies in secondary containment, SR 3.8.1.3, SR 3.8.1.9 through SR 3.8.1.11, and SR 3.8.1.14 through SR 3.8.1.16 are not required to be performed. This ensures that a given unit SR will not require an opposite unit SR to be performed, when the opposite unit Technical Specifications exempts performance of an opposite unit SR (however, as stated in the opposite unit SR 3.8.2.1 Note 1, while performance of an SR is exempted, the SR must still be met).
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.1-45 Revision 89
| |
| | |
| AC SourcesOperating B 3.8.1 BASES (continued)
| |
| REFERENCES 1. 10 CFR 50, Appendix A, GDC 17.
| |
| : 2. UFSAR, Chapter 8.
| |
| : 3. Regulatory Guide 1.9.
| |
| : 4. UFSAR, Chapter 6.
| |
| : 5. UFSAR, Chapter 15.
| |
| : 6. Regulatory Guide 1.93.
| |
| : 7. Generic Letter 84-15, July 2, 1984.
| |
| : 8. 10 CFR 50, Appendix A, GDC 18.
| |
| : 9. Regulatory Guide 1.137.
| |
| : 10. ANSI C84.1, 1982.
| |
| : 11. IEEE Standard 308.
| |
| : 12. Risk Management Document SA-1354, Rev. 0, LaSalle Division 1 and 2 CSCS Valve Replacement Project -
| |
| Temporary Extension of Technical Specification Completion Times, December 2, 2004.
| |
| : 13. NEDC-32988-A, Revision 2, "Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants," December 2002.
| |
| LaSalle 1 and 2 B 3.8.1-46 Revision 51
| |
| | |
| AC SourcesShutdown B 3.8.2 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.2 AC SourcesShutdown BASES BACKGROUND A description of the AC sources is provided in the Bases for LCO 3.8.1, "AC SourcesOperating."
| |
| APPLICABLE The OPERABILITY of the minimum AC sources during MODES 4 SAFETY ANALYSES and 5, and during movement of irradiated fuel assemblies in the secondary containment ensures that:
| |
| : a. The unit can be maintained in the shutdown or refueling condition for extended periods;
| |
| : b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and
| |
| : c. Adequate AC electrical power is provided to mitigate events postulated during shutdown, such as a fuel handling accident.
| |
| In general, when the unit is shutdown the Technical Specifications (TS) requirements ensure that the unit has the capability to mitigate the consequences of postulated accidents. However, assuming a single failure and concurrent loss of all offsite or loss of all onsite power is not required. The rationale for this is based on the fact that many Design Basis Accidents (DBAs) that are analyzed in MODES 1, 2, and 3 have no specific analyses in MODES 4 and 5. Worst case bounding events are deemed not credible in MODES 4 and 5 because the energy contained within the reactor pressure boundary, reactor coolant temperature and pressure, and the corresponding stresses result in the probabilities of occurrence significantly reduced or eliminated, and minimal consequences. These deviations from DBA analysis assumptions and design requirements during shutdown conditions are allowed by the LCO for required systems.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.2-1 Revision 76
| |
| | |
| AC SourcesShutdown B 3.8.2 BASES APPLICABLE During MODES 1, 2, and 3, various deviations from the SAFETY ANALYSES analysis assumptions and design requirements are allowed (continued) within the ACTIONS. This allowance is in recognition that certain testing and maintenance activities must be conducted provided an acceptable level of risk is not exceeded.
| |
| During MODES 4 and 5, performance of a significant number of required testing and maintenance activities is also required. In MODES 4 and 5, the activities are generally planned and administratively controlled. Relaxations from typical MODE 1, 2, and 3 LCO requirements are acceptable during shutdown MODES based on:
| |
| : a. The fact that time in an outage is limited. This is a risk prudent goal as well as utility economic consideration.
| |
| : b. Requiring appropriate compensatory measures for certain conditions. These may include administrative controls, reliance on systems that do not necessarily meet typical design requirements applied to systems credited in operating MODE analyses, or both.
| |
| : c. Prudent utility consideration of the risk associated with multiple activities that could affect multiple systems.
| |
| : d. Maintaining, to the extent practical, the ability to perform required functions (even if not meeting MODE 1, 2, and 3 OPERABILITY requirements) with systems assumed to function during an event.
| |
| In the event of an accident during shutdown, this LCO ensures the capability of supporting systems necessary to avoid immediate difficulty, assuming either a loss of all offsite power or a loss of all onsite (diesel generator (DG)) power.
| |
| The AC sources satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO One offsite circuit capable of supplying onsite unit Class 1E power distribution subsystem(s) of LCO 3.8.8, "Distribution SystemsShutdown," ensures that all required Division 1 loads, Division 2 loads, and Division 3 loads are (continued)
| |
| LaSalle 1 and 2 B 3.8.2-2 Revision 0
| |
| | |
| AC SourcesShutdown B 3.8.2 BASES LCO powered from offsite power. An OPERABLE unit DG, associated (continued) with a Division 1 or Division 2 Distribution System emergency bus required OPERABLE by LCO 3.8.8, ensures a diverse power source is available to provide electrical power support, assuming a loss of the offsite circuit.
| |
| Similarly, when the High Pressure Core Spray (HPCS) System is required to be OPERABLE, an OPERABLE Division 3 DG ensures a diverse source of power for the HPCS System is available to provide electrical power support, assuming a loss of the offsite power circuit. Additionally, when the Standby Gas Treatment (SGT) System, Control Room Area Filtration (CRAF) System, or Control Room Area Ventilation Air Conditioning System is required to be OPERABLE, one qualified offsite circuit (normal or alternate) between the offsite transmission network and the opposite unit Division 2 onsite Class 1E AC electrical power distribution subsystem or an opposite unit DG capable of supporting the opposite unit Division 2 onsite Class 1E AC electrical power distribution subsystem is required to be OPERABLE.
| |
| Together, OPERABILITY of the required offsite circuit(s) and the ability to manually start a DG(s) ensure the availability of sufficient AC sources to operate the plant in a safe manner and to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents).
| |
| The qualified offsite circuit(s) must be capable of maintaining rated frequency and voltage while connected to their respective emergency bus(es), and of accepting required loads during an accident. Qualified offsite circuits are those that are described in the UFSAR and are part of the licensing basis for the plant. An OPERABLE qualified normal offsite circuit consists of the required incoming breaker(s) and disconnects from the 345 kV switchyard to and including the SAT or UAT (backfeed mode),
| |
| the respective circuit path to and including the feeder breakers to the required Division 1, 2, and 3 emergency buses.
| |
| An OPERABLE qualified alternate offsite circuit consists of the required incoming breaker(s) and disconnects from the 345 kV switchyard to and including the SAT or UAT (backfeed mode), to and including the opposite unit 4.16 kV emergency bus, the opposite unit circuit path to and including the (continued)
| |
| LaSalle 1 and 2 B 3.8.2-3 Revision 9076
| |
| | |
| AC SourcesShutdown B 3.8.2 BASES LCO unit tie breakers (breakers 1414, 1424, 2414, and 2424),
| |
| (continued) and the respective circuit path to the required Division 1 and 2 emergency buses.
| |
| The required DG must be capable of being manually started, accelerating to rated speed and voltage, and connecting to its respective emergency bus, and accepting required loads.
| |
| The necessary portions of the DG Cooling Water System and Ultimate Heat Sink capable of providing cooling to the required DG(s) are also required.
| |
| It is acceptable for divisions to be cross tied during shutdown conditions, permitting a single offsite power circuit to supply all required divisions.
| |
| APPLICABILITY The AC sources required to be OPERABLE in MODES 4 and 5 and during movement of irradiated fuel assemblies in the secondary containment provide assurance that:
| |
| : a. Systems that provide core cooling are available;
| |
| : b. Systems needed to mitigate a fuel handling accident are available;
| |
| : c. Systems necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and
| |
| : d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.
| |
| The AC power requirements for MODES 1, 2, and 3 are covered in LCO 3.8.1.
| |
| ACTIONS LCO 3.0.3 is not applicable while in MODE 4 or 5. However, since irradiated fuel assembly movement can occur in MODE 1, 2, or 3, the ACTIONS have been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 4 or 5, LCO 3.0.3 (continued)
| |
| LaSalle 1 and 2 B 3.8.2-4 Revision 9076
| |
| | |
| AC SourcesShutdown B 3.8.2 BASES (continued)
| |
| ACTIONS would not specify any action. If moving irradiated fuel (continued) assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Entering LCO 3.0.3 while in MODE 1, 2, or 3 would require the unit to be shutdown, but would not require immediate suspension of movement of irradiated fuel assemblies. The Note to the ACTIONS, "LCO 3.0.3 is not applicable," ensures that the actions for immediate suspension of irradiated fuel assembly movement are not postponed due to entry into LCO 3.0.3.
| |
| A.1 An offsite circuit is considered inoperable if it is not available to one required 4.16 kV emergency bus. If two or more 4.16 kV emergency buses are required per LCO 3.8.8, division(s) with offsite power available may be capable of supporting sufficient required features to allow continuation of CORE ALTERATIONS and fuel movement. By the allowance of the option to declare required features inoperable that are not capable of being powered from offsite power, appropriate restrictions can be implemented in accordance with the required feature(s) LCOs' ACTIONS.
| |
| Required features remaining capable of being powered from a qualified offsite circuit, even if that circuit is considered inoperable because it is not capable of powering other required features, are not declared inoperable by this Required Action. For example, if both Division 1 and 2 emergency buses are required OPERABLE by LCO 3.8.8 and only the Division 1 emergency buses are not capable of being powered from offsite power, then only the required features powered from Division 1 emergency buses are required to be declared inoperable.
| |
| A.2.1, A.2.2, A.2.3, B.1, B.2, and B.3 With the offsite circuit not available to all required divisions, the option still exists to declare all required features inoperable per Required Action A.1. Since this option may involve undesired administrative efforts, the allowance for sufficiently conservative actions is made.
| |
| With the required DG inoperable, the minimum required diversity of AC power sources is not available. It is, (continued)
| |
| LaSalle 1 and 2 B 3.8.2-5 Revision 9076
| |
| | |
| AC SourcesShutdown B 3.8.2 BASES ACTIONS A.2.1, A.2.2, A.2.3, B.1, B.2, and B.3 (continued)
| |
| (continued) therefore, required to suspend CORE ALTERATIONS and movement of irradiated fuel assemblies in the secondary containment.
| |
| Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition.
| |
| These actions minimize probability of the occurrence of postulated events. It is further required to initiate action immediately to restore the required AC sources and to continue this action until restoration is accomplished in order to provide the necessary AC power to the plant safety systems.
| |
| The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required AC electrical power sources should be completed as quickly as possible in order to minimize the time during which the plant safety systems may be without sufficient power.
| |
| Pursuant to LCO 3.0.6, the Distribution System ACTIONS are not entered even if all AC sources to it are inoperable, resulting in de-energization. Therefore, the Required Actions of Condition A have been modified by a Note to indicate that when Condition A is entered with no AC power to any required emergency bus, ACTIONS for LCO 3.8.8 must be immediately entered. This Note allows Condition A to provide requirements for the loss of the offsite circuit whether or not a division is de-energized. LCO 3.8.8 provides the appropriate restrictions for the situation involving a de-energized division.
| |
| C.1 When the HPCS System is required to be OPERABLE, and the Division 3 DG is inoperable, the required diversity of AC power sources to the HPCS System is not available. Since these sources only affect the HPCS System, the HPCS System is declared inoperable and the Required Actions of LCO 3.5.2, "RPV Water Inventory Control," entered.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.2-6 Revision 9076
| |
| | |
| AC SourcesShutdown B 3.8.2 BASES ACTIONS C.1 (continued)
| |
| (continued)
| |
| In the event all sources of power to Division 3 are lost, Condition A will also be entered and direct that the ACTIONS of LCO 3.8.8 be taken. If only the Division 3 DG is inoperable, and power is still supplied to HPCS System, 72 hours is allowed to restore the DG to OPERABLE. This is reasonable considering the HPCS System will still perform its function, absent a loss of offsite power.
| |
| D.1 When the SGT System, CRAF System, or Control Room Area Ventilation Air Conditioning System is required to be OPERABLE, and the required opposite unit Division 2 AC source is inoperable, the associated SGT subsystem, CRAF subsystem, and control room ventilation area air conditioning subsystem are declared inoperable and the Required Actions of the affected LCOs are entered.
| |
| The immediate Completion Time is consistent with the required times for actions requiring prompt attention. The restoration of the required opposite unit Division 2 AC electrical power source should be completed as quickly as possible in order to minimize the time during which the aforementioned safety systems are without sufficient power.
| |
| SURVEILLANCE SR 3.8.2.1 REQUIREMENTS SR 3.8.2.1 requires the SRs from LCO 3.8.1 that are necessary for ensuring the OPERABILITY of the AC sources in other than MODES 1, 2, and 3 to be applicable. SR 3.8.1.8 is not required to be met since only one offsite circuit is required to be OPERABLE. SR 3.8.1.7, SR 3.8.1.11, SR 3.8.1.12, SR 3.8.1.13, SR 3.8.1.15, SR 3.8.1.18, and SR 3.8.1.19 are not required to be met because DG start and load within a specified time and response on an offsite (continued)
| |
| LaSalle 1 and 2 B 3.8.2-7 Revision 9076
| |
| | |
| AC SourcesShutdown B 3.8.2 BASES SURVEILLANCE SR 3.8.2.1 (continued)
| |
| REQUIREMENTS power or ECCS initiation signal is not required.
| |
| SR 3.8.1.17 is not required to be met because the required OPERABLE DG(s) is not required to undergo periods of being synchronized to the offsite circuit. SR 3.8.1.20 is excepted because starting independence is not required with the DG(s) that is not required to be OPERABLE. Refer to the corresponding Bases for LCO 3.8.1 for a discussion of each SR.
| |
| This SR is modified by a Note which precludes requiring the OPERABLE DG(s) from being paralleled with the offsite power network or otherwise rendered inoperable during the performance of SRs, and to preclude de-energizing a required 4.16 kV emergency bus or disconnecting a required offsite circuit during performance of SRs. With limited AC sources available, a single event could compromise both the required circuit and the DG. It is the intent that these SRs must still be capable of being met, but actual performance is not required during periods when the DG and offsite circuit are required to be OPERABLE.
| |
| REFERENCES None.
| |
| LaSalle 1 and 2 B 3.8.2-8 Revision 9076
| |
| | |
| Diesel Fuel Oil and Starting Air B 3.8.3 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.3 Diesel Fuel Oil and Starting Air BASES BACKGROUND Each diesel generator (DG) is provided with a storage tank and a day tank. The Division 1 and 2 DGs and the opposite unit Division 2 DG onsite fuel oil capacity is sufficient to operate that DG for a period of 7 days while the DG is supplying rated load. The Division 3 DG onsite fuel oil capacity is sufficient to operate that DG for a period of 7 days while the DG is supplying maximum expected load profile (Ref. 1). The maximum load demand is calculated using the assumption that at least two DGs are available.
| |
| This onsite fuel oil capacity is sufficient to operate the DGs for longer than the time to replenish the onsite supply from outside sources.
| |
| Fuel oil is transferred from each storage tank to its respective day tank by a transfer pump associated with each storage tank. Redundancy of pumps and piping precludes the failure of one pump, or the rupture of any pipe, valve, or tank to result in the loss of more than one DG. All system piping and components, except for fill piping and vents, are located within the diesel buildings. The fuel oil level in the storage tanks is indicated locally, and each storage tank is provided with low level switches that actuate alarm annunciators in the main control room.
| |
| For proper operation of the standby DGs, it is necessary to ensure the proper quality of the fuel oil. Regulatory Guide 1.137 (Ref. 2) addresses the recommended fuel oil practices as supplemented by ANSI N195 (Ref. 3). The fuel oil properties governed by these SRs are the water and sediment content, the flashpoint and kinematic viscosity, specific gravity (or API gravity), and impurity level.
| |
| Each Division 1 and Division 2 DG has two air start subsystems, each with adequate capacity for five successive starts on the DG without recharging the air start receivers.
| |
| Each Division 3 DG has two air start subsystems, each with adequate capacity for three successive starts on the DG without recharging the air start receivers.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.3-1 Revision 33
| |
| | |
| Diesel Fuel Oil and Starting Air B 3.8.3 BASES (continued)
| |
| APPLICABLE The initial conditions of Design Basis Accident (DBA) and SAFETY ANALYSES transient analyses in UFSAR, Chapter 6 (Ref. 4) and Chapter 15 (Ref. 5), assume Engineered Safety Feature (ESF) systems are OPERABLE. The DGs are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that fuel, reactor coolant system, and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution Limits; Section 3.5, Emergency Core Cooling (ECCS) and Reactor Core Isolation Cooling (RCIC) System; and Section 3.6, Containment Systems.
| |
| Since diesel fuel oil and starting air subsystems support the operation of the standby AC power sources, they satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO Stored diesel fuel oil is required to have sufficient supply for 7 days of rated load operation for Division 1 and 2 DG, and for 7 days of maximum expected load profile for Division 3 DG. It is also required to meet specific standards for quality. This requirement, in conjunction with an ability to obtain replacement supplies within 7 days, supports the availability of DGs required to shut down the reactor and to maintain it in a safe condition for an anticipated operational occurrence (AOO) or a postulated DBA with loss of offsite power. DG day tank fuel requirements, as well as transfer capability from the storage tank to the day tank, are addressed in LCO 3.8.1, "AC SourcesOperating," and LCO 3.8.2, "AC Sources-Shutdown."
| |
| The starting air system is required to have a minimum capacity for five successive Division 1 and 2 DG starts and three successive Division 3 DG starts without recharging the air start receivers. While each air start receiver set has the required capacity, both air start receiver sets (and associated air start headers) per DG are required to ensure OPERABILITY of the DG.
| |
| APPLICABILITY The AC sources (LCO 3.8.1 and LCO 3.8.2), are required to ensure the availability of the required power to shut down the reactor and maintain it in a safe shutdown condition after an AOO or a postulated DBA. Since stored diesel fuel (continued)
| |
| LaSalle 1 and 2 B 3.8.3-2 Revision 33
| |
| | |
| Diesel Fuel Oil and Starting Air B 3.8.3 BASES APPLICABILITY oil and starting air subsystems support LCO 3.8.1 and (continued) LCO 3.8.2, stored diesel fuel oil and starting air are required to be within limits when the associated DG is required to be OPERABLE.
| |
| ACTIONS The ACTIONS Table is modified by a Note indicating that separate Condition entry is allowed for each DG. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable DG subsystem. Complying with the Required Actions for one inoperable DG subsystem may allow for continued operation, and subsequent inoperable DG subsystem(s) are governed by separate Condition entry and application of associated Required Actions.
