ML19150A511: Difference between revisions

From kanterella
Jump to navigation Jump to search
(Created page by program invented by StriderTol)
(StriderTol Bot change)
 
Line 2: Line 2:
| number = ML19150A511
| number = ML19150A511
| issue date = 05/10/2019
| issue date = 05/10/2019
| title = Revision 90 to Technical Specification Bases
| title = 0 to Technical Specification Bases
| author name =  
| author name =  
| author affiliation = Exelon Generation Co, LLC
| author affiliation = Exelon Generation Co, LLC
Line 16: Line 16:


=Text=
=Text=
{{#Wiki_filter:Technical Specifications Bases for the R.E. Ginna Nuclear Power Plant Docket No. 50-244 Revision 90 Effective Date: March 7, 2019 FCMS ID: TSB R.E. Ginna Nuclear Power Plant        -1                  Revision 90
{{#Wiki_filter:}}
 
List of Effective Pages (Bases)
Page        Revision #      Page          Revision # Page        Revision #
Bases - i        78          B 3.1.3-4          34    B 3.2.1-4      78 Bases - ii      78          B 3.1.3-5          34    B 3.2.1-5      78 Bases - iii      50          B 3.1.3-6          34    B 3.2.1-6      78 B 3.2.1-7      78 B 2.1.1-1        78          B 3.1.4-1          60    B 3.2.1-8      78 B 2.1.1-2        42          B 3.1.4-2          60    B 3.2.1-9      77 B 2.1.1-3        42          B 3.1.4-3          60    B 3.2.1-10    77 B 2.1.1-4        42          B 3.1.4-4          60    B 3.2.1-11    77 B 3.1.4-5          88    B 3.2.1-12    42 B 2.1.2-1        78          B 3.1.4-6          88 B 2.1.2-2        78          B 3.1.4-7          88    B 3.2.2-1      21 B 2.1.2-3        78          B 3.1.4-8          88    B 3.2.2-2      21 B 2.1.2-4        58          B 3.1.4-9          88    B 3.2.2-3      21 B 3.2.2-4      21 B 3.0-1          82          B 3.1.5-1          88    B 3.2.2-5      21 B 3.0-2          50          B 3.1.5-2          78    B 3.2.2-6      77 B 3.0-3          82          B 3.1.5-3          88 B 3.0-4          82          B 3.1.5-4          88    B 3.2.3-1      42 B 3.0-5          82          B 3.1.5-5          88    B 3.2.3-2      42 B 3.0-6          82          B 3.1.5-6          88    B 3.2.3-3      77 B 3.0-7          82                                    B 3.2.3-4      42 B 3.0-8          82          B 3.1.6-1          60 B 3.0-9          82          B 3.1.6-2          60    B 3.2.4-1      42 B 3.0-10        82          B 3.1.6-3          60    B 3.2.4-2      42 B 3.0-11        82          B 3.1.6-4          88    B 3.2.4-3      42 B 3.0-12        81          B 3.1.6-5          88    B 3.2.4-4      42 B 3.0-13        50          B 3.1.6-6          88    B 3.2.4-5      77 B 3.0-14        82          B 3.1.6-7          88    B 3.2.4-6      77 B 3.0-15        82 B 3.0-16        82          B 3.1.7-1          70    B 3.3.1-1      61 B 3.0-17        82          B 3.1.7-2          70    B 3.3.1-2      61 B 3.1.7-3          70    B 3.3.1-3      61 B 3.1.1-1        42          B 3.1.7-4          88    B 3.3.1-4      61 B 3.1.1-2        42          B 3.1.7-5          88    B 3.3.1-5      61 B 3.1.1-3        42          B 3.1.7-6          88    B 3.3.1-6      61 B 3.1.1-4        42          B 3.1.7-7          88    B 3.3.1-7      61 B 3.1.1-5        77                                    B 3.3.1-8      61 B 3.1.1-6        42          B 3.1.8-1          34    B 3.3.1-9      61 B 3.1.8-2          34    B 3.3.1-10    61 B 3.1.2-1        21          B 3.1.8-3          34    B 3.3.1-11    61 B 3.1.2-2        21          B 3.1.8-4          34    B 3.3.1-12    61 B 3.1.2-3        21          B 3.1.8-5          34    B 3.3.1-13    61 B 3.1.2-4        21          B 3.1.8-6          34    B 3.3.1-14    61 B 3.1.2-5        77          B 3.1.8-7          77    B 3.3.1-15    61 B 3.1.2-6        21          B 3.1.8-8          77    B 3.3.1-16    61 B 3.3.1-17    61 B 3.1.3-1        34          B 3.2.1-1          42    B 3.3.1-18    61 B 3.1.3-2        34          B 3.2.1-2          42    B 3.3.1-19    61 B 3.1.3-3        34          B 3.2.1-3          42    B 3.3.1-20    61 R.E. Ginna Nuclear Power Plant        BAS LEP-1                      Revision 90
 
List of Effective Pages (Bases)
Page        Revision #      Page          Revision # Page      Revision #
B 3.3.1-21      61          B 3.3.2-21        42    B 3.3.5-6    42 B 3.3.1-22      61          B 3.3.2-22        42    B 3.3.5-7    42 B 3.3.1-23      61          B 3.3.2-23        42    B 3.3.5-8    77 B 3.3.1-24      61          B 3.3.2-24        42    B 3.3.5-9    77 B 3.3.1-25      61          B 3.3.2-25        42 B 3.3.1-26      61          B 3.3.2-26        42    B 3.3.6-1    38 B 3.3.1-27      61          B 3.3.2-27        42    B 3.3.6-2    38 B 3.3.1-28      61          B 3.3.2-28        42    B 3.3.6-3    38 B 3.3.1-29      61          B 3.3.2-29        42    B 3.3.6-4    38 B 3.3.1-30      61          B 3.3.2-30        42    B 3.3.6-5    38 B 3.3.1-31      61          B 3.3.2-31        77    B 3.3.6-6    38 B 3.3.1-32      61          B 3.3.2-32        89    B 3.3.6-7    77 B 3.3.1-33      61          B 3.3.2-33        77    B 3.3.6-8    77 B 3.3.1-34      61          B 3.3.2-34        77    B 3.3.6-9    38 B 3.3.1-35      61          B 3.3.2-35        89 B 3.3.1-36      61          B 3.3.2-36        42    B 3.4.1-1    42 B 3.3.1-37      61                                    B 3.4.1-2    42 B 3.3.1-38      61          B 3.3.3-1          73    B 3.4.1-3    42 B 3.3.1-39      61          B 3.3.3-2          73    B 3.4.1-4    77 B 3.3.1-40      77          B 3.3.3-3          73    B 3.4.1-5    77 B 3.3.1-41      77          B 3.3.3-4          86 B 3.3.1-42      77          B 3.3.3-5          73    B 3.4.2-1    21 B 3.3.1-43      89          B 3.3.3-6          73    B 3.4.2-2    21 B 3.3.1-44      89          B 3.3.3-7          73    B 3.4.2-3    77 B 3.3.1-45      77          B 3.3.3-8          73 B 3.3.1-46      89          B 3.3.3-9          73    B 3.4.3-1    78 B 3.3.1-47      89          B 3.3.3-10        79    B 3.4.3-2    21 B 3.3.1-48      61          B 3.3.3-11        73    B 3.4.3-3    21 B 3.3.3-12        73    B 3.4.3-4    21 B 3.3.2-1        42          B 3.3.3-13        73    B 3.4.3-5    21 B 3.3.2-2        42          B 3.3.3-14        73    B 3.4.3-6    77 B 3.3.2-3        42          B 3.3.3-15        73 B 3.3.2-4        42          B 3.3.3-16        77    B 3.4.4-1    78 B 3.3.2-5        42          B 3.3.3-17        77    B 3.4.4-2    46 B 3.3.2-6        42                                    B 3.4.4-3    77 B 3.3.2-7        42          B 3.3.4-1          37    B 3.4.4-4    46 B 3.3.2-8        42          B 3.3.4-2          37 B 3.3.2-9        42          B 3.3.4-3          37    B 3.4.5-1    61 B 3.3.2-10      42          B 3.3.4-4          37    B 3.4.5-2    61 B 3.3.2-11      42          B 3.3.4-5          37    B 3.4.5-3    61 B 3.3.2-12      42          B 3.3.4-6          37    B 3.4.5-4    61 B 3.3.2-13      42          B 3.3.4-7          77    B 3.4.5-5    77 B 3.3.2-14      42          B 3.3.4-8          37    B 3.4.5-6    77 B 3.3.2-15      42 B 3.3.2-16      42          B 3.3.5-1          42    B 3.4.6-1    76 B 3.3.2-17      42          B 3.3.5-2          42    B 3.4.6-2    76 B 3.3.2-18      42          B 3.3.5-3          42    B 3.4.6-3    76 B 3.3.2-19      42          B 3.3.5-4          42    B 3.4.6-4    76 B 3.3.2-20      42          B 3.3.5-5          42    B 3.4.6-5    77 R.E. Ginna Nuclear Power Plant        BAS LEP-2                      Revision 90
 
List of Effective Pages (Bases)
Page        Revision #      Page          Revision # Page        Revision #
B 3.4.6-6        77          B 3.4.13-1        52    B 3.5.2-5      76 B 3.4.13-2        52    B 3.5.2-6      76 B 3.4.7-1        76          B 3.4.13-3        52    B 3.5.2-7      76 B 3.4.7-2        76          B 3.4.13-4        52    B 3.5.2-8      76 B 3.4.7-3        76          B 3.4.13-5        77    B 3.5.2-9      76 B 3.4.7-4        76          B 3.4.13-6        77    B 3.5.2-10    76 B 3.4.7-5        77                                    B 3.5.2-11    77 B 3.4.7-6        77          B 3.4.14-1        58    B 3.5.2-12    81 B 3.4.14-2        58    B 3.5.2-13    77 B 3.4.8-1        76          B 3.4.14-3        58    B 3.5.2-14    77 B 3.4.8-2        76          B 3.4.14-4        58    B 3.5.2-15    76 B 3.4.8-3        76          B 3.4.14-5        58    B 3.5.2-16    76 B 3.4.8-4        77          B 3.4.14-6        77    B 3.5.2-17    76 B 3.4.8-5        77          B 3.4.14-7        77    B 3.5.2-18    76 B 3.4.9-1        21          B 3.4.15-1        62    B 3.5.3-1      76 B 3.4.9-2        21          B 3.4.15-2        62    B 3.5.3-2      76 B 3.4.9-3        21          B 3.4.15-3        62    B 3.5.3-3      76 B 3.4.9-4        77          B 3.4.15-4        62    B 3.5.3-4      76 B 3.4.9-5        21          B 3.4.15-5        77 B 3.4.15-6        62    B 3.5.4-1      42 B 3.4.10-1      58                                    B 3.5.4-2      42 B 3.4.10-2      58          B 3.4.16-1        80    B 3.5.4-3      42 B 3.4.10-3      58          B 3.4.16-2        80    B 3.5.4-4      77 B 3.4.10-4      81          B 3.4.16-3        80    B 3.5.4-5      77 B 3.4.10-5      58          B 3.4.16-4        80 B 3.4.16-5        80    B 3.6.1-1      42 B 3.4.11-1      58                                    B 3.6.1-2      42 B 3.4.11-2      58          B 3.4.17-1        46    B 3.6.1-3      42 B 3.4.11-3      58          B 3.4.17-2        46    B 3.6.1-4      42 B 3.4.11-4      58          B 3.4.17-3        46    B 3.6.1-5      42 B 3.4.11-5      58          B 3.4.17-4        46    B 3.6.1-6      42 B 3.4.11-6      58          B 3.4.17-5        46 B 3.4.11-7      77          B 3.4.17-6        46    B 3.6.2-1      21 B 3.4.17-7        46    B 3.6.2-2      21 B 3.4.12-1      52                                    B 3.6.2-3      21 B 3.4.12-2      52          B 3.5.1-1          44    B 3.6.2-4      21 B 3.4.12-3      52          B 3.5.1-2          44    B 3.6.2-5      21 B 3.4.12-4      52          B 3.5.1-3          44    B 3.6.2-6      21 B 3.4.12-5      52          B 3.5.1-4          44    B 3.6.2-7      77 B 3.4.12-6      52          B 3.5.1-5          44 B 3.4.12-7      52          B 3.5.1-6          77    B 3.6.3-1      64 B 3.4.12-8      52          B 3.5.1-7          77    B 3.6.3-2      64 B 3.4.12-9      52          B 3.5.1-8          44    B 3.6.3-3      64 B 3.4.12-10      52                                    B 3.6.3-4      64 B 3.4.12-11      77          B 3.5.2-1          76    B 3.6.3-5      64 B 3.4.12-12      77          B 3.5.2-2          76    B 3.6.3-6      64 B 3.4.12-13      77          B 3.5.2-3          76    B 3.6.3-7      64 B 3.5.2-4          76    B 3.6.3-8      64 R.E. Ginna Nuclear Power Plant        BAS LEP-3                      Revision 90
 
List of Effective Pages (Bases)
Page        Revision #      Page          Revision # Page        Revision #
B 3.6.3-9        64          B 3.7.3-6          81    B 3.7.9-6      77 B 3.6.3-10      64          B 3.7.3-7          58    B 3.7.9-7      51 B 3.6.3-11      77          B 3.7.4-1          69    B 3.7.9-8      51 B 3.6.3-12      78          B 3.7.4-2          85 B 3.6.3-13      81          B 3.7.4-3          69    B 3.7.10-1    62 B 3.6.3-14      78          B 3.7.4-4          77    B 3.7.10-2    62 B 3.7.10-3    62 B 3.6.4-1        72          B 3.7.5-1          75    B 3.7.10-4    77 B 3.6.4-2        78          B 3.7.5-2          78    B 3.7.10-5    62 B 3.6.4-3        77          B 3.7.5-3          75    B 3.7.10-6    62 B 3.7.5-4          75 B 3.6.5-1        78          B 3.7.5-5          75    B 3.7.11-1    79 B 3.6.5-2        72          B 3.7.5-6          75    B 3.7.11-2    59 B 3.6.5-3        77          B 3.7.5-7          75    B 3.7.11-3    79 B 3.6.5-4        72          B 3.7.5-8          81    B 3.7.11-4    59 B 3.7.5-9          81 B 3.6.6-1        76          B 3.7.5-10          77    B 3.7.12-1    83 B 3.6.6-2        76          B 3.7.5-11          75    B 3.7.12-2    83 B 3.6.6-3        76          B 3.7.5-12          78    B 3.7.12-3    77 B 3.6.6-4        76                                    B 3.7.12-4    83 B 3.6.6-5        76          B 3.7.6-1          60 B 3.6.6-6        76          B 3.7.6-2          60    B 3.7.13-1    49 B 3.6.6-7        76          B 3.7.6-3          77    B 3.7.13-2    78 B 3.6.6-8        77          B 3.7.6-4          60    B 3.7.13-3    49 B 3.6.6-9        77                                    B 3.7.13-4    49 B 3.6.6-10      81          B 3.7.7-1          58    B 3.7.13-5    49 B 3.6.6-11      77          B 3.7.7-2          58    B 3.7.13-6    49 B 3.6.6-12      76          B 3.7.7-3          81    B 3.7.13-7    49 B 3.6.6-13      77          B 3.7.7-4          58 B 3.6.6-14      76          B 3.7.7-5          58    B 3.7.14-1    42 B 3.6.6-15      76          B 3.7.7-6          81    B 3.7.14-2    42 B 3.7.7-7          58    B 3.7.14-3    77 B 3.7.1-1        58 B 3.7.1-2        81          B 3.7.8-1          68    B 3.8.1-1      63 B 3.7.1-3        58          B 3.7.8-2          68    B 3.8.1-2      63 B 3.7.1-4        81          B 3.7.8-3          68    B 3.8.1-3      63 B 3.7.8-4          68    B 3.8.1-4      63 B 3.7.2-1        58          B 3.7.8-5          84    B 3.8.1-5      63 B 3.7.2-2        58          B 3.7.8-6          68    B 3.8.1-6      63 B 3.7.2-3        58          B 3.7.8-7          77    B 3.8.1-7      63 B 3.7.2-4        58          B 3.7.8-8          84    B 3.8.1-8      63 B 3.7.2-5        81          B 3.7.8-9          68    B 3.8.1-9      63 B 3.7.2-6        77          B 3.7.8-10          68    B 3.8.1-10    63 B 3.8.1-11    63 B 3.7.3-1        58          B 3.7.9-1          51    B 3.8.1-12    77 B 3.7.3-2        58          B 3.7.9-2          51    B 3.8.1-13    77 B 3.7.3-3        58          B 3.7.9-3          51    B 3.8.1-14    77 B 3.7.3-4        58          B 3.7.9-4          51    B 3.8.1-15    77 B 3.7.3-5        81          B 3.7.9-5          51    B 3.8.1-16    77 R.E. Ginna Nuclear Power Plant        BAS LEP-4                      Revision 90
 
List of Effective Pages (Bases)
Page        Revision #      Page          Revision # Page Revision #
B 3.8.1-17      74          B 3.8.9-2        68 B 3.8.9-3        68 B 3.8.2-1        61          B 3.8.9-4        68 B 3.8.2-2        61          B 3.8.9-5        68 B 3.8.2-3        61          B 3.8.9-6        68 B 3.8.2-4        61          B 3.8.9-7        68 B 3.8.2-5        61          B 3.8.9-8        68 B 3.8.2-6        61          B 3.8.9-9        90 B 3.8.9-10        68 B 3.8.3-1        48          B 3.8.9-11        68 B 3.8.3-2        48 B 3.8.3-3        77          B 3.8.10-1        61 B 3.8.3-4        48          B 3.8.10-2        61 B 3.8.10-3        61 B 3.8.4-1        41          B 3.8.10-4        61 B 3.8.4-2        41          B 3.8.10-5        61 B 3.8.4-3        41          B 3.8.10-6        90 B 3.8.4-4        41 B 3.8.4-5        41          B 3.9.1-1        61 B 3.8.4-6        77          B 3.9.1-2        61 B 3.8.4-7        87          B 3.9.1-3        61 B 3.8.4-8        77          B 3.9.1-4        77 B 3.8.4-9        41 B 3.9.2-1        61 B 3.8.5-1        61          B 3.9.2-2        61 B 3.8.5-2        61          B 3.9.2-3        61 B 3.8.5-3        61          B 3.9.2-4        77 B 3.8.5-4        61 B 3.8.5-5        61          B 3.9.3-1        53 B 3.9.3-2        53 B 3.8.6-1        40          B 3.9.3-3        53 B 3.8.6-2        40          B 3.9.3-4        77 B 3.8.6-3        77          B 3.9.3-5        53 B 3.8.6-4        77 B 3.9.4-1        76 B 3.8.7-1        41          B 3.9.4-2        76 B 3.8.7-2        41          B 3.9.4-3        76 B 3.8.7-3        41          B 3.9.4-4        77 B 3.8.7-4        41          B 3.9.4-5        77 B 3.8.7-5        41 B 3.8.7-6        77          B 3.9.5-1        76 B 3.9.5-2        76 B 3.8.8-1        61          B 3.9.5-3        76 B 3.8.8-2        61          B 3.9.5-4        77 B 3.8.8-3        61          B 3.9.5-5        77 B 3.8.8-4        61 B 3.8.8-5        77          B 3.9.6-1        59 B 3.9.6-2        78 B 3.8.9-1        68          B 3.9.6-3        77 R.E. Ginna Nuclear Power Plant        BAS LEP-5                Revision 90
 
TABLE OF CONTENTS (Bases)
B 2.0    SAFETY LIMITS (SLs)
B 2.1.1        Reactor Core SLs. ......................................................................................... B 2.1.1-1 B 2.1.2        Reactor Coolant System (RCS) Pressure SL. ................................................ B 2.1.2-1 B 3.0    LIMITING CONDITION FOR OPERATION (LCO) AND SURVEILLANCE REQUIREMENT (SR) APPLICABILITY B 3.0          Limiting Condition for Operation (LCO) Applicability ........................................ B 3.0-1 B 3.0          Surveillance Requirement (SR) Applicability ................................................. B 3.0-12 B 3.1          REACTIVITY CONTROL SYSTEMS B 3.1.1            SHUTDOWN MARGIN (SDM) ............................................................... B 3.1.1-1 B 3.1.2            Core Reactivity . ..................................................................................... B 3.1.2-1 B 3.1.3            Moderator Temperature Coefficient (MTC)............................................. B 3.1.3-1 B 3.1.4            Rod Group Alignment Limits.... ............................................................... B 3.1.4-1 B 3.1.5            Shutdown Bank Insertion Limit ................................................................B 3.1.5-1 B 3.1.6            Control Bank Insertion Limits ................................................................... B 3.1.6-1 B 3.1.7            Rod Position Indication. ......................................................................... B 3.1.7-1 B 3.1.8            PHYSICS TESTS Exceptions  MODE 2 .............................................. B 3.1.8-1 B 3.2          POWER DISTRIBUTION LIMITS B 3.2.1            Heat Flux Hot Channel Factor (FQ(Z)) ...................................................
N                                        B 3.2.1-1 B 3.2.2            Nuclear Enthalpy Rise Hot Channel Factor (F H)................................. B 3.2.2-1 B 3.2.3            AXIAL FLUX DIFFERENCE (AFD) ......................................................... B 3.2.3-1 B 3.2.4            QUADRANT POWER TILT RATIO (QPTR) .......................................... B 3.2.4-1 B 3.3          INSTRUMENTATION B 3.3.1            Reactor Trip System (RTS) Instrumentation ........................................... B 3.3.1-1 B 3.3.2            Engineered Safety Feature Actuation System (ESFAS)
Instrumentation ......................................................................... B 3.3.2-1 B 3.3.3            Post Accident Monitoring (PAM) Instrumentation ................................... B 3.3.3-1 B 3.3.4            Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation.. ................................................................................... B 3.3.4-1 B 3.3.5            Containment Ventilation Isolation Instrumentation . ............................... B 3.3.5-1 B 3.3.6            Control Room Emergency Air Treatment System (CREATS) Instrumentation Actuation ........................................ B 3.3.6-1 B 3.4          REACTOR COOLANT SYSTEM (RCS)
B 3.4.1            RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB) Limits ................................................... B 3.4.1-1 B 3.4.2            RCS Minimum Temperature for Criticality .............................................. B 3.4.2-1 B 3.4.3            RCS Pressure and Temperature (P/T) Limits ......................................... B 3.4.3-1 B 3.4.4        RCS Loops  MODE 1 > 8.5% RTP ............................................................... B 3.4.4-1 B 3.4.5        RCS Loops  MODES 1  8.5% RTP, 2, and 3 .............................................. B 3.4.5-1 B 3.4.6        RCS Loops  MODE 4 .. ................................................................................. B 3.4.6-1 B 3.4.7        RCS Loops  MODE 5, Loops Filled . ............................................................. B 3.4.7-1 R.E. Ginna Nuclear Power Plant                Bases-i                                                                    Revision 78
 
B 3.4.8        RCS Loops  MODE 5, Loops Not Filled....................................................... B 3.4.8-1 B 3.4.9        Pressurizer      ..................................................................................................B 3.4.9-1 B 3.4.10          Pressurizer Safety Valves .................................................................. B 3.4.10-1 B 3.4.11          Pressurizer Power Operated Relief Valves (PORVs) ......................... B 3.4.11-1 B 3.4.12          Low Temperature Overpressure Protection (LTOP) System .............. B 3.4.12-1 B 3.4.13          RCS Operational LEAKAGE . ............................................................... B 3.4.13-1 B 3.4.14          RCS Pressure Isolation Valve (PIV) Leakage ...................................... B 3.4.14-1 B 3.4.15          RCS Leakage Detection Instrumentation.. ........................................... B 3.4.15-1 B 3.4.16          RCS Specific Activity . .......................................................................... B 3.4.16-1 B 3.4.17          Steam Generator (SG) Tube Integrity .................................................. B 3.4.17-1 B 3.5          EMERGENCY CORE COOLING SYSTEMS (ECCS)
B 3.5.1        Accumulators ................................................................................................ B 3.5.1-1 B 3.5.2        ECCS  MODES 1, 2, and 3. ....................................................................... B 3.5.2-1 B 3.5.3        ECCS  MODE 4 . ...........................................................................................B 3.5.3-1 B 3.5.4            Refueling Water Storage Tank (RWST) ..................................................B 3.5.4-1 B 3.6          CONTAINMENT SYSTEMS B 3.6.1        Containment................................................................................................... B 3.6.1-1 B 3.6.2            Containment Air Locks............................................................................. B 3.6.2-1 B 3.6.3            Containment Isolation Boundaries . ......................................................... B 3.6.3-1 B 3.6.4            Containment Pressure . .......................................................................... B 3.6.4-1 B 3.6.5            Containment Air Temperature .................................................................B 3.6.5-1 B 3.6.6            Containment Spray (CS), Containment Recirculation Fan Cooler (CRFC), and NaOH ...................................................... B 3.6.6-1 B 3.7          PLANT SYSTEMS B 3.7.1            Main Steam Safety Valves (MSSVs) .................................................... B 3.7.1-1 B 3.7.2            Main Steam Isolation Valves (MSIVs) and Non-Return Check Valves ......................................................... B 3.7.2-1 B 3.7.3            Main Feedwater Isolation Valves (MFIVs),
Main Feedwater Regulating Valves (MFRVs),
and Associated Bypass Valves. ....................................................... B 3.7.3-1 B 3.7.4            Atmospheric Relief Valves (ARVs) . ........................................................B 3.7.4-1 B 3.7.5            Auxiliary Feedwater (AFW) System .. ......................................................B 3.7.5-1 B 3.7.6            Condensate Storage Tanks (CSTs) ...................................................... B 3.7.6-1 B 3.7.7            Component Cooling Water (CCW) System .............................................B 3.7.7-1 B 3.7.8            Service Water (SW) System ...................................................................B 3.7.8-1 B 3.7.9            Control Room Emergency Air Treatment System (CREATS). ......................................................................... B 3.7.9-1 B 3.7.10          Auxiliary Building Ventilation System (ABVS) ...................................... B 3.7.10-1 B 3.7.11          Spent Fuel Pool (SFP) Water Level. .................................................... B 3.7.11-1 B 3.7.12          Spent Fuel Pool (SFP) Boron Concentration ....................................... B 3.7.12-1 B 3.7.13          Spent Fuel Pool (SFP) Storage . .......................................................... B 3.7.13-1 B 3.7.14          Secondary Specific Activity ................................................................. B 3.7.14-1 B 3.8          ELECTRICAL POWER SYSTEMS B 3.8.1        AC Sources  MODES 1, 2, 3, and 4............................................................. B 3.8.1-1 B 3.8.2        AC Sources  MODES 5 and 6. .................................................................... B 3.8.2-1 B 3.8.3            Diesel Fuel Oil.. ........................................................................................ B 3.8.3-1 B 3.8.4        DC Sources  MODES 1, 2, 3, and 4 ........................................................... B 3.8.4-1 R.E. Ginna Nuclear Power Plant                      Bases-ii                                                                Revision 78
 
B 3.8.5        DC Sources  MODES 5 and 6 ...................................................................... B 3.8.5-1 B 3.8.6            Battery Cell Parameters ......................................................................... B 3.8.6-1 B 3.8.7            AC Instrument Bus Sources  MODES 1, 2, 3, and 4............................. B 3.8.7-1 B 3.8.8            AC Instrument Bus Sources  MODES 5 and 6 ..................................... B 3.8.8-1 B 3.8.9        Distribution Systems  MODES 1, 2, 3, and 4. .............................................. B 3.8.9-1 B 3.8.10      Distribution Systems  MODES 5 and 6. ..................................................... B 3.8.10-1 B 3.9          REFUELING OPERATIONS B 3.9.1            Boron Concentration ................................................................................B 3.9.1-1 B 3.9.2            Nuclear Instrumentation ......................................................................... B 3.9.2-1 B 3.9.3            Containment Penetrations . ................................................................... B 3.9.3-1 B 3.9.4            Residual Heat Removal (RHR) and Coolant Circulation  Water Level  23 Ft ..................................................... B 3.9.4-1 B 3.9.5            Residual Heat Removal (RHR) and Coolant Circulation  Water Level < 23 Ft ...................................................... B 3.9.5-1 B 3.9.6            Refueling Cavity Water Level . ................................................................ B 3.9.6-1 R.E. Ginna Nuclear Power Plan Bases - iii                                                            Revision 50
 
Reactor Core SLs B 2.1.1 B 2.0      SAFETY LIMITS (SLs)
B 2.1.1    Reactor Core SLs BASES BACKGROUND          Atomic Industrial Forum (AIF) GDC 6 (Ref. 1) requires that the reactor core shall be designed to function throughout its design lifetime without exceeding acceptable fuel damage limits which have been stipulated and justified. This integrity is required during steady state operation, normal operational transients, and anticipated operational occurrences (AOOs).
This is accomplished by having a departure from nucleate boiling (DNB) design basis, which corresponds to a 95% probability at a 95%
confidence level (the 95/95 DNB criterion) that DNB will not occur on the limiting fuel rods and by requiring that fuel centerline temperature stays below the melting temperature (Ref. 2).
The restrictions of this SL prevent overheating of the fuel and cladding, as well as possible cladding perforation, that would result in the release of fission products to the reactor coolant. Overheating of the fuel is prevented by maintaining the steady state peak linear heat rate (LHR) below the level at which fuel centerline melting occurs. Overheating of the fuel cladding is prevented by restricting fuel operation to within the nucleate boiling regime, where the heat transfer coefficient is large and the cladding surface temperature is slightly above the coolant saturation temperature.
Fuel centerline melting occurs when the local LHR, or power peaking, in a region of the fuel is high enough to cause the fuel centerline temperature to reach the meltingpoint of the fuel. Expansion of the pellet upon centerline melting may cause the pellet to stress the cladding to the point of failure, allowing an uncontrolled release of activity to the reactor coolant.
Operation above the boundary of the nucleate boiling regime could result in excessive cladding temperature because of the onset of DNB and the resultant sharp reduction in heat transfer coefficient. Inside the steam film, high cladding temperatures are reached, and a cladding water (zirconium - water) reaction may take place. This chemical reaction results in oxidation of the fuel cladding to a structurally weaker form. This weaker form may lose its integrity, resulting in an uncontrolled release of activity to the reactor coolant.
The proper functioning of the Reactor Protection System (RPS) and main steam safety valves prevents violation of the reactor core SLs.
R.E. Ginna Nuclear Power Plant                    B 2.1.1-1                                    Revision 78
 
Reactor Core SLs B 2.1.1 APPLICABLE              The fuel cladding must not sustain damage as a result of normal SAFETY                  operation and AOOs. The reactor core SLs are established to preclude ANALYSES                violation of the following fuel design criteria (Ref. 3):
: a.      The hot fuel pellet in the core must not experience centerline fuel melting; and
: b.      There must be at least 95% probability at a 95% confidence level (the 95/95 DNB criterion) that the hot fuel rod in the core does not experience DNB.
In meeting the DNB design criterion, uncertainties in plant operating parameters, nuclear and thermal parameters, fuel fabrication parameters and computer codes must be considered. The effects of these uncertainties have been statistically combined with the correlation uncertainty to determine design limit departure from nucleate boiling ratio (DNBR) values that satisfy the DNB design criterion. The observable parameters, thermal power, reactor coolant temperature and pressure have been related to DNB through the W-3 and/or WRB-1 DNB correlation.
These DNB correlations have been developed to predict the DNB flux and the location of DNB for auxiliary uniform and non-uniform heat flux distributions. The local DNB heat flux ratio, defined as the ratio of the heat flux that would cause DNB at a particular core location to the local heat flux, is indicative of the margin to DNB. A minimum value of the DNB ratio is specified so that during steady state operation, normal operational transients and anticipated transients, there is a 95% probability at a 95%
confidence level that DNB will not occur.
Additional DNBR margin is maintained by performing the safety analyses to a higher DNBR limit. This margin between the design and safety analysis limit DNBR values is used to offset known DNBR penalties (e.g., rod bow and transition core) and to provide DNBR margin for operating and design flexibility (Ref. 4).
The Reactor Trip System setpoints specified in LCO 3.3.1, "Reactor Trip System (RTS) Instrumentation", in combination with all the LCOs, are designed to prevent any anticipated combination of transient conditions for Reactor Coolant System (RCS) temperature, RCS pressure, RCS flow, 'I, and THERMAL POWER level that would result in a DNBR of less than the DNBR limit and preclude the existence of flow instabilities.
Automatic enforcement of these reactor core SLs is provided by the appropriate operation of the RPS and the steam generator safety valves.
R.E. Ginna Nuclear Power Plan                  B 2.1.1-2                                Revision 42
 
Reactor Core SLs B 2.1.1 The SLs represent a design requirement for establishing the RPS trip setpoints identified previously. LCO 3.4.1, "RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB) Limits," or the assumed initial conditions of the safety analyses (Ref. 5) provide more restrictive limits to ensure that the SLs are not exceeded.
SAFETY LIMITS        2.1.1 Figure COLR-1 shows an example of the loci of points of THERMAL POWER, RCS pressure, and average temperature for which the minimum DNBR is greater than or equal to the safety analyses limit, that fuel centerline temperature remains below melting, that the average enthalpy in the hot leg is less than or equal to the enthalpy of saturated liquid, or that the core exit quality is within the limits defined by the DNBR correlation. Each of the curves of Figure COLR-1 has three distinct slopes. Working from left to right, the first slope ensures that the average enthalpy in the hot leg is less than or equal to the enthalpy of saturated liquid such that overtemperature 'T indication remains valid. The second slope ensures that the hot leg steam quality remains  15%.
The final slope ensures that DNBR is always  safety analysis DNBR limit. Note that a part power multiplier is applied below 100% RTP.
The reactor core SLs are established to preclude violation of the following fuel design criteria:
: a.      There must be at least a 95% probability at a 95% confidence level (the 95/95 DNB criterion) that the hot fuel rod in the core does not experience DNB and
: b.      There must be at least a 95% probability at a 95% confidence level that the hot fuel pellet in the core does not experience centerline fuel melting.
The reactor core SLs are used to define the various RPS functions such that the above criteria are satisfied during steady state operation, normal operational transients, and anticipated operational occurrences (AOOs).
To ensure that the RPS precludes the violation of the above criteria, additional criteria are applied to the Overtemperature and Overpower 'T reactor trip functions. That is, it must be demonstrated that the average enthalpy in the hot leg is less than or equal to the saturation enthalpy and that the core exit quality is within the limits defined by the DNBR correlation. Appropriate functioning of the RPS ensures that for variations in the THERMAL POWER, RCS Pressure, RCS average temperature, RCS flow rate, and 'I that the reactor core SLs will be satisfied during steady state operation, normal operational transients, and AOOs.
R.E. Ginna Nuclear Power Plan                    B 2.1.1-3                                      Revision 42
 
Reactor Core SLs B 2.1.1 APPLICABILITY        SL 2.1.1 only applies in MODES 1 and 2 because these are the only MODES in which the reactor is critical. Automatic protection functions are required to be OPERABLE during MODES 1 and 2 to ensure operation within the reactor core SLs. The steam generator safety valves and automatic protection actions serve to prevent RCS heatup to the reactor core SL conditions or to initiate a reactor trip function, which forces the plant into MODE 3. Setpoints for the reactor trip functions are specified in LCO 3.3.1, "Reactor Trip System (RTS) Instrumentation. In MODES 3, 4, 5, and 6, Applicability is not required since the reactor is not generating significant THERMAL POWER.
SAFETY LIMIT          2.2.1 VIOLATIONS If SL 2.1.1 is violated, the requirement to restore compliance and go to MODE 3 places the plant in a safe condition and in a MODE in which this SL is not applicable.
The allowed Completion Time of 1 hour recognizes the importance of bringing the plant to a MODE of operation where this SL is not applicable, and reduces the probability of fuel damage. If the Completion Time is exceeded, actions shall continue in order to bring the plant to a MODE of operation where this SL is not applicable.
REFERENCES          1. Atomic Industrial Forum (AIF) GDC 6, Issued for comment July 10, 1967.
: 2. Letter from J. A. Zwolinski, NRC, to R. W. Kober, RG&E,
 
==Subject:==
 
                            "Deletion of Information Pertaining to Definition of Hot Channel Factors," dated May 30, 1985.
: 3. UFSAR, Section 4.2.1.3.3.
: 4. UFSAR, Section 4.4.3.
: 5. UFSAR, Section 7.2.1.1.1.
R.E. Ginna Nuclear Power Plan                B 2.1.1-4                                    Revision 42
 
RCS Pressure SL B 2.1.2 B 2.0      SAFETY LIMITS (SLs)
B 2.1.2    Reactor Coolant System (RCS) Pressure SL BASES BACKGROUND          The SL on RCS pressure protects the integrity of the RCS against overpressurization. In the event of fuel cladding failure, fission products are released into the reactor coolant. The RCS then serves as the primary barrier in preventing the release of fission products into the atmosphere. By establishing an upper limit on RCS pressure, the continued integrity of the RCS is ensured. According to Atomic Industrial Forum (AIF) GDC 9, "Reactor Coolant Pressure Boundary," GDC 33, "Reactor Coolant Pressure Boundary Capability," and GDC 34, "Reactor Coolant Pressure Boundary Rapid Propagation Failure Prevention" (Ref.
1), the reactor coolant pressure boundary (RCPB) design conditions are not to be exceeded during normal operation and anticipated operational occurrences (AOOs).
The design pressure of the RCS is 2485 psig (Ref. 2). During normal operation and AOOs, RCS pressure is limited from exceeding the design pressure by more than 10%, in accordance with Section III of the ASME Code (Ref. 3) except for locked rotor accidents which must be limited to 120% of the design pressure (Refs. 4, 5, and 6). To ensure system integrity, all RCS components are hydrostatically tested at 125% of design pressure, according to the ASME Code requirements prior to initial operation when there is no fuel in the core. Following inception of plant operation, RCS components are pressure tested, in accordance with the requirements of the approved Ginna ISI Program which is based on ASME Code, Section XI (Ref. 7).
Overpressurization of the RCS could result in a breach of the RCPB reducing the number of protective barriers designed to prevent radioactive releases from exceeding the limits specified in 10 CFR 50.67 (Ref. 8). If such a breach occurs in conjunction with a fuel cladding failure, fission products could enter the containment atmosphere.
R.E. Ginna Nuclear Power Plant                  B 2.1.2-1                                    Revision 78
 
RCS Pressure SL B 2.1.2 B 2.0 SAFETY LIMITS (SLs)
APPLICABLE              The RCS pressurizer safety valves, the main steam safety valves SAFETY                  (MSSVs), and the reactor high pressure trip have settings established to ANALYSES                ensure that the RCS pressure SL will not be exceeded.
The RCS pressurizer safety valves are sized to prevent system pressure from exceeding the design pressure by more than 10%, as specified in Section III of the ASME Code for Nuclear Power Plant Components (Ref. 3) except for locked rotor accidents which must be limited to 120% of the design pressure. The transient that establishes the required relief capacity, and hence valve size requirements and lift settings, is a complete loss of external load without a direct reactor trip. During the transient, no control actions are assumed, except that the safety valves on the secondary plant are assumed to open when the steam pressure reaches the secondary plant safety valve settings.
The Reactor Trip System setpoints (Ref. 9), together with the settings of the MSSVs, provide pressure protection for normal operation and AOOs.
The reactor high pressure trip setpoint is specifically set to provide protection against overpressurization. The safety analyses which credit either the high pressure trip or the RCS pressurizer safety valves are performed using conservative assumptions relative to the other pressure control devices.
More specifically, no credit is taken for operation of the following:
: a. Pressurizer power operated relief valves;
: b. Steam generator atmospheric relief valves;
: c. Steam Dump System;
: d. Reactor Control System;
: e. Pressurizer Level Control System; or
: f. Pressurizer spray valves.
R.E. Ginna Nuclear Power Plant                  B 2.1.2-2                                    Revision 78
 
RCS Pressure SL B 2.1.2 SAFETY LIMITS        2.1.2 The maximum transient pressure allowed in the RCS pressure vessel under the ASME Code, Section III, is 110% of design pressure except for locked rotor accidents which must be limited to 120% of the design pressure. The maximum transient pressure allowed in the RCS piping, valves, and fittings under the original design requirements of USAS B31.1 (Ref. 5) is 120% of design pressure. The most limiting of these two allowances is the 110% of design pressure; therefore, the SL on maximum allowable RCS pressure is 2735 psig.
APPLICABILITY        SL 2.1.2 applies in MODES 1, 2, 3, 4, and 5 because this SL could be approached or exceeded in these MODES due to overpressurization events. The SL is not applicable in MODE 6 because the reactor vessel head closure bolts are not fully tightened, making it unlikely that the RCS can be pressurized.
SAFETY LIMIT          2.2.2 VIOLATIONS If SL 2.1.2 is violated when the reactor is in MODE 1 or 2, the requirement is to restore compliance and be in MODE 3 within 1 hour.
Exceeding the RCS pressure SL may cause immediate RCS failure and create a potential for radioactive releases in excess of 10 CFR 50.67 limits (Ref. 8).
The allowable Completion Time of 1 hour recognizes the importance of reducing power level to a MODE of operation where the potential for challenges to safety systems is minimized. If the Completion Time is exceeded, actions shall continue in order to restore compliance with the SL and bring the plant to MODE 3.
R.E. Ginna Nuclear Power Plant              B 2.1.2-3                                  Revision 78
 
RCS Pressure SL B 2.1.2 If SL 2.1.2 is exceeded in MODE 3, 4, or 5, RCS pressure must be restored to within the SL value within 5 minutes. Exceeding the RCS pressure SL in MODE 3, 4, or 5 is more severe than exceeding this SL in MODE 1 or 2, since the reactor vessel temperature may be lower and the vessel material, consequently, less ductile. As such, pressure must be reduced to less than the SL within 5 minutes. If the Completion Time is exceeded, action shall continue in order to reduce pressure to less than the SL. The action does not require reducing MODES, since this would require reducing temperature, which would compound the problem by adding thermal gradient stresses to the existing pressure stress.
REFERENCES          1. Atomic Industrial Forum (AIF) GDC 9, 33, and 34, Issued for comment July 10, 1967.
: 2. UFSAR, Section 5.1.4.
: 3. ASME, Boiler and Pressure Vessel Code, Section III, Article NB-7000.
: 4. Letter from D. M. Crutchfield, NRC, to J. E. Maier, RG&E,
 
==Subject:==
 
                            "SEP Topic XV-1, XV-2, XV-3, XV-4, XV- 5, XV-6, XV-7, XV-8, XV-10, XV-12, XV-14, XV-15, and XV-17, Design Basis Events, Accidents and Transients (R.E. Ginna)," dated September 4, 1981.
: 5. USAS B31.1, Standard Code for Pressure Piping, American Society of Mechanical Engineers, 1967 edition.
: 6. UFSAR, Section 15.3.2.
: 7. ASME, Boiler and Pressure Vessel Code, Section XI.
: 8. 10 CFR 50.67.
: 9. UFSAR, Section 7.2.2.2.
R.E. Ginna Nuclear Power Plan              B 2.1.2-4                                Revision 58
 
LCO Applicability 83.0 B 3.0    LIMITING CONDITION FOR OPERATION (LCO) AND SURVEILLANCE REQUIREMENT(SR)APPLICABILITY B 3.0      Limiting Condition For Operation (LCO) Applicability BASES LCOs                  LCO 3.0.1 through LCO 3.0.8 establish the general requirements applicable to all Specifications and apply at all times, unless otherwise stated.
LC03.0.1              LCO 3.0.1 establishes the Applicability statement within each individual Specification as the requirement for when the LCO is required to be met (i.e., when the plant is in the MODES or other specified conditions of the Applicability statement of each Specification).
LC03.0.2              LCO 3.0.2 establishes that upon discovery of a failure to meet an LCO, the associated ACTIONS shall be met. The Completion Time of each Required Action for an ACTIONS Condition is applicable from the point in time that an ACTIONS Condition is entered, unless otherwise specified.
The Required Actions establish those remedial measures that must be taken within specified Completion Times when the requirements of an LCO are not met. This Specification establishes that:
: a. Completion of the Required Actions within the specified Completion Times constitutes compliance with a Specification; and
: b. Completion of the Required Actions is not required when an LCO is met within the specified Completion Time, unless otherwise specified.
R.E. Ginna Nuclear Power Plan                      B 3.0-1                                    Revision 82
 
LCO Applicability B 3.0 There are two basic types of Required Actions. The first type of Required Action specifies a time limit in which the LCO must be met.
This time limit is the Completion Time to restore an inoperable system or component to OPERABLE status or to restore variables to within specified limits. If this type of Required Action is not completed within the specified Completion Time, a shutdown may be required to place the plant in a MODE or condition in which the Specification is not applicable.
(Whether stated as a Required Action or not, correction of the entered Condition is an action that may always be considered upon entering ACTIONS.) The second type of Required Action specifies the remedial measures that permit continued operation of the plant that is not further restricted by the Completion Time. In this case, compliance with the Required Actions provides an acceptable level of safety for continued operation.
Completing the Required Actions is not required when an LCO is met or is no longer applicable, unless otherwise stated in the individual Specifications.
The nature of some Required Actions of some Conditions necessitates that, once the Condition is entered, the Required Actions must be completed even though the associated Condition no longer exists. In this instance, the individual LCO's ACTIONS specify the Required Actions.
An example of this is in LCO 3.4.3, "RCS Pressure and Temperature (P/
T) Limits."
The Completion Times of the Required Actions are also applicable when a system or component is removed from service intentionally. The reasons for intentionally relying on the ACTIONS include, but are not limited to, performance of Surveillances, preventive maintenance, corrective maintenance, or investigation of operational problems as required by the LCO. Entering ACTIONS for these reasons must be done in a manner that does not compromise safety. Intentional entry into ACTIONS should not be made for operational convenience. Alternatives that would not result in redundant equipment being inoperable should be used instead. Doing so limits the time both subsystems/trains of a safety function are inoperable and limits the time other conditions exist which may result in LCO 3.0.3 being entered. Individual Specifications may specify a time limit for performing an SR when equipment is removed from service or bypassed for testing. In this case, the Completion Times of the Required Actions are applicable when this time limit expires, if the equipment remains removed from service or bypassed.
R.E. Ginna Nuclear Power Plan                B 3.0-2                                  Revision 50
 
LCO Applicability 83.0 When a change in MODE or other specified condition is required to comply with Required Actions, the plant may enter a MODE or other specified condition in which another Specification becomes applicable and the new LCO is not met. In this case, the Completion Times of the new Required Actions would apply from the point in time that the new Specification becomes applicable, and the ACTIONS Condition(s) are entered.
LC03.0.3            LCO 3.0.3 establishes the actions that must be implemented when an LCO is not met and:
: a.      An associated Required Action and Completion Time is not met and no other Condition applies; or
: b.      The condition of the plant is not specifically addressed by the associated ACTIONS. This means that no combination of Conditions stated in the ACTIONS can be made that exactly corresponds to the actual condition of the plant. Sometimes, possible combinations of Conditions are such that entering LCO 3.0.3 is warranted; in such cases, the ACTIONS specifically state a Condition corresponding to such combinations and also that LCO 3.0.3 be entered immediately.
This Specification delineates the time limits for placing the plant in a safe MODE or other specified condition when operation cannot be maintained within the limits for safe operation as defined by the LCO and its ACTIONS. It is not intended to be used as an operational convenience that permits routine voluntary removal of redundant systems or components from service in lieu of other alternatives that would not result in redundant systems or components being inoperable.
Upon entering LCO 3.0.3, the Shift Supervisor shall evaluate the condition of the plant and determine actions to be taken, considering plant safety first, that will allow sufficient time for an orderly plant shutdown. These actions shall include preparation for a safe and controlled shutdown, as well as actions to correct the condition which caused entry into LCO 3.0.3. This includes coordinating the reduction in electrical generation with energy operations to ensure the stability and availability of the electrical grid. If it is determined that the condition that caused entry into LCO 3.0.3 can be corrected within a reasonable period of time and still allow sufficient time for an orderly plant shutdown, a power reduction does not have to be initiated. The shutdown shall be initiated so that the time limits specified to enter lower MODES of operation permit the shutdown to proceed in a controlled and orderly manner that is well within the specified maximum cooldown rate and within the capabilities of the plant, assuming that only the minimum R.E. Ginna Nuclear Power Plan                  B 3.0-3                                      Revision 82
 
LCO Applicability 83.0 required equipment is OPERABLE. This reduces thermal stresses on components of the Reactor Coolant System and the potential for a plant upset that could challenge safety systems under conditions to which this Specification applies. The use and interpretation of specified times to complete the actions of LCO 3.0.3 are consistent with the discussion of Section 1.3, Completion Times.
A plant shutdown required in accordance with LCO 3.0.3 may be terminated and LCO 3.0.3 exited if any of the following occurs:
: a.      The LCO is now met.
: b.      The LCO is no longer applicable.
: c.      A Condition exists for which the Required Actions have now been performed.
: d.      ACTIONS exist that do not have expired Completion Times. These Completion Times are applicable from the point in time that the Condition is initially entered and not from the time LCO 3.0.3 is exited.
The time limits of LCO 3.0.3 allow 36 hours for the plart to be in MODE 5 when a shutdown is required during MODE 1 operation. If the plant is in a lower MODE of operation when a shutdown is required, the time limit for entering the next lower MODE applies. If a lower MODE is entered in less time than allowed, however, the total allowable time to enter MODE 5, or other applicable MODE, is not reduced. For example, if MODE 3 is entered in 2 hours, then the time allowed for entering MODE 4 is the next 1Ohours, because the total time for entering MODE 4 is not reduced from the allowable limit of 12 hours. Therefore, if remedial measures are completed that would permit a return to MODE 1, a penalty is not incurred by having to enter a lower MODE of operation in less than the total time allowed.
In MODES 1, 2, 3, and 4, LCO 3.0.3 provides actions for Conditions not covered in other Specifications. The requirements of LCO 3.0.3 do not apply in MODES 5 and 6 because the plant is already in the most restrictive Condition required by LCO 3.0.3. The requirements of LCO 3.0.3 do not apply in other specified conditions of the Applicability (unless in MODE 1, 2, 3, or 4) because the ACTIONS of individual Specifications sufficiently define the remedial measures to be taken.
Exceptions to LCO 3.0.3 are provided in instances where requiring a plant shutdown, in accordance with LCO 3.0.3, would not provide appropriate remedial measures for the associated condition of the plant.
An example of this is in LCO 3.7.11, "Spent Fuel Pool (SFP) Water Level." LCO 3.7.11 has an Applicability of "During movement of irradiated fuel assemblies in the SFP." Therefore, this LCO can be applicable in any or all MODES. If the LCO and the Required Actions of LCO 3.7.11 are not met while in MODE 1, 2, 3, or 4, there is no safety R.E. Ginna Nuclear Power Plan                  83.0-4                                    Revision82
 
LCO Applicability B3.0 benefit to be gained by placing the plant in a shutdown condition. The Required Action of LCO 3.7.11 of "Suspend movement of irradiated fuel assemblies in the SFP" is the appropriate Required Action to complete in lieu of the actions of LCO 3.0.3. These exceptions are addressed in the individual Specifications.
LC03.0.4 LCO 3.0.4 establishes limitations on changes in MODES or other specified conditions in the Applicability when an LCO is not met. It allows placing the plant in a MODE or other specified condition stated in that Applicability (e.g., the Applicability desired to be entered) when plant conditions are such that the requirements of the LCO would not be met, in accordance with either LCO 3.0.4.a, LCO 3.0.4.b, or LCO 3.0.4.c.
LCO 3.0.4.a allows entry into a MODE or other specified condition in the Applicability with the LCO not met when the associated ACTIONS to be entered following entry into the MODE or other specified condition in the Applicability will permit continued operation within the MODE or other specified condition for an unlimited period of time. Compliance with ACTIONS that permit continued operation of the plant for an unlimited period of time in a MODE or other specified condition provides an acceptable level of safety for continued operation. This is without regard to the status of the plant before or after the MODE change. Therefore, in such cases, entry into a MODE or other specified condition in the Applicability may be made and the Required Actions followed after entry into the Applicability.
For example, LCO 3.0.4.a may be used when the Required Action to be entered states that an inoperable instrument channel must be placed in the trip condition within the Completion Time. Transition into a MODE or other specified condition in the Applicability may be made in accordance with LCO 3.0.4 and the channel is subsequently placed in the tripped condition within the Completion Time, which begins when the Applicability is entered. If the instrument channel cannot be placed in the tripped condition and the subsequent default ACTION ("Required Action and associated Completion Time not met") allows the OPERABLE train to be placed in operation, use of LCO 3.0.4.a is acceptable because the subsequent ACTIONS to be entered following entry into the MODE include ACTIONS (place the OPERABLE train in operation) that permit safe plant operation for an unlimited period of time in the MODE or other specified condition to be entered.
LCO 3.0.4.b allows entry into a MODE or other specified condition in the Applicability with the L.CO not met after i:erformance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering the MODE or other specified condition in the Applicability, and establishment of risk management actions, if appropriate.
R.E. Ginna Nuclear Power Plant                B3.0-5                                    Revision 82
 
LCO Applicability 83.0 The risk assessment may use quantitative, qualitative, or blended approaches, and the risk assessment will be conducted using the plant program, procedures, and criteria in place to implement 10 CFR 50.65(a)(4), which requires that risk impacts of maintenance activities to be assessed and managed. The risk assessment, for the purposes of LCO 3.0.4.b, must take into account all inoperable Technical Specification equipment regardless of whether the equipment is included in the normal 10CFR50.65(a)(4) risk assessment scope. The risk assessments will be conducted using the procedures and guidance endorsed by Regulatory Guide 1.182, "Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants." Regulatory Guide 1.182 endorses the guidance in Section 11 of NU MARC 93-01, "Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants." These documents address general guidance for conduct of the risk assessment, quantitative and qualitative guidelines for establishing risk management actions, and example risk management actions. These include actions to plan and conduct other activities in a manner that controls overall risk, increased risk awareness by shift and management personnel, actions to reduce the duration of the condition, actions to minimize the magnitude of risk increases (establishment of backup success paths or compensatory measures), and determination that the proposed MODE change is acceptable. Consideration should also be given to the probability of completing restoration such that the requirements of the LCO would be met prior to the expiration of ACTIONS Completion Times that would require exiting the Applicability.
LCO 3.0.4.b may be used with single, or multiple systems and components unavailable. NU MARC 93-01 provides guidance relative to consideration of simultaneous unavailability of multiple systems and components. The results of the risk assessment shall be considered in determining the acceptability of entering the MODE or other specified condition in the Applicability, and any corresponding risk management actions. The LCO 3.0.4.b risk assessments do not have to be documented.
The Technical Specifications allow continued operation with equipment unavailable in MODE 1 for the duration of the Completion Time. Since this is allowable, and since in general the risk impact in that particular MODE bounds the risk of transitioning into and through the applicable MODES or other specified conditions in the Applicability of the LCO, the use of the LCO 3.0.4.b allowance should be generally acceptable, as long as the risk is assessed and managed as stated above. However, there is a small subset of systems and components that have been determined to be more important to risk and use of the LCO 3.0.4.b allowance is prohibited. The LCOs governing these system and components contain Notes prohibiting the use of LCO 3.0.4.b by stating that LCO 3.0.4.b is not applicable.
LCO 3.0.4.c allows entry into a MODE or other specified condition in the Applicability with the LCO not met based on a Note in the Specification which states LCO 3.0.4.c is applicable. These specific allowances permit R.E. Ginna Nuclear Power Plant                83.0-6                                      Revision82
 
LCO Applicability 83.0 entry into MODES or other specified conditions in the Applicability when the associated ACTIONS to be entered do not provide for continued operation for an unlimited period of time and a risk assessment has not been performed. This allowance may apply to all the ACTIONS or to a specific Required Action of a Specification. The risk assessments performed to justify the use of LCO 3.0.4.b usually only consider systems and components. For this reason, LCO 3.0.4.c is typically applied to Specifications which describe values and parameters (e.g., Moderator Temperature Coefficient, RCS Specific Activity), and may be applied to other Specifications based on NRG plant-specific approval.
The provisions of this Specification should not be interpreted as endorsing the failure to exercise the good practice of restoring systems or components to OPERABLE status before entering an associated MODE or other specified condition in the Applicability.
The provisions of LCO 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS. In addition, the provisions of LCO 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that result from any plant shutdown. In this context, a plant shutdown is defined as a change in MODE or other specified condition in the Applicability associated with transitioning from MODE 1 to MODE 2, MODE 2 to MODE 3, MODE 3 to MODE 4, and MODE 4 to MODE 5.
Upon entry into a MODE or other specified condition in the Applicability with the LCO not met, LCO 3.0.1 and LCO 3.0.2 require entry into the applicable Conditions and Required Actions until the Condition is resolved, until the LCO is met, or until the plant is not within the Applicability of the Technical Specification.
Surveillances do not have to be performed on the associated inoperable equipment (or on variables outside the specified limits), as permitted by SR 3.0.1. Therefore, utilizing LCO 3.0.4 is not a violation of SR 3.0.1 or SR 3.0.4 for any Surveillances that have not been performed on inoperable equipment. However, SRs must be met to ensure OPERABILITY prior to declaring the associated equipment OPERABLE (or variable within limits) and restoring compliance with the affected LCO.
LC03.0.5              LCO 3.0.5 establishes the allowance for restoring equipment to service under administrative controls when it has been removed from service or declared inoperable to comply with ACTIONS. The sole purpose of this LCO is to provide an exception to LCO 3.0.2 (e.g., to not comply with the applicable Required Action(s)) to allow the performance of SRs to demonstrate:
: a. The OPERABILITY of the equipment being returned to service; or
: b. The OPERABILITY of other equipment.
R.E. Ginna Nuclear Power Plant                83.0-7                                      Revision 82
 
LCO Applicability B3.0 The administrative controls ensure the time the equipment is returned to service in conflict with the requirements of the ACTIONS is limited to the time absolutely necessary to perform the allowed SRs. This Specification does not provide time to perform any other preventive or corrective maintenance. LCO 3 .0.5 should not be used in lieu of other practicable alternatives that comply with Required Actions and that do not require changing the MODE or other specified conditions in the Applicability in order to demonstrate equipment is OPERABLE. LCO 3.0.5 is not intended to be used repeatedly.
An example of demonstrating equipment is OPERABLE with the Required Actions not met is opening a manual valve that was closed to comply with Required Actions to isolate a flowpath with excessive Reactor Coolant System (RCS) Pressure Isolation Valve (PIV) leakage in order to perform testing to demonstrate that RCS PIV leakage is now within limit.
Examples of demonstrating equipment OPERABILITY include instances in which it is necessary to take an inoperable channel or trip system out of a tripped condition that was directed by a Required Action, if there is no Required Action Note for this purpose. An example of verifying OPERABILITY of equipment removed from service is taking a tripped channel out of the tripped condition to permit the logic to function and indicate the appropriate response during performance of required testing on the inoperable channel.
Examples of demonstrating the OPERABILITY of other equipment are taking an inoperable channel or trip system out of the tripped condition 1) to prevent the trip function from occurring during the performance of an SR on another channel in the other trip system, or 2) to permit the logic to function and indicate the appropriate response during the performance of an SR on another channel in the same trip system.
The administrative controls in LCO 3.0.5 apply in all cases to systems or components in Chapter 3 of the Technical Specifications, as long as the testing could not be conducted while complying with the Required Actions.
This includes the realignment or repositioning of redundant or alternate equipment or trains previously manipulated to comply with ACTIONS, as well as equipment removed from service or declared inoperable to comply with ACTIONS.
LC03.0.6              LCO 3.0.6 establishes an exception to LCO 3.0.2 for support systems that have an LCO specified in the Technical Specifications (TS). This exception is provided because LCO 3.0.2 would require that the Conditions and Required Actions of the associated inoperable supported system LCO be entered solely due to the inoperability of the support system. This exception is justified because the actions that are required R.E. Ginna Nuclear Power Plant                B3.0-8                                    Revision 82
 
LCO Applicability B3.0 to ensure the plant is maintained in a safe condition are specified in the support systems' LCO's Required Actions. These Required Actions may include entering the supported system's Conditions and Required Actions or may specify other Required Actions.
When a support system is inoperable and there is an LCO specified for it in the TS, the supported system(s) are required to be declared inoperable if determined to be inoperable as a result of the support system inoperability. However, it is not necessary to enter into the supported systems' Conditions and Required Actions unless directed to do so by the support system's Required Actions. The potential confusion and inconsistency of requirements related to the entry into multiple support and supported systems' LCO's Conditions and Required Actions are eliminated by providing all the actions that are necessary to ensure the plant is maintained in a safe condition in the support system's Required Actions.
However, there are instances where a support system's Required Action may either direct a supported system to be declared inoperable or direct entry into Conditions and Required Actions for the supported system.
This may occur immediately or after some specified delay to perform some other Required Action. Regardless of whether it is immediate or after some delay, when a support system's Required Action directs a supported system to be declared inoperable or directs entry into Conditions and Required Actions for a supported system, the applicable Conditions and Required Actions shall be entered in accordance with LC03.0.2.
Specification 5.5.14, "Safety Function Determination Program (SFDP),"
ensures loss of safety function is detected and appropriate actions are taken. Upon entry into LCO 3.0.6, an evaluation shall be made to determine if loss of safety function exists. Additionally, other limitations, remedial actions, or compensatory actions may be identified as a result of the support system inoperability and corresponding exception to entering supported system Conditions and Required Actions. The SFDP implements the requirements of LCO 3.0.6.
Cross train checks to identify a loss of safety function for those support systems that support multiple and redundant safety systems are required.
The cross train check verifies that the supported systems of the redundant OPERABLE support system are OPERABLE, thereby ensuring safety function is retained. If this evaluation determines that a loss of safety function exists, the appropriate Conditions and Required Actions of the LCO in which the loss of safety function exists are required to be entered.
LC03.0.7                There are certain special tests and operations required to be performed at various times over the life of the plant. These special tests and operations are necessary to demonstrate select plant performance characteristics, to perform special maintenance activities, and to R.E. Ginna Nuclear Power Plant                    B3.0-9                                      Revision82
 
LCO Applicability 83.0 perform special evolutions. Test Exception LCO 3.1.8, "PHYSICS TEST Exceptions - MODE 2," allows specified Technical Specification (TS) requirements to be changed to permit performances of special tests and operations, which otherwise could not be performed if required to comply with the requirements of these TS. Unless otherwise specified, all other TS requirements remain unchanged. This will ensure all appropriate requirements of the MODE or other specified condition not directly associated with or required to be changed to perform the special test or operation will remain in effect.
The Applicability of a Test Exception LCO represents a condition not necessarily in compliance with the normal requirements of the TS. A special operation may be performed either under the provisions of the appropriate Test Exception LCO or under the other applicable TS requirements. If it is desired to perform the special operation under the provisions of the Test Exception LCO, the requirements of the Test Exception LCO shall be followed.
LC03.0.8                  LCO 3.0.8 establishes conditions under which systems are considered to remain capable of performing their intended safety function when associated snubbers are not capable of providing their associated support function(s). This LCO states that the supported system is not considered to be inoperable solely due to one or more seismic snubbers not capable of performing their associated support function(s). This is appropriate because a limited length of time is allowed for maintenance, testing, or repair of one or more seismic snubbers not capable of performing their associated support function(s) and appropriate compensatory measures are specified in the snubber requirements, which are located outside of the Technical Specifications (TS) in the Snubber Inspection and Testing Program document. The snubber requirements do not meet the criteria in 10CFR50.36(c)(2)(ii), and, as such, are appropriate for control by the Snubber Program.
If the allowed time expires and the snubber(s) are unable to perform their associated supportfunction(s), the affected supported systems LCO(s) must be declared not met and the Conditions and Required Actions entered in accordance with LCO 3.0.2.
LCO 3.0.8.a applies when one or more seismic snubbers are not capable of providing their associated support function(s) to a single train or subsystem of a multiple train or subsystem supported system or to a single train or subsystem supported system. LCO 3.0.8.a allows 72 hours to restore the snubber(s) before declaring the supported system inoperable. The 72 hour Completion Time is reasonable based on the low probability of a seismic event concurrent with an event that would require operation of the supported system occurring while the snubber(s) are not capable of performing their associated support function and due to the availability of the redundant train of the supported system.
R.E. Ginna Nuclear Power Plant                      83.0-10                                  Revision82
 
LCO Applicability 83.0 LCO 3.0.8.b applies when one or more seismic snubbers are not capable of providing their associated support function(s) to more than one train or subsystem of a multiple train or subsystem supported system. LCO 3.0.8.b allows 12 hours to restore the snubber(s) before declaring the supported system inoperable. The 12 hour Completion Time is reasonable based on the low probability of a seismic event concurrent with an event that would require operation of the supported system occurring while the snubber(s) are not capable of performing their associated support function.
LCO 3.0.8 requires that risk be assessed and managed. Industry and NRC guidance on the implementation of 10 CFR 50.65(a)(4) (the Maintenance Rule) does not address seismic risk. However, use of LCO 3.0.8 should be considered with respect to other plant maintenance activities, and integrated into the existing Maintenance Rule process to the extent possible so that maintenance on any unaffected train or subsystem is properly controlled, and emergent issues are properly addressed. The risk assessment need not be quantified, but may be a qualitative awareness of the vulnerability of systems and components when one or more seismic snubbers are not able to perform their associated support function.
R.E. Ginna Nuclear Power Plant                    B 3.0-11                                Revision82
 
SR Applicability B 3.0 B 3.0    LIMITING CONDITION FOR OPERATION (LCO) AND SURVEILLANCE REQUIREMENT (SR) APPLICABILITY B 3.0        Surveillance Requirement (SR) Applicability BASES SRs                    SR 3.0.1 through SR 3.0.4 establish the general requirements applicable to all Specifications and apply at all times, unless otherwise stated.
SR 3.0.2 and SR 3.0.3 apply in Chapter 5 only when invoked by a Chapter 5 Specification.
SR 3.0.1              SR 3.0.1 establishes the requirement that SRs must be met during the MODES or other specified conditions in the Applicability for which the requirements of the LCO apply, unless otherwise specified in the individual SRs. This Specification is to ensure that Surveillances are performed to verify the OPERABILITY of systems and components, and that variables are within specified limits. Failure to meet a Surveillance within the specified Frequency, in accordance with SR 3.0.2, constitutes a failure to meet an LCO.
Systems and components are assumed to be OPERABLE when the associated SRs have been met. Nothing in this Specification, however, is to be construed as implying that systems or components are OPERABLE when:
: a. The systems or components are known to be inoperable, although still meeting the SRs; or
: b. The requirements of the Surveillance(s) are known not to be met between required Surveillance performances.
Surveillances do not have to be performed when the plant is in a MODE or other specified condition for which the requirements of the associated LCO are not applicable, unless otherwise specified. The SRs associated with a test exception are only applicable when the Test Exception LCO is used as an allowable exception to the requirements of a Specification.
Surveillances, including Surveillances invoked by Required Actions, do not have to be performed on inoperable equipment because the ACTIONS define the remedial measures that apply. Surveillances have to be met and performed in accordance with SR 3.0.2, prior to returning equipment to OPERABLE status.
R.E. Ginna Nuclear Power Plant                      B 3.0-12                              Revision 81
 
SR Applicability B 3.0 Upon completion of maintenance, appropriate post maintenance testing is required to declare equipment OPERABLE. This includes ensuring applicable Surveillances are not failed and their most recent performance is in accordance with SR 3.0.2. Post maintenance testing may not be possible in the current MODE or other specified conditions in the Applicability due to the necessary plant parameters not having been established. In these situations, the equipment may be considered OPERABLE provided testing has been satisfactorily completed to the extent possible and the equipment is not otherwise believed to be incapable of performing its function. This will allow operation to proceed to a MODE or other specified condition where other necessary post maintenance tests can be completed.
SR 3.0.2              SR 3.0.2 establishes the requirements for meeting the specified Frequency for Surveillances and any Required Action with a Completion Time that requires the periodic performance of the Required Action on a "once per . . ." interval.
SR 3.0.2 permits a 25% extension of the interval specified in the Frequency. This extension facilitates Surveillance scheduling and considers plant operating conditions that may not be suitable for conducting the Surveillance (e.g., transient conditions or other ongoing Surveillance or maintenance activities).
The 25% extension does not significantly degrade the reliability that results from performing the Surveillance at its specified Frequency. This is based on the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the SRs. The exceptions to SR 3.0.2 are those Surveillances for which the 25% extension of the interval specified in the Frequency does not apply.
These exceptions are stated in the individual Specifications. The requirements of regulations take precedence over the TS. Therefore, when a test interval is specified in the regulations, the test interval cannot be exceeded by TS, and the SR includes a Note in the Frequency stating, "SR 3.0.2 is not applicable." An example of an exception when the test interval is not specified in the regulations is the Note in the Containment Leakage Rate Testing Program," SR 3.0.2 is not applicable." This exception is provided because the program already includes extension of test intervals.
R.E. Ginna Nuclear Power Plant                B 3.0-13                                    Revision 50
 
SR Applicability 83.0 As stated in SR 3.0.2, the 25% extension also does not apply to the initial portion of a periodic Completion Time that requires performance on a "once per ... " basis. The 25% extension applies to each performance after the initial performance. The initial performance of the Required Action, whether it is a particular Surveillance or some other remedial action, is considered a single action with a single Completion Time. One reason for not allowing the 25% extension to this Competion Time is that such an action usually verifies that no loss of function has occurred by checking the status of redundant or diverse components or accomplishes the function of the inoperable equipment in an alternative manner.
The provisions of SR 3.0.2 are not intended to be used repeatedly to extend Surveillance intervals (other than those consistent with Refueling intervals) or periodic Completion Time intervals beyond those specified.
SR3.0.3              SR 3.0.3 establishes the flexibility to defer declaring affected equipment inoperable or an affected variable outside the specified limits when a Surveillance has not been performed within the specified Frequency. A delay period of up to 24 hours or up to the limit of the specified Frequency, whichever is greater, applies from the point in time that it is discovered that the Surveillance has not been performed in accordance with SR 3.0.2, and not at the time that the specified Frequency was not met.
This delay period provides adequate time to perform Surveillances that have been missed. This delay period permits the performance of a Surveillance before complying with Required Actions or other remedial measures that might preclude performance of the Surveillance.
The basis for this delay period includes consideration of plant conditions, adequate planning, availability of personnel, the time required to perform the Surveillance, the safety significance of the delay in completing the required Surveillance, and the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the requirements.
When a Surveillance with a Frequency based not on time intervals, but upon specified plant conditions, operating situations, or requirements of regulations (e.g., prior to entering MODE 1 after each fuel loading, or in accordance with 10CFR 50, Appendix J, as modified by approved exemptions, etc.) is discovered to not have been performed when specified, SR 3.0.3 allows for the full delay period of up to the specified Frequency to perform the Surveillance. However, since there is not a time interval specified, the missed Surveillance should be performed at the first reasonable opportunity.
R.E. Ginna Nuclear Power Plant                B 3.0-14                                  Revision 82
 
SR Applicability 83.0 SR 3.0.3 also provides a time limit for, and allowances for the performance of, Surveillances that become applicable as a consequaice of MODE changes imposed by Required Actions.
SR 3.0.3 is only applicable if there is a reasonable expectation the associated equipment is OPERABLE or that variables are within limits, and it is expected that the Surveillance will be met when performed. Many factors should be considered, such as the period of time since the Surveillance was last performed, or whether the Surveillance, or a portion thereof, has ever been performed, and any other indications, tests, or activities that might support the expectation that the Surveillance will be met when performed. An example of the use of SR 3.0.3 would be a relay contact that was not tested as required in accordance with a particular SR, but previous successful performances of the SR included the relay contact; the adjacent, physically connected relay contacts were tested during the SR performance; the subject relay contact has been tested by another SR; or historical operation of the subject relay contact has been successful. It is not sufficient to infer the behavior of the associated equipment from the performance of similar equipment. The rigor of determining whether there is a reasonable expectation a Surveillance will be met when performed should increase based on the length of time since the last performance of the Surveillance. If the Surveillance has been performed recently, a review of the Surveillance history and equipment performance may be sufficient to support a reasonable expectation that the Surveillance will be met when performed. For Surveillances that have not been performed for a long period or that have never been performed, a rigorous evaluation based on objective evidence should provide a high degree of confidence that the equipment is OPERABLE. The evaluation should be documented in sufficient detail to allow a knowledgeable individual to understand the basis for the determination.
Failure to comply with specified Frequencies for SRs is expected to be an infrequent occurrence. Use of the delay period established by SR 3.0.3 is a flexibility which is not intended to be used repeatedly to extend Surveillance intervals. While up to 24 hours or the limit of the specified Frequency is provided to perform the missed Surveillance, it is expected that the missed Surveillance will be performed at the first reasonable opportunity. The determination of the first reasonable opportunity should include consideration of the impact on plant risk (from delaying the Surveillance as well as any plant configuration changes required or shutting the plant down to perform the Surveillance) and impact on any analysis assumptions, in addition to unit conditions, planning, availability of personnel, and the time required to perform the Surveillance. This risk impact should be managed through the program in place to implement 10CFR50.65(a)(4) and its implementation guidance, NRC Regulatory Guide 1.182, 'Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants.' This Regulatory Guide addresses consideration of temporary and aggregate risk impacts, determination of risk management action thresholds, and risk management action up to and R.E. Ginna Nuclear Power Plant                B3.0-15                                  Revision82
 
SR Applicability B3.0 including plant shutdown. The missed Surveillance should be treated as an emergent condition as discussed in the Regulatory Guide. The risk evaluation may use quantitative, qualitative, or blended methods. The degree of depth and rigor of the evaluation should be commensurate with the importance of the component. Missed Surveillances for important components should be analyzed quantitatively. If the results of the risk evaluation determine the risk increase is significant, this evaluation should be used to determine the safest course of action. All missed Surveillances will be placed within the Corrective Action Program.
If a Surveillance is not completed within the allowed delay period, then the equipment is considered inoperable or the variable is considered outside the specified limits and the Completion Times of the Required Actions for the applicable LCO Conditions begin immediately upon expiration of the delay period. If a Surveillance is failed within the delay period, then the equipment is inoperable, or the variable is outside the specified limits and the Completion Times of the Required Actions for the applicable LCO Conditions begin immediately upon the failure of the Surveillance.
Completion of the Surveillance within the delay period allowed by this Specification, or within the Completion Time of the ACTIONS, restores compliance with SR 3.0.1.
SR 3.0.4              SR 3.0.4 establishes the requirement that all applicable SRs must be met before entry into a MODE or other specified condition in the Applicability.
This Specification ensures that system and component OPERABILITY requirements and variable limits are met before entry into MODES or other specified conditions in the Applicability for which these systems and components ensure safe operation of the plant. The provisions of this Specification should not be interpreted as endorsing the failure to exercise the good practice of restoring systems or components to OPERABLE status before entering an associated MODE or other specified condition in the Applicability.
A provision is included to allow entry into a MODE or other specified condition in the Applicability when an LCO is not met due to Surveillance not being met in accordance with LCO 3.0.4 However, in certain circumstances, failing to meet an SR will not result in SR 3.0.4 restricting a MODE chcnge or other specified condition change.
When a system, subsystem, division, component, device, or variable is inoperable or outside its specified limits, the associated SRs are not required to be performed, per SR 3.0.1, which states that surveillances do not have to be performed on iroperable equipment. When equipment is inoperable, SR 3.0.4 does not apply to the associated SRs since the requirement for the SRs to be performed is removed. Trerefore, failing to R.E. Ginna Nuclear Power Plant                B 3.0-16                                    Revision 82
 
SR Applicability 83.0 perform the Surveillance(s) within the specified Frequency does not result in an SR 3.0.4 restriction to changing MODES or other specified conditions of the Applicability. However, since the LCO is not met in this instance, LCO 3.0.4 will govern any restrictions that may (or may not) apply to MODE or other specified condition changes. SR 3.0.4 does not restrict changing MODES or other specified conditions of the Applicability when a Surveillance has not been performed within the specified Frequency, provided the requirement to declare the LCO not met has been delayed in accordance with SR 3.0.3.
The provisions of SR 3.0.4 shall not prevent entry into MODES or other specified conditions in the Applicability that are required to comply with ACTIONS. In addition, the provisions of SR 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that result from any plant shutdown. In this context, a plant shutdown is defined as a change in MODE or other specified condition in the Applicability associated with transitioning from MODE 1 to MODE 2, MODE 2 to MODE 3, MODE 3 to MODE 4, and MODE 4 to MODE 5.
The precise requirements for performance of SRs are specified such that exceptions to SR 3.0.4 are not necessary. The specific time frames and conditions necessary for meeting the SRs are specified in the Frequency, in the Surveillance, or both. This allows performance of Surveillances when the prerequisite condition(s) specified in a Surveillance procedure require entry into the MODE or other specified condition in the Applicability of the associated LCO prior to the performance or completion of a Surveillance. A Surveillance that could not be performed until after entering the LCOs Applicability, would have its Frequency specified such that it is not "due" until the specific conditions needed are met. Alternately, the Surveillance may be stated in the form of a Note, as not required (to be met or performed) until a particular event, condition, or time has been reached. Further discussion of the specific formats of SRs annotation is found in Section 1.4, Frequency.
R.E. Ginna Nuclear Power Plant                B 3.0-17                                  Revision 82
 
SDM B 3.1.1 B 3.1    REACTIVITY CONTROL SYSTEMS B 3.1.1      SHUTDOWN MARGIN (SDM)
BASES BACKGROUND            According to Atomic Industrial Forum (AIF) GDC 27 and 28 (Ref. 1), two independent reactivity control systems must be available and capable of holding the reactor core subcritical from any hot standby or hot operating condition. Maintenance of the SDM ensures that postulated reactivity events will not damage the fuel.
SDM requirements provide sufficient reactivity margin to ensure that acceptable fuel design limits will not be exceeded for normal shutdown and anticipated operational occurrences (AOOs) which are defined as Condition 2 events in Reference 2 (i.e., events which can be expected to occur during a calendar year with moderate frequency). As such, the SDM defines the degree of subcriticality that would be obtained immediately following the insertion or scram of all shutdown and control rods, assuming that the single rod cluster assembly of highest reactivity worth is fully withdrawn and the fuel and moderator temperature are changed to the nominal hot zero power temperature.
The system design requires that two independent reactivity control systems be provided, and that one of these systems be capable of maintaining the core subcritical under cold conditions. These requirements are provided by the use of movable rod cluster control assemblies (RCCAs) and soluble boric acid in the Reactor Coolant System (RCS) which each provide a neutron absorbing mechanism. The Control Rod System can compensate for the reactivity effects of the fuel and water temperature changes accompanying power level changes over the range from full load to no load. In addition, the Control Rod System, together with the boration system, provides the SDM during power operation and is capable of making the core subcritical rapidly enough to prevent exceeding acceptable fuel damage limits, assuming that the rod of highest reactivity worth remains fully withdrawn. The chemical and volume control system can control the soluble boron concentration to compensate for fuel depletion during operation and all xenon burnout reactivity changes and maintain the reactor subcritical under cold conditions.
During power operation, SDM control is ensured by operating with the shutdown bank fully withdrawn and the control banks within the limits of LCO 3.1.6, "Control Bank Insertion Limits." The shutdown bank fully withdrawn position is defined in the COLR. When the plant is in the shutdown and refueling modes, the SDM requirements are met by means of adjustments to the RCS boron concentration.
R.E. Ginna Nuclear Power Plant              B 3.1.1-1                                  Revision 42
 
SDM B 3.1.1 APPLICABLE            The minimum required SDM is assumed as an initial condition in the SAFETY                safety analyses. The safety analysis (Ref. 3) establishes a SDM that ANALYSES              ensures specified acceptable fuel design limits are not exceeded for normal operation and AOOs, with the assumption of the highest worth rod stuck out following a scram.
The acceptance criteria for the SDM requirements are that specified acceptable fuel design limits are not exceeded. This is done by ensuring that:
: a. The reactor can be made subcritical from all operating conditions, transients, and Design Basis Accidents;
: b. The reactivity transients associated with postulated accident conditions are controllable within acceptable limits (departure from nucleate boiling ratio (DNBR), fuel centerline temperature limits for AOOs, and  200 cal/gm energy deposition for the rod ejection accident); and
: c. The reactor will be maintained sufficiently subcritical to preclude inadvertent criticality in the shutdown condition.
The most limiting accident for the SDM requirements is based on a steam line break (SLB), as described in the accident analysis (Ref. 3). The increased steam flow resulting from a pipe break in the main steam system causes an increased energy removal from the affected steam generator (SG), and consequently the RCS. This results in a reduction of the reactor coolant temperature. The resultant coolant shrinkage causes a reduction in pressure. In the presence of a negative moderator temperature coefficient, this cooldown causes an increase in core reactivity. The most limiting SLB for both one loop and two loop operation, with respect to potential fuel damage before a reactor trip occurs, is a guillotine break of a main steam line inside containment initiated at the end of core life. The positive reactivity addition from the moderator temperature decrease will terminate when the affected SG boils dry, thus terminating RCS heat removal and cooldown. Following the SLB, a post trip return to power may occur; however, no fuel damage occurs as a result of the post trip return to power, and THERMAL POWER does not violate the Safety Limit (SL) requirement of SL 2.1.1.
R.E. Ginna Nuclear Power Plant                B 3.1.1-2                                    Revision 42
 
SDM B 3.1.1 In addition to the limiting SLB transient, the SDM requirement must also protect against:
: a. Inadvertent boron dilution;
: b. An uncontrolled rod withdrawal from subcritical or low power condition;
: c. Startup of an inactive reactor coolant pump (RCP); and
: d. Rod ejection.
Each of these events is discussed below.
In the boron dilution analysis (Ref. 4), the required SDM defines the reactivity difference between an initial subcritical boron concentration and the corresponding critical boron concentration. These values, in conjunction with the configuration of the RCS and the assumed dilution flow rate, directly affect the results of the analysis (i.e., the time available to operators to stop the dilution event). This event is analyzed for refueling, shutdown (MODE 5) and power operation conditions and is most limiting at the beginning of core life, when critical boron concentrations are highest.
Depending on the system initial conditions and reactivity insertion rate, the uncontrolled rod withdrawal transient is terminated by either a high power level trip or a high pressurizer pressure trip (Ref. 5). In all cases, power level, RCS pressure, linear heat rate, and the DNBR do not exceed allowable limits if SDM has been maintained.
The startup of an inactive RCP will not result in a "cold water" criticality, even if the maximum difference in temperature exists between the SG and the core (Ref. 6). The maximum positive reactivity addition that can occur due to an inadvertent RCP start is less severe than the effects of a small steam line break with one loop operation. Startup of an idle RCP cannot, therefore, produce a return to power from the hot standby condition if SDM has been maintained.
The ejection of a control rod constitutes a break in the RCS which rapidly adds reactivity to the reactor core, causing both the core power level and heat flux to increase with corresponding increases in reactor coolant temperatures and pressure (Ref. 7). The ejection of a rod also produces a time dependent redistribution of core power which results in a high neutron flux trip. Fuel and cladding limits are not exceeded if SDM has been maintained.
R.E. Ginna Nuclear Power Plant                B 3.1.1-3                                    Revision 42
 
SDM B 3.1.1 SDM satisfies Criterion 2 of the NRC Policy Statement. Even though it is not directly observed from the control room, SDM is considered an initial condition process variable because it is periodically monitored to ensure that the plant is operating within the bounds of accident analysis assumptions.
LCO                  SDM is a core design condition that can be ensured during operation through control rod positioning (control and shutdown banks) and through the soluble boron concentration in the RCS.
The COLR provides the shutdown margin requirement with respect to RCS boron concentration. The SLB (Ref. 3) and the boron dilution (Ref.
: 4) accidents are the most limiting analyses that establish the SDM curve in the COLR. The maximum shutdown margin requirement occurs at end of cycle life and is based on the value used in analysis for the SLB. Early in cycle life, less SDM is required and is bounded by the requirements provided in the COLR. All other accidents analyses are based on 1%
reactivity shutdown margin. For SLB accidents, if the LCO is violated, there is a potential to exceed the DNBR limit and to exceed 10 CFR 50.67 limits (Ref. 8). For the boron dilution accident, if the LCO is violated, the minimum required time assumed for operator action to terminate dilution may no longer be applicable.
APPLICABILITY        In MODE 2 with keff < 1.0 and in MODES 3, 4 and 5, the SDM requirements are applicable to provide sufficient negative reactivity to meet the assumptions of the safety analyses discussed above. In MODE 6, the shutdown reactivity requirements are given in LCO 3.9.1, "Boron Concentration." In MODE 1 and MODE 2 with Keff  1.0, SDM is ensured by complying with LCO 3.1.5, "Shutdown Bank Insertion Limit," and LCO 3.1.6, "Control Bank Insertion Limits."
ACTIONS              A.1 If the SDM requirements are not met, boration must be initiated promptly.
A Completion Time of 15 minutes is adequate for an operator to correctly align and start the required systems and components. It is assumed that boration will be continued until the SDM requirements are met.
R.E. Ginna Nuclear Power Plant                    B 3.1.1-4                                  Revision 42
 
SDM B 3.1.1 In the determination of the required combination of boration flow rate and boron concentration, there is no unique requirement that must be satisfied. Since it is imperative to raise the boron concentration of the RCS as soon as possible, the flowpath of choice would utilize a highly concentrated solution, such as that normally found in the boric acid storage tank, or the refueling water storage tank. The operator should borate with the best source available for the plant conditions.
In determining the boration flow rate, the time in core life must be considered. For instance, the most difficult time in core life to increase the RCS boron concentration is at the beginning of cycle when the boron concentration may approach or exceed 2000 ppm. Assuming that a value of 1% 'k/k must be recovered and a boration flow rate of 10 gpm using 13,000 ppm boric acid solution, it is possible to increase the boron concentration of the RCS by 100 ppm in approximately 35 minutes. If a boron worth of 10 pcm/ppm is assumed, this combination of parameters will increase the SDM by 1% 'k/k. These boration parameters of 10 gpm and 13,000 ppm represent typical values and are provided for the purpose of offering a specific example.
SURVEILLANCE          SR 3.1.1.1 REQUIREMENTS In MODE 2 with Keff < 1.0 and MODES 3, 4, and 5, the SDM is verified by comparing the RCS boron concentration to a SHUTDOWN MARGIN requirement curve that was generated by taking into account estimated RCS boron concentrations, core power defect, control bank position, RCS average temperature, fuel burnup based on gross thermal energy generation, xenon concentration, samarium concentration, and isothermal temperature coefficient (ITC)
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES            1. Atomic Industrial Forum (AIF) GDC 27 and 28, Issued for comment July 10, 1967.
: 2.    "American National Standard Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants," N18.2-1973.
: 3. UFSAR, Section 15.1.5.
: 4. UFSAR, Section 15.4.4.
R.E. Ginna Nuclear Power Plant                B 3.1.1-5                                        Revision 77
 
SDM B 3.1.1
: 5. UFSAR, Section 15.4.2.
: 6. UFSAR, Section 15.4.3.
: 7. UFSAR, Section 15.4.5.
: 8. 10 CFR 50.67.
R.E. Ginna Nuclear Power Plant              B 3.1.1-6 Revision 42
 
Core Reactivity B 3.1.2 B 3.1    REACTIVITY CONTROL SYSTEMS B 3.1.2      Core Reactivity BASES BACKGROUND            According to Atomic Industrial Forum (AIF) GDC 27, 28, 29, and 30 (Ref.
1), reactivity shall be controllable, such that subcriticality is maintained under cold conditions, and acceptable fuel design limits are not exceeded during normal operation and anticipated operational occurrences.
Therefore, reactivity balance is used as a measure of the predicted versus measured core reactivity during power operation. The periodic confirmation of core reactivity is necessary to ensure that Design Basis Accident (DBA) and transient safety analyses remain valid. A large reactivity difference could be the result of unanticipated changes in fuel, control rod worth, or operation at conditions not consistent with those assumed in the predictions of core reactivity, and could potentially result in a loss of SHUTDOWN MARGIN (SDM) or violation of acceptable fuel design limits. Comparing predicted versus measured core reactivity validates the nuclear methods used in the safety analysis and supports the SDM demonstrations (LCO 3.1.1, "SHUTDOWN MARGIN (SDM))" in ensuring the reactor can be brought safely to cold, subcritical conditions.
When the reactor core is critical or in normal power operation, a reactivity balance exists and the net reactivity is zero. A comparison of predicted and measured reactivity is convenient under such a balance, since parameters are being maintained relatively stable under steady state power conditions. The positive reactivity inherent in the core design is balanced by the negative reactivity of the control components, thermal feedback, neutron leakage, and materials in the core that absorb neutrons, such as burnable absorbers producing zero net reactivity.
Excess reactivity can be inferred from the boron letdown curve (or critical boron curve) in the core design report, which provides an indication of the soluble boron concentration in the Reactor Coolant System (RCS) versus cycle burnup. Periodic measurement of the RCS boron concentration for comparison with the predicted value with other variables fixed or stable (such as rod height, temperature, pressure, and power), provides a convenient method of ensuring that core reactivity is within design expectations and that the calculational models used to generate the safety analysis are adequate.
R.E. Ginna Nuclear Power Plant B 3.1.2-1                                    Revision 21
 
Core Reactivity B 3.1.2 In order to achieve the required fuel cycle energy output, the uranium enrichment, in the new fuel loading and in the fuel remaining from the previous cycle, provides excess positive reactivity beyond that required to sustain steady state operation throughout the cycle. When the reactor is critical at RTP and normal operating temperature, the excess positive reactivity is compensated by burnable absorbers (if any), control rods, whatever neutron poisons (mainly xenon and samarium) are present in the fuel, and the RCS boron concentration.
When the core is producing THERMAL POWER, the fuel is being depleted and excess reactivity is decreasing. As the fuel depletes, the RCS boron concentration is reduced to decrease negative reactivity and maintain constant moderator temperature. The boron letdown curve is based on steady state operation at RTP. Therefore, deviations from the predicted boron letdown curve may indicate deficiencies in the design analysis, deficiencies in the calculational models, or abnormal core conditions, and must be evaluated.
APPLICABLE              The acceptance criteria for core reactivity are that the reactivity balance SAFETY                  limit ensures plant operation is maintained within the assumptions of the ANALYSES                safety analyses.
Accurate prediction of core reactivity is either an explicit or implicit assumption in the accident analysis evaluations. Every accident evaluation (Ref. 2) is, therefore, dependent upon accurate evaluation of core reactivity. In particular, SDM and reactivity transients, such as control rod withdrawal accidents or rod ejection accidents, are very sensitive to accurate prediction of core reactivity. These accident analysis evaluations rely on computer codes that have been qualified against available test data, operating plant data, and analytical benchmarks. Monitoring reactivity balance additionally ensures that the Nuclear Design Methodology provides an accurate representation of the core reactivity.
Design calculations and safety analyses are performed for each fuel cycle for the purpose of predetermining reactivity behavior and the RCS boron concentration requirements for reactivity control during fuel depletion.
The comparison between measured and predicted initial core reactivity provides a normalization for the calculational models used to predict core reactivity. If the measured and predicted RCS boron concentrations for identical core conditions at beginning of cycle life (BOL) do not agree, then the assumptions used in the reload cycle design analysis or the calculational models used to predict soluble boron requirements may not be accurate. If reasonable agreement between measured and predicted core reactivity exists at BOL, then the prediction may be normalized to R.E. Ginna Nuclear Power Plant B 3.1.2-2                              Revision 21
 
Core Reactivity B 3.1.2 the measured boron concentration. Thereafter, any significant deviations in the measured boron concentration from the predicted boron letdown curve that develop during fuel depletion may be an indication that the calculational model is not adequate for core burnups beyond BOL, or that an unexpected change in core conditions has occurred.
The normalization of predicted RCS boron concentration to the measured value is typically performed after reaching RTP following startup from a refueling outage, with the control rods in their normal positions for power operation. The normalization is performed at BOL conditions, so that core reactivity relative to predicted values can be continually monitored and evaluated as core conditions change during the cycle.
Core reactivity satisfies Criterion 2 of the NRC Policy Statement.
LCO                  Long term core reactivity behavior is a result of the core physics design and cannot be easily controlled once the core design is fixed. During operation, therefore, the LCO can only be ensured through measurement and tracking, and appropriate actions taken as necessary. Large differences between actual and predicted core reactivity may indicate that the assumptions of the DBA and transient analyses are no longer valid, or that the uncertainties in the Nuclear Design Methodology are larger than expected. A limit on the reactivity balance of +/-1% 'k/k has been established based on engineering judgment. A 1% deviation in reactivity from that predicted is larger than expected for normal operation and should therefore be evaluated.
When measured core reactivity is within 1% 'k/k of the predicted value at steady state thermal conditions, the core is considered to be operating within acceptable design limits. Since deviations from the limit are normally detected by comparing predicted and measured steady state RCS critical boron concentrations, the difference between measured and predicted values would be approximately 100 ppm (depending on the boron worth) before the limit is reached. These values are well within the uncertainty limits for analysis of boron concentration samples, so that spurious violations of the limit due to uncertainty in measuring the RCS boron concentration are unlikely.
APPLICABILITY        The limits on core reactivity must be maintained during MODE 1 and MODE 2 with Keff 1.0 because a reactivity balance must exist when the reactor is critical or producing THERMAL POWER. As the fuel depletes, core conditions are changing, and confirmation of the reactivity balance ensures the core is operating as designed. This Specification does not apply in MODE 2 with Keff < 1.0 or MODES 3, 4, and 5 because the reactor is shut down.
R.E. Ginna Nuclear Power Plant B 3.1.2-3                                Revision 21
 
Core Reactivity B 3.1.2 In MODE 6, fuel loading results in a continually changing core reactivity.
Boron concentration requirements (LCO 3.9.1, "Boron Concentration")
ensure that fuel movements are performed within the bounds of the safety analysis. A S core reactivity verification is required during the first startup following operations that could have altered core reactivity (SR 3.1.2.1) to compare measured core reactivity values to predicted values.
ACTIONS                A.1 and A.2 Should an anomaly develop between measured and predicted core reactivity, an evaluation of the core design and safety analysis must be performed. Core conditions are evaluated to determine their consistency with input to design calculations. Measured core and process parameters are evaluated to determine that they are within the bounds of the safety analysis, and safety analysis calculational models are reviewed to verify that they are adequate for representation of the core conditions. The required Completion Time of 72 hours is based on the low probability of a DBA occurring during this period, and allows sufficient time to assess the physical condition of the reactor and complete the evaluation of the core design and safety analysis.
Following evaluations of the core design and safety analysis, the cause of the reactivity anomaly may be resolved. If the cause of the reactivity anomaly is a mismatch in core conditions at the time of RCS boron concentration sampling, then a recalculation of the RCS boron concentration requirements may be performed to demonstrate that core reactivity is behaving as expected. If an unexpected physical change in the condition of the core has occurred, it must be evaluated and corrected, if possible. If the cause of the reactivity anomaly is in the calculation technique, then the calculational models must be revised to provide more accurate predictions. If any of these results are demonstrated, and it is concluded that the reactor core is acceptable for continued operation, then the boron letdown curve may be renormalized and power operation may continue. If operational restriction or additional SRs are necessary to ensure the reactor core is acceptable for continued operation, then they must be defined.
The required Completion Time of 72 hours is adequate for preparing whatever operating restrictions or Surveillances that may be required to allow continued reactor operation.
R.E. Ginna Nuclear Power Plant                B 3.1.2-4                                  Revision 21
 
Core Reactivity B 3.1.2 B.1 If the core reactivity cannot be restored to within the 1% 'k/k limit, or if the Required Actions of Condition A cannot be completed within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 2 with Keff < 1.0 within 6 hours. If the SDM for MODE 2 with Keff < 1.0 is not met, then the boration required by SR 3.1.1.1 would occur. The allowed Completion Time is reasonable, based on operating experience, for reaching MODE 2 with Keff < 1.0 from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE              SR 3.1.2.1 REQUIREMENTS Core reactivity must be verified following operations that could have altered core reactivity (e.g., fuel movement, control rod replacement, control rod shuffling). The comparison must be made prior to entering MODE 1 when the core conditions such as control rod position, moderator temperature, and samarium concentration are fixed or stable. Since the reactor must be critical to verify core reactivity, it is acceptable to enter MODE 2 with Keff  1.0 to perform this SR. This SR is modified by a Note to clarify that the SR does not need to be performed until prior to entering MODE 1.
SR 3.1.2.2 Core reactivity is verified by periodic comparisons of measured and predicted RCS boron concentrations. The comparison is made, considering that other core conditions are fixed or stable, including control rod position, moderator temperature, fuel temperature, fuel depletion, xenon concentration, and samarium concentration. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The SR is modified by two Notes. The first Note states that the SR is only required after 60 effective full power days (EFPD). The second Note indicates that the normalization of predicted core reactivity to the measured value must take place within the first 60 EFPD after each fuel loading. This allows sufficient time for core conditions to reach steady state, but prevents operation for a large fraction of the fuel cycle without establishing a benchmark for the design calculations.
R.E. Ginna Nuclear Power Plant                  B 3.1.2-5                                    Revision 77
 
Core Reactivity B 3.
 
==1.2 REFERENCES==
: 1. Atomic Industrial Forum (AIF) GDC 27, 28, 29, and 30, Issued for comment July 10, 1967.
: 2. UFSAR, Chapter 15.
R.E. Ginna Nuclear Power Plant            B 3.1.2-6                                Revision 21
 
MTC B 3.1.3 B 3.1    REACTIVITY CONTROL SYSTEMS B 3.1.3      Moderator Temperature Coefficient (MTC)
BASES BACKGROUND            According to Atomic Industrial Forum (AIF) GDC 8 (Ref. 1), the reactor core and its interaction with the Reactor Coolant System (RCS) must be designed for inherently stable power operation, even in the possible event of an accident. In particular, the net reactivity feedback in the system must compensate for any unintended reactivity increases.
The MTC relates a change in core reactivity to a change in reactor coolant temperature (a positive MTC means that reactivity increases with increasing moderator temperature; conversely, a negative MTC means that reactivity decreases with increasing moderator temperature). MTC is defined as the change in reactivity per degree change in moderator temperature since temperature is directly proportional to coolant density.
The reactor is designed to operate with a negative MTC over the largest possible range of fuel cycle operation. Therefore, a coolant temperature increase will cause a reactivity decrease, so that the coolant temperature tends to return toward its initial value. Reactivity increases that cause a coolant temperature increase will thus be self limiting, and stable power operation will result.
MTC values are predicted at selected burnups during the safety evaluation analysis and are confirmed to be acceptable by measurements. Both initial and reload cores are designed so that the beginning of cycle life (BOL) MTC is less than zero when THERMAL POWER is at RTP. The actual value of the MTC is dependent on core characteristics, such as fuel loading and reactor coolant soluble boron concentration. The core design may require additional fixed distributed poisons to yield an MTC at BOL within the range analyzed in the plant accident analysis. The end of cycle life (EOL) MTC is also limited by the requirements of the accident analysis. Fuel cycles that are designed to achieve high burnups or that have changes to other characteristics are evaluated to ensure that the MTC does not exceed the EOL limit.
The limitations on MTC are provided to ensure that the value of this coefficient remains within the limiting conditions assumed in the UFSAR accident and transient analyses.
R.E. Ginna Nuclear Power Plant                B 3.1.3-1                                  Revision 34
 
MTC B 3.1.3 APPLICABLE            The acceptance criteria for the specified MTC are:
SAFETY ANALYSES              a. The MTC values must remain within the bounds of those used in the accident analysis (Ref. 2); and
: b.      The MTC must be such that inherently stable power operations result during normal operation and accidents, such as overheating and overcooling events.
The UFSAR, Chapter 15 (Ref. 2), contains analyses of accidents that result in both overheating and overcooling of the reactor core. MTC is one of the controlling parameters for core reactivity in these accidents.
Both the most positive value and most negative value of the MTC are important to safety, and both values must be bounded. Values used in the analyses consider worst case conditions to ensure that the accident results are bounding (Ref. 3).
The consequences of accidents that cause core overheating must be evaluated when the MTC is positive (i.e., upper limit). Such accidents include the rod withdrawal transient from either zero or RTP, loss of main feedwater flow, and loss of forced reactor coolant flow. The consequences of accidents that cause core overcooling must be evaluated when the MTC is negative (i.e., lower limit). Such accidents include sudden feedwater flow increase and sudden decrease in feedwater temperature.
In order to ensure a bounding accident analysis, the MTC is assumed to be its most limiting value for the analysis conditions appropriate to each accident. The bounding value is determined by considering rodded and unrodded conditions, whether the reactor is at full or zero power, and whether it is at BOL or EOL. The most conservative combination appropriate to the accident is then used for the analysis (Ref. 2).
MTC satisfies Criterion 2 of the NRC Policy Statement. Even though it is not directly observed and controlled from the control room, MTC is considered an initial condition process variable because of its dependence on boron concentration.
R.E. Ginna Nuclear Power Plant              B 3.1.3-2                                  Revision 34
 
MTC B 3.1.3 LCO                  LCO 3.1.3 requires the MTC to be within the specified limits of the COLR to ensure that the core operates within the assumptions of the accident analysis. During the reload core safety evaluation, the MTC is analyzed to determine that its values remain within the bounds of the original accident analysis during operation.
Assumptions made in safety analyses require that the MTC be less positive than a given upper bound and more positive than a given lower bound. The MTC is most positive at BOL; this upper bound must not be exceeded. This maximum upper limit occurs at BOL, all rods out (ARO),
hot zero power (HZP) conditions. At EOL the MTC takes on its most negative value, when the lower bound becomes important. This LCO exists to ensure that both the upper and lower bounds are not exceeded.
During operation, therefore, the conditions of the LCO can only be ensured through measurement. The Surveillance check at BOL on MTC provides confirmation that the MTC is behaving as anticipated and will be within limits at 70% RTP, full power, and EOL so that the acceptance criteria are met.
The LCO establishes a maximum positive value that cannot be exceeded. The BOL positive limit and the EOL negative limit are established in the COLR to allow specifying limits for each particular cycle. This permits the plant to take advantage of improved fuel management and changes in plant operating schedule.
If the LCO limits are not met, the plant response during transients may not be as predicted. The core could violate criteria that prohibit a return to criticality, or the departure from nucleate boiling ratio criteria of the approved correlation may be violated, which could lead to a loss of the fuel cladding integrity.
APPLICABILITY        In MODE 1, the upper and lower limits on MTC must be maintained to ensure that any accident initiated from THERMAL POWER operation will not violate the design assumptions of the accident analysis. In MODE 2 with the reactor critical, the upper limit must also be maintained to ensure that startup and subcritical accidents (such as the uncontrolled CONTROL ROD assembly or group withdrawal) will not violate the assumptions of the accident analysis. The lower MTC limit must be maintained in MODES 2 and 3, in addition to MODE 1, to ensure that cooldown accidents will not violate the assumptions of the accident analysis since MTC becomes more negative as the cycle burnup increases because the RCS boron concentration is reduced. In MODES 4, 5, and 6, this LCO is not applicable, since no Design Basis Accidents R.E. Ginna Nuclear Power Plant                  B 3.1.3-3                                    Revision 34
 
MTC B 3.1.3 using the MTC as an analysis assumption are initiated from these MODES.
ACTIONS              A.1 MTC must be kept within the upper limit specified in LCO 3.1.3 to ensure that assumptions made in the safety analysis remain valid. The upper limit of Condition A is the upper limit specified in the COLR since this value will always be less than or equal to the maximum upper limit specified in the LCO.
If the upper MTC limit is violated at BOL, administrative withdrawal limits for control banks must be established to maintain the MTC within its limits in the future. A Completion Time of 24 hours provides enough time for evaluating the MTC measurement and computing the required bank withdrawal limits.
As cycle burnup is increased, the RCS boron concentration will be reduced. The reduced boron concentration causes the MTC to become more negative. Using physics calculations, the time in cycle life at which the calculated MTC will meet the LCO requirement can be determined.
At this point in core life Condition A no longer exists. The plant is no longer in the Required Action, so the administrative withdrawal limits are no longer in effect.
B.1 If the required administrative withdrawal limits at BOL are not established within 24 hours, the plant must be brought to a MODE or condition in which the LCO requirements are not applicable. To achieve this status the plant must be brought to MODE 2 with keff < 1.0. The allowed Completion Time of 6 hours is reasonable, based on operating experience, for reaching the required MODE from full power conditions in an orderly manner and without challenging plant systems.
C.1 Exceeding the EOL MTC lower limit means that the safety analysis assumptions of the EOL accidents that use a bounding negative MTC value may be invalid. If it is determined during physics testing that the EOL MTC value will exceed the most negative MTC limit specified in the COLR, the safety analysis and core design must be re-evaluated prior to reaching the equivalent of an equilibrium RTP all rods out (ARO) boron concentration of 300 ppm to ensure that operation near the EOL remains acceptable. The 300 ppm limit is sufficient to prevent EOL operation at or below the accident analysis MTC assumptions.
R.E. Ginna Nuclear Power Plant                B 3.1.3-4                                Revision 34
 
MTC B 3.1.3 Condition C has been modified by a Note that requires that Required Action C.1 must be completed whenever this Condition is entered. This is necessary to ensure that the plant does not operate at conditions where the MTC would be below the most negative limit specified in the COLR.
Required Action C.1 is modified by a Note which states that LCO 3.0.4.c is applicable. This Note is provided since the requirement to re-evaluate the core design and safety analysis prior to reaching an equivalent RTP ARO boron concentration of 300 ppm is adequate action without restricting entry into MODE 1.
D.1 If the re-evaluation of the accident analysis cannot support the predicted EOL MTC lower limit, or if the Required Actions of Condition C are not completed within the associated Completion Time the plant must be brought to a MODE or Condition in which the LCO requirements are not applicable. To achieve this status, the plant must be brought to MODE 4 within 12 hours. The allowed Completion Time is reasonable, based on operating experience, for reaching the required MODE from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE                SR 3.1.3.1 REQUIREMENTS This SR requires measurement of the MTC at BOL prior to entering MODE 1 in order to demonstrate compliance with the most positive MTC LCO. Meeting the limit prior to entering MODE 1 ensures that the limit will also be met at higher power levels.
The BOL MTC value for ARO will be inferred from isothermal temperature coefficient (ITC) measurements obtained during the physics tests after refueling. The ARO value can be directly compared to the BOL MTC limit of the LCO. If required, measurement results and predicted design values can be used to establish administrative withdrawal limits for control banks.
The measurement of the MTC at the beginning of the fuel cycle is adequate to confirm that the MTC remains within its upper limits and will be within limits at 70% RTP, full power and at EOL, since this coefficient changes slowly, due principally to the reduction in RCS boron concentration associated with fuel burnup. This measurement is consistent with the recommendations detailed in Reference 4.
R.E. Ginna Nuclear Power Plant                    B 3.1.3-5                                Revision 34
 
MTC B 3.1.3 SR 3.1.3.2 This SR requires measurement of MTC at BOL prior to entering MODE 1 after each refueling in order to demonstrate compliance with the 70%
RTP MTC limit. The Frequency of "once prior to entering MODE 1 after each refueling" ensures the limit will also be met at higher power levels.
SR 3.1.3.3 This SR requires measurement of MTC at BOL prior to entering MODE 1 after each refueling in order to demonstrate compliance with the most negative MTC LCO. Meeting this limit prior to entering MODE 1 ensures that the limit will also be met at EOL.
The MTC value for EOL is also inferred from the ITC measurements. The EOL value is calculated using the predicted EOL MTC from the core design report and the difference between the measured and predicted ITC. The EOL value is directly compared to the most negative EOL value established in the COLR to ensure that the predicted EOL negative MTC value is within the accident analysis assumptions.
REFERENCES            1. Atomic Industrial Forum (AIF) GDC 8, Issued for comment July 10, 1967.
: 2. UFSAR, Chapter 15.
: 3. WCAP 9272-P-A, "Westinghouse Reload Safety Evaluation Methodology," July 1985.
: 4. Letter from J. P. Durr (NRC) to B. A. Snow (RGE),
 
==Subject:==
 
                              "Inspection Report No. 50-244/88-06", dated April 28, 1988.
R.E. Ginna Nuclear Power Plant                B 3.1.3-6                              Revision 34
 
Rod Group Alignment Limits B 3.1.4 B 3.1    REACTIVITY CONTROL SYSTEMS B 3.1.4      Rod Group Alignment Limits BASES BACKGROUND            The OPERABILITY (e.g., trippability) of the shutdown and control rods is an initial assumption in all safety analyses that assume rod insertion upon reactor trip. Maximum rod misalignment is an initial assumption in the safety analysis that directly affects core power distributions and assumptions of available SHUTDOWN MARGIN (SDM). The applicable criteria for these reactivity and power distribution design requirements are Atomic Industrial Forum (AIF) GDC 6, 14, 27 and 28(Ref. 1), and 10 CFR 50.46 (Ref. 2).
Mechanical or electrical failures may cause a control rod to become inoperable or to become misaligned from its group. Control rod inoperability or misalignment may cause increased power peaking, due to the asymmetric reactivity distribution and a reduction in the total available rod worth for reactor shutdown. Therefore, control rod alignment and OPERABILITY are related to core operation in design power peaking limits and the core design requirement of a minimum SDM. Limits on control rod alignment and OPERABILITY have been established, and all rod positions are monitored and controlled during power operation to ensure that the power distribution and reactivity limits defined by the design power peaking and SDM limits are preserved.
Rod cluster control assemblies (RCCAs), or rods, are movable neutron absorbing devices which are moved out of the core (up or withdrawn) or into the core (down or inserted) by their control rod drive mechanisms (CRDMs). Each CRDM moves its RCCA one step (approximately 5/8 inch) at a time, but at varying rates (steps per minute) depending on the signal output from the Rod Control System.
The RCCAs are divided among control banks and a shutdown bank.
Control banks are used to compensate for changes in reactivity due to variations in operating conditions of the reactor such as coolant temperature, power level, boron or xenon concentration. The shutdown bank provides additional shutdown reactivity such that the total shutdown worth of the bank is adequate to provide shutdown for all operating and hot zero power conditions with the single RCCA of highest reactivity worth fully withdrawn. Each bank is further subdivided into two groups to provide for precise reactivity control. A group consists of two or more RCCAs that are electrically paralleled to step simultaneously. A bank of RCCAs consists of two groups that are moved in a staggered fashion, but always within one step of each other. There are four control banks and one shutdown bank at Ginna Station.
R.E. Ginna Nuclear Power Plant                B 3.1.4-1                                  Revision 60
 
Rod Group Alignment Limits B 3.1.4 The shutdown bank is maintained either in the fully inserted or fully withdrawn position. The fully withdrawn position is defined in the COLR.
The control banks are moved in an overlap pattern, using the following withdrawal sequence: When control bank A reaches a predetermined height in the core, control bank B begins to move out with control bank A.
Control bank A stops at the fully withdrawn position, and control bank B continues to move out. When control bank B reaches a predetermined height, control bank C begins to move out with control bank B. This sequence continues until control banks A, B, and C are at the fully withdrawn position, and control bank D is near the fully withdrawn position at RTP. The insertion sequence is the opposite of the withdrawal sequence (i.e., bank D is inserted first) but follows the same overlap pattern. The control rods are arranged in a radially symmetric pattern, so that control bank motion does not introduce radial asymmetries in the core power distributions.
The axial position of shutdown rods and control rods is indicated by two separate and independent systems: the Bank Demand Position Indication System (commonly called group step counters) and the Microprocessor Rod Position Indication (MRPI) System.
The Bank Demand Position Indication System counts the pulses from the rod control system that moves the rods. There is one step counter for each group of rods. Individual rods in a group all receive the same signal to move and should, therefore, all be at the same position indicated by the group step counter for that group. The Bank Demand Position Indication System is considered highly precise (+/-1 step or +/-5/8 inch),
but if a rod does not move one step for each demand pulse, the step counter will still count the pulse and incorrectly reflect the position of the rod.
The MRPI System also provides a highly accurate indication of actual control rod position, but at a lower precision than the step counters. The MRPI system consists of one digital detector assembly per rod. All the detector assemblies consist of one coil stack which is multiplexed and becomes input to two redundant MRPI signal processors. Each signal processor independently monitors all rods and senses a rod bottom for any rod. The MRPI system directly senses rod position in intervals of 12 steps for each rod. The digital detector assemblies consist of 20 discrete coil pairs spaced at 12-step intervals. The true rod position is always within +/-8 steps of the indicated position (+/-6 steps due to the 12-step interval and +/-2 steps transition uncertainty due to processing and coil sensitivity). With an indicated deviation of 12 steps between the group step counter and MRPI, the maximum deviation between actual rod position and the demand position would be 20 steps, or 12.5 inches.
R.E. Ginna Nuclear Power Plant                B 3.1.4-2                                    Revision 60
 
Rod Group Alignment Limits B 3.1.4 The safety concerns associated with the MRPI system is the ability to comply with the rod misalignment requirement. The automatic rod withdrawal function has been disabled, which effectively eliminated the MRPI rod drop rod stop function, which previously blocked auto rod withdrawal. The accident analysis conservatively assumes that the capability to automatically withdraw control rods is retained.
The bank demand position and the MRPI rod position signals are monitored by a rod deviation monitoring system that provides an alarm whenever the individual rod position signal deviates from the bank demand signal by > 12 steps. The rod deviation alarm will be generated by the Plant Process Computer System (PPCS).
APPLICABLE                  Control rod misalignment accidents are analyzed in the safety analysis SAFETY                      (Ref. 3). The acceptance criteria for addressing control rod inoperability ANALYSES                    or misalignment are that:
: a. There be no violations of:
: 1. Specified acceptable fuel design limits, or
: 2. Reactor Coolant System (RCS) pressure boundary integrity; and
: b. The core remains subcritical after accident transients.
Two types of misalignment are distinguished. During movement of a control rod group, one rod may stop moving, while the other rods in the group continue (i.e., static rod misalignment). This condition may cause excessive power peaking. The second type of misalignment occurs if one rod fails to insert upon a reactor trip and remains stuck fully withdrawn. This condition requires an evaluation to determine that sufficient reactivity worth is held in the remaining control rods to meet the SDM requirement, with the maximum worth rod stuck fully withdrawn.
Three types of analysis are performed in regard to static rod misalignment (Ref. 4). The first type of analysis considers the case where any one rod is completely inserted into the core with all other rods completely withdrawn. With control banks at their insertion limits, the second type of analysis considers the case when any one rod is completely inserted into the core. The third type of analysis considers the case of a completely withdrawn single rod from a bank inserted to its insertion limit. Satisfying limits on departure from nucleate boiling ratio in all three of these cases bounds the situation when a rod is misaligned from its group by 12 steps.
R.E. Ginna Nuclear Power Plant                    B 3.1.4-3                                  Revision 60
 
Rod Group Alignment Limits B 3.1.4 The second type of misalignment occurs if one RCCA fails to insert upon a reactor trip and remains stuck fully withdrawn. This condition is assumed in the evaluation to determine that the required SDM is met with the maximum worth RCCA fully withdrawn following a main steam line break (Ref. 5).
The Required Actions in this LCO ensure that either deviations from the alignment limits will be corrected or that THERMAL POWER will be adjusted so that excessive local linear heat rates (LHRs) will not occur, and that the requirements on SDM and ejected rod worth are preserved.
Continued operation of the reactor with a misaligned control rod is allowed if the heat flux hot channel factor (FQ(Z)) and the nuclear enthalpy hot channel factor (FN'H) are verified to be within their limits in the COLR and the safety analysis is verified to remain valid. When a control rod is misaligned, the assumptions that are used to determine the rod insertion limits, AFD limits, and quadrant power tilt limits are not preserved. Therefore, the limits may not preserve the design peaking factors, and FQ(Z) and FN'H must be verified directly by incore mapping. Bases Section 3.2 (Power Distribution Limits) contains more complete discussions of the relation of FQ(Z) and FN'H to the operating limits.
Shutdown and control rod OPERABILITY and alignment are directly related to power distributions and SDM, which are initial conditions assumed in safety analyses. Therefore they satisfy Criterion 2 of the NRC Policy Statement.
LCO                  All shutdown and control rods must be OPERABLE to provide the negative reactivity necessary to provide adequate shutdown for all operating and hot zero power conditions. Shutdown and control rod OPERABILITY is defined as being trippable such that the necessary negative reactivity assumed in the accident analysis is available. If a control rod(s) is discovered to be immovable but remains trippable and aligned, the control rod is considered to be OPERABLE.
The limits on shutdown or control rod alignments ensure that the assumptions in the safety analysis will remain valid. The requirements on OPERABILITY ensure that upon reactor trip, the assumed reactivity will be available and will be inserted. The OPERABILITY requirements also ensure that the RCCAs and banks maintain the correct power distribution and rod alignment.
R.E. Ginna Nuclear Power Plant                B 3.1.4-4                                Revision 60
 
Rod Group Alignment Limits B 3.1.4 The requirement to maintain the rod alignment of each individual rod position as indicated by MRPI to within plus or minus 12 steps of their group step counter demand position is conservative. The minimum misalignment assumed in safety analysis with respect to power distribution and SDM is 25 steps, while a total misalignment from fully withdrawn to fully inserted is assumed for the control rod misalignment accident.
Verification that the rod positions are within the alignment limit is made in accordance with the Surveillance Frequency Control Program (SR 3.1.4.1).
Failure to meet the requirements of this LCO may produce unacceptable power peaking factors and LHRs, or unacceptable SDMs, all of which may constitute initial conditions inconsistent with the safety analysis.
APPLICABILITY        The requirements on RCCA OPERABILITY and alignment are applicable in MODES 1 and 2 because these are the only MODES in which neutron (or fission) power is generated, and the OPERABILITY (i.e.,
trippability) and alignment of rods have the potential to affect the safety of the plant. In MODES 3, 4, 5, and 6, the alignment limits do not apply because the reactor is shut down and not producing fission power. In the shutdown MODES, the OPERABILITY of the shutdown and control rods has the potential to affect the required SDM, but this effect can be compensated for by an increase in the boron concentration of the RCS.
See LCO 3.1.1, "SHUTDOWN MARGIN (SDM)," for SDM in MODES 3, 4, and 5 and LCO 3.9.1, "Boron Concentration," for boron concentration requirements during MODE 6.
ACTIONS              A.1.1 and A.1.2 When one or more rods are inoperable (i.e., untrippable), there is a possibility that the required SDM may be adversely affected. Under these conditions, it is important to determine the SDM, and if it is less than the required value, initiate boration until the required SDM is recovered. The Completion Time of 1 hour is adequate for determining SDM and, if necessary, for initiating boration to restore SDM. Boration is assumed to continue until the required SDM is restored.
R.E. Ginna Nuclear Power Plant                    B 3.1.4-5                                  Revision 88
 
Rod Group Alignment Limits B 3.1.4 In this situation, SDM verification must include the worth of the untrippable rod, as well as a remaining rod of maximum worth.
A.2 If the untrippable rod(s) cannot be restored to OPERABLE status, the plant must be brought to a MODE or condition in which the LCO requirements are not applicable. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours.
The allowed Completion Time is reasonable, based on operating experience, for reaching MODE 3 from full power conditions in an orderly manner and without challenging plant systems.
B.1.1 and B.1.2 When a rod is misaligned, it can usually be moved and is still trippable. If the rod cannot be realigned within 1 hour, then SDM must be verified to be within the limits specified in the COLR or boration must be initiated to restore the SDM. The Completion Time of 1 hour gives the operator sufficient time to perform either action in an orderly manner.
B.2, B.3, B.4, and B.5 For continued operation with a misaligned rod, reactor power must be reduced, SDM must periodically be verified within limits, hot channel factors (FQ(Z) and FN H must be verified within limits, and the safety analyses must be re-evaluated to confirm continued operation is permissible.
Reduction of power to  75% RTP ensures that local LHR increases due to a misaligned RCCA will not cause the core design criteria to be exceeded (Ref. 6). The Completion Time of 2 hours gives the operator sufficient time to accomplish an orderly power reduction without challenging the Reactor Protection System.
When a rod is known to be misaligned, there is a potential to impact the SDM. Since the core conditions can change with time, periodic verification of SDM is required. A Frequency of 12 hours is sufficient to ensure this requirement continues to be met.
Verifying that FQ(Z) and FNH are within the required limits (i.e., SR 3.2.1.1, SR 3.2.1.2, and SR 3.2.2.1) ensures that current operation at 75% RTP with a rod misaligned is not resulting in power distributions that may invalidate safety analysis assumptions at full power. The Completion Time of 72 hours allows sufficient time to obtain flux maps of the core power distribution using the incore flux mapping system and to calculate FQ(Z) and FNH*
R.E. Ginna Nuclear Power Plant                    B 3.1.4-6                                Revision 88
 
Rod Group Alignment Limits B 3.1.4 Once current conditions have been verified acceptable, time is available to perform evaluations of accident analysis to determine that core limits will not be exceeded during a Design Basis Accident for the duration of operation under these conditions. As a minimum, the following accident analyses shall be re-evaluated:
: a. Rod insertion characteristics;
: b. Rod misalignment;
: c. Small break loss of coolant accidents (LOCAs);
: d. Rod withdrawal at full power;
: e. Large break LOCAs;
: f. Main steamline break; and
: g. Rod ejection.
A Completion Time of 5 days is sufficient time to obtain the required input data and to perform the analysis.
C.1 When Required Actions of Condition B cannot be completed within their Completion Time, the plant must be brought to a MODE or Condition in which the LCO requirements are not applicable. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours, which obviates concerns about the development of undesirable xenon or power distributions. The allowed Completion Time of 6 hours is reasonable, based on operating experience, for reaching MODE 3 from full power conditions in an orderly manner and without challenging plant systems.
D.1.1 and D.1.2 More than one control rod becoming misaligned from its group position is not expected, and has the potential to reduce SDM. Therefore, SDM must be evaluated. One hour allows the operator adequate time to determine SDM. Restoration of the required SDM, if necessary, requires increasing the RCS boron concentration to provide negative reactivity, as described in the Bases of LCO 3.1.1. The required Completion Time of 1 hour for initiating boration is reasonable, based on the time required for potential xenon redistribution, the low probability of an accident occurring, and the steps required to complete the action. This allows the operator sufficient time to align the required valves and start the boric acid pumps. Boration is assumed to continue until the required SDM is restored.
R.E. Ginna Nuclear Power Plant                    B 3.1.4-7                                Revision 88
 
Rod Group Alignment Limits B 3.1.4 D.2 If more than one rod is found to be misaligned or becomes misaligned because of bank movement, the plant conditions fall outside of the accident analysis assumptions. Since automatic bank sequencing would continue to cause misalignment, the plant must be brought to a MODE or Condition in which the LCO requirements are not applicable. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours.
The allowed Completion Time is reasonable, based on operating experience, for reaching MODE 3 from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE            SR 3.1.4.1 REQUIREMENTS Verification that the position of individual rods is within alignment limits at a Frequency in accordance with the Surveillance Frequency Control Program provides a history that allows the operator to detect a rod that is beginning to deviate from its expected position. The specified Frequency takes into account other rod position information that is continuously available to the operator in the control room, so that during actual rod motion, deviations can immediately be detected.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.1.4.2 Verifying each control rod is OPERABLE would require that each rod be tripped. However, in MODES 1 and 2, tripping each control rod would result in radial or axial power tilts, or oscillations. Exercising each individual control rod provides increased confidence that all rods continue to be OPERABLE without exceeding the alignment limit, even if they are not regularly tripped. Moving each control rod  8 steps and to the first MRPI transition will not cause radial or axial power tilts, or oscillations, to occur.
Observing a MRPI transition guarantees the rods moved. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
R.E. Ginna Nuclear Power Plant                  B 3.1.4-8                                    Revision 88
 
Rod Group Alignment Limits B 3.1.4 During or between required performances of SR 3.1.4.2 (determination of control rod OPERABILITY by movement), if a control rod(s) is discovered to be immovable, but remains trippable and aligned, the control rod(s) is considered to be OPERABLE. At any time, if a control rod(s) is immovable, a determination of the trippability (OPERABILITY) of the control rod(s) must be made, and appropriate action taken.
SR 3.1.4.3 Verification of rod drop times allows the operator to determine that the maximum rod drop time permitted is consistent with the assumed rod drop time used in the safety analysis. Measuring rod drop times prior to reactor criticality, after reactor vessel head removal, ensures that the reactor internals and rod drive mechanism will not interfere with rod motion or rod drop time, and that no degradation in these systems has occurred that would adversely affect control rod motion or drop time.
This testing is performed with all RCPs operating and the average moderator temperature  500&#xba;F to simulate a reactor trip under actual conditions.
This Surveillance is performed during a plant outage prior to criticality after each removal of the reactor head, due to the plant conditions needed to perform the SR and the potential for an unplanned plant transient if the Surveillance were performed with the reactor at power.
REFERENCES            1. Atomic Industrial Forum (AIF) GDC 6, 14, 27, and 28, Issued for comment July 10, 1967.
: 2. 10 CFR 50.46.
: 3. UFSAR, Chapter 15.
: 4. UFSAR, Section 15.4.6.
: 5. UFSAR, Section 15.1.5.
: 6. UFSAR, Section 15.4.2.
R.E. Ginna Nuclear Power Plant                    B 3.1.4-9                                Revision 88
 
Shutdown Bank Insertion Limit B 3.1.5 B 3.1    REACTIVITY CONTROL SYSTEMS B 3.1.5      Shutdown Bank Insertion Limit BASES BACKGROUND            The insertion limits of the shutdown and control rods define the deepest insertion into the core with respect to core power which is allowed and are initial assumptions in all safety analyses that assume rod insertion upon reactor trip. The insertion limits directly affect core power and fuel burnup distributions and assumptions of available ejected rod worth, SHUTDOWN MARGIN (SDM), and initial reactivity insertion rate.
The applicable criteria for these reactivity and power distribution design requirements are Atomic Industrial Forum (AIF) GDC 27, 28, 29, and 32 (Ref. 1), and 10 CFR 50.46 (Ref. 2). Limits on control rod insertion have been established, and all rod positions are monitored and controlled during power operation to ensure that the power distribution and reactivity limits defined by the design power peaking and SDM limits are preserved.
The rod cluster control assemblies (RCCAs) are divided among control banks and a shutdown bank. Each bank is further subdivided into two groups to provide for precise reactivity control. A group consists of two or more RCCAs that are electrically paralleled to step simultaneously. A bank of RCCAs consists of two groups that are moved in a staggered fashion, but always within one step of each other. There are four control banks and one shutdown bank at Ginna Station. See LCO 3.1.4, "Rod Group Alignment Limits," for control and shutdown rod OPERABILITY and alignment requirements, and LCO 3.1.7, "Rod Position Indication,"
for position indication requirements.
The shutdown bank insertion limit is defined in the COLR. The shutdown bank is required to be at or above the insertion limit.
R.E. Ginna Nuclear Power Plant                    B 3.1.5-1                                    Revision 88
 
Shutdown Bank Insertion Limit B 3.1.5 The design calculations are performed with the assumption that the shutdown bank is withdrawn first. The shutdown bank can be fully withdrawn without the core going critical. The fully withdrawn position is defined in the COLR. This provides available negative reactivity in the event of boration errors. The shutdown bank is controlled manually by the control room operator. The shutdown bank is either fully withdrawn or fully inserted. The shutdown bank must be completely withdrawn from the core, prior to withdrawing any control banks during an approach to criticality. The shutdown bank is then left in this position until the reactor is shut down. The shutdown bank affects core power and burnup distribution, and adds negative reactivity to shut down the reactor upon receipt of a reactor trip signal.
The power density at any point in the core must be limited, so that the fuel design criteria are maintained. Together, LCO 3.1.4, "Rod Group Alignment Limits," LCO 3.1.5, "Shutdown Bank Insertion Limit," LCO 3.1.6, "Control Bank Insertion Limits," LCO 3.2.3, "AXIAL FLUX DIFFERENCE (AFD)," and LCO 3.2.4, "QUADRANT POWER TILT RATIO (QPTR)," provide limits on control component operation and on monitored process variables, which ensure that the core operates within the fuel design criteria.
The shutdown and control bank insertion and alignment limits, AFD, and QPTR are process variables that together characterize and control the three dimensional power distribution of the reactor core. Additionally, the shutdown and control bank insertion limits restrict the reactivity that could be added in the event of a rod ejection accident, and ensure the required SDM is maintained.
Operation within the subject LCO limits will prevent fuel cladding failures that would breach the primary fission product barrier and release fission products to the reactor coolant in the event of a loss of coolant accident (LOCA), loss of flow, ejected rod, or other accident requiring termination by a Reactor Trip System (RTS) trip function.
APPLICABLE              On a reactor trip, all RCCAs (shutdown bank and control banks), except SAFETY                  the most reactive RCCA, are assumed to insert into the core. The ANALYSES                shutdown bank shall be at or above the insertion limit and available to insert the maximum amount of negative reactivity on a reactor trip signal.
The control banks may be partially inserted in the core, as allowed by LCO 3.1.6, "Control Bank Insertion Limits." The shutdown bank and control bank insertion limits are established to ensure that a sufficient amount of negative reactivity is available to shut down the reactor and maintain the required SDM (see LCO 3.1.1, "SHUTDOWN MARGIN (SDM)") following a reactor trip from full power. The combination of control banks and the shutdown bank (less the most reactive RCCA, which is assumed to be fully withdrawn) is sufficient to take the reactor R.E. Ginna Nuclear Power Plant                    B 3.1.5-2                                      Revision 78
 
Shutdown Bank Insertion Limit B 3.1.5 from full power conditions at rated temperature to zero power, and to maintain the required SDM at rated no load temperature (Ref. 3). The shutdown bank insertion limit also limits the reactivity worth of an ejected shutdown rod.
The acceptance criteria for addressing shutdown and control bank insertion limits and inoperability or misalignment is that:
: a. There be no violations of:
: 1. Specified acceptable fuel design limits, or
: 2. RCS pressure boundary integrity; and
: b. The core remains subcritical after accident transients.
As such, the shutdown bank insertion limit affects safety analysis involving core reactivity and SDM (Ref. 3).
The SDM requirement is ensured by limiting the control and shutdown bank insertion limits so that allowable inserted worth of the RCCAs is such that sufficient reactivity is available in the rods to shut down the reactor to hot zero power with a reactivity margin that assumes the maximum worth RCCA remains fully withdrawn upon trip (Refs. 4, 5, 6, and 7).
Operation at the insertion limits or AFD limits may approach the maximum allowable linear heat generation rate or peaking factor with the allowed QPTR present. Operation at the insertion limit may also indicate the maximum ejected RCCA worth could be equal to the limiting value in fuel cycles that have sufficiently high ejected RCCA worths.
The control and shutdown bank insertion limits, together with AFD, QPTR and the control and shutdown bank alignment limits, ensure that safety analyses assumptions for SDM, ejected rod worth, and power distribution peaking factors are preserved (Refs. 4, 5, 6, and 7).
The shutdown bank insertion limit preserves an initial condition assumed in the safety analyses and, as such, satisfies Criterion 2 of the NRC Policy Statement.
LCO                  The shutdown bank must be at or above the insertion limit, as specified in the COLR, any time the reactor is critical and prior to withdrawal of any control rod. This ensures that a sufficient amount of negative reactivity is available to shut down the reactor and maintain the required SDM following a reactor trip.
R.E. Ginna Nuclear Power Plant                  B 3.1.5-3                                Revision 88
 
Shutdown Bank Insertion Limit B 3.1.5 The LCO is modified by a Note indicating the LCO requirement is suspended during SR 3.1.4.2. This SR verifies the freedom of the rods to move, and requires the shutdown bank to move below the LCO limits, which would normally violate the LCO.
The shutdown bank insertion limit is defined in the COLR.
APPLICABILITY        The shutdown bank must be within the insertion limit, with the reactor in MODES 1 and 2. This ensures that a sufficient amount of negative reactivity is available to shut down the reactor and maintain the required SDM following a reactor trip. In MODE 3, 4, 5, or 6, the shutdown bank insertion limit does not apply because the reactor is shutdown and not producing fission power. In shutdown MODES the OPERABILITY of the shutdown rods has the potential to affect the required SDM, but this effect can be compensated for by an increase in the boron concentration of the RCS. Refer to LCO 3.1.1 for SDM requirements in MODES 3, 4, and 5.
LCO 3.9.1, "Boron Concentration," ensures adequate SDM in MODE 6.
ACTIONS              A.1, A.2.1, A.2.2, and A.3 If the shutdown bank is inserted less than or equal to 8 steps below the insertion limit, as specified in the COLR, 24 hours is allowed to restore the shutdown bank to within the limit. This is necessary because the available SDM may be reduced with a shutdown bank not within its insertion limit.
Also, verification of SDM or initiation of boration within 1 hour is required, since the SDM in MODES 1 and 2 is ensured by adhering to the control and shutdown bank insertion limits (see LCO 3.1.1). If the shutdown bank is not within its insertion limit, SDM will be verified by performing a reactivity balance calculation, considering the effects listed in the BASES for SR 3.1.1.1.
While the shutdown bank is outside the insertion limit, as specified in the COLR, all control banks must be within their insertion limits to ensure sufficient shutdown margin is available within 1 hour. The 24 hour Completion Time is sufficient to repair most rod control failures that would prevent movement of a shutdown bank.
B.1.1, B.1.2, and B.2 When the shutdown bank is not within the insertion limit for reasons other than Condition A, verification of SDM or initiation of boration to regain SDM within 1 hour is required, since the SDM in MODE 1 and MODE 2 is ensured by adhering to the control and shutdown bank insertion limits (see LCO 3.1.1, "SHUTDOWN MARGIN (SDM)"). If the shutdown bank is not within the insertion limit, then SDM will be verified by performing a R.E. Ginna Nuclear Power Plant                    B 3.1.5-4                                Revision 88
 
Shutdown Bank Insertion Limit B 3.1.5 reactivity balance calculation, taking into account RCS boron concentration, core power defect, control bank position, RCS average temperature, fuel burnup based on gross thermal energy generation, xenon concentration, samarium concentration, and isothermal temperature coefficient (ITC).
Operation beyond the LCO limits is allowed for a short time period in order to take conservative action because the simultaneous occurrence of either a LOCA, loss of flow accident, ejected rod accident, or other accident during this short time period, together with an inadequate power distribution or reactivity capability, has an acceptably low probability. Two hours is allowed to restore the shutdown bank to within the insertion limit.
This time limit is necessary because the available SDM may be significantly reduced, with the shutdown bank not within the insertion limit. The allowed Completion Time of 2 hours provides an acceptable time for evaluating and repairing minor problems without allowing the plant to remain in an unacceptable condition for an extended period of time.
C.1 If Required Actions cannot be completed within the associated Completion Times, the plant must be brought to a MODE where the LCO is not applicable. The allowed Completion Time of 6 hours is reasonable, based on operating experience, for reaching the required MODE from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE          SR 3.1.5.1 REQUIREMENTS Verification that the shutdown bank is within the insertion limit, as specified in the COLR, prior to an approach to criticality ensures that when the reactor is critical, or being taken critical, the shutdown bank will be available to shut down the reactor, and the required SDM will be maintained following a reactor trip. This SR and Frequency ensure that the shutdown bank is withdrawn before the control banks are withdrawn during plant startup.
Since the shutdown bank is positioned manually by the control room operator, a verification of shutdown bank position at a Frequency in accordance with the Surveillance Frequency Control Program is adequate to ensure that the bank is within the insertion limit. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
R.E. Ginna Nuclear Power Plant                    B 3.1.5-5                                  Revision 88
 
Shutdown Bank Insertion Limit B 3.
 
==1.5 REFERENCES==
: 1. Atomic Industrial Forum (AIF) GDC 27, 28, 29, and 32, Issued for comment July 10, 1967.
: 2. 10 CFR 50.46.
: 3. UFSAR, Chapter 15.
: 4. UFSAR, Section 15.1.5.
: 5. UFSAR, Section 15.4.1.
: 6. UFSAR, Section 15.4.2.
: 7. UFSAR, Section 15.4.6.
R.E. Ginna Nuclear Power Plant                B 3.1.5-6                              Revision 88
 
Control Bank Insertion Limits B 3.1.6 B 3.1    REACTIVITY CONTROL SYSTEMS B 3.1.6      Control Bank Insertion Limits BASES BACKGROUND            The insertion limits of the shutdown and control rods define the deepest insertion into the core with respect to core power which is allowed and are initial assumptions in all safety analyses that assume rod insertion upon reactor trip. The insertion limits directly affect core power and fuel burnup distributions and assumptions of available ejected rod worth, SHUTDOWN MARGIN (SDM), and initial reactivity insertion rate.
The applicable criteria for these reactivity and power distribution design requirements are Atomic Industrial Forum (AIF) GDC 27, 28, 29, and 32 (Ref. 1), and 10 CFR 50.46 (Ref. 2). Limits on control rod insertion have been established, and all rod positions are monitored and controlled during power operation to ensure that the power distribution and reactivity limits defined by the design power peaking and SDM limits are preserved.
The rod cluster control assemblies (RCCAs) are divided among control banks and a shutdown bank. Each bank is further subdivided into two groups to provide for precise reactivity control. A group consists of two or more RCCAs that are electrically paralleled to step simultaneously. A bank of RCCAs consists of two groups that are moved in a staggered fashion, but always within one step of each other. There are four control banks and one shutdown bank at Ginna Station. See LCO 3.1.4, "Rod Group Alignment Limits," for control and shutdown rod OPERABILITY and alignment requirements, and LCO 3.1.7, "Rod Position Indication,"
for position indication requirements.
The control bank insertion limits are specified in the COLR. The control banks are required to be at or above the insertion limit lines.
The insertion limits figure in the COLR also indicates how the control banks are moved in an overlap pattern. Overlap is the distance travelled together by two control banks.
R.E. Ginna Nuclear Power Plant                B 3.1.6-1                                  Revision 60
 
Control Bank Insertion Limits B 3.1.6 The control banks are used for precise reactivity control of the reactor.
Control bank withdrawal is performed manually with normal control bank insertion automatically controlled by the Rod Control System. They are capable of adding negative reactivity very quickly (compared to borating or diluting). The control banks must be maintained above designed insertion limits and are typically near the fully withdrawn position during normal full power operations. The fully withdrawn position is defined in the COLR. Boration or dilution of the Reactor Coolant System (RCS) compensates for the reactivity changes associated with large changes in RCS temperature.
The rod insertion limit monitor is used to verify control rod insertion on a continuous basis and will provide an alarm whenever the control bank insertion deviates from the rod insertion limits specified in the COLR.
Verification that the control banks are within the insertion limit is made every 12 hours (SR 3.1.6.2). When the rod insertion limit monitor is inoperable a verification that the rod positions are within the limit must be made more frequently (SR 3.1.6.3).
The control banks are moved in an overlap pattern, using the following withdrawal sequence: When control bank A reaches a predetermined height in the core, control bank B begins to move out with control bank A.
Control bank A stops at the fully withdrawn position, and control bank B continues to move out. When control bank B reaches a predetermined height, control bank C begins to move out with control bank B. This sequence continues until control banks A, B, and C are at the fully withdrawn position, and control bank D is near the fully withdrawn position at RTP. The insertion sequence is the opposite of the withdrawal sequence (i.e., bank D is inserted first) but follows the same overlap pattern. The control rods are arranged in a radially symmetric pattern, so that control bank motion does not introduce radial asymmetries in the core power distributions.
The power density at any point in the core must be limited, so that the fuel design criteria are maintained. Together, LCO 3.1.4, "Rod Group Alignment Limits," LCO 3.1.5, "Shutdown Bank Insertion Limit," LCO 3.1.6, "Control Bank Insertion Limits," LCO 3.2.3, "AXIAL FLUX DIFFERENCE (AFD)," and LCO 3.2.4, "QUADRANT POWER TILT RATIO (QPTR)," provide limits on control component operation and on monitored process variables, which ensure that the core operates within the fuel design criteria.
The shutdown and control bank insertion and alignment limits, AFD, and QPTR are process variables that together characterize and control the three dimensional power distribution of the reactor core. Additionally, the shutdown and control bank insertion limits restrict the reactivity that could be added in the event of a rod ejection accident, and ensure the required SDM is maintained.
R.E. Ginna Nuclear Power Plan                    B 3.1.6-2                                    Revision 60
 
Control Bank Insertion Limits B 3.1.6 Operation within the AFD, QPTR, shutdown and control bank insertion and alignment LCO limits will prevent fuel cladding failures that would breach the primary fission product barrier and release fission products to the reactor coolant in the event of a loss of coolant accident (LOCA), loss of flow, ejected rod, or other accident requiring termination by a Reactor Trip System (RTS) trip function.
APPLICABLE            On a reactor trip, all RCCAs (shutdown bank and control banks), except SAFETY                the most reactive RCCA, are assumed to insert into the core. The ANALYSES              shutdown bank shall be at or above the insertion limit and available to insert the maximum amount of negative reactivity on a reactor trip signal.
The control banks may be partially inserted in the core, as allowed by LCO 3.1.6, "Control Bank Insertion Limits." The shutdown bank and control bank insertion limits are established to ensure that a sufficient amount of negative reactivity is available to shut down the reactor and maintain the required SDM (see LCO 3.1.1, "SHUTDOWN MARGIN (SDM)") following a reactor trip from full power. The combination of control banks and the shutdown bank (less the most reactive RCCA, which is assumed to be fully withdrawn) is sufficient to take the reactor from full power conditions at rated temperature to zero power, and to maintain the required SDM at rated no load temperature (Ref. 3). The control bank insertion limits also limit the reactivity worth of an ejected control bank rod.
The acceptance criteria for addressing shutdown and control bank insertion limits and inoperability or misalignment are that:
: a. There be no violations of:
: 1. Specified acceptable fuel design limits, or
: 2. Reactor Coolant System pressure boundary integrity; and
: b. The core remains subcritical after accident transients.
As such, the control bank insertion limits affect safety analysis involving core reactivity and power distributions (Refs. 4, 5, 6, and 7).
The SDM requirement is ensured by limiting the control and shutdown bank insertion limits so that allowable inserted worth of the RCCAs is such that sufficient reactivity is available in the rods to shut down the reactor to hot zero power with a reactivity margin that assumes the maximum worth RCCA remains fully withdrawn upon trip (Refs. 4, 5, 6, and 7).
R.E. Ginna Nuclear Power Plan                  B 3.1.6-3                                  Revision 60
 
Control Bank Insertion Limits B 3.1.6 Operation at the insertion limits or AFD limits may approach the maximum allowable linear heat generation rate or peaking factor with the allowed QPTR present. Operation at the insertion limit may also indicate the maximum ejected RCCA worth could be equal to the limiting value in fuel cycles that have sufficiently high ejected RCCA worths.
The control and shutdown bank insertion limits, together with AFD, QPTR and the control and shutdown bank alignment limits, ensure that safety analyses assumptions for SDM, ejected rod worth, and power distribution peaking factors are preserved (Refs. 4, 5, 6, and 7).
The control bank insertion, sequence and overlap limits satisfy Criterion 2 of the NRC Policy Statement, in that they are initial conditions assumed in the safety analysis.
LCO                  The limits on control bank insertion, sequence, overlap, and as specified in the COLR, must be maintained because they serve the function of preserving power distribution, ensuring that the SDM is maintained, ensuring that ejected rod worth is limited, and ensuring adequate negative reactivity insertion is available on trip. The overlap between control banks provides more uniform rates of reactivity insertion and withdrawal and is imposed to maintain acceptable power peaking during control bank motion.
The LCO is modified by a Note indicating the LCO requirement is not applicable to control banks being inserted while performing SR 3.1.4.2.
This SR verifies the freedom of the rods to move, and may require the control bank to move below the LCO limits, which would normally violate the LCO. This Note applies to each control bank as it is moved below the insertion limit to perform the SR. This Note applies to each control bank as it is moved below the insertion limit to perform the SR. This Note is not applicable should a malfunction stop performance of the SR.
APPLICABILITY          The control bank insertion, sequence, and overlap limits shall be maintained with the reactor in MODE 1 and MODE 2 with keff 1.0.
These limits must be maintained, since they preserve the assumed power distribution, ejected rod worth, SDM, and reactivity rate insertion assumptions. Applicability in MODE 2 with keff < 1.0 and MODES 3, 4, 5, and 6 is not required, since neither the power distribution nor ejected rod worth assumptions would be exceeded in these MODES.
R.E. Ginna Nuclear Power Plant                  B 3.1.6-4                                Revision 88
 
Control Bank Insertion Limits B 3.1.6 ACTIONS                    A.1, A.2.1, A.2.2, and A.3 If Control Bank A, B, or C is inserted less than or equal to 8 steps below the insertion, sequence, or overlap limits, 24 hours in allowed to restore the control bank to within the limits. Verification of SDM or initiation of boration within 1 hour is required, since the SDM in MODES 1 and 2 is ensured by adhering to the control and shutdown bank insertion limits. If a Control bank is not within its insertion limit, SDM will be verified by performing a reactivity balance calculation, considering the effects listed in the BASES for SR 3.1.1.1.
While the control bank is outside the insertion, sequence, or overlap limits, the shutdown bank must be within its insertion limit within 1 hour to ensure sufficient shutdown margin is available and that the power distribution is controlled. The 24 hour Completion Time is sufficient to repair most rod control failures that would prevent movement of a control bank.
Condition A is limited to Control banks A, B, or C. The allowance is not required for Control Bank D because the full power bank insertion limit can be met during performance of the SR 3.1.4.2 control rod freedom of movement (trippability) testing.
B.1.1, B.1.2, B.2, C.1.1, C.1.2, and C.2 When the control banks are outside the acceptable insertion limits, out of sequence, or in the wrong overlap configuration for reasons other than Condition A, they must be restored to within those limits. This restoration can occur in two ways:
: a.      Reducing power to be consistent with rod position; or
: b.      Moving rods to be consistent with power.
Also, verification of SDM or initiation of boration to regain SDM within 1 hour is required, since the SDM in MODES 1 and 2 with Keff  1.0 is normally ensured by adhering to the control and shutdown bank insertion limits. If control banks are not within their limits, then SDM will be verified by performing a reactivity balance calculation, taking into account RCS boron concentration, core power defect, control bank position, RCS average temperature, fuel burnup based on gross thermal energy generation, xenon concentration, samarium concentration, and isothermal temperature coefficient (ITC).
R.E. Ginna Nuclear Power Plant                  B 3.1.6-5                                    Revision 88
 
Control Bank Insertion Limits B 3.1.6 Operation beyond the LCO limits is allowed for a short time period in order to take conservative action because the occurrence of either a LOCA, loss of flow accident, ejected rod accident, or other accident during this short time period, together with an inadequate power distribution or reactivity capability, has an acceptably low probability.
Thus, the allowed Completion Time of 2 hours for restoring the banks to within the insertion, sequence, and overlap limits provides an acceptable time for evaluating and repairing minor problems.
D.1 If Required Actions cannot be completed within the associated Completion Times, the plant must be brought to MODE 2 with Keff < 1.0, where the LCO is not applicable. The allowed Completion Time of 6 hours is reasonable, based on operating experience, for reaching the required MODE from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE              SR 3.1.6.1 REQUIREMENTS This Surveillance is required to ensure that the reactor does not achieve criticality with the control banks below their insertion limits. The Frequency of within 4 hours prior to achieving criticality ensures that the estimated control bank position is within the limits specified in the COLR shortly before criticality is reached.
SR 3.1.6.2 Verification of the control bank insertion limits at a Frequency in accordance with the Surveillance Frequency Control Program is sufficient to detect control banks that may be approaching the insertion limits.
SR 3.1.6.3 When control banks are maintained within their insertion limits as required by SR 3.1.6.2 above, it is unlikely that their sequence and overlap will not be in accordance with requirements approaching provided in the COLR. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
R.E. Ginna Nuclear Power Plant                  B 3.1.6-6                                    Revision 88
 
Control Bank Insertion Limits B 3.
 