| |
| A.1 With stored fuel oil level less than the 7 day fuel oil supply shown in Table B 3.8.3-1, the 7 day fuel oil supply for a DG is not available. However, the Condition is restricted to fuel oil level reductions that maintain at least a 6 day supply as shown in Table B 3.8.3-1. The usable fuel oil volume equivalent to a 6 day supply for the Division 1 and Division 2 DGs, the opposite unit Division 2 DG, and the Division 3 DG is the Six-day Fuel Oil Supply listed in Table B 3.8.3-1. The volumes listed in Table B 3.8.3-1 are the usable volumes of the associated fuel oil storage tank and day tank combined. The usable tank volume plus the unusable tank volume equals the actual tank volume.
| |
| These circumstances may be caused by events such as:
| |
| : a. Full load operation required after an inadvertent start while at minimum required level; or
| |
| : b. Feed and bleed operations that may be necessitated by increasing particulate levels or any number of other oil quality degradations.
| |
| This restriction allows sufficient time for obtaining the requisite replacement volume and performing the analyses required prior to addition of the fuel oil to the tank. A period of 48 hours is considered sufficient to complete restoration of the required level prior to declaring the DG inoperable. This period is acceptable based on the remaining capacity (> 6 days), the fact that actions will be initiated to obtain replenishment, and the low probability of an event during this brief period.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.3-3 Revision 40
| |
| | |
| Diesel Fuel Oil and Starting Air B 3.8.3 BASES ACTIONS B.1 (continued)
| |
| This Condition is entered as a result of a failure to meet the acceptance criterion for particulates. Normally, trending of particulate levels allows sufficient time to correct high particulate levels prior to reaching the limit of acceptability. Poor sample procedures (bottom sampling), contaminated sampling equipment, and errors in laboratory analysis can produce failures that do not follow a trend. Since the presence of particulates does not mean failure of the fuel oil to burn properly in the diesel engine, since particulate concentration is unlikely to change significantly between Surveillance Frequency intervals, and since proper engine performance has been recently demonstrated (within 31 days), it is prudent to allow a brief period prior to declaring the associated DG inoperable. The 7 day Completion Time allows for further evaluation, resampling, and re-analysis of the DG fuel oil.
| |
| C.1 With the new fuel oil properties defined in the Bases for SR 3.8.3.2 not within the required limits, a period of 30 days is allowed for restoring the stored fuel oil properties. This period provides sufficient time to test the stored fuel oil to determine that the new fuel oil, when mixed with previously stored fuel oil, remains acceptable, or to restore the stored fuel oil properties. This restoration may involve feed and bleed procedures, filtering, or a combination of these procedures. Even if a DG start and load was required during this time interval and the fuel oil properties were outside limits, there is high likelihood that the DG would still be capable of performing its intended function.
| |
| D.1 With starting air receiver pressure < 200 psig, sufficient capacity for five successive starts for the Division 1 or 2 DG or three successive starts for the Division 3 DG, as applicable, does not exist. However, as long as the receiver pressure is > 165 psig, there is adequate capacity (continued)
| |
| LaSalle 1 and 2 B 3.8.3-4 Revision 0
| |
| | |
| Diesel Fuel Oil and Starting Air B 3.8.3 BASES ACTIONS D.1 (continued) for at least one start, and the DG can be considered OPERABLE while the air receiver pressure is restored to the required limit. A period of 48 hours is considered sufficient to complete restoration to the required pressure prior to declaring the DG inoperable. This period is acceptable based on the remaining air start capacity, the fact that most DG starts are accomplished on the first attempt, and the low probability of an event during this brief period.
| |
| E.1 With a Required Action and associated Completion Time of Condition A, B, C, or D not met, or the stored diesel fuel oil or starting air subsystem not within limits of this Specification for reasons other than addressed by Conditions A through D, the associated DG may be incapable of performing its intended function and must be immediately declared inoperable.
| |
| SURVEILLANCE SR 3.8.3.1 REQUIREMENTS This SR provides verification that there is an adequate inventory of fuel oil in the associated fuel oil storage tank and day tank for the Division 1 and 2 DGs and the opposite unit Division 2 DG to support each DG's operation for 7 days at rated load. This SR provides verification that there is an adequate inventory of fuel oil in the associated fuel oil storage tank and day tank for the Division 3 DG to support its operation for 7 days at maximum expected load profile. Each DG's storage tank supplies fuel to ensure an adequate supply is maintained in its respective day tank. Each DG's day tank supplies fuel to the DG. The usable fuel oil volume equivalent to a 7 day supply for the Division 1 and Division 2 DGs, the opposite unit Division 2 DG, and the Division 3 DG is the Seven-day Fuel Oil Supply listed in Table B 3.8.3-1. The volumes listed in Table B 3.8.3-1 are the usable volumes of the associated fuel oil storage tank and day tank combined. The usable tank volume plus the unusable tank volume equals the actual tank volume.
| |
| The 7 day period is sufficient time to place the unit in a safe shutdown condition and to bring in replenishment fuel from an offsite location.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.3-5 Revision 51
| |
| | |
| Diesel Fuel Oil and Starting Air B 3.8.3 BASES SURVEILLANCE SR 3.8.3.1 (continued)
| |
| REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.8.3.2 The tests of new fuel prior to addition to the storage tanks are a means of determining whether new fuel oil is of the appropriate grade and has not been contaminated with substances that would have an immediate detrimental impact on diesel engine combustion and operation. If results from these tests are within acceptable limits, the fuel oil may be added to the storage tanks without concern for contaminating the entire volume of fuel oil in the storage tanks. These tests are to be conducted prior to adding the new fuel to the storage tank(s). The tests, limits, and applicable ASTM Standards are as follows:
| |
| : a. Sample the new fuel oil in accordance with ASTM D4057-95 (Ref. 6);
| |
| : b. Verify in accordance with the tests specified in ASTM D975-06b (Ref. 6) that the sample has: 1) an absolute specific gravity at 60°F of 0.83 and 0.89 (or an API gravity at 60°F of 27 and 39) when tested in accordance with ASTM D1298-99 (Ref. 6); 2) a kinematic viscosity at 40°C of 1.9 centistokes and 4.1 centistokes when tested in accordance with ASTM D445-97 (Ref. 6); and 3) a flash point of 125°F when tested in accordance with ASTM D93-99c (Ref. 6); and
| |
| : c. Verify that the new fuel oil has a clear and bright appearance with proper color when tested in accordance with ASTM D4176-93 (Ref. 6) or a water and sediment content within limits when tested in accordance with ASTM D2709-96e (Ref. 6). The clear and bright appearance with proper color test is only applicable to fuels that meet the ASTM color requirement (i.e., ASTM color 5 or less).
| |
| Failure to meet any of the above limits is cause for rejecting the new fuel oil, but does not represent a failure to meet the LCO since the fuel oil is not added to the storage tanks.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.3-6 Revision 51
| |
| | |
| Diesel Fuel Oil and Starting Air B 3.8.3 BASES SURVEILLANCE SR 3.8.3.2 (continued)
| |
| REQUIREMENTS Following the initial new fuel oil sample, the fuel oil is analyzed within 31 days following addition of the new fuel oil to the fuel oil storage tank(s) to establish that the other properties specified in Table 1 of ASTM D975-06b (Ref. 6) are met for new fuel oil when tested in accordance with ASTM D975-06b (Ref. 6), except that the analysis for sulfur may be performed in accordance with ASTM D1552-95 (Ref. 6), ASTM D2622-98 (Ref. 6), ASTM D4294-98 (Ref. 6),
| |
| or ASTM D5453-06 (Ref. 6). The 31 day period is acceptable because the fuel oil properties of interest, even if not within stated limits, would not have an immediate effect on DG operation. This Surveillance ensures the availability of high quality fuel oil for the DGs.
| |
| Fuel oil degradation during long term storage shows up as an increase in particulate, mostly due to oxidation. The presence of particulate does not mean that the fuel oil will not burn properly in a diesel engine. However, the particulate can cause fouling of filters and fuel oil injection equipment, which can cause engine failure.
| |
| Particulate concentrations should be determined in accordance with ASTM D5452-98 (Ref. 6). This method involves a gravimetric determination of total particulate concentration in the fuel oil and has a limit of 10 mg/l.
| |
| It is acceptable to obtain a field sample for subsequent laboratory testing in lieu of field testing.
| |
| The Frequency of this Surveillance takes into consideration fuel oil degradation trends indicating that particulate concentration is unlikely to change between Frequency intervals.
| |
| SR 3.8.3.3 This Surveillance ensures that, without the aid of the refill compressor, sufficient air start capacity for each DG is available. The system design requirements provide for a minimum of five engine starts for each Division 1 and Division 2 DG, and three engine starts for each Division 3 DG without recharging. The pressure specified in this SR is intended to support the lowest value at which the required number of starts can be accomplished.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.3-7 Revision 40
| |
| | |
| Diesel Fuel Oil and Starting Air B 3.8.3 BASES SURVEILLANCE SR 3.8.3.3 (continued)
| |
| REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.8.3.4 Microbiological fouling is a major cause of fuel oil degradation. There are numerous bacteria that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive. Removal of water from the fuel oil storage tank eliminates the necessary environment for bacterial survival. This is the most effective means of controlling microbiological fouling. In addition, it eliminates the potential for water entrainment in the fuel oil during DG operation. Water may come from any of several sources, including condensation, ground water, rain water, contaminated fuel oil, and breakdown of the fuel oil by bacteria. Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. This SR is for preventive maintenance. The presence of water does not necessarily represent a failure of this SR provided that accumulated water is removed during performance of this Surveillance.
| |
| REFERENCES 1. UFSAR, Section 9.5.4.
| |
| : 2. Regulatory Guide 1.137.
| |
| : 3. ANSI N195, Appendix B, 1976.
| |
| : 4. UFSAR, Chapter 6.
| |
| : 5. UFSAR, Chapter 15.
| |
| : 6. ASTM Standards: D4057-95; D975-06b; D1298-99; D445-97; D93-99c; D4176-93; D2709-96e; D1552-95; D2622-98; D4294-98; D5452-98; D5453-06.
| |
| LaSalle 1 and 2 B 3.8.3-8 Revision 51
| |
| | |
| Diesel Fuel Oil and Starting Air B 3.8.3 Table B 3.8.3-1 (page 1 of 1)
| |
| Division 1, Division 2, Opposite Unit Division 2, & Division 3 DG Usable Fuel Oil Volumes DG SEVEN-DAY FUEL OIL SUPPLY SIX-DAY FUEL OIL SUPPLY Division 1 32,200 gallons 27,600 gallons Division 2 32,200 gallons 27,600 gallons Opposite Unit 32,200 gallons 27,600 gallons Division 2 Division 3 30,000 gallons 25,900 gallons LaSalle 1 and 2 B 3.8.3-9 Revision 40
| |
| | |
| DC SourcesOperating B 3.8.4 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.4 DC SourcesOperating BASES BACKGROUND The station DC electrical power system provides the AC emergency power system with control power. It also provides both motive and control power to selected safety related equipment. As required by 10 CFR 50, Appendix A, GDC 17 (Ref. 1), the DC electrical power system is designed to have sufficient independence, redundancy, and testability to perform its safety functions, assuming a single failure.
| |
| The DC electrical power system also conforms to the requirements of Regulatory Guide 1.6 (Ref. 2) and IEEE-308 (Ref. 3).
| |
| The 125 VDC electrical power system consists of three independent Class 1E DC electrical power subsystems, Divisions 1, 2, and 3. The 250 VDC electric power system consists of one Class 1E DC electrical power subsystem, Division 1. Each subsystem consists of a battery, associated battery charger(s), and all the associated control equipment and interconnecting cabling.
| |
| During normal operation, the DC loads are powered from the battery chargers with the batteries floating on the system.
| |
| In case of loss of normal power to the battery charger, the DC loads are automatically powered from the batteries.
| |
| The Division 1 safety related DC power source consists of one 58 cell, 125 V and one 116 cell, 250 V battery bank and associated full capacity battery charger(s). The Division 1 125 VDC power source provides the control power for its associated Class 1E AC power load group, 4.16 kV switchgear, and 480 V load centers and control power for non-Class 1E loads. Also, the 125 VDC power sources provide DC power to the emergency lighting system, diesel generator (DG) auxiliaries, and the DC control power for the Engineered Safety Feature (ESF) and non-ESF systems. The 250 VDC power source supplies power to the Reactor Core Isolation Cooling (RCIC) System, and RCIC primary containment isolation valves (PCIVs). It also supplies power to the main turbine emergency bearing oil pumps, main generator emergency seal oil pumps, and the process computer, however, these are not Technical Specification related loads.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.4-1 Revision 27
| |
| | |
| DC SourcesOperating B 3.8.4 BASES BACKGROUND The Division 2 safety related DC power source consists of a (continued) 58 cell, 125 V battery bank and associated full capacity chargers. This 125 V battery provides the control power for its associated Class 1E AC power load group, 4.16 kV switchgear, and 480 V load centers and control power for non-Class 1E loads. Also, this 125 V battery provides DC power to the emergency lighting system, diesel generator (DG) auxiliaries, and the DC control power for ESF and non-ESF systems.
| |
| The Division 3 safety related DC power source consists of a 58 cell, 125 V battery bank and associated full capacity charger, and provides power for the High Pressure Core Spray (HPCS) DG field flashing control logic and switching function of 4.16 kV Division 3 breakers. It also provides power for the HPCS System logic, HPCS DG control and protection, and Division 3 related controls.
| |
| The opposite unit Division 2 safety related DC power source consists of a 58 cell, 125 V battery bank and associated full capacity chargers. This 125 V battery provides the control power for its associated Class 1E AC power load group, 4.16 kV switchgear, and 480 V load centers and control power for non-Class 1E loads. Also, this 125 V battery provides DC power to the opposite unit's emergency lighting system, diesel generator (DG) auxiliaries, and DC control power for the ESF and non-ESF systems.
| |
| The DC power distribution system is described in more detail in the Bases for LCO 3.8.7, "Distribution Systems-Operating," and LCO 3.8.8, "Distribution Systems-Shutdown."
| |
| Each DC battery subsystem is separately housed in a ventilated room apart from its charger and distribution centers. Each subsystem is located in an area separated physically and electrically from the other subsystems to ensure that a single failure in one subsystem does not cause a failure in a redundant subsystem. There is no sharing between redundant Class 1E subsystems such as batteries, battery chargers, or distribution panels.
| |
| Each Division 1, 2, and 3 battery has adequate storage capacity to meet the duty cycle(s) discussed in the UFSAR, Section 8.3.2 (Ref. 4). The battery is designed with (continued)
| |
| LaSalle 1 and 2 B 3.8.4-2 Revision 27
| |
| | |
| DC SourcesOperating B 3.8.4 BASES BACKGROUND additional capacity above that required by the design duty (continued) cycle to allow for temperature variations and other factors.
| |
| Based on LaSalle Station battery sizing calculations, Divisions 1 and 2 batteries have a design margin of at least 5% (Ref. 9). The Division 3 batteries have a design margin of at least 10% (Ref. 9).
| |
| The backup battery chargers associated with the Division 1 and Division 2 125 VDC system are fully qualified chargers that are powered from a diesel generator backed safety related (Class 1E) distribution system, and are fully capable of supporting system design requirements. These 100% capacity battery chargers are the alternate means for supporting the Division 1 and Division 2 125 VDC systems.
| |
| The batteries for a DC electrical power subsystem are sized to produce required capacity at 80% of nameplate rating, corresponding to warranted capacity at end of life cycles and the 100% design demand. The minimum design voltage limit is 105/210 V.
| |
| The battery cells are of flooded lead acid construction with a nominal specific gravity of 1.215. This specific gravity corresponds to an open circuit battery voltage of approximately 120 V for a 58 cell battery and 240 V for a 116 cell battery (i.e., cell voltage of 2.065 volts per cell (Vpc)). The open circuit voltage is the voltage maintained when there is no charging or discharging. Once fully charged with its open circuit voltage > 2.065 Vpc, the battery will maintain its capacity for 30 days without further charging per manufacturers instructions. Optimal long term performance however, is obtained by maintaining a float voltage 2.17 Vpc to 2.25 Vpc for Division 1 and Division 2 and maintaining a float voltage of 2.20 Vpc to 2.25 Vpc for Division 3. This provides adequate over-potential, which limits the formation of lead sulfate and self discharge. The nominal float voltage of 2.23 Vpc corresponds to a total float voltage output of 129.3 V for a 58 cell battery and 258.7 V for a 116 cell battery as discussed in the UFSAR, Section 8.3.2 (Ref. 4).
| |
| Each Division 1, 2, and 3 DC electrical power subsystem battery charger has ample power output capacity for the steady state operation of connected loads required during (continued)
| |
| LaSalle 1 and 2 B 3.8.4-3 Revision 51
| |
| | |
| DC SourcesOperating B 3.8.4 BASES BACKGROUND normal operation, while at the same time maintaining its (continued) battery bank fully charged. Each battery charger has sufficient capacity to restore the battery bank from the design minimum charge to its fully charged state within 24 hours while supplying normal steady state loads (Ref. 4).
| |
| The battery charger is normally in the float-charge mode.
| |
| Float-charge is the condition in which the charger is supplying the connected loads and the battery cells are receiving adequate current to optimally charge the battery. This assures the internal losses of the battery are overcome and the battery is maintained in a fully charged state.
| |
| When desired, the charger can be placed in the equalize mode. The equalize mode is at a higher voltage than the float mode. The battery charger is operated in the equalize mode after a battery discharge or for routine maintenance.
| |
| Following a battery discharge, the battery recharge characteristic accepts current at the current limit of the battery charger (if the discharge was significant, e.g.,
| |
| following a battery service test) until the battery terminal voltage approaches the charger voltage setpoint. Charging current then reduces exponentially during the remainder of the recharge cycle.
| |
| APPLICABLE The initial conditions of Design Basis Accident (DBA) and SAFETY ANALYSES transient analyses in the UFSAR, Chapter 6 (Ref. 5), and Chapter 15 (Ref. 6), assume that ESF systems are OPERABLE.
| |
| The DC electrical power system provides normal and emergency DC electrical power for the DGs, emergency auxiliaries, and control and switching during all MODES of operation.
| |
| The OPERABILITY of the DC subsystems is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit. This includes maintaining DC sources OPERABLE during accident conditions in the event of:
| |
| : a. An assumed loss of all offsite AC power or of all onsite AC power; and
| |
| : b. A worst case single failure.
| |
| The DC sources satisfy Criterion 3 of 10CFR50.36(c)(2)(ii).