==1.6 REFERENCES==
: 1. Atomic Industrial Forum (AIF) GDC 27, 28, 29, and 32, Issued for comment July 10, 1967.
: 2. 10 CFR 50.46.
: 3. UFSAR, Chapter 15.
: 4. UFSAR, Section 15.1.5.
: 5. UFSAR, Section 15.4.1.
: 6. UFSAR, Section 15.4.2.
: 7. UFSAR, Section 15.4.6.
R.E. Ginna Nuclear Power Plant                B 3.1.6-7                              Revision 88
 
Rod Position Indication B 3.1.7 B 3.1    REACTIVITY CONTROL SYSTEMS B 3.1.7    Rod Position Indication BASES BACKGROUND            The OPERABILITY (i.e., trippability), including position indication, of the shutdown and control rods is an initial assumption in all safety analyses that assume rod insertion upon reactor trip. Maximum rod misalignment is an initial assumption in the safety analysis that directly affects core power distributions and assumptions of available SHUTDOWN MARGIN (SDM). Rod position indication is required to assess OPERABILITY and misalignment.
According to the Atomic Industrial Forum (AIF) GDC 12 and 13 (Ref. 1),
instrumentation to monitor variables and systems over their operating ranges during normal operation, anticipated operational occurrences, and accident conditions must be OPERABLE. LCO 3.1.7 is required to ensure OPERABILITY of the control rod position indicators to determine control rod positions and thereby ensure compliance with the control rod alignment and insertion limits.
Mechanical or electrical failures may cause a control rod to become inoperable or to become misaligned from its group. Control rod inoperability or misalignment may cause increased power peaking, due to the asymmetric reactivity distribution and a reduction in the total available rod worth for reactor shutdown. Therefore, control rod alignment and OPERABILITY are related to core operation in design power peaking limits and the core design requirement of a minimum SDM. Limits on control rod alignment and OPERABILITY have been established, and all rod positions are monitored and controlled during power operation to ensure that the power distribution and reactivity limits defined by the design power peaking and SDM limits are preserved.
Rod cluster control assemblies (RCCAs), or rods, are movable neutron absorbing devices which are moved out of the core (up or withdrawn) or into the core (down or inserted) by their control rod drive mechanisms (CRDMs). Each CRDM moves its RCCA one step (approximately 5/8 inch) at a time, but at varying rates (steps per minute) depending on the signal output from the Rod Control System.
The RCCAs are divided among control banks and a shutdown bank.
Control banks are used to compensate for changes in reactivity due to variations in operating conditions of the reactor such as coolant temperature, power level, boron or xenon concentration. The shutdown bank provides additional shutdown reactivity such that the total shutdown worth of the bank is adequate to provide shutdown for all operating and hot zero power conditions with the single RCCA of highest reactivity R.E. Ginna Nuclear Power Plan                B 3.1.7-1                                    Revision 70
 
Rod Position Indication B 3.1.7 worth fully withdrawn. Each bank is further subdivided into groups to provide for precise reactivity control. A group consists of two or more RCCAs that are electrically paralleled to step simultaneously. A bank of RCCAs consists of two groups that are moved in a staggered fashion but always within one step of each other. There are four control banks and one shutdown bank at Ginna Station.
The axial position of shutdown rods and control rods is indicated by two separate and independent systems: the Bank Demand Position Indication System (commonly called group step counters) and the Microprocessor Rod Position Indication (MRPI) System.
The Bank Demand Position Indication System counts the pulses from the Rod Control System that move the rods. There is one step counter for each group of rods. Individual rods in a group all receive the same signal to move and should, therefore, all be at the same position indicated by the group step counter for that group. The Bank Demand Position Indication System is considered highly precise (+/-1 step or +/-5/8 inch),
but if a rod does not move one step for each demand pulse, the step counter will still count the pulse and incorrectly reflect the position of the rod.
The MRPI System also provides a highly accurate indication of actual control rod position, but at a lower precision than the step counters. The MRPI system consists of one digital detector assembly per rod. All the detector assemblies consist of one coil stack which is multiplexed and becomes input to two redundant MRPI signal processors. Each signal processor independently monitors all rods and senses a rod bottom for any rod. The MRPI system directly senses rod position in intervals of 12 steps for each rod. The digital detector assemblies consist of 20 discrete coil pairs spaced at 12-step intervals. The true rod position is always within +/-8 steps of the indicated position (+/-6 steps due to the 12-step interval and +/-2 steps transition uncertainty due to processing and coil sensitivity). With an indicated deviation of 12 steps between the group step counter and MRPI, the maximum deviation between actual rod position and the demand position would be 20 steps, or 12.5 inches.
APPLICABLE            Control and shutdown rod position accuracy is essential during power SAFETY                operation. Power peaking, ejected rod worth, or SDM limits may ANALYSES              be violated in the event of a Design Basis Accident (Ref. 2), with control or shutdown rods operating outside their limits undetected. Therefore, the acceptance criteria for rod position indication is that rod positions must be known with sufficient accuracy in order to verify the core is operating within the group sequence, overlap, design peaking limits, ejected rod worth limits, and with minimum SDM (LCO 3.1.5, "Shutdown Bank Insertion Limit," and LCO 3.1.6, "Control Bank Insertion Limits"). The rod positions must also be known in order to verify the alignment limits are R.E. Ginna Nuclear Power Plan                B 3.1.7-2                                    Revision 70
 
Rod Position Indication B 3.1.7 preserved (LCO 3.1.4, "Rod Group Alignment Limits"). Control rod positions are continuously monitored to provide operators with information that ensures the plant is operating within the bounds of the accident analysis assumptions.
The control rod position indicator channels satisfy Criterion 2 of the NRC Policy Statement. The control rod position indicators monitor control rod position, which is an initial condition of the accident.
LCO                      LCO 3.1.7 specifies that the MRPI System and the Bank Demand Position Indication System be OPERABLE. For the control rod position indicators to be OPERABLE requires the following:
: a. For the MRPI System there are no failed coils and rod position indication is available on the MRPI screen (in either the control room or relay room) or the plant process computer system. In addition, individual rod position indication for a single rod can be determined using an engineered hand held device when connected to the MRPI Display Cabinet in the relay room; and
: b. The Bank Demand Indication System has been calibrated either in the fully inserted position or to the MRPI System.
The 12 step agreement limit between the Bank Demand Position Indication System and the MRPI System as required by SR 3.1.7.1 indicates that the Bank Demand Position Indication System is adequately calibrated, and can be used for indication of control rod bank position. A deviation of less than the allowable 12 step agreement limit, in position indication for a single control rod, ensures high confidence that the position uncertainty of the corresponding control rod group is within the assumed values used in the analysis.
The MRPI system is designed with error detection such that when a fault occurs in the binary data received from the coil stacks or processing unit an alarm is annunciated at the MRPI display. When the fault clears, the system provides self validation of data integrity and returns to its normal display mode. Because of the digital nature of the system and its inherent diagnostic features, intermittent data alarms can mask position indication and generate the perception that a single rod position is unmonitored. For a single rod position indication failure, MRPI is considered OPERABLE if a fault occurs and clears within five minutes and the indicated position is within expected values.
These requirements ensure that control rod position indication during power operation and PHYSICS TESTS is accurate, and that design assumptions are not challenged. OPERABILITY of the position indicator R.E. Ginna Nuclear Power Plan                    B 3.1.7-3                                  Revision 70
 
Rod Position Indication B 3.1.7 channels ensures that inoperable, misaligned, or mispositioned control rods can be detected. Therefore, power peaking, ejected rod worth, and SDM can be controlled within acceptable limits.
APPLICABILITY        The requirements on the MRPI and step counters are only applicable in MODES 1 and 2 (consistent with LCO 3.1.4 and LCO 3.1.5, and LCO 3.1.6), because these are the only MODES in which the reactor is critical, and the OPERABILITY and alignment of rods have the potential to affect the safety of the plant. In the shutdown MODES, the OPERABILITY of the shutdown and control banks has the potential to affect the required SDM, but this effect can be compensated for by an increase in the boron concentration of the Reactor Coolant System. See LCO 3.1.1, "SHUTDOWN MARGIN (SDM)," for SDM requirements in MODES 3, 4, and 5 and LCO 3.9.1, "Boron Concentration," for boron concentration requirements during MODE 6.
ACTIONS              The ACTIONS table is modified by a Note indicating that a separate Condition entry is allowed for each inoperable MRPI and each demand position indicator. This is acceptable because the Required Actions for each Condition provide appropriate compensatory actions for each inoperable position indicator.
A.1 and A.2 When one MRPI per group in one or more groups fails, the position of the rod can still be determined by use of the movable incore detectors.
Based on experience, normal power operation does not require excessive movement of banks. If a bank has been significantly moved, the Required Action of C.1 or C.2 below is required. Therefore, verification of RCCA position within the Completion Time of 8 hours is adequate for allowing continued full power operation, since the probability of simultaneously having a rod significantly out of position and an event sensitive to that rod position is small.
Required Action A.1 requires verification of the position of a rod with an inoperable MRPI once per 8 hours which may put excessive wear and tear on the moveable incore detector system, Required Action A.2 provides an alternative. Required Action A.2 requires verification of rod position using the moveable incore detectors every 31 EFPD, which coincides with the normal use of the system to verify core power distribution.
Required Action A.2 includes six distinct requirements for verification of the position of rods associated with an inoperable MRPI using the movable incore detectors:
: a. Initial verification within 8 hours of the inoperability of the MRPI; R.E. Ginna Nuclear Power Plant                    B 3.1.7-4                                Revision 88
 
Rod Position Indication B 3.1.7
: b. Re-verification once every 31 Effective Full Power Days (EFPD) thereafter;
: c. Verification within 8 hours if rod control system parameters indicate unintended rod movement. An unintended rod movement is defined as the release of the rods stationary gripper when no action was demanded either manually or automatically from the rod control system, or a rod motion in a direction other than the direction demanded by the rod control system. Verifying that no unintended rod movement has occurred is performed by monitoring the rod control system stationary gripper coil current for indications of rod movement;
: d. Verification within 8 hours if the rod with an inoperable MRPI is intentionally moved greater than 12 steps;
: e. Verification prior to exceeding 50% RTP if power is reduced below 50% RTP; and
: f. Verification within 8 hours of reaching 100% RTP if power is reduced to less than 100% RTP.
Should the rod with the inoperable MRPI be moved more than 12 steps, or if reactor power is changed, the position of the rod with the inoperable MRPI must be verified.
A.3 Reduction of THERMAL POWER to  50% RTP puts the core into a condition where rod position is not significantly affecting core peaking factors.
The allowed Completion Time of 8 hours is reasonable, based on operating experience, for reducing power to  50% RTP from full power conditions without challenging plant systems and allowing for rod position determination by Required Action A.1 above.
B.1 and B.2 When more than one MRPI per group in one or more groups fail, additional actions are necessary. Placing the Rod Control System in manual assures unplanned rod motion will not occur. The immediate Completion Time for placing the Rod Control System in manual reflects the urgency with which unplanned rod motion must be prevented while in the Condition.
The inoperable MRPIs must be restored, such that a maximum of one MRPI per group is inoperable, within 24 hours. The 24 hour Completion Time provides sufficient time to troubleshoot and restore the MRPI system to operation while avoiding the plant challenges associated with the shutdown without full rod position indication.
R.E. Ginna Nuclear Power Plant                    B 3.1.7-5                              Revision 88
 
Rod Position Indication B 3.1.7 Based on operating experience, normal power operation does not require excessive rod movement. If one or more rods has been significantly moved, the Required Action of C.1 or C.2 below is required.
C.1 and C.2 With one MRPI inoperable in one or more groups and the affected groups have moved greater than 24 steps in one direction since the last determination of rod position, additional actions are needed to verify the position of rods within inoperable MRPI. Within 4 hours, the position of the rods with inoperable position indication must be determined using the moveable incore detectors to verify these rods are still properly positioned, relative to their group positions. The allowed Completion Time of 4 hours provides an acceptable period of time to verify the rod positions.
If, within 4 hours, the rod positions have not been determined, THERMAL POWER must be reduced to  50% RTP within 8 hours to avoid undesirable power distributions that could result from continued operation at > 50% RTP, if one or more rods are misaligned by more than 24 steps.
D.1.1 and D.1.2 With one or more demand position indicators per bank inoperable in one or more banks, the rod positions can be determined by the MRPI System. Since normal power operation does not require excessive movement of rods, verification by administrative means that the rod position indicators are OPERABLE and the most withdrawn rod and the least withdrawn rod are  12 steps apart within the allowed Completion Time of once every 8 hours is adequate.
D.2 Reduction of THERMAL POWER to  50% RTP puts the core into a condition where rod position will not cause core peaking to approach the core peaking factor limits.
The allowed Completion Time of 8 hours is reasonable, based on operating experience, for reducing power to  50% RTP from full power conditions without challenging plant systems.
E.1 If the Required Actions cannot be completed within the associated Completion Time, the plant must be brought to a MODE in which the requirement does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours. The allowed Completion R.E. Ginna Nuclear Power Plant                    B 3.1.7-6                            Revision 88
 
Rod Position Indication B 3.1.7 Time is reasonable, based on operating experience, for reaching the required MODE from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE          SR 3.1.7.1 REQUIREMENTS Verification that the MRPI agrees with the group demand position within 12 steps for the full indicated range of rod travel ensures that the MRPI is operating correctly. Since the MRPI does not display the actual shutdown rod positions between 0 and 230 steps, only points within the indicated ranges are required in comparison.
This Surveillance is performed during a plant outage or during plant startup, prior to reactor criticality after each removal of the reactor head due to the plant conditions needed to perform the SR and the potential for an unplanned plant transient if the Surveillance were performed with the reactor at power.
The Surveillance is modified by a Note which states it is not required to be met for MRPIs associated with rods that do not meet LCO 3.1.4. If a rod is known to not be within 12 steps of the group demand position, the ACTIONS of LCO 3.1.4 provide the appropriate Actions.
REFERENCES            1. Atomic Industrial Forum (AIF) GDC 12 and 13, Issued for comment July 10, 1967.
: 2. UFSAR, Chapter 15.
R.E. Ginna Nuclear Power Plant                  B 3.1.7-7                                Revision 88
 
PHYSICS TESTS Exceptions - MODE 2 B 3.1.8 B 3.1      REACTIVITY CONTROL SYSTEMS B 3.1.8      PHYSICS TESTS Exceptions - MODE 2 BASES BACKGROUND            The primary purpose of the MODE 2 PHYSICS TESTS exceptions is to permit relaxations of existing LCOs to allow certain PHYSICS TESTS to be performed.
Section XI of 10 CFR 50, Appendix B (Ref. 1), requires that a test program be established to ensure that structures, systems, and components will perform satisfactorily in service. All functions necessary to ensure that the specified design conditions are not exceeded during normal operation and anticipated operational occurrences must be tested. This testing is an integral part of the design, construction, and operation of the plant. Requirements for notification of the NRC, for the purpose of conducting tests and experiments, are specified in 10 CFR 50.59 (Ref. 2).
The key objectives of a test program are to:
: a. Ensure that the facility has been adequately designed;
: b. Validate the analytical models used in the design and analysis;
: c. Verify the assumptions used to predict plant response;
: d. Ensure that installation of equipment in the facility has been accomplished in accordance with the design; and
: e. Verify that the operating and emergency procedures are adequate.
To accomplish these objectives, testing is performed prior to initial criticality; during startup, low power, power ascension, and at power operation; and after each refueling. The PHYSICS TESTS requirements for reload fuel cycles ensure that the operating characteristics of the core are consistent with the design predictions and that the core can be operated as designed. PHYSICS TESTS procedures are written and approved in accordance with established formats. The procedures include all information necessary to permit a detailed execution of the testing required to ensure that the design intent is met. PHYSICS TESTS are performed in accordance with these procedures, and test results are approved prior to continued power escalation and long term power operation.
R.E. Ginna Nuclear Power Plant                B 3.1.8-1                                  Revision 34
 
PHYSICS TESTS Exceptions - MODE 2 B 3.1.8 The PHYSICS TESTS performed at Ginna Station for reload fuel cycles in MODE 2 include:
: a. Critical Boron Concentration - Control Rods Withdrawn;
: b. Critical Boron Concentration - Control Rods Inserted;
: c. Control Rod Worth; and
: d. Isothermal Temperature Coefficient (ITC).
These and other supplementary tests may be required to calibrate the nuclear instrumentation or to diagnose operational problems. These tests may cause the operating controls and process variables to deviate from their LCO requirements during their performance as described below.
: a. The Critical Boron Concentration - Control Rods Withdrawn Test measures the critical boron concentration at hot zero power (HZP).
With all rods out, bank D is at or near its fully withdrawn position.
HZP is where the core is critical (keff = 1.0), and the Reactor Coolant System (RCS) is at design temperature and pressure for zero power. Performance of this test could violate LCO 3.1.3, "Moderator Temperature Coefficient (MTC)."
: b. The Critical Boron Concentration - Control Rods Inserted Test measures the critical boron concentration at HZP, with a bank having a worth of at least 1% 'k/k fully inserted into the core. This test is used to measure the differential boron worth. With the core at HZP and all banks fully withdrawn, the boron concentration of the reactor coolant is gradually lowered in a continuous manner. The selected bank is then inserted to make up for the decreasing boron concentration until the selected bank has been moved over its entire range of travel. The reactivity resulting from each incremental bank movement is measured with a reactivity computer. The difference between the measured critical boron concentration with all rods fully withdrawn and with the bank inserted is determined. The differential boron worth is determined by dividing the measured bank worth by the measured boron concentration difference. Performance of this test could violate LCO 3.1.4, "Rod Group Alignment Limits;" LCO 3.1.5, "Shutdown Bank Insertion Limit;" or LCO 3.1.6, "Control Bank Insertion Limits."
: c. The Control Rod Worth Test is used to measure the reactivity worth of selected control banks. This test is performed at HZP and has two alternative methods of performance. The first method, the Boron Exchange Method, varies the reactor coolant boron concentration and moves the selected control bank in response to the changing boron concentration. The reactivity changes are R.E. Ginna Nuclear Power Plant              B 3.1.8-2                                    Revision 34
 
PHYSICS TESTS Exceptions - MODE 2 B 3.1.8 measured with a reactivity computer. This sequence is repeated for the remaining control banks. The second method, the Boron Endpoint Method, moves the selected control bank over its entire length of travel and then varies the reactor coolant boron concentration to achieve HZP criticality again. The difference in boron concentration is the worth of the selected control bank.
This sequence is repeated for the remaining control banks.
Performance of this test could violate LCO 3.1.4, LCO 3.1.5, or LCO 3.1.6.
: d. The ITC Test measures the ITC of the reactor. This test is performed at HZP using the Slope Method. The Slope Method varies RCS temperature in a slow and continuous manner. The reactivity change is measured with a reactivity computer as a function of the temperature change. The ITC is the slope of the reactivity versus the temperature plot. The test is repeated by reversing the direction of the temperature change, and the final ITC is the average of the two calculated ITCs. The Moderator Temperature Coefficient (MTC) at BOL, 70% RTP and at EOL is determined from the measured ITC. This test satisfies the requirements of SR 3.1.3.1 and SR 3.1.3.2. Performance of this test could violate LCO 3.4.2, "RCS Minimum Temperature for Criticality."
An alternative method of performing PHYSICS TESTS in MODE 2 that may be used at Ginna Station is the Dynamic Rod Worth Measurement (DRWM) technique. The specific tests that are performed include:
: a. Critical Boron Concentration -Control Rods Withdrawn;
: b. Control Rod Worth; and
: c. Isothermal Temperature Coefficient (ITC)
The use of DRWM for control rod worth measurements may cause operating controls to deviate from LCO requirements during testing as described below:
: a. The Critical Boron Concentration Control Rods Withdrawn Test is not significantly different from the previous description and the potential to cause the operating controls and process variables to deviate from LCO requirements are the same.
: b. The Control Rod Worth Test is used to measure the reactivity worth of all control banks and the shutdown bank. The selected test bank is inserted fully from the withdrawn position in a continuous motion, and then withdrawn fully out of the core. While the flux is recovering, the reactivity computer adjusts the flux signals recorded during insertion for static spatial effects. Reactivity is then computed from the adjusted flux signals using inverse point kinetics R.E. Ginna Nuclear Power Plant                    B 3.1.8-3                                  Revision 34
 
PHYSICS TESTS Exceptions - MODE 2 B 3.1.8 equations. The calculated reactivity is then adjusted for dynamic spatial effects. The remaining banks are tested in the same manner in sequence. Performance of this test could violate LCO 3.1.4, LCO 3.1.5, or LCO 3.1.6.
: c. The Isothermal Temperature Coefficient (ITC) Test is not significantly different from the previous description and the potential to cause the operating controls and process variables to deviate from LCO requirements are the same.
The DRWM technique does not require measurement of the critical boron concentration with control rods inserted. The differential boron worth determined using this measurement is typically used for design and measurement process validation. The fuel vendor does not utilize the measured differential boron worth for design validation, and uses alternate methods for measurement process validation. Therefore, measurement of the critical boron concentration with control rods inserted is unnecessary and not performed with DRWM. This position was accepted by the NRC as documented in the SER on the DRWM topical report, WCAP-13360-P-A, Rev. 1.
APPLICABLE                  The fuel is protected by multiple LCOs that preserve the initial SAFETY                      conditions of the core assumed during the safety analyses. The ANALYSES                    methods for development of these LCOs, that are excepted by this LCO, are described in the Westinghouse Reload Safety Evaluation Methodology Report (Ref. 3). The above mentioned PHYSICS TESTS, and other tests that may be required to calibrate nuclear instrumentation or to diagnose operational problems, may require the operating control or process variables to deviate from their LCO limitations.
The UFSAR defines requirements for initial testing of the facility, including PHYSICS TESTS. Reference 4 summarizes the initial zero, low power, and power tests. Reload fuel cycle PHYSICS TESTS are performed in accordance with Technical Specification requirements, fuel vendor guidelines and established industry practices which are consistent with the PHYSICS TESTS described in References 5 and 6.
Although these PHYSICS TESTS are generally accomplished within the limits of all LCOs, conditions may occur when one or more LCOs must be suspended to make completion of PHYSICS TESTS possible or practical. This is acceptable as long as the fuel design criteria are not violated. The requirements specified in the following LCOs may be suspended for PHYSICS TESTING R.E. Ginna Nuclear Power Plant                    B 3.1.8-4                                  Revision 34
 
PHYSICS TESTS Exceptions - MODE 2 B 3.1.8 LCO 3.1.3,              "Moderator Temperature Coefficient (MTC)";
LCO 3.1.4,              "Rod Group Alignment Limits";
LCO 3.1.5,              "Shutdown Bank Insertion Limit";
LCO 3.1.6,              "Control Bank Insertion Limits";
LCO 3.4.2,              "RCS Minimum Temperature for Criticality".
When these LCOs are suspended for PHYSICS TESTS, the fuel design criteria are preserved as long as the power level is limited to  5% RTP, the reactor coolant temperature is kept  530&#xba;F, and SDM is within the limits specified in the COLR.
The PHYSICS TESTS include measurement of core nuclear parameters or the exercise of control components that affect process variables.
Among the process variables involved are AFD and QPTR, which represent initial conditions of the plant safety analyses. Also involved are the movable control components (control and shutdown rods), which are required to shut down the reactor. The limits for these variables are specified for each fuel cycle in the COLR.
PHYSICS TESTS meet the criteria for inclusion in the Technical Specifications, since the components and process variable LCOs suspended during PHYSICS TESTS meet Criteria 1, 2, and 3 of the NRC Policy Statement.
LCO                    This LCO allows the reactor parameters of MTC and minimum temperature for criticality to be outside their specified limits to conduct PHYSICS TESTS in MODE 2, to verify certain core physics parameters.
In addition, it allows selected control and shutdown rods to be positioned outside of their specified alignment and insertion limits.
Operation beyond specified limits is permitted for the purpose of performing PHYSICS TESTS and poses no threat to fuel integrity, provided the SRs are met.
R.E. Ginna Nuclear Power Plant                B 3.1.8-5                                    Revision 34
 
PHYSICS TESTS Exceptions - MODE 2 B 3.1.8 The requirements of LCO 3.1.3, LCO 3.1.4, LCO 3.1.5, LCO 3.1.6, and LCO 3.4.2 may be suspended during the performance of PHYSICS TESTS provided:
: a. THERMAL POWER is maintained  5% RTP;
: b. RCS lowest loop average temperature is  530&#xba;F; and
: c. SDM is within the limits specified in the COLR.
APPLICABILITY        This LCO is applicable when performing low power PHYSICS TESTS.
The applicable PHYSICS TESTS are performed in MODE 2 at HZP.
ACTIONS                A.1 and A.2 If the SDM requirement is not met, boration must be initiated promptly. A Completion Time of 15 minutes is adequate for an operator to correctly align and start the required systems and components. The operator should begin boration with the best source available for the plant conditions. Boration will be continued until SDM is within limit.
Suspension of PHYSICS TESTS exceptions requires restoration of each of the applicable LCOs to within specification within 1 hour.
B.1 When THERMAL POWER is > 5% RTP, the only acceptable action is to open the reactor trip breakers (RTBs) to prevent operation of the reactor beyond its design limits since a MODE change has occurred.
Immediately opening the RTBs will shut down the reactor and prevent operation of the reactor outside of its design limits.
C.1 When the RCS loop with the lowest Tavg is < 530&#xba;F, the appropriate action is to restore Tavg to within its specified limit. The allowed Completion Time of 15 minutes provides time for restoring TAVG to within limits without allowing the plant to remain in an unacceptable condition for an extended period of time. Operation with the reactor critical and with temperature below 530&#xba;F could violate the assumptions for accidents analyzed in the safety analyses.
R.E. Ginna Nuclear Power Plant              B 3.1.8-6                                    Revision 34
 
PHYSICS TESTS Exceptions - MODE 2 B 3.1.8 D.1 If Required Action C.1 cannot be completed within the associated Completion Time, the plant must be brought to a MODE in which the requirement does not apply. To achieve this status, the plant must be brought to at least MODE 3 within an additional 15 minutes. The Completion Time of 15 additional minutes is reasonable, based on operating experience, for reaching MODE 3 from MODE 2 in an orderly manner and without challenging plant systems.
SURVEILLANCE                SR 3.1.8.1 REQUIREMENTS The power range and intermediate range neutron detectors must be verified to be OPERABLE in MODE 2 by LCO 3.3.1, "Reactor Trip System (RTS) Instrumentation." A CHANNEL OPERATIONAL TEST is performed on each power range and intermediate range channel within 7 days prior to criticality. This will ensure that the RTS is properly aligned to provide the required degree of core protection during the performance of the PHYSICS TESTS. The 7 day time limit is sufficient to ensure that the instrumentation is OPERABLE shortly before initiating PHYSICS TESTS.
SR 3.1.8.2 Verification that the RCS lowest loop TAVG is  530&#xba;F will ensure that the plant is not operating in a condition that could invalidate the safety analyses. Control board indication for TAVG is available down to 540&#xba;F while indication from the plant process computer (PPCS) is available down to 535&#xba;F. Between 530&#xba;F and 535&#xba;F, PPCS cold and hot leg indication should be used to determine TAVG.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.1.8.3 Verification that THERMAL POWER is  5% RTP using the NIS detectors will ensure that the plant is not operating in a condition that could invalidate the safety analyses. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program R.E. Ginna Nuclear Power Plant                  B 3.1.8-7                                        Revision 77
 
PHYSICS TESTS Exceptions - MODE 2 B 3.1.8 SR 3.1.8.4 The SDM is verified by comparing the RCS boron concentration to a SHUTDOWN MARGIN requirement curve that was generated by taking into account estimated RCS boron concentrations, core power defect, control bank position, RCS average temperature, fuel burnup based on gross thermal energy generation, xenon concentration, samarium concentration, and isothermal temperature coefficient (ITC).
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES            1. 10 CFR 50, Appendix B, Section XI.
: 2. 10 CFR 50.59.
: 3. WCAP-9272-P-A, "Westinghouse Reload Safety Evaluation Methodology Report," July 1985.
: 4. UFSAR, Section 14.6.
: 5. Letter from R. W. Kober (RGE) to T. E. Murley (NRC),
 
==Subject:==
 
                                  "Startup Reports," dated July 9, 1984.
: 6. Letter from J. P. Durr (NRC) to B. A. Snow (RGE),
 
==Subject:==
 
                                  "Inspection Report No. 50-244/88-06," dated April 28, 1988.
R.E. Ginna Nuclear Power Plant              B 3.1.8-8                                      Revision 77
 
FQ(Z)
B 3.2.1 B 3.2    POWER DISTRIBUTION LIMITS B 3.2.1      Heat Flux Hot Channel Factor (FQ(Z)) BASES BACKGROUND            The purpose of the limits on the values of FQ(Z) is to limit the local (i.e.,
pellet) peak power density. The value of FQ(Z) varies along the axial height (Z) of the core.
FQ(Z) is defined as the maximum local fuel rod linear power density divided by the average fuel rod linear power density, assuming nominal fuel pellet and fuel rod dimensions adjusted for uncertainty. Therefore, FQ(Z) is a measure of the peak fuel pellet power within the reactor core.
During power operation, the global power distribution is limited by LCO 3.2.3, "AXIAL FLUX DIFFERENCE (AFD)," and LCO 3.2.4, "QUADRANT POWER TILT RATIO (QPTR)," which are directly and continuously measured process variables. These LCOs, along with LCO 3.1.6, "Control Bank Insertion Limits," maintain the core limits on power distributions on a continuous basis.
FQ(Z) varies with fuel loading patterns, control bank insertion, fuel burnup, and changes in axial power distribution.
FQ(Z) is measured periodically using the incore detector system. These measurements are generally taken with the core at or near equilibrium conditions. Equilibrium conditions are achieved when the core is sufficiently stable at intended operating conditions to support flux mapping.
Using the measured three dimensional power distributions, it is possible to derive a measured value for FQ(Z). However, because this value represents an equilibrium condition, it does not include the variations in the value of FQ(Z) which are present during nonequilibrium situations such as load following or power ascension.
To account for these possible variations, the equilibrium value of FQ(Z) is adjusted as FQW(Z) by an elevation dependent factor that accounts for the calculated worst case transient conditions R.E. Ginna Nuclear Power Plant                    B 3.2.1-1                                  Revision 42
 
FQ(Z)
B 3.2.1 Core monitoring and control under non-equilibrium conditions are accomplished by operating the core within the limits of the appropriate LCOs, including the limits on AFD, QPTR, and bank insertion, sequence, and overlap limits.
APPLICABLE              This LCO precludes core power distributions that violate the following fuel SAFETY                  design criteria:
ANALYSES
: a. During a large break loss of coolant accident (LOCA), the peak cladding temperature (PCT) must not exceed 2200&#xba;F (Ref. 1),
: b. During a loss of forced reactor coolant flow accident, there must be at least 95% probability at the 95% confidence level (the 95/95 departure from nucleate boiling (DNB) criterion) that the hot fuel rod in the core does not experience a DNB condition,
: c. During an ejected rod accident, the energy deposition to the fuel must not exceed 200 cal/gm (Ref. 2), and
: d. The control rods must be capable of shutting down the reactor with a minimum required SDM with the highest worth control rod stuck fully withdrawn (Ref. 3).
Limits on FQ(Z) ensure that the value of the initial total peaking factor assumed in the accident analyses remains valid. Other criteria must also be met (e.g., maximum cladding oxidation, maximum hydrogen generation, coolable geometry, and long term cooling). However, the peak cladding temperature is typically most limiting.
FQ(Z) limits assumed in the LOCA analysis are typically limiting relative to (i.e., lower than) the FQ(Z) limit assumed in safety analyses for other postulated accidents. Therefore, this LCO provides conservative limits for other postulated accidents FQ(Z) satisfies Criterion 2 of 10 CFR 50.36.
R.E. Ginna Nuclear Power Plant                    B 3.2.1-2                                  Revision 42
 
FQ(Z)
B 3.2.1 LCO                  The Heat Flux Hot Channel Factor, FQ(Z), shall be limited by the following relationships:
FQ(Z) d(CFQ / P) K(Z)              for P > 0.5 FQ(Z) d(CFQ / 0.5) K(Z)              for P d0.5 where:
CFQ is the FQ(Z) limit at RTP provided in the COLR, K(Z) is the normalized FQ(Z) as a function of core height provided in the COLR, and P = THERMAL POWER / RTP For this facility, the actual values of CFQ and K(Z) are given in the COLR; however, CFQ is normally a number on the order of 2.60, and K(Z) is a function that looks like the one provided in Figure B 3.2.1-1.
For Relaxed Axial Offset Control operation, FQ(Z) is approximated by FQC(Z) and FQW(Z). Thus, both FQC(Z) and FQW(Z) must meet the preceding limits on FQ(Z).
An FQC(Z) evaluation requires obtaining an incore flux map in MODE 1.
From the incore flux map results we obtain the measured value ( FQM(Z))
of FQ(Z). Then, FQC(Z) = FQM(Z) 1.0815 where 1.0815 is a factor that accounts for fuel manufacturing tolerances (1.03) and flux map measurement uncertainty (1.05)(Ref. 4)
FQC(Z) is an excellent approximation for FQ(Z) when the reactor is at the steady state power at which the incore flux map was taken.
Because flux maps are taken in steady state conditions, the variations in power distribution resulting from normal operational maneuvers are not present in the flux map data. These variations are, however, conservatively calculated by considering a wide range of unit maneuvers in normal operation.
R.E. Ginna Nuclear Power Plant                    B 3.2.1-3                                Revision 42
 
FQ(Z)
B 3.2.1 The expression for FQW(Z) is:
FQW(Z)=FQC(Z)W(Z) where W(Z) is a cycle dependent function that accounts for power distribution transients encountered during normal operation. W(Z) is included in the COLR. The FQW(Z) is calculated at equilibrium conditions.
The FQ(Z) limits define limiting values for core power peaking that precludes peak cladding temperatures above 2200&deg;F during either a large or small break LOCA.
This LCO requires operation within the bounds assumed in the safety analyses. Calculations are performed in the core design process to confirm that the core can be controlled in such a manner during operation that it can stay within the LOCA FQ(Z) limits. If FQC(Z) cannot be maintained within the LCO limits, reduction of the core power is required and if FQW(Z) cannot be maintained within the LOCA limits, reduction of the AFD limits is required. Note that sufficient reduction of the AFD limits will also result in a reduction of the core power.
Violating the LCO limits for FQ(Z) produces unacceptable consequences if a design basis event occurs while FQ(Z) is outside its specified limits.
APPLICABILITY        The FQ(Z) limits must be maintained in MODE 1 to prevent core power distributions from exceeding the limits assumed in the safety analyses.
Applicability in other MODES is not required because there is either insufficient stored energy in the fuel or insufficient energy being transferred to the reactor coolant to require a limit on the distribution of core power.
ACTIONS                A.1 Reducing THERMAL POWER by  1% RTP for each 1% by which FQC(Z) exceeds its limit, maintains an acceptable absolute power density FQC(Z) is FQM(Z) multiplied by a factor accounting for manufacturing tolerances and measurement uncertainties. FQM(Z) is the measured value of FQ(Z). The Completion Time of 15 minutes provides an acceptable time to reduce power in an orderly manner and without allowing the plant to remain in an unacceptable condition for an extended period of time. The maximum allowable power level initially determined R.E. Ginna Nuclear Power Plant B 3.2.1-4                                Revision 78
 
FQ(Z)
B 3.2.1 by Required Action A.1 may be affected by subsequent determinations of FQC(Z) and would require power reductions within 15 minutes of the FQC (Z) determination (completion of applicable surveillances), if necessary to comply with the decreased maximum allowable power level.
Decreases in FQC (Z) would allow increasing the maximum allowable power level and increasing power up to this revised limit.
A.2 A reduction of the Power Range Neutron Flux - High trip setpoints by 1% for each 1% by which FQC (Z) exceeds its limit, is a conservative action for protection against the consequences of severe transients with unanalyzed power distributions. The Completion Time of 72 hours is sufficient considering the small likelihood of a severe transient in this time period and the preceding prompt reduction in THERMAL POWER in accordance with Required Action A.1. The maximum allowable Power Range Neutron Flux - High trip setpoints initially determined by Required Action A.2 may be affected by subsequent determinations of FQC(Z) and would require Power Range Neutron Flux - High trip setpoint reductions within 72 hours of the FQC(Z) determination (completion of applicable surveillances), if necessary to comply with the decreased maximum allowable Power Range Neutron Flux - High trip setpoints. Decreases in FQC(Z) would allow increasing the maximum allowable Power Range Neutron Flux - High trip setpoints.
A.3 Reduction in the Overpower T trip setpoints (value of K4) by  1% for each 1% by which FQC(Z) exceeds its limit, is a conservative action for protection against the consequences of severe transients with unanalyzed power distributions. The Completion Time of 72 hours is sufficient considering the small likelihood of a severe transient in this time period, and the preceding prompt reduction in THERMAL POWER in accordance with Required Action A.1. The maximum allowable Overpower T trip setpoints initially determined by Required Action A.3 may be affected by subsequent determinations of FQC(Z) and would require Overpower T trip setpoint reductions within 72 hours of the FQC(Z) determination (completion of applicable surveillances), if necessary to comply with the decreased maximum allowable Overpower T trip setpoints. Decreases in FQC(Z) would allow increasing the maximum allowable Overpower T trip setpoints.
R.E. Ginna Nuclear Power Plant                  B 3.2.1-5                                  Revision 78
 
FQ(Z)
B 3.2.1 A.4 Verification that FQC(Z) has been restored to within its limit, by performing SR 3.2.1.1 and SR 3.2.1.2 prior to increasing THERMAL POWER above the limit imposed by Required Action A.1, ensures that core conditions during operation at higher power levels and future operation are consistent with safety analyses assumptions.
Condition A is modified by a Note that requires Required Action A.4 to be performed whenever the Condition is entered. This ensures that SR 3.2.1.1 and SR 3.2.1.2 will be performed prior to increasing THERMAL POWER above the limit of Required Action A.1, even when Condition A is exited prior to performing Required Action A.4. Performance of SR 3.2.1.1 and SR 3.2.1.2 are necessary to assure FQ(Z) is properly evaluated prior to increasing THERMAL POWER.
B.1 If it is found that the maximum calculated value of FQ(Z) that can occur during normal maneuvers, FQC(Z), exceeds its specified limits, there exists a potential for FQC(Z) to become excessively high if a normal operational transient occurs. Reducing the AFD by  1% for each 1% by which FQW(Z) exceeds its limit within the allowed Completion Time of 4 hours, restricts the axial flux distribution such that even if a transient occurred, core peaking factors are not exceeded (Ref. 5).
The percent that FQ(Z) exceeds its transient limit is calculated based on the following expression:
R.E. Ginna Nuclear Power Plant                    B 3.2.1-6                                  Revision 78
 
FQ(Z)
B 3.2.1 The implicit assumption is that if W(Z) values were recalculated (consistent with the reduced AFD limits), then FQC(Z) times the recalculated W(Z) values would meet the FQ(Z) limit. Note that complying with this action (of reducing AFD limits) may also result in a power reduction. Hence the need for Required Actions B.2, B.3 and B.4.
B.2 A reduction of the Power Range Neutron Flux-High trip setpoints by  1%
for each 1% by which the maximum allowable power is reduced, is a conservative action for protection against the consequences of severe transients with unanalyzed power distributions. The Completion Time of 72 hours is sufficient considering the small likelihood of a severe transient in this time period and the preceding prompt reduction in THERMAL POWER as a result of reducing AFD limits in accordance with Required Action B.1.
B.3 Reduction in the Overpower T trip setpoints value of K4 by  1% for each 1% by which the maximum allowable power is reduced, is a conservative action for protection against the consequences of severe transients with unanalyzed power distributions. The Completion Time of 72 hours is sufficient considering the small likelihood of a severe transient in this time period, and the preceding prompt reduction in THERMAL POWER as a result of reducing AFD limits in accordance with Required Action B.1.
B.4 Verification that FQW(Z) has been restored to within its limit, by performing SR 3.2.1.1 and SR 3.2.1.2 prior to increasing THERMAL POWER above the maximum allowable power limit imposed by Required Action B.1 ensures that core conditions during operation at higher power levels and future operation are consistent with safety analyses assumptions.
Condition B is modified by a Note that requires Required Action B.4 to be performed whenever the Condition is entered. This ensures that SR 3.2.1.1 and SR 3.2.1.2 will be performed prior to increasing THERMAL POWER above the limit of Required Action B.1, even when Condition B is exited prior to performing Required Action B.4. Performance of SR 3.2.1.1 and SR 3.2.1.2 are necessary to assure FQ(Z) is properly evaluated prior to increasing THERMAL POWER.
R.E. Ginna Nuclear Power Plant                      B 3.2.1-7                              Revision 78
 
FQ(Z)
B 3.2.1 C.1 If Required Actions A.1 through A.4 or B.1 through B.4 are not met within their associated Completion Times, the plant must be placed in a mode or condition in which the LCO requirements are not applicable. This is done by placing the plant in at least MODE 2 within 6 hours.
This allowed Completion Time is reasonable based on operating experience regarding the amount of time it takes to reach MODE 2 from full power operation in an orderly manner and without challenging plant systems.
SURVEILLANCE            SR 3.2.1.1 and SR 3.2.1.2 are modified by a Note. The Note applies REQUIREMENTS            during the first power ascension after a refueling. It states that THERMAL POWER may be increased until an equilibrium power level has been achieved at which a power distribution map can be obtained.
This allowance is modified, however, by one of the Frequency conditions that requires verification that FQC(Z) and FQW(Z) are within their specified limits after a power rise of more than 10% RTP over the THERMAL POWER at which they were last verified to be within specified limits.
Because FQC(Z) and FQW (Z) could not have previously been measured in this reload core, there is a second Frequency condition, applicable only for reload cores, that requires determination of these parameters before exceeding 75% RTP. This ensures that some determination of FQC(Z) and FQW(Z) are made at a lower power level at which adequate margin is available before going to 100% RTP. Also, this Frequency condition, together with the Frequency condition requiring verification of FQC(Z) and FQW(Z) following a power increase of more than 10%, ensures that they are verified as soon as RTP (or any other level for extended operation) is achieved. In the absence of these Frequency conditions, it is possible to increase power to RTP and operate for 31 days without verification of FQC(Z) and FQW(Z). The Frequency condition is not intended to require verification of these parameters after every 10% increase in power level above the last verification. It only requires verification after a power level is achieved for extended operation that is 10% higher than that power at which FQ(Z) was last measured.
R.E. Ginna Nuclear Power Plant                B 3.2.1-8                                    Revision 78
 
FQ(Z)
B 3.2.1 SR 3.2.1.1 Verification that FQC(Z) is within its specified limits involves increasing FaM(Z) to allow for manufacturing tolerance and measurement uncertainties in order to obtain FQC (Z). Specifically, FQM(Z) is the measured value of Fa(Z) obtained from incore flux map results and FQC(Z) = FQM (Z) 1.0815 (Ref. 4). FQC(Z)is then compared to its specified limits.
The limit with which FQC(Z) is compared varies inversely with power above 50% RTP and directly with a function called K(Z) provided in the COLR.
Performing this Surveillance in MODE 1 prior to exceeding 75% RTP ensures that the FQC(Z) limit is met when RTP is achieved, because peaking factors generally decrease as power level is increased.
If THERMAL POWER has been increased by  10% RTP since the last determination of FQC (Z), another evaluation of this factor is required 12 hours after achieving equilibrium conditions at this higher power level (to ensure that FQC(Z) values are being reduced sufficiently with power increase to stay within the LCO limits).
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.2.1.2 The nuclear design process includes calculations performed to determine that the core can be operated within the FQ(Z) limits.
Because flux maps are taken in steady state conditions, the variations in power distribution resulting from normal operational maneuvers are not present in the flux map data. These variations are, however, conservatively calculated by considering a wide range of unit maneuvers in normal operation. The maximum peaking factor increase over steady state values, calculated as a function of core elevation, Z, is called W(Z). Multiplying the measured total peaking factor, FQC(Z), by W(Z) gives the maximum FQ(Z) calculated to occur in normal operation, FQW(Z).
R.E. Ginna Nuclear Power Plant              B 3.2.1-9                                  Revision 77
 
FQ(Z)
B 3.2.1 The limit with which FQW(Z) is compared varies inversely with power above 50% RTP and directly with the function K(Z) provided in the COLR.
The W(Z) curve is provided in the COLR for discrete core elevations. Flux map data are typically taken for 61 core elevations. FQW(Z) evaluations are not applicable for the following axial core regions, measured in percent of core height:
: a. Lower core region, from 0 to 8% inclusive and
: b. Upper core region, from 92 to 100% inclusive.
The top and bottom 8% of the core are excluded from the evaluation because of the low probability that these regions would be more limiting in the safety analyses and because of the difficulty of making a precise measurement in these regions.
This Surveillance has been modified by a Note that may require that more frequent surveillances be performed. If FQW (Z) is evaluated, an evaluation of the expression below is required to account for any increase to FQM(Z) that may occur and cause the FQ(Z) limit to be exceeded before the next required FQ(Z) evaluation.
If the two most recent FQ(Z) evaluations show an increase in the expression maximum over z [FQC(Z) I K(Z) ], it is required to meet the FQ(Z) limit with the last FQW(Z) increased by the greater of a factor of 1.02 or by an appropriate factor specified in the COLR or to evaluate FQ(Z) more frequently, each 7 EFPD. These alternative requirements prevent FQ(Z) from exceeding its limit for any significant period of time without detection.
Performing the Surveillance in MODE 1 prior to exceeding 75% RTP ensures that the FQ(Z) limit is met when RTP is achieved, because peaking factors are generally decreased as power level is increased.
FQ(Z) is verified at power levels  10% RTP above the THERMAL POWER of its last verification, 12 hours after achieving equilibrium conditions to ensure that FQ(Z) is within its limit at higher power levels.
R.E. Ginna Nuclear Power Plant                B 3.2.1-10                                    Revision 77
 
FQ(Z)
B 3.2.1 The Surveillance Frequency.is controlled under the Surveillance Frequency Control Program.
REFERENCES            1. 10 CFR 50.46.
: 2. UFSAR 15.4.5.4.3
: 3. Atomic Industrial Forum (AIF) GDC-29, Issued for comment July10, 1967
: 4. WCAP-7308-L-P-A, "Evaluation of Nuclear Hot Channel Factor Uncertainties," June 1988.
: 5. WCAP-10216-P-A, Rev. 1A, "Relaxation of Constant Axial Offset Control (and) FQ Surveillance Technical Specification," February 1994.
R.E. Ginna Nuclear Power Plant                B 3.2.1-11                                  Revision 77
 
FQ(Z)
B 3.2.1 Figure B 3.2.1-1 K(Z) - Normalized FQ(Z) as a Function of Core Height R.E. Ginna Nuclear Power Plant            B 3.2.1-12                        Revision 42
 
FN'H B 3.2.2 B 3.2    POWER DISTRIBUTION LIMITS B 3.2.2      Nuclear Enthalpy Rise Hot Channel Factor (FN'H)
BASES BACKGROUND            The purpose of this LCO is to establish limits on the power density at any point in the core so that the fuel design criteria are not exceeded and the accident analysis assumptions remain valid. The design limits on local (pellet) and integrated fuel rod peak power density are expressed in terms of hot channel factors. Control of the core power distribution with respect to these factors ensures that local conditions in the fuel rods and coolant channels do not challenge core integrity at any location in the core during either normal operation or a postulated accident analyzed in the safety analyses.
FN'H is defined as the ratio of the integral of the linear power along the fuel rod with the highest integrated power to the average integrated fuel rod power. Therefore, FN'H is a measure of the maximum total power produced in a fuel rod. The FN'H limit identifies the coolant flow channel with the maximum enthalpy rise. This channel has the least heat removal capability and thus the highest probability for departure from nucleate boiling (DNB).
FN'H is sensitive to fuel loading patterns, control bank insertion, and fuel burnup. FN'H typically increases with control bank insertion and typically decreases with fuel burnup.
FN'H is not directly measurable but is inferred from a power distribution map obtained with the movable incore detector system. Specifically, the results of the three dimensional power distribution map are analyzed by a computer to determine FN'H. This factor is calculated at least every 31 EFPD. However, during power operation, the global power distribution is monitored by LCO 3.2.3, "AXIAL FLUX DIFFERENCE (AFD)," and LCO 3.2.4, "QUADRANT POWER TILT RATIO (QPTR)," which are directly and continuously measured process variables. Therefore, these LCOs preserve core limits on a continuous basis. FN'H and the QPTR LCO limit the radial component of the peaking factors.
R.E. Ginna Nuclear Power Plant                B3.2.2-1                                  Revision 21
 
FN'H B 3.2.2 The COLR provides peaking factor limits that ensure that the design basis value for departure from nucleate boiling ratio (DNBR) is met for normal operation, operational transients, and any transient condition arising from events of moderate frequency. The DNB design basis precludes DNB and is met by limiting the minimum local DNB heat flux ratio. All DNB limited transient events are assumed to begin with an FN'H value that satisfies the LCO requirements.
Operation outside the LCO limits may produce unacceptable consequences if a DNB limiting event occurs. The DNB design basis ensures that there is no overheating of the fuel that results in possible cladding perforation with the release of fission products to the reactor coolant.
APPLICABLE            Limits on FN'H preclude core power distributions that exceed the SAFETY                following fuel design limits:
ANALYSES
: a. During a loss of forced reactor coolant flow accident, there must be at least 95% probability at the 95% confidence level (the 95/95 DNB criterion) that the hottest fuel rod in the core does not experience a DNB condition;
: b. During a large break loss of coolant accident (LOCA), peak cladding temperature (PCT) must not exceed 2200&deg;F (Ref. 1);
: c. During an ejected rod accident, the energy deposition to the fuel will be below 200 cal/gm (Ref. 2); and
: d. The control rods must be capable of shutting down the reactor with a minimum required SOM with the highest worth control rod stuck fully withdrawn (Ref. 3).
For transients that may be DNB limited, the Reactor Coolant System flow and FN'H are the core parameters of most importance. The limits on FN'H ensure that the DNB design basis is met for normal operation, operational transients, and any transients arising from events of moderate frequency (i.e., Condition 1 events as described in Reference 4). The DNB design basis is met by limiting the minimum DNBR to the 95/95 DNB criterion.
R.E. Ginna Nuclear Power Plant              B3.2.2-2                                    Revision 21
 
FNH B 3.2.2 The allowable FN'H limit increases with decreasing power level. This functionality in FN'H is included in the analyses that provide the Reactor Core Safety Limits (SLs) of SL 2.1.1. Therefore, any DNB events in which the calculation of the core limits is modeled implicitly use this variable value of FN'H in the analyses. Likewise, all transients that may be DNB limited are assumed to begin with an initial FNAH as a function of power level defined by the COLR limit equation.
The LOCA safety analysis indirectly models FN'H as an input parameter.
The Nuclear Heat Flux Hot Channel Factor (FQ(Z)) and the axial peaking factors are inserted directly into the LOCA safety analyses that verify the acceptability of the resulting peak cladding temperature (Ref. 1).
The fuel is protected in part by Technical Specifications, which ensure that the initial conditions assumed in the safety and accident analyses remain valid. The following LCOs ensure this: LCO 3.2.3, "AXIAL FLUX DIFFERENCE (AFD)," LCO 3.2.4, "QUADRANT POWER TILT RATIO (QPTR)," LCO 3.1.6, "Control Bank Insertion Limits," LCO 3.2.2, "Nuclear Enthalpy Rise Hot Channel Factor (FN'H)," and LCO 3.2.1, "Heat Flux Hot Channel Factor (FQ(Z))."
FNAH is measured periodically using the movable incore detector system.
Measurements are generally taken with the core at, or near, steady state conditions. Core monitoring and control under transient conditions (Condition 1 events) are accomplished by operating the core within the limits of the LCOs on AFD, QPTR, and Bank Insertion, Sequence and Overlap Limits.
FN'H satisfies Criterion 2 of the NRC Policy Statement.
LCO                  FN'H shall be maintained within the limits of the relationship provided in the COLR.
The FN'H limit identifies the coolant flow channel with the maximum enthalpy rise. This channel has the least heat removal capability and thus the highest probability for DNB.
The limiting value of FN'H, described by the equation contained in the COLR, is the design radial peaking factor used in the plant safety analyses.
R.E. Ginna Nuclear Power Plant                B 3.2.2-3                                  Revision 21
 
FNH B 3.2.2 A power multiplication factor in this equation includes an additional margin for higher radial peaking from reduced thermal feedback and greater control rod insertion at low power levels. The limiting value of FN'H is allowed to increase 0.3% for every 1% RTP reduction in THERMAL POWER APPLICABILITY        The FN'H limits must be maintained in MODE 1 to prevent core power distributions from exceeding the fuel design limits for DNBR and PCT.
Applicability in other modes is not required because there is neither sufficient stored energy in the fuel nor sufficient energy being transferred to the reactor coolant to require a limit on the distribution of core power. Specifically, the design bases events that are sensitive to FN'H in MODES 2, 3, 4, and 5 have significant margin to DNB, and therefore, there is no need to restrict FN'H in these modes.
ACTIONS Reducing THERMAL POWER by 2 1% for each 1% by which FN'H exceeds its limit maintains an acceptable DNBR margin. When the FN'H limit is exceeded, the DNBR limit is not likely violated in steady state operation, because events that could significantly perturb the FN'H value (e.g., static control rod misalignment) are considered in the safety analyses. However, the DNBR limit may be violated if a DNB limiting event occurs. Reducing THERMAL POWER increases the DNB margin.
The Completion Time of 15 minutes provides an acceptable time to reduce power in an orderly manner and without allowing the plant to remain in an unacceptable condition for an extended period of time.
A reduction of the Power Range Neutron Flux-High trip setpoints by  1%
for each 1% by which FN'H exceeds its specified limit, is a conservative action for protection against the consequences of severe transients with unanalyzed power distributions and ensures that continuing operation remains at an acceptable low power level with adequate DNBR margin.
This reduction shall be made as follows, given that the FN'H limit is exceeded by 3% and the Power Range Neutron Flux-High setpoint is 108%, the Power Range Neutron Flux-High setpoint must be reduced by at least 3% to 105%. The Completion Time of 72 hours is sufficient, considering the small likelihood of a severe transient in this period, and the preceding prompt reduction in THERMAL POWER in accordance with required action A.1.
R.E. Ginna Nuclear Power Plant                B 3.2.2-4                                  Revision 21
 
FNH B 3.2.2 A.3 Reduction in the Overpower 'T and Overtemperature 'T trip setpoints by 1% for each 1% by which FN'H exceeds its limit, ensures that continuing operation remains at an acceptable low power level with adequate DNBR margin. The Completion Time of 72 hours is sufficient considering the small likelihood of a severe transient in this period, and the preceding prompt reduction in THERMAL POWER in accordance with Required Action A.1.
A.4 Verification that FN'H has been restored within its limit by performing SR 3.2.2.1 or SR 3.2.2.2 prior to increasing THERMAL POWER above the limit imposed by Required Action A.1 ensures that the cause that led to the FN6H exceeding its limit is corrected, and core conditions during operation at higher power levels are consistent with safety analyses assumptions .
B.1 If the Required Actions of A.1 through A.4 cannot be met within their associated Completion Times, the plant must be placed in a mode in which the LCO requirements are not applicable. This is done by placing the plant in at least MODE 2 within 6 hours.
The allowed Completion Time is reasonable based on operating experience regarding the amount of time it takes to reach MODE 2 from full power operation in an orderly manner and without challenging plant systems.
SURVEILLANCE          SR 3.2.2.1 REQUIREMENTS The value of FN'H is determined by using the movable incore detector system to obtain a flux distribution map. A data reduction computer program then calculates the maximum value of FN'H from the measured flux distributions. The measured value of FN'H must be multiplied by 1.04 to account for measurement uncertainty before making comparisons to the FN'H limit.
After each refueling, FN'H must be determined in MODE 1 prior to exceeding 75% RTP. This requirement ensures that FN'H limits are met at the beginning of each fuel cycle.
R.E. Ginna Nuclear Power Plant              B 3.2.2-5                                  Revision 21
 
FNH B 3.2.2 The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. When the plant is already performing SR 3.2.2.2 to satisfy other requirements, SR 3.2.2.2 does not need to be suspended in order to perform SR 3.2.2.1 since the performance of SR 3.2.2.2 meets the requirements of SR 3.2.2.1.
SR 3.2.2.2 During power operation, the global power distribution is monitored by LCO 3.2.3, "AXIAL FLUX DIFFERENCE (AFD)," and LCO 3.2.4, "QUADRANT POWER TILT RATIO (QPTR)," which are directly and continuously measured process variables.
With an NIS power range channel inoperable, QPTR monitoring for a portion of the reactor core becomes degraded. Large tilts are likely detected with the remaining channels, but the capability for detection of small power tilts in some quadrants is decreased. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
This Surveillance is modified by a Note, which states that it is required only when one power range channel is inoperable and the THERMAL POWER is  75% RTP.
REFERENCES            1. 10 CFR 50.46.
: 2. UFSAR, Section 15.4.5.1.
Atomic Industrial Forum (AIF) GDC 29, Issued for comment July 10 3.
1967.
American National Standard, "Nuclear Safety Criteria for the Design 4.
of Stationary Pressurized Water Reactor Plants," N18.2-1973 .
R.E. Ginna Nuclear Power Plant                B 3.2.2-6                                Revision 77
 
AFD B 3.2.3 B 3.2        POWER DISTRIBUTION LIMITS B 3.2.3        AXIAL FLUX DIFFERENCE (AFD)
BASES BACKGROUND              The purpose of this LCO is to establish limits on the values of the AFD in order to limit the amount of axial power distribution skewing to either the top or bottom of the core. By limiting the amount of power distribution skewing, core peaking factors are consistent with the assumptions used in the safety analyses. Limiting power distribution skewing over time also minimizes the xenon distribution skewing, which is a significant factor in axial power distribution control.
Relaxed Axial Offset Control (RAOC) is a calculational procedure that defines the allowed operational space of the AFD versus THERMAL POWER. The AFD limits are selected by considering a range of axial xenon distributions that may occur as a result of large variations of the AFD. Subsequently, power peaking factors and power distributions are examined to ensure that the loss of coolant accident (LOCA), loss of flow accident, and anticipated transient limits are met. Violation of the AFD limits invalidate the conclusions of the accident and transient analyses with regard to fuel cladding integrity.
The AFD is monitored on an automatic basis using the unit process computer, which has an AFD monitor alarm. The computer determines the 1 minute average of each of the OPERABLE excore detector outputs and provides an alarm message immediately if the AFD for two or more OPERABLE excore channels is outside its specified limits.
APPLICABLE              The AFD is a measure of the axial power distribution skewing to SAFETY                  either the top or bottom half of the core. The AFD is sensitive to ANALYSES                many core related parameters such as control bank positions, core power level, axial burnup, axial xenon distribution, and, to a lesser extent, reactor coolant temperature and boron concentration.
The allowed range of the AFD is used in the nuclear design process to confirm that operation within these limits produces core peaking factors and axial power distributions that meet safety analysis requirements.
The RAOC methodology (Ref. 1) establishes a xenon distribution library with tentatively wide AFD limits. One dimensional axial power distribution calculations are then performed to demonstrate that normal operation power shapes are acceptable for the LOCA and loss of flow accident, and for initial conditions of anticipated transients. The tentative limits are adjusted as necessary to meet the safety analysis requirements.
R.E. Ginna Nuclear Power Plant              B 3.2.3-1                                  Revision 42
 
AFD B 3.2.3 The limits on the AFD ensure that the Heat Flux Hot Channel Factor (FQ(Z)) is not exceeded during either normal operation or in the event of xenon redistribution following power changes. The limits on the AFD also restrict the range of power distributions that are used as initial conditions in the analyses of Condition 2, 3, or 4 events, (Ref. 2). This ensures that the fuel cladding integrity is maintained for these postulated accidents.
The most important Condition 4 event is the LOCA. The most important Condition 3 event is the loss of flow accident. The most important Condition 2 events are uncontrolled bank withdrawal and boration or dilution accidents. Condition 2 accidents assumed to begin from within the AFD limits are used to confirm the adequacy of the Overpower 'T and Overtemperature 'T trip setpoints.
The limits on the AFD satisfy Criterion 2 of 10 CFR 50.36.
LCO                  The shape of the power profile in the axial (i.e., the vertical) direction is largely under the control of the operator through the manual operation of the control banks or automatic motion of control banks. The automatic motion of the control banks is in response to temperature deviations resulting from manual operation of the Chemical and Volume Control System to change boron concentration or from power level changes.
Signals are available to the operator from the Nuclear Instrumentation System (NIS) excore neutron detectors (Ref. 3). Separate signals are taken from the top and bottom detectors. The AFD is defined as the difference in normalized flux signals between the top and bottom excore detectors in each detector well. For convenience, this flux difference is converted to provide flux difference units expressed as a percentage and labeled as %' flux or %'I.
The AFD limits are provided in the COLR. Figure B 3.2.3-1 shows typical RAOC AFD limits. The AFD limits for RAOC do not depend on the target flux difference. However, the target flux difference may be used to minimize changes in the axial power distribution.
Violating this LCO on the AFD could produce unacceptable consequences if a Condition 2, 3, or 4 event occurs while the AFD is outside its specified limits.
R.E. Ginna Nuclear Power Plant                    B 3.2.3-2                                  Revision 42
 
AFD B 3.2.3 APPLICABILITY          The AFD requirements are applicable in MODE 1 greater than or equal to 50% RTP when the combination of THERMAL POWER and core peaking factors are of primary importance in safety analysis.
For AFD limits developed using RAOC methodology, the value of the AFD does not affect the limiting accident consequences with THERMAL POWER < 50% RTP and for lower operating power MODES.
ACTIONS                A.1 As an alternative to restoring the AFD to within its specified limits, Required Action A.1 requires a THERMAL POWER reduction to < 50%
RTP. This places the core in a condition for which the value of the AFD is not important in the applicable safety analyses. A Completion Time of 30 minutes is reasonable, based on operating experience, to reach 50%
RTP without challenging plant systems.
SURVEILLANCE          SR 3.2.3.1 REQUIREMENTS This Surveillance verifies that the AFD, as indicated by the NIS excore channel, is within its specified limits. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES            1. WCAP-10216-P-A, Revision 1A, "Relaxation of Constant Axial Offset Control/FQ Surveillance Technical Specification", February1994
: 2. American National Standard, "Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants," N18.2-1973.
: 3. UFSAR, Section 7.7.2.6.4.
R.E. Ginna Nuclear Power Plant              B 3.2.3-3                                        Revision 77
 
AFD B 3.2.3 Figure B3.2.3-1 AXIAL FLUX DIFFERENCE Acceptable Operation Limits as a Function of RATED THERMAL POWER R.E. Ginna Nuclear Power Plant      B 3.2.3-4                                    Revision 42
 
QPTR B 3.2.4 B 3.2 POWER DISTRIBUTION LIMITS B 3.2.4  QUADRANT POWER TILT RATIO (QPTR)
BASES BACKGROUND        The QPTR limit ensures that the gross radial power distribution remains consistent with the design values used in the safety analyses. Precise radial power distribution measurements are made during startup testing, after refueling, and periodically during power operation.
Quadrant Power Tilt is a core tilt that is measured with the use of the excore power range flux detectors. A core tilt is defined as the ratio of maximum to average quadrant power. The QPTR is defined as the ratio of the highest average nuclear power in any quadrant to the average nuclear power in the four quadrants. Limiting the QPTR prevents radial xenon oscillations and will indicate any core asymmetries .
The power density at any point in the core must be limited so that the fuel design criteria are maintained. Together, LCO 3.2.3, "AXIAL FLUX DIFFERENCE (AFD)," LCO 3.2.4, "QUADRANT POWER TILT RATIO (QPTR)," and LCO 3.1.6, "Control Bank Insertion Limits," provide limits on process variables that characterize and control the three dimensional power distribution of the reactor core. Control of these variables ensures that the core operates within the fuel design criteria and that the power distribution remains within the bounds used in the safety analyses.
APPLICABLE          Limits on QPTR preclude core power distributions that violate the SAFETY              following fuel design criteria:
ANALYSES
: a. During a loss of forced reactor coolant flow accident, there must be at least 95% probability at the 95% confidence level (the 95/95 departure from nucleate boiling (DNB) criterion) that the hot fuel rod in the core does not experience a DNB condition;
: b. During a large break loss of coolant accident (LOCA), the peak cladding temperature (PCT) must not exceed 2200&deg;F (Ref. 1);
: c. During an ejected rod accident, the energy deposition to the fuel will be below 200 cal/gm (Ref. 2); and The control rods must be capable of shutting down the reactor with a minimum required SOM with the highest worth control rod stuck fully withdrawn (Ref. 3).
R.E. Ginna Nuclear Power Plant                    B 3.2.4-1                                Revision 42
 
QPTR B 3.2.4 The LCO limits on the AFD, the QPTR, the Heat Flux Hot Channel Factor (FQ(Z)), the Nuclear Enthalpy Rise Hot Channel Factor (FN'H), and Bank Insertion, Sequence and Overlap Limits are established to preclude core power distributions that exceed the safety analyses limits.
The QPTR limits ensure that FN'H and FQ(Z) remain below their limiting values by preventing an undetected change in the gross radial power distribution.
In MODE 1, the FN'H and FQ(Z) limits must be maintained to preclude core power distributions from exceeding design limits assumed in the safety analyses.
The QPTR satisfies Criterion 2 of 10 CFR 50.36.
LCO                  The QPTR shall be maintained at or below the limit of 1.02.
The QPTR limit of 1.02, above which corrective action is required, provides a margin of protection for both the DNB ratio and linear heat generation rate contributing to excessive power peaks resulting from X-Y plane power tilts. A limiting QPTR of 1.02 can be tolerated before the margin for uncertainty in FQ(Z) and FN'H is possibly challenged.
APPLICABI LITY        The QPTR limit must be maintained in MODE 1 with THERMAL POWER
                      > 50% RTP to prevent core power distributions from exceeding the design limits assumed in the safety analyses.
Applicability in MODE 1  50% RTP and in other MODES is not required because there is neither sufficient stored energy in the fuel nor sufficient energy being transferred to the reactor coolant to require the implementation of a QPTR limit on the distribution of core power. The QPTR limit in these conditions is, therefore, not important. Note that the FN'H and FQ(Z) LCOs still apply below 50% RTP, but allow progressively higher peaking factors as THERMAL POWER decreases below 50% RTP.
R.E. Ginna Nuclear Power Plant                  B 3.2.4-2                                Revision 42
 
QPTR B 3.2.4 ACTIONS                A.1 With the QPTR exceeding its limit, limiting THERMAL POWER to  3%
below RTP for each 1% by which the QPTR exceeds 1.00 is a conservative trade off of total core power with peak linear power. The Completion Time of 2 hours after each QPTR determination allows sufficient time to identify the cause and correct the tilt. Note that the power reduction itself may cause a change in the tilted condition. The maximum allowable power level initially determined by Required Action A.1 may be affected by subsequent determinations of QPTR. Increases in the QPTR would require power reductions within 2 hours of QPTR determination (completion of applicable surveillance), if necessary to comply with the decreased maximum allowable power level. Decreases in QPTR would allow increasing the maximum allowable power level and increasing power up to this revised limit.
A.2 After completion of Required Action A.1, the QPTR alarm may still be in its alarmed state. As such, any additional changes in the QPTR are detected by requiring a check of the QPTR once per 12 hours thereafter.
If the QPTR continues to increase, THERMAL POWER must be limited accordingly. A 12 hour Completion Time is sufficient because any additional change in QPTR would be relatively slow.
A.3 The peaking factors FQC(Z), as approximated by FQC (Z) and FQW(Z), and FN'H are of primary importance in ensuring that the power distribution remains consistent with the initial conditions used in the safety analyses.
Performing SRs on F FN'H and FQ(Z) within the Completion Time of 24 hours after achieving equilibrium conditions from a THERMAL POWER reduction per Required Action A.1 ensures that these primary indicators of power distribution are within their respective limits. Equilibrium conditions are achieved when the core is sufficiently stable at intended operating conditions to support the flux mapping. A Completion Time of 24 hours after achieving equilibrium conditions from a THERMAL POWER reduction per Required Action A.1 takes into consideration the rate at which peaking factors are likely to change, and the time required to stabilize the plant and perform a flux map. If these peaking factors are not within their limits, the Required Actions of these Surveillances provide an appropriate response for the abnormal condition. If the QPTR remains above its specified limit, the peaking factor surveillances are required each 7 days thereafter to evaluate FN'H and FQ(Z) with changes in power distribution. Relatively small changes are expected due to R.E. Ginna Nuclear Power Plant                    B 3.2.4-3                                Revision 42
 
QPTR B 3.2.4 either burnup and xenon redistribution or correction of the cause for exceeding the QPTR limit.
A.4 Although FN'H and FQ(Z) are of primary importance as initial conditions in the safety analyses, other changes in the power distribution may occur as the QPTR limit is exceeded and may have an impact on the validity of the safety analysis. A change in the power distribution can affect such reactor parameters as bank worths and peaking factors for rod malfunction accidents. When the QPTR exceeds its limit, it does not necessarily mean a safety concern exists. It does mean that there is an indication of a change in the gross radial power distribution that requires an investigation and evaluation that is accomplished by examining the incore power distribution. Specifically, the core peaking factors and the quadrant tilt must be evaluated because they are the factors that best characterize the core power distribution. This re-evaluation is required to ensure that, before increasing THERMAL POWER to above the limit of Required Action A 1, the reactor core conditions are consistent with the assumptions in the safety analyses.
A.5 If the QPTR has exceeded the 1.02 limit and a re-evaluation of the safety analysis is completed and shows that safety requirements are met, the excore detectors are normalized to restore QPTR to within limits prior to increasing THERMAL POWER to above the limit of Required Action A 1. Normalization is accomplished in such a manner that the indicated QPTR following normalization is near 1.00. This is done to detect any subsequent significant changes in QPTR.
Required Action A.5 is modified by two Notes. Note 1 states that the QPTR is not restored to within limits until after the re-evaluation of the safety analysis has determined that core conditions at RTP are within the safety analysis assumptions (i.e., Required Action A.4). Note 2 states that if Required Action A.5 is performed, then Required Action A.6 shall be performed. Required Action A.5 normalizes the excore detectors to restore QPTR to within limi1s, which restores compliance with LCO 3.2.4. Thus, Note 2 prevents exiting the Actions prior to completing flux mapping to verify peaking factors, per Required Action A.6. These Notes are intended to prevent any ambiguity about the required sequence of actions.
A.6 Once the flux tilt is normalized to eliminate the equilibrium condition at indicated tilt (i.e., Required Action A.5 is performed), it is acceptable to return to full power operation. However, as an added check that the core power distribution at RTP is consistent with the safety analysis R.E. Ginna Nuclear Power Plant                      B 3.2.4-4                                Revision 42
 
QPTR B 3.2.4 assumptions, Required Action A.6 requires verification that FQ(Z) as approximated by FQC(Z) and FQW(Z), and FN'H are within their specified limits within 24 hours after reaching equilibrium condition at RTP. As an added precaution, if the core power does not reach equilibrium condition at RTP within 24 hours, but it increases slowly, then the peaking factor surveillances must be performed within 48 hours after increasing THERMAL POWER above the limit of Required Action A.1.
These Completion Times are intended to allow adequate time to increase THERMAL POWER to above the limit of Required Action A.1, while not permitting the core to remain with unconfirmed power distributions for extended periods of time.
Required Action A.6 is modified by a Note that states that the peaking factor surveillances may only be done after the excore detectors have been normalized to eliminate the indicated tilt (i.e., Required Action A.5). The intent of this Note is to have the peaking factor surveillances performed at operating power levels, which can only be accomplished after the excore detectors are adjusted to eliminate the indicated tilt and the core returned to power.
B.1 If Required Actions A.1 through A.6 are not completed within their associated Completion Times, the plant must be brought to a MODE or condition in which the requirements do not apply. To achieve this status, THERMAL POWER must be reduced to  50% RTP within 4 hours. The allowed Completion Time of 4 hours is reasonable, based on operating experience regarding the amount of time required to reach the reduced power level without challenging plant systems.
SURVEILLANCE              SR 3.2.4 .1 REQUIREMENTS This Surveillance verifies that the QPTR, as indicated by the Nuclear Instrumentation System (NIS) excore channels, is within its limits.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.2.4.1 is modified by two Notes. Note 1 allows QPTR to be calculated with three power range channels if THERMAL POWER is
                              < 75% RTP and one power range channel is inoperable. Note 2 allows performance of SR 3.2.4.2 in lieu of SR 3.2.4.1.
For those causes of quadrant power tilt that occur quickly (e.g., a dropped rod), there typically are other indications of abnormality that prompt a verification of the core power tilt.
R.E. Ginna Nuclear Power Plant                  B 3.2.4-5                                  Revision 77
 
QPTR B 3.2.4 SR 3.2.4.2 This surveillance is modified by a Note, which states that it is not required until 24 hours after the input from one or more Power Range Neutron Flux channel is inoperable and the THERMAL POWER is > 75% RTP.
With the input from a NIS power range channel inoperable, tilt monitoring for a portion of the reactor core becomes degraded. Large tilts are likely detected with the remaining channels, but the capability for detection of small power tilts in some quadrants is decreased.
When one NIS power range channel input is inoperable and THERMAL POWER is > 75% RTP, a full core flux map should be performed to verify the core power distribution. Performing a full core flux map provides an accurate alternative means for ensuring that FQ(Z) and FN'H remain within limits and the core power distribution is consistent with the safety analysis. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES            1. 10 CFR 50.46.
: 2. UFSAR, Section 15.4.5.
: 3. Atomic Industrial Forum (AIF) GDC 29, Issued for comment July 10, 1967.
R.E. Ginna Nuclear Power Plant                  B 3.2.4-6                                    Revision 77
 
RTS Instrumentation B 3.3.1 B 3.3    INSTRUMENTATION B 3.3.1      Reactor Trip System (RTS) Instrumentation BASES BACKGROUND            Atomic Industry Forum (AIF) GDC 14 (Ref. 1) requires that the core protection systems, together with associated engineered safety features equipment, be designed to prevent or suppress conditions that could result in exceeding acceptable fuel design limits. The RTS initiates a plant shutdown, based on the values of selected plant parameters, to protect against violating the core fuel design limits and Reactor Coolant System (RCS) pressure boundary during anticipated operational occurrences (AOOs) and to assist the Engineered Safety Features (ESF)
Systems in mitigating accidents.
The installed protection and monitoring systems have been designed to assure safe operation of the reactor at all times. This is achieved by specifying limiting safety system settings (LSSS) in terms of parameters directly monitored by the RTS, as well as specifying LCOs with respect to these parameters and other reactor system parameters and equipment.
Technical specifications are required by 10 CFR 50.36 to contain LSSS defined by the regulation as "...settings for automatic protective devices...so chosen that automatic protective action will correct the abnormal situation before a Safety Limit (SL) is exceeded." The Analytic Limit is the limit of the process variable at which a safety action is initiated, as established by the safety analysis, to ensure that a SL is not exceeded. Any automatic protection action that occurs on reaching the Analytic Limit therefore ensures that the SL is not exceeded. However, in practice, the actual settings for automatic protective devices must be chosen to be more conservative than the Analytic Limit to account for instrument loop uncertainties related to the setting at which the automatic protective action would actually occur.
The Calculated Trip Setpoint is a predetermined setting for a protective device chosen to ensure automatic actuation prior to the process variable reaching the Analytic Limit and thus ensuring that the SL would not be exceeded. As such, the Calculated Trip Setpoint accounts for uncertainties in setting the device (e.g. calibration), uncertainties in how the device might actually perform (e.g., repeatability), changes in the point of action of the device over time (e.g., drift during surveillance intervals), and any other factors which may influence its actual performance (e.g., harsh accident environments). In this manner, the Calculated Trip Setpoint plays an important role in ensuring that SLs are not exceeded. As such, the Calculated Trip Setpoint meets the definition of an LSSS and they are contained in the technical specifications.
R.E. Ginna Nuclear Power Plant                  B 3.3.1-1                                  Revision 61
 
RTS Instrumentation B 3.3.1 Technical specifications contain requirements related to the OPERABILITY of equipment required for safe operation of the facility.
OPERABLE is defined in technical specifications as "...being capable of performing its safety functions(s)." For automatic protective devices, the required safety function is to ensure that a SL is not exceeded and therefore the LSSS as defined by 10 CFR 50.36 serves as the OPERABILITY limit for the nominal trip setpoint. However, use of the LSSS (Calculated Trip Setpoint) to define OPERABILITY in technical specifications would be an overly restrictive requirement if it were applied as an OPERABILITY limit for the as-found value of a protective device setting during a surveillance. This would result in technical specification compliance problems, as well as reports and corrective actions required by the rule which are not necessary to ensure safety. For example, an automatic protective device with a setting that has been found to be different from the Calculated Trip Setpoint due to some drift of the setting may still be OPERABLE since drift is to be expected. This expected drift would have been specifically accounted for in the setpoint methodology for determining the Calculated Trip Setpoint and thus the automatic protective action would still have ensured that the SL would not be exceeded with the as-found setting of the protective device. Therefore, the device would still be OPERABLE since it would have performed its safety function and the only corrective action required would be to reset the device to within the tolerance band assumed in the determination of the Calculated Trip Setpoint to account for further drift during the next surveillance interval.
The Nominal Trip Setpoint is the desired setting specified within established plant procedures, and may be more conservative than the Calculated Trip Setpoint. The Nominal Trip Setpoint therefore may include additional margin to ensure that the SL would not be exceeded.
Use of the Calculated Trip Setpoint or Nominal Trip Setpoint to define as-found OPERABILITY, under the expected circumstances described above, would result in actions required by both the rule and technical specifications that are clearly not warranted. However, there is also some point beyond which the OPERABILITY of the device would be called into question, for example, greater than expected drift. This requirement needs to be specified in the technical specifications in order to define the OPERABILITY limit for the as-found trip setpoint and is designated as the Channel Operational Test (COT) Acceptance Criteria.
The COT Acceptance Criteria described in Table 3.3.1-1 serves as a confirmation of OPERABILITY, such that a channel is OPERABLE if the absolute difference between the as-found trip setpoint and the previously as-left trip setpoint does not exceed the assumed COT uncertainty during the performance of the COT. The COT uncertainty is primarily equal to the expected instrument loop uncertainties, such as drift, during the surveillance interval. In this manner, the actual setting of the device will still meet the LSSS definition and ensure that a Safety Limit is not exceeded at any given point of time as long as the device has not drifted beyond that expected during the surveillance interval. Note that, R.E. Ginna Nuclear Power Plant                B 3.3.1-2                                  Revision 61
 
RTS Instrumentation B 3.3.1 although the channel is "OPERABLE" under these circumstances, the trip setpoint should be left adjusted to a value within the established Nominal Trip Setpoint calibration tolerance band, in accordance with the uncertainty assumptions stated in the referenced setpoint methodology (as-left criteria), and confirmed to be operating within the statistical allowances of the uncertainty terms assigned. If the actual setting of the device is found to have exceeded the COT Acceptance Criteria the device would be considered inoperable from a technical specification perspective. This requires corrective action including those actions required by 10 CFR 50.36 when automatic protective devices do not function as required.
During Design Basis Accidents (DBAs), the acceptable limits are:
: a. The Safety Limit (SL) values shall be maintained to prevent departure from nucleate boiling (DNB);
: b. Fuel centerline melt shall not occur; and
: c. The RCS pressure SL of 2735 psig shall not be exceeded.
Operation within the SLs of Specification 2.0, "Safety Limits (SLs),"
maintains the above values and assures that offsite dose will be within 10 CFR 50.67 limits (Ref. 2) during AOOs.
DBAs are events that are analyzed even though they are not expected to occur during the plant life. The DBA acceptance limit is that offsite doses shall be maintained within an acceptable fraction of 10 CFR 50.67 limits (Ref. 2). There are five different accident categories which are organized based on the probability of occurrence (Ref. 3). Each accident category is allowed a different fraction of the 10 CFR 50.67 limits, inversely proportioned to the probability of occurrence. Meeting the acceptable dose limit for an accident category is considered as having acceptable consequences for that event.
The RTS instrumentation is segmented into three distinct but interconnected modules as described in UFSAR, Chapter 7 (Ref. 4):
: a. Field transmitters or process sensors;
: b. Signal process control and protection equipment; and
: c. Reactor trip switchgear.
These modules are shown in Figure B 3.3.1-1 and discussed in more detail below.
R.E. Ginna Nuclear Power Plant                B 3.3.1-3                                    Revision 61
 
RTS Instrumentation B 3.3.1 Field Transmitters and Process Sensors Field transmitters and process sensors provide a measurable electronic signal based on the physical characteristics of the parameter being measured. To meet the design demands for redundancy and reliability, two, three, and up to four field transmitters or sensors are used to measure required plant parameters. To account for the calibration tolerances and instrument drift, which is assumed to occur between calibrations, statistical allowances are provided. These statistical allowances provide the basis for determining acceptable as-left and as-found calibration values for each transmitter or sensor as provided in established plant procedures.
Signal Process Control and Protection Equipment The process control equipment provides signal conditioning, comparable output signals for instruments located on the main control board, and comparison of measured input signals with setpoints established by safety analyses. These setpoints are defined in UFSAR, Chapter 7 (Ref. 4), Chapter 6 (Ref. 5), and Chapter 15 (Ref. 6). If the measured value of a plant parameter exceeds the predetermined setpoint, an output from a bistable is forwarded to the logic relays.
Generally, three or four channels of process control equipment are used for the signal processing of plant parameters measured by the field transmitters and sensors. If a parameter is used only for input to the protection circuits, three channels with a two-out-of-three logic are typically sufficient to provide the required reliability and redundancy. If one channel fails in a direction that would not result in a partial Function trip, the Function can still be accomplished with a two-out-of-two logic. If one channel fails in a direction that a partial Function trip occurs, a trip will not occur unless a second channel fails or trips in the remaining one-out-of-two logic.
If a parameter has no measurable setpoint and is only used as an input to the protection circuits (e.g., manual trip functions) two channels with a one-out-of-two logic are sufficient. A third channel is not required since no surveillance testing is required during the time period in which the parameter is required.
R.E. Ginna Nuclear Power Plant              B 3.3.1-4                                      Revision 61
 
RTS Instrumentation B 3.3.1 If a parameter is used for input to the protection system and a control function, four channels with a two-out-of-four logic are typically sufficient to provide the required reliability and redundancy.
This ensures that the circuit is able to withstand both an input failure to the control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation. Therefore, a single failure will neither cause nor prevent the protection function actuation. These requirements are described in IEEE-279-1971 (Ref. 7).
The two, three, and four process control channels discussed above all feed two logic trains. Figure B 3.3.1-1 shows a two-out-of-four logic function which provides input into two logic trains (Train A and B). Two logic trains are required to ensure that no single failure of one logic train will disable the RTS. Provisions to allow removing logic trains from service during maintenance are unnecessary because of the logic system's designed reliability. During normal operation, the two logic trains remain energized.
Reactor Trip Switchgear The reactor trip switchgear includes the reactor trip breakers (RTBs) and bypass breakers as shown on Figure B 3.3.1-1. The RTBs are in the electrical power supply line from the control rod drive motor generator set power supply to the control rod drive mechanisms (CRDMs). Opening of the RTBs interrupts power to the CRDMs, which allows the shutdown rods and control rods to fall into the core by gravity and shutdown the reactor. Each RTB may be bypassed with a bypass breaker to allow testing of the RTB while the plant is at power. During normal operation, the output from the protection system is a voltage signal that energizes the undervoltage coils in the RTBs and bypass breakers, if in use.
When the required logic matrix combination is completed, the protection system output voltage signal is removed, the undervoltage coils are de-energized, the breaker trip lever is actuated by the de-energized undervoltage coil, and the RTBs and bypass breakers are tripped open allowing the shutdown rods and control rods to fall into the core. Therefore, a loss of power to the protection system or RTBs will cause a reactor trip. In addition to the de-energization of the undervoltage coils, each RTB is also equipped with a shunt trip device that is energized to trip the breaker open upon receipt of a reactor trip signal from the protection system (except for the zirconium guide tube trip which only utilizes the undervoltage coils). The bypass breakers also include a shunt trip device which is energized to trip the breaker upon receipt of a Manual Reactor Trip only. Either the undervoltage coil or the shunt trip mechanism is sufficient by itself to open the RTBs or bypass breaker, thus providing diverse trip mechanisms.
R.E. Ginna Nuclear Power Plant                B 3.3.1-5                                      Revision 61
 
RTS Instrumentation B 3.3.1 APPLICABLE                  The RTS functions to maintain the SLs during all AOOs and mitigates SAFETY                      the consequences of DBAs which initiate in any MODE in which the ANALYSES,                  RTBs are closed.
LCO, AND APPLICABILITY              Each of the analyzed accidents and transients can be detected by one or more RTS Functions. The accident analysis described in Reference 6 takes credit for most RTS trip Functions. RTS trip Functions not specifically credited in the accident analysis are qualitatively credited in the safety analysis and the NRC staff approved licensing basis for the plant. These RTS trip Functions may provide protection for conditions that do not require dynamic transient analysis to demonstrate Function performance. They may also serve as anticipatory trips to RTS trip Functions that were credited in the accident analysis.
The LCO requires all instrumentation performing an RTS Function, listed in Table 3.3.1-1 in the accompanying LCO, to be OPERABLE.
A channel is considered OPERABLE when:
: a.      The nominal trip setpoint is equal to or conservative with respect to the LSSS;
: b.      The absolute difference between the as-found trip setpoint and the previous as-left trip setpoint does not exceed the COT Acceptance Criteria; and
: c.      The as-left trip setpoint is within the established calibration tolerance band about the nominal trip setpoint.
The channel is still operable even if the as-left trip setpoint is non-conservative with respect to the LSSS provided that the as-left trip setpoint is within the established calibration tolerance band as specified in the Ginna Instrument Setpoint Methodology. Failure of any instrument renders the affected channel(s) inoperable and reduces the reliability of the affected Functions.
The LCO generally requires OPERABILITY of three or four channels in each instrumentation Function, two channels of Manual Reactor Trip in each logic Function, and two trains in each Automatic Trip Logic Function. Four OPERABLE instrumentation channels in a two-out-of-four configuration are required when one RTS channel is also used as a control system input. This configuration accounts for the possibility of the shared channel failing in such a manner that it creates a transient that requires RTS action. In this case, the RTS will still provide protection, even with random failure of one of the other three protection channels. Three operable instrumentation channels in a two-out-of-three configuration are generally required when there is no potential for control system and protection system interaction that could simultaneously R.E. Ginna Nuclear Power Plant                B 3.3.1-6                                    Revision 61
 
RTS Instrumentation B 3.3.1 create a need for a RTS trip and disable one RTS channel. The two-out-of-three and two-out-of-four configurations allow one channel to be tripped or bypassed during maintenance or testing without causing a reactor trip. Specific exceptions to the above general philosophy exist and are discussed below.
The LCO and Applicability of each RTS Function are provided in Table 3.3.1-1. Included on Table 3.3.1-1 are the LSSS for all applicable RTS Functions. LSSS for RTS Functions not specifically modeled in the safety analysis are based on established limits provided in the UFSAR (Reference 4). In situations where the Applicability is associated with a Reactor Trip System Interlock/Permissive (P-6, P-7, P-8, P-9, and P-10),
the Applicability value is to be treated as a Nominal value. The individual Interlock/Permissives, and hence the Applicability, have a setting tolerance which must be considered when determining whether the Applicability has been entered. The tolerance is specified within plant procedures.
The Calculated Trip Setpoints (which are equal to the LSSS) are based on the Analytical Limits stated in References 4, 5, and 6. The selection of these trip setpoints is such that adequate protection is provided when all sensor and processing time delays are taken into account. To allow for calibration tolerances, instrumentation uncertainties, instrument drift, and severe environment errors for those RTS channels that must function in harsh environments as defined by 10 CFR 50.49, the LSSS specified in Table 3.3.1-1 in the accompanying LCO are conservative with respect to the Analytical Limits. A detailed description of the methodology used to calculate the LSSS is provided in the "Instrument Setpoint/Loop Accuracy Calculation Methodology" (Ref. 8). The magnitudes of these uncertainties are factored into the determination of each trip setpoint and corresponding COT Acceptance Criteria. However, it should be noted that the COT Acceptance Criteria does not include the instrument setting tolerance. The COT Acceptance Criteria serves as the technical specification OPERABILITY limit for the purpose of the COT. If the absolute difference between the as-found trip setpoint and the previous as-left trip setpoint does not exceed the COT Acceptance Criteria, the bistable is considered OPERABLE.
The Nominal Trip Setpoint is the value at which the bistable is set and is the expected value to be achieved during calibration. The Nominal Trip Setpoint value ensures the LSSS and the safety analysis limits are met for surveillance interval selected when a channel is adjusted based on stated channel uncertainties. Any bistable is considered to be properly adjusted when the as-left trip setpoint is within the tolerance band assumed in the uncertainty analysis. The bistable is still operable even if the as-left trip setpoint is non-conservative with respect to the LSSS provided that the as-left trip setpoint is within the established calibration tolerance band as specified in the Ginna Instrument Setpoint Methodology.
R.E. Ginna Nuclear Power Plant                B 3.3.1-7                                    Revision 61
 
RTS Instrumentation B 3.3.1 Trip setpoints consistent with the requirements of the LSSS ensure that SLs are not violated during DBAs (and that the consequences of DBAs will be acceptable, providing the unit is operated from within the LCOs at the onset of the DBA and the equipment functions as designed).
The RTS utilizes various permissive signals to ensure reactor trip Functions are in the correct configuration for the current plant status.
These permissives back up operator actions to ensure protection system Functions are not bypassed during plant conditions under which the safety analysis assumes the Function is available.
In addition to the RTS Functions listed in Table 3.3.1-1, a zirconium guide tube trip function exists. This trip function was added to prevent potential damage to the control rod drive mechanisms when cooling down due to the different thermal expansion rates of zirconium and stainless steel.
This trip function is not credited in the accident analysis, and as such, is not addressed by this LCO. However, the trip function is used for testing the RTBs since the function only actuates the RTB undervoltage mechanism (versus shunt trip).
The safety analyses and OPERABILITY requirements applicable to each RTS Function and permissive provided in Table 3.3.1-1 are discussed below:
: 1. Manual Reactor Trip The Manual Reactor Trip Function ensures that the control room operator can initiate a reactor trip at any time by using either of two reactor trip pushbuttons on the main control board. A Manual Reactor Trip energizes the shunt trip device and de-energizes the undervoltage coils for the RTBs and bypass breakers. It is used at the discretion of the control room operators to shut down the reactor whenever any parameter is rapidly trending toward its Trip Setpoint or during other degrading plant conditions.
The LCO requires two Manual Reactor Trip channels to be OPERABLE. Each channel is controlled by a manual reactor trip pushbutton which actuates the reactor trip breaker in both trains.
Two independent channels are required to be OPERABLE so that no single failure will disable the Manual Reactor Trip Function. This function has no adjustable trip setpoint with which to associate an LSSS, therefore no setpoints are provided.
R.E. Ginna Nuclear Power Plant                B 3.3.1-8                                    Revision 61
 
RTS Instrumentation B 3.3.1 In MODE 1 or 2, manual initiation capability of a reactor trip must be OPERABLE. These are the MODES in which the shutdown rods and/or control rods are partially or fully withdrawn from the core. In MODE 3, 4, or 5, the manual initiation Function must also be OPERABLE if the RTBs are closed and the Control Rod Drive (CRD) System is capable of withdrawing the shutdown rods or the control rods. In this condition, inadvertent control rod withdrawal is possible. In MODE 3, 4, or 5, manual initiation of a reactor trip is not required to be OPERABLE if the CRD System is not capable of withdrawing the shutdown rods or control rods, or if one or more RTBs are open. If the rods cannot be withdrawn from the core, there is no need to be able to trip the reactor because all of the rods are inserted. In MODE 6, neither the shutdown rods nor the control rods are permitted to be withdrawn and the CRDMs are disconnected from the control rods and shutdown rods. Therefore, the manual initiation Function is not required.
: 2. Power Range Neutron Flux The Power Range Neutron Flux trip Function ensures that protection is provided against an uncontrolled RCCA bank rod withdrawal accident. The Nuclear Instrumentation System (NIS) power range detectors (N-41, N-42, N-43, and N-44) are located external to the reactor vessel and measure neutrons leaking from the core. The NIS power range detectors provide input to the CRD System for determination of automatic rod speed and direction.
Therefore, the actuation logic must be able to withstand an input failure to the control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation.
: a. Power Range Neutron Flux-High The Power Range Neutron Flux-High trip Function ensures that protection is provided, from all power levels, against a positive reactivity excursion leading to DNB during power operations. These reactivity excursions can be caused by rod withdrawal or reductions in RCS temperature. Note that this Function also provides a signal to prevent manual rod withdrawal prior to initiating a reactor trip. Limiting further rod withdrawal may terminate the transient and eliminate the need to trip the reactor.
The LCO requires all four of the Power Range Neutron Flux-High trip Function channels to be OPERABLE.
In MODE 1 or 2, when a positive reactivity excursion could occur, the Power Range Neutron Flux-High trip must be OPERABLE. This Function will terminate the reactivity excursion and shut down the reactor prior to reaching a R.E. Ginna Nuclear Power Plant              B 3.3.1-9                                      Revision 61
 
RTS Instrumentation B 3.3.1 power level that could damage the fuel. In MODE 3, 4, 5, or 6, the NIS power range detectors cannot detect neutron levels in this range. In these MODES, the Power Range Neutron Flux-High trip Function is not required to be OPERABLE because the reactor is shut down and reactivity excursions into the power range are extremely unlikely.
Other RTS Functions and administrative controls provide protection against reactivity additions when in MODE 3, 4, 5, or 6.
: b. Power Range Neutron Flux-Low The LCO requirement for the Power Range Neutron Flux-Low trip Function ensures that protection is provided against a positive reactivity excursion from low power or subcritical conditions.
The LCO requires all four of the Power Range Neutron Flux-Low trip Function channels (N-41, N-42, N-43, and N-44) to be OPERABLE.
In MODE 1, below 6% RTP, and in MODE 2, the Power Range Neutron Flux-Low trip must be OPERABLE. This Function may be manually blocked by the operator when two-out-of-four power range channels are greater than approximately 8% RTP (P-10 setpoint). This Function is automatically unblocked when three-out-of-four power range channels are below the P-10 setpoint. Above the P-10 setpoint, positive reactivity additions are mitigated by the Power Range Neutron Flux-High trip Function.
In MODE 3, 4, 5, or 6, the Power Range Neutron Flux-Low trip Function is not required to be OPERABLE because the reactor is shut down and the NIS power range detectors cannot detect neutron levels in this range. Other RTS trip Functions and administrative controls provide protection against positive reactivity additions or power excursions in MODE 3, 4, 5, or 6.
R.E. Ginna Nuclear Power Plant          B 3.3.1-10                                  Revision 61
 
RTS Instrumentation B 3.3.1
: 3. Intermediate Range Neutron Flux The Intermediate Range Neutron Flux trip Function ensures that protection is provided against an uncontrolled RCCA bank rod withdrawal accident from a subcritical condition. This trip Function provides redundant protection to the Power Range Neutron Flux-Low trip Function and is not specifically modeled in the accident analysis. The NIS intermediate range detectors (N-35 and N-36) are located external to the reactor vessel and measure neutrons leaking from the core. The NIS intermediate range detectors do not provide any input to control systems. Note that this Function also provides a signal to prevent manual rod withdrawal prior to initiating a reactor trip. Limiting further rod withdrawal may terminate the transient and eliminate the need to trip the reactor.
The LCO requires two channels of the Intermediate Range Neutron Flux trip Function to be OPERABLE. Two OPERABLE channels are sufficient to ensure no single failure will disable this trip Function. Because this trip Function is important only during low power conditions, there is generally no need to disable channels for testing while the Function is required to be OPERABLE. Therefore, a third channel is unnecessary.
In MODE 1 below 6% RTP, and in MODE 2,The Intermediate Range Neutron Flux trip Function must be OPERABLE since there is a potential for an uncontrolled RCCA bank rod withdrawal accident. This Function may be manually blocked by the operator when two-out-of-four power range channels are greater than approximately 8% RTP (P-10 setpoint). Above the P-10 setpoint, the Power Range Neutron Flux-High trip provides core protection for a rod withdrawal accident. In MODE 3, 4, or 5, the Intermediate Range Neutron Flux trip Function is not required to be OPERABLE because the NIS intermediate range detectors cannot detect neutron levels in this range. Other RTS trip Functions and administrative controls provide protection against reactivity additions or power excursions in MODE 3, 4, 5, or 6.
R.E. Ginna Nuclear Power Plant              B 3.3.1-11                                    Revision 61
 
RTS Instrumentation B 3.3.1
: 4. Source Range Neutron Flux The LCO requirement for the Source Range Neutron Flux trip Function ensures that protection is provided against an uncontrolled RCCA bank rod withdrawal accident from a subcritical condition and provides protection against boron dilution and rod ejection events. This trip Function provides redundant protection to the Power Range Neutron Flux-Low and Intermediate Range Neutron Flux trip Functions in MODE 2 and is not specifically credited in the accident analysis at these conditions. The NIS source range detectors (N-31 and N-32) are located external to the reactor vessel and measure neutrons leaking from the core. The NIS source range detectors do not provide any inputs to control systems. The source range trip is the only RTS automatic protection function required in MODES 3, 4, and 5. Therefore, the functional capability at the specified Trip Setpoint is assumed to be available.
The LCO requires two channels of Source Range Neutron Flux trip Function to be OPERABLE. Two OPERABLE channels are sufficient to ensure no single failure will disable this trip Function.
The LCO also requires one channel of the Source Range Neutron Flux trip Function to be OPERABLE in MODE 3, 4, or 5 with the CRD System not capable of rod withdrawal and all rods fully inserted. In this case, the source range Function is to provide control room indication. The outputs of the Function to RTS logic are not required to be OPERABLE when the CRD system is not capable of rod withdrawal and all rods fully inserted.
The Source Range Neutron Flux Trip Function provides protection for control rod withdrawal from subcritical, boron dilution and control rod ejection events. The Function also provides visual neutron flux indication in the control room.
In MODE 2 when both intermediate range channels are < 5E-11 amps (below the P-6 setpoint), the Source Range Neutron Flux trip Function must be OPERABLE. Above the P-6 setpoint, the Intermediate Range Neutron Flux trip and the Power Range Neutron Flux-Low trip will provide core protection for reactivity accidents. Above the P-6 setpoint, the NIS source range detectors are manually de-energized by the operator and are inoperable.
R.E. Ginna Nuclear Power Plant              B 3.3.1-12                                    Revision 61
 
RTS Instrumentation B 3.3.1 In MODE 3, 4, or 5 with the CRD System capable of rod withdrawal or all rods are not fully inserted, the Source Range Neutron Flux trip Function must be OPERABLE to provide core protection against a rod withdrawal accident. If the CRD System is not capable of rod withdrawal and all rods are fully inserted, the source range detectors are not required to trip the reactor.
However, their monitoring Function must be OPERABLE to monitor core neutron levels and provide indication of reactivity changes that may occur as a result of events like a boron dilution.
The requirements for the NIS source range detectors in MODE 6 are addressed in LCO 3.9.2, "Nuclear Instrumentation."
: 5. Overtemperature 'T The Overtemperature 'T trip Function is provided to ensure that the design limit departure from nucleate boiling ratio (DNBR) is met.
This trip Function also limits the range over which the Overpower
                            'T trip Function must provide protection. The inputs to the Overtemperature 'T trip include pressure, Tavg, axial power distribution, and reactor power as indicated by loop 'T assuming full reactor coolant flow. Protection from violating the DNBR limit is assured for those transients that are slow with respect to delays from the core to the measurement system. The Overtemperature
                            'T trip Function monitors both variation in power and flow since a decrease in flow has the same effect on 'T as a power increase.
The Overtemperature 'T trip Function uses the 'T of each loop as a measure of reactor power and is compared with a setpoint that is automatically varied with the following parameters:
* reactor coolant average temperature - the Trip Setpoint is varied to correct for changes in coolant density and specific heat capacity with changes in coolant temperature;
* pressurizer pressure - the Trip Setpoint is varied to correct for changes in system pressure; and
* axial power distribution f('I) - the Trip Setpoint is varied to account for imbalances in the axial power distribution as detected by the NIS upper and lower power range detectors.
If axial peaks are greater than the design limit, as indicated by the difference between the upper and lower NIS power range detectors, the Trip Setpoint is reduced in accordance with Note 1 of Table 3.3.1-1.
Dynamic compensation is included for system piping delays from the core to the temperature measurement system.
R.E. Ginna Nuclear Power Plant                B 3.3.1-13                                  Revision 61
 
RTS Instrumentation B 3.3.1 The Overtemperature 'T trip Function is calculated in two channels for each loop as described in Note 1 of Table 3.3.1-1. A reactor trip occurs if the Overtemperature 'T Trip Setpoint is reached in two-out-of-four channels. Since the pressure and temperature signals are used for other control functions, the actuation logic must be able to withstand an input failure to the control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation.
Section 7.2.5 of Reference 4 discusses control and protection system interactions for this function. Note that this Function also provides a signal to generate a turbine runback prior to reaching the Trip Setpoint. A turbine runback will reduce turbine power and reactor power. A reduction in power will normally alleviate the Overtemperature 'T condition and may prevent an unnecessary reactor trip.
The LCO requires all four channels of the Overtemperature 'T trip Function to be OPERABLE. Note that the Overtemperature 'T Function receives input from channels shared with other RTS Functions. Failures that affect multiple Functions require entry into the Conditions applicable to all affected Functions.
In MODE 1 or 2, the Overtemperature 'T trip must be OPERABLE to prevent DNB. In MODE 3, 4, 5, or 6, this trip Function is not required to be OPERABLE because the reactor is not operating and there is insufficient heat production to be concerned about DNB.
: 6. Overpower 'T The Overpower 'T trip Function ensures that protection is provided to ensure the integrity of the fuel (i.e., no fuel pellet melting and less than 1% cladding failure) under all possible overpower conditions. This trip Function also limits the required range of the Overtemperature 'T trip Function and provides a backup to the Power Range Neutron Flux-High Setpoint trip. The Overpower 'T trip Function ensures that the allowable heat generation rate (kW/ft) of the fuel is not exceeded. It uses the 'T of each loop as a measure of reactor power with a setpoint that is automatically varied with the following parameters:
* reactor coolant average temperature - the Trip Setpoint is varied to correct for changes in coolant density and specific heat capacity with changes in coolant temperature; and
* rate of change of reactor coolant average temperature -
including dynamic compensation for the delays between the core and the temperature measurement system.
R.E. Ginna Nuclear Power Plant              B 3.3.1-14                                  Revision 61
 
RTS Instrumentation B 3.3.1 The Overpower 'T trip Function is calculated in two channels for each loop as described in Note 2 of Table 3.3.1-1. A reactor trip occurs if the Overpower 'T trip setpoint is reached in two-out-of-four channels. Since the temperature signals are used for other control functions, the actuation logic must be able to withstand an input failure to the control system, which may then require the protection function actuation and a single failure in the remaining channels providing the protection function actuation. Section 7.2.5 of Reference 4 discusses control and protection system interactions for this function. Note that this Function also provides a signal to generate a turbine runback prior to reaching the Trip Setpoint. A turbine runback will reduce turbine power and reactor power. A reduction in power will normally alleviate the Overpower
                            'T condition and may prevent an unnecessary reactor trip.
The LCO requires four channels of the Overpower 'T trip Function to be OPERABLE. Note that the Overpower 'T trip Function receives input from channels shared with other RTS Functions.
Failures that affect multiple Functions require entry into the Conditions applicable to all affected Functions.
In MODE 1 or 2, the Overpower 'T trip Function must be OPERABLE. These are the only MODES where enough heat is generated in the fuel to be concerned about the heat generation rates and overheating of the fuel. In MODE 3, 4, 5, or 6, this trip Function is not required to be OPERABLE because the reactor is not operating and there is insufficient heat production to be concerned about fuel overheating and fuel damage.
: 7. Pressurizer Pressure The same sensors (PT-429, PT-430, and PT-431) provide input to the Pressurizer Pressure-High and -Low trips and the Overtemperature 'T trip with the exception that the Pressurizer Pressure-Low and Overtemperature 'T trips also receive input from PT-449. Since the Pressurizer Pressure channels are also used for other control functions, the actuation logic must be able to withstand an input failure to the control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation.
Section 7.2.5 of Reference 4 discusses control and protection system interactions for this function.
: a. Pressurizer Pressure-Low The Pressurizer Pressure-Low trip Function ensures that protection is provided against violating the DNBR limit due to low pressure. The LCO requires four channels of the Pressurizer Pressure-Low trip Function to be OPERABLE.
R.E. Ginna Nuclear Power Plant              B 3.3.1-15                                  Revision 61
 
RTS Instrumentation B 3.3.1 In MODE 1, when DNB is a major concern, the Pressurizer Pressure-Low trip function must be OPERABLE. This trip Function is automatically enabled on increasing power by the P-7 interlock (approximately 8% RTP). On decreasing power, this trip Function is automatically blocked below P-7. Below the P-7 setpoint, the Pressurizer Pressure-Low trip Function is not required to be OPERABLE because no conceivable power distributions can occur that would cause DNB concerns.
: b. Pressurizer Pressure-High The Pressurizer Pressure-High trip Function ensures that protection is provided against overpressurizing the RCS.
This trip Function operates in conjunction with the pressurizer relief and safety valves to prevent RCS overpressure conditions. The LCO requires three channels of the Pressurizer Pressure-High trip Function to be OPERABLE.
In MODE 1 or 2, the Pressurizer Pressure-High trip Function must be OPERABLE to help prevent RCS overpressurization and minimize challenges to the relief and safety valves. In MODE 3, 4, 5, or 6, the Pressurizer Pressure-High trip Function is not required to be OPERABLE because transients that could cause an overpressure condition will be slow to occur. Therefore, the operator will have sufficient time to evaluate plant conditions and take corrective actions.
Additionally, low temperature overpressure protection systems provide overpressure protection when in or below MODE 4.
: 8. Pressurizer Water Level-High The Pressurizer Water Level-High trip Function provides a backup signal for the Pressurizer Pressure-High trip and also provides protection against water relief through the pressurizer safety valves. These valves are designed to pass steam in order to achieve their design energy removal rate. A reactor trip is actuated prior to the pressurizer becoming water solid. This trip Function is not specifically modeled in the accident analysis.
R.E. Ginna Nuclear Power Plant                B 3.3.1-16                                Revision 61
 
RTS Instrumentation B 3.3.1 The LCO requires three channels of the Pressurizer Water Level-High trip Function to be OPERABLE. The pressurizer level channels (LT-426, LT-427, and LT-428) are also used for other control functions. Section 7.2.5 of Reference 4 discusses control and protection system interactions for this function. The level channels do not actuate the safety valves, and the high pressure reactor trip is set below the safety valve setting. Therefore, with the slow rate of charging available, pressure overshoot due to level channel failure cannot cause the safety valve to lift before the reactor high pressure trip.
In MODE 1 or 2, when there is a potential for overfilling the pressurizer, the Pressurizer Water Level-High trip Function must be OPERABLE. In MODES 3, 4, 5, or 6, the Pressurizer Water Level-High trip Function is not required to be OPERABLE because transients that could raise the pressurizer water level will be slow and the operator will have sufficient time to evaluate plant conditions and take corrective actions.
: 9. Reactor Coolant Flow-Low The Reactor Coolant Flow-Low (Single Loop) and (Two Loops) trip Functions utilize three common flow transmitters per RCS loop to generate a reactor trip above approximately 8% RTP (P-7 setpoint).
Flow transmitters FT-411, FT-412, and FT-413 are used for RCS Loop A and FT-414, FT-415, and FT-416 are used for RCS Loop B.
: a. Reactor Coolant Flow-Low (Single Loop)
The Reactor Coolant Flow-Low (Single Loop) trip Function ensures that protection is provided against violating the DNBR limit due to low flow in the RCS loop, while avoiding reactor trips due to normal variations in loop flow. Above the P-8 setpoint, (approximately 25% RTP), a loss of flow in either RCS loop will actuate a reactor trip. Each RCS loop has three flow detectors to monitor flow. The flow signals are not used for any control system input.
The LCO requires three Reactor Coolant Flow-Low (Single Loop) trip Function channels per RCS loop to be OPERABLE in MODE 1  30% RTP (above P-8 setpoint). Each loop is considered a separate Function for the purpose of this LCO.
In MODE 1 above the P-8 setpoint, a loss of flow in one RCS loop could result in DNB conditions in the core. In MODE 1 below the P-8 setpoint the Reactor Coolant Flow-Low (Single Loop) trip Function is not required to be OPERABLE because a loss of flow in one loop has been evaluated and found to be acceptable (Ref. 6).
R.E. Ginna Nuclear Power Plant                B 3.3.1-17                                Revision 61
 
RTS Instrumentation B 3.3.1
: b. Reactor Coolant Flow-Low (Two Loops)
The Reactor Coolant Flow-Low (Two Loops) trip Function ensures that protection is provided against violating the DNBR limit due to low flow in both RCS loops while avoiding reactor trips due to normal variations in loop flow.
The LCO requires three Reactor Coolant Flow-Low (Two Loops) trip Function channels per loop to be OPERABLE in MODE 1 above approximately 8% RTP (the P-7 setpoint) and before the Reactor Coolant Flow-Low (Single Loop) trip Function is OPERABLE (below the P-8 setpoint). Each loop is considered a separate Function for the purpose of this LCO.
Above the P-7 setpoint and below the P-8 setpoint, a loss of flow in both loops will initiate a reactor trip. Each loop has three flow detectors to monitor flow. The flow signals are not used for any control system input.
Below the P-7 setpoint, this trip Function is not required to be OPERABLE because all reactor trips on low flow are automatically blocked since no conceivable power distributions could occur that would cause a DNB concern at this low power level. Above the P-7 setpoint, the reactor trip on low flow in both RCS loops is automatically enabled.
Above the P-8 setpoint, the Reactor Coolant Flow-Low (Two Loops) trip Function is not required to be OPERABLE because loss of flow in any one loop will actuate a reactor trip because of the higher power level and the reduced margin to the design limit DNBR.
: 10. RCP Breaker Position Both RCP Breaker Position trip Functions (Single Loop and Two Loops) utilize a common auxiliary contact located on each RCP.
These Functions anticipate the Reactor Coolant Flow-Low trips to avoid RCS heatup that would occur before the low flow trip actuates but are not specifically credited in the accident analysis.
: a. Reactor Coolant Pump Breaker Position (Single Loop)
The RCP Breaker Position (Single Loop) trip Function ensures that protection is provided against violating the DNBR limit due to a loss of flow in one RCS loop. The position of each RCP breaker is monitored. If one RCP breaker is open above approximately 25% RTP, a reactor trip is initiated. This trip Function will generate a reactor trip before the Reactor Coolant Flow-Low (Single Loop) Trip Setpoint is reached.
R.E. Ginna Nuclear Power Plant              B 3.3.1-18                                    Revision 61
 
RTS Instrumentation B 3.3.1 The LCO requires one RCP Breaker Position trip Function channel per RCP to be OPERABLE in MODE 1  30% RTP (above the P-8 setpoint). Each RCP is considered a separate Function for the purpose of this LCO. One OPERABLE channel is sufficient for this trip Function because the RCS Flow-Low trip alone provides sufficient protection of plant SLs for loss of flow events. The RCP Breaker Position trip serves only to anticipate the low flow trip, minimizing the thermal transient associated with loss of a pump.
This Function measures only the discrete position (open or closed) of the RCP breaker, using a position switch.
Therefore, the Function has no adjustable trip setpoint with which to associate an LSSS.
In MODE 1 above the P-8 setpoint, when a loss of flow in any RCS loop could result in DNB conditions in the core, the RCP Breaker Position (Single Loop) trip Function must be OPERABLE. In MODE 1 below the P-8 setpoint, the RCP Breaker Position (Single Loop) trip Function is not required to be OPERABLE because a loss of flow in one loop has been evaluated and found to be acceptable (Ref. 6).
: b. RCP Breaker Position (Two Loops)
The RCP Breaker Position (Two Loops) trip Function ensures that protection is provided against violating the DNBR limit due to a loss of flow in both RCS loops. The position of each RCP breaker is monitored. If both RCP breakers are open above approximately 8% RTP (P-7 setpoint) and before the RCP Breaker Position (Single Loop) trip Function is OPERABLE (below the P-8 setpoint), a reactor trip is initiated. This trip Function will generate a reactor trip before the Reactor Coolant Flow-Low (Two Loops) Trip Setpoint is reached.
The LCO requires one RCP Breaker Position trip Function channel per RCP to be OPERABLE in MODE 1 above the P-7 and below the P-8 setpoints. Each RCP is considered a separate Function for the purpose of this LCO. One OPERABLE channel is sufficient for this Function because the RCS Flow-Low trip alone provides sufficient protection of plant SLs for loss of flow events. The RCP Breaker Position trip serves only to anticipate the low flow trip, minimizing the thermal transient associated with loss of an RCP.
This Function measures only the discrete position (open or closed) of the RCP breaker, using a position switch.
Therefore, the Function has no adjustable trip setpoint with which to associate an LSSS.
R.E. Ginna Nuclear Power Plant          B 3.3.1-19                                    Revision 61
 
RTS Instrumentation B 3.3.1 In MODE 1 above the P-7 setpoint and below the P-8 setpoint, the RCP Breaker Position (Two Loops) trip Function must be OPERABLE. Below the P-7 setpoint, all reactor trips on loss of flow (including RCP breaker position) are automatically blocked since no conceivable power distributions could occur that would cause a DNB concern at this low power level. Above the P-7 setpoint, the reactor trip on loss of flow in both RCS loops is automatically enabled.
Above the P-8 setpoint, the RCP Breaker Position (Two Loops) trip Function is not required to be OPERABLE because a loss of flow in any one loop will actuate a reactor trip because of the higher power level and the reduced margin to the design limit DNBR.
: 11. Undervoltage-Bus 11A and 11B The Undervoltage-Bus 11A and 11B reactor trip Function ensures that protection is provided against violating the DNBR limit due to a loss of flow in both RCS loops from a major network voltage disturbance. The voltage to each RCP is monitored. Above approximately 8% RTP (the P-7 setpoint), an undervoltage condition detected on both Buses 11A and 11B will initiate a reactor trip. This trip Function will generate a reactor trip before the Reactor Coolant Flow-Low (Two Loops) Trip Setpoint is reached.
Time delays are incorporated into the Undervoltage Bus 11A and 11B channels to prevent reactor trips due to momentary electrical power transients.
The LCO requires two Undervoltage-Bus 11A and 11B trip Function channels per bus to be OPERABLE in MODE 1 above the P-7 setpoint. Each bus is considered a separate Function for the purpose of this LCO.
Below the P-7 setpoint, the Undervoltage-Bus 11A and 11B trip Function is not required to be OPERABLE because all reactor trips on loss of flow are automatically blocked since no conceivable power distributions could occur that would cause a DNB concern at this low power level. Above the P-7 setpoint, the reactor trip on Undervoltage-Bus 11A and 11B is automatically enabled.
: 12. Underfrequency-Bus 11A and 11B The Underfrequency-Bus 11A and 11B reactor trip Function ensures that protection is provided against violating the DNBR limit due to a loss of flow in both RCP loops from a major network frequency disturbance. An underfrequency condition will slow down the pumps, thereby reducing their coastdown time following a pump trip. The proper coastdown time is required so that reactor heat can be removed immediately after reactor trip. The frequency of each RCP bus is monitored. Above approximately 8% RTP (the R.E. Ginna Nuclear Power Plant              B 3.3.1-20                                    Revision 61
 
RTS Instrumentation B 3.3.1 P-7 setpoint), a loss of frequency detected on both RCP buses will initiate a reactor trip. This trip Function will generate a reactor trip before the Reactor Coolant Flow-Low (Two Loops) Trip Setpoint is reached. Time delays are incorporated into the Underfrequency RCPs channels to prevent reactor trips due to momentary electrical power transients.
The LCO requires two Underfrequency-Bus 11A and 11B channels per bus to be OPERABLE in Mode 1 above the P-7 setpoint. Each bus is considered a separate Function for the purpose of this LCO.
Below the P-7 setpoint, all reactor trips on loss of flow are automatically blocked since no conceivable power distributions could occur that would cause a DNB concern at this low power level. Above the P-7 setpoint, the reactor trip on Underfrequency-Bus 11A and 11B is automatically enabled.
: 13. Steam Generator Water Level-Low Low The Steam Generator (SG) Water Level-Low Low trip Function ensures that protection is provided against a loss of heat sink and actuates the Auxiliary Feedwater (AFW) System prior to uncovering the SG tubes. The SGs are the heat sink for the reactor. In order to act as a heat sink, the SGs must contain a minimum amount of water. A narrow range low low level in any SG is indicative of a loss of heat sink for the reactor. Three level transmitters per SG (LT-461, LT-462, and LT-463 for SG A and, LT-471, LT-472, and LT-473 for SG B) provide input to the SG Level Control System.
Therefore, the actuation logic must be able to withstand an input failure to the control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation. This Function also performs the Engineered Safety Feature Actuation System (ESFAS) function of starting the AFW pumps on low low SG level.
The AFW System is the safety related backup source of water to ensure that the SGs remain the heat sink for the reactor.
The LCO requires three trip Function channels of SG Water Level-Low Low per SG to be OPERABLE in MODES 1 and 2. Each SG is considered a separate Function for the purpose of this LCO.
In MODE 1 or 2, the SG Water Level-Low Low trip Function must be OPERABLE to ensure that a heat sink is available to the reactor.
In MODE 3, 4, 5, or 6, the SG Water Level-Low Low trip Function is not required to be OPERABLE because the reactor is not operating. Decay heat removal is accomplished by the AFW System in MODE 3 and by the Residual Heat Removal (RHR)
System in MODE 4, 5, or 6.
R.E. Ginna Nuclear Power Plant              B 3.3.1-21                                    Revision 61
 
RTS Instrumentation B 3.3.1
: 14. Turbine Trip Credit for these trip Functions is not credited in the accident analysis.
: a. Turbine Trip-Low Autostop Oil Pressure The Turbine Trip-Low Autostop Oil Pressure trip Function anticipates the loss of heat removal capabilities of the secondary system following a turbine trip from a power level above the P-9 setpoint. Below the P-9 setpoint this action will not actuate a reactor trip. The trip Function anticipates the loss of secondary heat removal capability that occurs when the stop valves close. Tripping the reactor in anticipation of loss of secondary heat removal acts to minimize the pressure and temperature transient on the reactor. Three pressure switches monitor the control oil pressure in the Autostop Oil System. A low pressure condition sensed by two-out-of-three pressure switches will actuate a reactor trip. These pressure switches do not provide any input to the control system. The plant is designed to withstand a complete loss of load and not sustain core damage or challenge the RCS pressure limitations. Core protection is provided by the Pressurizer Pressure-High trip Function and RCS integrity is ensured by the pressurizer safety valves.
The LCO requires three trip Function channels of Turbine Trip-Low Autostop Oil Pressure to be OPERABLE in MODE 1 above P-9.
Below the P-9 setpoint, the Turbine Trip-Low Autostop Oil Pressure trip Function is not required to be OPERABLE because load rejection can be accommodated by the steam dump system. Therefore, a turbine trip does not actuate a reactor trip. In MODE 2, 3, 4, 5, or 6, the turbine is not operating, therefore, there is no potential for a turbine trip.
: b. Turbine Trip-Turbine Stop Valve Closure The Turbine Trip-Turbine Stop Valve Closure trip Function anticipates the loss of heat removal capabilities of the secondary system following a turbine trip from a power level above the P-9 setpoint. Below the P-9 setpoint this action will not actuate a reactor trip. The trip Function anticipates the loss of secondary heat removal capability that occurs when the stop valves close. Tripping the reactor in anticipation of loss of secondary heat removal acts to minimize the pressure and temperature transient on the reactor. This trip Function will not and is not required to operate in the presence of a single channel failure. The plant is designed to withstand a R.E. Ginna Nuclear Power Plant              B 3.3.1-22                                  Revision 61
 
RTS Instrumentation B 3.3.1 complete loss of load and not sustain core damage or challenge the RCS pressure limitations. Core protection is provided by the Pressurizer Pressure-High trip Function, and RCS integrity is ensured by the pressurizer safety valves.
This trip Function is diverse to the Turbine Trip-Low Autostop Oil Pressure trip Function. Each turbine stop valve is equipped with one limit switch that inputs to the RTS. If both limit switches indicate that the stop valves are closed, a reactor trip is initiated.
This Function only measures the discrete position (open or closed) of the turbine stop valves. Therefore, the Function has no adjustable trip setpoint with which to associate an LSSS.
The LCO requires two Turbine Trip-Turbine Stop Valve Closure trip Function channels, one per valve, to be OPERABLE in MODE 1 above P-9. Both channels must trip to cause reactor trip.
Below the P-9 setpoint, the Turbine Trip-Turbine Stop Valve Closure trip Function is not required to be OPERABLE because a load rejection can be accommodated by the steam dump system. Therefore, a turbine trip does not actuate a reactor trip. In MODE 2, 3, 4, 5, or 6, the turbine is not operating, therefore there is no potential for a turbine trip.
: 15. Safety Injection Input from Engineered Safety Feature Actuation System The Safety Injection (SI) Input from ESFAS ensures that if a reactor trip has not already been generated by the RTS, the ESFAS automatic actuation logic will initiate a reactor trip upon any signal that initiates SI. This trip is assumed in the safety analyses for the loss of coolant accident (LOCA). However, other transients and accidents take credit for varying levels of ESF performance and rely upon rod insertion, except for the most reactive rod that is assumed to be fully withdrawn, to ensure reactor shutdown. Therefore, a reactor trip is initiated every time an SI signal is present.
Trip Setpoints are not applicable to this Function. The SI Input is provided by relays in the ESFAS. Therefore, there is no measurement signal with which to associate an LSSS.
The LCO requires two trip Function channels of SI Input from ESFAS to be OPERABLE in MODE 1 or 2.
R.E. Ginna Nuclear Power Plant                B 3.3.1-23                                  Revision 61
 
RTS Instrumentation B 3.3.1 A reactor trip is initiated every time an SI signal is present.
Therefore, this trip Function must be OPERABLE in MODE 1 or 2, when the reactor is critical, and must be shut down in the event of an accident. In MODE 3, 4, 5, or 6, the reactor is not critical, and this trip Function does not need to be OPERABLE.
: 16. Reactor Trip System Interlocks Reactor protection interlocks (i.e., permissives) are provided to ensure reactor trips are in the correct configuration for the current plant status. They back up operator actions to ensure protection system Functions are not bypassed during plant conditions under which the safety analysis assumes the Functions are not bypassed.
Therefore, the interlock Functions do not need to be OPERABLE when the associated reactor trip functions are outside the applicable MODES.
These are:
: a.      Intermediate Range Neutron Flux, P-6 Permissive The Intermediate Range Neutron Flux, P-6 permissive is actuated when any NIS intermediate range channel goes approximately one decade (1 E-10 amps) above the minimum channel reading. If both channels drop below the setpoint, the permissive will automatically be defeated. The LCO requirement for the P-6 permissive ensures that the following Functions are performed:
* on increasing power, the P-6 interlock allows the manual block of the NIS Source Range, Neutron Flux reactor trip by use of two defeat push buttons. This prevents a premature block of the source range trip and allows the operator to ensure that the intermediate range is OPERABLE prior to leaving the source range.
When the source range trip is blocked, the high voltage to the detectors is also removed; and
* on decreasing power, the P-6 interlock automatically energizes the NIS source range detectors and enables the Source Range Neutron Flux reactor trip at 5E-11 amps.
The LCO requires two channels of Intermediate Range Neutron Flux, P-6 permissive to be OPERABLE in MODE 2 when below the P-6 permissive setpoint.
R.E. Ginna Nuclear Power Plant                B 3.3.1-24                                  Revision 61
 
RTS Instrumentation B 3.3.1 Above the P-6 permissive setpoint, the Source Range Neutron Flux reactor trip will be blocked, and this Function is no longer required.
In MODE 3, 4, 5, or 6 the P-6 permissive does not have to be OPERABLE because the Source Range is providing the required core protection.
: b. Low Power Reactor Trips Block, P-7 Permissive The Low Power Reactor Trips Block, P-7 interlock is actuated by input from either the Power Range Neutron Flux, P-10, or from first stage turbine pressure. The LCO requirement for the P-7 permissive allows the bypass of the following Functions:
* Pressurizer Pressure-Low;
* Reactor Coolant Flow-Low (Two Loops);
* RCP Breaker Position (Two Loops);
* Undervoltage-Bus 11A and 11B; and
* Underfrequency-Bus 11A and 11B.
These reactor trip functions are not required below the P-7 setpoint since the RCS is capable of providing sufficient natural circulation without any RCP running.
The LCO requires four channels of Low Power Reactor Trips Block, P-7 permissive to be OPERABLE in MODE 1  8.5%
RTP.
In MODE 2, 3, 4, 5, or 6, this Function does not have to be OPERABLE because the permissive performs its Function when power level drops below 8.5% power, which is in MODE 1.
R.E. Ginna Nuclear Power Plant          B 3.3.1-25                                  Revision 61
 
RTS Instrumentation B 3.3.1
: c. Power Range Neutron Flux, P-8 Permissive The Power Range Neutron Flux, P-8, permissive is actuated at approximately 25% power as determined by two-out-of-four NIS power range detectors. The P-8 interlock allows the Reactor Coolant Flow-Low (Single Loop) and RCP Breaker Position (Single Loop) reactor trips on low flow in one or more RCS loops to be blocked so that a loss of a single loop will not cause a reactor trip. The LCO requirement for this trip Functions ensures that protection is provided against a loss of flow in any RCS loop that could result in DNB conditions in the core when  30% power.
The LCO requires four channels of Power Range Neutron Flux, P-8 interlock to be OPERABLE in MODE 1  3 0% RTP.
In MODE 1, a loss of flow in one RCS loop could result in DNB conditions, so the Power Range Neutron Flux, P-8 permissive must be OPERABLE. In MODE 1 < 30% RTP, this function is not required to be OPERABLE because a loss of flow in one loop will not result in DNB. In MODE 2, 3, 4, 5, or 6, this Function does not have to be OPERABLE because the core is not producing sufficient power to be concerned about DNB conditions.
: d. Power Range Neutron Flux, P-9 Permissive The Power Range Neutron Flux, P-9 permissive is actuated at approximately 50% power as determined by two-out-of-four NIS power range detectors if the Steam Dump System is available and at approximately 8% if the Steam Dump System is unavailable. The LCO requirement for this Function ensures that the Turbine Trip-Low Autostop Oil Pressure and Turbine Trip-Turbine Stop Valve Closure reactor trips are enabled above the P-9 setpoint. Above the P-9 setpoint, a turbine trip will cause a load rejection beyond the capacity of the Steam Dump System and RCS. A reactor trip is automatically initiated on a turbine trip when it is above the P-9 setpoint, to minimize the transient on the reactor.
The LCO require four channels of Power Range Neutron Flux, P-9 permissive to be OPERABLE in MODE 1 above the permissive setpoint.
R.E. Ginna Nuclear Power Plant            B 3.3.1-26                                  Revision 61
 
RTS Instrumentation B 3.3.1 In MODE 1 above the permissive setpoint, a turbine trip could cause a load rejection beyond the capacity of the Steam Dump System and RCS, so the Power Range Neutron Flux interlock must be OPERABLE. In MODE 1 below the permissive setpoint and MODE 2, 3, 4, 5, or 6, this Function does not have to be OPERABLE because the reactor is not at a power level sufficient to have a load rejection beyond the capacity of the Steam Dump System.
: e. Power Range Neutron Flux, P-10 Permissive The Power Range Neutron Flux, P-10 permissive is actuated at approximately 8% power, as determined by two-out-of- four NIS power range detectors. If power level falls below 8%
RTP on 3 of 4 channels, the nuclear instrument trips will be automatically unblocked. The LCO requirement for the P-10 permissive ensures that the following Functions are performed:
* on increasing power, the P-10 permissive allows the operator to manually block the Intermediate Range Neutron Flux and Power Range Neutron Flux-low reactor trips;
* on increasing power, the P-10 permissive automatically provides a backup signal to the P-6 permissive to block the Source Range Neutron Flux reactor trip, and also to de-energize the NIS source range detector;
* the P-10 interlock provides one of the two inputs to the P-7 interlock; and
* on decreasing power, the P-10 interlock automatically enables the Power Range Neutron Flux-Low reactor trip and the Intermediate Range Neutron Flux reactor trip (and rod stop).
The LCO requires four channels of Power Range Neutron Flux, P-10 interlock to be OPERABLE in MODE 1 < 6% RTP and MODE 2.
R.E. Ginna Nuclear Power Plant            B 3.3.1-27                                Revision 61
 
RTS Instrumentation B 3.3.1 OPERABILITY in MODE 1 < 6% RTP ensures the Function is available to perform its decreasing power Functions in the event of a reactor shutdown. This Function must also be OPERABLE in MODE 2 to ensure that core protection is providing during a startup or shutdown by the Power Range Neutron Flux-Low and Intermediate Range Neutron Flux reactor trips. In MODE 3, 4, 5, or 6, this Function does not have to be OPERABLE because the reactor is not at power and the Source Range Neutron Flux reactor trip provides core protection.
: 17. Reactor Trip Breakers This trip Function applies to the RTBs exclusive of individual trip mechanisms. The OPERABILITY requirement for the individual trip mechanisms is provided in Function 18 below. The LCO requires two OPERABLE trains of trip breakers. A trip breaker train consists of all trip breakers associated with a single RTS logic train that are racked in, closed, and capable of supplying power to the CRD System. Thus, the train may consist of the main breaker, bypass breaker, or main breaker and bypass breaker, depending upon the system configuration. Two OPERABLE trains ensure no single failure can disable the RTS trip capability.
These trip Functions must be OPERABLE in MODE 1 or 2 because the reactor is critical. In MODE 3, 4, or 5, these RTS trip Functions must be OPERABLE when the CRD System is capable of rod withdrawal and all rods are not fully inserted.
: 18. Reactor Trip Breaker Undervoltage and Shunt Trip Mechanisms The LCO requires both the Undervoltage and Shunt Trip Mechanisms to be OPERABLE for each RTB that is in service. The trip mechanisms are not required to be OPERABLE for trip breakers that are open, racked out, incapable of supplying power to the CRD System, or declared inoperable under Function 17 above.
OPERABILITY of both trip mechanisms on each breaker ensures that no single trip mechanism failure will prevent opening any breaker on a valid signal.
These trip Functions must be OPERABLE in MODE 1 or 2 because the reactor is critical. In MODE 3, 4, or 5, these RTS trip Functions must be OPERABLE when the CRD System is capable of rod withdrawal and all rods are not fully inserted.
R.E. Ginna Nuclear Power Plant              B 3.3.1-28                                  Revision 61
 
RTS Instrumentation B 3.3.1
: 19. Automatic Trip Logic The LCO requirement for the RTBs (Functions 17 and 18) and Automatic Trip Logic (Function 19) ensures that means are provided to interrupt the power to allow the rods to fall into the reactor core. Each RTB is equipped with an undervoltage coil and a shunt trip coil to trip the breaker open when needed. Each RTB is also equipped with a redundant bypass breaker to allow testing of the trip breaker while the plant is at power. The reactor trip signals generated by the RTS Automatic Trip Logic cause the RTBs and associated bypass breakers to open and shut down the reactor.
The LCO requires two trains of RTS Automatic Trip Logic to be OPERABLE. Having two OPERABLE trains ensures that failure of a single logic train will not prevent reactor trip.
These trip Functions must be OPERABLE in MODE 1 or 2 because the reactor is critical. In MODE 3, 4, or 5, these RTS trip Functions must be OPERABLE when the CRD System is capable of rod withdrawal and all rods are not fully inserted.
The RTS instrumentation satisfies Criterion 3 of the NRC Policy Statement.
ACTIONS              A Note has been added to the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed in Table 3.3.1-1.
In the event a channel's Trip Setpoint is found nonconservative with respect to the COT Acceptance Criteria specified in plant procedures, or the transmitter, instrument loop, signal processing electronics, or bistable is found inoperable, then all affected Functions provided by that channel must be declared inoperable and the LCO Condition(s) entered for the protection Function(s) affected.
As shown on Figure B 3.3.1-1, the RTS is comprised of multiple interconnected modules and components. For the purpose of this LCO, a channel is defined as including all related components from the field instrument to the Automatic Trip Logic (Function 19 in Table 3.3.1-1).
Therefore, a channel may be inoperable due to the failure of a field instrument or a bistable failure which affects one or both RTS trains that is comprised of the RTBs and Automatic Trip Logic Function. The only exception to this are the Manual Reactor Trip and SI Input from ESFAS trip Functions which are defined strictly on a train basis (i.e., failure of these Functions may only affect one RTS train).
R.E. Ginna Nuclear Power Plant                B 3.3.1-29                                  Revision 61
 
RTS Instrumentation B 3.3.1 A.1 Condition A applies to all RTS protection functions. Condition A addresses the situation where one required channel for one or more Functions is inoperable or if both source range channels are inoperable.
The Required Action is to refer to Table 3.3.1-1 and to take the Required Actions for the protection functions affected. The Completion Times are those from the referenced Conditions and Required Actions.
When the number of inoperable channels in a trip Function exceed those specified in all related Conditions associated with a trip Function, then the plant is outside the safety analysis. Therefore, LCO 3.0.3 must be immediately entered if the trip Function is applicable in the current MODE of operation. This essentially applies to the loss of more than one channel of any RTS Function except with respect to Condition H.
B.1 Condition B applies to the Manual Reactor Trip Function in MODE 1 or 2 and in MODES 3, 4, and 5 with the CRD system capable of rod withdrawal or all rods not fully inserted. With one channel inoperable, the inoperable channel must be restored to OPERABLE status within 48 hours. In this Condition, the remaining OPERABLE channel is adequate to perform the required safety function.
The Completion Time of 48 hours is reasonable considering that there are two automatic actuation trains and another manual initiation channel OPERABLE, and the low probability of an event occurring during this interval.
C.1, C.2, and C.3 If the Manual Reactor Trip Function cannot be restored to OPERABLE status within the allowed 48 hour Completion Time of Condition B, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours, action must be initiated within 6 hours to ensure that all rods are fully inserted, and the Control Rod Drive System must be placed in a condition incapable of rod withdrawal within 7 hours. The Completion Times provide adequate time to exit the MODE of Applicability from full power operation in an orderly manner without challenging plant systems based on operating experience.
D.1 Condition D applies to the following reactor trip Functions:
* Power Range Neutron Flux-High;
* Power Range Neutron Flux-Low; R.E. Ginna Nuclear Power Plant                B 3.3.1-30                                  Revision 61
 
RTS Instrumentation B 3.3.1
* Overtemperature 'T;
* Overpower 'T;
* Pressurizer Pressure-High;
* Pressurizer Water Level-High; and
* SG Water Level-Low Low.
With one channel inoperable, the channel must be restored to OPERABLE status or placed in the tripped condition within 6 hours.
Placing the channel in the tripped condition results in a partial trip condition. For the Power Range Neutron Flux-High, Power Range Neutron Flux-Low, Overtemperature 'T, and Overpower 'T functions, this results in a one-out-of-three logic for actuation. For the Pressurizer Pressure-High and Pressurizer Water Level-High Functions, this results in a one-out-of two logic for actuation. For the SG Water Level-Low Low Function, this results in a one-out-of-two logic per each affected SG for actuation. The 6 hours allowed to place the inoperable channel in the tripped condition is consistent with Reference 9.
The Required Actions have been modified by a Note that allows placing the inoperable channel in the bypass condition for up to 4 hours while performing surveillance testing of other channels. This includes placing the inoperable channel in the bypass condition to allow setpoint adjustments of other channels when required to reduce the setpoint in accordance with other Technical Specifications. This 4 hours is applied to each of the remaining OPERABLE channels. The 4 hour time limit is consistent with Reference 9.
E.1 and E.2 Condition E applies to the Intermediate Range Neutron Flux trip Function when THERMAL POWER is below 6% RTP and one channel is inoperable. Below the P-10 setpoint, the NIS intermediate range detector performs a monitoring and protection function. With one NIS intermediate range channel inoperable, 2 hours is allowed to either reduce THERMAL POWER below 5E-11amps or increase THERMAL POWER above 8% RTP. If THERMAL POWER is greater than the P-10 setpoint, the NIS power range detectors perform the monitoring and protection functions and the intermediate range is not required. The Completion Times allow for a slow and controlled power adjustment above 8% RTP or below 5E-11amps and take into account the redundant capability afforded by the redundant OPERABLE channel, and the low probability of its failure during this period. This action does not require the inoperable channel to be tripped because the Function uses one-out-of-two logic. Tripping one channel would trip the reactor. Thus, the Required Actions specified in this Condition are only applicable when channel inoperability does not result in reactor trip.
R.E. Ginna Nuclear Power Plant                B 3.3.1-31                                  Revision 61
 
RTS Instrumentation B 3.3.1 Required Action E.2 is modified by a Note which states that the option to increase THERMAL POWER is not allowed if both intermediate range channels are inoperable or if THERMAL POWER is < 5E-11 amps. This prevents the plant from increasing THERMAL POWER when the trip capability of the Intermediate Range Neutron Flux trip Function is not available.
F.1, F.2, and F.3 Condition F applies to the Source Range Neutron Flux trip Function when in MODE 2 with both Intermediate Range Channels < 5E-11amps. In this Condition, the NIS source range performs the monitoring and protection functions. With two channels inoperable, the RTBs and RTBBs must be opened immediately. With the RTBs and RTBBs opened, the core is in a more stable condition.
With one channel inoperable, operations involving positive reactivity additions shall be suspended immediately. This will preclude any power escalation since with only one source range channel OPERABLE, core protection is severely reduced. The inoperable channel must also be restored within 48 hours.
Required Action F.2 is modified by a Note to indicate that normal plant control operations that individually add limited positive reactivity (e.g.,
temperature or boron fluctuations associated with RCS inventory management or temperature control) are not precluded by this Action, provided they are accounted for in the calculated SDM.
G.1 If the Required Actions of Condition D, E, or F cannot be met within the specified Completion Times, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in MODE 3 within the next 6 hours. The Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.
H.1, H.2, and H.3 Condition H applies to an inoperable source range channel in MODE 3, 4, or 5 with the CRD System capable of rod withdrawal or all rods not fully inserted. In this Condition, the NIS source range performs the monitoring and protection functions. With two channels inoperable, at least one channel must be restored to OPERABLE status within 1 hour. The Completion Time of 1 hour is reasonable considering the low probability of an event occurring during this interval.
R.E. Ginna Nuclear Power Plant                  B 3.3.1-32                                    Revision 61
 
RTS Instrumentation B 3.3.1 With one of the source range channels inoperable, operations involving positive reactivity additions must be suspended immediately and 48 hours is allowed to restore it to OPERABLE status. The suspension of positive reactivity additions will preclude any power escalation.
Required Action H.2 is modified by a Note to indicate that normal plant control operations that individually add limited positive reactivity (e.g.,
temperature or boron fluctuations associated with RCS inventory management or temperature control) are not precluded by this Action, provided they are accounted for in the calculated SDM.
I.1 and I.2 If the Source Range trip Function cannot be restored to OPERABLE status within the required Completion Time of Condition H, the plant must be brought to a MODE in which the requirement does not apply. To achieve this status, action must be immediately initiated to fully insert all rods. Additionally, the CRD System must be placed in a condition incapable of rod withdrawal within 1 hour. The Completion Time of 1 hour is sufficient to accomplish the Required Action, and takes into account the low probability of an event occurring during this interval.
J.1 and J.2 Condition J applies when the required Source Range Neutron Flux channel is inoperable in MODE 3, 4, or 5 with the CRD System not capable of rod withdrawal and all rods are fully inserted. In this Condition, the NIS source range performs the monitoring function. With no source range channels OPERABLE, operations involving positive reactivity additions shall be suspended immediately.
Also, the SDM must be verified once within 12 hours and every 12 hours thereafter as per SR 3.1.1.1, SDM verification. With no source range channels OPERABLE, core protection is severely reduced. Verifying the SDM once per 12 hours allows sufficient time to perform the calculations and determine that the SDM requirements are met and to ensure that the core reactivity has not changed. Required Action J.1 precludes any positive reactivity additions; therefore, core reactivity should not be increasing, and a 12 hour Frequency is adequate. The Completion Time of once per 12 hours is based on operating experience in performing the Required Actions and the knowledge that plant conditions will change slowly.
Required Action J.1 is modified by a Note which permits plant temperature changes provided the temperature change is accounted for in the calculated SDM. Introduction of temperature changes, including temperature increases when a positive MTC exits, must be evaluated to ensure they do not result in a loss of required SDM.
R.E. Ginna Nuclear Power Plant                  B 3.3.1-33                                    Revision 61
 
RTS Instrumentation B 3.3.1 K.1 Condition K applies to the following reactor trip Functions:
* Pressurizer Pressure-Low;
* Reactor Coolant Flow-Low (Two Loops);
* RCP Breaker Position (Two Loops);
* Undervoltage-Bus 11A and 11B; and
* Underfrequency-Bus 11A and 11B.
With one channel inoperable, the inoperable channel must be restored to OPERABLE status or placed in the tripped condition within 6 hours.
Placing the channel in the tripped condition results in a partial trip condition requiring only one additional channel to initiate a reactor trip.
The 6 hours allowed to place the channel in the tripped condition is consistent with Reference 9 if the inoperable channel cannot be restored to OPERABLE status.
Allowance of this time interval takes into consideration the redundant capability provided by the remaining redundant OPERABLE channel(s),
and the low probability of occurrence of an event during this period that may require the protection afforded by the Functions associated with Condition K.
For the Reactor Coolant Flow-Low (Two Loops) Function, Condition K applies on a per loop basis. For the RCP Breaker Position (Two Loops)
Function, Condition K applies on a per RCP basis. For Undervoltage-Bus 11A and 11B and underfrequency-Bus 11A and 11B, Condition K applies on a per bus basis. This allows one inoperable channel from each loop, RCP, or bus to be considered on a separate condition entry basis.
The Required Actions have been modified by a Note that allows placing the inoperable channel in the bypassed condition for up to 4 hours while performing surveillance testing of the other channels. The 4 hour time limit is consistent with Reference 9. The 4 hours is applied to each of the remaining OPERABLE channels.
R.E. Ginna Nuclear Power Plant              B 3.3.1-34                                  Revision 61
 