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.4-4 Revision 27
| |
| | |
| DC SourcesOperating B 3.8.4 BASES (continued)
| |
| LCO The Division 1 125 VDC and 250 VDC, Division 2 125 VDC, and Division 3 125 VDC, and opposite unit Division 2 125 VDC electrical power subsystems, each subsystem consisting of one battery, one required battery charger, and the corresponding control equipment and interconnecting cabling supplying power to the associated bus within the divisions, are required to be OPERABLE to ensure the availability of the required power to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence (AOO) or a postulated DBA. Loss of any DC electrical power subsystem does not prevent the minimum safety function from being performed (Ref. 4).
| |
| APPLICABILITY The DC electrical power sources are required to be OPERABLE in MODES 1, 2, and 3 to ensure safe unit operation and to ensure that:
| |
| : a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients; and
| |
| : b. Adequate core cooling is provided, and containment integrity and other vital functions are maintained in the event of a postulated DBA.
| |
| The DC electrical power requirements for MODES 4 and 5 and other conditions in which the DC electrical power sources are required are addressed in LCO 3.8.5, "DC Sources Shutdown."
| |
| ACTIONS A.1, A.2, and A.3 Condition A represents one redundant ESF division with one required battery charger inoperable or the inoperability of one required battery charger on the 250 VDC electrical power subsystem supporting RCIC (e.g., the voltage limit of SR 3.8.4.1 is not maintained). The ACTIONS provide a tiered response that focuses on returning the battery to the fully charged state and restoring the fully qualified charger to OPERABLE status in a reasonable time period. Required (continued)
| |
| LaSalle 1 and 2 B 3.8.4-5 Revision 27
| |
| | |
| DC SourcesOperating B 3.8.4 BASES ACTIONS A.1, A.2, and A.3 (continued)
| |
| Action A.1 requires that the battery terminal voltage be restored to greater than or equal to the minimum established float voltage within 2 hours. This time provides for returning the inoperable charger to OPERABLE status or providing an alternate means of restoring battery terminal voltage to greater than or equal to the minimum established float voltage. Restoring the battery terminal voltage to greater than or equal to the minimum established float voltage provides good assurance that, within 12 hours, the battery will be restored to its fully charged condition (Required Action A.2) from any discharge that might have occurred due to the charger inoperability. A discharged battery having terminal voltage of at least the minimum established float voltage indicates that the battery is on the exponential charging current portion (the second part) of its recharge cycle. The time to return a battery to its fully charged state under this condition is simply a function of the amount of the previous discharge and the recharge characteristic of the battery. Thus there is good assurance of fully recharging the battery within 12 hours, avoiding a premature shutdown with its own attendant risk.
| |
| If battery terminal float voltage cannot be restored to greater than or equal to the minimum established float voltage within 2 hours, and the charger is not operating in the current-limiting mode, a faulty charger is indicated. A faulty charger that is incapable of maintaining established battery terminal float voltage does not provide adequate assurance that it can revert to and operate properly in the current limit mode that is necessary during the recovery period following a battery discharge event for which the DC system is designed.
| |
| If the charger is operating in the current-limit mode after 2 hours that is an indication that the battery is partially discharged and its capacity margins will be reduced. The time to return the battery to its fully charged condition in this case is a function of the battery charger capacity, the amount of loads on the associated DC system, the amount of the previous discharge, and the recharge characteristic of the battery. The charge time can be extensive, and there is not adequate assurance that it can be recharged within 12 hours (Required Action A.2).
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.4-6 Revision 27
| |
| | |
| DC SourcesOperating B 3.8.4 BASES ACTIONS A.1, A.2, and A.3 (continued)
| |
| Required Action A.2 requires that the battery float current be verified as less than or equal to 2 amps. This indicates that, if the battery has been discharged as a result of the inoperable battery charger, it has now been fully recharged.
| |
| If at the expiration of the initial 12 hour period the battery float current is not less than or equal to 2 amps, this indicates there may be additional battery problems and the battery must be declared inoperable.
| |
| Required Action A.3 limits the restoration time for the inoperable battery charger to 7 days or in accordance with the Risk Informed Completion Time Program. This action is applicable if an alternate means of restoring battery terminal voltage to greater than or equal to the minimum established float voltage has been used (e.g., balance of plant non-Class 1E battery charger). The 7 day Completion Time reflects a reasonable time to effect restoration of the qualified battery charger to OPERABLE status.
| |
| B.1 Condition B represents one division with a loss of ability to completely respond to an event, and a potential loss of ability to remain energized during normal operation. It is, therefore, imperative that the operator's attention focus on stabilizing the unit, minimizing the potential for complete loss of DC power to the affected division. The 2 hour limit is consistent with the allowed time for an inoperable DC distribution system division. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.
| |
| If one of the Division 1 or 2 125 VDC electrical power subsystems is inoperable for reasons other than Condition A (e.g., inoperable battery), the remaining DC electrical power subsystems have the capacity to support a safe shutdown and to mitigate an accident condition. Since a subsequent worst case single failure could, however, result in the loss of minimum necessary DC electrical subsystems, continued power operation should not exceed 2 hours. The 2 hour Completion Time is based on Regulatory Guide 1.93 (Ref. 7) and reflects a reasonable time to assess unit (continued)
| |
| LaSalle 1 and 2 B 3.8.4-7 Revision 89
| |
| | |
| DC SourcesOperating B 3.8.4 BASES ACTIONS B.1 (continued) status as a function of the inoperable DC electrical power subsystem and, if the DC electrical power subsystem is not restored to OPERABLE status, to prepare to effect an orderly and safe unit shutdown.
| |
| C.1 If the Division 3 battery cannot be maintained OPERABLE, the required Division 3 battery charger cannot be restored, or the Division 3 DC electrical power subsystem is inoperable for reasons other than Condition A (e.g., inoperable battery), the HPCS System may be incapable of performing its intended function and must be immediately declared inoperable. This declaration also requires entry into applicable Conditions and Required Actions of LCO 3.5.1, "ECCSOperating."
| |
| D.1 If the Division 1 250 VDC battery cannot be maintained OPERABLE, the required 250 VDC battery charger cannot be restored, or the Division 1 250 VDC electrical power subsystem is inoperable for reasons other than Condition A (e.g., inoperable battery), the RCIC System and the RCIC DC powered PCIVs may be incapable of performing their intended functions and must be immediately declared inoperable. This declaration also requires entry into applicable Conditions and Required Actions of LCO 3.5.3, "RCIC System," and LCO 3.6.1.3, "PCIVs."
| |
| E.1 If the opposite unit Division 2 battery cannot be maintained OPERABLE, the required opposite unit Division 2 battery charger cannot be restored, or the opposite unit Division 2 125 VDC electrical power subsystem is inoperable for reasons other than Condition A (e.g., inoperable battery), certain redundant Division 2 features (e.g., a standby gas treatment subsystem) will not function if a design basis event were to occur. Therefore, a 7 day Completion Time is provided to restore the opposite unit (continued)
| |
| LaSalle 1 and 2 B 3.8.4-8 Revision 89
| |
| | |
| DC SourcesOperating B 3.8.4 BASES ACTIONS E.1 (continued)
| |
| Division 2 125 VDC electrical power subsystem to OPERABLE status. The 7 day Completion Time takes into account the capacity and capability of the remaining DC electrical power subsystems, and is based on the shortest restoration time allowed for the systems affected by the inoperable DC electrical power subsystem in the respective system specifications. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.
| |
| F.1 and F.2 If the inoperable Division 1, Division 2, or opposite unit Division 2 DC electrical power subsystem cannot be restored to OPERABLE status within the associated Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. The Completion Time to bring the unit to MODE 4 is consistent with the time specified in Regulatory Guide 1.93 (Ref. 7).
| |
| G.1 If a Division 1 or 2 125 VDC electrical power subsystem is inoperable for reasons other than Condition A and not restored within the provided Completion Time, the plant must be brought to a condition in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 10) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.4-9 Revision 89
| |
| | |
| DC SourcesOperating B 3.8.4 BASES SURVEILLANCE The Surveillances are modified by two Notes to clearly REQUIREMENTS identify how the Surveillances apply to the given unit and opposite unit DC electrical power sources. Note 1 states that SR 3.8.4.1 through SR 3.8.4.3 are applicable only to the given unit DC electrical power sources and Note 2 states that SR 3.8.4.4 is applicable only to the opposite unit DC electrical power sources. These Notes are necessary since opposite unit DC electrical power sources are not required to perform all of the requirements of the given unit DC electrical power sources (e.g., the opposite unit battery is not required to perform SR 3.8.4.2 and 3.8.4.3 under certain conditions when not in MODE 1, 2, or 3).
| |
| SR 3.8.4.1 Verifying battery terminal voltage while on float charge helps to ensure the effectiveness of the battery chargers, which support the ability of the batteries to perform their intended function. Float charge is the condition in which the charger is supplying the continuous charge required to overcome the internal losses of a battery and maintain the battery in a fully charged state while supplying the continuous steady state loads of the associated DC subsystem. On float charge, battery cells will receive adequate current to optimally maintain a charge on the battery. The voltage requirements are based on the nominal design voltage of the battery and are consistent with the minimum float voltage established by the battery manufacturer (2.17 Vpc or 125.86 V for the 125 V Div 1 and Div 2 batteries, 2.20 Vpc or 127.60 V for the 125 V Div 3 battery and 2.17 Vpc or 251.72 for the 250 volt battery at the battery terminals). This voltage maintains the battery plates in a condition that supports maintaining the grid life (expected to be approximately 20 years). The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.8.4.2 This SR verifies the design capacity of the battery chargers. According to Regulatory Guide 1.32 (Ref. 8), the battery charger supply is recommended to be based on the largest combined demands of the various steady state loads and the charging capacity to restore the battery from the design minimum charge state to the fully charged state, (continued)
| |
| LaSalle 1 and 2 B 3.8.4-10 Revision 89
| |
| | |
| DC SourcesOperating B 3.8.4 BASES SURVEILLANCE SR 3.8.4.2 (continued)
| |
| REQUIREMENTS irrespective of the status of the unit during these demand occurrences. The minimum required amperes and duration ensure that these requirements can be satisfied.
| |
| This SR provides two options. One option requires that each 125 V and 250 V Division 1 and 2 battery charger be capable of supplying 200 amps (50 amps for the 125 V Division 3 charger) at the minimum established float voltage for 4 hours. The ampere requirements are based on the output rating of the chargers. The voltage requirements are based on the charger voltage level after a response to a loss of AC power. The time period is sufficient for the charger temperature to have stabilized and to have been maintained for at least 2 hours.The other option requires that each battery charger be capable of recharging the battery after a service test coincident with supplying the largest coincident demands of the various continuous steady state loads (irrespective of the status of the plant during which these demands occur). This level of loading may not be normally available following the battery service test and will need to be supplemented with additional loads. The duration for this test may be longer than the charger sizing criteria since the battery recharge is affected by float voltage, temperature, and the exponential decay in charging current. The battery is recharged when the measured charging current is < 2 amps.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.8.4.3 A battery service test is a special test of the battery's capability, as found, to satisfy the design requirements (battery duty cycle) of the DC electrical power system. The discharge rate and test length correspond to the design duty cycle requirements as specified in Reference 4.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by two Notes. Note 1 allows the performance of a modified performance discharge test in (continued)
| |
| LaSalle 1 and 2 B 3.8.4-11 Revision 89
| |
| | |
| DC SourcesOperating B 3.8.4 BASES SURVEILLANCE SR 3.8.4.3 (continued)
| |
| REQUIREMENTS lieu of a service test. This substitution is acceptable because a modified performance discharge test represents a more severe test of battery capacity than SR 3.8.4.3. The reason for Note 2 is that performing the Surveillance would remove a required 125 VDC electrical power subsystem from service, perturb the electrical distribution system, and challenge safety systems. The Division 3 test may be performed in MODE 1 or 2 in conjunction with HPCS system outages. This restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow portions of the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial Surveillance, a successful partial Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when portions of the Surveillance are performed in MODE 1 or 2.
| |
| Risk insights or deterministic methods may be used for this assessment. Credit may be taken for unplanned events that satisfy the Surveillance.
| |
| SR 3.8.4.4 With the exception of this Surveillance, all other Surveillances of this Specification (SR 3.8.4.1 through 3.8.4.3) are applied to the given unit DC sources. This Surveillance is provided to direct that appropriate Surveillances for the required opposite unit DC source are governed by the applicable opposite unit Technical Specifications. Performance of the applicable opposite unit Surveillances will satisfy the opposite unit requirements as well as satisfy the given unit Surveillance Requirement.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.4-12 Revision 89
| |
| | |
| DC SourcesOperating B 3.8.4 BASES SURVEILLANCE SR 3.8.4.4 (continued)
| |
| REQUIREMENTS The Frequency required by the applicable opposite unit SR also governs performance of that SR for the given unit.
| |
| As noted, if the opposite unit is in MODE 4 or 5, or moving irradiated fuel assemblies in secondary containment, SR 3.8.4.2 and SR 3.8.4.3 are not required to be performed.
| |
| This ensures that a given unit SR will not require an opposite unit SR to be performed, when the opposite unit Technical Specifications exempts performance of an opposite unit SR (however, as stated in the opposite unit SR 3.8.5.1 Note 1, while performance of an SR is exempted, the SR must still be met).
| |
| REFERENCES 1. 10 CFR 50, Appendix A, GDC 17.
| |
| : 2. Regulatory Guide 1.6, March 10, 1971.
| |
| : 3. IEEE Standard 308, 1971.
| |
| : 4. UFSAR, Section 8.3.2.
| |
| : 5. UFSAR, Chapter 6.
| |
| : 6. UFSAR, Chapter 15.
| |
| : 7. Regulatory Guide 1.93, December 1974.
| |
| : 8. Regulatory Guide 1.32, August 1972.
| |
| : 9. NRC ReGulatory Commitment documented in letter from D. M. Benyak to NRC, Additional Information Supporting the License Amendment Request Associated with Direct Current Electrical Request, dated September 13, 2006.
| |
| : 10. NEDC-32988-A, Revision 2, "Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants," December 2002.
| |
| LaSalle 1 and 2 B 3.8.4-13 Revision 89
| |
| | |
| DC SourcesShutdown B 3.8.5 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.5 DC SourcesShutdown BASES BACKGROUND A description of the DC sources is provided in the Bases for LCO 3.8.4, "DC SourcesOperating."
| |
| APPLICABLE The initial conditions of Design Basis Accident and SAFETY ANALYSES transient analyses in the UFSAR, Chapter 6 (Ref. 1) and Chapter 15 (Ref. 2), assume that Engineered Safety Feature systems are OPERABLE. The DC electrical power system provides normal and emergency DC electrical power for the diesel generators, emergency auxiliaries, and control and switching during all MODES of operation and during movement of irradiated fuel assemblies in the secondary containment.
| |
| The OPERABILITY of the DC subsystems is consistent with the initial assumptions of the accident analyses and the requirements for the supported systems' OPERABILITY.
| |
| The OPERABILITY of the minimum DC electrical power sources during MODES 4 and 5 and during movement of irradiated fuel assemblies in the secondary containment ensures that:
| |
| : a. The facility can be maintained in the shutdown or refueling condition for extended periods;
| |
| : b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and
| |
| : c. Adequate DC electrical power is provided to mitigate events postulated during shutdown, such as a fuel handling accident.
| |
| In general, when the unit is shut down, the Technical Specifications requirements ensure that the unit has the capability to mitigate the consequences of postulated accidents. However, assuming a single failure and concurrent loss of all offsite or all onsite power is not required. The rationale for this is based on the fact that many Design Basis Accidents (DBAs) that are analyzed in MODES 1, 2, and 3 have no specific analyses in MODES 4 (continued)
| |
| LaSalle 1 and 2 B 3.8.5-1 Revision 76
| |
| | |
| DC SourcesShutdown B 3.8.5 BASES APPLICABLE and 5. Worst case bounding events are deemed not credible SAFETY ANALYSES in MODES 4 and 5 because the energy contained within the (continued) reactor pressure boundary, reactor coolant temperature and pressure, and the corresponding stresses result in the probabilities of occurrence being significantly reduced or eliminated, and in minimal consequences. These deviations from DBA analysis assumptions and design requirements during shutdown conditions are allowed by the LCO for required systems.
| |
| The shutdown Technical Specification requirements are designed to ensure that the unit has the capability to mitigate the consequences of certain postulated accidents.
| |
| Worst case Design Basis Accidents which are analyzed for operating MODES are generally viewed not to be a significant concern during shutdown MODES due to the lower energies involved. The Technical Specifications therefore require a lesser complement of electrical equipment to be available during shutdown than is required during operating MODES.
| |
| More recent work completed on the potential risks associated with shutdown, however, have found significant risk associated with certain shutdown evolutions. As a result, in addition to the requirements established in the Technical Specifications, the Industry has adopted NUMARC 91-06, "Guidelines for Industry Actions to Assess Shutdown Management," as an industry initiative to manage shutdown tasks and associated electrical support to maintain risk at an acceptable low level. This may require the availability of additional equipment beyond that required by the shutdown Technical Specifications.
| |
| The DC sources satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The DC electrical power subsystems, each required subsystem consisting of one battery, one required battery charger, and the corresponding control equipment and interconnecting cabling supplying power to the associated buses within the division, are required to be OPERABLE to support some of the required DC Distribution System divisions required OPERABLE by LCO 3.8.8, "Distribution SystemsShutdown." This ensures the availability of sufficient DC electrical power sources to operate the unit in a safe manner and to mitigate the (continued)
| |
| LaSalle 1 and 2 B 3.8.5-2 Revision 27
| |
| | |
| DC SourcesShutdown B 3.8.5 BASES LCO consequences of postulated events during shutdown (continued) (e.g., fuel handling accidents).
| |
| APPLICABILITY The DC electrical power sources required to be OPERABLE in MODES 4 and 5 and during movement of irradiated fuel assemblies in the secondary containment provide assurance that:
| |
| : a. Required features to provide core cooling are available;
| |
| : b. Required features needed to mitigate a fuel handling accident are available;
| |
| : c. Required features necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and
| |
| : d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.
| |
| The DC electrical power requirements for MODES 1, 2, and 3 are covered in LCO 3.8.4.