RTS Instrumentation B 3.3.1 L.1 If the Required Action and Completion Time of Condition K is not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in MODE 1 < 8.5% RTP at which point the Function is no longer required. An alternative is not provided for increasing THERMAL POWER above the P-8 setpoint for the Reactor Coolant Flow-Low (Two Loops) and RCP Breaker Position (Two Loops) trip Functions since this places the plant in Condition M.
The Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 1 < 8.5% RTP from full power conditions in an orderly manner and without challenging plant systems.
M.1 Condition M applies to the Reactor Coolant Flow-Low (Single Loop) reactor trip Function. Condition M applies on a per loop basis. With one channel per loop inoperable, the inoperable channel must be restored to OPERABLE status or placed in the tripped condition within 6 hours. The 6 hours allowed to restore the channel to OPERABLE status or place in trip is consistent with Reference 9.
The Required Actions have been modified by a Note that allows placing the inoperable channel in the bypassed condition for up to 4 hours while performing surveillance testing of the other channels. The 4 hours is applied to each of the two OPERABLE channels. The 4 hour time limit is consistent with Reference 9.
N.1 Condition N applies to the RCP Breaker Position (Single Loop) trip Function. Condition N applies on a per loop basis. There is one breaker position device per RCP breaker. With one channel per RCP inoperable, the inoperable channel must be restored to OPERABLE status within 6 hours. The 6 hours allowed to restore the channel to OPERABLE status is consistent with Reference 9.
O.1 If the Required Action and associated Completion Time of Condition M or N is not met, the plant must be placed in a MODE where the Functions are not required to be OPERABLE. To achieve this status, THERMAL POWER must be reduced to < 30% RTP within the next 6 hours. The Completion Time of 6 hours is consistent with Reference 9.
R.E. Ginna Nuclear Power Plant              B 3.3.1-35                                Revision 61
 
RTS Instrumentation B 3.3.1 P.1 Condition P applies to Turbine Trip on Low Autostop Oil Pressure or on Turbine Stop Valve Closure in MODE 1 above the P-9 setpoint. With one channel inoperable, the inoperable channel must be restored to OPERABLE status or placed in the tripped condition within 6 hours. If placed in the tripped Condition, this results in a partial trip condition requiring only one additional channel to initiate a reactor trip. The 6 hours allowed to place the inoperable channel in the tripped condition is consistent with Reference 9.
The Required Actions have been modified by a Note that allows placing the inoperable channel in the bypassed condition for up to 4 hours while performing surveillance testing of the other channels. The 4 hours is applied to each remaining OPERABLE channel. The 4 hour time limit is consistent with Reference 9.
Q.1, Q.2.1, and Q.2.2 If the Required Action and Associated Completion Time of Condition P are not met, the plant must be placed in a MODE where the Turbine Trip Functions are no longer required to be OPERABLE. To achieve this status, THERMAL POWER must be reduced to < 50% RTP within the next 6 hours. The Completion Time of 6 hours is consistent with Reference 9.
The Steam Dump system must also be verified OPERABLE within 7 hours or THERMAL POWER must be reduced to < 8% RTP. This ensures that either the secondary system or RCS is capable of handling the heat rejection following a reactor trip. The Completion Times are reasonable considering the need to perform the actions in an orderly manner and the low probability of an event occurring in this time.
R.1 Condition R applies to the SI Input from ESFAS reactor trip and the RTS Automatic Trip Logic in MODES 1 and 2. With one train inoperable, 6 hours is allowed to restore the train to OPERABLE status. The Completion Time of 6 hours to restore the train to OPERABLE status is reasonable considering that in this Condition, the remaining OPERABLE train is adequate to perform the safety function and given the low probability of an event during this interval.
The Required Action has been modified by a Note that allows bypassing one train up to 4 hours for surveillance testing, provided the other train is OPERABLE.
R.E. Ginna Nuclear Power Plant              B 3.3.1-36                                    Revision 61
 
RTS Instrumentation B 3.3.1 S.1 and S.2 Condition S applies to the P-6, P-7, P-8, P-9, and P-10 permissives. With one channel inoperable, the associated interlock must be verified to be in its required state for the existing plant condition within 1 hour or the associated RTS channel(s) must be declared inoperable. These actions are conservative for the case where power level is being raised. Verifying the interlock status manually accomplishes the interlock's Function. The Completion Time of 1 hour is based on operating experience and the minimum amount of time allowed for manual operator actions.
T.1 Condition T applies to the RTBs in MODES 1 and 2. With one train inoperable, 1 hour is allowed to restore the train to OPERABLE status.
The 1 hour Completion Time is based on operating experience and the minimum amount of time allowed for manual operator actions.
The Required Action has been modified by two Notes. Note 1 allows one train to be bypassed for up to 2 hours for surveillance testing, provided the other train is OPERABLE. Note 2 allows one RTB to be bypassed for up to 6 hours for maintenance on undervoltage or shunt trip mechanisms if the other RTB train is OPERABLE. The 6 hours for maintenance is in addition to the 2 hours for surveillance testing (e.g., if a RTB fails 1 hour into its testing window, it must be restored within 6 additional hours (or 7 hours from start of test)).
U.1 and U.2 Condition U applies to the RTB Undervoltage and Shunt Trip Mechanisms (i.e., diverse trip features) in MODES 1 and 2. Condition U applies on a RTB basis. This allows one diverse trip feature to be inoperable on each RTB. However, with two diverse trip features inoperable (i.e., one on each of two different RTBs), at least one diverse trip feature must be restored to OPERABLE status within 1 hour. The Completion Time of 1 hour is reasonable considering the low probability of an event occurring during this time interval.
With one trip mechanism for one RTB inoperable, it must be restored to an OPERABLE status within 48 hours. The affected RTB shall not be bypassed while one of the diverse trip features is inoperable except for the time required to perform maintenance to one of the diverse trip features. The allowable time for performing maintenance of the diverse trip features is 6 hours for the reasons stated under Condition T. The Completion Time of 48 hours for Required Action U.2 is reasonable considering that in this Condition there is one remaining diverse trip feature for the affected RTB, and one OPERABLE RTB capable of performing the safety function and given the low probability of an event occurring during this interval.
R.E. Ginna Nuclear Power Plant              B 3.3.1-37                                    Revision 61
 
RTS Instrumentation B 3.3.1 V.1 If the Required Action and Associated Completion Time of Condition R, S, T, or U is not met, the plant must be placed in a MODE where the Functions are no longer required to be OPERABLE. To achieve this status, the plant must be placed in MODE 3 within the next 6 hours. The Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner without challenging plant systems.
It should be noted that for inoperable channels of Functions 16a, 16b, 16c, and 16d, the MODE of Applicability will be exited before Required Action V.1 is completed. Therefore, the plant shutdown may be stopped upon exiting the MODE of Applicability per LCO 3.0.2.
W.1 and W.2 Condition W applies to the following reactor trip Functions in MODE 3, 4, or 5 with the CRD System capable of rod withdrawal or all rods not fully inserted:
* RTBs;
* RTB Undervoltage and Shunt Trip Mechanisms; and
* Automatic Trip Logic.
With two trip mechanisms inoperable, at least one trip mechanism must be restored to OPERABLE status within 1 hour. The Completion Time of 1 hour is reasonable considering the low probability of an event occurring during this time interval.
With one trip mechanism or train inoperable, the inoperable trip mechanism or train must be restored to OPERABLE status within 48 hours. For the trip mechanisms, Condition W applies on a RTB basis.
This allows one diverse trip feature to be inoperable on each RTB.
However, with two diverse trip features inoperable (i.e., one on each of two different RTBs), at least one diverse trip feature must be restored to OPERABLE status within 1 hour.
The Completion Time is reasonable considering that in this Condition, the remaining OPERABLE train is adequate to perform the safety function, and given the low probability of an event occurring during this interval.
R.E. Ginna Nuclear Power Plant              B 3.3.1-38                                Revision 61
 
RTS Instrumentation B 3.3.1 X.1 and X.2 If the Required Action and Associated Completion Time of Condition W is not met, the plant must be placed in a MODE where the Functions are no longer required. To achieve this status, action be must initiated immediately to fully insert all rods and the CRD System must be incapable of rod withdrawal within 1 hour. These Completion Times are reasonable, based on operating experience to exit the MODE of Applicability in an orderly manner.
SURVEILLANCE            The SRs for each RTS Function are identified by the SRs column of REQUIREMENTS            Table 3.3.1-1 for that Function A Note has been added to the SR Table stating that Table 3.3.1-1 determines which SRs apply to which RTS Functions.
Note that each channel of process protection supplies both trains of the RTS. When testing Channel 1, Train A and Train B must be examined.
Similarly, Train A and Train B must be examined when testing Channel 2, Channel 3, and Channel 4 (if applicable). The CHANNEL CALIBRATION and COTs are performed in a manner that is consistent with the assumptions used in analytically calculating the required channel accuracies (Ref. 8).
SR 3.3.1.1 A CHANNEL CHECK is required for the following RTS trip functions:
* Power Range Neutron Flux-High;
* Power Range Neutron Flux-Low;
* Intermediate Range Neutron Flux;
* Source Range Neutron Flux;
* Overtemperature 'T;
* Overpower 'T;
* Pressurizer Pressure-Low;
* Pressurizer Pressure-High;
* Pressurizer Water Level-High;
* Reactor Coolant Flow-Low (Single Loop);
R.E. Ginna Nuclear Power Plant                B 3.3.1-39                                Revision 61
 
RTS Instrumentation B 3.3.1
* Reactor Coolant Flow-Low (Two Loops); and
* SG Water Level-Low Low Performance of the CHANNEL CHECK ensures that gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or of more serious instrument conditions. A CHANNEL CHECK will detect gross channel failure; thus, it is a verification that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
Channel check acceptance criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.3.1.2 This SR compares the calorimetric heat balance calculation to the NIS Power Range Neutron Flux-High channel output. If the calorimetric exceeds the NIS channel output by > 2% RTP, the NIS is still OPERABLE but must be adjusted. If the NIS channel output cannot be properly adjusted, the channel is then declared inoperable.
This SR is modified by a Note which states that this Surveillance is required to be performed within 12 hours after power is 50% RTP. At lower power levels, calorimetric data are inaccurate.
R.E. Ginna Nuclear Power Plant                  B 3.3.1-40                              Revision 77
 
RTS Instrumentation B 3.3.1 In addition, control room operators periodically monitor redundant indications and alarms to detect deviations in channel outputs. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.3.1.3 This SR compares the incore system to the NIS channel output. If the absolute difference is  3%, the NIS channel is still OPERABLE, but must be readjusted. If the NIS channel cannot be properly readjusted, the channel is then declared inoperable. This surveillance is performed to verify the f('I) input to the Overtemperature 'T Function.
This SR is modified by two Notes. Note 1 clarifies that the Surveillance is required to be performed within 7 days after THERMAL POWER is  50%
RTP but prior to exceeding 90% RTP following each refueling and if it has not been performed within the last 31 EFPD. Note 2 states that performance of SR 3.3.1.6 satisfies this SR since it is a more comprehensive test.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.3.1.4 This SR is the performance of a TADOT of the RTB, and the RTB Undervoltage and Shunt Trip Mechanisms. This test shall verify OPERABILITY by actuation of the end devices.
The test shall include separate verification of the undervoltage and shunt trip mechanisms except for the bypass breakers which do not require separate verification since no capability is provided for performing such a test at power. The independent test for bypass breakers is included in SR 3.3.1.11. However, the bypass breaker test shall include a local shunt trip. This test must be performed on the bypass breaker prior to placing it in service to take the place of a RTB.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
R.E. Ginna Nuclear Power Plant                  B 3.3.1-41                              Revision 77
 
RTS Instrumentation B 3.3.1 SR 3.3.1.5 This SR is the performance of an ACTUATION LOGIC TEST on the RTS Automatic Trip Logic. The train being tested is placed in the bypass condition, thus preventing inadvertent actuation. All possible logic combinations, with and without applicable permissives, are tested for each protection function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.3.1.6 This SR is a calibration of the excore channels to the incore channels. If the measurements do not agree, the excore channels are still OPERABLE but must be calibrated to agree with the incore detector measurements. If the excore channels cannot be adjusted, the channels are then declared inoperable. This surveillance is performed to verify the f('I) input to the Overtemperature 'T Function.
A minimum of 2 thimbles per quadrant and sufficient movable incore detectors shall be operable during recalibration of the excore axial off-set detection system. To calibrate the excore detector channels, it is only necessary that the movable incore system be used to determine the gross power distribution in the core as indicated by the power balance between the top and bottom halves of the core.
This SR has been modified by a Note stating that this Surveillance is required to be performed within 7 days after THERMAL POWER is  50%
RTP but prior to exceeding 90% RTP following each refueling.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.3.1.7 This SR is the performance of a COT for the following RTS functions:
* Power Range Neutron Flux-High;
* Source Range Neutron Flux (in MODE 3, 4, or 5 with CRD System capable of rod withdrawal or all rods not fully inserted);
* Overtemperature 'T;
* Overpower 'T;
* Pressurizer Pressure-Low; R.E. Ginna Nuclear Power Plant                  B 3.3.1-42                                Revision 77
 
RTS Instrumentation B 3.3.1
* Pressurizer Pressurizer-High;
* Pressurizer Water Level-High;
* Reactor Coolant Flow-Low (Single Loop);
* Reactor Coolant Flow-Low (Two Loops); and
* SG Water Level-Low Low A COT is performed on each required channel to ensure the channel will perform the intended Function. The as-found setpoints must be within the COT Acceptance Criteria specified within plant procedures. The as-left values must be consistent with the setting tolerance used in the setpoint methodology (Ref. 8).
This SR is modified by two Notes. Note 1 provides a 4 hour delay in the requirement to perform this surveillance for source range instrumentation when entering MODE 3 from MODE 2. This Note allows a normal shutdown to proceed without a delay for testing in MODE 2 and for a short time in MODE 3 until the RTBs are open and SR 3.3.1.7 is no longer required to be performed. If the plant is in MODE 3 with the RTBs closed for greater than 4 hours, this SR must be performed within 4 hours after entry into MODE 3.
Note 2 states that the RTS input relays are excluded from this surveillance for these Functions. These Functions have installed bypass test capability. For the Functions with installed bypass test capability, the channel is tested in a bypass versus a tripped condition. To preclude placing the channel in a tripped condition, the input relays are excluded from this surveillance.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.3.1.8 This SR is the performance of a COT as described in SR 3.3.1.7 for the Power Range Neutron Flux-Low, Intermediate Range Neutron Flux, and Source Range Neutron Flux (MODE 2), except that this test also includes verification that the P-6 and P-10 interlocks are in their required state for the existing plant condition. This SR is modified by three Notes. Notes 1 and 2 provide a 4 hour delay in the requirement to perform this surveillance. These Notes allow a normal shutdown to be completed and the plant removed from the MODE of Applicability for this surveillance without a delay to perform the testing required by this surveillance. The Frequency is in accordance with the Surveillance Frequency Control Program if the plant remains in the MODE of Applicability after the initial performances of prior to reactor startup and 4 hours after reducing power below P-10 or P-6.
R.E. Ginna Nuclear Power Plant                B 3.3.1-43                                  Revision 89
 
RTS Instrumentation B 3.3.1 Note 3 states that the RTS input relays are excluded from this surveillance for this Function. This Function has installed bypass test capability. For the Functions with installed bypass test capability, the channel is tested in a bypass versus a tripped condition. To preclude placing the channel in a tripped condition, the input relays are excluded from this surveillance.
The MODE of Applicability for this surveillance is < 6% RTP for the power range low and intermediate range channels and < 5E-11amps for the Source range channels. Once the plant is in MODE 3, this surveillance is no longer required. If power is to be maintained < 6% RTP or < 5E-11amps for more than 4 hours, then the testing required by this surveillance must be performed prior to the expiration of the 4 hour limit, unless performed in accordance with the Surveillance Frequency Control Program. Four hours is a reasonable time to complete the required testing or place the plant in a MODE where this surveillance is no longer required. This test ensures that the NIS source, intermediate, and power range low channels are OPERABLE prior to taking the reactor critical or after reducing power into the applicable MODE (< 6% RTP or < 5E-11amps) for periods > 4 hours. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.3.1.9 This SR is the performance of a TADOT for the Undervoltage-Bus 11A and 11B and Underfrequency-Bus 11A and 11B trip Functions.
This SR is modified by a Note that excludes verification of setpoints from the TADOT. Since this SR applies to Bus 11A and 11B undervoltage and underfrequency relays, setpoint verification requires elaborate bench calibration and is accomplished during the CHANNEL CALIBRATION required by SR 3.3.1.10. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.3.1.10 This SR is the performance of a CHANNEL CALIBRATION for the following RTS Functions:
* Power Range Neutron Flux-High;
* Power Range Neutron Flux-Low;
* Intermediate Range Neutron Flux;
* Source Range Neutron Flux;
* Overtemperature T;
* Overpower T;
* Pressurizer Pressure-Low;
* Pressurizer Pressure-High; R.E. Ginna Nuclear Power Plant                B 3.3.1-44                              Revision 89
 
RTS Instrumentation B 3.3.1
* Pressurizer Water Level-High;
* Reactor Coolant Flow-Low (Single Loop);
* Reactor Coolant Flow-Low (Two Loops);
* Undervoltage-Bus 11A and 11B;
* Underfrequency-Bus 11A and 11B;
* SG Water Level-Low Low;
* Turbine Trip-Low Autostop Oil Pressure; and
* Reactor Trip System Interlocks.
CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy.
CHANNEL CALIBRATIONS must be performed consistent with the assumptions of the plant specific setpoint methodology (Ref. 8). The difference between the current as-found values and the previous test as-left values must be consistent with the drift allowance used in the setpoint methodology.
With respect to RTDs, whenever a sensing element is replaced, the next required CHANNEL CALIBRATION of the resistance temperature detectors (RTD) sensors shall include an inplace qualitative assessment of sensor behavior and normal calibration of the remaining adjustable devices in the channel. This is accomplished by an inplace cross calibration that compares the other sensing elements with the recently installed sensing element.
This SR is modified by a Note stating that neutron detectors are excluded from the CHANNEL CALIBRATION. The CHANNEL CALIBRATION for the power range neutron detectors consists of a normalization of the detectors based on a power calorimetric and flux map performed above 50% RTP. The CHANNEL CALIBRATION for the source range and intermediate range neutron detectors consists of obtaining the detector plateau or preamp discriminator curves, evaluating those curves, and comparing the curves to the manufacturer's data. This Surveillance is not required for the NIS power range detectors for entry into MODE 2 or 1, and is not required for the NIS intermediate range detectors for entry into MODE 2, because the plant must be in at least MODE 2 to perform the test for the intermediate range detectors and MODE 1 for the power range detectors. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
R.E. Ginna Nuclear Power Plant                  B 3.3.1-45                                Revision 77
 
RTS Instrumentation B 3.3.1 SR 3.3.1.11 This SR is the performance of a TADOT of the Manual Reactor Trip, RCP Breaker Position, and the SI Input from ESFAS trip Functions. This test independently verifies the OPERABILITY of the undervoltage and shunt trip mechanisms for the Manual Reactor Trip Function for the Reactor Trip Breakers and Reactor Trip Bypass Breakers.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.3.1.12 This SR is the performance of a TADOT for Turbine Trip Functions which is performed prior to reactor startup if it has not been performed within the last 31 days. This test shall verify OPERABILITY by actuation of the end devices.
The Frequency is based on the known reliability of the Functions and the multichannel redundancy available, and has been shown to be acceptable through operating experience.
This SR is modified by a Note stating that verification of the Trip Setpoint does not have to be performed for this Surveillance. Performance of this test will ensure that the turbine trip Function is OPERABLE prior to taking the reactor critical because portions of this test cannot be performed with the reactor at power.
SR 3.3.1.13 SR 3.3.1.13 is modified by a Note. The Note states that the RTS permissive input relays are excluded from this surveillance for the Functions specified. These Functions have installed bypass test capability. For the Functions with installed bypass test capability, the channel is tested in a bypass versus a tripped condition. To preclude placing the channel in a tripped condition, the input relays are excluded from this surveillance.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
R.E. Ginna Nuclear Power Plant                B 3.3.1-46                                Revision 89
 
RTS Instrumentation B 3.
 
==3.1 REFERENCES==
: 1. Atomic Industry Forum (AIF) GDC 14, Issued for comment July 10, 1967.
: 2. 10 CFR 50.67.
: 3. American National Standard, "Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants," N18.2-1973.
: 4. UFSAR, Chapter 7.
: 5. UFSAR, Chapter 6.
: 6. UFSAR, Chapter 15.
: 7. IEEE-279-1971.
: 8. EP-3-S-0505, "Instrument Setpoint/Loop Accuracy Calculation Methodology".
: 9. WCAP-10271-P-A, Supplement 2, Revision 1, June 1990.
10    "Power Range Nuclear Instrumentation System Bypass Test Instrumentation for R. E. Ginna," WCAP-18298-P, September 2017.
R.E. Ginna Nuclear Power Plant                B 3.3.1-47                                Revision 89
 
RTS Instrumentation B 3.3.1 Figure B 3.3.1-1 R.E. Ginna Nuclear Power Plant    B 3.3.1-48            Revision 61
 
ESFAS Instrumentation B 3.3.2 B 3.3    INSTRUMENTATION B 3.3.2      Engineered Safety Feature Actuation System (ESFAS) Instrumentation BASES BACKGROUND            Atomic Industrial Forum (AIF) GDC 15 (Ref. 1) requires that protection systems be provided for sensing accident situations and initiating the operation of necessary engineered safety features.
The installed protection and monitoring systems have been designed to protect against violating core design limits and the Reactor Coolant System (RCS) pressure boundary, and to mitigate accidents. This is achieved by specifying limiting safety system settings (LSSS) in terms of parameters directly monitored by the ESFAS, as well as specifying LCOs with respect to these parameters and other reactor system parameters and equipment.
Technical specifications are required by 10 CFR 50.36 to contain LSSS defined by the regulation as "...settings for automatic protective devices...so chosen that automatic protective action will correct the abnormal situation before a Safety Limit (SL) is exceeded." The Analytic Limit is the limit of the process variable at which a safety action is initiated, as established by the safety analysis, to ensure that a SL is not exceeded. Any automatic protection action that occurs on reaching the Analytic Limit therefore ensures that the SL is not exceeded. However, in practice, the actual settings for automatic protective devices must be chosen to be more conservative than the Analytic Limit to account for instrument loop uncertainties related to the setting at which the automatic protective action would actually occur.
The Calculated Trip Setpoint is a predetermined setting for a protective device chosen to ensure automatic actuation prior to the process variable reaching the Analytic Limit and thus ensuring that the SL would not be exceeded. As such, the Calculated Trip Setpoint accounts for uncertainties in setting the device (e.g. calibration), uncertainties in how the device might actually perform (e.g., repeatability), changes in the point of action of the device over time (e.g., drift during surveillance intervals), and any other factors which may influence its actual performance (e.g., harsh accident environments). In this manner, the Calculated Trip Setpoint plays an important role in ensuring that SLs are not exceeded. As such, the Calculated Trip Setpoint meets the definition of an LSSS and they are contained in the technical specifications.
Technical specifications contain requirements related to the OPERABILITY of equipment required for safe operation of the facility.
OPERABLE is defined in technical specifications as "...being capable of performing its safety functions(s)." For automatic protective devices, the R.E. Ginna Nuclear Power Plant                B 3.3.2-1                                  Revision 42
 
ESFAS Instrumentation B 3.3.2 required safety function is to ensure that a SL is not exceeded and therefore the LSSS as defined by 10 CFR 50.36 serves as the OPERABILITY limit for the nominal trip setpoint. However, use of the LSSS (Calculated Trip Setpoint) to define OPERABILITY in technical specifications would be an overly restrictive requirement if it were applied as an OPERABILITY limit for the as-found value of a protective device setting during a surveillance. This would result in technical specification compliance problems, as well as reports and corrective actions required by the rule which are not necessary to ensure safety. For example, an automatic protective device with a setting that has been found to be different from the Calculated Trip Setpoint due to some drift of the setting may still be OPERABLE since drift is to be expected. This expected drift would have been specifically accounted for in the setpoint methodology for determining the Calculated Trip Setpoint and thus the automatic protective action would still have ensured that the SL would not be exceeded with the as-found setting of the protective device. Therefore, the device would still be OPERABLE since it would have performed its safety function and the only corrective action required would be to reset the device to within the tolerance band assumed in the determination of the Calculated Trip Setpoint to account for further drift during the next surveillance interval.
The Nominal Trip Setpoint is the desired setting specified within established plant procedures, and may be more conservative than the Calculated Trip Setpoint. The Nominal Trip Setpoint therefore may include additional margin to ensure that the SL would not be exceeded.
Use of the Calculated Trip Setpoint or Nominal Trip Setpoint to define as-found OPERABILITY, under the expected circumstances described above, would result in actions required by both the rule and technical specifications that are clearly not warranted. However, there is also some point beyond which the OPERABILITY of the device would be called into question, for example, greater than expected drift. This requirement needs to be specified in the technical specifications in order to define the OPERABILITY limit for the as-found trip setpoint and is designated as the Channel Operational Test (COT) Acceptance Criteria.
The COT Acceptance Criteria described in Table 3.3.2-1 serves as a confirmation of OPERABILITY, such that a channel is OPERABLE if the absolute difference between the as-found trip setpoint and the previously as-left trip setpoint does not exceed the assumed COT uncertainty during the performance of the COT. The COT uncertainty is primarily equal to the expected instrument loop uncertainties, such as drift, during the surveillance interval. In this manner, the actual setting of the device will still meet the LSSS definition and ensure that a Safety Limit is not exceeded at any given point of time as long as the device has not drifted beyond that expected during the surveillance interval. Note that, although the channel is "OPERABLE" under these circumstances, the trip setpoint should be left adjusted to a value within the established Nominal Trip Setpoint calibration tolerance band, in accordance with the uncertainty assumptions stated in the referenced setpoint methodology R.E. Ginna Nuclear Power Plant              B 3.3.2-2                                  Revision 42
 
ESFAS Instrumentation B 3.3.2 (as-left criteria), and confirmed to be operating within the statistical allowances of the uncertainty terms assigned. If the actual setting of the device is found to have exceeded the COT Acceptance Criteria the device would be considered inoperable from a technical specification perspective. This requires corrective action including those actions required by 10 CFR 50.36 when automatic protective devices do not function as required.
The ESFAS instrumentation is segmented into two distinct but interconnected modules as described in UFSAR, Chapter 7 (Ref. 2):
* Field transmitters or process sensors; and
* Signal processing equipment.
These modules are discussed in more detail below.
Field Transmitters and Process Sensors Field transmitters and process sensors provide a measurable electronic signal based on the physical characteristics of the parameter being measured. To meet the design demands for redundancy and reliability, two, three, and up to four field transmitters or sensors are used to measure required plant parameters. In many cases, field transmitters or sensors that input to the ESFAS are shared with the Reactor Trip System (RTS). To account for calibration tolerances and instrument drift, which is assumed to occur between calibrations, statistical allowances are provided. These statistical allowances provide the basis for determining acceptable as-left and as-found calibration values for each transmitter or sensor.
Signal Processing Equipment The process control equipment provides signal conditioning, comparable output signals for instruments located on the main control board, and comparison of measured input signals with setpoints established by safety analyses. These setpoints are defined in UFSAR, Chapter 6 (Ref. 3), Chapter 7 (Ref. 2), and Chapter 15 (Ref. 4). If the measured value of a plant parameter exceeds the predetermined setpoint, an output from a bistable is forwarded to the logic relays.
R.E. Ginna Nuclear Power Plant              B 3.3.2-3                                    Revision 42
 
ESFAS Instrumentation B 3.3.2 Generally, three or four channels of process control equipment are used for the signal processing of plant parameters measured by the field transmitters and sensors. If a parameter is used only for input to the protection circuits, three channels with a two-out-of-three logic are typically sufficient to provide the required reliability and redundancy. If one channel fails in a direction that would not result in a partial Function trip, the Function can still be accomplished with a two-out-of-two logic. If one channel fails in a direction that a partial Function trip occurs, a trip will not occur unless a second channel fails or trips in the remaining one-out-of-two logic.
If a parameter is used for input to the protection system and a control function, four channels with a two-out-of-four logic are typically sufficient to provide the required reliability and redundancy.
This ensures that the circuit is able to withstand both an input failure to the control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation. Therefore, a single failure will neither cause nor prevent the protection function actuation. These requirements are described in IEEE-279-1971 (Ref. 5).
The actuation of ESF components is accomplished through master and slave relays. The protection system energizes the master relays appropriate for the condition of the plant. Each master relay then energizes one or more slave relays, which then cause actuation of the end devices.
APPLICABLE            Each of the analyzed accidents can be detected by one or more ESFAS SAFETY                Functions. One of the ESFAS Functions is the primary actuation signal ANALYSES,              for that accident. An ESFAS Function may be the primary actuation LCO, AND              signal for more than one type of accident. An ESFAS Function may also APPLICABILITY          be a secondary, or backup, actuation signal for one or more other accidents. For example, SI-Pressurizer Pressure-Low is a primary actuation signal for small break loss of coolant accidents (LOCAs) and a backup actuation signal for steam line breaks (SLBs) outside containment. Functions such as manual initiation, not specifically credited in the accident safety analysis, are qualitatively credited in the safety analysis and the NRC staff approved licensing basis for the plant. These Functions may provide protection for conditions that do not require dynamic transient analysis to demonstrate Function performance. These Functions may also serve as anticipatory actions to Functions that were credited in the accident analysis (Ref. 4).
This LCO requires all instrumentation performing an ESFAS Function to be OPERABLE. A channel is considered OPERABLE when:
R.E. Ginna Nuclear Power Plant                B 3.3.2-4                                    Revision 42
 
ESFAS Instrumentation B 3.3.2
: a.      The nominal trip setpoint is equal to or conservative with respect to the LSSS;
: b.      The absolute difference between the as-found trip setpoint and the previous as-left trip setpoint does not exceed the COT Acceptance Criteria; and
: c.      The as-left trip setpoint is within the established calibration tolerance band about the nominal trip setpoint.
The channel is still operable even if the as-left trip setpoint is non-conservative with respect to the LSSS provided that the as-left trip setpoint is within the established calibration tolerance band as specified in the Ginna Instrument Setpoint Methodology. Failure of any instrument renders the affected channel(s) inoperable and reduces the reliability of the affected Functions.
The LCO generally requires OPERABILITY of three or four channels in each instrumentation function and two channels in each logic and manual initiation function. The two-out-of-three and the two-out-of-four configurations allow one channel to be tripped during maintenance or testing without causing an ESFAS initiation. Two logic or manual initiation channels are required to ensure no single failure disables the ESFAS.
The LCO and Applicability of each ESFAS Function are provided in Table 3.3.2-1. Included on Table 3.3.2-1 are LSSS for all applicable ESFAS Functions. Setpoints in accordance with the LSSS ensure that the consequences of Design Basis Accidents (DBAs) will be acceptable, providing the plant is operated within the LCOs, including any Required Actions that are in effect at the onset of the DBA and the equipment functions as designed.
The Calculated Trip Setpoints (which are equal to the LSSS) are based on the Analytical Limits stated in References 2, 3, and 4. The selection of these trip setpoints is such that adequate protection is provided when all sensor and processing time delays are taken into account. To allow for calibration tolerances, instrumentation uncertainties, instrument drift, and severe environment errors for those ESFAS channels that must function in harsh environments as defined by 10 CFR 50.49, the LSSS specified in Table 3.3.2-1 in the accompanying LCO are conservative with respect to the Analytical Limits. A detailed description of the methodology used to calculate the LSSS is provided in the "Instrument Setpoint/Loop Accuracy Calculation Methodology" (Ref. 6). The magnitudes of these uncertainties are factored into the determination of each trip setpoint and corresponding COT Acceptance Criteria.
However, it should be noted that the COT Acceptance Criteria does not include the instrument setting tolerance. The COT Acceptance Criteria serves as the technical specification OPERABILITY limit for the purpose of the COT. If the absolute difference between the as-found trip setpoint R.E. Ginna Nuclear Power Plant                B 3.3.2-5                                    Revision 42
 
ESFAS Instrumentation B 3.3.2 and the previous as-left trip setpoint does not exceed the COT Acceptance Criteria, the bistable is considered OPERABLE.
The Nominal Trip Setpoint is the value at which the bistable is set and is the expected value to be achieved during calibration. The Nominal Trip Setpoint value ensures the LSSS and the safety analysis limits are met for surveillance interval selected when a channel is adjusted based on stated channel uncertainties. Any bistable is considered to be properly adjusted when the as-left trip setpoint is within the tolerance band assumed in the uncertainty analysis. The bistable is still operable even if the as-left trip setpoint is non-conservative with respect to the LSSS provided that the as-left trip setpoint is within the established calibration tolerance band as specified in the Ginna Instrument Setpoint Methodology.
Trip setpoints consistent with the requirements of the LSSS ensure that SLs are not violated during DBAs (and that the consequences of DBAs will be acceptable, providing the unit is operated from within the LCOss at the onset of the DBA and the equipment functions as designed).
The required channels of ESFAS instrumentation provide plant protection in the event of any of the analyzed accidents. ESFAS protection functions provided in Table 3.3.2-1 are as follows:
: 1. Safety Injection Safety Injection (SI) provides two primary functions:
: 1. Primary side water addition to ensure maintenance or recovery of reactor vessel water level (coverage of the active fuel for heat removal, clad integrity, and for limiting peak clad temperature to < 2200&#xba;F); and
: 2. Boration to ensure recovery and maintenance of SDM (keff
                                    < 1.0).
These functions are necessary to mitigate the effects of high energy line breaks (HELBs) both inside and outside of containment.
The SI signal is also used to initiate other Functions such as:
* Containment Isolation;
* Containment Ventilation Isolation;
* Reactor Trip;
* Feedwater Isolation; and
* Start of motor driven auxiliary feedwater (AFW) pumps.
R.E. Ginna Nuclear Power Plant                B 3.3.2-6                                    Revision 42
 
ESFAS Instrumentation B 3.3.2 These other functions ensure:
* Isolation of nonessential systems through containment penetrations;
* Trip of the reactor to limit power generation;
* Isolation of main feedwater (MFW) to limit secondary side mass losses; and
* Start of AFW to ensure secondary side cooling capability.
: a. Safety Injection-Manual Initiation This LCO requires one channel per train to be OPERABLE in MODES 1, 2, 3, and 4. In these MODES, there is sufficient energy in the primary and secondary systems to warrant automatic initiation of ESF systems. The operator can initiate SI at any time by using either of two pushbuttons on the main control board. This action will cause actuation of all components with the exception of Containment Isolation.
The LCO for the Manual Initiation Function ensures the proper amount of redundancy is maintained in the manual ESFAS actuation circuitry to ensure the operator has manual ESFAS initiation capability.
Each channel consists of one pushbutton and the interconnecting wiring to the actuation logic cabinet. Each pushbutton actuates both trains. This configuration does not allow testing at power.
This function is not required to be OPERABLE in MODES 5, and 6 because there is adequate time for the operator to evaluate plant conditions and respond by manually starting individual systems, pumps, and other equipment to mitigate the consequences of an abnormal condition or accident.
Plant pressure and temperature are very low and many ESF components are administratively locked out or otherwise prevented from actuating to prevent inadvertent overpressurization of plant systems.
: b. Safety Injection-Automatic Actuation Logic and Actuation Relays This LCO requires two trains to be OPERABLE in MODES 1, 2, 3, and 4. In these MODES, there is sufficient energy in the primary and secondary systems to warrant automatic initiation of ESF systems. Actuation logic consists of all circuitry housed within the actuation subsystems, including R.E. Ginna Nuclear Power Plant              B 3.3.2-7                                  Revision 42
 
ESFAS Instrumentation B 3.3.2 the initiating relay contacts responsible for actuating the ESF equipment.
This Function is not required to be OPERABLE in MODES 5 and 6 because there is adequate time for the operator to evaluate plant conditions and respond by manually starting individual systems, pumps, and other equipment to mitigate the consequences of an abnormal condition or accident.
Plant pressure and temperature are very low and many ESF components are administratively locked out or otherwise prevented from actuating to prevent inadvertent overpressurization of plant systems.
: c. Safety Injection-Containment Pressure-High This signal provides protection against the following accidents:
* SLB inside containment;
* LOCA; and
* Feed line break inside containment.
Containment Pressure-High provides no input to any control functions. Thus, three OPERABLE channels are sufficient to satisfy protective requirements with a two-out-of-three logic.
PT-945, PT-947, and PT-949 are the three channels required for this function. The transmitters and electronics are located outside of containment with the sensing lines passing through containment penetrations to sense the containment atmosphere in three different locations.
Thus, the high pressure Function will not experience any adverse environmental conditions and the LSSS reflects only steady state instrument uncertainties.
Containment Pressure-High must be OPERABLE in MODES 1, 2, 3, and 4 because there is sufficient energy in the primary and secondary systems to pressurize the containment following a pipe break. In MODES 5 and 6, Containment Pressure-High is not required to be OPERABLE because there is insufficient energy in the primary or secondary systems to pressurize the containment.
R.E. Ginna Nuclear Power Plant            B 3.3.2-8                                  Revision 42
 
ESFAS Instrumentation B 3.3.2
: d. Safety Injection-Pressurizer Pressure-Low This signal provides protection against the following accidents:
* Inadvertent opening of a steam generator (SG) atmospheric relief or safety valve;
* SLB;
* Rod cluster control assembly ejection accidents (rod ejection);
* Inadvertent opening of a pressurizer relief or safety valve;
* LOCAs; and
* SG Tube Rupture.
Since there are dedicated protection and control channels, only three protection channels are necessary to satisfy the protective requirements. PT-429, PT-430, and PT-431 are the three channels required for this function.
The transmitters are located inside containment, with the taps in the vapor space region of the pressurizer, and thus possibly experiencing adverse environmental conditions (LOCA, SLB inside containment, rod ejection). Due to the rapid nature of the events, the LSSS reflects the inclusion of only steady state instrument uncertainties.
This Function must be OPERABLE in MODES 1, 2, and 3 (above the Pressurizer Pressure interlock) to mitigate the consequences of an HELB inside containment. This signal may be manually blocked by the operator below the interlock setpoint. Automatic SI actuation below this interlock setpoint is performed by the Containment Pressure-High signal.
This function is not required to be OPERABLE in MODE 3 below the Pressurizer Pressure interlock setpoint. Other ESF functions are used to detect accident conditions and actuate the ESF systems in this MODE. In MODES 4, 5, and 6, this Function is not needed for accident detection and mitigation.
R.E. Ginna Nuclear Power Plant          B 3.3.2-9                                    Revision 42
 
ESFAS Instrumentation B 3.3.2
: e. Safety Injection-Steam Line Pressure-Low Steam Line Pressure-Low provides protection against the following accidents:
* SLB;
* Feed line break; and
* Inadvertent opening of an SG atmospheric relief or an SG safety valve.
Steam line pressure transmitters provide control input, but the control function cannot initiate events that the Function acts to mitigate. Thus, three OPERABLE channels on each steam line are sufficient to satisfy the protective requirements with a two-out-of-three logic on each steam line. PT-468, PT-469, and PT-482 are the three channels required for steam line A.
PT-478, PT-479, and PT-483 are the three channels required for steam line B. Each steam line is considered a separate function for the purpose of this LCO. The loss of inverter MQ-483 requires declaring PT-479 inoperable.
With the transmitters located in the Intermediate Building, it is possible for them to experience adverse environmental conditions during a secondary side break. Due to the rapid nature of the events, the LSSS reflects only steady state instrument uncertainties.
Steam Line Pressure-Low must be OPERABLE in MODES 1, 2, and 3 (above The Pressurizer Pressure interlock) when a secondary side break or stuck open SG atmospheric relief or safety valve could result in the rapid depressurization of the steam lines. This signal may be manually blocked by the operator below the interlock setpoint. Below the interlock setpoint, a feed line break is not a concern. This Function is not required to be OPERABLE in MODE 4, 5, or 6 because there is insufficient energy in the secondary side of the plant to cause an accident.
R.E. Ginna Nuclear Power Plant          B 3.3.2-10                                    Revision 42
 
ESFAS Instrumentation B 3.3.2
: 2. Containment Spray (CS)
CS provides three primary functions:
: 1. Lowers containment pressure and temperature after an HELB in containment;
: 2. Reduces the amount of radioactive iodine in the containment atmosphere; and
: 3. Adjusts the pH of the water in containment sump B after a large break LOCA.
These functions are necessary to:
* Ensure the pressure boundary integrity of the containment structure;
* Limit the release of radioactive iodine to the environment in the event of a failure of the containment structure; and
* Minimize corrosion of the components and systems inside containment following a LOCA.
CS is actuated manually or by Containment Pressure-High High.
The CS actuation signal starts the CS pumps and aligns the discharge of the pumps to the CS nozzle headers in the upper levels of containment. Water is initially drawn from the RWST by the CS pumps and mixed with a sodium hydroxide solution from the spray additive tank. During the recirculation phase of accident recovery, the spray pump suctions are manually shifted to containment sump B if continued CS is required.
: a. CS-Manual Initiation The operator can initiate CS at any time from the control room by simultaneously depressing two CS actuation pushbuttons.
Because an inadvertent actuation of CS could have serious consequences, two pushbuttons must be simultaneously depressed to initiate both trains of CS. Therefore, the inoperability of either pushbutton fails both trains of manual initiation.
Manual initiation of CS must be OPERABLE in MODES 1, 2, 3, and 4 because a DBA could cause a release of radioactive material to containment and an increase in containment temperature and pressure requiring the operation of the CS System.
R.E. Ginna Nuclear Power Plant              B 3.3.2-11                                  Revision 42
 
ESFAS Instrumentation B 3.3.2 In MODES 5 and 6, this function is not required to be OPERABLE because the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. In MODES 5 and 6, there is also adequate time for the operators to evaluate plant conditions and respond to mitigate the consequences of abnormal conditions by manually starting individual components.
: b. CS-Automatic Actuation Logic and Actuation Relays Actuation logic consists of all circuitry housed within the actuation subsystems, including the initiating relay contacts responsible for actuating the ESF equipment.
Automatic initiation of CS must be OPERABLE in MODES 1, 2, 3, and 4 because a DBA could cause a release of radioactive material to containment and an increase in containment temperature and pressure requiring the operation of the CS System.
In MODES 5 and 6, this Function is not required to be OPERABLE because the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. In MODES 5 and 6, there is also adequate time for the operators to evaluate plant conditions and respond to mitigate the consequences of abnormal conditions by manually starting individual components.
: c. CS-Containment Pressure-High High This signal provides protection against a LOCA or an SLB inside containment. The transmitters are located outside of containment with the sensing lines passing through containment penetrations to sense the containment atmosphere in three different locations. The transmitters and electronics are located outside of containment. Thus, they will not experience any adverse environmental conditions and the LSSS reflects only steady state instrument uncertainties.
This is the only ESFAS Function that requires the bistable output to energize to perform its required action. It is not desirable to have a loss of power actuate CS, since the consequences of an inadvertent actuation of CS could be serious.
R.E. Ginna Nuclear Power Plant            B 3.3.2-12                                  Revision 42
 
ESFAS Instrumentation B 3.3.2 The Containment Pressure-High High instrument function consists of two sets with three channels in each set. One set is comprised of PT-945, PT-947, and PT-949. The second set is comprised of PT-946, PT-948, and PT-950. Each set is a two-out-of-three logic where the outputs are combined so that both sets tripped initiates CS. Each set is considered a separate function for the purposes of this LCO. Since containment pressure is not used for control, this arrangement exceeds the minimum redundancy requirements. Additional redundancy is warranted because this Function is energize to trip. Containment Pressure-High High must be OPERABLE in MODES 1, 2, 3 and 4 because a DBA could cause a release of radioactive material to containment and an increase in containment temperature and pressure requiring the operation of the CS System. The loss of inverter MQ-483 requires declaring PT-950 inoperable.
In MODES 5 and 6, this Function is not required to be OPERABLE because the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. In MODES 5 and 6, there is also adequate time for the operators to evaluate plant conditions and respond to mitigate the consequences of abnormal conditions by manually starting individual components.
: 3. Containment Isolation Containment Isolation provides isolation of the containment atmosphere, and selected process systems that penetrate containment, from the environment. This Function is necessary to prevent or limit the release of radioactivity to the environment in the event of a LOCA.
Containment Isolation signals isolate all automatically isolatable process lines, except feedwater lines, main steam lines, and component cooling water (CCW). The main feedwater and steam lines are isolated by other functions since forced circulation cooling using the reactor coolant pumps (RCPs) and SGs is the preferred (but not required) method of decay heat removal. Since CCW is required to support RCP operation, not isolating CCW enhances plant safety by allowing operators to use forced RCS circulation to cool the plant. Isolating CCW may require the use of feed and bleed cooling, which could prove more difficult to control.
R.E. Ginna Nuclear Power Plant              B 3.3.2-13                                  Revision 42
 
ESFAS Instrumentation B 3.3.2
: a. Containment Isolation-Manual Initiation Manual Containment Isolation is actuated by either of two pushbuttons on the main control board. Either pushbutton actuates both trains. Manual initiation of Containment Isolation also actuates Containment Ventilation Isolation.
Manual initiation of Containment Isolation must be OPERABLE in MODES 1, 2, 3 and 4, because there is a potential for an accident to occur.
In MODES 5 and 6, there is insufficient energy in the primary or secondary systems to pressurize the containment to require Containment Isolation. There also is adequate time for the operator to evaluate plant conditions and manually actuate individual isolation valves in response to abnormal or accident conditions.
Containment Isolation-Manual Initiation is required to be OPERABLE during CORE ALTERATIONS or movement of irradiated fuel assemblies within containment, since it provides actuation of Containment Ventilation Isolation (LCO 3.3.5). Under these conditions, the potential exists for an accident that could release fission product radioactivity into containment.
: b. Containment Isolation-Automatic Actuation Logic and Actuation Relays Actuation logic consists of all circuitry housed within the actuation subsystems, including the initiating relay contacts responsible for actuating the ESF equipment.
Automatic initiation of Containment Isolation must be OPERABLE in MODES 1, 2, 3 and 4, because there is a potential for an accident to occur.
In MODES 5 and 6, there is insufficient energy in the primary or secondary systems to pressurize the containment to require Containment Isolation. There also is adequate time for the operator to evaluate plant conditions and manually actuate individual isolation valves in response to abnormal or accident conditions.
R.E. Ginna Nuclear Power Plant          B 3.3.2-14                                  Revision 42
 
ESFAS Instrumentation B 3.3.2
: c. Containment Isolation-Safety Injection Containment Isolation is also initiated by all Functions that automatically initiate SI. The Containment Isolation requirements for these Functions are the same as the requirements for their SI function. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all applicable automatic initiating Functions and requirements.
: 4. Steam Line Isolation Isolation of the main steam lines provides protection in the event of an SLB inside or outside containment. Closure of the main steam isolation valves (MSIVs) and their associated non-return check valves limits the accident to the blowdown from only the affected SG. For a SLB downstream of the MSIVs, closure of the MSIVs terminates the accident as soon as the steam lines depressurize.
Steam Line Isolation also mitigates the effects of a feed line break and ensures a source of steam for the turbine driven AFW pump during a feed line break.
: a. Steam Line Isolation-Manual Initiation Manual initiation of Steam Line Isolation can be accomplished from the control room. There are two actuation devices (one pushbutton and one switch) on the main control board for each MSIV. Each device can initiate action to immediately close its respective MSIV. The LCO requires one channel (device) per loop to be OPERABLE. Each loop is not considered a separate function since there is only one required per loop.
Manual initiation of steam line isolation must be OPERABLE in MODES 1, 2, and 3 because a secondary side break or stuck open valve could result in rapid depressurization of the steam lines. This could result in the release of significant quantities of energy and cause a cooldown of the primary system. The Steam Line Isolation Function is required to be OPERABLE in MODES 2 and 3 unless both MSIVs are closed and de-activated. In MODES 4, 5, and 6, the steam line isolation function is not required to be OPERABLE because there is insufficient energy in the RCS and SGs to experience an SLB or other accident releasing significant quantities of energy.
R.E. Ginna Nuclear Power Plant                B 3.3.2-15                                  Revision 42
 
ESFAS Instrumentation B 3.3.2
: b. Steam Line Isolation-Automatic Actuation Logic and Actuation Relays Actuation logic consists of all circuitry housed within the actuation subsystems, including the initiating relay contacts responsible for actuating the ESF equipment.
Automatic initiation of steam line isolation must be OPERABLE in MODES 1, 2, and 3 because a secondary side break or stuck open valve could result in rapid depressurization of the steam lines. This could result in the release of significant quantities of energy and cause a cooldown of the primary system. The Steam Line Isolation Function is required to be OPERABLE in MODES 2 and 3 unless both MSIVs are closed and de-activated. In MODES 4, 5, and 6, the steam line isolation function is not required to be OPERABLE because there is insufficient energy in the RCS and SGs to experience an SLB or other accident releasing significant quantities of energy.
: c. Steam Line Isolation-Containment Pressure-High High This Function actuates closure of both MSIVs in the event of a LOCA or an SLB inside containment to maintain at least one unfaulted SG as a heat sink for the reactor, and to limit the mass and energy release to containment. The transmitters are located outside containment with the sensing lines passing through containment penetrations to sense the containment atmosphere in three different locations. Thus, they will not experience any adverse environmental conditions, and the LSSS reflects only steady state instrument uncertainties. Containment Pressure-High High provides no input to any control functions. Thus, three OPERABLE channels are sufficient to satisfy protective requirements with two-out-of-three logic. PT-946, PT-948, and PT-950 are the three channels required for this function.
The loss of inverter MQ-483 requires declaring PT-950 inoperable.
Containment Pressure-High High must be OPERABLE in MODES 1, 2, and 3, because there is sufficient energy in the primary and secondary side to pressurize the containment following a pipe break. This would cause a significant increase in the containment pressure, thus allowing detection and closure of the MSIVs. The steam line isolation Function must be OPERABLE in MODES 2 and 3 unless both MSIVs are closed and de-activated. In MODES 4, 5, and 6 the steam line isolation Function is not required to be OPERABLE because there is not enough energy in the R.E. Ginna Nuclear Power Plant          B 3.3.2-16                                    Revision 42
 
ESFAS Instrumentation B 3.3.2 primary and secondary sides to pressurize the containment to the Containment Pressure-High High setpoint.
: d. Steam Line Isolation-High Steam Flow Coincident With Safety Injection and Coincident With Tavg-Low This Function provides closure of the MSIVs during an SLB or inadvertent opening of multiple SG atmospheric relief or safety valves to maintain at least one unfaulted SG as a heat sink for the reactor, and to limit the mass and energy release to containment.
The specified Limiting Safety System Setting (LSSS) is based on steam line breaks occurring from no load conditions (1005 psig). Specifically, steam line breaks which result in a steam flow analytical limit of > 1.50E6 Ibm/hr are considered. The steam flow signal to this function's bistables are not pressure compensated (i.e.,
only the main control board indicators are compensated).
However, the high steam flow bistable setpoint is determined from the expected flow transmitter differential pressure under steam conditions of 1.50E6 Ibm/hr at 1005 psig. Steam breaks which result in higher flowrates or lower pressure generate larger differential pressures such that the high steam flow bistables would be tripped. Steam line breaks which result in < 1.50E6 Ibm/hr do not require automatic action to isolate. The high steam flow bistables are OPERABLE if they are placed in the tripped condition since the specified LSSS are met. However, all applicable surveillances related to the tripped channel must continue to be performed and met.
Two steam line flow channels per steam line are required to be OPERABLE for this Function. These are combined in a one-out-of-two logic to indicate high steam flow in one steam line. FT-464 and FT-465 are the two channels required for steam line A. FT-474 and FT-475 are the two channels required for steam line B. Each steam line is considered a separate function for the purpose of this LCO. The steam flow transmitters provide control inputs, but the control function cannot initiate events that the function acts to mitigate. Therefore, additional channels are not required to address control protection interaction issues. The one-out-of-two configuration allows online testing because trip of one high steam flow channel is not sufficient to cause initiation.
R.E. Ginna Nuclear Power Plant            B 3.3.2-17                                  Revision 42
 
ESFAS Instrumentation B 3.3.2 With the transmitters (d/p cells) located inside containment, it is possible for them to experience adverse environmental conditions during an SLB event. Due to the rapid nature of the event, the LSSS reflects only steady state instrument uncertainties.
The main steam line isolates only if the high steam flow signal occurs coincident with an SI and low RCS average temperature. The Main Steam Line Isolation Function requirements for the SI Functions are the same as the requirements for their SI function. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all applicable initiating functions and requirements.
Two channels of Tavg per loop are required to be OPERABLE for this Function. TC-401 and TC-402 are the two channels required for RCS loop A. TC-403 and TC-404 are the two channels required for RCS loop B. Each loop is considered a separate Function for the purpose of this LCO. The Tavg channels are combined in a logic such that any two of the four Tavg channels tripped in conjunction with SI and one of the two high steam line flow channels tripped causes isolation of the steam line associated with the tripped steam line flow channels. The accidents that this Function protects against cause reduction of Tavg in the entire primary system.
Therefore, the provision of two OPERABLE channels per loop in a two-out-of-four configuration ensures no single failure disables the Tavg-Low Function. The Tavg channels provide control inputs, but the control function cannot initiate events that the Function acts to mitigate. Therefore, additional channels are not required to address control protection interaction issues.
This Function must be OPERABLE in MODES 1, 2, and 3 when a secondary side break or stuck open valve could result in rapid depressurization of the steam lines. The Steam Line Isolation Function is required to be OPERABLE in MODES 2 and 3 unless both MSIVs are closed and de-activated. This Function is not required to be OPERABLE in MODES 4, 5, and 6 because there is insufficient energy in the secondary side of the plant to have an accident.
R.E. Ginna Nuclear Power Plant          B 3.3.2-18                                    Revision 42
 
ESFAS Instrumentation B 3.3.2
: e. Steam Line Isolation-High High Steam Flow Coincident With Safety Injection This Function provides closure of the MSIVs during a large steam line break to maintain at least one unfaulted SG as a heat sink for the reactor, and to limit the mass and energy release to containment.
The specified LSSS is based on steamline breaks occurring from full power steam conditions which result in  155% RTP analytical limit steam flow. The steam flow signal to this function's bistables are not pressure compensated (i.e., only the main control board indicators are compensated).
However, the high-high steam flow bistable setpoint is determined from the expected flow transmitter differential pressure under steam conditions of 4.53E6 Ibm/hr at 785 psig. Steam breaks which result in higher flowrates or lower pressure generate larger differential pressures such that the high-high steam flow bistables would be tripped.
Two steam line flow channels per steam line are required to be OPERABLE for this Function. These are combined in a one-out-of-two logic to indicate high-high steam flow in one steam line. FT-464 and FT-465 are the two channels required for steam line A. FT-474 and FT-475 are the two channels required for steam line B. Each steam line is considered a separate function for the purpose of this LCO.
The steam flow transmitters provide control inputs, but the control function cannot initiate events that the Function acts to mitigate. Therefore, additional channels are not required to address control protection interaction issues.
The main steam lines isolate only if the high-high steam flow signal occurs coincident with an SI signal. Steamline isolation occurs only for the steam line associated with the tripped steam flow channels. The Main Steam Line Isolation Function requirements for the SI Functions are the same as the requirements for their SI function. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all applicable initiating functions and requirements.
This Function must be OPERABLE in MODES 1, 2, and 3 because a secondary side break or stuck open valve could result in rapid depressurization of the steam lines. The Steam Line Isolation Function is required to be OPERABLE in MODES 2 and 3 unless both MSIV's are closed and de-activated. This Function is not required to be OPERABLE in MODES 4, 5, and 6 because there is insufficient energy in the secondary side of the plant to have an accident.
R.E. Ginna Nuclear Power Plant            B 3.3.2-19                                    Revision 42
 
ESFAS Instrumentation B 3.3.2
: 5. Feedwater Isolation The primary function of the Feedwater Isolation signals is to prevent and mitigate the effects of highwater level in the SGs which could cause carryover of water into the steam lines and result in excessive cooldown of the primary system. The SG high water level is due to excessive feedwater flows.
This Function is actuated by either a SG Water Level-High or an SI signal. The Function provides feedwater isolation by closing the Main Feedwater Regulating Valves (MFRVs) and the associated bypass valves. In addition, on an SI signal, the AFW System is automatically started, the MFIVs are closed, and the MFW pump breakers are opened which closes the MFW pump discharge valves. The SI signal was discussed previously.
: a. Feedwater Isolation-Automatic Actuation Logic and Actuation Relays Actuation logic consists of all circuitry housed within the actuation subsystems, including the initiating relay contacts responsible for actuating the ESF equipment.
Automatic initiation must be OPERABLE in MODES 1, 2, and
: 3. The Feedwater Isolation Function is required to be OPERABLE in MODES 2 and 3 unless all MFRVs and associated bypass valves are closed and de-activated or isolated by a closed manual valve. In MODES 4, 5, and 6, the MFW System and the turbine generator are not in service and this Function is not required to be OPERABLE.
: b. Feedwater Isolation-Steam Generator Water Level-High The Steam Generator Water Level-High Function must be OPERABLE in MODES 1, 2, and 3. The Feedwater Isolation Function is required to be OPERABLE in MODES 2 and 3 unless all MFRVs and associated bypass valves are closed and de-activated or isolated by a closed manual valve. In MODES 4, 5, and 6, the MFW System and the turbine generator are not in service and this Function is not required to be OPERABLE.
R.E. Ginna Nuclear Power Plant                B 3.3.2-20                                  Revision 42
 
ESFAS Instrumentation B 3.3.2 This signal provides protection against excessive feedwater flow. The ESFAS SG water level instruments have dedicated protection and control channels, only three protection channels are necessary to satisfy the protective requirements. LT-461, LT-462, and LT-463 are the three channels required for SG A. LT-471, LT-472, and LT-473 are the three channels required for SG B. Each SG is considered a separate Function for the purpose of this LCO. The LSSS for SG Water Level-High is a percent of narrow range instrument span.
: c. Feedwater Isolation-Safety Injection The Safety Injection Function must be OPERABLE in MODES 1, 2, and 3. The Feedwater Isolation Function is required to be OPERABLE in MODES 2 and 3 unless all MFRVs and associated bypass valves are closed and de-activated or isolated by a closed manual valve. In MODES 4, 5, and 6, the MFW System and the turbine generator are not in service and this Function is not required to be OPERABLE.
Feedwater Isolation is also initiated by all Functions that initiate SI. The Feedwater Isolation Function requirements for these Functions are the same as the requirements for their SI function. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead Function 1, SI, is referenced for all initiating functions and requirements.
: 6. Auxiliary Feedwater The AFW System is designed to provide a secondary side heat sink for the reactor in the event that the MFW System is not available.
The preferred system has two motor driven pumps and a turbine driven pump, making it available during normal plant operation, during a loss of AC power, a loss of MFW, and during a Feedwater System pipe break (depending on break location). A Standby AFW (SAFW) System is also available in the event the preferred system is unavailable. The normal source of water for the AFW System is the condensate storage tank (CST) which is not safety related.
Upon a low level in the CST the operators can manually realign the pump suctions to the Service Water (SW) System which is the safety related water source. The SW System also is the safety related water source for the SAFW System. The AFW System is aligned so that upon a pump start, flow is initiated to the respective SGs immediately while the SAFW System is only manually initiated and aligned.
R.E. Ginna Nuclear Power Plant                B 3.3.2-21                                  Revision 42
 
ESFAS Instrumentation B 3.3.2
: a. Auxiliary Feedwater-Manual Initiation The operator can initiate AFW or SAFW at any time by using control switches on the Main Control board (one switch for each pump in each system). This action will cause actuation of their respective pump.
The LCO for the Manual Initiation Function ensures the proper amount of redundancy is maintained to ensure the operator has manual AFW and SAFW initiation capability.
The LCO requires one channel per pump in each system to be OPERABLE in MODES 1, 2, and 3 to ensure that the SGs remain the heat sink for the reactor. In MODE 4, AFW actuation is not required to be OPERABLE because either AFW or residual heat removal (RHR) will already be in operation to remove decay heat or sufficient time is available to manually place either system in operation. This Function is not required to be OPERABLE in MODES 5 and 6 because there is not enough heat being generated in the reactor to require the SGs as a heat sink.
: b. Auxiliary Feedwater-Automatic Actuation Logic and Actuation Relays Actuation logic consists of all circuitry housed within the actuation subsystems, including the initiating relay contacts responsible for actuating the ESF equipment.
Automatic initiation of Auxiliary Feedwater must be OPERABLE in MODES 1, 2, and 3 to ensure that the SGs remain the heat sink for the reactor. In MODE 4, AFW actuation is not required to be OPERABLE because either AFW or residual heat removal (RHR) will already be in operation to remove decay heat or sufficient time is available to manually place either system in operation. This Function is not required to be OPERABLE in MODES 5 and 6 because there is not enough heat being generated in the reactor to require the SGs as a heat sink.
R.E. Ginna Nuclear Power Plant            B 3.3.2-22                                  Revision 42
 
ESFAS Instrumentation B 3.3.2
: c. Auxiliary Feedwater-Steam Generator Water Level-Low Low SG Water Level-Low Low must be OPERABLE in MODES 1, 2, and 3 to provide protection against a loss of heat sink. A feed line break, inside or outside of containment, or a loss of MFW, would result in a loss of SG water level. SG Water Level-Low Low in either SG will cause both motor driven AFW pumps to start. The system is aligned so that upon a start of the pump, water immediately begins to flow to the SGs. SG Water Level-Low Low in both SGs will cause the turbine driven pump to start. In MODE 4, AFW actuation is not required to be OPERABLE because either AFW or RHR will already be in operation to remove decay heat or sufficient time is available to manually place either system in operation. This Function is not required to be OPERABLE in MODES 5 and 6 because there is not enough heat being generated in the reactor to require the SGs as a heat sink.
LT-461, LT-462, and LT-463 are the three channels required for SG A. LT-471, LT-472, and LT-473 are the three channels required for SG B. Each SG is considered a separate Function for the purpose of this LCO. The LSSS for SG Water Level - Low Low is a percent of narrow range instrument span.
With the transmitters (d/p cells) located inside containment and thus possibly experiencing adverse environmental conditions (feed line break), the LSSS reflects the inclusion of both steady state and adverse environmental instrument uncertainties.
: d. Auxiliary Feedwater-Safety Injection The SI function must be OPERABLE in MODES 1, 2, and 3 to ensure that the SGs remain the heat sink for the reactor. In MODE 4, AFW actuation is not required to be OPERABLE because either AFW or residual heat removal (RHR) will already be in operation to remove decay heat or sufficient time is available to manually place either system in operation.
This Function is not required to be OPERABLE in MODES 5 and 6 because there is not enough heat being generated in the reactor to require the SGs as a heat sink.
R.E. Ginna Nuclear Power Plant            B 3.3.2-23                                Revision 42
 
ESFAS Instrumentation B 3.3.2 An SI signal starts the motor driven AFW pumps. The AFW initiation functions are the same as the requirements for their SI function. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all applicable initiating functions and requirements.
: e. Auxiliary Feedwater-Undervoltage-Bus 11A and 11B The Undervoltage-Bus 11A and 11B Function must be OPERABLE in MODES 1, 2, and 3 to ensure that the SGs remain the heat sink for the reactor. In MODE 4, AFW actuation is not required to be OPERABLE because either AFW or RHR will already be in operation to remove decay heat or sufficient time is available to manually place either system in operation. This Function is not required to be OPERABLE in MODES 5 and 6 because there is not enough heat being generated in the reactor to require the SGs as a heat sink.
A loss of power to 4160 V Bus 11A and 11B will be accompanied by a loss of power to both MFW pumps and the subsequent need for some method of decay heat removal.
The loss of offsite power is detected by a voltage drop on each bus. Loss of power to both buses will start the turbine driven AFW pump to ensure that at least one SG contains enough water to serve as the heat sink for reactor decay heat and sensible heat removal following the reactor trip. Each bus is considered a separate Function for the purpose of this LCO.
: f. Auxiliary Feedwater-Trip Of Both Main Feedwater Pumps A trip of both MFW pumps is an indication of a loss of MFW and the subsequent need for some method of decay heat and sensible heat removal. The MFW pumps are equipped with a breaker position sensing device. An open supply breaker indicates that the pump is not running. Two OPERABLE channels per MFW pump satisfy redundancy requirements with two-out-of-two logic. Each MFW pump is considered a Separate Function for the purpose of this LCO. A trip of both MFW pumps starts both motor driven AFW (MDAFW) pumps to ensure that at least one SG is available with water to act as the heat sink for the reactor. However, this actuation of the MDAFW pumps is not credited in the mitigation of any accident.
R.E. Ginna Nuclear Power Plant            B 3.3.2-24                                Revision 42
 
ESFAS Instrumentation B 3.3.2 This Function must be OPERABLE in MODE 1. This ensures that at least one SG is provided with water to serve as the heat sink to remove reactor decay heat and sensible heat in the event of an accident. In MODES 2, 3, 4, 5, and 6 the MFW pumps may not be in operation, and thus pump trip is not indicative of a condition requiring automatic AFW initiation.
ACTIONS              A Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed on Table 3.3.2-1.
In the event a channel's trip setpoint is found nonconservative with respect to the COT Acceptance Criteria specified in plant procedures, or the transmitter, instrument loop, signal processing electronics, or bistable is found inoperable, then all affected Functions provided by that channel must be declared inoperable and the LCO Condition(s) entered for the protection Function(s) affected. As shown on Figure B 3.3.2-1, the ESFAS is comprised of multiple interconnected modules and components. For the purpose of this LCO, a channel is defined as including all related components from the field instrument to the Automatic Actuation Logic. Therefore, a channel may be inoperable due to the failure of a field instrument, loss of 120 VAC instrument bus power or a bistable failure which affects one or both ESFAS trains. The only exception to this are the Manual ESFAS and Automatic Actuation Logic Functions which are defined strictly on a train basis. The Automatic Actuation Logic consists of all circuitry housed within the actuation subsystem, including the master relays, slave relays, and initiating relay contacts responsible for activating the ESF equipment.
A.1 Condition A applies to all ESFAS protection functions.
Condition A addresses the situation where one channel or train for one or more Functions are inoperable. The Required Action is to refer to Table 3.3.2-1 and to take the Required Actions for the protection functions affected. The Completion Times are those from the referenced Conditions and Required Actions.
When the number of inoperable channels in an ESFAS Function exceed those specified in all related Conditions associated with an ESFAS Function, then the plant is outside the safety analysis. Therefore, LCO 3.0.3 should be immediately entered if the ESFAS function is applicable in the current MODE of operation.
R.E. Ginna Nuclear Power Plant                B 3.3.2-25                                Revision 42
 
ESFAS Instrumentation B 3.3.2 B.1 Condition B applies to the AFW-Trip of Both MFW Pumps ESFAS Function. If a channel is inoperable, 48 hours is allowed to return it to OPERABLE status. The specified Completion Time of 48 hours is reasonable considering the nature of this Function, the available redundancy, and the low probability of an event occurring during this interval.
C.1 If the Required Action and Completion Time of Condition B is not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 2 within 6 hours. The allowed Completion time is reasonable, based on operating experience, to reach MODE 2 from full power conditions in an orderly manner and without challenging plant systems.
D.1 Condition D applies to the following ESFAS Functions:
* Manual Initiation of SI;
* Manual Initiation of Steam Line Isolation; and
* AFW-Undervoltage-Bus 11A and 11B.
If a channel is inoperable, 48 hours is allowed to restore it to OPERABLE status. The specified Completion Time of 48 hours is reasonable considering that there are two automatic actuation trains and another manual initiation channel OPERABLE for each manual initiation Function, additional AFW actuation channels available besides the Undervoltage-Bus 11A and 11B AFW Initiation Function, and the low probability of an event occurring during this interval.
E.1 Condition E applies to the automatic actuation logic and actuation relays for the following ESFAS Functions:
* Steam Line Isolation;
* Feedwater Isolation; and
* AFW.
R.E. Ginna Nuclear Power Plant              B 3.3.2-26                                  Revision 42
 
ESFAS Instrumentation B 3.3.2 Condition E addresses the train orientation of the protection system and the master and slave relays. If one train is inoperable, a Completion Time of 6 hours is allowed to restore the train to OPERABLE status. This Completion Time is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this time interval. The Completion Time of 6 hours is consistent with Reference 7.
F.1 Condition F applies to the following Functions:
* Steam Line Isolation-Containment Pressure-High High;
* Steam Line Isolation-High Steam Flow Coincident With Safety Injection and Coincident With Tavg -Low;
* Steam Line Isolation-High-High Steam Flow Coincident With Safety Injection;
* Feedwater Isolation-SG Water Level-High; and
* AFW-SG Water Level-Low Low.
Condition F applies to Functions that typically operate on two-out-of-three logic. Therefore, failure of one channel places the Function in a two-out-of-two configuration. One channel must be tripped to place the Function in a one-out-of-two configuration that satisfies redundancy requirements.
If one channel is inoperable, a Completion Time of 6 hours is allowed to restore the channel to OPERABLE status or to place it in the tripped condition. Placing the channel in the Tripped condition conservatively compensates for the inoperability, restores capability to accommodate a single failure, and allows operation to continue.
The Required Actions are modified by a Note that allows the inoperable channel to be bypassed for up to 4 hours for surveillance testing of other channels. This 4 hours applies to each of the remaining OPERABLE channels.
The Completion Time of 6 hours allowed to restore the channel to OPERABLE status or to place the inoperable channel in the tripped condition, and the 4 hours allowed for testing, are justified in Reference 7.
R.E. Ginna Nuclear Power Plant              B 3.3.2-27                                  Revision 42
 
ESFAS Instrumentation B 3.3.2 G.1 If the Required Actions and Completion Times of Conditions D, E, or F are not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
H.1 Condition H applies to the following ESFAS functions:
* Manual Initiation of CS; and
* Manual Initiation of Containment Isolation.
If a channel is inoperable, 48 hours is allowed to restore it to OPERABLE status. The specified Completion Time of 48 hours is reasonable considering that there are two automatic actuation trains and another manual initiation channel OPERABLE for each Function (except for CS) and the low probability of an event occurring during this interval.
I.1 Condition I applies to the automatic actuation logic and actuation relays for the following Functions:
* SI;
* CS; and
* Containment Isolation.
Condition I addresses the train orientation of the protection system and the master and slave relays. If one train is inoperable, a Completion Time of 6 hours is allowed to restore the train to OPERABLE status. This Completion Time is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this interval. The Completion Time of 6 hours is consistent with Reference 7.
R.E. Ginna Nuclear Power Plant              B 3.3.2-28                                  Revision 42
 
ESFAS Instrumentation B 3.3.2 J.1 Condition J applies to the following Functions:
* SI-Containment Pressure-High; and
* CS-Containment Pressure-High High.
Condition J applies to Functions that operate on a two-out-of-three logic (for CS-Containment Pressure-High High there are two sets of this logic).
Therefore, failure of one channel places the Function in a two-out-of-two configuration. One channel must be tripped to place the Function in a one-out-of-two configuration that satisfies redundancy requirements.
If one channel is inoperable, a Completion Time of 6 hours is allowed to restore the channel to OPERABLE status or place it in the tripped condition. Placing the channel in the tripped condition conservatively compensates for the inoperability, restores capability to accommodate a single failure, and allows operation to continue.
The Required Action is modified by a Note that allows the inoperable channel to be bypassed for up to 4 hours for surveillance testing of other channels. The 4 hours applies to each of the remaining OPERABLE channels.
The Completion Time of 6 hours to restore the inoperable channel or place it in trip, and the 4 hours allowed for surveillance testing is justified in Reference 7.
K.1 If the Required Actions and Completion Times of Conditions H, I, or J are not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
L.1 Condition L applies to the following Functions:
* SI-Pressurizer Pressure-Low; and
* SI-Steam Line Pressure-Low.
R.E. Ginna Nuclear Power Plant                B 3.3.2-29                                  Revision 42
 
ESFAS Instrumentation B 3.3.2 Condition L applies to Functions that operate on a two-out-of-three logic.
Therefore, failure of one channel places the Function in a two-out-of-two configuration. One channel must be tripped to place the Function in a one-out-of-two configuration that satisfies redundancy requirements.
If one channel is inoperable, a Completion Time of 6 hours is allowed to restore the channel to OPERABLE status or place it in the tripped condition. Placing the channel in the tripped condition conservatively compensates for the inoperability, restores capability to accommodate a single failure, and allows operation to continue.
The Required Action is modified by a Note that allows the inoperable channel to be bypassed for up to 4 hours for surveillance testing of other channels. The 4 hours applies to each of the remaining OPERABLE channels.
The Completion Time of 6 hours to restore the inoperable channel or place it in trip, and the 4 hours allowed for surveillance testing is justified in Reference 7.
M.1 If the Required Actions and Completion Times of Condition L are not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and pressurizer pressure reduced to < 2000 psig within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
N.1 Condition N applies if an AFW Manual Initiation channel is inoperable. If a manual initiation switch is inoperable, the associated AFW or SAFW pump must be declared inoperable and the applicable Conditions of LCO 3.7.5, "Auxiliary Feedwater (AFW) System" must be entered immediately.
Each AFW manual initiation switch controls one AFW or SAFW pump.
Declaring the associated pump inoperable ensures that appropriate action is taken in LCO 3.7.5 based on the number and type of pumps involved.
R.E. Ginna Nuclear Power Plant                B 3.3.2-30                                  Revision 42
 
ESFAS Instrumentation B 3.3.2 SURVEILLANCE          The SRs for each ESFAS Function are identified by the SRs column REQUIREMENTS          of Table 3.3.2-1. Each channel of process protection supplies both trains of the ESFAS. When testing Channel 1, Train A and Train B must be examined. Similarly, Train A and Train B must be examined when testing Channel 2, Channel 3, and Channel 4 (if applicable). The CHANNEL CALIBRATION and COTs are performed in a manner that is consistent with the assumptions used in analytically calculating the required channel accuracies.
A Note has been added to the SR Table to clarify that Table 3.3.2-1 determines which SRs apply to which ESFAS Functions.
SR 3.3.2.1 This SR is the performance of a CHANNEL CHECK for the following ESFAS Functions:
* SI-Containment Pressure-High;
* SI-Pressurizer Pressure-Low;
* SI-Steam Line Pressure-Low;
* CS-Containment Pressure-High High;
* Steam Line Isolation-Containment Pressure-High High;
* Steam Line Isolation-High Steam Flow Coincident with SI and Tavg- Low;
* Steam Line Isolation-High-High Steam Flow Coincident with SI;
* Feedwater Isolation-SG Water Level-High; and
* AFW-SG Water Level-Low Low.
Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels or of more serious instrument conditions. A CHANNEL CHECK will detect gross channel failure; thus, it is a verification the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
R.E. Ginna Nuclear Power Plant              B 3.3.2-31                                  Revision 77
 
ESFAS Instrumentation B 3.3.2 CHANNEL CHECK acceptance criteria are determined by the plant staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.3.2.2 SR 3.3.2.2 Is modified by a Note. The Note states that the ESFAS input relays are excluded from this surveillance for the Functions specified.
These Functions have installed bypass test capability. For the Functions with installed bypass test capability, the channel is tested in a bypass versus a tripped condition. To preclude placing the channel in a tripped condition, the input relays are excluded from this surveillance.
This SR is the performance of a COT every 92 days for the following ESFAS functions:
* SI-Containment Pressure-High;
* SI-Pressurizer Pressure-Low;
* SI-Steam Line Pressure-Low;
* CS-Containment Pressure-High High;
* Steam Line Isolation-Containment Pressure-High High;
* Steam Line Isolation-High Steam Flow Coincident with SI and Tavg- Low;
* Steam Line Isolation-High-High Steam Flow Coincident with SI;
* Feedwater Isolation-SG Water Level-High; and
* AFW-SG Water Level-Low Low.
A COT is performed on each required channel to ensure the channel will perform the intended Function. Setpoints must be found to be within the COT Acceptance Criteria specified in plant procedures. The as-left values must be consistent with the drift allowance used in the setpoint methodology.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
R.E. Ginna Nuclear Power Plant              B 3.3.2-32                                  Revision 89
 
ESFAS Instrumentation B 3.3.2 SR 3.3.2.3 This SR is the performance of a TADOT. This test is a check of the AFW-Undervoltage-Bus 11A and 11B Function.
The test includes trip devices that provide actuation signals directly to the protection system. The SR is modified by a Note that excludes verification of setpoints for relays. Relay setpoints require elaborate bench calibration and are verified during CHANNEL CALIBRATION. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.3.2.4 This SR is the performance of a TADOT. This test is a check of the SI, CS, Containment Isolation, Steam Line Isolation, and AFW Manual Initiations, and the AFW-Trip of Both MFW Pumps Functions. Each Function is tested up to, and including, the master transfer relay coils.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The SR is modified by a Note that excludes verification of setpoints during the TADOT. The Manual Initiations, and AFW-Trip of Both MFW Pumps Functions have no associated setpoints.
SR 3.3.2.5 This SR is the performance of a CHANNEL CALIBRATION of the following ESFAS Functions:
* SI-Containment Pressure-High;
* SI-Pressurizer Pressure-Low;
* SI-Steam Line Pressure-Low;
* CS-Containment Pressure-High High;
* Steam Line Isolation-Containment Pressure-High High;
* Steam Line Isolation-High Steam Flow Coincident with SI and Tavg- Low;
* Steam Line Isolation-High-High Steam Flow Coincident with SI;
* Feedwater Isolation-SG Water Level-High;
* AFW-SG Water Level-Low Low; and
* AFW-Undervoltage-Bus 11A and 11B.
R.E. Ginna Nuclear Power Plant              B 3.3.2-33                                  Revision 77
 
ESFAS Instrumentation B 3.3.2 CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy.
CHANNEL CALIBRATIONS must be performed consistent with the assumptions of the plant specific setpoint methodology. The "as left" values must be consistent with the drift allowance used in the setpoint methodology.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.3.2.6 This SR ensures the SI-Pressurizer Pressure-Low and SI-Steam Line Pressure-Low Functions are not bypassed when pressurizer pressure
                      > 2000 psig while in MODES 1, 2, and 3. Periodic testing of the pressurizer pressure channels is required to verify the setpoint to be less than or equal to the limit.
The difference between the current as-found values and the previous test as-left values must be consistent with the drift allowance used in the setpoint methodology (Ref. 6). The setpoint shall be left set consistent with the assumptions of the current plant specific setpoint methodology.
If the pressurizer pressure interlock setpoint is nonconservative, then the Pressurizer Pressure-Low and Steam Line Pressure-Low Functions are considered inoperable. Alternatively, the pressurizer pressure interlock can be placed in the conservative condition (nonbypassed). If placed in the nonbypassed condition, the SR is met and the Pressurizer Pressure-Low and Steam Line Pressure-Low Functions would not be considered inoperable. The Surveillance Frequency is controlled under Surveillance Frequency Control Program.
SR 3.3.2.7 This SR is the performance of an ACTUATION LOGIC TEST on all ESFAS Automatic Actuation Logic and Actuation Relays Functions. This test includes the application of various simulated or actual input combinations in conjunction with each possible interlock state and verification of the required logic output. Relay and contact operation is verified by a continuance check or actuation of the end device.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
R.E. Ginna Nuclear Power Plant              B 3.3.2-34                                Revision 77
 
ESFAS Instrumentation B 3.
 
==3.2 REFERENCES==
: 1. Atomic Industrial Forum (AIF) GDC 15, Issued for Comment July 10, 1967.
: 2. UFSAR, Chapter 7.
: 3. UFSAR, Chapter 6.
: 4. UFSAR, Chapter 15.
: 5. IEEE-279-1971.
: 6. EP-3-S-0505, "Instrument Setpoint/Loop Accuracy Calculation Methodology".
: 7. WCAP-10271-P-A, Supplement 2, Rev. 1, June 1990.
8    "Power Range Nuclear Instrumentation System Bypass Test Instrumentation for R. E. Ginna," WCAP-18298-P, September 2017.
R.E. Ginna Nuclear Power Plant            B 3.3.2-35                              Revision 89
 
ESFAS Instrumentation B 3.3.2 Figure B 3.3.2-1 R.E. Ginna Nuclear Power Plant    B 3.3.2-36              Revision 42
 
PAM Instrumentation B 3.3.3 B 3.3    INSTRUMENTATION B 3.3.3      Post Accident Monitoring (PAM) Instrumentation BASES BACKGROUND            The primary purpose of the PAM instrumentation is to display plant variables that provide information required by the control room operators during accident conditions. This instrumentation provides the necessary support for the operator to take required manual actions, verify that automatic and required manual safety functions have been completed, and to determine if fission product barriers have been breached following a Design Basis Accident (DBA).
The OPERABILITY of the accident monitoring instrumentation ensures that there is sufficient information available on selected plant parameters to monitor and assess plant status and behavior during an accident.
The availability of accident monitoring instrumentation is important so that responses to corrective actions can be observed and the need for, and magnitude of, further actions can be determined. These essential instruments are identified in Reference 1 addressing the recommendations of Regulatory Guide 1.97 (Ref. 2) as required by Supplement 1 to NUREG-0737 (Ref. 3).
The instrument channels required to be OPERABLE by this LCO provide information for key parameters identified during implementation of Regulatory Guide 1.97 as Category I variables. Category I variables are organized into four types and are the key variables deemed risk significant because they are needed to:
: a. Provide the primary information required for the control room operator to take specific manually controlled actions for which no automatic control is provided, and that are required for safety systems to accomplish their safety functions for DBAs (Type A).
: b. Provide the primary information required for the control room operator to verify that required automatic and manually controlled functions have been accomplished (Type B);
: c. Provide information to the control room operators that will enable them to determine the likelihood of a gross breach of the barriers to radioactivity release (Type C); and
: d. Provide information regarding the release of radioactive materials to allow for early indication of the need to initiate action necessary to protect the public, and to estimate the magnitude of any impending threat (Type E).
R.E. Ginna Nuclear Power Plant                B 3.3.3-1                                    Revision 73
 
PAM Instrumentation B 3.3.3 All Type A and key Type B, C, and E parameters have been identified as Category I variables in Reference 1 which also provides justification for deviating from the NRC proposed list of Category I variables.
The specific instrument Functions listed in Table 3.3.3-1 are discussed in the LCO section.
APPLICABLE            The PAM instrumentation ensures the availability of Regulatory Guide SAFETY                1.97 Category I variables so that the control room operating staff can:
ANALYSES
* Perform the diagnosis specified in the emergency operating procedures for the primary success path of DBAs (e.g., loss of coolant accident (LOCA));
* Take the specified, pre-planned, manually controlled actions, for which no automatic control is provided, and that are required for safety systems to accomplish their safety function;
* Determine whether required automatic and manual safety functions have been accomplished;
* Determine the likelihood of a gross breach of the barriers to radioactivity release;
* Determine if a gross breach of a barrier has occurred; and
* Initiate action necessary to protect the public and to estimate the magnitude of any impending threat.
PAM instrumentation that meets the definition of Type A in Regulatory Guide 1.97 satisfies Criterion 3 of the NRC Policy Statement. Category I, non-Type A, instrumentation must be retained in TS because it is intended to assist operators in minimizing the consequences of accidents. Therefore, Category I, non-Type A, variables are important for reducing public risk and satisfy Criterion 4.
LCO                  The PAM instrumentation LCO provides OPERABILITY requirements for Regulatory Guide 1.97 Type A monitors, which provide information required by the control room operators to perform certain manual actions specified in the plant Emergency Operating Procedures. These manual actions ensure that a system can accomplish its safety function, and are credited in the safety analyses. Additionally, this LCO addresses Regulatory Guide 1.97 instruments that have been designated Category I, non-Type A.
R.E. Ginna Nuclear Power Plant                B 3.3.3-2                                  Revision 73
 
PAM Instrumentation B 3.3.3 The OPERABILITY of the PAM instrumentation ensures there is sufficient information available on selected plant parameters to monitor and assess plant status following an accident.
This LCO requires two OPERABLE channels for most Functions. Two OPERABLE channels ensure no single failure prevents operators from obtaining the information necessary to determine the safety status of the plant, and to bring the plant to and maintain it in a safe condition following an accident.
Furthermore, OPERABILITY of two channels allows a CHANNEL CHECK during the post accident phase to confirm the validity of displayed information. More than two channels may be required if failure of one accident monitoring channel results in information ambiguity (that is, the redundant displays disagree) that could lead operators to defeat or fail to accomplish a required safety function.
Table 3.3.3-1 lists all Category I variables identified by Reference 1.
Category I variables are considered OPERABLE when they are capable of providing immediately accessible display and continuous readout in the control room. Each channel must also be supplied by separate electrical trains except as noted below. In addition, in accordance with LCO 3.0.6, it is not required to declare a supported system inoperable due to the inoperability of the support system (e.g., electric power). Since the inoperability of Instrument Bus D does not have any associated Required Actions, the loss of this power source may affect the OPERABILITY of the Pressurizer Pressure and SG Water Level (Narrow Range) Functions. Similarly, since the inoperability of inverter MQ-483 does not have any associated Required Actions, the loss of this power source may affect the OPERABILITY of the Containment Pressure (Wide Range) and SG B Pressure Functions.
Listed below are discussions of the specified instrument Functions listed in Table 3.3.3-1.
: 1.      Pressurizer Pressure Pressurizer Pressure is a Type A variable used to determine whether to terminate SI, if still in progress, or to reinitiate SI if it has been stopped. Pressurizer pressure is also used to verify the plant conditions necessary to establish natural circulation in the RCS and to verify that the plant is maintained in a safe shutdown condition.
Any of the following combinations of pressure transmitters comprise the two channels required for this function:
* PT-429 and PT-431;
* PT-430 and PT-431; R.E. Ginna Nuclear Power Plant                B 3.3.3-3                                      Revision 73
 
PAM Instrumentation B 3.3.3
* PT-429 and PT-449;
* PT-430 and PT-449; or
* PT-431 and PT-449 The loss of Instrument Bus D requires declaring PT-449 inoperable.
: 2. Pressurizer Level Pressurizer Level is a Type A variable used to determine whether to terminate SI, if still in progress, or to reinitiate SI if it has been stopped. Pressurizer water level is also used to verify that the plant is maintained in a safe shutdown condition. Any of the following combinations of level transmitters comprise the two channels required for this function:
* LT-426 and LT-428; or
* LT-427 and LT-428.
: 3. Reactor Coolant System (RCS) Hot Leg Temperature RCS Hot and Cold Leg Temperatures are Category I variables (RCS Cold Leg Temperature is also a Type A variable) provided for verification of core cooling and long term surveillance of RCS integrity.
RCS hot and cold leg temperatures are used to determine RCS subcooling margin. RCS subcooling margin will allow termination of SI, if still in progress, or reinitiation of SI if it has been stopped.
RCS subcooling margin is also used for plant stabilization and cooldown control.
In addition, RCS cold leg temperature is used in conjunction with RCS hot leg temperature to verify natural circulation in the RCS.
Temperature inputs are provided by two independent temperature sensor resistance elements and associated transmitters in each loop. Temperature elements TE-409B-1 and TE-410B-1 provide the required RCS cold leg temperature input for RCS Loops A and B, respectively. Temperature elements TE-409A-1 and TE-410A-1 (or TE-410A-2) provide the required RCS hot leg temperature input for RCS Loops A and B, respectively.
: 4. RCS Cold Leg Temperature Refer to description of Function number 3 above.
R.E. Ginna Nuclear Power Plant                B 3.3.3-4                                  Revision 86
 
PAM Instrumentation B 3.3.3
: 5. RCS Pressure (Wide Range)
RCS wide range pressure is a Type A variable provided for verification of core cooling and the long term surveillance of RCS integrity.
RCS pressure is used to verify delivery of SI flow to the RCS from at least one train when the RCS pressure is below the SI pump shutoff head. RCS pressure is also used to verify closure of manually closed pressurizer spray line valves and pressurizer power operated relief valves (PORVs) and for determining RCS subcooling margin.
RCS pressure can also be used:
* to determine whether to terminate actuated SI or to reinitiate stopped SI;
* to determine when to reset SI and stop the residual heat removal pumps (RHR);
* to manually restart the RHR pumps;
* as reactor coolant pump (RCP) trip criteria;
* to make a determination on the nature of the accident in progress and where to go next in the emergency operating procedure; and
* to determine whether to operate the pressurizer heaters.
RCS pressure is also related to three decisions about depressurization. They are:
* to determine whether to proceed with primary system depressurization;
* to verify termination of depressurization; and
* to determine whether to close accumulator isolation valves during a controlled cooldown/depressurization.
RCS pressure is a Type A variable because the operator uses this indication to monitor the cooldown of the RCS following a steam generator tube rupture (SGTR) or small break LOCA. Operator actions to maintain a controlled cooldown, such as adjusting steam generator (SG) pressure or level, would use this indication.
RCS pressure transmitters PT-420 and PT-420A provide the two required channels for this function.
R.E. Ginna Nuclear Power Plant                B 3.3.3-5                                Revision 73
 
PAM Instrumentation B 3.3.3
: 6. RCS Subcooling Monitor RCS Subcooling Monitor is a Type A variable provided for verification of core cooling and long term surveillance of RCS integrity. The RCS Subcooling Monitor is used to provide information to the operator, derived from RCS hot leg temperature and RCS pressure, on subcooling. RCS subcooling margin is used to determine whether to terminate SI, if still in progress, or to reinitiate SI if it has been stopped. RCS subcooling margin is also used for plant stabilization and cooldown control.
The emergency operating procedures determine RCS subcooling margin based on the core exit thermocouples (CETs) and RCS pressure. Therefore, any of the following combination of parameters comprise the two required channels for this function:
* TI-409A and TI-410A; or
* One RCS pressure transmitter and two CETs in each of the four quadrants supplied by electrical train A and train B (i.e.,
total of two RCS pressure transmitters and 16 CETs).
: 7. Reactor Vessel Water Level Reactor Vessel Water Level is a Type A variable provided for verification and long term surveillance of core cooling. It is also used for accident diagnosis and to determine reactor coolant inventory adequacy.
When both RCPs are stopped, the Reactor Vessel Water Level Indication System (RVLIS) provides a direct measurement of the collapsed liquid level above the fuel alignment plate. The collapsed level represents the amount of liquid mass that is in the reactor vessel above the core. When the RCPs are operating, RVLIS indicates the fluid fraction of the RCS. Measurement of the collapsed water level or fluid fraction is selected because it is a direct indication of the water inventory.
Level transmitters LT-490A and LT-490B provide the two required channels for this function.
: 8. Containment Sump B Water Level Containment Sump B Water Level is a Type A variable provided for verification and long term surveillance of RCS integrity.
Containment Sump B Water Level is used to determine:
* containment sump level for accident diagnosis; R.E. Ginna Nuclear Power Plant                  B 3.3.3-6                                Revision 73
 
PAM Instrumentation B 3.3.3
* when to begin the recirculation procedure; and
* whether to terminate SI, if still in progress.
Level indicators LI-942 and LI-943, each with five discrete level switches, provide the two required channels for this function.
: 9. Containment Pressure (Wide Range)
Containment Pressure (Wide Range) is a Type A variable provided for verification of RCS and containment OPERABILITY.
Containment Pressure (Wide Range) is used to determine the type of accident in progress and when, and if, to use emergency operating procedure containment adverse values.
Any of the following combinations of pressure transmitters comprise the two required channels for this function:
* PT-946 and PT-948; or
* PT-950 and PT-948.
The loss of inverter MQ-483 requires declaring PT-950 inoperable.
: 10. Containment Area Radiation (High Range)
Containment Area Radiation (High Range) is a Type E Category I variable provided to monitor for the potential of significant radiation releases into containment and to provide release assessment for use by operators in determining the need to invoke site emergency plans.
Containment radiation level is used to determine the type of accident in progress (e.g., LOCA), and when, or if, to use emergency operating procedure containment adverse values.
Radiation monitors R-29 and R-30 are used to provide the two required channels for this function.
: 11. Condensate Storage Tank Level Condensate Storage Tank (CST) Level is a Type A variable provided to ensure a water supply is available for the preferred Auxiliary Feedwater (AFW) System. The CST consists of two identical tanks connected by a common outlet header.
CST level is used to determine:
R.E. Ginna Nuclear Power Plant                B 3.3.3-7                                  Revision 73
 
PAM Instrumentation B 3.3.3
* if sufficient CST inventory is available immediately following a loss of normal feedwater or small break LOCA; and
* when to manually replenish the CST or align the safety related source of water (service water) to the preferred AFW system.
Level transmitters LT-2022A and LT-2022B provide the two required channels for this function. However, only the level transmitter associated with the CST(s) required by LCO 3.7.6, "Condensate Storage Tank(s)" is required for this LCO.
: 12. Refueling Water Storage Tank Level Refueling Water Storage Tank (RWST) Level is a Type A variable provided for verifying a water source to the SI, RHR, and Containment Spray (CS) Systems.
The RWST level accuracy is established to allow an adequate supply of water to the SI, RHR, and CS pumps during the switchover to the recirculation phase of an accident. A high degree of accuracy is required to maximize the time available to the operator to complete the switchover to the sump recirculation phase and ensure sufficient water is available to maintain adequate net positive suction head (NPSH) to operating pumps.
Level transmitters LT-920 and LT-921 provide the two required channels for this function.
: 13. Residual Heat Removal Flow Residual Heat Removal (RHR) Flow is a Type A variable provided for verifying low pressure safety injection to the reactor vessel and to the CS and SI pumps.
RHR flow is used to determine when to stop the RHR pumps and if sufficient flow is available to the CS and SI pumps during recirculation.
Since different flow transmitters are used to verify injection to the reactor vessel and to verify flow to the CS and SI pumps, FT-626 and FT-931B comprise one required channel and FT-689 and FT-931A comprise a second required channel.
: 14. Core Exit Temperature - QUADRANT 1 Core Exit Temperature is a Type A variable provided for verification and long term surveillance of core cooling.
R.E. Ginna Nuclear Power Plant                B 3.3.3-8                                  Revision 73
 
PAM Instrumentation B 3.3.3 An evaluation was made of the minimum number of valid CETs necessary for measuring core cooling. The evaluation determined the necessary complement of CETs required to detect initial core recovery and trend the ensuing core heatup.
The evaluation accounted for core nonuniformities, including incore effects of the radial decay power distribution, excore effects of reflux in the hot legs, and nonuniform inlet temperatures. Based on these evaluations, adequate core cooling is ensured with two valid Core Exit Temperature channels per quadrant with two CETs per required channel.
Core Exit Temperature is used to determine whether to terminate SI, if still in progress, or to reinitiate SI if it has been stopped.
Core Exit Temperature is also used for plant stabilization and cooldown control.
Two OPERABLE channels of Core Exit Temperature are required in each quadrant to provide indication of radial distribution of the coolant temperature rise across representative regions of the core. Because of the small core size, two randomly selected thermocouples are sufficient to meet the two thermocouples per channel requirement in any quadrant.
However, a CET which lies directly on the dividing line between two quadrants can only be used to satisfy the minimum required channels for one quadrant.
A CET is considered OPERABLE when it is within +/-35 &#xba;F of the average CET reading except for the CETs associated with peripheral assemblies. These CETs (A7, B5, C3, C.11, D2, D12, H13, I2, K3, K11, L10, and M6) are considered OPERABLE when they are within +/-43&#xba;F of the average CET reading. At least two CETs from each of the following trains must be OPERABLE in each of the four quadrants:
R.E. Ginna Nuclear Power Plant                  B 3.3.3-9                                    Revision 73
 
PAM Instrumentation B 3.3.3 Train A                          Train B CET              Location          CET              Location T2                  M6            T1                  I4 T5                    J3            T3                  L7 T6                    I2            T4                K3 T7                    J6            T10                J9 (a)
T8                  L10            T11                I7 (a)
T9                    J8            T13                K11 T12                  H6            T14                D12 T15                  H9            T16                H10 T18                  F8            T17                E10 T21                  C11            T19                G7 T22                  H11            T20                C8 (a)(c)
T23                  H13            T24                F12 (b)
T26                  I10            T25                G12 T28                  D5            T27                E6 T33                  D2            T29                E4 (b)
T34                  C3            T30                G4 (a)(c)
T36                  B7            T31                G2 (b)
T38                  B5            T32                G1 (a)
T39                  D7            T35                A7 T37                C6 (a)  Removed from scan.
(b)  These thermocouples are in the reactor vessel head and cannot be credited with respect to this LCO.
(c)  These thermocouple locations are no longer operational and have been disconnected and plugged at the associated core exit thermocouple nozzle assembly
[CETNA].
: 15.      Core Exit Temperature - QUADRANT 2 Refer to description of Function number 14 above.
: 16.      Core Exit Temperature - QUADRANT 3 Refer to description of Function number 14 above.
R.E. Ginna Nuclear Power Plant                    B 3.3.3-10                                  Revision 79
 
PAM Instrumentation B 3.3.3
: 17. Core Exit Temperature - QUADRANT 4 Refer to description of Function number 14 above.
: 18. Auxiliary Feedwater (AFW) Flow to Steam Generator (SG) A Auxiliary Feedwater (AFW) Flow is a Type A variable provided to monitor operation of the preferred AFW system.
The AFW System provides decay heat removal via the SGs and is comprised of the preferred AFW System and the Standby AFW (SAFW) System. The use of the preferred AFW or SAFW System to provide this decay heat removal function is dependent upon the type of accident. AFW flow indication is required from the three pump trains which comprise the preferred AFW System since these pumps automatically start on various actuation signals. The failure of the preferred AFW System (e.g., due to a high energy line break (HELB) in the Intermediate Building) is detected by AFW flow indication. At this point, the SAFW System is manually aligned to provide the decay heat removal function.
SAFW flow can also be used to verify that AFW flow is being delivered to the SGs. However, the primary indication of this is provided by SG water level. Therefore, flow indication from the SAFW pumps is not required.
Each of the three preferred AFW pump trains has two redundant transmitters; however, only the flow transmitter supplied power from the same electrical train as the AFW pump is required for this LCO.
Therefore, flow transmitters FT-2001 (MCB indicator FI-2021A) and FT-2006 (MCB indicator FI-2023A) comprise the two required channels for SG A and FT-2002 (MCB indicator FI-2022A) and FT-2007 (MCB indicator FI-2024A) comprise the two required channels for SG B.
: 19. AFW Flow to SG B Refer to description of Function number 18 above.
: 20. SG A Water Level (Narrow Range)
Steam Generator (SG) Water Level is a Type A variable provided to monitor operation of decay heat removal via the SGs. For the narrow range level, the signals from the transmitters are independently indicated on the main control board as 0% to 100%.
This corresponds to approximately above the top of the tube bundles to the top of the swirl vane separators (span of 143 inches). For the wide range level, signals from the transmitters are indicated as 0 to 520 inches (0% to 100%) on the main control board.
R.E. Ginna Nuclear Power Plant              B 3.3.3-11                                  Revision 73
 
PAM Instrumentation B 3.3.3 SG Water Level (Narrow and Wide Range) is used to:
* identify the faulted SG following a tube rupture;
* verify that the intact SGs are an adequate heat sink for the reactor;
* determine the nature of the accident in progress (e.g., verify an SGTR); and
* verify plant conditions for termination of SI during secondary plant HELBs outside containment.
Redundant monitoring capability is provided by two trains of instrumentation per SG.
SG Water Level (Narrow Range) requires 2 channels of indication per SG. This can be met using any of the following combinations of level transmitters for SG A:
* LT-461 and LT-462;
* LT-462 and LT-463; or
* LT-461 and LT-463; For SG B, any of the following combinations of level transmitters can be used:
* LT-471 and LT-473;
* LT-471 and LT-472; or
* LT-472 and LT-473.
The loss of Instrument Bus D requires declaring LT-463 and LT-471 inoperable.
SG Water Level (Wide Range) requires 2 channels of indication per SG. Two channels per SG are required since the loss of one channel with no backup available may result in the complete loss of information required by the operators to accomplish necessary safety functions. Level transmitters LT-504 and LT-505 comprise the two required channels for SG A and LT-506 and LT-507 comprise the two required channels for SG B.
: 21. SG B Water Level (Narrow Range)
Refer to description of Function number 20 above.
R.E. Ginna Nuclear Power Plant B 3.3.3-12                                  Revision 73
 
PAM Instrumentation B 3.3.3
: 22. SG A Water Level (Wide Range)
Refer to description of Function number 20 above.
: 23. SG B Water Level (Wide Range)
Refer to description of Function number 20 above.
: 24. SG A Pressure Steam Generator (SG) Pressure is a Type A variable provided to monitor operation of decay heat removal via the SGs. The signals from the transmitters are calibrated for a range of 0 psig to 1400 psig. Redundant monitoring capability is provided by three available trains of instrumentation.
Any of the following combinations of pressure transmitters comprise the two required channels for SG A:
* PT-468 and PT-482; or
* PT-469 and PT-482.
Any of the following combinations of pressure transmitters comprise the two required channels for SG B:
* PT-479 and PT-478; or
* PT-478 and PT-483.
The loss of inverter MQ-483 requires declaring PT-479 inoperable.
: 25. SG B Pressure Refer to description of Function number 24 above.
APPLICABILITY        The PAM instrumentation LCO is applicable in MODES 1, 2, and 3. These variables are related to the diagnosis and pre-planned actions required to mitigate DBAs. The applicable DBAs are assumed to occur in MODES 1, 2, and 3. In MODES 4, 5, and 6, the PAM instrumentation is not required to be OPERABLE because plant conditions are such that the likelihood of an event that would require PAM instrumentation is low.
R.E. Ginna Nuclear Power Plant B 3.3.3-13                                  Revision 73
 
PAM Instrumentation B 3.3.3 ACTIONS              A Note has been added to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed on Table 3.3.3-1. The Completion Time(s) of the inoperable channel(s) of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.
A.1 Condition A applies when one or more Functions have one required channel that is inoperable. Required Action A.1 requires restoring the inoperable channel to OPERABLE status within 30 days. The 30 day Completion Time is based on operating experience and takes into account the remaining OPERABLE channel, the passive nature of the instrument (no critical automatic action is assumed to occur from these instruments), and the low probability of an event requiring PAM Instrumentation during this interval.
Condition A is modified by a Note which states that the Condition is not applicable to Table 3.3.3-1 Functions 3 and 4. These Functions are addressed by Condition C which provides the necessary required actions for these single channel Functions.
B.1 Condition B applies when the Required Action and associated Completion Time for Condition A is not met. This Condition requires the immediate initiation of actions to prepare and submit a special report to the NRC. This report shall be submitted within the following 14 days from the time the Condition is entered. This report shall discuss the results of the root cause evaluation of the inoperability and identify proposed restorative actions or alternate means of providing the required function.
This action is appropriate in lieu of a shutdown requirement since alternative actions are identified before loss of functional capability, and given the likelihood of plant conditions that would require information provided by this instrumentation. If alternate means are to be used, they must be developed and tested prior to submittal of the special report.
C.1 Condition C applies when a Function has one inoperable required channel and no diverse channel OPERABLE (i.e., loss of RCS Hot Leg Temperature or RCS Cold Leg Temperature Functions). This Condition requires restoring the inoperable channel in the affected Function to OPERABLE status within 7 days. The Completion Time of 7 days is based on the relatively low probability of an event requiring PAM instrument operation and the availability of alternate means to obtain the R.E. Ginna Nuclear Power Plant B 3.3.3-14                                  Revision 73
 
PAM Instrumentation B 3.3.3 required information. Continuous operation with a complete loss of function is not acceptable because the alternate indications may not fully meet all performance qualification requirements applied to the PAM instrumentation. Therefore, requiring restoration of the inoperable channel limits the risk that the PAM Function will be in a degraded condition should an accident occur.
Condition C is modified by a Note which states that this Condition is only applicable to Table 3.3.3-1 Functions 3 and 4. All remaining Functions are addressed by Condition A with one channel inoperable.
D.1 Condition D applies when one or more Functions have two inoperable required channels (i.e., two channels inoperable in the same Function).
Required Action D.1 requires restoring one channel in the Function(s) to OPERABLE status within 7 days. The Completion Time of 7 days is based on the relatively low probability of an event requiring PAM instrument operation and the availability of alternate means to obtain the required information. Continuous operation with two required channels inoperable in a Function is not acceptable because the alternate indications may not fully meet all performance qualification requirements applied to the PAM instrumentation. Therefore, requiring restoration of one inoperable channel of the Function limits the risk that the PAM Function will be in a degraded condition should an accident occur.
E.1 Condition E applies when the Required Action and associated Completion Time of Condition C or D are not met. Required Action E.1 requires entering the appropriate Condition referenced in Table 3.3.3-1 for the channel immediately. The applicable Condition referenced in the Table is Function dependent. Each time an inoperable channel has not met any Required Action of Condition C or D and the associated Completion Time has expired, Condition E is entered for that channel and provides for transfer to the appropriate subsequent Condition.
F.1 and F.2 If one channel for Function 3 and 4 cannot be restored to OPERABLE status within the required Completion Time for Condition C, or if one channel for Function 1, 2, 3, 4, 5, 6, 8, 9, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24 or 25 cannot be restored to OPERABLE status within the required Completion Time of Condition D, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
R.E. Ginna Nuclear Power Plant B 3.3.3-15                                    Revision 73
 
PAM Instrumentation B 3.3.3 G.1 If one channel for Function 7 or 10 cannot be restored to OPERABLE status within the required Completion Time of Condition D, the plant must take immediate action to prepare and submit a special report to the NRC.
This report shall be submitted within the following 14 days from the time the action is required. This report discusses the alternate means of monitoring Reactor Vessel Water Level and Containment Area Radiation, the degree to which the alternate means are equivalent to the installed PAM channels, the areas in which they are not equivalent, and a schedule for restoring the normal PAM channels.
These alternate means must have been developed and tested and may be temporarily installed if the normal PAM channel(s) cannot be restored to OPERABLE status within the allotted time.
SURVEILLANCE          A Note has been added to the SR Table to clarify that SR 3.3.3.1 and SR REQUIREMENTS          3.3.3.2 apply to each PAM instrumentation Function in Table 3.3.3-1.
SR 3.3.3.1 Performance of the CHANNEL CHECK ensures that a gross instrumentation failure has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of more serious instrument conditions. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION. The high radiation instrumentation should be compared to similar plant instruments located throughout the plant.
Channel check acceptance criteria are determined by the plant staff, based on a combination of the channel instrument uncertainties, including isolation, indication, and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.
As specified in the SR, a CHANNEL CHECK is only required for those channels that are normally energized.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
R.E. Ginna Nuclear Power Plant                B 3.3.3-16                                  Revision 77
 
PAM Instrumentation B 3.3.3 SR 3.3.3.2 CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to the measured parameter with the necessary range and accuracy.
Whenever a sensing element is replaced, the next required CHANNEL CALIBRATION of the Core Exit thermocouple sensors shall include an inplace qualitative assessment of sensor behavior and normal calibration of the remaining adjustable devices in the channel. This is accomplished by an inplace cross calibration that compares the other sensing elements with the recently installed sensing element. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES            1. UFSAR, Section 7.5.2.
: 2. Regulatory Guide 1.97, Rev. 3.
: 3. NUREG-0737, Supplement 1, "TMI Action Items."
: 4. UFSAR, Section 6.2.5.
R.E. Ginna Nuclear Power Plant              B 3.3.3-17                                Revision 77
 
LOP DG Start Instrumentation B 3.3.4 B 3.3    INSTRUMENTATION B 3.3.4      Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation BASES BACKGROUND            The DGs provide a source of emergency power when offsite power is either unavailable or is insufficiently stable to allow safe plant operation.
The LOP DG start instrumentation consists of two channels on each of safeguards Buses 14, 16, 17, and 18 (Ref. 1). Each channel contains one loss of voltage relay and one degraded voltage relay (see Figure B 3.3.4-1). A one-out-of-two logic in both channels will cause the following actions on the associated safeguards bus:
: a. trip of the normal feed breaker from offsite power;
: b. trip of the bus-tie breaker to the opposite electrical train (if closed);
: c. shed of all bus loads except the CS pump, component cooling water pump (if no safety injection signal is present), and safety related motor control centers; and
: d. start of the associated DG.
The degraded voltage logic is provided on each 480 V safeguards bus to protect Engineered Safety Features (ESF) components from exposure to long periods of reduced voltage conditions which can result in degraded performance and to ensure that required motors can start. The loss of voltage logic is provided on each 480 V safeguards bus to ensure the DG is started within the time limits assumed in the accident analysis to provide the required electrical power if offsite power is lost.
The degraded voltage relays have time delays which have inverse operating characteristics such that the lower the bus voltage, the faster the operating time. The loss of voltage relays have definite time delays which are not related to the rate of the loss of bus voltage. These time delays are set to permit voltage transients during worst case motor starting conditions.
Technical specifications are required by 10 CFR 50.36 to contain limiting safety system settings (LSSS) defined by the regulation as "...settings for automatic protective devices...so chosen that automatic protective action will correct the abnormal situation before a Safety Limit (SL) is exceeded." The Analytic Limit is the limit of the process variable at which a safety action is initiated, as established by the safety analysis, to ensure that a SL is not exceeded. Any automatic protection action that occurs on reaching the Analytic Limit therefore ensures that the SL is not exceeded. However, in practice, the actual settings for automatic R.E. Ginna Nuclear Power Plant                      B 3.3.4-1                                    Revision 37
 
LOP DG Start Instrumentation B 3.3.4 protective devices must be chosen to be more conservative than the Analytic Limit to account for instrument loop uncertainties related to the setting at which the automatic protective action would actually occur.
The Calculated Trip Setpoint is a predetermined setting for a protective device chosen to ensure automatic actuation prior to the process variable reaching the Analytic Limit and thus ensuring that the SL would not be exceeded. As such, the Calculated Trip Setpoint accounts for uncertainties in setting the device (e.g. calibration), uncertainties in how the device might actually perform (e.g., repeatability), changes in the point of action of the device over time (e.g., drift during surveillance intervals), and any other factors which may influence its actual performance (e.g., harsh accident environments). In this manner, the Calculated Trip Setpoint plays an important role in ensuring that SLs are not exceeded. As such, the Calculated Trip Setpoint meets the definition of an LSSS and they are contained in the technical specifications.
Technical specifications contain requirements related to the OPERABILITY of equipment required for safe operation of the facility.
OPERABLE is defined in technical specifications as "...being capable of performing its safety functions(s)." For automatic protective devices, the required safety function is to ensure that a SL is not exceeded and therefore the LSSS as defined by 10 CFR 50.36 serves as the OPERABILITY limit for the nominal trip setpoint. However, use of the LSSS (Calculated Trip Setpoint) to define OPERABILITY in technical specifications would be an overly restrictive requirement if it were applied as an OPERABILITY limit for the as-found value of a protective device setting during a surveillance. This would result in technical specification compliance problems, as well as reports and corrective actions required by the rule which are not necessary to ensure safety. For example, an automatic protective device with a setting that has been found to be different from the Calculated Trip Setpoint due to some drift of the setting may still be OPERABLE since drift is to be expected. This expected drift would have been specifically accounted for in the setpoint methodology for determining the Calculated Trip Setpoint and thus the automatic protective action would still have ensured that the SL would not be exceeded with the as-found setting of the protective device. Therefore, the device would still be OPERABLE since it would have performed its safety function and the only corrective action required would be to reset the device to within the tolerance band assumed in the determination of the Calculated Trip Setpoint to account for further drift during the next surveillance interval.
The Nominal Trip Setpoint is the desired setting specified within established plant procedures, and may be more conservative than the Calculated Trip Setpoint. The Nominal Trip Setpoint therefore may include additional margin to ensure that the SL would not be exceeded.
Use of the Calculated Trip Setpoint or Nominal Trip Setpoint to define as-found OPERABILITY, under the expected circumstances described above, would result in actions required by both the rule and technical R.E. Ginna Nuclear Power Plant                    B 3.3.4-2                                    Revision 37
 
LOP DG Start Instrumentation B 3.3.4 specifications that are clearly not warranted. However, there is also some point beyond which the OPERABILITY of the device would be called into question, for example, greater than expected drift. This requirement needs to be specified in the technical specifications in order to define the OPERABILITY limit for the as-found trip setpoint and is designated as the CHANNEL CALIBRATION Acceptance Criteria.
The CHANNEL CALIBRATION Acceptance Criteria described in SR 3.3.4.2 serves as a confirmation of OPERABILITY, such that a channel is OPERABLE if the absolute difference between the as-found trip setpoint and the previously as-left trip setpoint does not exceed the assumed uncertainty during the performance of the CHANNEL CALIBRATION. The assumed uncertainty is primarily equal to the expected instrument loop uncertainties, such as drift, during the surveillance interval. In this manner, the actual setting of the device will still meet the LSSS definition and ensure that a Safety Limit is not exceeded at any given point of time as long as the device has not drifted beyond that expected during the surveillance interval. Note that, although the channel is "OPERABLE" under these circumstances, the trip setpoint should be left adjusted to a value within the established Nominal Trip Setpoint calibration tolerance band, in accordance with the uncertainty assumptions stated in the referenced setpoint methodology (as-left criteria), and confirmed to be operating within the statistical allowances of the uncertainty terms assigned. If the actual setting of the device is found to have exceeded the CHANNEL CALIBRATION Acceptance Criteria the device would be considered inoperable from a technical specification perspective. This requires corrective action including those actions required by 10 CFR 50.36 when automatic protective devices do not function as required.
APPLICABLE            The LOP DG start instrumentation is required for the ESF Systems to SAFETY                function in any accident with a loss of offsite power. Its design basis is ANALYSES              that of the ESF Actuation System (ESFAS). Undervoltage conditions which occur independent of any accident conditions result in the start and bus connection of the associated DG, but no automatic loading occurs.
Accident analyses credit the loading of the DG based on the loss of offsite power during a Design Basis Accident (DBA). The most limiting DBA of concern is the large break loss of coolant accident (LOCA) which requires ESF Systems in order to maintain containment integrity and protect fuel contained within the reactor vessel (Ref. 2). The detection and processing of an undervoltage condition, and subsequent DG loading, has been included in the delay time assumed for each ESF component requiring DG supplied power following a DBA and loss of offsite power.
The loss of offsite power has been assumed to occur coincident with the DBA accident analyses assumes the SI signal will actuate the DG within R.E. Ginna Nuclear Power Plant                  B 3.3.4-3                                    Revision 37
 
LOP DG Start Instrumentation B 3.3.4 2 seconds and that the DG will connect to the affected safeguards bus within an additional 10 seconds (12 seconds total time). If the loss of offsite power occurs before the SI signal parameters are reached, the accident analyses assumes the LOP DG start instrumentation will actuate the DG within 2.75 seconds and that the DG will connect to the affected safeguards bus within an additional 10 seconds (12.75 seconds total time).
The degraded voltage and undervoltage LSSS are based on the minimum voltage required for continued operation of ESF Systems assuming worst case loading conditions (i.e., maximum loading upon DG sequencing). The LSSS for the loss of voltage relays, and associated time delays, have been chosen based on the following considerations:
: a. Actuate the associated DG within 2.75 seconds as assumed in the accident analysis;
: b. Prevent DG actuation on momentary voltage drops associated with starting of ESF components during an accident with offsite power available and during normal operation due to minor system disturbances; and
: c. Prevent DG re-sequencing on momentary voltage drops associated with starting of the ESF Components during an accident. Therefore, the time delay setting must be greater than the time between the largest assumed voltage drop below the voltage setting and the reset value of the trip function.
The LSSS for the degraded voltage channels, and associated time delays, have been chosen based on the following considerations;
: a. Prevent motors supplied by the 480 V bus from operating at reduced voltage conditions for long periods of time;
: b. Prevent DG actuation on momentary voltage drops associated with starting of ESF components during an accident with offsite power available, and during normal operation due to minor system disturbances; and
: c. Prevent DG re-sequencing on momentary voltage drops associated with starting of the ESF Components during an accident.
Therefore, the time delay setting must be greater than the time between the largest voltage drop below the maximum voltage setting and the reset value of the trip function.
The LOP DG start instrumentation channels satisfy Criterion 3 of the NRC Policy Statement.
R.E. Ginna Nuclear Power Plant                    B 3.3.4-4                                  Revision 37
 
LOP DG Start Instrumentation B 3.3.4 LCO                  This LCO requires that each 480 V safeguards bus have two OPERABLE channels of the LOP DG start instrumentation in MODES 1, 2, 3, and 4 when the associated DG supports safety systems associated with the ESFAS. In MODES 5 and 6, the LOP DG start instrumentation channels for each 480 V safeguards bus must be OPERABLE whenever the associated DG is required to be OPERABLE to ensure that the automatic start of the DG is available when needed. Loss of the LOP DG Start Instrumentation Function could result in the delay of safety systems initiation when required. This could lead to unacceptable consequences during accidents.
The LOP start instrumentation is considered OPERABLE when two channels, each comprised of one degraded voltage and one loss of voltage relays are available for each 480 V safeguards bus (i.e., Bus 14, 16, 17, and 18). Each of the LOP channels must be capable of detecting undervoltage conditions within the voltage limits and time delays assumed in the accident analysis.
The LSSS for the degraded voltage and loss of voltage Functions are specified in SR 3.3.4.2. The LSSS specified in SR 3.3.4.2 are those setpoints which ensure that the associated DG will actuate within 2.75 seconds on undervoltage conditions, and that the DG will not actuate or re-sequence on momentary voltage drops which could affect ESF actuation times as assumed in the accident analysis. A channel is considered OPERABLE when:
: a.      The nominal trip setpoint is equal to or conservative with respect to the LSSS;
: b.      The absolute difference between the as-found trip setpoint and the previous as-left trip setpoint does not exceed the CHANNEL CALIBRATION Acceptance Criteria; and
: c.      The as-left trip setpoint is within the established calibration tolerance band about the nominal trip setpoint.
The channel is still operable even if the as-left trip setpoint is non-conservative with respect to the LSSS provided that the as-left trip setpoint is within the established calibration tolerance band as specified in the Ginna Instrument Setpoint Methodology.
APPLICABILITY        The LOP DG Start Instrumentation Functions are required in MODES 1, 2, 3, and 4 because ESF Functions are designed to provide protection in these MODES. Actuation in MODE 5 or 6 is required whenever the required DG must be OPERABLE so that it can perform its function on an R.E. Ginna Nuclear Power Plant                      B 3.3.4-5                                    Revision 37
 
LOP DG Start Instrumentation B 3.3.4 LOP or degraded power to the 480 V safeguards buses.
ACTIONS              In the event a relay's trip setpoint is found to be nonconservative with respect to the CHANNEL CALIBRATION Acceptance Criteria, or the channel is found to be inoperable, then the channel must be declared inoperable and the LCO Condition entered as applicable.
A Note has been added in the ACTIONS to clarify the application of Completion Time rules. This Note states that separate Condition entry is allowed for each 480 V safeguards bus.
A.1 With one or more 480 V bus(es) with one channel inoperable, Required Action A.1 requires the inoperable channel(s) to be placed in trip within 6 hours. With an undervoltage channel in the tripped condition, the LOP DG start instrumentation channels are configured to provide a one-out-of-one logic to initiate a trip of the incoming offsite power for the respective bus. The remaining OPERABLE channel is comprised of one-out-of-two logic from the degraded and loss of voltage relays. Any additional failure of either of these two OPERABLE relays requires entry into Condition B.
B.1 Condition B applies to the LOP DG start Function when the Required Action and associated Completion Time for Condition A are not met or with one or more 480 V bus(es) with two channels of LOP start instrumentation inoperable.
Condition B requires immediate entry into the Applicable Conditions specified in LCO 3.8.1, "AC Sources - MODES 1, 2, 3, and 4," or LCO 3.8.2, "AC Sources - MODES 5 and 6," for the DG made inoperable by failure of the LOP DG start instrumentation. The actions of those LCOs provide for adequate compensatory actions to assure plant safety.
SURVEILLANCE          The Surveillances are modified by a Note to indicate that, when a REQUIREMENTS          channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 4 hours, provided the second channel maintains trip capability. Upon completion of the Surveillance, or expiration of the 4 hour allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the assumption that 4 hours is the average time required to perform channel surveillance. Based on engineering judgement, the 4 hour testing allowance does not R.E. Ginna Nuclear Power Plant                    B 3.3.4-6                                    Revision 37
 
LOP DG Start Instrumentation B 3.3.4 significantly reduce the probability that the LOP DG start instrumentation will trip when necessary.
SR 3.3.4.1 This SR is the performance of a TADOT. This test checks trip devices that provide actuation signals directly. For these tests, the relay trip setpoints are verified and adjusted as necessary to ensure the LSSS can still be met. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.3.4.2 This SR is the performance of a CHANNEL CALIBRATION of the LOP DG start instrumentation for each 480 V bus.
The voltage setpoint verification, as well as the time response to a loss of voltage and a degraded voltage test, shall include a single point verification that the trip occurs within the required time delay.
CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES            1.      UFSAR, Section 8.3.
: 2.      UFSAR, Chapter 15.
R.E. Ginna Nuclear Power Plant                    B 3.3.4-7                                Revision 77
 
LOP DG Start Instrumentation B 3.3.4 Figure B 3.3.4-1 DG LOP Instrumentation R.E. Ginna Nuclear Power Plant      B 3.3.4-8                        Revision 37
 
Containment Ventilation Isolation Instrumentation B 3.3.5 B 3.3    INSTRUMENTATION B 3.3.5      Containment Ventilation Isolation Instrumentation BASES BACKGROUND            Containment ventilation isolation instrumentation closes the containment isolation valves in the Mini-Purge System and the Shutdown Purge System. This action isolates the containment atmosphere from the environment to minimize releases of radioactivity in the event of an accident. The Mini-Purge System may be used in all MODES while the Shutdown Purge System may only be used with the reactor shutdown.
Containment ventilation isolation initiates on a containment radiation signal, manual actuation of containment isolation, manual actuation of containment spray (CS), or by any safety injection (SI) signal. The Bases for LCO 3.3.2, "Engineered Safety Feature Actuation System (ESFAS)
Instrumentation," discuss the manual containment isolation, manual containment spray, and safety injection modes of initiation.
Two containment radiation monitoring channels are provided as input to the containment ventilation isolation. The two radiation detectors are of different types: gaseous (R-12), and particulate (R-11). Both detectors will respond to most events that release radiation to containment.
However, analyses have not been conducted to demonstrate that all credible events will be detected by more than one monitor. Therefore, for the purposes of this LCO the two channels are not considered redundant.
Instead, they are treated as two one-out-of-one Functions. Since the radiation monitors constitute a sampling system, various components such as sample line valves, sample line heaters, sample pumps, and filter motors are required to support monitor OPERABILITY.
The Mini-Purge System has inner and outer containment isolation valves in its supply and exhaust ducts while the Shutdown Purge System only has one valve located outside containment since the inside valve was replaced by a blind flange that is used during MODES 1, 2, 3, and 4. A high radiation signal from any one of the two channels initiates containment ventilation isolation, which closes all isolation valves in the Mini-Purge System and the Shutdown Purge System. These systems are described in the Bases for LCO 3.6.3, "Containment Isolation Boundaries."
Technical specifications are required by 10 CFR 50.36 to contain limiting safety system settings (LSSS). The Analytic Limit is the limit of the process variable at which a safety action is initiated, as established by the safety analysis. However, in practice, the actual settings for automatic protective devices must be chosen to be more conservative than the Analytic Limit to account for instrument loop uncertainties related R.E. Ginna Nuclear Power Plant                B 3.3.5-1                                  Revision 42
 
Containment Ventilation Isolation Instrumentation B 3.3.5 to the setting at which the automatic protective action would actually occur.
The Calculated Trip Setpoint is a predetermined setting for a protective device chosen to ensure automatic actuation prior to the process variable reaching the Analytic Limit. As such, the Calculated Trip Setpoint accounts for uncertainties in setting the device (e.g. calibration),
uncertainties in how the device might actually perform (e.g.,
repeatability), changes in the point of action of the device over time (e.g.,
drift during surveillance intervals), and any other factors which may influence its actual performance (e.g., harsh accident environments). As such, the Calculated Trip Setpoint meets the definition of an LSSS and they are contained in the technical specifications.
Technical specifications contain requirements related to the OPERABILITY of equipment required for safe operation of the facility.
OPERABLE is defined in technical specifications as "...being capable of performing its safety functions(s)." For automatic protective devices, the required safety function is to ensure that a SL is not exceeded and therefore the LSSS as defined by 10 CFR 50.36 serves as the OPERABILITY limit for the nominal trip setpoint. However, use of the LSSS (Calculated Trip Setpoint) to define OPERABILITY in technical specifications would be an overly restrictive requirement if it were applied as an OPERABILITY limit for the as-found value of a protective device setting during a surveillance. This would result in technical specification compliance problems, as well as reports and corrective actions required by the rule which are not necessary to ensure safety. For example, an automatic protective device with a setting that has been found to be different from the Calculated Trip Setpoint due to some drift of the setting may still be OPERABLE since drift is to be expected. This expected drift would have been specifically accounted for in the setpoint methodology for determining the Calculated Trip Setpoint and thus the automatic protective action would still have been ensured with the as-found setting of the protective device. Therefore, the device would still be OPERABLE since it would have performed its safety function and the only corrective action required would be to reset the device to within the tolerance band assumed in the determination of the Calculated Trip Setpoint to account for further drift during the next surveillance interval.
The Nominal Trip Setpoint is the desired setting specified within established plant procedures, and may be more conservative than the Calculated Trip Setpoint. The Nominal Trip Setpoint therefore may include additional margin to ensure that the SL would not be exceeded.
Use of the Calculated Trip Setpoint or Nominal Trip Setpoint to define as-found OPERABILITY, under the expected circumstances described above, would result in actions required by both the rule and technical specifications that are clearly not warranted. However, there is also some point beyond which the OPERABILITY of the device would be called into question, for example, greater than expected drift. This requirement needs to be specified in the technical specifications in order R.E. Ginna Nuclear Power Plant                B 3.3.5-2                                  Revision 42
 
Containment Ventilation Isolation Instrumentation B 3.3.5 to define the OPERABILITY limit for the as-found trip setpoint and is designated as the Channel Operational Test (COT) Acceptance Criteria.
The COT Acceptance Criteria described in SR 3.3.5-1 serves as a confirmation of OPERABILITY, such that a channel is OPERABLE if the absolute difference between the as-found trip setpoint and the previously as-left trip setpoint does not exceed the assumed uncertainty during the performance of the COT. The assumed uncertainty is primarily equal to the expected instrument loop uncertainties, such as drift, during the surveillance interval. In this manner, the actual setting of the device will still meet the LSSS definition, as long as the device has not drifted beyond that expected during the surveillance interval. Note that, although the channel is "OPERABLE " under these circumstances, the trip setpoint should be left adjusted to a value within the established Nominal Trip Setpoint calibration tolerance band, in accordance with the uncertainty assumptions stated in the referenced setpoint methodology (as-left criteria), and confirmed to be operating within the statistical allowances of the uncertainty terms assigned. If the actual setting of the device is found to have exceeded the COT Acceptance Criteria the device would be considered inoperable from a technical specification perspective. This requires corrective action including those actions required by 10 CFR 50.36 when automatic protective devices do not function as required.
APPLICABLE            The safety analyses assume that the containment remains intact with SAFETY                penetrations unnecessary for accident mitigation functions isolated early ANALYSES              in the event, within approximately 60 seconds. The isolation of the purge valves has not been analyzed mechanistically in the dose calculations, although its rapid isolation is assumed. The containment ventilation isolation radiation monitors act as backup to the containment isolation signal to ensure closing of the ventilation valves. They are also the primary means for automatically isolating containment in the event of a fuel handling accident during shutdown even though containment isolation is not specifically credited for this event. Containment isolation in turn ensures meeting the containment leakage rate assumptions of the safety analyses, and ensures that the calculated accident offsite radiological doses are below 10 CFR 50.67 (Ref. 1) limits.
The containment ventilation isolation instrumentation satisfies Criterion 3 of the NRC Policy Statement.
R.E. Ginna Nuclear Power Plant                    B 3.3.5-3                                  Revision 42
 
Containment Ventilation Isolation Instrumentation B 3.3.5 LCO                  The LCO requirements ensure that the instrumentation necessary to initiate Containment Ventilation Isolation, listed in Table 3.3.5-1, is OPERABLE.
: 1. Automatic Actuation Logic and Actuation Relays The LCO requires two trains of Automatic Actuation Logic and Actuation Relays OPERABLE to ensure that no single random failure can prevent automatic actuation.
Automatic Actuation Logic and Actuation Relays consist of the same features and operate in the same manner as described for ESFAS Table 3.3.2-1 Function 1, Safety Injection, ESFAS Function 2.a, Containment Spray-Manual Initiation, and ESFAS Function 3.a Containment Isolation-Manual Initiation. The applicable MODES and specified conditions for the containment ventilation isolation portion of these Functions are different and less restrictive than those for their respective ESFAS Table 3.3.2-1 roles. If one or more of the ESFAS Functions becomes inoperable in such a manner that only the Containment Ventilation Isolation Function is affected, the Conditions applicable to their respective isolation Functions in LCO 3.3.2 need not be entered. The less restrictive Actions specified for inoperability of the Containment Ventilation Isolation Functions specify sufficient compensatory measures for this case.
: 2. Containment Radiation The LCO specifies two required channels of radiation monitors (R-11 and R-12) to ensure that the radiation monitoring instrumentation necessary to initiate Containment Ventilation Isolation remains OPERABLE.
For sampling systems, channel OPERABILITY involves more than OPERABILITY of the channel electronics. OPERABILITY may also require correct valve lineups, sample pump operation, and filter motor operation, as well as detector OPERABILITY, if these supporting features are necessary for trip to occur.
: 3. Containment Isolation-Manual Initiation Refer to LCO 3.3.2, Function 3.a, for all initiating Functions and requirements. This Function provides the manual initiation capability for containment ventilation isolation.
R.E. Ginna Nuclear Power Plant                B 3.3.5-4                                  Revision 42
 
Containment Ventilation Isolation Instrumentation B 3.3.5
: 4. Containment Spray-Manual Initiation Refer to LCO 3.3.2, Function 2.a, for all initiating Functions and requirements. This Function provides the manual initiation capability for containment ventilation isolation.
: 5. Safety Injection Refer to LCO 3.3.2, Function 1, for all initiating Functions and requirements. This Function provides both manual and automatic initiation capability for containment ventilation isolation.
APPLICABILITY        The Automatic Actuation Logic and Actuation Relays, Containment Isolation-Manual Initiation, and Containment Radiation Functions are required to be OPERABLE in MODES 1, 2, 3, and 4, and during CORE ALTERATIONS or movement of irradiated fuel assemblies within containment. Under these conditions, the potential exists for an accident that could release fission product radioactivity into containment.
Therefore, the containment ventilation isolation instrumentation must be OPERABLE in these MODES.
The Containment Spray-Manual Initiation and Safety Injection Functions are required to be OPERABLE in MODES 1,2,3, and 4. Due to the potential negative affects of system actuations, and the redundancy provided by the alternate Functions, these Functions are not required during CORE ALTERATIONS or movement of irradiated fuel assemblies within containment.
While in MODES 5 and 6 without fuel handling in progress, the containment ventilation isolation instrumentation need not be OPERABLE since the potential for radioactive releases is minimized and operator action is sufficient to ensure post accident offsite doses are maintained within the limits of Reference 1.
R.E. Ginna Nuclear Power Plant                B 3.3.5-5                                    Revision 42
 
Containment Ventilation Isolation Instrumentation B 3.3.5 ACTIONS              The most common cause of channel inoperability is outright failure or drift of the bistable or process module sufficient to exceed the tolerance allowed by plant specific calibration procedures. Typically, the drift is found to be small and results in a delay of actuation rather than a total loss of function. This determination is generally made during the performance of a COT, when the process instrumentation is set up for adjustment to bring it within specification. A channel is considered OPERABLE when:
: a. The nominal trip setpoint is equal to or conservative with respect to the LSSS;
: b. The absolute difference between the as-found trip setpoint and the previous as-left trip setpoint does not exceed the COT Acceptance Criteria; and
: c. The as-left trip setpoint is within the established calibration tolerance band about the nominal trip setpoint.
The channel is still operable even if the as-left trip setpoint is non-conservative with respect to the LSSS provided that the as-left trip setpoint is within the established calibration tolerance band as specified in the Ginna Instrument Setpoint Methodology.
A Note has been added to the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed in Table 3.3.5-1. The Completion Time(s) of the inoperable channel(s)/train(s) of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.
A.1 Condition A applies to the failure of one containment ventilation isolation radiation monitor channel. Since the two containment radiation monitors measure different parameters, failure of a single channel may result in loss of the radiation monitoring Function for certain events.
Consequently, the failed channel must be restored to OPERABLE status.
The 4 hour allowed to restore the affected channel is justified by the low likelihood of events occurring during this interval, and recognition that one or more of the remaining channels will respond to most events.
R.E. Ginna Nuclear Power Plant                B 3.3.5-6                                    Revision 42
 
Containment Ventilation Isolation Instrumentation B 3.3.5 B.1 Condition B applies to all Containment Ventilation Isolation Functions and addresses the train orientation of the system and the master and slave relays for these Functions. It also addresses the failure of multiple radiation monitoring channels, or the inability to restore a single failed channel to OPERABLE status in the time allowed for Required Action A.1.
If a train is inoperable, multiple channels are inoperable, or the Required Action and associated Completion Time of Condition A are not met, operation may continue as long as the Required Action for the applicable Conditions of LCO 3.6.3 is met for each mini-purge isolation valve made inoperable by failure of isolation instrumentation. For example, if R-11 and R-12 were both inoperable, then all four mini-purge isolation valves must be declared inoperable. If CVI Train A were inoperable, then the two mini-purge valves which receive a Train A isolation signal must be declared inoperable.
A Note is added stating that Condition B is only applicable in MODE 1, 2, 3, or 4.
C.1 and C.2 Condition C applies to all Containment Ventilation Isolation Functions and addresses the train orientation of the system and the master and slave relays for these Functions. It also addresses the failure of multiple radiation monitoring channels, or the inability to restore a single failed channel to OPERABLE status in the time allowed for Required Action A.1.
If a train is inoperable, multiple channels are inoperable, or the Required Action and associated Completion Time of Condition A are not met, operation may continue as long as the Required Action to place each purge isolation valve in its closed position or the applicable Conditions of LCO 3.9.3, "Containment Penetrations," are met for each purge isolation valve made inoperable by failure of isolation instrumentation. The Completion Time for these Required Actions is Immediately.
A Note states that Condition C is applicable during CORE ALTERATIONS and during movement of irradiated fuel assemblies within containment.
R.E. Ginna Nuclear Power Plant              B 3.3.5-7                                  Revision 42
 
Containment Ventilation Isolation Instrumentation B 3.3.5 SURVEILLANCE        A Note has been added to the SR Table to clarify that Table 3.3.5-1 REQUIREMENTS        determines which SRs apply to which Containment Ventilation Isolation Functions.
SR 3.3.5.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred and the instrumentation continues to operate properly between each CHANNEL CALIBRATION. The CHANNEL CHECK agreement criteria are determined by the plant staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.3.5.2 A COT is performed on each required channel to ensure the channel will perform the intended Function. The Frequency is based on the staff recommendation for increasing the availability of radiation monitors according to NUREG-1366 (Ref. 2). This test verifies the capability of the instrumentation to provide the containment ventilation system isolation. The setpoint shall be left consistent with the current plant specific calibration procedure tolerance. The Surveillance Frequency is controlled under Surveillance Frequency Program.
SR 3.3.5.3 This SR is the performance of an ACTUATION LOGIC TEST. All possible logic combinations, with and without applicable permissives, are tested for each protection function. In addition, the master relay is tested for continuity. This verifies that the logic modules are OPERABLE and there is an intact voltage signal path to the master relay coils. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
R.E. Ginna Nuclear Power Plant              B 3.3.5-8                                  Revision 77
 
Containment Ventilation Isolation Instrumentation B 3.3.5 SR 3.3.5.4 CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES            1. 10 CFR 50.67.
: 2. NUREG-1366.
R.E. Ginna Nuclear Power Plant                  B 3.3.5-9                                  Revision 77
 
CREATS Actuation Instrumentation B 3.3.6 B 3.3    INSTRUMENTATION B 3.3.6      Control Room Emergency Air Treatment System (CREATS) Actuation Instrumentation BASES BACKGROUND            The CREATS provides a protected environment from which operators can control the plant following an uncontrolled release of radioactivity.
This system is described in the Bases for LCO 3.7.9, "Control Room Emergency Air Treatment System (CREATS)." This LCO only addresses the CREATS actuation instrumentation with respect to the high radiation state or a Safety Injection (SI) signal.
The high radiation actuation instrumentation consists of two GM probe radiation monitors installed in the outside air intake for the control room ventilation system. A high radiation signal from either of these detectors, or a SI signal, will place the CREATS in the emergency mode. The control room operator can also place the CREATS in the emergency mode by using the manual pushbuttons in the control room.
Technical specifications are required by 10 CFR 50.36 to contain limiting safety system settings (LSSS). The Analytic Limit is the limit of the process variable at which a safety action is initiated, as established by the safety analysis. However, in practice, the actual settings for automatic protective devices must be chosen to be more conservative than the Analytic Limit to account for instrument loop uncertainties related to the setting at which the automatic protective action would actually occur.
The Calculated Trip Setpoint is a predetermined setting for a protective device chosen to ensure automatic actuation prior to the process variable reaching the Analytic Limit. As such, the Calculated Trip Setpoint accounts for uncertainties in setting the device (e.g. calibration),
uncertainties in how the device might actually perform (e.g.,
repeatability), changes in the point of action of the device over time (e.g.,
drift during surveillance intervals), and any other factors which may influence its actual performance (e.g., harsh accident environments). As such, the Calculated Trip Setpoint meets the definition of an LSSS and they are contained in the technical specifications.
Technical specifications contain requirements related to the OPERABILITY of equipment required for safe operation of the facility.
OPERABLE is defined in technical specifications as "...being capable of performing its safety functions(s)." For automatic protective devices, the required safety function is to ensure that a SL is not exceeded and therefore the LSSS as defined by 10 CFR 50.36 serves as the OPERABILITY limit for the nominal trip setpoint. However, use of the R.E. Ginna Nuclear Power Plant                      B 3.3.6-1                                  Revision 38
 
CREATS Actuation Instrumentation B 3.3.6 LSSS (Calculated Trip Setpoint) to define OPERABILITY in technical specifications would be an overly restrictive requirement if it were applied as an OPERABILITY limit for the as-found value of a protective device setting during a surveillance. This would result in technical specification compliance problems, as well as reports and corrective actions required by the rule which are not necessary to ensure safety. For example, an automatic protective device with a setting that has been found to be different from the Calculated Trip Setpoint due to some drift of the setting may still be OPERABLE since drift is to be expected. This expected drift would have been specifically accounted for in the setpoint methodology for determining the Calculated Trip Setpoint and thus the automatic protective action would still have been ensured with the as-found setting of the protective device. Therefore, the device would still be OPERABLE since it would have performed its safety function and the only corrective action required would be to reset the device to within the tolerance band assumed in the determination of the Calculated Trip Setpoint to account for further drift during the next surveillance interval.
The Nominal Trip Setpoint is the desired setting specified within established plant procedures, and may be more conservative than the Calculated Trip Setpoint. The Nominal Trip Setpoint therefore may include additional margin to ensure that the SL would not be exceeded.
Use of the Calculated Trip Setpoint or Nominal Trip Setpoint to define as-found OPERABILITY, under the expected circumstances described above, would result in actions required by both the rule and technical specifications that are clearly not warranted. However, there is also some point beyond which the OPERABILITY of the device would be called into question, for example, greater than expected drift. This requirement needs to be specified in the technical specifications in order to define the OPERABILITY limit for the as-found trip setpoint and is designated as the Channel Operational Test (COT) Acceptance Criteria.
The COT Acceptance Criteria described in SR Table 3.3.6-1 serves as a confirmation of OPERABILITY, such that a channel is OPERABLE if the absolute difference between the as-found trip setpoint and the previously as-left trip setpoint does not exceed the assumed uncertainty during the performance of the COT. The assumed uncertainty is primarily equal to the expected instrument loop uncertainties, such as drift, during the surveillance interval. In this manner, the actual setting of the device will still meet the LSSS definition, as long as the device has not drifted beyond that expected during the surveillance interval. Note that, although the channel is "OPERABLE" under these circumstances, the trip setpoint should be left adjusted to a value within the established Nominal Trip Setpoint calibration tolerance band, in accordance with the uncertainty assumptions stated in the referenced setpoint methodology (as-left criteria), and confirmed to be operating within the statistical allowances of the uncertainty terms assigned. If the actual setting of the device is found to have exceeded the COT Acceptance Criteria the device would be considered inoperable from a technical specification perspective. This requires corrective action including those actions R.E. Ginna Nuclear Power Plant                    B 3.3.6-2                                  Revision 38
 
CREATS Actuation Instrumentation B 3.3.6 required by 10 CFR 50.36 when automatic protective devices do not function as required.
APPLICABLE            The control room must be kept habitable for the operators stationed there SAFETY                during accident recovery and post accident operations.
ANALYSES The CREATS acts to terminate the supply of unfiltered outside air to the control room, and to initiate filtration. These actions are necessary to ensure the control room is kept habitable for the operators stationed there during accident recovery and post accident operations by minimizing the radiation exposure of control room personnel. One train of filtration in conjunction with isolation is sufficient to maintain control room doses within established limits.
Control Room doses were analyzed per Regulatory Guide 1.183, Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors (Ref. 6). Per Reference 7, Safety Injection is credited with initiating the CREATS emergency mode within the time assumed in the dose analysis for LOCA, SGTR and MSLB accidents. For other analyzed accidents (Rod Ejection, Locked RCP Rotor, Fuel Handling Accident), the high radiation signal is the primary protection. CREATS actuation is not required for GDT Rupture or SFP Tornado Missile, although the analysis demonstrates that actuation may occur from the radiation monitors for these events.
The LSSS for the Control Room Radiation Intake Monitors is based on a correlation to the limit specified in 10 CFR 50, Appendix A, GDC 19 (Ref.
: 3) and the guidance provided by the NRC in NUREG-0737 section ll.B.2 (Ref. 4), Dose Rate Criteria, and NUREG-0800 section 6.4, Control Room Habitability Program (Ref. 5). This is a maximum of 5 rem body dose, with a 30 day weighted average dose rate of less than 15 mR/hr.
This LSSS is calculated in accordance with the Ginna Station Setpoint Verification Program and will provide for isolation of the control room ventilation system which will prevent exceeding these limits. Subsequent to the installation of the present rad monitors, the control room accident doses were recalculated using the alternate source term methodology (Ref. 6). The current control room accident dose calculations conservatively assume that the cloud released during the accident enters the control room envelope for 60 seconds (360 seconds for SGTR) prior to ventilation system isolation. The response time of the Control Room Radiation Intake Monitors to an actual release is bounded by the time used in the analyses (Ref. 7 ) for those accidents crediting the radiation monitors.
During movement of irradiated fuel assemblies, the CREATS ensures control room habitability in the event of a fuel handling accident. It has R.E. Ginna Nuclear Power Plant                    B 3.3.6-3                                  Revision 38
 
CREATS Actuation Instrumentation B 3.3.6 been demonstrated that the CREATS is not required in the event of a waste gas decay tank rupture (Ref. 2).
The CREATS Actuation Instrumentation satisfies Criterion 3 of the NRC Policy Statement.
LCO                  The LCO requirements ensure that instrumentation necessary to initiate the CREATS is OPERABLE.
: 1. Manual Initiation The LCO requires two trains to be OPERABLE. A train consists of one pushbutton and the interconnecting wiring to the actuation logic. The operator can initiate the CREATS Emergency Mode at any time by using the pushbuttons in the control room. Each pushbutton will actuate both trains of isolation dampers and the respective fan train.
: 2. Automatic Actuation Logic and Actuation Relays The LCO requires two trains of Actuation Logic and Actuation Relays to be OPERABLE. Actuation logic consists of all circuitry associated with manual initiation, Safety Injection and Control Room Radiation Intake Monitors within the actuation system, including the initiation relay contacts responsible for actuating the CREATS Emergency Mode.
The Automatic SI Actuation Logic and Actuation Relays consist of the same features and operate in the same manner as described for ESFAS Function 1.b., SI, in LCO 3.3.2. The applicable MODES and specified conditions for the CREATS portion of these functions are different and less restrictive than those specified for their SI roles. If one or more of the SI functions becomes inoperable in such a manner that only the CREATS function is affected, the Conditions applicable to their SI function need not be entered. The less restrictive Actions specified for inoperability of the CREATS Functions specify sufficient compensatory measures for this case.
: 3. Control Room Radiation Intake Monitor The LCO specifies two channels of Control Room Radiation Intake Monitors to ensure that the radiation monitoring instrumentation necessary to initiate the CREATS filtration trains and isolation dampers remains OPERABLE.
The Nominal Trip Setpoint used in the Control Room Radiation Intake Monitors is based on the LSSS specified in Table 3.3.6-1.
R.E. Ginna Nuclear Power Plant                    B 3.3.6-4                                    Revision 38
 
CREATS Actuation Instrumentation B 3.3.6 The selection of this trip setpoint is such that adequate protection is provided when all sensor and processing time delays, calibration tolerances, instrumentation uncertainties, and instrument drift are taken into account. The Nominal Trip Setpoint specified in plant procedures is therefore conservatively adjusted with respect to the Analytical Limit.
A channel is considered OPERABLE when:
: a. The nominal trip setpoint is equal to or conservative with respect to the LSSS;
: b. The absolute difference between the as-found trip setpoint and the previous as-left trip setpoint does not exceed the COT Acceptance Criteria; and
: c. The as-left trip setpoint is within the established calibration tolerance band about the nominal trip setpoint.
The channel is still OPERABLE even if the as-left trip setpoint is non-conservative with respect to the LSSS provided that the as-left trip setpoint is within the established calibration tolerance band as specified in the Ginna Instrument Setpoint Methodology.
: 4. Safety Injection Refer to LCO 3.3.2, Function 1, for all initiating Functions and requirements.
The CREATS emergency mode is also initiated by all Functions that automatically initiate SI. The CREATS emergency mode requirements for these Functions are the same as the requirements for their SI function. Therefore, the requirements are not repeated in Table 3.3.6-1. Instead, Function 1, SI, is referenced for all applicable initiating Functions and requirements.
APPLICABILITY        In MODES 1, 2, 3, and 4, the CREATS actuation instrumentation must be OPERABLE to control operator exposure during and following a Design Basis Accident.
During movement of irradiated fuel assemblies, the CREATS actuation instrumentation must be OPERABLE to cope with the release from a fuel handling accident.
R.E. Ginna Nuclear Power Plant                    B 3.3.6-5                                    Revision 38
 
CREATS Actuation Instrumentation B 3.3.6 ACTIONS              The most common cause of channel inoperability is failure or drift of the bistable or process module sufficient to exceed the tolerance allowed by the plant specific calibration procedures. Typically, the drift is found to be small and results in a delay of actuation rather than a total loss of function. This determination is generally made during the performance of a COT, when the process instrumentation is set up for adjustment to bring it within specification.
A Note has been added to the ACTIONS indicating that separate Condition entry is allowed for each Function. The Conditions of this Specification may be entered independently for each Function listed in Table 3.3.6-1 in the accompanying LCO. The Completion Time(s) of the inoperable channel/train of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.
A.1 Condition A applies to the actuation logic train Function of the CREATS, the radiation monitor channel Functions, the manual channel Functions and the SI logic Functions. If one train is inoperable, or one radiation monitor channel is inoperable, 7 days are permitted to restore it to OPERABLE status. The 7 day Completion Time is the same as is allowed if one train of the mechanical portion of the system is inoperable.
The basis for this Completion Time is the same as provided in LCO 3.7.9.
If the channel/train cannot be restored to OPERABLE status, one CREATS train must be placed in the emergency radiation protection mode of operation. This accomplishes the actuation instrumentation Function and places the plant in a conservative mode of operation.
B.1.1, B.1.2 and B.2 Condition B applies to the failure of two CREATS actuation trains, two radiation monitor channels, two manual channels, or two SI actuation trains. The first Required Action is to place one CREATS train in the emergency mode of operation immediately. This accomplishes the actuation instrumentation Function that may have been lost and places the plant in a conservative mode of operation. The applicable Conditions and Required Actions of LCO 3.7.9must also be entered for the CREATS train made inoperable by the inoperable actuation instrumentation. This ensures appropriate limits are placed upon train inoperability as discussed in the Bases for LCO 3.7.9.
Alternatively, both trains may be placed in the emergency mode. This ensures the CREATS function is performed even in the presence of a single failure.
R.E. Ginna Nuclear Power Plant                    B 3.3.6-6                                  Revision 38
 
CREATS Actuation Instrumentation B 3.3.6 C.1 and C.2 Condition C applies when the Required Action and associated Completion Time of Condition A or B has not been met and the plant is in MODE 1, 2, 3, or 4. The plant must be brought to a MODE that minimizes accident risk. To achieve this status, the plant must be brought to MODE 3 within 6 hours and MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
D.1 and D.2 Condition D applies when the Required Action and associated Completion Time of Condition A or B has not been met during movement of irradiated fuel assemblies. Movement of irradiated fuel assemblies must be suspended immediately to reduce the risk of accidents that would require CREATS actuation. This places the plant in a condition that minimizes risk. This does not preclude movement of fuel or other components to a safe position.
SURVEILLANCE          A Note has been added to the SR Table to clarify that Table 3.3.6-1 REQUIREMENTS          determines which SRs apply to which CREATS Actuation Functions.
SR 3.3.6.1 Performance of the CHANNEL CHECK ensures that gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or of more serious instrument conditions. A CHANNEL CHECK will detect gross channel failure; thus, it is a verification that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
CHANNEL CHECK acceptance criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
R.E. Ginna Nuclear Power Plant                    B 3.3.6-7                                  Revision 77
 
CREATS Actuation Instrumentation B 3.3.6 SR 3.3.6.2 This SR is the performance of a COT on each required channel to ensure the channel will perform the intended function. This test verifies the capability of the instrumentation to provide the automatic CREATS actuation. The setpoints shall be left consistent with the plant specific calibration procedure tolerance. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.3.6.3 This SR is the performance of a TADOT of the Manual Initiation Function.
The Manual Initiation Function is tested up to, and including, the master relay coils.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
The SR is modified by a Note that excludes verification of setpoints because the Manual Initiation Function has no setpoints.
SR 3.3.6.4 CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.3.6.5 This SR is the performance of an ACTUATION LOGIC TEST. All possible logic combinations are tested for the CREATS actuation instrumentation. In addition, the master relay is tested for continuity. This verifies that the logic modules are OPERABLE and there is an intact voltage signal path to the master relay coils. This test is acceptable based on instrument reliability and operating experience. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program R.E. Ginna Nuclear Power Plant                    B 3.3.6-8                                  Revision 77
 
CREATS Actuation Instrumentation B 3.
 