| |
| ACTIONS LCO 3.0.3 is not applicable while in MODE 4 or 5. However, since irradiated fuel assembly movement can occur in MODE 1, 2, or 3, the ACTIONS have been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 4 or 5, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Entering LCO 3.0.3 while in MODE 1, 2, or 3 would require the unit to be shutdown, but would not require immediate suspension of movement of irradiated fuel assemblies. The Note to the ACTIONS, "LCO 3.0.3 is not applicable," ensures that the actions for immediate suspension of irradiated fuel assembly movement are not postponed due to entry into LCO 3.0.3.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.5-3 Revision 76
| |
| | |
| DC SourcesShutdown B 3.8.5 BASES ACTIONS A.1, A.2, and A.3 (continued)
| |
| Condition A represents one required division with one required battery charger inoperable (e.g., the voltage limit of SR 3.8.4.1 is not maintained). This Condition is only entered under plant conditions in which LCO 3.8.8, Distribution Systems - Shutdown, requires more than one division of Class 1E DC Electrical Power Distribution (e.g.,
| |
| during CORE ALTERATIONS, LCO 3.8.8 requires the operability of both the Division 2 and the opposite unit Division 2 DC electrical power distribution subsystems). Although the High Pressure Core Spray (HPCS) System is typically considered a single division system, for this Condition, Division 3 (HPCS System) is considered redundant to Division 1 and 2 Emergency Core Cooling Systems. If the redundant required division battery or battery charger are inoperable, or as stated above, LCO 3.8.8 does not require a redundant DC electrical power distribution subsystem, then Condition B must be entered.
| |
| The ACTIONS provide a tiered response that focuses on returning the battery to the fully charged state and restoring the fully qualified charger to OPERABLE status in a reasonable time period. Required Action A.1 requires that the battery terminal voltage be restored to greater than or equal to the minimum established float voltage within 2 hours. This time provides for returning the inoperable charger to OPERABLE status or providing an alternate means of restoring battery terminal voltage to greater than or equal to the minimum established float voltage. Restoring the battery terminal voltage to greater than or equal to the minimum established float voltage provides good assurance that, within 12 hours, the battery will be restored to its fully charged condition (Required Action A.2) from any discharge that might have occurred due to the charger inoperability. A discharged battery having terminal voltage of at least the minimum established float voltage indicates that the battery is on the exponential charging current portion (the second part) of its recharge cycle. The time to return a battery to its fully charged state under this condition is simply a function of the amount of the previous discharge and the recharge characteristic of the battery.
| |
| Thus there is good assurance of fully recharging the battery within 12 hours, avoiding a premature shutdown with its own attendant risk.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.5-4 Revision 27
| |
| | |
| DC SourcesShutdown B 3.8.5 BASES ACTIONS A.1, A.2, and A.3 (continued)
| |
| If battery terminal float voltage cannot be restored to greater than or equal to the minimum established float voltage within 2 hours, and the charger is not operating in the current-limiting mode, a faulty charger is indicated. A faulty charger that is incapable of maintaining established battery terminal float voltage does not provide adequate assurance that it can revert to and operate properly in the current limit mode that is necessary during the recovery period following a battery discharge event that the DC system is designed for.
| |
| If the charger is operating in the current limit mode after 2 hours that is an indication that the battery is partially discharged and its capacity margins will be reduced. The time to return the battery to its fully charged condition in this case is a function of the battery charger capacity, the amount of loads on the associated DC system, the amount of the previous discharge, and the recharge characteristic of the battery. The charge time can be extensive, and there is not adequate assurance that it can be recharged within 12 hours (Required Action A.2).
| |
| Required Action A.2 requires that the battery float current be verified as less than or equal to 2 amps. This indicates that, if the battery has been discharged as a result of the inoperable battery charger, it has now been fully recharged.
| |
| If at the expiration of the initial 12 hour period the battery float current is not less than or equal to 2 amps, this indicates there may be additional battery problems and the battery must be declared inoperable.
| |
| Required Action A.3 limits the restoration time for the inoperable battery charger to 7 days. This action is applicable if an alternate means of restoring battery terminal voltage to greater than or equal to the minimum established float voltage has been used (e.g., balance of plant non-Class 1E battery charger). The 7 day Completion Time reflects a reasonable time to effect restoration of the qualified battery charger to OPERABLE status.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.5-5 Revision 27
| |
| | |
| DC SourcesShutdown B 3.8.5 BASES ACTIONS B.1, B.2.1, B.2.2, and B.2.3 (continued)
| |
| By allowing the option to declare required features inoperable with associated DC electrical power subsystems inoperable, appropriate restrictions are implemented in accordance with the affected system LCOs' ACTIONS. However, in many instances this option may involve undesired administrative efforts. Therefore, the allowance for sufficiently conservative actions is made (i.e., to suspend CORE ALTERATIONS and movement of irradiated fuel assemblies in the secondary containment).
| |
| Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition.
| |
| These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required DC electrical power subsystems and to continue this action until restoration is accomplished in order to provide the necessary DC electrical power to the plant safety systems.
| |
| The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required DC electrical power subsystems should be completed as quickly as possible in order to minimize the time during which the plant safety systems may be without sufficient power.
| |
| SURVEILLANCE SR 3.8.5.1 REQUIREMENTS SR 3.8.5.1 requires all Surveillances required by SR 3.8.4.1 through SR 3.8.4.4 to be applicable. Therefore, see the corresponding Bases for LCO 3.8.4 for a discussion of each SR.
| |
| This SR is modified by a Note. The reason for the Note is to preclude requiring the OPERABLE DC sources from being discharged below their capability to provide the required power supply or otherwise rendered inoperable during the performance of SRs. It is the intent that these SRs must still be capable of being met, but actual performance is not required.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.5-6 Revision 76
| |
| | |
| DC SourcesShutdown B 3.8.5 BASES (continued)
| |
| REFERENCES 1. UFSAR, Chapter 6.
| |
| : 2. UFSAR, Chapter 15.
| |
| LaSalle 1 and 2 B 3.8.5-7 Revision 27
| |
| | |
| Battery Parameters B 3.8.6 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.6 Battery Parameters BASES BACKGROUND This LCO delineates the limits on battery float current as well as electrolyte temperature, level, and float voltage for the DC power source batteries. A discussion of these batteries and their OPERABILITY requirements is provided in the Bases for LCO 3.8.4, "DC SourcesOperating," and LCO 3.8.5, "DC SourcesShutdown." In addition to the limitations of this Specification, the Battery Monitoring and Maintenance Program described in the Technical Requirements Manual (Ref. 7) implements the program specified in Specification 5.5.14 for monitoring various battery parameters including temperature, voltage, and level requirements that are based on the recommendations of IEEE Standard 450, IEEE Recommended Practice for Maintenance, Testing, and Replacement of Vented Lead-Acid Batteries for Stationary Applications (Ref. 4).
| |
| The battery cells are of flooded lead acid construction with a nominal specific gravity of 1.215. This specific gravity corresponds to an open circuit battery voltage of approximately 120 V for a 58 cell battery and 240 V for a 116 cell battery (i.e., cell voltage of 2.065 volts per cell (Vpc)). The open circuit voltage is the voltage maintained when there is no charging or discharging. Once fully charged with its open circuit voltage > 2.065 Vpc, the battery will maintain its capacity for 30 days without further charging per manufacturers instructions. Optimal long term performance however, is obtained by maintaining a float voltage of 2.17 Vpc to 2.25 Vpc for Division 1 and Division 2 and maintainting a float voltage of 2.20 to 2.25 Vpc for Division 3. This provides adequate over-potential, which limits the formation of lead sulfate and self discharge. The nominal float voltage of 2.23 Vpc corresponds to a total float voltage output of 129.3 V for a 58 cell battery and 258.7 V for a 116 cell battery as discussed in the UFSAR, Section 8.3.2 (Ref. 2).
| |
| APPLICABLE The initial conditions of Design Basis Accident (DBA) and SAFETY ANALYSES transient analyses in UFSAR, Chapter 6 (Ref. 1) and Chapter 15 (Ref. 3), assume Engineered Safety Feature systems are OPERABLE. The DC electrical power subsystems (continued)
| |
| LaSalle 1 and 2 B 3.8.6-1 Revision 27
| |
| | |
| Battery Parameters B 3.8.6 BASES APPLICABLE provide normal and emergency DC electrical power for the SAFETY ANALYSES diesel generators, emergency auxiliaries, and control and (continued) switching during all MODES of operation.
| |
| ACTIONS The OPERABILITY of the DC subsystems is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit as discussed in the Bases for LCO 3.8.4 and LCO 3.8.5.
| |
| Since battery parameters support the operation of the DC power sources, they satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO Battery parameters must remain within acceptable limits to ensure availability of the required DC power to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence or a postulated DBA.
| |
| Battery parameter limits are conservatively established, allowing continued DC electrical system function even with limits not met. Additional preventative maintenance, testing, and monitoring performed in accordance with the Battery Monitoring and Maintenance Program is conducted as specified in Specification 5.5.14.
| |
| APPLICABILITY The battery parameters are required solely for the support of the associated DC electrical power subsystem. Therefore, battery parameter limits are only required when the associated DC electrical power subsystem is required to be OPERABLE. Refer to the Applicability discussion in Bases for LCO 3.8.4 and LCO 3.8.5.
| |
| The ACTIONS Table is modified by a Note which indicates that separate Condition entry is allowed for each battery. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable DC electrical power subsystem. Complying with the Required Actions for one inoperable DC electrical power subsystem may allow for continued operation, and subsequent inoperable DC electrical power subsystem(s) are governed by separate Condition entry and application of associated Required Actions.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.6-2 Revision 27
| |
| | |
| Battery Parameters B 3.8.6 BASES (continued)
| |
| ACTIONS A.1, A.2, and A.3 With one or more cells of a battery < 2.07 V, the battery is degraded. Within 2 hours, verification of the required battery charger OPERABILITY is made by monitoring the battery terminal voltage (SR 3.8.4.1) and the overall battery state of charge by monitoring the battery float charge current (SR 3.8.6.1). This assures that there is still sufficient battery capacity to perform the intended function. Therefore, the affected battery is not required to be considered inoperable solely as a result of one or more cells in the battery being < 2.07 V, and continued operation is permitted for a limited period of up to 24 hours.
| |
| Since the Required Actions only specify perform, a failure of SR 3.8.4.1 or SR 3.8.6.1 acceptance criteria does not result in the Required Action not met. However, if one of the SRs is failed, the appropriate Condition(s), depending on the cause of the failure, is entered. If SR 3.8.6.1 is failed, then there is not assurance that there is still sufficient battery capacity to perform the intended function and the battery must be declared inoperable immediately as specified in Condition F.
| |
| B.1 and B.2 One or more batteries with float current > 2 amps indicates that a partial discharge of the battery capacity has occurred. This may be due to a temporary loss of a battery charger or possibly due to one or more battery cells in a low voltage condition reflecting some loss of capacity.
| |
| Within 2 hours, verification of the required battery charger OPERABILITY is made by monitoring the battery terminal voltage. If the terminal voltage is found to be less than the minimum established float voltage, there are two possibilities; the battery charger is inoperable or is operating in the current limit mode. Condition A of LCO 3.8.4 and LCO 3.8.5 address charger inoperability. If the charger is operating in the current limit mode after 2 hours, that is an indication that the battery has been substantially discharged and likely cannot perform its required design functions. The time to return the battery to its fully charged condition in this case is a function of the battery charger capacity, the amount of loads on the associated DC system, the amount of the previous discharge, (continued)
| |
| LaSalle 1 and 2 B 3.8.6-3 Revision 27
| |
| | |
| Battery Parameters B 3.8.6 BASES ACTIONS B.1 and B.2 (continued) and the recharge characteristic of the battery. The charge time can be extensive, and there is not adequate assurance that it can be recharged within 12 hours (Required Action B.2). The battery must therefore be declared inoperable as specified in Condition F.
| |
| If the float voltage is found to be satisfactory, but there are one or more battery cells with float voltage less than 2.07 V, the associated OR statement in Condition F is applicable and the battery must be declared inoperable immediately. If float voltage is satisfactory and there are no battery cells less than 2.07 V, there is good assurance that, within 12 hours, the battery will be restored to its fully charged condition (Required Action B.2) from any discharge that might have occurred due to a temporary loss of the battery charger. A discharged battery with float voltage (the charger setpoint) across its terminals indicates that the battery is on the exponential charging current portion (the second part) of its recharge cycle.
| |
| The time to return a battery to its fully charged state under this condition is simply a function of the amount of the previous discharge and the recharge characteristic of the battery. Thus there is good assurance of fully recharging the battery within 12 hours, avoiding a premature shutdown with its own attendant risk.
| |
| If the condition is due to one or more cells in a low voltage condition but still greater than 2.07 V and float voltage is found to be satisfactory, this is not an indication of a substantially discharged battery and 12 hours is a reasonable time prior to declaring the battery inoperable.
| |
| Since Required Action B.1 only specifies perform, a failure of SR 3.8.4.1 acceptance criteria does not result in the Required Action not met. However, if SR 3.8.4.1 is failed, the appropriate Condition(s), depending on the cause of the failure, is entered.
| |
| C.1, C.2, and C.3 With one or more batteries with one or more cells electrolyte level above the top of the plates but below the minimum established design limits, the battery still retains sufficient capacity to perform the intended function.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.6-4 Revision 27
| |
| | |
| Battery Parameters B 3.8.6 BASES ACTIONS C.1, C.2, and C.3 (continued)
| |
| Therefore, the affected battery is not required to be considered inoperable solely as a result of electrolyte level not met. Within 31 days, the minimum established design limits for electrolyte level must be re-established.
| |
| With electrolyte level below the top of the plates, there is a potential for dryout and plate degradation. Required Actions C.1 and C.2 address this potential (as well as provisions in Specification 5.5.14, Battery Maintenance and Monitoring Program). They are modified by a Note that indicates they are only applicable if electrolyte level is below the top of the plates. Within 8 hours, level is required to be restored to above the top of the plates. The Required Action C.2 requirement to verify that there is no leakage by visual inspection and the Specification 5.5.14.b item to initiate action to equalize and test in accordance with the manufacturers recommendation are performed following restoration of the electrolyte level to above the top of the plates. Based on the results of the manufacturers recommended testing, the battery may have to be declared inoperable and the affected cell(s) replaced.
| |
| D.1 With one or more batteries with pilot cell temperature less than the minimum established design limits, 12 hours is allowed to restore the temperature to within limits. A low electrolyte temperature limits the current and power available. Since the battery is sized with margin, while battery capacity is degraded, sufficient capacity exists to perform the intended function and the affected battery is not required to be considered inoperable solely as a result of pilot cell temperature not met.
| |
| E.1 If two or more redundant division (e.g., both the Division 2 and the opposite unit Division 2) batteries have battery parameters not within limits there is not sufficient assurance that battery capacity has not been affected to the degree that the batteries are can still perform their required function, given that redundant batteries are involved. With redundant batteries involved, this potential could result in a total loss of function on multiple systems that rely upon the batteries. The longer Completion Times (continued)
| |
| LaSalle 1 and 2 B 3.8.6-5 Revision 27
| |
| | |
| Battery Parameters B 3.8.6 BASES ACTIONS E.1 (continued) specified for battery parameters on non-redundant batteries not within limits are therefore not appropriate, and the parameters must be restored to within limits on at least one affected division within 2 hours. Although the High Pressure Core Spray (HPCS) System is typically considered a single division system, for this Condition, the Division 3 (HPCS System) battery is considered redundant to Division 1 and 2 batteries for the Emergency Core Cooling function.
| |
| F.1 When any battery parameter is outside the allowances of the Required Actions for Condition A, B, C, D, or E, sufficient capacity to supply the maximum expected load requirement is not assured and the corresponding battery must be declared inoperable. Additionally, discovering a battery with one or more battery cells float voltage less than 2.07 V and float current greater than 2 amps indicates that the battery capacity may not be sufficient to perform the intended functions. The battery must therefore be declared inoperable immediately.
| |
| SURVEILLANCE SR 3.8.6.1 REQUIREMENTS Verifying battery float current while on float charge is used to determine the state of charge of the battery. Float charge is the condition in which the charger is supplying the continuous charge required to overcome the internal losses of a battery and maintain the battery in a fully charged state. The float current requirements are based on the float current indicative of a charged battery. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| This SR is modified by a Note that states the float current requirement is not required to be met when battery terminal voltage is less than the minimum established float voltage of SR 3.8.4.1. When this float voltage is not maintained, the Required Actions of LCO 3.8.4 or LCO 3.8.5 ACTION A, as applicable, are being taken, which provide the necessary and appropriate verifications of battery condition.
| |
| Furthermore, the float current limit of 2 amps is established based on the nominal float voltage and is not directly applicable when this voltage is not maintained.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.6-6 Revision 51
| |
| | |
| Battery Parameters B 3.8.6 BASES SURVEILLANCE SR 3.8.6.2 and SR 3.8.6.5 REQUIREMENTS (continued) Optimal long term battery performance is obtained by maintaining a float voltage greater than or equal to the minimum established design limits provided by the manufacturer, which corresponds to 125.86 V for the Division 1 and 2 125 V batteries, 127.60 V for the Division 3 125 V battery and 251.72 V for the 250 V battery at the battery terminals or 2.17 Vpc for Division 1 and 2 and 2.20 Vpc for Division 3. This provides adequate over-potential, which limits the formation of lead sulfate and self discharge, which could eventually render the battery inoperable. Float voltage in this range or less, but greater than 2.07 Vpc, is addressed in Specification 5.5.14.
| |
| SRs 3.8.6.2 and 3.8.6.5 require verification that the cell float voltages are equal to or greater than the short term absolute minimum voltage of 2.07 V. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.8.6.3 The limit specified for electrolyte level ensures that the plates suffer no physical damage and maintains adequate electron transfer capability. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.8.6.4 This Surveillance verifies that the pilot cell temperature is greater than or equal to the minimum established design limit (i.e., 60°F for 125 V batteries and 65°F for the 250 V battery). Pilot cell electrolyte temperature is maintained above this temperature to assure the battery can provide the required current and voltage to meet the design requirements. Temperatures lower than assumed in the battery sizing calculations may act to inhibit or reduce battery capacity. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.6-7 Revision 51
| |
| | |
| Battery Parameters B 3.8.6 BASES SURVEILLANCE SR 3.8.6.6 REQUIREMENTS (continued) A battery performance discharge test is a test of constant current capacity of a battery, normally done in the as found condition, after having been in service, to detect any change in the capacity determined by the acceptance test.
| |
| The test is intended to determine overall battery degradation due to age and usage.
| |
| Either the battery performance discharge test or the modified performance discharge test is acceptable for satisfying SR 3.8.6.6; however, only the modified performance discharge test may be used to satisfy the battery service test requirements of SR 3.8.4.3 at the same time.
| |
| A modified performance discharge test is a test of the battery capacity and its ability to provide a high rate, short duration load (usually the highest rate of the duty cycle). This will often confirm the battery's ability to meet the critical period of the load duty cycle, in addition to determining its percentage of rated capacity. Initial conditions for the modified performance discharge test should be identical to those specified for a service test when the modified performance discharge test is performed in lieu of a service test.
| |
| A battery modified performance discharge test is a simulated duty cycle normally consisting of multiple rates; these rates include the test rate employed for the performance discharge test and the rates published for the current load of the duty cycle, both of which envelope the duty cycle of the service test. (The test can consist of a single rate if the test rate employed for the performance discharge test envelopes the duty cycle of the service test). The battery terminal voltage for the modified performance discharge test must remain above the minimum battery terminal voltage specified in the battery service test for the duration of time equal to that of the service test.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.6-8 Revision 27
| |
| | |
| Battery Parameters B 3.8.6 BASES SURVEILLANCE SR 3.8.6.6 (continued)
| |
| REQUIREMENTS The acceptance criteria for this Surveillance is consistent with IEEE-450 (Ref. 4) and IEEE-485 (Ref. 5). These references recommend that the battery be replaced if its capacity is below 80% of the manufacturer's rating, since IEEE-485 (Ref. 5) recommends using an aging factor of 125%
| |
| in the battery sizing calculation. A capacity of 80% shows that the battery rate of deterioration is increasing, even if there is ample capacity to meet the load requirements.
| |
| Furthermore, the battery is sized to meet the assumed duty cycle loads when the battery design capacity reaches this 80% limit. If an aging factor other than 125% is used, the minimum capacity should be adjusted accordingly.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. If the battery shows degradation, or if the battery has reached 85% of its expected life and capacity is < 100% of the manufacturers rating, the Surveillance Frequency is reduced to 12 months.
| |
| However, if the battery shows no degradation but has reached 85% of its expected life, the Surveillance Frequency is only reduced to 24 months for batteries that retain capacity t 100% of the manufacturers rating. Degradation is indicated, consistent with IEEE-450 (Ref. 4), when the battery capacity drops by more than 10% relative to its capacity on the previous performance test or when it is t 10% below the manufacturers rating. The 12 month and 60 month Frequencies are consistent with the recommendations in IEEE-450 (Ref. 4).
| |
| This SR is modified by three Notes. The reason for the first Note is that performing the Surveillance would remove a required 125 VDC electrical power subsystem from service, perturb the electrical distribution system, and challenge safety systems. The Division 3 test may be performed in MODE 1 or 2 in conjunction with HPCS system outages. This restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow portions of the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed (continued)
| |
| LaSalle 1 and 2 B 3.8.6-9 Revision 80
| |
| | |
| Battery Parameters B 3.8.6 BASES SURVEILLANCE SR 3.8.6.6 (continued)
| |
| REQUIREMENTS partial Surveillance, a successful partial Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when portions of the Surveillance are performed in MODE 1 or 2.
| |
| Risk insights or deterministic methods may be used for this assessment. Credit may be taken for unplanned events that satisfy this SR.
| |
| The reason for the second Note is if the opposite unit is in MODE 4 or 5, or moving irradiated fuel assemblies in secondary containment, this Surveillance is not required to be performed for an operating unit. This ensures that a given operating unit SR will not require an opposite unit SR to be performed, when the opposite unit Technical Specifications exempts performance of an opposite unit SR.
| |
| Furthermore, it precludes requiring the OPERABLE DC source on the shutdown unit from being discharged below its capability to provide the required power supply or otherwise be rendered inoperable during the performance of this Surveillance. It is the intent that this SR must still be capable of being met, but actual performance is not required.
| |
| The reason for the third Note is to preclude requiring the OPERABLE DC sources on the shutdown unit from being discharged below their capability to provide the required power supply or otherwise be rendered inoperable during the performance of this SR. It is the intent that this SR must still be capable of being met, but actual performance is not required.
| |
| REFERENCES 1. UFSAR, Chapter 6.
| |
| : 2. UFSAR, Chapter 8.
| |
| : 3. UFSAR, Chapter 15.
| |
| : 4. IEEE Standard 450, 1975.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.6-10 Revision 27
| |
| | |
| Battery Parameters B 3.8.6 BASES REFERENCES 5. IEEE Standard 485, 1983.
| |
| (continued)
| |
| : 6. Technical Requirements Manual
| |
| : 7. NRC Regulatory Commitment documented in letter from D. M. Benyak to NRC, Additional Information Supporting the License Amendment Request Associated with Direct Current Electrical Request, dated September 13, 2006.
| |
| LaSalle 1 and 2 B 3.8.6-11 Revision 27
| |
| | |
| Distribution SystemsOperating B 3.8.7 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.7 Distribution SystemsOperating BASES BACKGROUND The onsite Class 1E AC and DC electrical power distribution system for each unit is divided by division into three independent AC and DC electrical power distribution subsystems. Each unit is also dependent on portions of the opposite unit's Division 2 AC and DC power distribution subsystems.
| |
| The primary AC Distribution System consists of three 4.16 kV emergency buses that are supplied from the transmission system by two physically independent circuits. The Division 2 and 3 emergency buses also have a dedicated onsite diesel generator (DG) source, while the Unit 1 and 2 Division 1 buses share an onsite DG source. The Division 1, 2, and 3 4.16 kV emergency buses are normally supplied through the system auxiliary transformer (SAT). In addition to the SAT, Division 1 and 2 can be supplied from the unit auxiliary transformer or the opposite unit's SAT. Control power for the 4.16 kV breakers is supplied from the Class 1E batteries. Additional description of this system may be found in the Bases for LCO 3.8.1, "AC SourcesOperating,"
| |
| and the Bases for LCO 3.8.4, "DC SourcesOperating."
| |
| The secondary plant AC distribution system includes 480 V ESF load centers and associated loads, motor control centers, and transformers.
| |
| There are three independent 125 VDC electrical power distribution subsystems. The Division 2 Class 1E AC and DC electrical power distribution subsystems associated with each unit are shared by each unit since some systems are common to both units. The opposite unit Division 2 Class 1E AC and DC electrical power distribution subsystems support equipment required to be OPERABLE by LCO 3.6.4.3, "Standby Gas Treatment (SGT) System," LCO 3.7.4, "Control Room Area Filtration (CRAF) System," LCO 3.7.5, "Control Room Area Ventilation Air Conditioning (AC) System," and LCO 3.8.1, "AC SourcesOperating."
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.7-1 Revision 19
| |
| | |
| Distribution SystemsOperating B 3.8.7 BASES BACKGROUND The list of all required distribution buses for Unit 1 and (continued) Unit 2 is located in Tables B 3.8.7-1 and B 3.8.7-2, respectively.
| |
| APPLICABLE The initial conditions of Design Basis Accident (DBA) and SAFETY ANALYSES transient analyses in the UFSAR, Chapter 6 (Ref. 1) and Chapter 15 (Ref. 2), assume Engineered Safety Features (ESF) systems are OPERABLE. The AC and DC electrical power distribution systems are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor Coolant System, and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution Limits; Section 3.5, Emergency Core Cooling Systems (ECCS) and Reactor Core Isolation Cooling (RCIC) System; and Section 3.6, Containment Systems.
| |
| The OPERABILITY of the AC and DC electrical power distribution systems is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the plant. This includes maintaining the AC and DC electrical power sources and associated distribution systems OPERABLE during accident conditions in the event of:
| |
| : a. An assumed loss of all offsite or onsite AC electrical power; and
| |
| : b. A worst case single failure.
| |
| The AC and DC electrical power distribution systems satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The required AC and DC electrical power distribution subsystems listed in Table B 3.8.7-1 for Unit 1 and Table B 3.8.7-2 for Unit 2 ensure the availability of AC and DC electrical power for the systems required to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence (AOO) or a postulated DBA. The Division 1, 2, and 3 AC and DC bus electrical power primary distribution subsystems are required to be (continued)
| |
| LaSalle 1 and 2 B 3.8.7-2 Revision 0
| |
| | |
| Distribution SystemsOperating B 3.8.7 BASES LCO OPERABLE and certain buses of the opposite unit Division 2 (continued) AC and DC electrical power distribution subsystems are required to be OPERABLE to support the equipment required to be OPERABLE by LCO 3.6.4.3, LCO 3.7.4, LCO 3.7.5, and LCO 3.8.1. As noted in Table B 3.8.7-1 and Table B 3.8.7-2 (Footnote a), each division of the AC and DC electrical power distribution systems is a subsystem.
| |
| Maintaining the Division 1, 2, and 3 AC and DC electrical power distribution subsystems OPERABLE ensures that the redundancy incorporated into the design of ESF is not defeated. Any two of the three divisions of the distribution system are capable of providing the necessary electrical power to the associated ESF components.
| |
| Therefore, a single failure within any system or within the electrical power distribution subsystems does not prevent safe shutdown of the reactor.
| |
| OPERABLE AC electrical power distribution subsystems require the associated buses to be energized to their proper voltages. OPERABLE DC electrical power distribution subsystems require the associated buses to be energized to their proper voltage from either the associated battery or charger.
| |
| Based on the number of safety significant electrical loads associated with each bus listed in Table B 3.8.7-1 for Unit 1 and Table B 3.8.7-2 for Unit 2, if one or more of the buses becomes inoperable, entry into the appropriate ACTIONS of LCO 3.8.7 is required. Some buses, such as distribution panels, which help comprise the AC and DC distribution systems are not listed in Table B 3.8.7-1 for Unit 1 and Table B 3.8.7-2 for Unit 2. The loss of electrical loads associated with these buses may not result in a complete loss of a redundant safety function necessary to shut down the reactor and maintain it in a safe condition. Therefore, should one or more of these buses become inoperable due to a failure not affecting the OPERABILITY of a bus listed in Table B 3.8.7-1 for Unit 1 and Table B 3.8.7-2 for Unit 2 (e.g., a breaker supplying a single distribution panel fails open), the individual loads on the bus would be considered inoperable, and the appropriate Conditions and Required Actions of the LCOs governing the individual loads would be entered. However, if one or more of these buses is (continued)
| |
| LaSalle 1 and 2 B 3.8.7-3 Revision 19
| |
| | |
| Distribution SystemsOperating B 3.8.7 BASES LCO inoperable due to a failure also affecting the OPERABILITY (continued) of a bus listed in Table B 3.8.7-1 for Unit 1 and Table B 3.8.7-2 for Unit 2 (e.g., loss of 4.16 kV emergency bus, which results in de-energization of all buses powered from the 4.16 kV emergency bus), then although the individual loads are still considered inoperable, the Conditions and Required Actions of the LCO for the individual loads are not required to be entered, since LCO 3.0.6 allows this exception (i.e., the loads are inoperable due to the inoperability of a support system governed by a Technical Specification; the 4.16 kV emergency bus).
| |
| In addition, at least one tie breaker between the redundant Division 2, safety related DC emergency power distribution subsystems must be open. This prevents an electrical malfunction in one power distribution subsystem from propagating to the redundant subsystem, which could cause the failure of a redundant subsystem and a loss of essential safety function(s). If at least one tie breaker is not open, then both Division 2 DC electrical power distribution subsystems are considered inoperable. The restriction of maintaining electrical separation applies to the onsite, safety related, redundant electrical power distribution subsystems. It does not, however, preclude redundant Class 1E 4.16 kV emergency buses from being supplied from the same offsite source.
| |
| APPLICABILITY The electrical power distribution subsystems are required to be OPERABLE in MODES 1, 2, and 3 to ensure that:
| |
| : a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients; and
| |
| : b. Adequate core cooling is provided, and containment OPERABILITY and other vital functions are maintained, in the event of a postulated DBA.
| |
| Electrical power distribution subsystem requirements for MODES 4 and 5 and other conditions in which AC and DC electrical power distribution subsystems are required. are covered in the Bases for LCO 3.8.8, "Distribution Systems-Shutdown."
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.7-4 Revision 0
| |
| | |
| Distribution SystemsOperating B 3.8.7 BASES (continued)
| |
| ACTIONS A.1 With one or more Division 1 and 2 required AC buses, load centers, motor control centers, or distribution panels inoperable and a loss of function has not yet occurred, the remaining AC electrical power distribution subsystems are capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition, assuming no single failure. The overall reliability is reduced, however, because a single failure in the remaining electrical power distribution subsystems could result in the minimum required ESF functions not being supported. Therefore, the required AC buses, load centers, motor control centers, and distribution panels must be restored to OPERABLE status within 8 hours. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. This Completion Time is modified by a Note to clarity that the Risk Informed Completion Time Program is not applicable to a Required Action associated with a Condition that represents a loss of safety function.
| |
| The Condition A worst scenario is two divisions without AC power (i.e., no offsite power to the divisions and the associated DGs inoperable). In this situation, the unit is more vulnerable to a complete loss of AC power. It is, therefore, imperative that the unit operators' attention be focused on minimizing the potential for loss of power to the remaining division by stabilizing the unit and restoring power to the affected division. The 8 hour time limit before requiring a unit shutdown in this Condition is acceptable because of:
| |
| : a. The potential for decreased safety if the unit operators' attention is diverted from the evaluations and actions necessary to restore power to the affected division to the actions associated with taking the unit to shutdown within this time limit.
| |
| : b. The low potential for an event in conjunction with a single failure of a redundant component in the division with AC power. (The redundant component is verified OPERABLE in accordance with Specification 5.5.12, "Safety Function Determination Program (SFDP).")
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.7-5 Revision 89
| |
| | |
| Distribution SystemsOperating B 3.8.7 BASES ACTIONS B.1 (continued)
| |
| With one or more Division 1 and 2 DC electrical distribution subsystems inoperable and a loss of function has not yet occurred, the remaining DC electrical power distribution subsystems are capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition, assuming no single failure.
| |
| The overall reliability is reduced, however, because a single failure in the remaining DC electrical power distribution subsystems could result in the minimum required ESF functions not being supported. Therefore, the required DC electrical power distribution subsystem(s) must be restored to OPERABLE status within 2 hours or in accordance with the Risk Informed Completion Time Program by powering the bus from the associated battery or charger. A Note clarifies that the Risk Informed Completion Time Program is not applicable to a Required Action associated with a Condition that represents a loss of safety function.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.7-6 Revision 89
| |
| | |
| Distribution SystemsOperating B 3.8.7 BASES ACTIONS B.1 (continued)
| |
| Condition B worst scenario is two divisions without adequate DC power, potentially with both the battery significantly degraded and the associated charger nonfunctioning. In this situation, the plant is significantly more vulnerable to a complete loss of all DC power. It is, therefore, imperative that the operator's attention focus on stabilizing the plant, minimizing the potential for loss of power to the remaining divisions, and restoring power to the affected division(s).
| |
| This 2 hour limit is more conservative than Completion Times allowed for the majority of components that could be without power. Taking exception to LCO 3.0.2 for components without adequate DC power, that would have Required Action Completion Times shorter than 2 hours, is acceptable because of:
| |
| : a. The potential for decreased safety when requiring a change in plant conditions (i.e., requiring a shutdown) while not allowing stable operations to continue;
| |
| : b. The potential for decreased safety when requiring entry into numerous applicable Conditions and Required Actions for components without DC power while not providing sufficient time for the operators to perform the necessary evaluations and actions for restoring power to the affected division; and
| |
| : c. The potential for an event in conjunction with a single failure of a redundant component.
| |
| The 2 hour Completion Time for DC electrical power distribution subsystems is consistent with Regulatory Guide 1.93 (Ref. 3).
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.7-7 Revision 0
| |
| | |
| Distribution SystemsOperating B 3.8.7 BASES ACTIONS C.1 If one or both Division 1 and 2 AC or DC electrical power distribution subsystems are inoperable and not restored within the provided Completion Time, the plant must be brought to a condition in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 4) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.7-8 Revision 81
| |
| | |
| Distribution SystemsOperating B 3.8.7 BASES ACTIONS D.1 (continued)
| |
| With one or more required opposite unit Division 2 AC or DC electrical power distribution subsystems inoperable and a loss of function has not yet occurred, certain redundant Division 2 features (e.g., a standby gas treatment subsystem) will not function if a design basis event were to occur. Therefore, a 7 day Completion Time is provided to restore the required opposite unit Division 2 AC and DC electrical power distribution subsystems to OPERABLE status.
| |
| The 7 day Completion Time takes into account the capacity and capability of the remaining AC and DC electrical power distribution subsystems, and is based on the shortest restoration time allowed for the systems affected by the inoperable AC and DC electrical power distribution subsystems in the respective system specifications.
| |
| Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.
| |
| This Completion Time is modified by a Note to clarify that the Risk Informed Completion Time Program is not applicable to a Required Action associated with a Condition that represents a loss of safety function.
| |
| The Required Action is modified by a Note indicating that the applicable Conditions of LCO 3.8.1 be entered and Required Actions taken if the inoperable opposite unit AC electrical power distribution subsystem results in an inoperable required offsite circuit. This is an exception to LCO 3.0.6 and ensures the proper actions are taken for these components.
| |
| E.1 and E.2 If the inoperable electrical power distribution system cannot be restored to OPERABLE status within the associated Completion Times, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.7-9 Revision 89
| |
| | |
| Distribution SystemsOperating B 3.8.7 BASES ACTIONS F.1 (continued)
| |
| With the Division 3 electrical power distribution system inoperable (i.e., one or both Division 3 AC or DC electrical power distribution subsystems inoperable), the Division 3 powered systems are not capable of performing their intended functions. Immediately declaring the affected supported features, e.g., the High Pressure Core Spray System and its associated primary containment isolation valves, inoperable allows the ACTIONS of LCO 3.5.1, "ECCSOperating," and LCO 3.6.1.3, "Primary Containment Isolation Valves (PCIVs),"
| |
| to apply appropriate limitations on continued reactor operation.
| |
| G.1 With the Division 1 250 V DC subsystem inoperable, the RCIC System and the RCIC DC powered PCIVs may be incapable of performing their intended functions and must be immediately declared inoperable. This declaration also requires entry into applicable Conditions and Required Actions of LCO 3.5.3, "Reactor Core Isolation Cooling (RCIC) System," and LCO 3.6.1.3, "Primary Containment Isolation Valves (PCIVs)."
| |
| H.1 Condition H corresponds to a level of degradation in the electrical power distribution system that causes a required safety function to be lost. When the inoperability of two or more inoperable electrical power distribution subsystems, in combination, result in the loss of a required function, the plant is in a condition outside the accident analysis.