==3.6 REFERENCES==
: 1. UFSAR, Section 6.4.
: 2. DA-NS-2000-057, Revision 2, Gas Decay Tank Rupture Offsite and Control Room Doses
: 3. 10CFR50, Appendix A, GDC 19
: 4. NUREG-0737, Section II.B.2, Dose Rate Criteria
: 5. NUREG-0800, Section 6.4, Control Room Habitability Program
: 6. Regulatory Guide 1.183, Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors
: 7. UFSAR Chapter 15 Transient Analysis Calculation Sheet 10.26, Rev 1, Control Room Isolation Time R.E. Ginna Nuclear Power Plant                B 3.3.6-9                                Revision 38
 
RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 B 3.4    REACTOR COOLANT SYSTEMS (RCS)
B 3.4.1      RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB)
Limits BASES BACKGROUND            These Bases address requirements for maintaining RCS pressure, temperature, and flow rate within limits assumed in the safety analyses.
The safety analyses (Ref. 1) of normal operating conditions and anticipated operational occurrences assume initial conditions within the normal steady state envelope. The limits placed on RCS pressure, temperature, and flow rate ensure that the departure from nucleate boiling (DNB) design criterion will be met for each of the transients analyzed.
The design method employed to meet the DNB design criterion for fuel assemblies is the Revised Thermal Design Procedure (RTDP). With the RTDP methodology, uncertainties in plant operating parameters, computer codes and DNB correlation predictions are considered statistically to obtain DNB uncertainty factors. Based on the DNB uncertainty factors, RTDP design limit departure from nucleate boiling ratio (DNBR) values are determined in order to meet the DNB design criterion.
The RTDP design limit DNBR is 1.24 for the typical and thimble cells for fuel analyses with the WRB-1 correlation for the 422V+ and OFA fuel.
Additional DNBR margin is maintained by performing the safety analyses to DNBR limits higher than the design limit DNBR values. This margin between the design and safety analysis limit DNBR values is used to offset known DNBR penalties (e.g., rod bow and transition core) and to provide DNBR margin for operating and design flexibility. The safety analysis DNBR values are 1.40 and 1.34 for the 422V+ and OFA fuel, respectively, for the typical and thimble cells.
For the WRB-1 correlation, the 95/95 DNBR correlation limit is 1.17. The W-3 DNB correlation is used where the primary DNBR correlation is not applicable. The WRB-1 correlation was developed based on mixing vane data and therefore is only applicable in the heated rod spans above the first mixing vane grid. The W-3 correlation, which does not take credit for mixing vane grids, is used to calculate DNBR values in the heated region below the first mixing vane grid. In addition, the W-3 correlation is applied in the analysis of accident conditions where the system pressure is below the range of the primary correlations. For system pressures in the range of 500 to 1000 psia, the W-3 correlation limit is 1.45. For system pressures greater than 1000 psia, the W-3 correlation limit is 1.30.
R.E. Ginna Nuclear Power Plant                    B 3.4.1-1                                Revision 42
 
RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 The RCS pressure limit as specified in the COLR, is consistent with operation within the nominal operational envelope. Pressurizer pressure indications are averaged to come up with a value for comparison to the limit. A lower pressure will cause the reactor core to approach DNB limits.
The RCS coolant average temperature limit as specified in the COLR, is consistent with full power operation within the nominal operational envelope. Indications of temperature are averaged to determine a value for comparison to the limit. A higher average temperature will cause the core to approach DNB limits.
The RCS flow rate as specified in the COLR, normally remains constant during an operational fuel cycle with both pumps running. The minimum RCS flow limit corresponds to that assumed for DNB analyses. Flow rate indications are averaged to come up with a value for comparison to the limit. A lower RCS flow will cause the core to approach DNB limits.
Operation for significant periods of time outside these DNB limits increases the likelihood of a fuel cladding failure in a DNB limited event.
APPLICABLE            The requirements of this LCO represent the initial conditions for DNB SAFETY                limited transients analyzed in the plant safety analyses (Ref. 1). The ANALYSES              safety analyses have shown that transients initiated from the limits of this LCO will result in meeting the DNB design criterion. This is the acceptance limit for the RCS DNB parameters. Changes to the plant that could impact these parameters must be assessed for their impact on the DNB design criterion. The transients analyzed include loss of coolant flow events and dropped or stuck rod events. A key assumption for the analysis of these events is that the core power distribution is within the limits of LCO 3.1.6, "Control Bank Insertion Limits"; LCO 3.2.3, "AXIAL FLUX DIFFERENCE (AFD)"; and LCO 3.2.4, "QUADRANT POWER TILT RATIO (QPTR)."
The limit for pressurizer pressure is based on a +/- 60 psi instrument uncertainty. The accident analyses assume that nominal pressure is maintained at 2235 psig. By Reference 2, minor fluctuations are acceptable provided that the time averaged pressure is 2235 psig.
The RCS coolant average temperature limit is based on a +/- 4&#xba;F instrument uncertainty which includes a +/- 1.5&#xba;F deadband. It is assumed that nominal Tavg is maintained within +/- 1.5&#xba;F of the nominal Tavg specified in the COLR. By Reference 2, minor fluctuations are acceptable provided that the time averaged temperature is within 1.5&#xba;F of nominal.
R.E. Ginna Nuclear Power Plant                  B 3.4.1-2                                  Revision 42
 
RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 The limit for RCS flow rate is based on the nominal Tavg and SG plugging criteria limit. Additional margin of approximately 4% is then added for conservatism.
The RCS DNB parameters satisfy Criterion 2 of the NRC Policy Statement.
LCO                  This LCO specifies limits on the monitored process variables-pressurizer pressure, RCS average temperature, and RCS total flow rate-to ensure the core operates within the limits assumed in the safety analyses.
Operating within these limits will result in meeting the DNB design criterion in the event of a DNB limited transient.
A Note has been added to indicate the limit on pressurizer pressure is not applicable during short term operational transients such as a THERMAL POWER ramp > 5% RTP per minute or a THERMAL POWER step > 10%
RTP. These conditions represent short term perturbations where actions to control pressure variations might be counterproductive. Also, since they represent transients initiated from power levels < 100% RTP, an increased DNBR margin exists to offset the temporary pressure variations.
The DNBR limit is provided in SL 2.1.1, "Reactor Core SLs." The conditions that define the DNBR limit are less restrictive than the limits of this LCO, but violation of a Safety Limit (SL) merits a stricter, more severe Required Action. Should a violation of this LCO occur, the operator must check whether or not an SL may have been exceeded.
APPLICABILITY        In MODE 1, the limits on pressurizer pressure, RCS coolant average temperature, and RCS flow rate must be maintained during steady state operation in order to ensure DNB design criteria will be met in the event of an unplanned loss of forced coolant flow or other DNB limited transient. In MODE 2, an increased DNBR margin exists. In all other MODES, the power level is low enough that DNB is not a concern.
ACTIONS              A.1 RCS pressure and RCS average temperature are controllable and measurable parameters. With one or both of these parameters not within LCO limits, action must be taken to restore parameter(s).
R.E. Ginna Nuclear Power Plant                    B 3.4.1-3                                    Revision 42
 
RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 RCS total flow rate is not a controllable parameter and is not expected to vary during steady state operation. If the indicated RCS total flow rate is below the LCO limit, power must be reduced, as required by Required Action B.1, to restore DNB margin and eliminate the potential for violation of the accident analysis bounds.
The 2 hour Completion Time for restoration of the parameters provides sufficient time to determine the cause for the off normal condition, to adjust plant parameters, and to restore the readings within limits, and is based on plant operating experience.
B.1 If Required Action A.1 is not met within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply.
To achieve this status, the plant must be brought to at least MODE 2 within 6 hours. In MODE 2, the reduced power condition eliminates the potential for violation of the accident analysis bounds. The Completion Time of 6 hours is reasonable to reach the required plant conditions in an orderly manner.
SURVEILLANCE          SR 3.4.1.1 REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.4.1.2 The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
R.E. Ginna Nuclear Power Plant                B 3.4.1-4                                Revision 77
 
RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 SR 3.4.1.3 Measurement of RCS total flow rate verifies the actual RCS flow rate is greater than or equal to the minimum required RCS flow rate. This verification may be performed via a precision calorimetric heat balance or other accepted means.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. Verification of RCS flow rate on a shorter interval is not required since this parameter is not expected to vary during steady state operation as there are no RCS loop isolation valves or other installed devices which could significantly alter flow.
Reduced performance of a reactor coolant pump (RCP) would be observable due to bus voltage and frequency changes, and installed alarms that would result in operator investigation.
This SR is modified by a Note that allows entry into MODE 1, without having performed the SR, and placement of the plant in the best condition for performing the SR. The Note states that the SR shall be performed within 7 days after reaching 95% RTP. This exception is appropriate since the heat balance requires the plant to be at a minimum of 95% RTP to obtain the stated RCS flow accuracies.
REFERENCES            1. UFSAR, Chapter 15.
: 2. NRC Memorandum from E.L. Jordan, Assistant Director for Technical Programs, Division of Reactor Operations Inspection to Distribution;
 
==Subject:==
"Discussion of Licensed Power Level (AITS F14580H2)," dated August 22, 1980.
R.E. Ginna Nuclear Power Plant                B 3.4.1-5                                Revision 77
 
RCS Minimum Temperature for Criticality B 3.4.2 B 3.4    REACTOR COOLANT SYSTEM (RCS)
B 3.4.2      RCS Minimum Temperature for Criticality BASES BACKGROUND            This LCO is based upon meeting several major considerations before the reactor can be made critical and while the reactor is critical.
The first consideration is moderator temperature coefficient (MTC), LCO 3.1.3, "Moderator Temperature Coefficient (MTC)." In the transient and accident analyses, the MTC is assumed to be in a range from slightly positive to negative and the operating temperature is assumed to be within the nominal operating envelope while the reactor is critical. The LCO on minimum temperature for criticality helps ensure the plant is operated consistent with these assumptions.
The second consideration is the protective instrumentation. Because certain protective instrumentation (e.g., excore neutron detectors) can be affected by moderator temperature, a temperature value within the nominal operating envelope is chosen to ensure proper indication and response while the reactor is critical.
The third consideration is the pressurizer operating characteristics. The transient and accident analyses assume that the pressurizer is within its normal startup and operating range (i.e., saturated conditions and steam bubble present). It is also assumed that the RCS temperature is within its normal expected range for startup and power operation. Since the density of the RCS water, and hence the response of the pressurizer to transients, depends upon the initial temperature of the moderator, a minimum value for moderator temperature within the nominal operating envelope is chosen.
The fourth consideration is that the reactor vessel is above its minimum nil ductility reference temperature when the reactor is critical.
APPLICABLE            Although the RCS minimum temperature for criticality is not itself an initial SAFETY                condition assumed in Design Basis Accidents (DBAs), the closely aligned ANALYSES              temperature for hot zero power (HZP) is a process variable that is an initial condition of DBAs, such as the rod cluster control assembly (RCCA) withdrawal, RCCA ejection, and main steam line break accidents performed at zero power that either assumes the failure of, or presents a challenge to, the integrity of a fission product barrier.
R.E. Ginna Nuclear Power Plant                B 3.4.2-1                                  Revision 21
 
RCS Minimum Temperature for Criticality B 3.4.2 All low power safety analyses assume initial RCS loop temperatures greater than or equal to the HZP temperature of 547&#xba;F. The minimum temperature for criticality limitation provides a small band, 7&#xba;F, for critical operation below HZP. This band allows critical operation below HZP during plant startup and does not adversely affect any safety analyses since the MTC is not significantly affected by the small temperature difference between HZP and the minimum temperature for criticality.
The RCS minimum temperature for criticality satisfies Criterion 2 of the NRC Policy Statement.
LCO                  Compliance with the LCO ensures that the reactor will not be made or maintained critical (keff  1.0) at a temperature less than a small band below the HZP temperature, which is assumed in the safety analysis.
Failure to meet the requirements of this LCO may produce initial conditions inconsistent with the initial conditions assumed in the safety analysis.
APPLICABILITY        In MODE 1, and MODE 2 with keff  1.0, LCO 3.4.2 is applicable since the reactor can only be critical (keff  1.0) in these MODES.
The special test exception of LCO 3.1.8, "PHYSICS TESTS Exceptions -
MODE 2, "permits PHYSICS TESTS to be performed at  5% RTP with RCS loop average temperatures slightly lower than normally allowed so that fundamental nuclear characteristics of the core can be verified. In order for nuclear characteristics to be accurately measured, it may be necessary to operate outside the normal restrictions of this LCO. For example, to measure the MTC at beginning of cycle, it is necessary to allow RCS loop average temperatures to fall below T no load, which may cause RCS loop average temperatures to fall below the temperature limit of this LCO. The need to perform the PHYSICS TESTS to ensure that the operating characteristics of the core are consistent with design predictions provides sufficient justification to allow a temporary decrease in the RCS minimum temperature for criticality limit.
R.E. Ginna Nuclear Power Plant                B 3.4.2-2                                  Revision 21
 
RCS Minimum Temperature for Criticality B 3.4.2 ACTIONS              A.1 If the parameters that are outside the limit cannot be restored, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 2 with Keff < 1.0 within 30 minutes. Rapid reactor shutdown can be readily and practically achieved within a 30 minute period due to the proximity to MODE 2 conditions.
The allowed time is reasonable, based on operating experience, to reach MODE 2 with Keff < 1.0 in an orderly manner and without challenging plant systems.
SURVEILLANCE          SR 3.4.2.1 REQUIREMENTS This SR verifies that RCS Tavg in each loop is  540&#xba;F within 30 minutes prior to achieving criticality. This ensures that the minimum temperature for criticality is being maintained just before criticality is reached. The 30 minute time period is long enough to allow the operator to adjust temperatures or delay criticality so the LCO will not be violated, thereby providing assurance that the safety analyses are not violated.
SR 3.4.2.2 RCS loop average temperature is required to be verified at or above 540&#xba;F every 30 minutes in MODE 1, and in MODE 2 with keff  1.0. The 30 minute frequency is sufficient based on the low likelihood of large temperature swings without the operators knowledge. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
This SR is modified by a Note that only requires the SR to be performed if any RCS loop Tavg is < 547&#xba;F and the low Tavg alarm is either inoperable or not reset. The Tavg alarm provides operator indication of low RCS temperature without requiring independent verification while a Tavg > 547&#xba;F in both RCS loops is within the accident analysis assumptions. If the Tavg alarm is to be used for this SR, it should be calibrated consistent with industry standards.
This surveillance is replaced by SR 3.1.8.2 during PHYSICS TESTING.
REFERENCES            1. None.
R.E. Ginna Nuclear Power Plant                B 3.4.2-3                                  Revision 77
 
RCS P/T Limits B 3.4.3 B 3.4    REACTOR COOLANT SYSTEM (RCS)
B 3.4.3      RCS Pressure and Temperature (P/T) Limits BASES BACKGROUND            All components of the RCS are designed to withstand effects of cyclic loads due to system pressure and temperature changes. These loads are introduced by startup (heatup) and shutdown (cooldown) operations, power transients, and reactor trips. This LCO limits the pressure and temperature changes during RCS heatup and cooldown, within the design assumptions and the stress limits for cyclic operation.
The PTLR contains P/T limit curves for heatup, cooldown, inservice leak and hydrostatic (ISLH) testing, and data for the maximum rate of change of reactor coolant temperature (Ref. 1).
Each P/T limit curve defines an acceptable region for normal operation.
The usual use of the curves is operational guidance during heatup or cooldown maneuvering, when pressure and temperature indications are monitored and compared to the applicable curve to determine that operation is within the allowable region.
The LCO establishes operating limits that provide a margin to brittle failure of the reactor vessel and piping of the reactor coolant pressure boundary (RCPB). The vessel is the component most subject to brittle failure, and the LCO limits apply mainly to the vessel. The limits do not apply to the pressurizer, which has different design characteristics and operating functions.
10 CFR 50, Appendix G (Ref. 2), requires the establishment of P/T limits for specific material fracture toughness requirements of the RCPB materials. Reference 2 requires an adequate margin to brittle failure during normal operation, anticipated operational occurrences, and system hydrostatic tests. It mandates the use of the American Society of Mechanical Engineers (ASME) Code, Section III, Appendix G (Ref. 3).
The neutron embrittlement effect on the material toughness is reflected by increasing the nil ductility reference temperature (RTNDT) as exposure to neutron fluence increases.
The actual shift in the RTNDT of the vessel material has been established by periodically removing and evaluating the irradiated reactor vessel material specimens, in accordance with ASTM E 185 (Ref. 4) and Appendix H of 10 CFR 50 (Ref. 5). The operating P/T limit curves have been adjusted based on the evaluation findings and the recommendations of Regulatory Guide 1.99 (Ref. 6).
R.E. Ginna Nuclear Power Plant                B 3.4.3-1                                  Revision 78
 
RCS P/T Limits B 3.4.3 The P/T limit curves are composite curves established by superimposing limits derived from stress analyses of those portions of the reactor vessel and head that are the most restrictive. At any specific pressure, temperature, and temperature rate of change, one location within the reactor vessel will dictate the most restrictive limit. Across the span of the P/T limit curves, different locations are more restrictive, and, thus, the curves are composites of the most restrictive regions.
The heatup curve represents a different set of restrictions than the cooldown curve because the directions of the thermal gradients through the vessel wall are reversed. The thermal gradient reversal alters the location of the tensile stress between the outer and inner walls.
The criticality limit curve includes the Reference 2 requirement that it be 40&#xba;F above the heatup curve or the cooldown curve, and not less than the minimum permissible temperature for ISLH testing. However, the criticality curve is not operationally limiting; a more restrictive limit exists in LCO 3.4.2, "RCS Minimum Temperature for Criticality."
The consequence of violating the LCO limits is that the RCS has been operated under conditions that can result in brittle failure of the RCPB, possibly leading to a nonisolable leak or loss of coolant accident. In the event these limits are exceeded, an evaluation must be performed to determine the effect on the structural integrity of the RCPB components.
The ASME Code, Section XI, Appendix E (Ref. 7), provides a recommended methodology for evaluating an operating event that causes an excursion outside the limits.
APPLICABLE            The P/T limits are not derived from Design Basis Accident (DBA)
SAFETY                analyses. They are prescribed during normal operation to avoid ANALYSES              encountering pressure, temperature, and temperature rate of change conditions that might cause undetected flaws to propagate and result in nonductile failure of the RCPB which is an unanalyzed condition.
Reference 1 establishes the methodology for determining the P/T limits.
Although the P/T limits are not derived from any DBA, the P/T limits are acceptance limits since they preclude operation in an unanalyzed condition.
RCS P/T limits satisfy Criterion 2 of the NRC Policy Statement.
LCO                  The two elements of this LCO are:
: a. The limit curves for heatup, cooldown, and ISLH testing; and
: b. Limits on the rate of change of temperature.
R.E. Ginna Nuclear Power Plant                B 3.4.3-2                                    Revision 21
 
RCS P/T Limits B 3.4.3 The LCO limits apply to all components of the RCS, except the pressurizer. These limits define allowable operating regions and permit a large number of operating cycles while providing a wide margin to nonductile failure.
The limits for the rate of change of temperature control the thermal gradient through the vessel wall and are used as inputs for calculating the heatup, cooldown, and ISLH testing P/T limit curves. Thus, the LCO for the rate of change of temperature restricts stresses caused by thermal gradients and also ensures the validity of the P/T limit curves.
Violating the LCO limits places the reactor vessel outside of the bounds of the stress analyses and can increase stresses in other RCPB components. The consequences depend on several factors, as follow:
: a. The severity of the departure from the allowable operating P/T regime or the severity of the rate of change of temperature;
: b. The length of time the limits were violated (longer violations allow the temperature gradient in the thick vessel walls to become more pronounced); and
: c. The existences, sizes, and orientations of flaws in the vessel material.
APPLICABILITY        The RCS P/T limits LCO provides a definition of acceptable operation for prevention of nonductile failure in accordance with 10 CFR 50, Appendix G (Ref. 2). Although the P/T limits were developed to provide guidance for operation during heatup or cooldown (MODES 3, 4, and 5) or ISLH testing, their Applicability is at all times in keeping with the concern for nonductile failure. The limits do not apply to the pressurizer.
During MODES 1 and 2, other Technical Specifications provide limits for operation that can be more restrictive than or can supplement these P/T limits. LCO 3.4.1, "RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB) Limits"; LCO 3.4.2, "RCS Minimum Temperature for Criticality"; and Safety Limit 2.1, "Safety Limits," also provide operational restrictions for pressure and temperature.
Furthermore, MODES 1 and 2 are above the temperature range of concern for nonductile failure, and stress analyses have been performed for normal maneuvering profiles, such as power ascension or descent.
R.E. Ginna Nuclear Power Plant                B 3.4.3-3                                    Revision 21
 
RCS P/T Limits B 3.4.3 ACTIONS              A.1 and A.2 Operation outside the P/T limits during MODE 1, 2, 3, or 4 must be corrected so that the RCPB is returned to a condition that has been verified by stress analyses.
The 30 minute Completion Time reflects the urgency of restoring the parameters to within the analyzed range. Most violations will not be severe, and the activity can be accomplished in this time in a controlled manner.
Besides restoring operation within limits, an evaluation is required to determine if RCS operation can continue. The evaluation must verify the RCPB integrity remains acceptable and must be completed before continuing operation. Several methods may be used, including comparison with pre-analyzed transients in the stress analyses, new analyses, or inspection of the components. A favorable evaluation must be completed and documented before returning to operating pressure and temperature conditions.
ASME Code, Section XI, Appendix E (Ref. 7), may be used to support the evaluation. However, its use is restricted to evaluation of the vessel beltline.
The 72 hour Completion Time is reasonable to accomplish the evaluation. The evaluation for a mild violation is possible within this time, but more severe violations may require special, event specific stress analyses or inspections. A favorable evaluation must be completed before continuing to operate.
Condition A is modified by a Note stating that Required Action A.2 shall be completed whenever the Condition is entered. The Note emphasizes the need to perform the evaluation of the effects of the excursion outside the allowable limits. Restoration alone per Required Action A.1 is insufficient because higher than analyzed stresses may have occurred and may have affected the RCPB integrity.
R.E. Ginna Nuclear Power Plant              B 3.4.3-4                                  Revision 21
 
RCS P/T Limits B 3.4.3 B.1 and B.2 If a Required Action and associated Completion Time of Condition A are not met, the plant must be placed in a lower MODE because either the RCS remained in an unacceptable P/T region for an extended period of increased stress or a sufficiently severe event caused entry into an unacceptable region. Either possibility indicates a need for more careful examination of the event which is best accomplished with the RCS at reduced pressure and temperature. In reduced pressure and temperature conditions, the possibility of propagation with undetected flaws is decreased.
Pressure and temperature are reduced by bringing the plant to MODE 3 within 6 hours and to MODE 5 with RCS pressure < 500 psig within 36 hours.
The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
C.1 and C.2 Actions must be initiated immediately to correct operation outside of the P/T limits at times other than when in MODE 1, 2, 3, or 4, so that the RCPB is returned to a condition that has been verified by stress analysis.
The immediate Completion Time reflects the urgency of initiating action to restore the parameters to within the analyzed range. Most violations will not be severe, and the activity can be accomplished quickly in a controlled manner.
Besides restoring operation within limits, an evaluation is required to determine if RCS operation can continue. The evaluation must verify that the RCPB integrity remains acceptable and must be completed prior to entry into MODE 4. Several methods may be used, including comparison with pre-analyzed transients in the stress analyses, or inspection of the components.
ASME Code, Section XI, Appendix E (Ref. 7), may be used to support the evaluation. However, its use is restricted to evaluation of the vessel beltline.
Condition C is modified by a Note requiring Required Action C.2 to be completed whenever the Condition is entered. The Note emphasizes the need to perform the evaluation of the effects of the excursion outside the allowable limits. Restoration alone per Required Action C.1 is insufficient because higher than analyzed stresses may have occurred and may have affected the RCPB integrity.
R.E. Ginna Nuclear Power Plant              B 3.4.3-5                                  Revision 21
 
RCS P/T Limits B 3.4.3 SURVEILLANCE          SR 3.4.3.1 REQUIREMENTS Verification that operation is within the PTLR limits is required when RCS pressure and temperature conditions are undergoing planned changes.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
Surveillance for heatup, cooldown, or ISLH testing may be discontinued when the definition given in the relevant plant procedure for ending the activity is satisfied.
This SR is modified by a Note that only requires this SR to be performed during system heatup, cooldown, and ISLH testing. No SR is given for criticality operations because LCO 3.4.2 contains a more restrictive requirement.
REFERENCES            1. WCAP-14040, "Methodology Used to Develop Cold Overpressure Mitigating System Setpoints and RCS Heatup and Cooldown Limit Curves," Revision 1, December 1994.
: 2. 10 CFR 50, Appendix G.
: 3. ASME, Boiler and Pressure Vessel Code, Section III, Appendix G.
: 4. ASTM E 185-82, July 1982.
: 5. 10 CFR 50, Appendix H.
: 6. Regulatory Guide 1.99, Revision 2, May 1988.
: 7. ASME, Boiler and Pressure Vessel Code, Section XI, Appendix E.
R.E. Ginna Nuclear Power Plant                B 3.4.3-6                                Revision 77
 
RCS Loops - MODE 1 > 8.5% RTP B 3.4.4 B 3.4    REACTOR COOLANT SYSTEM (RCS)
B 3.4.4    RCS Loops - MODE 1 > 8.5% RTP BASES BACKGROUND            The primary function of the RCS is removal of the heat generated in the fuel due to the fission process, and transfer of this heat, via the steam generators (SGs), to the secondary plant.
The secondary functions of the RCS include:
: a. Moderating the neutron energy level to the thermal state, to increase the probability of fission;
: b. Improving the neutron economy by acting as a reflector;
: c. Carrying the soluble neutron poison, boric acid; and
: d. Providing a second barrier against fission product release to the environment.
The reactor coolant is circulated through two loops connected in parallel to the reactor vessel, each containing a SG, a reactor coolant pump (RCP), and appropriate flow, pressure, level and temperature instrumentation for both control and protection. The reactor vessel contains the clad fuel. The SGs provide the heat sink to the isolated secondary coolant. The RCPs circulate the coolant through the reactor vessel and SGs at a sufficient rate to ensure proper heat transfer and prevent fuel damage. This forced circulation of the reactor coolant ensures mixing of the coolant for proper boration and chemistry control.
APPLICABLE            Safety analyses contain various assumptions for the design bases SAFETY                accident initial conditions including RCS pressure, RCS temperature, ANALYSES              reactor power level, core parameters, and safety system setpoints. The important aspect for this LCO is the reactor coolant forced flow rate, which is represented by the number of RCS loops in service.
Both transient and steady state analyses have been performed to establish the effect of flow on the departure from nucleate boiling (DNB).
The transient and accident analyses for the plant have been performed assuming both RCS loops are in operation. The majority of the plant safety analyses are based on initial conditions at high core power or zero power. The accident analyses that are most important to RCP operation are the two pump coastdown, single pump locked rotor, single pump (broken shaft or coastdown), and rod withdrawal events (Ref. 1).
R.E. Ginna Nuclear Power Plant                B 3.4.4-1                                  Revision 78
 
RCS Loops - MODE 1 > 8.5% RTP B 3.4.4 Steady state DNB analysis has been performed for the two RCS loop operation. For two RCS loop operation, the steady state DNB analysis, which generates the pressure and temperature Safety Limit (SL) (i.e., the departure from nucleate boiling ratio (DNBR) limit) assumes a maximum power level of 109% RTP. This is the design overpower condition for two RCS loop operation. The value for the accident analysis setpoint of the nuclear overpower (high flux) trip is 115% and is based on an analysis assumption that bounds all possible instrumentation errors (Ref. 2). The DNBR limit defines a locus of pressure and temperature points that result in a minimum DNBR greater than or equal to the critical heat flux correlation limit.
The plant is designed to operate with both RCS loops in operation to maintain DNBR above the SL, during all normal operations and anticipated transients. By ensuring heat transfer in the nucleate boiling region, adequate heat transfer is provided between the fuel cladding and the reactor coolant. Adequate heat transfer between the reactor coolant and the secondary side is ensured by maintaining  16% SG level in accordance with LCO 3.3.1, "Reactor Trip System (RTS)
Instrumentation," which provides sufficient water inventory to cover the SG tubes.
RCS Loops - MODE 1 > 8.5% RTP satisfies Criterion 2 of the NRC Policy Statement.
LCO                  The purpose of this LCO is to require an adequate forced flow rate for core heat removal. Flow is represented by the number of RCPs in operation for removal of heat by the SGs. To meet safety analysis acceptance criteria for DNB, two pumps are required to be in operation at rated power.
An OPERABLE RCS loop consists of an OPERABLE RCP in operation providing forced flow for heat transport and an OPERABLE SG.
APPLICABILITY        In MODE 1 > 8.5% RTP, the reactor is critical and thus has the potential to produce maximum THERMAL POWER. Thus, to ensure that the assumptions of the accident analyses remain valid, both RCS loops are required to be OPERABLE and in operation in this MODE to prevent DNB and core damage.
The decay heat production rate is much lower than the full power heat rate. As such, the forced circulation flow and heat sink requirements are reduced for lower MODES as indicated by the LCOs for MODES 1 8.5% RTP, 2, 3, 4, and 5.
R.E. Ginna Nuclear Power Plant                  B 3.4.4-2                                  Revision 46
 
RCS Loops - MODE 1 > 8.5% RTP B 3.4.4 Operation in other MODES is covered by:
LCO 3.4.5,    "RCS Loops - MODES 1  8.5% RTP, 2, AND 3";
LCO 3.4.6,    "RCS Loops - MODE 4";
LCO 3.4.7,    "RCS Loops - MODE 5, Loops Filled";
LCO 3.4.8,    "RCS Loops - MODE 5, Loops Not Filled";
LCO 3.9.4,    "Residual Heat Removal (RHR) and Coolant Circulation-Water Level  23 Ft" (MODE 6); and LCO 3.9.5,    "Residual Heat Removal (RHR) and Coolant Circulation-Water Level < 23 Ft" (MODE 6).
ACTIONS              A.1 If the requirements of the LCO are not met, the Required Action is to reduce power and bring the plant to MODE 1 < 8.5% RTP. This lowers power level and thus reduces the core heat removal needs and minimizes the possibility of violating DNB limits.
The Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 1 < 8.5% RTP from full power conditions in an orderly manner and without challenging safety systems.
SURVEILLANCE          SR 3.4.4.1 REQUIREMENTS This SR requires verification that each RCS loop is in operation.
Verification includes flow rate, temperature, or pump status monitoring, which help ensure that forced flow is providing heat removal while maintaining the margin to DNB. Use of control board indication for these parameters is an acceptable verification. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
R.E. Ginna Nuclear Power Plant              B 3.4.4-3                                Revision 77
 
RCS Loops - MODE 1 > 8.5% RTP B 3.
 
==4.4 REFERENCES==
: 1. UFSAR, Chapter 15.
: 2. UFSAR, Section 15.0.
R.E. Ginna Nuclear Power Plant            B 3.4.4-4                    Revision 46
 
RCS Loops - MODES 1  8.5% RTP, 2, and 3 B 3.4.5 B 3.4    REACTOR COOLANT SYSTEM (RCS)
B 3.4.5    RCS Loops - MODES 1  8.5% RTP, 2, AND 3 BASES BACKGROUND            In MODE 1  8.5% RTP, and in MODE 2 and 3, the primary function of the RCS is the removal of decay heat and transfer of this heat, via the steam generator (SG), to the secondary plant. The secondary functions of the RCS include:
: a. Moderating the neutron energy level to the thermal state, to increase the probability of fission (MODE 1  8.5% RTP and MODE 2 only);
: b. Improving the neutron economy by acting as a reflector (MODE 1 8.5% RTP and MODE 2 only);
: c. Carrying the soluble neutron poison, boric acid; and
: d. Providing a second barrier against fission product release to the environment.
The reactor coolant is circulated through two RCS loops, connected in parallel to the reactor vessel, each containing a SG, a reactor coolant pump (RCP), and appropriate flow, pressure, level, and temperature instrumentation for control, protection, and indication. The reactor vessel contains the clad fuel. The SGs provide the heat sink. The RCPs circulate the water through the reactor vessel and SGs at a sufficient rate to ensure proper heat transfer and prevent fuel damage.
In MODE 1  8.5% RTP and MODE 2, the RCPs are used to provide forced circulation of the reactor coolant to ensure mixing of the coolant for proper boration and chemistry control and to remove the limited amount of reactor heat. In MODE 3, the RCPs are used to provide forced circulation for heat removal during heatup and cooldown. The MODE 1 8.5% RTP, 2, and 3 reactor and decay heat removal requirements are low enough that a single RCS loop with one RCP running is sufficient to remove core decay heat. However, two RCS loops are required to be OPERABLE to ensure redundant capability for decay heat removal.
R.E. Ginna Nuclear Power Plant                B 3.4.5-1                                  Revision 61
 
RCS Loops - MODES 1  8.5% RTP, 2, and 3 B 3.4.5 APPLICABLE            Both transient and steady state analyses have been performed to SAFETY                establish the effect of flow on the departure from nucleate boiling (DNB).
ANALYSES              In MODE 1  8.5% RTP, and in MODES 2 and 3, these analyses include evaluation of main steam line breaks and uncontrolled rod withdrawal from a subcritical condition. The most limiting accident with respect to DNB limits for MODES 1  8.5% RTP, 2, and 3 is a rod withdrawal from subcritical.
A main steam line break has been analyzed for both the case with one and two RCS loops in operation at hot zero power (HZP) conditions with acceptable results (Ref. 1). However, with only one RCS loop in operation and offsite power available, additional shutdown margin is required since the reduced flow produces an adverse effect on DNB limits.
The startup of an inactive reactor coolant pump (RCP) up to 8.5% RTP has been evaluated and found to result in only limited power and temperature excursions that are bounded by a main steam line break with only one RCS Loop in operation (Refs. 2 and 3).
Analyses have also been performed which demonstrate that reactor heat as high as 3% RTP can be removed by natural circulation alone (Ref. 4).
Failure to provide decay heat removal may result in challenges to a fission product barrier. The RCS loops are part of the primary success path that functions or actuates to prevent or mitigate a Design Basis Accident or transient that either assumes the failure of, or presents a challenge to, the integrity of a fission product barrier. RCS Loops-MODES 1  8.5% RTP, 2, and 3 satisfy Criterion 3 of the NRC Policy Statement.
LCO                  The purpose of this LCO is to require that both RCS loops be OPERABLE. Only one RCS loop in operation is necessary to ensure removal of decay heat from the core and homogenous boron concentration throughout the RCS up to 8.5% RTP. An additional RCS loop is required to be OPERABLE to ensure that safety analyses limits are met. Requiring one RCS loop in operation ensures that the Safety Limit criteria will be met for all of the postulated accidents.
R.E. Ginna Nuclear Power Plant                B 3.4.5-2                                Revision 61
 
RCS Loops - MODES 1  8.5% RTP, 2, and 3 B 3.4.5 The Note permits all RCPs to be de-energized for  1 hour per 8 hour period in MODE 3. The purpose of the Note is to perform tests that are designed to validate various accident analyses values. One of these tests is validation of the pump coastdown curve used as input to a number of accident analyses including a loss of flow accident. This test was satisfactorily performed during the initial startup testing program (Ref. 5). If, however, changes are made to the RCS that would cause a change to the flow characteristics of the RCS, the input values of the coastdown curve must be revalidated by conducting the test again.
The no flow test may be performed in MODE 3, 4, or 5. The Note permits the de-energizing of the pumps in order to perform this test and validate the assumed analysis values. As with the validation of the pump coastdown curve, this test should be performed only once unless the flow characteristics of the RCS are changed. The 1 hour time period specified is adequate to perform the desired tests, and operating experience has shown that boron stratification is not a problem during this short period with no forced flow.
Utilization of the Note is permitted provided the following conditions are met, along with any other conditions imposed by test procedures:
: a. No operations are permitted that would dilute the RCS boron concentration with coolant at boron concentrations less than required to assure the SDM of LCO 3.1.1, thereby maintaining the margin to criticality. Boron reduction with coolant at boron concentrations less than required to assure SDM is maintained is prohibited because a uniform concentration distribution throughout the RCS cannot be ensured when in natural circulation; and
: b. Core outlet temperature is maintained at least 10&#xba;F below saturation temperature, so that no vapor bubble may form and possibly cause a natural circulation flow obstruction.
An OPERABLE RCS loop consists of an OPERABLE RCP and an OPERABLE SG, which has the minimum water level specified in SR 3.4.5.2. An RCP is OPERABLE ifit is capable of being powered and able to provide forced flow if required.
R.E. Ginna Nuclear Power Plant                    B 3.4.5-3                                  Revision 61
 
RCS Loops - MODES 1  8.5% RTP, 2, and 3 B 3.4.5 APPLICABILITY        In MODES 1  8.5% RTP, 2, and 3, this LCO ensures forced circulation of the reactor coolant to remove reactor and decay heat from the core and to provide proper boron mixing.
Operation in other MODES is covered by:
LCO 3.4.4,    "RCS Loops - MODE 1 > 8.5% RTP";
LCO 3.4.6,    "RCS Loops - MODE 4";
LCO 3.4.7,    "RCS Loops - MODE 5, Loops Filled";
LCO 3.4.8,    "RCS Loops - MODE 5, Loops Not Filled";
LCO 3.9.4,    "Residual Heat Removal (RHR) and Coolant Circulation-Water Level  23 Ft" (MODE 6); and LCO 3.9.5,    "Residual Heat Removal (RHR) and Coolant Circulation-Water Level < 23 Ft" (MODE 6).
ACTIONS              A.1 and A.2 If one RCS loop is inoperable, redundancy for heat removal is lost. The Required Actions are to verify that the SDM is within limits specified in the COLR. This action is required to ensure that adequate SDM exists in the event of a main steam line break with only one RCS loop in operation.
The Completion Time of once per 12 hour considers the time required to obtain RCS boron concentration samples and the low probability of a main steam line break during this time period.
The inoperable RCS loop must be restored to OPERABLE status within the Completion Time of 72 hours. This time allowance is a justified period to be without the redundant, nonoperating loop because a single loop in operation has a heat transfer capability greater than that needed to remove the reactor and decay heat produced in the reactor core and because of the low probability of a failure in the remaining loop occurring during this period.
It should be noted that for the loss of one RCP in MODE 1  8.5% RTP, Required Action A.1 of LCO 3.4.1 is more limiting since one RCP cannot provide the specified flow requirements.
R.E. Ginna Nuclear Power Plant              B 3.4.5-4                                  Revision 61
 
RCS Loops - MODES 1  8.5% RTP, 2, and 3 B 3.4.5 B.1 If restoration of the inoperable loop is not possible within 72 hours, the plant must be brought to MODE 4. In MODE 4, the plant may be placed on the Residual Heat Removal System. The additional Completion Time of 12 hours is compatible with required operations to achieve cooldown and depressurization from the existing plant conditions in an orderly manner and without challenging plant systems.
C.1, C.2, and C.3 If two RCS loops are inoperable, or no RCS loop is in operation, except during conditions permitted by the Note in the LCO section, all CRDMs must be de-energized by opening the RTBs or de-energizing the MG sets. All operations involving introduction of coolant into the RCS with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 must be suspended, and action to restore one of the RCS loops to OPERABLE status and operation must be initiated. Boron dilution requires forced circulation for proper mixing, and opening the RTBs or de-energizing the MG sets removes the possibility of an inadvertent rod withdrawal. Suspending the introduction of coolant into the RCS with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 is required to assure continued safe operation. With coolant added without forced circulation, unmixed coolant could be introduced to the core, however coolant added with boron concentration meeting the minimum SDM maintains acceptable margin to subcritical operations. The immediate Completion Time reflects the importance of maintaining operation for heat removal. The action to restore must be continued until one loop is restored to OPERABLE status and operation.
SURVEILLANCE          SR 3.4.5.1 REQUIREMENTS This SR requires verification that the required RCS loop is in operation.
Verification includes flow rate, temperature, or pump status monitoring, which help ensure that forced flow is providing heat removal. Use of the control board indication for these parameters is an acceptable verification. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
R.E. Ginna Nuclear Power Plant                    B 3.4.5-5                                Revision 77
 
RCS Loops - MODES 1 # 8.5% RTP, 2, and 3 B 3.4.5 SR 3.4.5.2 This SR requires verification of SG OPERABILITY. SG OPERABILITY is verified by ensuring that the secondary side narrow range water level is 16% for two RCS loops. If the SG secondary side narrow range water level is < 16%, the tubes may become uncovered and the associated loop may not be capable of providing the heat sink for removal of reactor or decay heat. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.4.5.3 Verification that the required RCP is OPERABLE ensures that an additional RCP can be placed in operation, if needed, to maintain decay heat removal and reactor coolant circulation. Verification is performed by verifying proper breaker alignment and power available to the required pump that is not in operation. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program..
REFERENCES            1. UFSAR Section 15.1.5.
: 2. UFSAR Section 15.4.3.
: 3. Letter from D. M. Crutchfield, NRC, to J. E. Maier, RG&E,
 
==Subject:==
 
                              "SEP Topic XV-9, Startup of an Inactive Loop, R. E. Ginna," dated August 26, 1981.
: 4. UFSAR Sections 14.6.1.5.6 and 15.2.5.
: 5. UFSAR Section 14.6.1.5.5.
R.E. Ginna Nuclear Power Plant                B 3.4.5-6                                  Revision 77
 
RCS Loops - MODES 4 B 3.4.6 B 3.4    REACTOR COOLANT SYSTEM (RCS)
B 3.4.6      RCS Loops - MODE 4 BASES BACKGROUND            In MODE 4, the primary function of the reactor coolant is the removal of decay heat and the transfer of this heat to either the steam generator (SG) secondary side coolant or the component cooling water via the residual heat removal (RHR) heat exchangers. The secondary function of the reactor coolant is to act as a carrier for soluble neutron poison, boric acid.
The reactor coolant is circulated through two RCS loops connected in parallel to the reactor vessel, each containing a SG, a reactor coolant pump (RCP), and appropriate flow, pressure, level, and temperature instrumentation for control, protection, and indication. The reactor vessel contains the cladded fuel. The SGs or the RHR heat exchangers provide the heat sink. The RCPs and the RHR pumps circulate the coolant through the reactor vessel and SGs at a sufficient rate to ensure proper heat transfer and to prevent boric acid stratification.
In MODE 4, either RCS or RHR loops can be used to provide forced circulation. The intent of this LCO is to provide forced flow from at least one RCS or one RHR loop for decay heat removal and transport. The flow provided by one RCS loop or one RHR loop is adequate for decay heat removal. The other intent of this LCO is to require that two paths be available to provide redundancy for decay heat removal.
APPLICABLE            In MODE 4, RCS circulation is considered in the determination of the time SAFETY                available for mitigation of an accidental boron dilution event. The RCS ANALYSES              and RHR loops provide this circulation.
RCS Loops - MODE 4 have been identified in the NRC Policy Statement as important contributors to risk reduction.
LCO                  The purpose of this LCO is to require that at least two loops be OPERABLE in MODE 4 and that one of these loops be in operation. The LCO allows the two loops that are required to be OPERABLE to consist of any combination of RCS loops and RHR loops. Any one loop in operation provides enough flow to remove the decay heat from the core with forced circulation. An additional loop is required to be OPERABLE to provide redundancy for heat removal.
R.E. Ginna Nuclear Power Plant                B 3.4.6-1                                  Revision 76
 
RCS Loops - MODE 4 B 3.4.6 Note 1 permits all RCPs and RHR pumps to be de-energized for  1 hour per 8 hour period. The purpose of the Note is to permit tests that are designed to validate various accident analyses values. One of the tests performed during the startup testing program was the validation of rod drop times during cold conditions, both with and without flow (Ref. 1). If changes are made to the RCS that would cause a change to the flow characteristics of the RCS, the input values must be revalidated by conducting the test again. The no flow test may be performed in MODE 3, 4, or 5 and requires that the pumps be stopped for a short period of time. The Note permits the de-energizing of the pumps in order to perform this test and validate the assumed analysis values. The 1 hour time period is adequate to perform the test, and operating experience has shown that boron stratification is not a problem during this short period with no forced flow.
Utilization of Note 1 is permitted provided the following conditions are met along with any other conditions imposed by test procedures:
: a. No operations are permitted that would dilute the RCS boron concentration with coolant at boron concentrations less than required to assure the SDM of LCO 3.1.1, thereby maintaining the margin to criticality. Boron reduction with coolant at boron concentrations less than required to assure SDM is maintained is prohibited because a uniform concentration distribution throughout the RCS cannot be ensured when in natural circulation; and
: b. Core outlet temperature is maintained at least 10&#xba;F below saturation temperature, so that no vapor bubble may form and possibly cause a natural circulation flow obstruction.
Note 2 requires that the pressurizer water volume be < 324 cubic feet (38% level), or that the secondary side water temperature of each SG be 50&#xba;F above each of the RCS cold leg temperatures before the start of an RCP with any RCS cold leg temperature less than or equal to the LTOP enable temperature specified in the PTLR. The water volume limit ensures that the pressurizer will accommodate the swell resulting from an RCP start. Restraints on the pressurizer water volume and SG secondary side water temperature prevent a low temperature overpressure event due to a thermal transient when an RCP is started and the colder RCS water enters the warmer SG and expands. Violation of this Note places the plant in an unanalyzed condition.
An OPERABLE RCS loop comprises an OPERABLE RCP and an OPERABLE SG, which has the minimum water level specified in SR 3.4.6.2. RCPs are OPERABLE if they are capable of being powered and are able to provide forced flow if required.
R.E. Ginna Nuclear Power Plant              B 3.4.6-2                                  Revision 76
 
RCS Loops - MODE 4 B 3.4.6 Similarly for the RHR System, an OPERABLE RHR loop comprises an OPERABLE RHR pump capable of providing forced flow to an OPERABLE RHR heat exchanger. An OPERABLE RHR loop may be isolated from the RCS provided that the loop can be placed into service from the control room. RHR pumps are OPERABLE if they are capable of being powered and are able to provide forced flow if required.
Management of gas voids is important to RHR System OPERABILITY.
APPLICABILITY        In MODE 4, this LCO ensures forced circulation of the reactor coolant to remove decay heat from the core and to provide proper boron mixing.
One loop of either RCS or RHR provides sufficient circulation for these purposes. However, two loops consisting of any combination of RCS and RHR loops are required to be OPERABLE to meet single failure considerations.
Operation in other MODES is covered by:
LCO 3.4.4,    "RCS Loops - MODE 1 > 8.5% RTP";
LCO 3.4.5,    "RCS Loops - MODES 1  8.5% RTP, 2, AND 3";
LCO 3.4.7,    "RCS Loops - MODE 5, Loops Filled";
LCO 3.4.8,    "RCS Loops - MODE 5, Loops Not Filled";
LCO 3.9.4,    "Residual Heat Removal (RHR) and Coolant Circulation-Water Level  23 Ft" (MODE 6); and LCO 3.9.5,    "Residual Heat Removal (RHR) and Coolant Circulation-Water Level < 23 Ft" (MODE 6).
ACTIONS              A.1 If one RCS loop is inoperable and two RHR loops are inoperable, redundancy for heat removal is lost. Action must be initiated to restore a second RCS or RHR loop to OPERABLE status. If no RHR is available, the plant cannot enter a reduced MODE since no long term means of decay heat removal would be available. The immediate Completion Time reflects the importance of maintaining the availability of two paths for heat removal.
R.E. Ginna Nuclear Power Plant                  B 3.4.6-3                                    Revision 76
 
RCS Loops - MODE 4 B 3.4.6 B.1 If one RHR loop is inoperable and both RCS loops are inoperable, an inoperable RCS or RHR loop must be restored to OPERABLE status to provide a redundant means for decay heat removal.
If a second loop cannot be restored, the plant must be brought to MODE 5 within 24 hours. Bringing the plant to MODE 5 is a conservative action with regard to decay heat removal. With only one RHR loop OPERABLE, redundancy for decay heat removal is lost and, in the event of a loss of the remaining RHR loop, it would be safer to initiate that loss from MODE 5 ( 200&#xba;F) rather than MODE 4 (200 to 350&#xba;F). The Completion Time of 24 hours is a reasonable time, based on operating experience, to reach MODE 5 from MODE 4 in an orderly manner and without challenging plant systems.
Required Action B.1 is modified by a Note stating that only the Required Actions of Condition C are entered if all RCS and RHR loops are inoperable. With all RCS and RHR loops inoperable, MODE 5 cannot be entered and Required Actions C.1 and C.2 are the appropriate remedial actions.
C.1 and C.2 If no loop is OPERABLE or in operation, except during conditions permitted by Note 1 in the LCO section, all operations involving introduction of coolant into the RCS with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 must be suspended and action to restore one RCS or RHR loop to OPERABLE status and operation must be initiated. The required margin to criticality must not be reduced in this type of operation. Suspending the introduction of coolant into the RCS with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 is required to assure continued safe operation. With coolant added without forced circulation, unmixed coolant could be introduced to the core, however coolant added with boron concentration meeting the minimum SDM maintains acceptable margin to subcritical operations. The immediate Completion Times reflect the importance of maintaining operation for decay heat removal.
The action to restore must be continued until one loop is restored to OPERABLE status and operation.
R.E. Ginna Nuclear Power Plant              B 3.4.6-4                                    Revision 76
 
RCS Loops - MODE 4 B 3.4.6 SURVEILLANCE        SR 3.4.6.1 REQUIREMENTS This SR requires verification that one RCS or RHR loop is in operation.
Verification includes flow rate, temperature, or pump status monitoring, which help ensure that forced flow is providing heat removal. Use of control board indication for these parameters is an acceptable verification. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.4.6.2 This SR requires verification of SG OPERABILITY. SG OPERABILITY is verified by ensuring that the secondary side narrow range water level is 16%. If the SG secondary side narrow range water level is < 16%, the tubes may become uncovered and the associated loop may not be capable of providing the heat sink necessary for removal of decay heat.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.4.6.3 Verification that the required pump is OPERABLE ensures that an additional RCS or RHR pump can be placed in operation, if needed, to maintain decay heat removal and reactor coolant circulation. Verification is performed by verifying proper breaker alignment and power available to the required pump that is not in operation. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.4.6.4 RHR System piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the required RHR loop(s) and may also prevent water hammer, pump cavitation, and pumping of noncondensible gas into the reactor vessel.
Selection of RHR System locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to R.E. Ginna Nuclear Power Plant                B 3.4.6-5                                Revision 77
 
RCS Loops - MODE 4 B 3.4.6 remove during system maintenance or restoration. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.
The RHR System is OPERABLE when it is sufficiently filled with water.
Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criteria for gas volume at the suction or discharge of a pump),
the Surveillance is not met. If it is determined by subsequent evaluation that the RHR System is not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water), the Surveillance may be declared met. Accumulated gas should be eliminated or brought within the acceptance criteria limits.
RHR System locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative sub-set of susceptible locations.
Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.
This SR is modified by a Note that states the SR is not required to be performed until 12 hours after entering MODE 4. In a rapid shutdown, there may be insufficient time to verify all susceptible locations prior to entering MODE 4.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation.
REFERENCES            1.      UFSAR, Section 14.6.1.2.6.
R.E. Ginna Nuclear Power Plant                  B 3.4.6-6                                    Revision 77
 
RCS Loops - MODE 5, Loops Filled B 3.4.7 B 3.4    REACTOR COOLANT SYSTEM (RCS)
B 3.4.7      RCS Loops - MODE 5, Loops Filled BASES BACKGROUND            In MODE 5 with the RCS loops filled, the primary function of the reactor coolant is the removal of decay heat and the transfer of this heat either to the steam generator (SG) secondary side coolant or the component cooling water via the residual heat removal (RHR) heat exchangers.
While the principal means for decay heat removal is via the RHR System, the SGs are specified as a backup means for redundancy. Even though the SGs cannot produce steam in this MODE, they are capable of being a heat sink due to their large contained volume of secondary water. As long as the SG secondary side water is at a lower temperature than the reactor coolant, heat transfer will occur. The rate of heat transfer is directly proportional to the temperature difference. The secondary function of the reactor coolant is to act as a carrier for soluble neutron poison, boric acid.
In MODE 5 with RCS loops filled, the reactor coolant is normally circulated by means of two RHR loops connected to the RCS, each loop containing an RHR heat exchanger, an RHR pump, and appropriate flow and temperature instrumentation for control, protection, and indication.
One RHR pump circulates the water through the RCS at a sufficient rate to prevent boric acid stratification.
The number of loops in operation can vary to suit the operational needs.
The intent of this LCO is to provide forced flow from at least one RHR loop for decay heat removal and transport. The flow provided by one RHR loop is adequate for decay heat removal. The other intent of this LCO is to require that a second path be available to provide redundancy for heat removal.
The LCO provides for redundant paths of decay heat removal capability.
The first path can be an RHR loop that must be OPERABLE and in operation. The second path can be another OPERABLE RHR loop or maintaining one SG with a secondary side water level at or above 16% to provide an alternate method for decay heat removal.
APPLICABLE            In MODE 5, RCS circulation is considered in the determination of the time SAFETY                available for mitigation of an accidental boron dilution event. The RHR ANALYSES              loops provide this circulation.
RCS Loops - MODE 5 (Loops Filled) have been identified in the NRC Policy Statement as important contributors to risk reduction.
R.E. Ginna Nuclear Power Plant                B 3.4.7-1                                    Revision 76
 
RCS Loops - MODE 5, Loops Filled B 3.4.7 LCO                  The purpose of this LCO is to require that at least one of the RHR loops be OPERABLE and in operation with an additional RHR loop OPERABLE or one SG with a secondary side water level  16%. One RHR loop provides sufficient forced circulation to perform the safety functions of the reactor coolant under these conditions. An additional RHR loop is required to be OPERABLE to meet single failure considerations.
However, if the standby RHR loop is not OPERABLE, an acceptable alternate method is one SG with a secondary side water level  16%.
Should the operating RHR loop fail, the SG could be used to remove the decay heat.
Note 1 permits all RHR pumps to be de-energized  1 hour per 8 hour period. The purpose of the Note is to permit tests designed to validate various accident analyses values. One of the tests performed during the startup testing program was the validation of rod drop times during cold conditions, both with and without flow (Ref. 1). If changes are made to the RCS that would cause a change to the flow characteristics of the RCS, the input values must be revalidated by conducting the test again.
The no flow test may be performed in MODE 3, 4, or 5 and requires that the pumps be stopped for a short period of time. The Note permits de-energizing of the pumps in order to perform this test and validate the assumed analysis values. The 1 hour time period is adequate to perform the test, and operating experience has shown that boron stratification is not likely during this short period with no forced flow.
Utilization of Note 1 is permitted provided the following conditions are met, along with any other conditions imposed by test procedures:
: a. No operations are permitted that would dilute the RCS boron concentration with coolant at boron concentrations less than required to assure the SDM of LCO 3.1.1, thereby maintaining the margin to criticality. Boron reduction with coolant at boron concentrations less than required to assure SDM is maintained is prohibited because a uniform concentration distribution throughout the RCS cannot be ensured when in natural circulation; and
: b. Core outlet temperature is maintained at least 10&#xba;F below saturation temperature, so that no vapor bubble may form and possibly cause a natural circulation flow obstruction.
Note 2 allows one RHR loop to be inoperable for a period  2 hours, provided that the other RHR loop is OPERABLE and in operation. This permits periodic surveillance tests to be performed on the inoperable loop during the only time when such testing is safe and possible. The 2 hour allowance may be used separately for each individual loop.
R.E. Ginna Nuclear Power Plant                B 3.4.7-2                                  Revision 76
 
RCS Loops - MODE 5, Loops Filled B 3.4.7 Note 3 requires that the pressurizer water volume be < 324 cubic feet (38% level), or that the secondary side water temperature of each SG be 50&#xba;F above each of the RCS cold leg temperatures before the start of a reactor coolant pump (RCP) with an RCS cold leg temperature less than or equal to the LTOP enable temperature specified in the PTLR. The water volume limit ensures that the pressurizer will accommodate the swell resulting from an RCP start. Restraints on the pressurizer water volume and SG secondary side water temperature are to prevent a low temperature overpressure event due to a thermal transient when an RCP is started and the colder RCS water enters the warmer SG and expands.
Violation of this Note places the plant in an unanalyzed Condition.
Note 4 provides for an orderly transition from MODE 5 to MODE 4 during a planned heatup by permitting removal of RHR loops from operation when at least one RCS loop is in operation. This Note provides for the transition to MODE 4 where an RCS loop is permitted to be in operation and replaces the RCS circulation function provided by the RHR loops. A planned heatup is a scheduled transition to MODE 4 within a defined time period.
RHR pumps are OPERABLE if they are capable of being powered and are able to provide flow if required. Also included are all necessary support systems not addressed by applicable LCOs (e.g., component cooling water and service water). A SG can perform as a heat sink when it is OPERABLE, with the minimum water level specified in SR 3.4.7.2.
Management of gas voids is important to RHR System OPERABILITY.
APPLICABILITY        In MODE 5 with RCS loops filled, this LCO requires forced circulation of the reactor coolant to remove decay heat from the core and to provide proper boron mixing. The RCS loops are considered filled until the isolation valves are opened to facilitate draining of the RCS. The loops are also considered filled following the completion of filling and venting the RCS. However, in both cases, loops filled is based on the ability to use a SG as a backup. To be able to take credit for the use of one SG the ability to pressurize to 50 psig and control pressure in the RCS must be available. This is to prevent flashing and void formation at the top of the SG tubes which may degrade or interrupt the natural circulation flow path (Ref. 2). One loop of RHR provides sufficient circulation for these purposes. However, one additional RHR loop is required to be OPERABLE, or the secondary side water level of at least one SG is required to be  1 6%.
R.E. Ginna Nuclear Power Plant                    B 3.4.7-3                                  Revision 76
 
RCS Loops - MODE 5, Loops Filled B 3.4.7 Operation in other MODES is covered by:
LCO 3.4.4,      "RCS Loops - MODE 1 > 8.5% RTP";
LCO 3.4.5,      "RCS Loops - MODES 1  8.5% RTP, 2, AND 3";
LCO 3.4.6,      "RCS Loops - MODE 4";
LCO 3.4.8,      "RCS Loops - MODE 5, Loops Not Filled";
LCO 3.9.4,      "Residual Heat Removal (RHR) and Coolant Circulation-Water Level  23 Ft" (MODE 6); and LCO 3.9.5,      "Residual Heat Removal (RHR) and Coolant Circulation-Water Level < 23 Ft" (MODE 6).
ACTIONS              A.1 and A.2 If one RHR loop is inoperable and both SGs have secondary side water levels < 16%, redundancy for heat removal is lost. Action must be initiated immediately to restore a second RHR loop to OPERABLE status or to restore at least one SG secondary side water level. Either Required Action A.1 or Required Action A.2 will restore redundant heat removal paths. The immediate Completion Time reflects the importance of maintaining the availability of two paths for heat removal. The action to restore must continue until an RHR loop is restored to OPERABLE status or SG secondary side water level is restored.
B.1and B.2 If no RHR loop is in operation, except during conditions permitted by Notes 1 and 4, or if no loop is OPERABLE, all operations involving introduction of coolant into the RCS with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 must be suspended and action to restore one RHR loop to OPERABLE status and operation must be initiated. Suspending the introduction of coolant into the RCS with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 is required to assure continued safe operation. With coolant added without forced circulation, unmixed coolant could be introduced to the core, however coolant added with boron concentration meeting the minimum SDM maintains acceptable margin to subcritical operations.
The immediate Completion Times reflect the importance of maintaining operation for heat removal. The action to restore must continue until one loop is restored to OPERABLE status and operation.
R.E. Ginna Nuclear Power Plant                B 3.4.7-4                                Revision 76
 
RCS Loops - MODE 5, Loops Filled B 3.4.7 SURVEILLANCE          SR 3.4.7.1 REQUIREMENTS This SR requires verification that one RHR loop is in operation.
Verification includes flow rate, temperature, or pump status monitoring, which help ensure that forced flow is providing heat removal. Use of control board indication for these parameters is an acceptable verification. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.4.7.2 This SR requires verification of SG OPERABILITY. Verifying that at least one SG is OPERABLE by ensuring its secondary side narrow range water level is  16% ensures an alternate decay heat removal method in the event that the second RHR loop is not OPERABLE. If both RHR loops are OPERABLE, this Surveillance is not needed. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.4.7.3 Verification that a second RHR pump is OPERABLE ensures that an additional pump can be placed in operation, if needed, to maintain decay heat removal and reactor coolant circulation. Verification is performed by verifying proper breaker alignment and power available to the standby RHR pump. If secondary side water level is  16% in at least one SG, this Surveillance is not needed. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.4.7.4 RHR System piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the required RHR loop(s) and may also prevent water hammer, pump cavitation, and pumping of noncondensible gas into the reactor vessel.
Selection of RHR System locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.
R.E. Ginna Nuclear Power Plant                B 3.4.7-5                                  Revision 77
 
RCS Loops - MODE 5, Loops Filled B 3.4.7 The RHR System is OPERABLE when it is sufficiently filled with water.
Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criteria for gas volume at the suction or discharge of a pump),
the Surveillance is not met. If it is determined by subsequent evaluation that the RHR System is not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water), the Surveillance may be declared met. Accumulated gas should be eliminated or brought within the acceptance criteria limits.
RHR System locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative sub-set of susceptible locations. Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation.
REFERENCES            1.      UFSAR, Section 14.6.1.2.6
: 2.      NRC Information Notice 95-35 R.E. Ginna Nuclear Power Plant                B 3.4.7-6                                    Revision 77
 
RCS Loops - MODE 5, Loops Not Filled B 3.4.8 B 3.4    REACTOR COOLANT SYSTEM (RCS)
B 3.4.8      RCS Loops - MODE 5, Loops Not Filled BASES BACKGROUND            In MODE 5 with the RCS loops not filled, the primary function of the reactor coolant is the removal of decay heat and the transfer of this heat to the component cooling water via the residual heat removal (RHR) heat exchangers. The steam generators (SGs) are not available as a heat sink when the loops are not filled. The secondary function of the reactor coolant is to act as a carrier for the soluble neutron poison, boric acid.
In MODE 5 with loops not filled, only RHR pumps can be used for coolant circulation. The number of pumps in operation can vary to suit the operational needs. The intent of this LCO is to provide forced flow from at least one RHR pump for decay heat removal and transport and to require that two paths be available to provide redundancy for heat removal.
APPLICABLE            In MODE 5, RCS circulation is considered in the determination of the time SAFETY                available for mitigation of an accidental boron dilution event. The RHR ANALYSES              loops provide this circulation. The flow provided by one RHR loop is adequate for heat removal and for boron mixing.
RCS loops in MODE 5 (loops not filled) have been identified in the NRC Policy Statement as important contributors to risk reduction.
LCO                  The purpose of this LCO is to require that at least two RHR loops be OPERABLE and one of these loops be in operation to transfer heat from the reactor coolant at a controlled rate. Heat cannot be removed via the RHR System unless forced flow is used. A minimum of one operating RHR pump meets the LCO requirement for one loop in operation. An additional RHR loop is required to be OPERABLE to meet single failure considerations.
R.E. Ginna Nuclear Power Plant                B 3.4.8-1                                  Revision 76
 
RCS Loops - MODE 5, Loops Not Filled B 3.4.8 Note 1 permits all RHR pumps to be de-energized for  15 minutes when switching from one loop to another. The circumstances for stopping both RHR pumps are to be limited to situations when the outage time is short and requires that the following conditions be met:
: a.      No operations are permitted that would cause introduction of coolant into the RCS with boron concentration less than required to meet the SDM of LCO 3.1.1.
: b.      Core outlet temperature is maintained at least 10&#xba;F below saturation temperature, so that no vapor bubble may form and possibly cause a natural circulation flow obstruction; and
: c.      No draining operations are permitted that would further reduce the RCS water volume and possibly cause a more rapid heatup of the remaining RCS inventory.
: d.      Suspending the introduction of coolant into the RCS with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 is required to assure continued safe operation. With coolant added without forced circulation, unmixed coolant could be introduced to the core, however coolant added with boron concentration meeting the minimum SDM maintains acceptable margin to subcritical operations.
Note 2 allows one RHR loop to be inoperable for a period of  2 hours, provided that the other loop is OPERABLE and in operation. This permits periodic surveillance tests to be performed on the inoperable loop during the only time when these tests are safe and possible. The 2 hour allowance may be used separately for each individual loop.
An OPERABLE RHR loop is comprised of an OPERABLE RHR pump capable of providing forced flow to an OPERABLE RHR heat exchanger.
RHR pumps are OPERABLE if they are capable of being powered and are able to provide flow if required. Also included are all necessary support systems not addressed by applicable LCOs (e.g., component cooling water and service water). Management of gas voids is important to RHR System OPERABILITY.
APPLICABILITY        In MODE 5 with loops not filled, this LCO requires core heat removal and coolant circulation by the RHR System. The RCS loops are considered not filled from the time period beginning with the opening of isolation valves and draining of the RCS and ending with the completion of filling and venting the RCS.
R.E. Ginna Nuclear Power Plant                    B 3.4.8-2                                  Revision 76
 
RCS Loops - MODE 5, Loops Not Filled B 3.4.8 Operation in other MODES is covered by:
LCO 3.4.4,    "RCS Loops - MODE 1 > 8.5% RTP";
LCO 3.4.5,    "RCS Loops - MODES 1  8.5% RTP, 2, and 3";
LCO 3.4.6,    "RCS Loops - MODE 4";
LCO 3.4.7,    "RCS Loops - MODE 5, Loops Filled";
LCO 3.9.4,    "Residual Heat Removal (RHR) and Coolant Circulation-Water Level  23 Ft" (MODE 6); and LCO 3.9.5,    "Residual Heat Removal (RHR) and Coolant Circulation-Water Level < 23 Ft" (MODE 6).
ACTIONS              A.1 If only one RHR loop is OPERABLE and in operation, redundancy for RHR is lost. Action must be initiated to restore a second loop to OPERABLE status. The immediate Completion Time reflects the importance of maintaining the availability of two paths for heat removal. The action to restore must continue until the second RHR loop is restored to OPERABLE status.
B.1 and B.2 If no RHR loop is in operation, except during conditions permitted by Note 1, or if no loop is OPERABLE all operations involving introduction of coolant into the RCS with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 must be suspended and action to restore one RHR loop to OPERABLE status and operation must be initiated. The required margin to criticality must not be reduced in this type of operation.
Suspending the introduction of coolant into the RCS with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 is required to assure continued safe operation. With coolant added without forced circulation, unmixed coolant could be introduced to the core, however coolant added with boron concentration meeting the minimum SDM maintains acceptable margin to subcritical operations.
The immediate Completion Time reflects the importance of maintaining operation for heat removal. The action to restore must continue until one loop is restored to OPERABLE status and operation.
R.E. Ginna Nuclear Power Plant              B 3.4.8-3                                    Revision 76
 
RCS Loops - MODE 5, Loops Not Filled B 3.4.8 SURVEILLANCE          SR 3.4.8.1 REQUIREMENTS This SR requires verification that one RHR loop is in operation.
Verification includes flow rate, temperature, or pump status monitoring, which help ensure that forced flow is providing heat removal. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.4.8.2 Verification that a second RHR pump is OPERABLE ensures that an additional pump can be placed in operation, if needed, to maintain decay heat removal and reactor coolant circulation. Verification is performed by verifying proper breaker alignment and power available to the standby pump. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.4.8.3 RHR System piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the RHR loops and may also prevent water hammer, pump cavitation, and pumping of noncondensible gas into the reactor vessel.
Selection of RHR System locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.
The RHR System is OPERABLE when it is sufficiently filled with water.
Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criteria for gas volume at the suction or discharge of a pump), the Surveillance is not met. If it is determined by subsequent evaluation that the RHR System is not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water), the Surveillance may be declared met. Accumulated gas should be eliminated or brought within the acceptance criteria limits.
R.E. Ginna Nuclear Power Plant                B 3.4.8-4                                  Revision 77
 
RCS Loops - MODE 5, Loops Not Filled B 3.4.8 RHR System locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative sub-set of susceptible locations.
Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation.
REFERENCES            1. None.
R.E. Ginna Nuclear Power Plant                    B 3.4.8-5                                Revision 77
 
Pressurizer B 3.4.9 B 3.4    REACTOR COOLANT SYSTEM (RCS)
B 3.4.9      Pressurizer BASES BACKGROUND            The pressurizer provides a point in the RCS where liquid and vapor are maintained in equilibrium under saturated conditions for pressure control purposes to prevent bulk boiling in the remainder of the RCS. Key functions include maintaining required primary system pressure during steady state operation, and limiting the pressure changes caused by reactor coolant thermal expansion and contraction during normal load transients.
The pressure control components addressed by this LCO include the pressurizer water level and the required heater capacity. Pressurizer safety valves and pressurizer power operated relief valves are addressed by LCO 3.4.10, "Pressurizer Safety Valves," and LCO 3.4.11, "Pressurizer Power Operated Relief Valves (PORVs)," respectively.
The intent of this LCO is to ensure that a steam bubble exists in the pressurizer prior to, and during, power operation to minimize the consequences of potential overpressure transients. The presence of a steam bubble is consistent with analytical assumptions. Relatively small amounts of noncondensible gases are typically present in the RCS and can inhibit the condensation heat transfer between the pressurizer spray and the steam, and diminish the spray effectiveness for pressure control.
These noncondensible gases can be ignored if the steam bubble is present.
This LCO also ensures that adequate heater capacity is available in the pressurizer to support natural circulation following an extended loss of offsite power. Electrical immersion heaters, located in the lower section of the pressurizer vessel, keep the water in the pressurizer at saturation temperature and maintain a constant operating pressure. These heaters are divided into two groups, a control/variable group and a backup group.
The control/variable group is normally used during power operation since these heaters have inverse proportional control with respect to the pressurizer pressure. The backup group is either fully on or off with setpoints that are below those for the control/variable group. Both groups of heaters receive power from the Engineered Safety Feature (ESF) 480 V buses, however, the heaters are shed following a loss of offsite power or safety injection signal. The heaters can be manually loaded onto the diesel generators if required.
R.E. Ginna Nuclear Power Plant                B 3.4.9-1                                Revision 21
 
Pressurizer B 3.4.9 A minimum required available capacity of pressurizer heaters ensures that the RCS pressure can be maintained during natural circulation. The capability to maintain and control system pressure is important for maintaining subcooled conditions in the RCS and ensuring the capability to remove core decay heat. Unless adequate heater capacity is available, the required subcooling margin in the primary system cannot be maintained. Inability to control the system pressure and maintain subcooling under conditions of natural circulation flow in the primary system could lead to a loss of single phase natural circulation and decreased capability to remove core decay heat. Maintaining necessary subcooled margin during normal power operation is controlled by meeting the requirements for pressurizer level and LCO 3.4.1, "RCS Pressure, Temperature and Flow Departure From Nucleate Boiling (DNB) Limits."
APPLICABLE            In MODES 1, 2, and 3, the LCO requirement for a steam bubble is SAFETY                reflected implicitly in the accident analyses. Safety analyses performed ANALYSES              for lower MODES are not limiting with respect to pressurizer parameters.
All analyses performed from a critical reactor condition assume the existence of a steam bubble and saturated conditions in the pressurizer.
In making this assumption, the analyses neglect the small fraction of noncondensible gases normally present.
The maximum pressurizer water level limit ensures that a steam bubble exists and satisfies Criterion 2 of the NRC Policy Statement.
Safety analyses presented in the UFSAR (Ref. 1) do not take credit for pressurizer heater operation, however, the need to maintain subcooling in the long term during loss of offsite power, as indicated in NUREG-0737 (Ref. 2), is the reason for providing an LCO. The pressurizer heaters are assumed to be available within one hour following the loss of offsite power and initiation of natural circulation (Ref. 3).
LCO                  The LCO establishes the minimum conditions required to ensure that a steam bubble exists within the pressurizer and that sufficient heater capacity is available to support an extended loss of offsite power event.
For the pressurizer to be considered OPERABLE, the limits established in the SRs for water level and heater capacity must be met and the heaters must be capable of being powered from an emergency power source within one hour.
R.E. Ginna Nuclear Power Plant                B 3.4.9-2                                Revision 21
 
Pressurizer B 3.4.9 APPLICABILITY        The need for pressure control is most pertinent when core heat can cause the greatest effect on RCS temperature, resulting in the greatest effect on pressurizer level and RCS pressure control. Thus, applicability has been designated for MODES 1 and 2. The applicability is also provided for MODE 3 to prevent solid water RCS operation during heatup and cooldown to avoid rapid pressure rises caused by normal operational perturbation, such as reactor coolant pump startup.
In MODES 1, 2, and 3, there is need to maintain the availability of pressurizer heaters, capable of being powered from an emergency power supply (Ref. 4). In the event of a loss of offsite power, the initial conditions of these MODES give the greatest demand for maintaining the RCS in a hot pressurized condition with loop subcooling for an extended period. For MODE 4, 5, or 6, it is not necessary to control pressure (by heaters) to ensure loop subcooling for heat transfer when the Residual Heat Removal (RHR) System is in service, and therefore, the LCO is not applicable.
ACTIONS              A.1 and A.2 If the pressurizer water level is > 650 cubic feet, which is equivalent to 87%, the ability to maintain a steam bubble may no longer exist. The steam bubble is necessary to ensure the capability to establish and maintain pressure control for steady state operation and to minimize the consequences of potential overpressure transients. Requiring the presence of a steam bubble is also consistent with analytical assumptions. Pressurizer water level control malfunctions or other plant evolutions may result in a pressurizer water level above the nominal upper limit, even with the plant at steady state conditions. Normally the plant will trip in this event since the upper limit is the same as the Pressurizer High Level Trip.
If the pressurizer water level is not within the limit, action must be taken to restore the plant to operation within the bounds of the safety analyses.
To achieve this status, the plant must be brought to MODE 3, with the reactor trip breakers open, within 6 hours and to MODE 4 within 12 hours.
This takes the plant out of the applicable MODES and restores the plant to operation within the bounds of the safety analyses. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
R.E. Ginna Nuclear Power Plant                  B 3.4.9-3                                  Revision 21
 
Pressurizer B 3.4.9 B.1 and B.2 If the pressurizer heaters capacity is < 100 KW, the ability to maintain RCS pressure to support natural circulation may no longer exist. By maintaining RCS pressure control, a margin to subcooling is provided.
The value of 100 KW is based on the amount needed to support natural circulation after accounting for heat losses through the pressurizer insulation during an extended loss of offsite power event.
If the capacity of the pressurizer heaters is not within the limit, the plant must be brought to MODE 3 within 6 hours and to MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE          SR 3.4.9.1 REQUIREMENTS This SR requires that during steady state operation, pressurizer level is maintained below the nominal upper limit to provide a minimum space for a steam bubble. The Surveillance is performed by observing the indicated level. Alarms are also available for early detection of abnormal level indications. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.4.9.2 This SR is satisfied when the power supplies are demonstrated to be capable of producing the minimum power required. This may be done by testing the power supply output by verifying the electrical load on Buses 14 and 16 with the respective heater groups on and off. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
R.E. Ginna Nuclear Power Plant                B 3.4.9-4                                    Revision 77
 
Pressurizer Safety Valves B 3.
 