| |
| Therefore, no additional time is justified for continued operation. LCO 3.0.3 must be entered immediately to commence a controlled shutdown. The term "in combination" means that the loss of function must result from the inoperability of two or more AC and DC electrical power distribution subsystems; a loss of function solely due to a single AC or DC electrical power distribution subsystem inoperability even with another AC or DC electrical power distribution subsystem concurrently inoperable, does not require entry into Condition H. In addition, for this Action, Division 3 is considered redundant to Division 1 and 2 ECCS.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.7-10 Revision 89
| |
| | |
| Distribution SystemsOperating B 3.8.7 BASES (continued)
| |
| SURVEILLANCE SR 3.8.7.1 REQUIREMENTS Meeting this Surveillance verifies that the AC and DC electrical power distribution systems are functioning properly, with the correct circuit breaker alignment. The correct breaker alignment ensures the appropriate separation and independence of the electrical divisions is maintained, and the appropriate voltage is available to each required bus. The verification of proper voltage availability on the buses ensures that the required voltage is readily available for motive as well as control functions for critical system loads connected to these buses. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Chapter 6.
| |
| : 2. UFSAR, Chapter 15.
| |
| : 3. Regulatory Guide 1.93, Revision 0, December 1974.
| |
| : 4. NEDC-32988-A, Revision 2, "Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants," December 2002.
| |
| LaSalle 1 and 2 B 3.8.7-11 Revision 51
| |
| | |
| Distribution SystemsOperating B 3.8.7 Table B 3.8.7-1 (page 1 of 1)
| |
| Unit 1 AC and DC Electrical Power Distribution Systems TYPE VOLTAGE DIVISION 1(a) DIVISION 2(a)(b) DIVISION 3(a)
| |
| AC buses 4160 V 141Y 142Y 143 480 V 135X and 136X and 136Y MCC 143-1 135Y MCCS 136X-1, MCCs 135X-1, 136X-2, 136X-3, 135X-2, 135X-3, 136Y-1, and 136Y-2 135Y-1, and 135Y-2 120 V Distribution Distribution Distribution Panels Panels in 480V Panels in 480V in 480V MCC 143-1 MCCS 135X-1, MCCS 136X-1, 135X-2, 135X-3, 136X-2, 136X-3, and 135Y-1 and 136Y-2 DC buses 250 V MCC 121Y 125 V Distribution Distribution Distribution Panel 111Y Panel 112Y Panel 113 (a) Each division of the AC and DC electrical power distribution systems is a subsystem.
| |
| (b) OPERABILITY requirements of the opposite unit's Division 2 AC and DC electrical power distribution subsystems require OPERABILITY of all the opposite unit's Division 2 4160 VAC, 480 VAC, 120 VAC, and 125 VDC buses listed in the Unit 2 Table.
| |
| LaSalle 1 and 2 B 3.8.7-12 Revision 0
| |
| | |
| Distribution SystemsOperating B 3.8.7 Table B 3.8.7-2 (page 1 of 1)
| |
| Unit 2 AC and DC Electrical Power Distribution Systems TYPE VOLTAGE DIVISION 1(a) DIVISION 2(a)(b) DIVISION 3(a)
| |
| AC buses 4160 V 241Y 242Y 243 480 V 235X and 235Y 236X and 236Y MCC 243-1 MCCs 235X-1, MCCS 236X-1, 235X-2, 235X-3, 236X-2, 236X-3, 235Y-1, and 235Y-2 236Y-1, and 236Y-2 120 V Distribution Distribution Distribution Panels Panels in 480V Panels in 480V in 480V MCC 243-1 MCCs 235X-1, MCCs 236X-1, 235X-2, 235X-3, 236X-2, 236X-3, and 235Y-1 and 236Y-2 DC buses 250 V MCC 221Y 125 V Distribution Distribution Distribution Panel 211Y Panel 212Y Panel 213 (a) Each division of the AC and DC electrical power distribution systems is a subsystem.
| |
| (b) OPERABILITY requirements of the opposite unit's Division 2 AC and DC electrical power distribution subsystems require OPERABILITY of all the opposite unit's Division 2 4160 VAC, 480 VAC, 120 VAC, and 125 VDC buses listed in the Unit 1 Table.
| |
| LaSalle 1 and 2 B 3.8.7-13 Revision 0
| |
| | |
| Distribution SystemsShutdown B 3.8.8 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.8 Distribution SystemsShutdown BASES BACKGROUND A description of the AC and DC electrical power distribution systems is provided in the Bases for LCO 3.8.7, "Distribution SystemsOperating."
| |
| APPLICABLE The initial conditions of Design Basis Accident and SAFETY ANALYSES transient analyses in the UFSAR, Chapter 6 (Ref. 1) and Chapter 15 (Ref. 2), assume Engineered Safety Feature (ESF) systems are OPERABLE. The AC and DC electrical power distribution systems are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor Coolant System, and containment design limits are not exceeded.
| |
| The OPERABILITY of the AC and DC electrical power distribution system is consistent with the initial assumptions of the accident analyses and the requirements for the supported systems' OPERABILITY.
| |
| The OPERABILITY of the minimum AC and DC electrical power sources and associated power distribution subsystems during MODES 4 and 5, and during movement of irradiated fuel assemblies in the secondary containment ensures that:
| |
| : a. The facility can be maintained in the shutdown or refueling condition for extended periods;
| |
| : b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and
| |
| : c. Adequate power is provided to mitigate events postulated during shutdown, such as a fuel handling accident.
| |
| The AC and DC electrical power distribution systems satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.8-1 Revision 76
| |
| | |
| Distribution SystemsShutdown B 3.8.8 BASES (continued)
| |
| LCO Various combinations of subsystems, equipment, and components are required OPERABLE by other LCOs, depending on the specific plant condition. Implicit in those requirements is the required OPERABILITY of necessary support features. This LCO explicitly requires energization of the portions of the electrical distribution system, including the opposite unit Division 2 electrical distribution subsystem, necessary to support OPERABILITY of Technical Specifications' required systems, equipment, and componentsboth specifically addressed by their own LCOs, and implicitly required by the definition of OPERABILITY.
| |
| Maintaining these portions of the distribution system energized ensures the availability of sufficient power to operate the plant in a safe manner to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents).
| |
| APPLICABILITY The AC and DC electrical power distribution subsystems required to be OPERABLE in MODES 4 and 5 and during movement of irradiated fuel assemblies in the secondary containment provide assurance that:
| |
| : a. Systems that provide core cooling are available;
| |
| : b. Systems needed to mitigate a fuel handling accident are available;
| |
| : c. Systems necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and
| |
| : d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown or refueling condition.
| |
| The AC and DC electrical power distribution subsystem requirements for MODES 1, 2, and 3 are covered in LCO 3.8.7.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.8-2 Revision 76
| |
| | |
| Distribution SystemsShutdown B 3.8.8 BASES (continued)
| |
| ACTIONS LCO 3.0.3 is not applicable while in MODE 4 or 5. However, since irradiated fuel assembly movement can occur in MODE 1, 2, or 3, the ACTIONS have been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 4 or 5, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Entering LCO 3.0.3 while in MODE 1, 2, or 3 would require the unit to be shutdown, but would not require immediate suspension of movement of irradiated fuel assemblies. The Note to the ACTIONS, "LCO 3.0.3 is not applicable," ensures that the actions for immediate suspension of irradiated fuel assembly movement are not postponed due to entry into LCO 3.0.3.
| |
| A.1, A.2.1, A.2.2, A.2.3, and A.2.4 Although redundant required features may require redundant divisions of electrical power distribution subsystems to be OPERABLE, one OPERABLE distribution subsystem division may be capable of supporting sufficient required features to allow continuation of CORE ALTERATIONS and fuel movement.
| |
| By allowing the option to declare required features associated with an inoperable distribution subsystem inoperable, appropriate restrictions are implemented in accordance with the affected distribution subsystem LCO's Required Actions. In many instances, this option may involve undesired administrative efforts. Therefore, the allowance for sufficiently conservative actions is made (i.e., to suspend CORE ALTERATIONS and movement of irradiated fuel assemblies in the secondary containment).
| |
| Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition.
| |
| These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required AC and DC electrical power distribution subsystems and to continue this action until restoration is accomplished in order to provide the necessary power to the plant safety systems.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.8.8-3 Revision 76
| |
| | |
| Distribution SystemsShutdown B 3.8.8 BASES ACTIONS A.1, A.2.1, A.2.2, A.2.3, and A.2.4 (continued)
| |
| Notwithstanding performance of the above conservative Required Actions, a required residual heat removalshutdown cooling (RHR-SDC) subsystem may be inoperable. In this case, Required Actions A.2.1 through A.2.3 do not adequately address the concerns relating to coolant circulation and heat removal. Pursuant to LCO 3.0.6, the RHR-SDC ACTIONS would not be entered. Therefore, Required Action A.2.4 is provided to direct declaring RHR-SDC inoperable, which results in taking the appropriate RHR-SDC ACTIONS.
| |
| The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required distribution subsystems should be completed as quickly as possible in order to minimize the time the plant safety systems may be without power.
| |
| SURVEILLANCE SR 3.8.8.1 REQUIREMENTS This Surveillance verifies that the AC and DC electrical power distribution subsystem is functioning properly, with the buses energized. The verification of proper voltage availability on the buses ensures that the required power is readily available for motive as well as control functions for critical system loads connected to these buses. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. UFSAR, Chapter 6.
| |
| : 2. UFSAR, Chapter 15.
| |
| LaSalle 1 and 2 B 3.8.8-4 Revision 76
| |
| | |
| Refueling Equipment Interlocks B 3.9.1 B 3.9 REFUELING OPERATIONS B 3.9.1 Refueling Equipment Interlocks BASES BACKGROUND Refueling equipment interlocks restrict the operation of the refueling equipment or the withdrawal of control rods to reinforce unit procedures in preventing the reactor from achieving criticality during refueling. The refueling interlock circuitry senses the conditions of the refueling equipment and the control rods. Depending on the sensed conditions, interlocks are actuated to prevent the operation of the refueling equipment or the withdrawal of control rods.
| |
| GDC 26 of 10 CFR 50, Appendix A, requires that one of the two required independent reactivity control systems be capable of holding the reactor core subcritical under cold conditions (Ref. 1). The control rods, when fully inserted, serve as the system capable of maintaining the reactor subcritical in cold conditions during all fuel movement activities and accidents.
| |
| The instrumentation provided to sense the position of the refueling platform, the loading of the refueling platform fuel grapple (main hoist), and the full insertion of all control rods is designed with redundancy such that a single interlock failure cannot cause an accident. Additionally, inputs are provided for the loading of the refueling platform frame-mounted (auxiliary) hoist, the loading of the refueling platform trolley-mounted (monorail) hoist, and the loading of the service platform hoist. With the reactor mode switch in the shutdown or refuel position, the indicated conditions are combined in logic circuits to determine if all restrictions on refueling equipment operations and control rod insertion are satisfied.
| |
| A control rod not at its full-in position interrupts power to the refueling equipment to prevent operating the equipment over the reactor core when loaded with a fuel assembly. Conversely, the refueling equipment located over the core and loaded with fuel provides input to Rod Control Management System to prevent withdrawing a control rod.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.9.1-1 Revision 46
| |
| | |
| Refueling Equipment Interlocks B 3.9.1 BASES BACKGROUND The refueling platform has two mechanical switch contacts (continued) that open before the platform is physically located over the reactor vessel. The refueling platform hoists and the service platform hoist have switches that open when the hoists are loaded with fuel. The refueling interlocks use these indications to prevent operation of the refueling equipment with fuel loaded over the core whenever any control rod is withdrawn, or to prevent control rod withdrawal whenever fuel loaded refueling equipment is over the core (Ref. 2).
| |
| The hoist switches open at a load lighter than the weight of a single fuel assembly in water.
| |
| APPLICABLE The refueling interlocks are explicitly assumed in the UFSAR SAFETY ANALYSES analysis of the control rod removal error during refueling (Ref. 3). This analysis evaluates the consequences of control rod withdrawal during refueling. A prompt reactivity excursion during refueling could potentially result in fuel failure with subsequent release of radioactive material to the environment.
| |
| Criticality and, therefore, subsequent prompt reactivity excursions are prevented during the insertion of fuel, provided all control rods are fully inserted during the fuel insertion. The refueling interlocks accomplish this by preventing loading fuel into the core with any control rod withdrawn, or by preventing withdrawal of a rod from the core during fuel loading.
| |
| The refueling platform location switch contacts activate at a point outside of the reactor core, such that, with a fuel assembly loaded and a control rod withdrawn, the fuel is not over the core.
| |
| Refueling equipment interlocks satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO To prevent criticality during refueling, the refueling interlocks associated with the reactor mode switch refuel position ensure that fuel assemblies are not loaded into the core with any control rod withdrawn.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.9.1-2 Revision 46
| |
| | |
| Refueling Equipment Interlocks B 3.9.1 BASES LCO To prevent these conditions from developing, the (continued) all-rods-in, the refueling platform position, the refueling platform fuel grapple fuel-loaded, the refueling platform frame-mounted hoist fuel-loaded, the refueling platform trolley-mounted hoist fuel-loaded, and the service platform hoist fuel-loaded inputs are required to be OPERABLE when the associated equipment is in use for in-vessel fuel movement. These inputs are combined in logic circuits that provide refueling equipment or control rod blocks to prevent operations that could result in criticality during refueling operations.
| |
| APPLICABILITY In MODE 5, a prompt reactivity excursion could cause fuel damage and subsequent release of radioactive material to the environment. The refueling equipment interlocks protect against prompt reactivity excursions during MODE 5. The interlocks are only required to be OPERABLE during in-vessel fuel movement with refueling equipment associated with the interlocks when the reactor mode switch is in the refuel position. The interlocks are not required when the reactor mode switch is in the shutdown position since a control rod block (LCO 3.3.2.1, "Control Rod Block Instrumentation")
| |
| ensures control rod withdrawals cannot occur simultaneously with in-vessel fuel movements.
| |
| In MODES 1, 2, 3, and 4, the reactor pressure vessel head is on, and no fuel loading activities are possible. Therefore, the refueling interlocks are not required to be OPERABLE in these MODES.
| |
| ACTIONS A.1, A.2.1, and A.2.2 With one or more of the required refueling equipment interlocks inoperable, the unit must be placed in a condition in which the LCO does not apply or is not necessary. This can be performed by ensuring fuel assemblies are not moved in the reactor vessel or by ensuring that the control rods are inserted and cannot be withdrawn. Therefore, Required Action A.1 requires that in-vessel fuel movement with the affected refueling equipment must be immediately suspended. This action ensures that operations are not performed with equipment that would potentially not be blocked from unacceptable operations (e.g., loading fuel into a cell with a control (continued)
| |
| LaSalle 1 and 2 B 3.9.1-3 Revision 0
| |
| | |
| Refueling Equipment Interlocks B 3.9.1 BASES ACTIONS A.1, A.2.1, and A.2.2 (continued) rod withdrawn). Suspension of in-vessel fuel movement shall not preclude completion of movement of a component to a safe position. Alternately, Required Actions A.2.1 and A.2.2 require that a control rod withdrawal block be inserted and that all control rods are subsequently verified to be fully inserted. Required Action A.2.1 ensures that no control rods can be withdrawn. This action ensures that control rods cannot be inappropriately withdrawn since an electrical or hydraulic block to control rod withdrawal is in place.
| |
| Required Action A.2.2 is normally performed after placing the rod withdrawal block in effect and provides a verification that all control rods are fully inserted. Like Required Action A.1, Required Actions A.2.1 and A.2.2 ensure that unacceptable operations are prohibited (e.g., loading fuel into a core cell with the control rod withdrawn).
| |
| SURVEILLANCE SR 3.9.1.1 REQUIREMENTS Performance of a CHANNEL FUNCTIONAL TEST demonstrates each required refueling equipment interlock will function properly when a simulated or actual signal indicative of a required condition is injected into the logic. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. 10 CFR 50, Appendix A, GDC 26.
| |
| : 2. UFSAR, Section 7.7.13.
| |
| : 3. UFSAR, Section 15.4.1.1.
| |
| LaSalle 1 and 2 B 3.9.1-4 Revision 51
| |
| | |
| Refuel Position One-Rod-Out Interlock B 3.9.2 B 3.9 REFUELING OPERATIONS B 3.9.2 Refuel Position One-Rod-Out Interlock BASES BACKGROUND The refuel position one-rod-out interlock restricts the movement of control rods to reinforce unit procedures that prevent the reactor from becoming critical during refueling operations. During refueling operations, no more than one control rod is permitted to be withdrawn.
| |
| GDC 26 of 10 CFR 50, Appendix A, requires that one of the two required independent reactivity control systems be capable of holding the reactor core subcritical under cold conditions (Ref. 1). The control rods serve as the system capable of maintaining the reactor subcritical in cold conditions.
| |
| The refuel position one-rod-out interlock prevents the selection of a second control rod for movement when any other control rod is not fully inserted (Ref. 2). It is a logic circuit that has redundant channels. It uses the all-rods-in signal (from the control rod full-in position indicators discussed in LCO 3.9.4, "Control Rod Position Indication") and a rod selection signal (from the Rod Control Management System).
| |
| This Specification ensures that the performance of the refuel position one-rod-out interlock in the event of a Design Basis Accident meets the assumptions used in the safety analysis of Reference 3.
| |
| APPLICABLE The refuel position one-rod-out interlock is explicitly SAFETY ANALYSES assumed in the UFSAR analysis of the control rod removal error during refueling (Ref. 3). This analysis evaluates the consequences of control rod withdrawal during refueling.
| |
| A prompt reactivity excursion during refueling could potentially result in fuel failure with subsequent release of radioactive material to the environment.
| |
| The refuel position one-rod-out interlock and adequate SDM (LCO 3.1.1, "SHUTDOWN MARGIN (SDM)") prevent criticality by preventing withdrawal of more than one control rod. With (continued)
| |
| LaSalle 1 and 2 B 3.9.2-1 Revision 44
| |
| | |
| Refuel Position One-Rod-Out Interlock B 3.9.2 BASES APPLICABLE one control rod withdrawn, the core will remain subcritical, SAFETY ANALYSES thereby preventing any prompt critical excursion.
| |
| (continued)
| |
| The refuel position one-rod-out interlock satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO To prevent criticality during MODE 5, the refuel position one-rod-out interlock ensures no more than one control rod may be withdrawn. Both channels of the refuel position one-rod-out interlock are required to be OPERABLE and the reactor mode switch must be locked in the refuel position to support the OPERABILITY of these channels.
| |
| APPLICABILITY In MODE 5, with the reactor mode switch in the refuel position, the OPERABLE refuel position one-rod-out interlock provides protection against prompt reactivity excursions.
| |
| In MODES 1, 2, 3, and 4, the refuel position one-rod-out interlock is not required to be OPERABLE and is bypassed.
| |
| In MODES 1 and 2, the Reactor Protection System (LCO 3.3.1.1, "Reactor Protection System (RPS)
| |
| Instrumentation") and the control rods (LCO 3.1.3, "Control Rod OPERABILITY") provide mitigation of potential reactivity excursions. In MODES 3 and 4, with the reactor mode switch in the shutdown position, a control rod block (LCO 3.3.2.1, "Control Rod Block Instrumentation") ensures all control rods are inserted, thereby preventing criticality during shutdown conditions.
| |
| ACTIONS A.1 and A.2 With the refuel position one-rod-out interlock inoperable, the refueling interlocks are not capable of preventing more than one control rod from being withdrawn. This condition may lead to criticality.
| |
| Control rod withdrawal must be immediately suspended, and action must be immediately initiated to fully insert all insertable control rods in core cells containing one or more fuel assemblies. Action must continue until all such control rods are fully inserted. Control rods in core cells containing no fuel assemblies do not affect the reactivity of the core and, therefore, do not have to be inserted.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.9.2-2 Revision 0
| |
| | |
| Refuel Position One-Rod-Out Interlock B 3.9.2 BASES (continued)
| |
| SURVEILLANCE SR 3.9.2.1 REQUIREMENTS Proper functioning of the refueling position one-rod-out interlock requires the reactor mode switch to be in Refuel.
| |
| During control rod withdrawal in MODE 5, improper positioning of the reactor mode switch could, in some instances, allow improper bypassing of required interlocks.
| |
| Therefore, this Surveillance imposes an additional level of assurance that the refueling position one-rod-out interlock will be OPERABLE when required. By "locking" the reactor mode switch in the proper position (i.e., removing the reactor mode switch key from the console while the reactor mode switch is positioned in refuel), an additional administrative control is in place to preclude operator errors from resulting in unanalyzed operation.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.9.2.2 Performance of a CHANNEL FUNCTIONAL TEST on each channel demonstrates the associated refuel position one-rod-out interlock will function properly when a simulated or actual signal indicative of a required condition is injected into the logic. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. To perform the required testing, the applicable condition must be entered (i.e., a control rod must be withdrawn from its full-in position). Therefore, SR 3.9.2.2 has been modified by a Note that states the CHANNEL FUNCTIONAL TEST is not required to be performed until 1 hour after any control rod is withdrawn.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.9.2-3 Revision 51
| |
| | |
| Refuel Position One-Rod-Out Interlock B 3.9.2 BASES (continued)
| |
| REFERENCES 1. 10 CFR 50, Appendix A, GDC 26.
| |
| : 2. UFSAR, Section 7.7.13.
| |
| : 3. UFSAR, Section 15.4.1.1.
| |
| LaSalle 1 and 2 B 3.9.2-4 Revision 0
| |
| | |
| Control Rod Position B 3.9.3 B 3.9 REFUELING OPERATIONS B 3.9.3 Control Rod Position BASES BACKGROUND Control rods provide the capability to maintain the reactor subcritical under all conditions and to limit the potential amount and rate of reactivity increase caused by a malfunction in the Control Rod Drive System. During refueling, movement of control rods is limited by the refueling interlocks (LCO 3.9.1, "Refueling Equipment Interlocks" and LCO 3.9.2, "Refuel Position One-Rod-Out Interlock") or the control rod block with the reactor mode switch in the shutdown position (LCO 3.3.2.1, "Control Rod Block Instrumentation").
| |
| GDC 26 of 10 CFR 50, Appendix A, requires that one of the two required independent reactivity control systems be capable of holding the reactor core subcritical under cold conditions (Ref. 1). The control rods serve as the system capable of maintaining the reactor subcritical in cold conditions.
| |
| The refueling interlocks allow a single control rod to be withdrawn at any time unless fuel is being loaded into the core. To preclude loading fuel assemblies into the core with a control rod withdrawn, all control rods must be fully inserted. This prevents the reactor from achieving criticality during refueling operations.
| |
| APPLICABLE Prevention and mitigation of prompt reactivity excursions SAFETY ANALYSES during refueling are provided by the refueling interlocks (LCO 3.9.1 and LCO 3.9.2), the SDM (LCO 3.1.1, "SHUTDOWN MARGIN (SDM)"), the intermediate range monitor neutron flux scram (LCO 3.3.1.1, "Reactor Protection System (RPS)
| |
| Instrumentation"), and the control rod block instrumentation (LCO 3.3.2.1).
| |
| The safety analysis of the control rod removal error during refueling in the UFSAR (Ref. 2) assumes the functioning of the refueling interlocks and adequate SDM. Additionally, prior to fuel reload, all control rods must be fully inserted to minimize the probability of an inadvertent criticality.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.9.3-1 Revision 0
| |
| | |
| Control Rod Position B 3.9.3 BASES APPLICABLE Control rod position satisfies Criterion 3 of SAFETY ANALYSES 10 CFR 50.36(c)(2)(ii).
| |
| (continued)
| |
| LCO All control rods must be fully inserted during applicable refueling conditions to minimize the probability of an inadvertent criticality during refueling.
| |
| APPLICABILITY During MODE 5, loading fuel into core cells with control rods withdrawn may result in inadvertent criticality.
| |
| Therefore, the control rods must be inserted before loading fuel into a core cell. All control rods must be inserted before loading fuel to ensure that a fuel loading error does not result in loading fuel into a core cell with the control rod withdrawn.
| |
| In MODES 1, 2, 3, and 4, the reactor pressure vessel head is on, and no fuel loading activities are possible. Therefore, this Specification is not applicable in these MODES.
| |
| ACTIONS A.1 With all control rods not fully inserted during the applicable conditions, an inadvertent criticality could occur that is not analyzed in the UFSAR. All fuel loading operations must be immediately suspended. Suspension of these activities shall not preclude completion of movement of a component to a safe position.
| |
| SURVEILLANCE SR 3.9.3.1 REQUIREMENTS During refueling, to ensure that the reactor remains subcritical, all control rods must be fully inserted prior to and during fuel loading. Periodic checks of the control rod position ensure this condition is maintained.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.9.3-2 Revision 51
| |
| | |
| Control Rod Position B 3.9.3 BASES (continued)
| |
| REFERENCES 1. 10 CFR 50, Appendix A, GDC 26.
| |
| : 2. UFSAR, Section 15.4.1.1.
| |
| LaSalle 1 and 2 B 3.9.3-3 Revision 0
| |
| | |
| Control Rod Position Indication B 3.9.4 B 3.9 REFUELING OPERATIONS B 3.9.4 Control Rod Position Indication BASES BACKGROUND The full-in position indication channel for each control rod provides information necessary to the refueling interlocks to prevent inadvertent criticalities during refueling operations. During refueling, the refueling interlocks (LCO 3.9.1, "Refueling Equipment Interlocks" and LCO 3.9.2, "Refuel Position One-Rod-Out Interlock") use the full-in position indication channel to limit the operation of the refueling equipment and the movement of the control rods.
| |
| Three full-in position indication detectors are provided for each control rod (reed switches S00 and S52 provide indication for full-in and switch S51 provides indication for beyond full-in). All three full-in position indication detectors provide input to the all-rods-in logic. The three switches are wired in parallel, such that, if any one of the three full-in position indication detectors indicates full-in, the all-rods-in logic will receive a full-in signal for that control rod. Therefore, each control rod is considered to have only one "full-in" position indication channel. The absence of the full-in position indication channel signal for any control rod removes the all-rods-in permissive for the refueling equipment interlocks and prevents fuel loading. Also, this condition causes the refuel position one-rod-out interlock to not allow the selection of any other control rod. The all-rods-in logic provides two signals, one to each of the two Rod Control Management System rod block logic circuits.
| |
| GDC 26 of 10 CFR 50, Appendix A, requires that one of the two required independent reactivity control systems be capable of holding the reactor core subcritical under cold conditions (Ref. 1). The control rods serve as the system capable of maintaining the reactor subcritical in cold conditions.
| |
| APPLICABLE Prevention and mitigation of prompt reactivity excursions SAFETY ANALYSES during refueling are provided by the refueling interlocks (LCO 3.9.1 and LCO 3.9.2), the SDM (LCO 3.1.1, "SHUTDOWN MARGIN (SDM)"), the intermediate range monitor neutron flux (continued)
| |
| LaSalle 1 and 2 B 3.9.4-1 Revision 44
| |
| | |
| Control Rod Position Indication B 3.9.4 BASES APPLICABLE scram (LCO 3.3.1.1, "Reactor Protection System (RPS)
| |
| SAFETY ANALYSES Instrumentation"), and the control rod block instrumentation (continued) (LCO 3.3.2.1, "Control Rod Block Instrumentation").
| |
| The safety analysis for the control rod removal error during refueling (Ref. 2) assumes the functioning of the refueling interlocks and adequate SDM. The full-in position indication channel is required to be OPERABLE so that the refueling interlocks can ensure that fuel cannot be loaded with any control rod withdrawn and that no more than one control rod can be withdrawn at a time.
| |
| Control rod position indication satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO The control rod full-in position indication channel for each control rod must be OPERABLE to provide the required inputs to the refueling interlocks. A channel is OPERABLE if it provides correct position indication to the refueling equipment interlock all-rods-in logic (LCO 3.9.1) and the refuel position one-rod-out interlock logic (LCO 3.9.2).
| |
| APPLICABILITY During MODE 5, the control rods must have OPERABLE full-in position indication channels to ensure the applicable refueling interlocks will be OPERABLE.
| |
| In MODES 1 and 2, requirements for control rod position are specified in LCO 3.1.3, "Control Rod OPERABILITY." In MODES 3 and 4, with the reactor mode switch in the shutdown position, a control rod block (LCO 3.3.2.1) ensures all control rods are inserted, thereby preventing criticality during shutdown conditions.
| |
| ACTIONS A Note has been provided to modify the ACTIONS related to control rod position indication channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial (continued)
| |
| LaSalle 1 and 2 B 3.9.4-2 Revision 0
| |
| | |
| Control Rod Position Indication B 3.9.4 BASES ACTIONS entry into the Condition. However, the Required Actions for (continued) inoperable control rod position indication channels provide appropriate compensatory measures for separate inoperable channels. As such, this Note has been provided, which allows separate Condition entry for each inoperable required control rod position indication channel.
| |
| A.1.1, A.1.2, A.1.3, A.2.1, and A.2.2 With one or more required full-in position indication channels inoperable, compensating actions must be taken to protect against potential reactivity excursions from fuel assembly insertions or control rod withdrawals. This may be accomplished by immediately suspending in-vessel fuel movement and control rod withdrawal, and immediately initiating action to fully insert all insertable control rods in core cells containing one or more fuel assemblies.
| |
| Actions must continue until all insertable control rods in core cells containing one or more fuel assemblies are fully inserted. Control rods in core cells containing no fuel assemblies do not affect the reactivity of the core and, therefore, do not have to be inserted. Suspension of in-vessel fuel movements and control rod withdrawal shall not preclude moving a component to a safe position.
| |
| Alternatively, actions may be immediately initiated to fully insert the control rod(s) associated with the inoperable full-in position indicators(s) and to disarm (electrically or hydraulically) the drive(s) to ensure that the control rod is not withdrawn. A control rod can be hydraulically disarmed by closing the drive water and exhaust water isolation valves. A control rod can be electrically disarmed by disconnecting power from all four directional control valve solenoids. Actions must continue until all associated control rods are fully inserted and drives are disarmed. Under these conditions (control rod fully inserted and disarmed), an inoperable full-in channel may be bypassed to allow refueling operations to proceed. An alternate method must be used to ensure the control rod is fully inserted.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.9.4-3 Revision 0
| |
| | |
| Control Rod Position Indication B 3.9.4 BASES (continued)
| |
| SURVEILLANCE SR 3.9.4.1 REQUIREMENTS The full-in position indication channels provide input to the one-rod-out interlock and other refueling interlocks that require an all-rods-in permissive. The interlocks are activated when the full-in position indication for any control rod is not present, since this indicates that all rods are not fully inserted. Therefore, testing of the full-in position indication channels is performed to ensure that when a control rod is withdrawn, the full-in position indication is not present. This is performed by verifying both the absence of a full-in position indication and the absence of an "00" indication for the selected control rod, when the control rod is not full-in. The full-in position of the rod is displayed as either "00" or "FI" on either of the RCMS displays. The full-in position indication channel is considered inoperable even with the control rod fully inserted, if it would continue to indicate full-in with the control rod withdrawn. Performing the SR each time a control rod is withdrawn from the full-in position is considered adequate because of the procedural controls on control rod withdrawals and the visual indications available in the control room to alert the operator to control rods not fully inserted.
| |
| REFERENCES 1. 10 CFR 50, Appendix A, GDC 26.
| |
| : 2. UFSAR, Section 15.4.1.1.
| |
| LaSalle 1 and 2 B 3.9.4-4 Revision 44
| |
| | |
| Control Rod OPERABILITYRefueling B 3.9.5 B 3.9 REFUELING OPERATIONS B 3.9.5 Control Rod OPERABILITYRefueling BASES BACKGROUND Control rods are components of the Control Rod Drive (CRD)
| |
| System, the primary reactivity control system for the reactor. In conjunction with the Reactor Protection System, the CRD System provides the means for the reliable control of reactivity changes during refueling operation. In addition, the control rods provide the capability to maintain the reactor subcritical under all conditions and to limit the potential amount and rate of reactivity increase caused by a malfunction in the CRD System.
| |
| GDC 26 of 10 CFR 50, Appendix A, requires that one of the two required independent reactivity control systems be capable of holding the reactor core subcritical under cold conditions (Ref. 1). The CRD System is the system capable of maintaining the reactor subcritical in cold conditions.
| |
| APPLICABLE Prevention and mitigation of prompt reactivity excursions SAFETY ANALYSES during refueling are provided by refueling interlocks (LCO 3.9.1, "Refueling Equipment Interlocks" and LCO 3.9.2, "Refuel Position One-Rod-Out Interlock"), the SDM (LCO 3.1.1, "SHUTDOWN MARGIN (SDM)"), the intermediate range monitor neutron flux scram (LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation"), and the control rod block instrumentation (LCO 3.3.2.1, "Control Rod Block Instrumentation").
| |
| The safety analysis for the control rod removal error during refueling (Ref. 2) evaluates the consequences of control rod withdrawal during refueling. A prompt reactivity excursion during refueling could potentially result in fuel failure with subsequent release of radioactive material to the environment. Control rod scram provides protection should a prompt reactivity excursion occur.
| |
| Control rod OPERABILITY during refueling satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.9.5-1 Revision 0
| |
| | |
| Control Rod OPERABILITYRefueling B 3.9.5 BASES (continued)
| |
| LCO Each withdrawn control rod must be OPERABLE. The withdrawn control rod is considered OPERABLE if the scram accumulator pressure is 940 psig and the control rod is capable of being automatically inserted upon receipt of a scram signal.
| |
| Inserted control rods have already completed their reactivity control function, and therefore, are not required to be OPERABLE.
| |
| APPLICABILITY During MODE 5, withdrawn control rods must be OPERABLE to ensure that when a scram occurs the control rods will insert and provide the required negative reactivity to maintain the reactor subcritical.
| |
| For MODES 1 and 2, control rod requirements are found in LCO 3.1.2, "Reactivity Anomalies," LCO 3.1.3, "Control Rod OPERABILITY," LCO 3.1.4, "Control Rod Scram Times," and LCO 3.1.5, "Control Rod Scram Accumulators." During MODES 3 and 4, control rods are not able to be withdrawn since the reactor mode switch is in shutdown and a control rod block is applied. This provides adequate requirements for control rod OPERABILITY during these conditions.
| |
| ACTIONS A.1 With one or more withdrawn control rods inoperable, action must be immediately initiated to fully insert the inoperable control rod(s). Inserting the control rod(s) ensures that the shutdown and scram capabilities are not adversely affected. Actions must continue until the inoperable control rod(s) is fully inserted.
| |
| SURVEILLANCE SR 3.9.5.1 and SR 3.9.5.2 REQUIREMENTS During MODE 5, the OPERABILITY of control rods is primarily required to ensure that a withdrawn control rod will automatically insert if a signal requiring a reactor shutdown occurs. Because no explicit analysis exists for automatic shutdown during refueling, the shutdown function is satisfied if the withdrawn control rod is capable of automatic insertion and the associated CRD scram accumulator pressure is 940 psig.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.9.5-2 Revision 0
| |
| | |
| Control Rod OPERABILITYRefueling B 3.9.5 BASES SURVEILLANCE SR 3.9.5.1 and SR 3.9.5.2 (continued)
| |
| REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.9.5.1 is modified by a Note that allows 7 days after withdrawal of the control rod to perform the Surveillance.
| |
| This acknowledges that the control rod must first be withdrawn before performance of the Surveillance, and therefore avoids potential conflicts with SR 3.0.1.
| |
| REFERENCES 1. 10 CFR 50, Appendix A, GDC 26.
| |
| : 2. UFSAR, Section 15.4.1.1.
| |
| LaSalle 1 and 2 B 3.9.5-3 Revision 51
| |
| | |
| RPV Water LevelIrradiated Fuel B 3.9.6 B 3.9 REFUELING OPERATIONS B 3.9.6 Reactor Pressure Vessel (RPV) Water LevelIrradiated Fuel BASES BACKGROUND The movement of irradiated fuel assemblies within the RPV requires a minimum water level of 22 ft above the top of the RPV flange. During refueling, this maintains a sufficient water level in the reactor vessel cavity and spent fuel storage pool. Sufficient water is necessary to retain iodine fission product activity in the water in the event of a fuel handling accident (Refs. 1 and 2). Sufficient iodine activity would be retained to limit offsite doses from the accident to 10 CFR 50.67 limits, as modified by the guidance of Reference 1.
| |
| APPLICABLE During movement of irradiated fuel assemblies the water SAFETY ANALYSES level in the RPV is an initial condition design parameter in the analysis of a fuel handling accident in containment postulated by Regulatory Guide 1.183 (Ref. 1). A minimum water level of 23 ft allows a decontamination factor of 200 to be used in the accident analysis for iodine (Ref. 1).
| |
| This relates to the assumption that 99.5% of the total iodine released from the pellet to cladding gap of all the damaged fuel assembly rods is retained by the refueling cavity water.
| |
| Analysis of the fuel handling accident inside containment is described in Reference 2. With a minimum water level of 22 ft and a minimum decay time of 24 hours prior to fuel handling, the analysis and test programs demonstrate that the iodine release due to a postulated fuel handling accident is adequately captured by the water, and that offsite doses are maintained within allowable limits (Ref. 3). While the worst case assumptions include the dropping of the irradiated fuel assembly being handled onto the reactor core, the possibility exists of the dropped assembly striking the RPV flange and releasing fission products. Therefore, the minimum depth for water (continued)
| |
| LaSalle 1 and 2 B 3.9.6-1 Revision 48
| |
| | |
| RPV Water LevelIrradiated Fuel B 3.9.6 BASES APPLICABLE coverage to ensure acceptable radiological consequences is SAFETY ANALYSES specified from the RPV flange. Since the worst case event (continued) results in failed fuel assemblies seated in the core, as well as the dropped assembly, dropping an assembly on the RPV flange will result in reduced releases of fission gases.
| |
| RPV water level satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO A minimum water level of 22 ft above the top of the RPV flange is required to ensure that the radiological consequences of a postulated fuel handling accident are within acceptable limits, as provided by the guidance of Reference 1.
| |
| APPLICABILITY LCO 3.9.6 is applicable when moving irradiated fuel assemblies within the RPV. The LCO minimizes the possibility of a fuel handling accident in containment that is beyond the assumptions of the safety analysis. If irradiated fuel is not present within the RPV, there can be no significant radioactivity release as a result of a postulated fuel handling accident. Requirements for handling of new fuel assemblies or control rods (where water depth to the RPV flange is not of concern) are covered by LCO 3.9.7, "RPV Water Level - New Fuel or Control Rods."
| |
| Requirements for fuel handling accidents in the spent fuel storage pool are covered by LCO 3.7.8, "Spent Fuel Storage Pool Water Level."
| |
| ACTIONS A.1 If the water level is < 22 ft above the top of the RPV flange, all operations involving movement of irradiated fuel assemblies within the RPV shall be suspended immediately to ensure that a fuel handling accident cannot occur. The suspension of irradiated fuel movement shall not preclude completion of movement of a component to a safe position.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.9.6-2 Revision 48
| |
| | |
| RPV Water LevelIrradiated Fuel B 3.9.6 BASES (continued)
| |
| SURVEILLANCE SR 3.9.6.1 REQUIREMENTS Verification of a minimum water level of 22 ft above the top of the RPV flange ensures that the design basis for the postulated fuel handling accident analysis during refueling operations is met. Water at the required level limits the consequences of damaged fuel rods, which are postulated to result from a fuel handling accident in containment (Ref. 2).
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. Regulatory Guide 1.183, July 2000.
| |
| : 2. UFSAR, Section 15.7.4.
| |
| : 3. 10 CFR 50.67.
| |
| LaSalle 1 and 2 B 3.9.6-3 Revision 51
| |
| | |
| RPV Water LevelNew Fuel or Control Rods B 3.9.7 B 3.9 REFUELING OPERATIONS B 3.9.7 Reactor Pressure Vessel (RPV) Water LevelNew Fuel or Control Rods BASES BACKGROUND The movement of new fuel assemblies or handling of control rods within the RPV when fuel assemblies seated within the reactor vessel are irradiated requires a minimum water level of 23 ft above the top of irradiated fuel assemblies seated within the RPV. During refueling, this maintains a sufficient water level above the irradiated fuel.
| |
| Sufficient water is necessary to retain iodine fission product activity in the water in the event of a fuel handling accident (Refs. 1 and 2). Sufficient iodine activity would be retained to limit offsite doses from the accident to 10 CFR 50.67 limits, as modified by the guidance of Reference 1.
| |
| APPLICABLE During movement of new fuel assemblies or handling of SAFETY ANALYSES control rods over irradiated fuel assemblies, the water level in the RPV is an initial condition design parameter in the analysis of a fuel handling accident in containment postulated by Regulatory Guide 1.183 (Ref. 1). A minimum water level of 23 ft allows a decontamination factor of 200 to be used in the accident analysis for iodine (Ref. 1).
| |
| This relates to the assumption that 99.5% of the total iodine released from the pellet to cladding gap of all the damaged fuel assembly rods is retained by the refueling cavity water.
| |
| Analysis of the fuel handling accident inside containment is described in Reference 2. With a minimum water level of 23 ft and a minimum decay time of 24 hours prior to fuel handling, the analysis and test programs demonstrate that the iodine release due to a postulated fuel handling accident is adequately captured by the water, and that offsite doses are maintained within allowable limits (Ref. 3). The related assumptions include the worst case dropping of an irradiated fuel assembly onto the reactor core loaded with irradiated fuel assemblies.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.9.7-1 Revision 48
| |
| | |
| RPV Water LevelNew Fuel or Control Rods B 3.9.7 BASES APPLICABLE RPV water level satisfies Criterion 2 of SAFETY ANALYSES 10 CFR 50.36(c)(2)(ii).
| |
| (continued)
| |
| LCO A minimum water level of 23 ft above the top of irradiated fuel assemblies seated within the RPV is required to ensure that the radiological consequences of a postulated fuel handling accident are within acceptable limits, as provided by the guidance of Reference 1.
| |
| APPLICABILITY LCO 3.9.7 is applicable when moving new fuel assemblies or handling control rods (i.e., movement with other than the normal control rod drive) when irradiated fuel assemblies are seated within the RPV. The LCO minimizes the possibility of a fuel handling accident in containment that is beyond the assumptions of the safety analysis. If irradiated fuel is not present within the RPV, there can be no significant radioactivity release as a result of a postulated fuel handling accident. Requirements for fuel handling accidents in the spent fuel storage pool are covered by LCO 3.7.8, "Spent Fuel Storage Pool Water Level."
| |
| Requirements for handling irradiated fuel over the RPV are covered by LCO 3.9.6, "Reactor Pressure Vessel (RPV) Water LevelIrradiated Fuel."
| |
| ACTIONS A.1 If the water level is < 23 ft above the top of irradiated fuel assemblies seated within the RPV, all operations involving movement of new fuel assemblies and handling of control rods within the RPV shall be suspended immediately to ensure that a fuel handling accident cannot occur. The suspension of fuel movement and control rod handling shall not preclude completion of movement of a component to a safe position.
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.9.7-2 Revision 48
| |
| | |
| RPV Water LevelNew Fuel or Control Rods B 3.9.7 BASES (continued)
| |
| SURVEILLANCE SR 3.9.7.1 REQUIREMENTS Verification of a minimum water level of 23 ft above the top of the irradiated fuel assemblies seated within the RPV ensures that the design basis for the postulated fuel handling accident analysis during refueling operations is met. Water at the required level limits the consequences of damaged fuel rods, which are postulated to result from a fuel handling accident in containment (Ref. 2).
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| REFERENCES 1. Regulatory Guide 1.183, July 2000.
| |
| : 2. UFSAR, Section 15.7.4.
| |
| : 3. 10 CFR 50.67.
| |
| LaSalle 1 and 2 B 3.9.7-3 Revision 51
| |
| | |
| RHRHigh Water Level B 3.9.8 B 3.9 REFUELING OPERATIONS B 3.9.8 Residual Heat Removal (RHR)High Water Level BASES BACKGROUND The purpose of the RHR System in MODE 5 is to remove decay heat and sensible heat from the reactor coolant, as required by GDC 34 (Ref. 1). Each of the two shutdown cooling loops of the RHR System can provide the required decay heat removal. Each loop consists of one motor driven pump, a heat exchanger, and associated piping and valves. Both loops have a common suction from the same recirculation loop. Each pump discharges the reactor coolant, after it has been cooled by circulation through the respective heat exchangers, to the reactor via the associated recirculation loop. The RHR heat exchangers transfer heat to the RHR Service Water (RHRSW) System. The RHR shutdown cooling mode is manually controlled.
| |
| In addition to the RHR subsystems, the volume of water above the reactor pressure vessel (RPV) flange provides a heat sink for decay heat removal.
| |
| APPLICABLE With the unit in MODE 5, the RHR shutdown cooling subsystem SAFETY ANALYSES is not required to mitigate any events or accidents evaluated in the safety analyses. The RHR shutdown cooling subsystem is required for removing decay heat to maintain the temperature of the reactor coolant.
| |
| The RHR System satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO Only one RHR shutdown cooling subsystem is required to be OPERABLE and in operation in MODE 5 with irradiated fuel in the RPV and the water level t 22 ft above the RPV flange.
| |
| Only one subsystem is required to be OPERABLE because the volume of water above the RPV flange provides backup decay heat removal capability.
| |
| An OPERABLE RHR shutdown cooling subsystem consists of an RHR pump, a heat exchanger, the necessary portions of the RHRSW System and Ultimate Heat Sink capable of providing (continued)
| |
| LaSalle 1 and 2 B 3.9.8-1 Revision 0
| |
| | |
| RHRHigh Water Level B 3.9.8 BASES LCO cooling to the RHR heat exchanger, valves, piping, (continued) instruments, and controls to ensure an OPERABLE flow path.
| |
| Management of gas voids is important to RHR Shutdown Cooling System OPERABILITY.
| |
| Additionally, each RHR shutdown cooling subsystem is considered OPERABLE if it can be manually aligned (remote or local) in the shutdown cooling mode for removal of decay heat. Operation (either continuous or intermittent) of one subsystem can maintain and reduce the reactor coolant temperature as required. However, to ensure adequate core flow to allow for accurate average reactor coolant temperature monitoring, nearly continuous operation is required. A Note is provided to allow a 2 hour exception for the operating subsystem to not be in operation every 8 hours. This is permitted because the core heat generation can be low enough and the heatup rate slow enough to allow some changes to the RHR subsystem or other operations requiring RHR flow interruption.
| |
| APPLICABILITY One RHR shutdown cooling subsystem must be OPERABLE and in operation in MODE 5, with irradiated fuel in the RPV and with the water level t 22 ft above the top of the RPV flange, to provide decay heat removal. RHR shutdown cooling subsystem requirements in other MODES are covered by LCOs in Section 3.4, Reactor Coolant System (RCS). RHR shutdown cooling subsystem requirements in MODE 5, with irradiated fuel in the RPV and with the water level < 22 ft above the RPV flange, are given in LCO 3.9.9, "Residual Heat Removal (RHR)Low Water Level."
| |
| ACTIONS A.1 With no RHR shutdown cooling subsystem OPERABLE, an alternate method of decay heat removal must be provided within 1 hour. In this condition, the volume of water above the RPV flange provides adequate capability to remove decay heat from the reactor core. However, the overall reliability is reduced because loss of water level could result in reduced decay heat removal capability. The 1 hour Completion Time is based on the decay heat removal function and the probability of a loss of the available decay heat removal capabilities. Furthermore, verification of the (continued)
| |
| LaSalle 1 and 2 B 3.9.8-2 Revision 60
| |
| | |
| RHRHigh Water Level B 3.9.8 BASES ACTIONS A.1 (continued) functional availability of the alternate method must be reconfirmed every 24 hours thereafter. This will ensure continued heat removal capability.
| |
| Alternate decay heat removal methods are available to the operators for review and preplanning in the unit operating procedures. The required cooling capacity of the alternate method should be sufficient to maintain or reduce temperature. Decay heat removal by ambient losses can be considered as, or contributing to, the alternate method capability. Alternate methods that can be used include (but are not limited to) the Fuel Pool Cooling System (operating with positive flow from the reactor cavity to the skimmer surge tank), the Reactor Water Cleanup System, the Control Rod Drive System, or an inoperable but functional RHR shutdown cooling subsystem. The method used to remove the decay heat should be the most prudent choice based on unit conditions.
| |
| B.1, B.2, B.3, and B.4 If no RHR shutdown cooling subsystem is OPERABLE and an alternate method of decay heat removal is not available in accordance with Required Action A.1, actions shall be taken immediately to suspend operations involving an increase in reactor decay heat load by suspending the loading of irradiated fuel assemblies into the RPV.
| |
| Additional actions are required to minimize any potential fission product release to the environment. This includes ensuring secondary containment is OPERABLE; one standby gas treatment subsystem is OPERABLE; and secondary containment isolation capability is available in each associated penetration flow path not isolated that is assumed to be isolated to mitigate radioactive releases (i.e., one secondary containment isolation valve and associated instrumentation are OPERABLE or other acceptable administrative controls to assure isolation capability.
| |
| These administrative controls consist of stationing a dedicated operator, who is in continuous communication with the control room, at the controls of the isolation device.
| |
| In this way, the penetration can be rapidly isolated when a need for secondary containment isolation is indicated).
| |
| (continued)
| |
| LaSalle 1 and 2 B 3.9.8-3 Revision 87
| |
| | |
| RHRHigh Water Level B 3.9.8 BASES ACTIONS B.1, B.2, B.3, and B.4 (continued)
| |
| This may be performed as an administrative check, by examining logs or other information to determine whether the components are out of service for maintenance or other reasons. It is not necessary to perform the Surveillances needed to demonstrate the OPERABILITY of the components.
| |
| If, however, any required component is inoperable, then it must be restored to OPERABLE status. In this case, a surveillance may need to be performed to restore the component to OPERABLE status. Actions must continue until all required components are OPERABLE.
| |
| C.1 and C.2 If no RHR shutdown cooling subsystem is in operation, an alternate method of coolant circulation is required to be established within 1 hour. The Completion Time is modified such that 1 hour is applicable separately for each occurrence involving a loss of coolant circulation.
| |
| During the period when the reactor coolant is being circulated by an alternate method (other than by the required RHR shutdown cooling subsystem), the reactor coolant temperature must be periodically monitored to ensure proper functioning of the alternate method. The once per hour Completion Time is deemed appropriate.
| |
| SURVEILLANCE SR 3.9.8.1 REQUIREMENTS This Surveillance demonstrates that the required RHR shutdown cooling subsystem is in operation and circulating reactor coolant in accordance with normal procedural requirements. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
| |
| SR 3.9.8.2 RHR Shutdown Cooling System piping and components have the potential to develop voids and pockets of entrained gases.
| |
| Preventing and managing gas intrusion and accumulation is necessary for proper operation of the required RHR shutdown (continued)
| |
| LaSalle 1 and 2 B 3.9.8-4 Revision 60
| |
| | |
| RHRHigh Water Level B 3.9.8 BASES SURVEILLANCE SR 3.9.8.2 (continued)
| |
| REQUIREMENTS cooling subsystem(s) and may also prevent water hammer, pump cavitation, and pumping of noncondensible gas into the reactor vessel.
| |
| Selection of RHR Shutdown Cooling System locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.
| |
| The RHR Shutdown Cooling System is OPERABLE when it is sufficiently filled with water. Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criteria for gas volume at the suction or discharge of a pump), the Surveillance is not met. If it is determined by subsequent evaluation that the RHR Shutdown Cooling System is not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water), the Surveillance may be declared met.
| |
| Accumulated gas should be eliminated or brought within the acceptance criteria limits.
| |
| RHR Shutdown Cooling System locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative subset of susceptible locations. Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not (continued)
| |
| LaSalle 1 and 2 B 3.9.8-5 Revision 60
| |
| | |
| RHRHigh Water Level B 3.9.8 BASES SURVEILLANCE SR 3.9.8.2 (continued)
| |
| REQUIREMENTS required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.
| |
| The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation.
| |
| REFERENCES 1. 10 CFR 50, Appendix A, GDC 34.
| |
| LaSalle 1 and 2 B 3.9.8-6 Revision 60
| |
| | |
| RHRLow Water Level B 3.9.9 B 3.9 REFUELING OPERATIONS B 3.9.9 Residual Heat Removal (RHR)Low Water Level BASES BACKGROUND The purpose of the RHR System in MODE 5 is to remove decay heat and sensible heat from the reactor coolant, as required by GDC 34 (Ref. 1). Each of the two shutdown cooling loops of the RHR System can provide the required decay heat removal. Each loop consists of one motor driven pump, a heat exchanger, and associated piping and valves. Both loops have a common suction from the same recirculation loop. Each pump discharges the reactor coolant, after it has been cooled by circulation through the respective heat exchangers, to the reactor via the associated recirculation loop. The RHR heat exchangers transfer heat to the RHR Service Water (RHRSW) System. The RHR shutdown cooling mode is manually controlled.
| |
| APPLICABLE With the unit in MODE 5, the RHR shutdown cooling subsystems SAFETY ANALYSES are not required to mitigate any events or accidents evaluated in the safety analyses. The RHR shutdown cooling subsystems are required for removing decay heat to maintain the temperature of the reactor coolant.
| |
| The RHR System satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii).
| |
| LCO In MODE 5 with irradiated fuel in the reactor pressure vessel (RPV) and with the water level < 22 ft above the RPV flange both RHR shutdown cooling subsystems must be OPERABLE and one RHR shutdown cooling subsystem must be in operation.
| |
| An OPERABLE RHR shutdown cooling subsystem consists of an RHR pump, a heat exchanger, the necessary portions of the RHRSW System and Ultimate Heat Sink capable of providing cooling to the RHR heat exchanger, valves, piping, instruments, and controls to ensure an OPERABLE flow path.
| |
| Management of gas voids is important to RHR Shutdown Cooling System OPERABILITY.
| |
| Additionally, each RHR shutdown cooling subsystem is considered OPERABLE if it can be manually aligned (remote or (continued)
| |
| LaSalle 1 and 2 B 3.9.9-1 Revision 60
| |
| | |
| RHRLow Water Level B 3.9.9 BASES LCO local) in the shutdown cooling mode for removal of decay (continued) heat. Operation (either continuous or intermittent) of one subsystem can maintain and reduce the reactor coolant temperature as required. However, to ensure adequate core flow to allow for accurate average reactor coolant temperature monitoring, nearly continuous operation is required. A Note is provided to allow a 2 hour exception for the operating subsystem to not be in operation every 8 hours. This is permitted because the core heat generation can be low enough and the heatup rate slow enough to allow some changes to the RHR subsystem or other operations requiring RHR flow interruption.
| |
| APPLICABILITY Two RHR shutdown cooling subsystems are required to be OPERABLE and one RHR shutdown cooling subsystem must be in operation in MODE 5, with irradiated fuel in the RPV and with the water level < 22 ft above the top of the RPV flange, to provide decay heat removal. RHR shutdown cooling subsystem requirements in other MODES are covered by LCOs in Section 3.4, Reactor Coolant System (RCS). RHR shutdown cooling subsystem requirements in MODE 5, with irradiated fuel in the RPV and the water level t 22 ft above the RPV flange, are given in LCO 3.9.8, "Residual Heat Removal (RHR)High Water Level."
| |
| ACTIONS A.1 With one of the two RHR shutdown cooling subsystems inoperable, the remaining subsystem is capable of providing the required decay heat removal. However, the overall reliability is reduced. Therefore, an alternate method of decay heat removal must be provided. With both RHR shutdown cooling subsystems inoperable, an alternate method of decay heat removal must be provided in addition to that provided for the initial RHR shutdown cooling subsystem inoperability. This re-establishes backup decay heat removal capabilities, similar to the requirements of the LCO. The 1 hour Completion Time is based on the decay heat removal function and the probability of a loss of the available decay heat removal capabilities. Furthermore, verification of the functional availability of these alternate method(s) must be reconfirmed ever}}
| |