==4.9 REFERENCES==
: 1. UFSAR, Chapter 15.
: 2. NUREG-0737, "Clarification of TMI Action Plan Requirements,"
November 1980.
: 3. Letter from B. L. King, Westinghouse Electric Corporation, to R. C.
Mecredy, RG&E,
 
==Subject:==
"Ability to Maintain Subcooled Conditions During an Extended Loss of Offsite Power," dated September 26, 1979.
: 4. Letter from D. M. Crutchfield, NRC, to L. D. White, Jr. RG&E,
 
==Subject:==
"Lessons Learned Category A Evaluation," dated July 7, 1980.
R.E. Ginna Nuclear Power Plant              B 3.4.9-5                                  Revision 21
 
Pressurizer Safety Valves B 3.4.10 B 3.4    REACTOR COOLANT SYSTEM (RCS)
B 3.4.10    Pressurizer Safety Valves BASES BACKGROUND            The pressurizer safety valves provide, in conjunction with the Reactor Protection System, overpressure protection for the RCS. The pressurizer safety valves are totally enclosed pop type, spring loaded, self actuated valves with backpressure compensation. The safety valves are designed to prevent the system pressure from exceeding the system Safety Limit (SL), 2735 psig, which is 110% of the design pressure.
Because the safety valves are totally enclosed and self actuating, they are considered independent components. The relief capacity for each valve, 288,000 lbm/hr, is based on postulated overpressure transient conditions resulting from a complete loss of steam flow to the turbine.
This event results in the maximum surge rate into the pressurizer, which specifies the minimum relief capacity for the safety valves. The discharge flow from the pressurizer safety valves is directed to the pressurizer relief tank. This discharge flow is indicated by an increase in temperature downstream of the pressurizer safety valves or increase in the pressurizer relief tank temperature or level.
Overpressure protection is required in MODES 1, 2, 3, 4, and 5 and in MODE 6 with reactor vessel head on; however, in MODE 4, with either RCS cold leg temperature less than or equal to the LTOP enable temperature specified in the PTLR, and MODE 5 and MODE 6 with the reactor vessel head on and the SG primary system manway and pressurizer manway closed and secured in position, overpressure protection is provided by operating procedures and by meeting the requirements of LCO 3.4.12, "Low Temperature Overpressure Protection (LTOP) System."
The upper and lower pressure limits are based on the +/- 1% tolerance requirement (Ref. 1) for lifting pressures above 1000 psig. The lift setting is for the ambient conditions associated with MODES 1, 2, and 3. This requires either that the valves be set hot or that a correlation between hot and cold settings be established.
R.E. Ginna Nuclear Power Plant B 3.4.10-1                                    Revision 58
 
Pressurizer Safety Valves B 3.4.10 The pressurizer safety valves are part of the primary success path and mitigate the effects of postulated accidents. OPERABILITY of the safety valves ensures that the RCS pressure will be limited to 110% of design pressure for all anticipated transients except for the locked rotor accident which remains below 120% of the design pressure consistent with the original maximum transient pressure limit for the RCS (Refs. 2, 3 and 4).
The consequences of exceeding the American Society of Mechanical Engineers (ASME) and USAS Section B31.1 pressure limits (Refs. 1 and
: 4) could include damage to RCS components, increased leakage, or a requirement to perform additional stress analyses prior to resumption of reactor operation.
APPLICABLE            All accident and safety analyses in the UFSAR (Ref. 5) that require safety SAFETY                valve actuation assume operation of both pressurizer safety valves to ANALYSES              limit increases in RCS pressure. The overpressure protection analysis (Ref. 6) is also based on operation of both safety valves. Accidents that could result in overpressurization if not properly terminated include:
: a.      Uncontrolled rod withdrawal from full power;
: b.      Loss of reactor coolant flow;
: c.      Loss of external electrical load (including the complete loss of steam flow to the turbine);
: d.      Loss of normal feedwater;
: e.      Loss of all AC power to station auxiliaries; and
: f.      Locked rotor.
Detailed analyses of the above transients are contained in Reference 5.
Safety valve actuation is required in events c, d, e, and f (above) to limit the pressure increase. Compliance with this LCO is consistent with the design bases and accident analyses assumptions.
Pressurizer safety valves satisfy Criterion 3 of the NRC Policy Statement.
R.E. Ginna Nuclear Power Plant B 3.4.10-2                                  Revision 58
 
Pressurizer Safety Valves B 3.4.10 LCO                  The two pressurizer safety valves are set to open at the RCS design pressure (2500 psia), and within the ASME specified tolerance, to avoid exceeding the maximum design pressure SL, to maintain accident analyses assumptions, and to comply with ASME requirements. The upper and lower pressure tolerance limits following testing are based on the +/- 1% tolerance requirements (Ref. 1) for lifting pressures above 1000 psig. The OPERABILITY limits of + 2.3%, - 3% are based on the analyzed events. The limit protected by this Specification is the reactor coolant pressure boundary (RCPB) SL of 110% of design pressure for all transients except locked rotor accidents which has an allowed limit of 120% of design pressure. Inoperability of one or more valves could result in exceeding the SL if a transient were to occur. The consequences of exceeding the ASME pressure limit could include damage to one or more RCS components, increased leakage, or additional stress analysis being required prior to resumption of reactor operation.
APPLICABILITY        In MODES 1, 2, and 3, and portions of MODE 4 above the LTOP arming temperature, OPERABILITY of two valves is required because the combined capacity is required to keep reactor coolant pressure below 110% of its design value during certain accidents. MODE 3 and portions of MODE 4 are conservatively included, although the listed accidents may not require the safety valves for protection.
The LCO is not applicable in MODE 4 when either RCS cold leg temperature is less than or equal to the LTOP enable temperature specified in the PTLR or in MODE 5 because LTOP is provided.
Overpressure protection is not required in MODE 6 with the reactor vessel head detensioned or the SG primary system manway or the pressurizer manway open.
ACTIONS              A.1 With one pressurizer safety valve inoperable, restoration must take place within 15 minutes. The Completion Time of 15 minutes reflects the importance of maintaining the RCS Overpressure Protection System. An inoperable safety valve coincident with an RCS overpressure event could challenge the integrity of the pressure boundary.
R.E. Ginna Nuclear Power Plant B 3.4.10-3                                  Revision 58
 
Pressurizer Safety Valves B 3.4.10 B.1 and B.2 If the Required Action of A.1 cannot be met within the required Completion Time or if both pressurizer safety valves are inoperable, the plant must be brought to a MODE in which the requirement does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 4 with either RCS cold leg temperature less than or equal to the LTOP enable temperature specified in the PTLR within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. With any RCS cold leg temperature at or below the LTOP enable temperature specified in the PTLR, overpressure protection is provided by the LTOP System. The change from MODE 1, 2, or 3 to MODE 4 reduces the RCS energy (core power and pressure), lowers the potential for large pressurizer insurges, and thereby removes the need for overpressure protection by both pressurizer safety valves.
SURVEILLANCE          SR 3.4.10.1 REQUIREMENTS SRs are specified in the INSERVICE TESTING PROGRAM. Pressurizer safety valves are to be tested in accordance with the requirements of the ASME Code (Ref. 7), which provides the activities and Frequencies necessary to satisfy the SRs. No additional requirements are specified.
The pressurizer safety valve setpoint is + 2.3%, - 3% for OPERABILITY; however, the valves are reset to +/- 1% during the surveillance to allow for drift.
This SR is modified by a Note that allows entry into MODES 3 and 4 without having performed the SR for the purpose of setting the pressurizer safety valves under ambient (hot) conditions. This permits testing and examination of the safety valves at high pressure and temperature near their normal operating range, but only after the valves have had a preliminary cold setting. The cold setting gives assurance that the valves are OPERABLE near their design condition until completion of the surveillance.
R.E. Ginna Nuclear Power Plant                          B 3.4.10-4                        Revision 81
 
Pressurizer Safety Valves B 3.4.10 REFERENCES            1. ASME, Boiler and Pressure Vessel Code, Section III.
: 2. UFSAR, Section 15.3.2.
: 3. Letter from D. M. Crutchfield, NRC, to J. E. Maier, RG&E,
 
==Subject:==
 
                              "SEP Topic XV-1, XV-2, XV-3, XV-4, XV-5, XV-6, XV-7, XV-8, XV-10, XV-12, XV-14, XV-15, and XV-17, Design Basis Events, Accidents, and Transients (R.E. Ginna)," dated September 4, 1981.
: 4. USAS B31.1, Standard Code for Pressure Piping, American Society of Mechanical Engineers, 1967 edition.
: 5. UFSAR, Chapter 15.
: 6. WCAP-7769, "Topical Report, Overpressure Protection for Westinghouse Pressurized Water Reactors," Rev. 1, June 1972.
: 7. ASME Code for Operation and Maintenance of Nuclear Power Plants.
R.E. Ginna Nuclear Power Plant B 3.4.10-5                                Revision 58
 
Pressurizer PORVs B 3.4.11 B 3.4    REACTOR COOLANT SYSTEM (RCS)
B 3.4.11    Pressurizer Power Operated Relief Valves (PORVs)
BASES BACKGROUND            The pressurizer is equipped with two types of devices for pressure relief:
pressurizer safety valves and PORVs. The PORVs (430 and 431C) are air operated valves that are controlled to open at a specific set pressure when the pressurizer pressure increases and close when the pressurizer pressure decreases. The PORVs may also be manually operated from the control room.
Motor operated block valves (515 and 516), which are normally open, are located between the pressurizer and the PORVs. The block valves are used to isolate the PORVs in case of excessive leakage or a stuck open PORV. Block valve closure is accomplished manually using controls in the control room. A stuck open PORV is, in effect, a small break loss of coolant accident (LOCA). As such, block valve closure terminates the RCS depressurization and coolant inventory loss.
The PORVs and their associated block valves may be used by plant operators to depressurize the RCS to recover from certain transients if normal pressurizer spray is not available. Additionally, the series arrangement of the PORVs and their block valves permit performance of surveillances on the valves during power operation.
The PORVs may also be used for feed and bleed core cooling in the case of multiple equipment failure events that are not within the design basis, such as a total loss of feedwater and auxiliary feedwater. The PORVs are also used to mitigate the effects of an anticipated transient without scram (ATWS) event which is also not within the design basis.
The PORVs, their block valves, and their controls are powered from the vital buses that normally receive power from offsite power sources, but are also capable of being powered from emergency power sources in the event of a loss of offsite power. The two PORVs (in manual operation only) and their associated block valves are powered from two separate safety trains.
The plant has two PORVs, each having a relief capacity of 179,000 lb/hr at 2335 psig. The PORVs are normally opened by using instrument air which is supplied through separate solenoid operated valves (8620A and 8620B). The safety related source of motive air is from two separate nitrogen accumulators that are normally isolated from the PORVs by solenoid operated valves 8619A and 8619B; however, solenoid operated valves 8620A and 8620B must be in the vent position to close the PORVs regardless of which motive air source is used.
R.E. Ginna Nuclear Power Plant                B 3.4.11-1                                  Revision 58
 
Pressurizer PORVs B 3.4.11 The functional design of the PORVs is based on maintaining pressure below the pressurizer high pressure reactor trip setpoint following a step reduction of 50% of full load with steam dump. In addition, the PORVs minimize challenges to the pressurizer safety valves and also may be used for low temperature overpressure protection (LTOP). See LCO 3.4.12, "Low Temperature Overpressure Protection (LTOP) System."
APPLICABLE            Plant operators employ the PORVs to depressurize the RCS in response SAFETY                to certain plant transients if normal pressurizer spray is not available. For ANALYSES              the Steam Generator Tube Rupture (SGTR) event, the safety analysis assumes that manual operator actions are required to mitigate the event.
A loss of offsite power is assumed to accompany the event, and thus, normal pressurizer spray is unavailable to reduce RCS pressure. The PORVs are assumed to be used for RCS depressurization, which is one of the steps performed to equalize the primary and secondary pressures in order to terminate the primary to secondary break flow and the radioactive releases from the affected steam generator.
The PORVs are also used in safety analyses for events that result in increasing RCS pressure for which departure from nucleate boiling ratio (DNBR) criteria are critical. By assuming PORV manual actuation, the primary pressure remains below the pressurizer high pressure trip and pressurizer safety valve setpoints; thus the DNBR calculation is more conservative assuming the same initial RCS temperature since the pressurizer pressure is limited. Events that assume this condition include a loss of external electrical load and other transients which result in a decrease in heat removal by the secondary system (Ref. 1).
Pressurizer PORVs satisfy Criterion 3 of the NRC Policy Statement.
LCO                  The LCO requires the PORVs and their associated block valves to be OPERABLE for manual operation by the nitrogen accumulators to mitigate the effects associated with an SGTR. PORV OPERABILITY requires the associated nitrogen accumulator to be maintained at a pressure  400 psig. PORV leakage is addressed by LCO 3.4.13, "RCS Operational LEAKAGE;" however, a PORV with a leakage rate  10 gpm must also be declared inoperable per this LCO. This restriction is based on the potential need for operators to open the leaking PORV and associated block valve during accident mitigation. If the block valve then fails to re-close, the PORV leakage rate is outside the accident analysis assumptions.
By maintaining two PORVs and their associated block valves OPERABLE, the single failure criterion is satisfied. The block valves are available to isolate the flow path through either a failed open PORV or a R.E. Ginna Nuclear Power Plant                B 3.4.11-2                                  Revision 58
 
Pressurizer PORVs B 3.4.11 PORV with excessive leakage. Satisfying the LCO helps minimize challenges to fission product barriers.
APPLICABILITY        In MODES 1, 2, and 3, the PORV is required to be OPERABLE to mitigate the effects associated with an SGTR and its block valve must be OPERABLE to limit the potential for a small break LOCA through the flow path. The most likely cause for a PORV small break LOCA is a result ofa pressure increase transient that causes the PORV to automatically open with a subsequent failure to close. Imbalances in the energy output of the core and heat removal by the secondary system can cause the RCS pressure to increase to the PORV opening setpoint. The most rapid increases will occur at the higher operating power and pressure conditions of MODES 1 and 2. Pressure increases are less prominent in MODE 3 because the core input energy is reduced, but the RCS pressure is high.
The PORVs are also required to be OPERABLE in MODES 1,2, and 3 to minimize challenges to the pressurizer safety valves by manually opening the PORVs. Therefore, the LCO is applicable in MODES 1, 2, and 3.
The LCO is not applicable in MODE 4 when both pressure and core energy are decreased and the pressure surges become much less significant. The PORV setpoint is reduced for LTOP in MODES 4, 5, and 6 with the reactor vessel head in place. LCO 3.4.12 addresses the PORV requirements in these MODES.
ACTIONS              Note 1 has been added to clarify that both pressurizer PORVs are treated as separate entities, each with separate Completion Times (i.e., the Completion Time is on a component basis) for Condition A.
Note 2 has been added to clarify that both block valves are treated as separate entities, each with separate Completion Times, for Condition C.
A.1 and A.2 With the PORVs OPERABLE and not capable of being automatically controlled, either the PORVs must be restored or the flow path isolated within 1 hour. Although a PORV may not be capable of being automatically controlled, it may be able to be manually opened and closed, and therefore, able to perform its function. A PORV is considered not capable of being automatically controlled for any problem which prevents the PORV from automatically closing once it has automatically opened. This may be due to instrumentation problems. Not capable of automatic control does not include problems which only prevent the PORV from automatically opening (e.g., loss of instrument air to the PORV). It also does not include problems which prevent the PORV from R.E. Ginna Nuclear Power Plant              B 3.4.11-3                                Revision 58
 
Pressurizer PORVs B 3.4.11 both automatically opening and automaticaly closing. For these reasons, the block valve may either be closed to isolate the flowpaths or isolated by placing the PORV control switch in the closed position. However, if the block valve is closed to isolate the flowpath, the Action requires power be maintained to the valve. This Condition is only intended to permit operation of the plant for a limited period of time not to exceed the next refueling outage (MODE 6) so that maintenance can be performed on the PORVs to eliminate the problem. Normally, the PORVs should be available for automatic mitigation of overpressure events and should be returned to OPERABLE status prior to entering startup (MODE 2). Seat leakage problems are controlled by LCO 3.4.13, "RCS Operational LEAKAGE."
Quick access to the PORV for pressure control can be made when power remains on the closed block valve. The Completion Time of 1 hour is based on plant operating experience that has shown that minor problems can be corrected or closure accomplished in this time period.
B.1, B.2, and B.3 If one PORV is not capable of being manually cycled, it is inoperable and must be either restored or isolated by closing the associated block valve and removing the power to the associated block valve. PORV inoperability includes (but is not limited to) the inability of the solenoid operated isolation valve from the nitrogen accumulator to open or the solenoid operated isolation valve from instrument air to vent. The Completion Times of 1 hour are reasonable, based on challenges to the PORVs during this time period, and provide the operator adequate time to correct the situation. If the inoperable valve cannot be restored to OPERABLE status, it must be isolated within the specified time. Because there is a second PORV that is OPERABLE, 72 hours is provided to restore the inoperable PORV to OPERABLE status. If the PORV cannot be restored within this time, the plant must be brought to a MODE in which the LCO does not apply, as required by Condition E.
C.1 and C.2 If one block valve is inoperable, then it is necessary to either restore the block valve to OPERABLE status within the Completion Time of 1 hour or place the associated PORV in manual control. The prime importance for the capability to close the block valve is to isolate a stuck open PORV.
Therefore, if the block valve cannot be restored to OPERABLE status within 1 hour, the Required Action is to place the PORV in manual control to preclude its automatic opening for an overpressure event and to avoid the potential for a stuck open PORV at a time that the block valve is inoperable. Manual control is accomplished by placing the PORV control board switch in the closed position. The Completion Time of 1 hour is reasonable, based on the small potential for challenges to the system during this time period, and provides the operator time to correct the situation. Because the PORV is not capable of automatically opening R.E. Ginna Nuclear Power Plant              B 3.4.11-4                                      Revision 58
 
Pressurizer PORVs B 3.4.11 and the small potential for an SGTR or other event requiring Manual operation, the operator is permitted a Completion Time of 7 days to restore the inoperable block valve to OPERABLE status. The time allowed to restore the block valve is limited to 7 days since the PORVs are not capable of automatically mitigating an overpressure event when placed in manual control. If the block valve is restored within the Completion Time of 7 days, the PORV will again be capable of automatically responding to an overpressure event, and the block valves capable of isolating a stuck open PORV which may result from the overpressure event. If it cannot be restored within this additional time, the plant must be brought to a MODE in which the LCO does not apply, as required by Condition E.
D.1 and D.2 If both block valves are inoperable, then it is necessary to either restore at least one block valve to OPERABLE status within the Completion Time of 1 hour or place the PORVs in manual control. The prime importance for the capability to close the block valve is to isolate a stuck open PORV.
Therefore, if the block valves cannot be restored to OPERABLE status within 1 hour, the Required Action is to place the PORVs in manual control to preclude its automatic opening for an overpressure event and to avoid the potential for a stuck open PORV at a time that the block valve is inoperable. Manual control is accomplished by placing the PORV control board switch in the closed position. The Completion Time of 1 hour is reasonable, based on the small potential for challenges to the system during this time period, and provides the operator time to correct the situation. Because the PORV is not capable of automatically opening and the small potential for an SGTR or other event requiring Manual operation, the operator is permitted a Completion Time of 72 hours to restore at least one inoperable block valve to OPERABLE status. The time allowed to restore one block valve is limited to 72 hours since the PORVs are not capable of automatically mitigating an overpressure event when placed in manual control. If at least one block valve is restored within the Completion Time of 72 hours, at least one PORV will again be capable of automatically responding to an overpressure event, and the associated block valve capable of isolating a stuck open PORV which may result from the overpressure event. If it cannot be restored within this additional time, the plant must be brought to a MODE in which the LCO does not apply, as required by Condition E.
R.E. Ginna Nuclear Power Plant              B 3.4.11-5                                  Revision 58
 
Pressurizer PORVs B 3.4.11 E.1 and E.2 If the Required Action of Condition A, B, C, or Dis not met, then the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. In MODES 4 and 5, maintaining PORV OPERABILITY may be required. See LCO 3.4.12.
F.1, F.2, F.3, and F.4 If both PORVs are not capable of being manually cycled, they are inoperable and it is necessary to initiate action to restore one PORV to OPERABLE status immediately since no relief valve is available to mitigate the effects associated with an SGTR. Therefore, operators must either restore at least one valve within the Completion Time of 1 hour or isolate the flow path by closing and removing the power to the associated block valves. The Completion Time of 1 hour is reasonable, based on the small potential for challenges to the system during this time and provides the operator time to correct the situation.
If one PORV is restored and one PORV remains inoperable, then the plant will be in Condition B with the time clock started at the original declaration of having two PORVs inoperable. If no PORVs are restored within the Completion Time, then the plant must be brought to a MODE which does not require manual PORV operation. To achieve this status, the plant must be brought to MODE 3 with Tavg < 500&#xba;F within 8 hours.
In MODE 3 with the RCS average temperature < 500&#xba;F, the saturation pressure of the reactor coolant is below the setpoint of the main steam safety valves. Since the RWST contains a larger volume of water than the secondary side of an SG, the leak through the ruptured tube will stop after the SG is filled to capacity. Therefore, an SGTR can be mitigated under these conditions without any release of radioactive fluid through the main steam safety valves. Entering a lower MODE is not desirable with both PORVs inoperable and not capable of being manually cycled since the PORVs are also required for low temperature overpressure protection. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
R.E. Ginna Nuclear Power Plant              B 3.4.11-6                                  Revision 58
 
Pressurizer PORVs B 3.4.11 SURVEILLANCE          SR 3.4.11.1 REQUIREMENTS Block valve cycling verifies that the valve(s) can be closed if needed. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. If the block valve is closed to isolate a PORV that is OPERABLE and is not leaking in excess of the limits of LCO 3.4.13, "RCS Operational LEAKAGE," then opening the block valve is necessary to verify that the PORV can be used for manual control of reactor pressure. If the block valve is closed to isolate an otherwise inoperable PORV, the maximum Completion Time to restore the PORV and open the block valve is 72 hours, which is well within the allowable limits (25%) to extend the block valve Frequency. Furthermore, these test requirements would be completed by the reopening of a recently closed block valve upon restoration of the PORV to OPERABLE status (i.e., completion of the Required Actions fulfills the SR).
The Note modifies this SR by stating that it is not required to be performed with the block valve closed per LCO 3.4.13. This prevents the need to open the block valve when the associated PORV is leaking > 10 gpm creating the potential for a plant transient.
SR 3.4.11.2 This SR requires a complete cycle of each PORV using the nitrogen accumulators. Operating a PORV through one complete cycle ensures that the PORV can be manually actuated for mitigation of an SGTR. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES            1.      UFSAR, Section 15.2.
: 2.      ASME Code for Operation and Maintenance of Nuclear Power Plants.
R.E. Ginna Nuclear Power Plant                  B 3.4.11-7                                  Revision 77
 
LTOP System B 3.4.12 B 3.4    REACTOR COOLANT SYSTEM (RCS)
B 3.4.12    Low Temperature Overpressure Protection (LTOP) System BASES BACKGROUND            The LTOP System controls RCS pressure at low temperatures so the integrity of the reactor coolant pressure boundary (RCPB) is not compromised by violating the pressure and temperature (P/T) limits of 10 CFR 50, Appendix G (Ref. 1). The reactor vessel is the limiting RCPB component for demonstrating such protection. The LTOP system also protects the RHR system from overpressurization during the RHR mode of operation. The PTLR provides the maximum allowable actuation logic setpoints for the pressurizer power operated relief valves (PORVs) and the maximum RCS pressure for the existing RCS cold leg temperature during cooldown, shutdown, and heatup to meet the Reference 1 requirements during the LTOP MODES.
The reactor vessel material is less tough at low temperatures than at normal operating temperatures. As the vessel neutron exposure accumulates, the material toughness decreases and becomes less resistant to pressure stress at low temperatures (Ref. 2). RCS pressure, therefore, is maintained low at low temperatures and is increased only as temperature is increased.
The potential for vessel overpressurization is most acute when the RCS is water solid, occurring only while shutdown; a pressure fluctuation can occur more quickly than an operator can react to relieve the condition.
Exceeding the RCS P/T limits by a significant amount could cause brittle cracking of the reactor vessel. LCO 3.4.3, "RCS Pressure and Temperature (P/T) Limits," requires administrative control of RCS pressure and temperature during heatup and cooldown to prevent exceeding the PTLR limits.
This LCO provides RCS overpressure protection by restricting coolant input capability and having adequate pressure relief capacity. Limiting coolant input capability requires isolating the Emergency Core Cooling System (ECCS) accumulators and rendering all safety injection (SI) pumps incapable of RCS injection when the PORVs provide the RCS vent path and rendering a minimum of two SI pumps incapable of RCS injection when the RCS is depressurized with an RCS vent  1.1 square inches. The pressure relief capacity requires either two redundant PORVs or a depressurized RCS and an RCS vent of sufficient size. One PORV or the open RCS vent is the overpressure protection device that acts to terminate an increasing pressure event.
R.E. Ginna Nuclear Power Plant              B 3.4.12-1                                Revision 52
 
LTOP System B 3.4.12 By restricting coolant input capability, the ability to provide core coolant addition is minimized. The LCO does not require the makeup control system to be deactivated or the SI actuation circuits blocked. Due to the lower pressures in the LTOP MODES and the expected core decay heat levels, the makeup system can provide adequate flow via the makeup control valve. If the conditions require the use of SI for makeup in the event of loss of inventory, then pumps can be made available through manual actions.
The two redundant PORVs or a depressurized RCS with an open RCS vent is also sufficient to protect the RHR system during the RHR mode of operation for events which cause an increase in system pressure.
PORV Requirements As designed for the LTOP System, each PORV is signaled to open if the RCS pressure exceeds the limit selected to prevent a condition that is not within the acceptable region provided in the PTLR. The PORVs are opened by coincident actuation of two-of-three RCS pressure channels.
The PTLR presents the PORV setpoint for LTOP.
When a PORV is opened in an increasing pressure transient, the release of coolant will cause the pressure increase to slow and then reverse. As the PORV releases coolant, the RCS pressure decreases until a reset pressure is reached and the valve is signaled to close. The pressure continues to decrease below the reset pressure as the valve closes.
RCS Vent Requirements Once the RCS is depressurized, a vent exposed to the containment atmosphere will maintain the RCS at containment ambient pressure in an RCS overpressure transient, if the relieving requirements of the transient do not exceed the capabilities of the vent. Thus, the vent path must be capable of relieving the flow resulting from the limiting LTOP mass or heat input transient, and maintaining pressure below the P/T limits. The required vent capacity may be provided by one or more vent paths.
For an RCS vent to meet the flow capacity requirement, it requires removing a pressurizer safety valve, removing a PORV's internals or blocking it open, and disabling its block valve in the open position, or similarly establishing a vent by opening an RCS vent path. The vent path(s) must be above the level of reactor coolant, so as not to drain the RCS when open.
R.E. Ginna Nuclear Power Plant              B 3.4.12-2                                    Revision 52
 
LTOP System B 3.4.12 APPLICABLE            Safety analyses (Ref. 3) demonstrate that the reactor vessel is SAFETY                adequately protected against exceeding the Reference 1 P/T limits for all ANALYSES              Design Basis Accidents. In MODES 1, 2, and 3, and in MODE 4 with RCS cold leg temperature exceeding the LTOP enable temperature specified in the PTLR, the pressurizer safety valves will prevent RCS pressure from exceeding the Reference 1 limits. At or below the LTOP enable temperature specified in the PTLR, overpressure prevention requires two OPERABLE PORVs or a depressurized RCS and a sufficiently sized RCS vent. Each of these overpressure protection systems has a limited overpressure relief capability.
The actual temperature at which the pressure in the P/T limit curve falls below the pressurizer safety valve setpoint increases as the reactor vessel material toughness decreases as a result of neutron embrittlement. Each time the PTLR curves are revised, the LTOP System must be re-evaluated to ensure its functional requirements can still be met using the RCS relief valve method or the depressurized and vented RCS condition.
The PTLR contains the acceptance limits that define the LTOP requirements. Any change to the RCS must be evaluated against the Reference 3 analyses to determine the impact of the change on the LTOP acceptance limits.
Transients that are capable of overpressurizing the RCS are categorized as either mass or heat input transients, examples of which follow:
Mass Input Type Transients
: a.      Inadvertent safety injection (SI); or
: b.      Charging/letdown flow mismatch.
Heat Input Type Transients
: a.      Inadvertent actuation of pressurizer heaters;
: b.      Loss of RHR cooling; or
: c.      Reactor coolant pump (RCP) startup with temperature asymmetry within the RCS or between the RCS and steam generators.
R.E. Ginna Nuclear Power Plant              B 3.4.12-3                                Revision 52
 
LTOP System B 3.4.12 Analyses have determined that the mass input transients are the bounding case for overpressurization of the RCS (Ref. 3). The two categories of mass input transients were analyzed with respect to utilizing a single PORV or an RCS vent  1.1 square inches as overpressure protection. The inadvertent actuation of a single SI pump provides a larger mass addition to the RCS than isolation of letdown with all three charging pumps operating. A single automatic PORV was determined to be incapable of mitigating the overpressure transient resulting from actuation of a SI pump, but is capable of mitigating the charging/letdown mismatch transient. An RCS vent  1.1 square inches can mitigate both the inadvertent SI and charging/letdown flow mismatch transients.
Therefore, the following are required during the LTOP MODES to ensure that mass and heat input transients do not occur, which either of the LTOP overpressure protection means cannot handle:
: a. Rendering all SI pumps incapable of injection into the RCS when the PORVs provide the RCS vent path and rendering all but one SI pump incapable of injection into the RCS when the RCS is depressurized with an RCS vent of  1.1 square inches;
: b. Deactivating the ECCS accumulator discharge motor operated isolation valves in their closed positions; and
: c. Disallowing start of an RCP if secondary temperature is more than 50&#xba;F above primary temperature in any one loop or pressurizer level  38%. LCO 3.4.6, "RCS Loops - MODE 4," and LCO 3.4.7, "RCS Loops - MODE 5, Loops Filled," provide this protection.
The Reference 3 analyses demonstrate that either one automatic PORV or the depressurized RCS and RCS vent can maintain RCS pressure below limits with the maximum allowed coolant input capability. Since neither one automatic PORV nor the RCS vent can handle the pressure transient produced from ECCS accumulator injection when RCS temperature is low, the LCO also requires the ECCS accumulators isolated when accumulator pressure is greater than or equal to the maximum RCS pressure for the existing RCS cold leg temperature allowed in the PTLR.
The isolated ECCS accumulators must have their discharge valves closed and the valve power supply removed. The analyses show the effect of ECCS accumulator discharge is over a narrower RCS temperature range (200&#xba;F and below) than that of the LCO. Fracture mechanics analyses established the temperature of LTOP Applicability at the LTOP enable temperature specified in the PTLR.
The consequences of a small break loss of coolant accident (LOCA) in LTOP MODE 4 conform to 10 CFR 50.46 and 10 CFR 50, Appendix K (Refs. 4 and 5), requirements by having procedures to manually establish makeup capability.
R.E. Ginna Nuclear Power Plant                  B 3.4.12-4                                Revision 52
 
LTOP System B 3.4.12 The events which potentially overpressurize the RHR system during the RHR mode of operation are included within the mass and heat input transients analyzed for LTOP conditions. Therefore, an OPERABLE LTOP System ensures that the RHR system will not be overpressurized during the RHR mode of operation.
PORV Performance The fracture mechanics analyses show that the vessel is protected when the PORVs are set to open at or below the limit shown in the PTLR. The setpoints are derived by analyses that model the performance of the LTOP System, assuming the limiting LTOP transient for the PORVs of a charging/letdown flow mismatch. These analyses consider pressure overshoot and undershoot beyond the PORV opening and closing, resulting from signal processing and valve stroke times. The PORV setpoints at or below the derived limit ensures the Reference 1 P/T limits will be met and that the RHR system will not be overpressurized.
The PORV setpoints in the PTLR are updated when the revised P/T limits conflict with the LTOP analysis limits. The P/T limits are periodically modified as the reactor vessel material toughness decreases due to neutron embrittlement caused by neutron irradiation. Revised limits are determined using neutron fluence projections and the results of examinations of the reactor vessel material irradiation surveillance specimens. The Bases for LCO 3.4.3, "RCS Pressure and Temperature (P/T) Limits," discuss these examinations.
The PORVs are considered active components. Thus, the failure of one PORV is assumed to represent the worst case, single active failure.
RCS Vent Performance With the RCS depressurized, analyses show a vent size of 1.1 square inches is capable of mitigating the allowed LTOP overpressure transient.
The capacity of a vent this size is greater than the flow of the limiting transient for the LTOP configuration, which maintains RCS pressure less than the maximum pressure on the P/T limit curve. The limiting transient for this LTOP configuration is an SI actuation with one SI pump OPERABLE.
An RCS vent  1.1 square inches with the RCS depressurized also prevents overpressurization of the RHR system.
The RCS vent size will be re-evaluated for compliance each time the P/T limit curves are revised based on the results of the vessel material surveillance.
The RCS vent is passive and is not subject to active failure.
The LTOP System satisfies Criterion 2 of the NRC Policy Statement.
R.E. Ginna Nuclear Power Plant              B 3.4.12-5                                  Revision 52
 
LTOP System B 3.4.12 LCO                  This LCO requires that the LTOP System is OPERABLE. The LTOP System is OPERABLE when the minimum coolant input and pressure relief capabilities are OPERABLE. Violation of this LCO could lead to the loss of low temperature overpressure mitigation and violation of the Reference 1 limits as a result of an operational transient.
To limit the coolant input capability, the LCO requires the ECCS accumulators to be isolated. LCO 3.3.2, "Engineered Safety Feature Actuation System (ESFAS) Instrumentation," defines SI actuation OPERABILITY for the LTOP MODE 4 small break LOCA.
The elements of the LCO that provide low temperature overpressure mitigation are:
: a. Two OPERABLE PORVs and no SI pump capable of injecting into the RCS.
A PORV is OPERABLE for LTOP when its block valve is open, its lift setpoint is set to the limit required by the PTLR and testing proves its ability to open at this setpoint, and motive power is available to the valve and its control circuits and its associated accumulator pressure is  400 psig.
: b. A depressurized RCS and an RCS vent and a maximum of one SI pump capable of injecting into the RCS.
An RCS vent is OPERABLE when open with an area of  1.1 square inches.
Each of these methods of overpressure prevention is capable of mitigating the limiting LTOP transient.
The LCO is modified by two Notes. The first Note allows performance of the secondary side hydrostatic tests without the PORVs and RCS vent OPERABLE; however no SI pump may be capable of injecting into the RCS during this test. This exclusion is necessary since a pressure differential of  800 psid is maintained between the primary and secondary sides during the test. This restricted pressure differential limits the stresses placed on the SG which can cause cladding in the primary channel to separate from the base metal and result in the need for difficult repairs in a high radiation area. To maintain this pressure differential limit, RCS pressure must be increased above the PORV setpoint for LTOP conditions. The test cannot be performed above the LTOP enable temperature since the steam lines may not be able to accommodate the associated thermal expansion if they are heated. Therefore, all three SI pumps must be incapable of injecting into the RCS during these secondary side hydrostatic tests (Ref. 6).
R.E. Ginna Nuclear Power Plant                    B 3.4.12-6                                  Revision 52
 
LTOP System B 3.4.12 The second Note only requires an ECCS accumulator to be isolated when the accumulator pressure is greater than or equal to the maximum pressure for the existing RCS cold leg temperature allowed in the PTLR.
Accumulator pressure below this limit will not overpressurize the RCS beyond analyzed conditions. The accumulator is isolated when the discharge motor operated valve is closed and its associated power supply is removed.
APPLICABILITY        This LCO is applicable in MODE 4 when any RCS cold leg temperature is less than or equal to the LTOP enable temperature specified in the PTLR or the RHR system is in the RHR operating mode, in MODE 5 when the SG primary system manway and pressurizer manway are closed and secured in position, and in MODE 6 when the reactor vessel head is on and the SG primary system manway and pressurizer manway are closed and secured in position. The pressurizer safety valves provide overpressure protection that meets the Reference 1 P/T limits above the LTOP enable temperature specified in the PTLR. When the reactor vessel head is off or the SG primary system manway or pressurizer manway are open, overpressurization cannot occur.
LCO 3.4.3 provides the operational P/T limits for all MODES. LCO 3.4.10, "Pressurizer Safety Valves," requires the OPERABILITY of the pressurizer safety valves that provide overpressure protection during MODES 1, 2, and 3, and MODE 4 above the LTOP enable temperature specified in the PTLR.
Low temperature overpressure prevention is most critical during shutdown when the RCS is water solid, and a mass or heat input transient can cause a very rapid increase in RCS pressure when little or no time allows operator action to mitigate the event.
ACTIONS              A Note prohibits the application of LCO 3.0.4.b to an inoperable LTOP system. There is an increased risk associated with entering MODE 4 from MODE 5 with LTOP inoperable and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.
A.1 With one or more SI pumps capable of injecting into the RCS and the PORVs provide the RCS vent path, RCS overpressurization is possible.
To immediately initiate action to restore restricted coolant input capability R.E. Ginna Nuclear Power Plant              B 3.4.12-7                                  Revision 52
 
LTOP System B 3.4.12 to the RCS reflects the urgency of taking action to remove the RCS from this potential condition.
Condition A is modified by a Note which states that this condition is only applicable to LCO 3.4.12.a (i.e., when the PORVs provide the RCS vent path).
B.1 In MODE 4 when any RCS cold leg temperature is less than or equal to the LTOP enable temperature specified in the PTLR, with one required PORV inoperable, the PORV must be restored to OPERABLE status within a Completion Time of 7 days. Two PORVs are required to provide low temperature overpressure mitigation while withstanding a single failure of an active component.
The Completion Time considers that only one PORV is required to mitigate an overpressure transient and that the likelihood of an active failure of the remaining valve path during this time period is very low.
Condition B is modified by a Note which states that this condition is only applicable to LCO 3.4.12.a (i.e., when the PORVs provide the RCS vent path).
C.1 The consequences of operational events that will overpressurize the RCS are more severe at lower temperature (Ref. 7). Thus, with one of the two PORVs inoperable in MODE 5 with the SG primary system manway and pressurizer manway closed and secured in position, or in MODE 6 with the head on and the SG primary system manway and pressurizer manway closed and secured in position, the PORV must be restored to OPERABLE status in 72 hours. Restoring the PORV to OPERABLE status provides required redundancy.
The Completion Time of 72 hours to restore the PORV to OPERABLE status represents a reasonable time to investigate and repair several types of relief valve failures without exposure to a lengthy period with only one PORV to protect against overpressure events.
Condition C is modified by a Note which states that this condition is only applicable to LCO 3.4.12.a (i.e., when the PORVs provide the RCS vent path).
D.1 With two or more SI pumps capable of injecting into the RCS and the RCS is depressurized with an RCS vent of  1.1 square inches, RCS overpressurization is possible.
R.E. Ginna Nuclear Power Plant              B 3.4.12-8                                  Revision 52
 
LTOP System B 3.4.12 To immediately initiate action to restore restricted coolant input capability to the RCS reflects the urgency of taking action to the RCS from this potential condition.
Condition D is modified by a Note which states that this condition is only applicable to LCO 3.4.12.b (i.e., when there is a RCS vent path  1.1 square inches.
E.1, F.1, and F.2 An unisolated ECCS accumulator requires isolation within 1 hour. This is only required when the accumulator pressure is greater than or equal to the maximum RCS pressure for the existing temperature allowed by the P/T limit curves.
If isolation is needed and cannot be accomplished in 1 hour, Required Action F.1 and Required Action F.2 provide two options, either of which must be performed in the next 12 hours. By increasing the RCS temperature to greater than the LTOP enable temperature specified in the PTLR, a maximum accumulator pressure of 800 psig (relief valve setpoint) cannot exceed the LTOP limits if the accumulators are fully injected. Depressurizing the accumulators below the LTOP limit from the PTLR also gives this protection.
The Completion Times are based on operating experience that these activities can be accomplished in these time periods and on engineering evaluations indicating that an event requiring LTOP is not likely in the allowed times.
G.1 and G.2 At least one charging pump must be in the pull-stop position within 1 hour and the RCS must be depressurized and a vent must be established within 8 hours when:
: a.      Both required PORVs are inoperable for LCO 3.4.12.a; or
: b.      A Required Action and associated Completion Time of Condition A, B, C, or F is not met; or
: c.      The LTOP System is inoperable for any reason other than Condition A, B, C, or E.
The Completion Time of one hour to restrict the coolant input capability to the RCS considers the relatively low probability of an overpressure event during this time period and provides the operator time to render a charging pump incapable of injecting by placing it in the pull-stop position.
Only one disabling device is required since there is a relatively small probability of an inadvertent charging pump actuation during the 8 hours before RCS depressurization is achieved and a vent established. The R.E. Ginna Nuclear Power Plant B 3.4.12-9                                  Revision 52
 
LTOP System B 3.4.12 disabling of a charging pump is necessary since RV 203 cannot mitigate a charging/letdown mismatch event if RHR is providing decay heat removal above MODE 5 and three charging pumps are operating.
The passive vent must be sized 1.1 square inches to ensure that the flow capacity is greater than that required for the worst case mass input transient reasonable during the applicable MODES. This action is needed to protect the RCPB from a low temperature overpressure event and a possible brittle failure of the reactor vessel and to protect the RHR system from overpressurization.
The Completion Time of 8 hours to depressurize the RCS and establish a vent considers the time required to place the plant in this Condition and the relatively low probability of an overpressure event during this time period due to increased operator awareness of administrative control requirements.
SURVEILLANCE          SR 3.4.12.1 REQUIREMENTS To minimize the potential for a low temperature overpressure event by limiting the mass input capability, all SI pumps must be verified incapable of injecting into the RCS when the PORVs provide the RCS vent path (LCO 3.4.12.a) and a minimum of two SI pumps must be verified incapable of injecting into the RCS when the RCS is depressurized and an RCS vent  1.1 square inches is established (LCO 3.4.12.b). The SI pumps are rendered incapable of injecting into the RCS through removing the power from the pumps by racking the breakers out under administrative control. An alternate method of LTOP control may be employed using at least two independent means to prevent a pump start such that a single failure or single action will not result in an injection into the RCS. This may be accomplished through the following:
: a. placing the pump control switch in the pull-stop position and closing at least one valve in the discharge flow path;
: b. locking closed a manual isolation valve in the injection path; or
: c. closing a motor operated isolation valve in the injection path and removing the AC power source.
The flowpaths through the test connections associated with the ECCS accumulator check valves (i.e., lines containing air operated valves 839A, 839B, 840A, and 840B) and the ECCS accumulator fill lines (i.e., lines containing air operated valves 835A and 835B) do not have to be isolated for this SR since the potential mass addition from a single SI pump through these six lines is limited by the installed orifices to less than that assumed for the charging/letdown mismatch analysis.
R.E. Ginna Nuclear Power Plant                  B 3.4.12-10                                    Revision 52
 
LTOP System B 3.4.12 The ECCS accumulator motor operated isolation valves can be verified closed by use of control board indication for valve position. This verification is only required when the accumulator pressure is greater than or equal to the maximum RCS pressure for the existing RCS cold leg temperature allowed by the P/T limit curves provided in the PTLR. If the accumulator pressure is less than this limit, no verification is required since the accumulator cannot pressurize the RCS to or above the PORV setpoint.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.4.12.2 See SR 3.4.12.1 SR 3.4.12.3 See SR 3.4.12.1 SR 3.4.12.4 The RCS vent of  1.1 square inches is proven OPERABLE by verifying its open condition.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
The passive vent arrangement must be  1.1 square inches and be open to be OPERABLE. This Surveillance is required to be performed if the vent is being used to satisfy the pressure relief requirements of the LCO 3.4.12.b.
SR 3.4.12.5 The PORV block valve must be verified open to provide the flow path for each required PORV to perform its function when actuated. The valve may be remotely verified open in the main control room. This Surveillance is performed if the PORV satisfies the LCO.
The block valve is a remotely controlled, motor operated valve. The power to the valve operator is not required to be removed, and the manual operator is not required to be locked in the inactive position.
Thus, the block valve can be closed in the event the PORV develops R.E. Ginna Nuclear Power Plant                  B 3.4.12-11                                  Revision 77
 
LTOP System B 3.4.12 excessive leakage or does not close (sticks open) after relieving an overpressure situation.
The Surveillance Frequency is control under the Surveillance Frequency Control Program.
SR 3.4.12.6 Performance of a CHANNEL OPERATIONAL TEST (COT) is required on each required PORV to verify and, as necessary, adjust its lift setpoint.
The COT will verify the setpoint is within the allowed maximum limits in the PTLR. PORV actuation could depressurize the RCS and is therefore not required.
A Note has been added indicating that this SR is required to be performed within 12 hours after decreasing RCS cold leg temperature to less than or equal to the LTOP enable temperature specified in the PTLR if it has not been performed in accordance with the Surveillance Frequency Control Program. Depending on the cooldown rate, the COT may not have been performed before entry into the LTOP MODES. The test must be performed within 12 hours after entering the LTOP MODES. The 12 hours considers the unlikelihood of a low temperature overpressure event during this time.
SR 3.4.12.7 Verification once within 12 hours and in accordance with the Surveillance Frequency Control Program thereafter that power is removed from each ECCS accumulator motor operated isolation valve ensures that at least two independent actions must occur before the accumulator is capable of injecting into the RCS. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
This SR is modified by a Note which states that the Surveillance is only required when the accumulator pressure is greater than or equal to the maximum RCS pressure for the existing cold leg temperature allowed in the PTLR. If the accumulator pressure is below this limit, the LTOP limit cannot be exceeded and the surveillance is not required.
SR 3.4.12.8 Performance of a CHANNEL CALIBRATION on each required PORV actuation channel is required to adjust the whole channel so that it responds and the valve opens within the required range and accuracy to known input. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
R.E. Ginna Nuclear Power Plant              B 3.4.12-12                                Revision 77
 
LTOP System B 3.4.12 REFERENCES            1. 10 CFR 50, Appendix G.
: 2. Deleted.
: 3. UFSAR, Section 5.2.2.
: 4. 10 CFR 50, Section 50.46.
: 5. 10 CFR 50, Appendix K.
: 6. Letter from D. L. Ziemann, NRC, to L. D. White, RG&E,
 
==Subject:==
 
                            "Issuance of Amendment No. 28 to Provisional Operating License No.
DPR-18," dated July 26, 1979.
: 7. Generic Letter 90-06, "Resolution of Generic Issue 70, "Power-Operated Relief Valve and Block Valve Reliability," and Generic Issue 94, "Additional Low-Temperature Overpressure Protection for Light-Water Reactors."
R.E. Ginna Nuclear Power Plant                  B 3.4.12-13                            Revision 77
 
RCS Operational LEAKAGE B 3.4.13 B 3.4    REACTOR COOLANT SYSTEM (RCS)
B 3.4.13    RCS Operational LEAKAGE BASES BACKGROUND            Components that contain or transport the coolant to or from the reactor core make up the RCS. Component joints are made by welding, bolting, rolling, or pressure loading, and valves isolate connecting systems from the RCS.
During plant life, the joint and valve interfaces can produce varying amounts of reactor coolant LEAKAGE, through either normal operational wear or mechanical deterioration. The purpose of the RCS Operational LEAKAGE LCO is to limit LEAKAGE from these sources to amounts that do not compromise safety. This LCO specifies the types and amounts of LEAKAGE.
Atomic Industry Forum (AIF) GDC 16 (Ref. 1) requires that means be provided to detect significant uncontrolled leakage from the reactor coolant pressure boundary (RCPB). AIF-GDC 34 also requires that the RCPB be designed to reduce the probability of rapid propagation failures.
Thus, an early indication or warning signal is necessary to permit proper evaluation of all unidentified LEAKAGE. The leakage detection systems support these requirements by both detecting RCS LEAKAGE and identifying the location of its source. These leakage detection systems are specified in LCO 3.4.15, "RCS Leakage Detection Instrumentation."
The safety significance of RCS LEAKAGE varies widely depending on its source, rate, and duration. Therefore, detecting and monitoring RCS LEAKAGE into the containment area is necessary. Quickly separating the identified LEAKAGE from the unidentified LEAKAGE is necessary to provide quantitative information to the operators, allowing them to take corrective action should a leak occur that is detrimental to the safety of the plant and the public.
A limited amount of leakage inside containment is expected from auxiliary systems (e.g. component cooling water) that cannot be made 100%
leaktight. Leakage from these systems should be detected, located, and isolated from the containment atmosphere, if possible, to not interfere with RCS leakage detection.
This LCO deals with protection of the reactor coolant pressure boundary (RCPB) from degradation and the core from inadequate cooling, in addition to preventing the accident analyses radiation release assumptions from being exceeded. The consequences of violating this LCO include the possibility of a loss of coolant accident (LOCA).
R.E. Ginna Nuclear Power Plant                B 3.4.13-1                                  Revision 52
 
RCS Operational LEAKAGE B 3.4.13 APPLICABLE            Except for primary to secondary LEAKAGE, the safety analyses do not SAFETY                address operational LEAKAGE. However, other operational LEAKAGE is ANALYSES              related to the safety analyses for LOCA; the amount of leakage can affect the probability of such an event (Ref. 2).
Primary to secondary LEAKAGE is a factor in the dose releases outside containment resulting from a steam line break (SLB) accident and other accidents or transients which involve secondary steam release to the atmosphere, such as a steam generator tube rupture (SGTR), reactor coolant pump locked rotor (LR), and a rod ejection (RE) accident. The leakage contaminates the secondary fluid.
The UFSAR (Ref. 3) analysis for SGTR assumes that the intact SG primary to secondary LEAKAGE is 150 gallons per day, which is relatively inconsequential. The safety analysis for the SLB accident assumes 1 gpm primary to secondary LEAKAGE in each SG as a result of the accident. The LR and RE accidents are assumed to result in a 500 gallon per day primary to secondary LEAKAGE in each SG as a result of the accident. The dose consequences resulting from the accidents outside of containment are well within the limits defined in 10 CFR 50.67.
The RCS operational LEAKAGE satisfies Criterion 2 of the NRC Policy Statement.
LCO                  RCS operational LEAKAGE shall be limited to:
: 1. Pressure Boundary LEAKAGE No pressure boundary LEAKAGE is allowed, being indicative of material deterioration. LEAKAGE of this type is unacceptable as the leak itself could cause further deterioration, resulting in higher LEAKAGE. Violation of this LCO could result in continued degradation of the RCPB. LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE. LEAKAGE from an RCS branch connection component body or pipe wall is not considered Pressure Boundary LEAKAGE if the leak is isolated by a component that will not change position following an accident.
: 2. Unidentified LEAKAGE One gallon per minute (gpm) of unidentified LEAKAGE is allowed as a reasonable minimum detectable amount that the containment air monitoring and containment sump level monitoring equipment can detect within a reasonable time period. Violation of this LCO R.E. Ginna Nuclear Power Plant                  B 3.4.13-2                                  Revision 52
 
RCS Operational LEAKAGE B 3.4.13 could result in continued degradation of the RCPB, if the LEAKAGE is from the pressure boundary.
: 3. Identified LEAKAGE Up to 10 gpm of identified LEAKAGE is considered allowable because LEAKAGE is from known sources that do not interfere with detection of unidentified LEAKAGE and is well within the capability of a charging pump operating at its low speed setting. Identified LEAKAGE includes LEAKAGE to the containment from specifically known and located sources, LEAKAGE through two in-series PIVs, and primary to secondary LEAKAGE, but does not include pressure boundary LEAKAGE or controlled reactor coolant pump (RCP) seal return (a normal function not considered LEAKAGE). Violation of this LCO could result in continued degradation of a component or system.
: 4. Primary to Secondary LEAKAGE Through Any One SG The limit of 150 gallons per day per SG is based on the operational LEAKAGE performance criterion in NEI 97-06, Steam Generator Program Guidelines (Ref. 4). The Steam Generator Program operational LEAKAGE performance criterion in NEI 97-06 states, "The RCS operational primary to secondary leakage through any one SG shall be limited to 150 gallons per day." The limit is based on operating experience with SG tube degradation mechanisms that result in tube leakage. The operational leakage rate criterion in conjunction with the implementation of the Steam Generator Program is an effective measure for minimizing the frequency of steam generator tube ruptures.
A PORV which is leaking  10 gpm must also be declared inoperable per LCO 3.4.11, "Pressurizer PORVs."
APPLICABILITY        In MODES 1, 2, 3, and 4, this LCO applies because the potential for RCPB LEAKAGE is greatest when the RCS is pressurized.
In MODES 5 or 6, the temperature is  200&#xba;F and pressure is maintained low or at atmospheric pressure. Since the temperatures and pressures are far lower than those for MODES 1, 2, 3, and 4, the likelihood of leakage and crack propagation is much smaller. Therefore, the requirements of this LCO are not applicable in MODES 5 and 6.
LCO 3.4.14, "RCS Pressure Isolation Valve (PIV) Leakage," measures leakage through each individual PIV and can impact this LCO. Of the in-series PIVs in each isolated line, leakage measured through one PIV does not result in RCS LEAKAGE when the other is leak tight. If both R.E. Ginna Nuclear Power Plant              B 3.4.13-3                                Revision 52
 
RCS Operational LEAKAGE B 3.4.13 valves leak and result in a loss of mass from the RCS, the loss must be included in the allowable identified LEAKAGE.
ACTIONS              A.1 Unidentified LEAKAGE or identified LEAKAGE in excess of the LCO limits must be reduced to within limits within 4 hours. This Completion Time allows time to verify leakage rates and either identify unidentified LEAKAGE or reduce LEAKAGE to within limits before the reactor must be shut down. This action is necessary to prevent further deterioration of the RCPB.
B.1 and B.2 If any RCS pressure boundary LEAKAGE exists, or primary to secondary LEAKAGE is not within limits, or if the Required Action of Condition A cannot be completed within 4 hours, the reactor must be brought to lower pressure conditions to reduce the severity of the LEAKAGE and its potential consequences. It should be noted that LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE. The reactor must be brought to MODE 3 within 6 hours and MODE 5 within 36 hours. This action reduces the LEAKAGE and also reduces the factors that tend to degrade the pressure boundary.
The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
In MODE 5, the pressure stresses acting on the RCPB are much lower, and further deterioration is much less likely.
SURVEILLANCE          SR 3.4.13.1 REQUIREMENTS Verifying RCS LEAKAGE to be within the LCO limits ensures the integrity of the RCPB is maintained. Pressure boundary LEAKAGE which is not allowed by this LCO, would at first appear as unidentified LEAKAGE and can only be positively identified by inspection. Unidentified LEAKAGE and identified LEAKAGE are determined by performance of an RCS water inventory balance.
The RCS water inventory balance must be met with the reactor at steady state operating conditions (stable temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection and return flows). The Surveillance is modified by two Notes. Note 1 states that this SR is not required to be performed until 12 hours after establishing steady state operation. The 12 hour allowance provides R.E. Ginna Nuclear Power Plant              B 3.4.13-4                                Revision 52
 
RCS Operational LEAKAGE B 3.4.13 sufficient time to collect and process all necessary data after stable plant conditions are established.
Steady state operation is required to perform a proper inventory balance; calculations during maneuvering are not useful. For RCS operational LEAKAGE determination by water inventory balance, steady state is defined as stable RCS pressure, temperature, power level, pressurizer and volume control tank levels, makeup and letdown, and RCP seal injection and return flows.
An early warning of pressure boundary LEAKAGE or unidentified LEAKAGE is provided by the automatic systems that monitor the containment atmosphere radioactivity and the containment sump level. It should be noted that LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE. Leakage detection systems are specified in LCO 3.4.15, "RCS Leakage Detection Instrumentation."
Note 2 states that this SR is not applicable to primary to secondary LEAKAGE because LEAKAGE of 150 gallons per day cannot be measured accurately by an RCS water inventory balance.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.4.13.2 This SR verifies that primary to secondary LEAKAGE is less or equal to 150 gallons per day through any one SG. Satisfying the primary to secondary LEAKAGE limit ensures that the operational LEAKAGE performance criterion in the Steam Generator Program is met. If this SR is not met, compliance with LCO 3.4.17, "Steam Generator Tube Integrity," should be evaluated. The 150 gallons per day limit is measured at room temperature as described in Reference 5. The operational LEAKAGE rate limit applies to LEAKAGE through any one SG. If it is not practical to assign the LEAKAGE to an individual SG, all the primary to secondary LEAKAGE should be conservatively assumed to be from one SG.
The Surveillance is modified by a Note which states that the Surveillance is not required to be performed until 12 hours after establishment of steady state operation. For RCS primary to secondary LEAKAGE determination, steady state is defined as stable RCS pressure, temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection and return flows.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
R.E. Ginna Nuclear Power Plant              B 3.4.13-5                                  Revision 77
 
RCS Operational LEAKAGE B 3.4.13 REFERENCES            1. Atomic Industry Forum (AIF) GDC 16, Issued for comment July 10, 1967.
: 2. Generic Letter 84-04, "Safety Evaluation of Westinghouse Topical Reports Dealing with Elimination of Postulated Pipe Breaks in PWR Primary Main Loops."
: 3. UFSAR, Chapter 15.
: 4. NEI 97-06, Steam Generator Program Guidelines
: 5. Deleted.
R.E. Ginna Nuclear Power Plant            B 3.4.13-6                                Revision 77
 
RCS PIV Leakage B 3.4.14 B 3.4    REACTOR COOLANT SYSTEM (RCS)
B 3.4.14    RCS Pressure Isolation Valve (PIV) Leakage BASES BACKGROUND            10 CFR 50.2, 10 CFR 50.55a(c), and Atomic Industry Forum (AIF) GDC 53 (Refs. 1, 2, and 3), define RCS PIVs as any two normally closed valves in-series within the reactor coolant pressure boundary (RCPB),
which separate the high pressure RCS from an attached low pressure system. During their lives, these valves can produce varying amounts of reactor coolant leakage through either normal operational wear or mechanical deterioration. The RCS PIV Leakage LCO allows RCS high pressure operation when leakage through these valves exists in amounts that do not compromise safety.
The PIV leakage limit applies to each individual valve. Leakage through both in-series PIVs for a given line must be included as part of the identified LEAKAGE, governed by LCO 3.4.13, "RCS Operational LEAKAGE." This is true during operation only when the loss of RCS mass through in-series valves is determined by a water inventory balance (SR 3.4.13.1) or other confirmatory tests. A known component of the identified LEAKAGE before operation begins is the least of the individual leak rates determined for leaking series PIVs during the required surveillance testing; leakage measured through one PIV in a line is not RCS operational LEAKAGE if the other is leaktight. Prior to the required surveillance testing (SR 3.4.14.1) and water inventory balance (SR 3.4.13.1) in MODES 3 and 4, any leakage through the PIVs is considered unidentified LEAKAGE.
Although this specification provides a limit on allowable PIV leakage rate, its main purpose is to prevent overpressure failure of the low pressure portions of connecting systems. The leakage limit is an indication that the PIVs between the RCS and the connecting systems are degraded or degrading. PIV leakage could lead to overpressure of the low pressure piping or components. Failure consequences could be a loss of coolant accident (LOCA) outside of containment (i.e.,
intersystem LOCA), an unanalyzed accident, that could degrade the ability for low pressure injection.
The basis for this LCO is the 1975 NRC "Reactor Safety Study" (Ref. 4) that identified potential intersystem LOCAs as a significant contributor to the risk of core damage. A subsequent study (Ref. 5) evaluated various PIV configurations to determine the probability of intersystem LOCAs and to identify which configurations dominate the risk profile for intersystem LOCA potential. In response to Reference 6, a plant specific evaluation of intersystem LOCAs was performed to identify the most risk significant configurations.
R.E. Ginna Nuclear Power Plant                B 3.4.14-1                                  Revision 58
 
RCS PIV Leakage B 3.4.14 Violation of this LCO could result in continued degradation of a PIV, which could lead to overpressurization of a low pressure system and the loss of the integrity of a fission product barrier.
APPLICABLE            Reference 4 identified potential intersystem LOCAs as a significant SAFETY                contributor to the risk of core damage. The dominant accident sequence ANALYSES              in the intersystem LOCA category as identified by Reference 4 was the failure of the low pressure portion of the RHR System outside of containment. This accident is the result of a postulated failure of the PIVs, which are part of the RCPB, and the subsequent pressurization of the RHR System downstream of the PIVs from the RCS. Because the low pressure portion of the RHR System is designed for 600 psig, overpressurization failure of the RHR low pressure line would result in a LOCA outside containment and subsequent increased risk of core damage.
Reference 5 evaluated various PIV configurations, leakage testing of the valves, and operational changes to determine the effect on the probability of intersystem LOCAs. This study concluded that periodic leakage testing of the PIVs can substantially reduce the probability of an intersystem LOCA. In response to Reference 6, a plant specific evaluation of intersystem LOCAs was performed. PIVs in the following systems connected to the RCS were evaluated:
: a. residual heat removal (RHR);
: b. safety injection (SI); and
: c. chemical and volume control.
The evaluation of intersystem LOCAs concluded that several configurations identified in References 4 and 5 existed in the RHR and SI systems. The PIV configurations in the Chemical and Volume Control System were not identified as being risk significant due to the installed orifices in the letdown piping and the use of piping designed to RCS pressure conditions from the discharge of the positive displacement pumps to containment (Ref. 7).
R.E. Ginna Nuclear Power Plant                B 3.4.14-2                                Revision 58
 
RCS PIV Leakage B 3.4.14 The PIVs identified in the SI and RHR Systems are listed below and shown on Figure B 3.5.2-1a:
853A      RHR Inlet Check Valve to Reactor Vessel Core Deluge 853B      RHR Inlet Check Valve to Reactor Vessel Core Deluge 867A      SI Pump Discharge and Accumulator A Check Valve to RCS Cold Leg B 867B      SI Pump Discharge and Accumulator B Check Valve to RCS Cold Leg A 877A      SI Pump Discharge Chack Valve to RCS Hot Leg B 877B      SI Pump Discharge Chack Valve to RCS Hot Leg A 878A      SI Pump Discharge Isolation MOV to RCS Hot Leg B 878C      SI Pump Discharge Isolation MOV to RCS Hot Leg A 878F      SI Pump Discharge Check Valve to RCS Hot Leg B 878G      SI Pump Discharge Check Valve to RCS Cold Leg B 878H      SI Pump Discharge Check Valve to RCS Hot Leg A 878J      SI Pump Discharge Check Valve to RCS Cold Leg A RCS PIV leakage satisfies Criterion 2 of the NRC Policy Statement.
LCO                  RCS PIV leakage is identified LEAKAGE into closed systems connected to the RCS. Isolation valve leakage is usually on the order of drops per minute. Leakage that increases significantly suggests that something is operationally wrong and corrective action must be taken. This LCO only applies to those PIVs which are determined to be in the most risk significant configurations (Ref. 7) as listed in Applicable Safety Analysis.
The remaining PIVs are governed by LCO 3.4.13, "RCS Operational LEAKAGE" and LCO 3.6.3, "Containment Isolation Boundaries."
The LCO PIV leakage limit is 0.5 gpm per nominal inch of valve size with a maximum limit of 5 gpm. A leakage rate limit based on valve size is used since this is superior to a single allowable value (Ref. 8).
R.E. Ginna Nuclear Power Plant B 3.4.14-3                                    Revision 58
 
RCS PIV Leakage B 3.4.14 Reference 9 permits leakage testing at a lower pressure differential than between the specified maximum RCS pressure and the normal pressure of the connected system during RCS operation (the maximum pressure differential) in those types of valves in which the higher service pressure will tend to diminish the overall leakage channel opening. In such cases, the observed rate may be adjusted to the maximum pressure differential by assuming leakage is directly proportional to the pressure differential to the one half power.
APPLICABILITY        In MODES 1, 2, 3, and 4, this LCO applies because the PIV leakage potential is greatest when the RCS is pressurized.
In MODES 5 or 6, the temperature is  200&#xba;F and pressure is maintained low or at atmospheric pressure. Since the temperatures and pressures are far lower than those for MODES 1, 2, 3, and 4, the likelihood of leakage and isolation failures are much smaller. Therefore, the requirements of this LCO are not applicable in MODES 5 and 6.
ACTIONS              The Actions are modified by two Notes. Note 1 provides clarification that each flow path allows separate entry into a Condition. This is allowed based upon the functional independence of the flow path. Note 2 requires an evaluation of affected systems if a PIV is inoperable. The leakage may have affected system operability, or isolation of a leaking flow path with an alternate valve may have degraded the ability of the interconnected system to perform its safety function.
A.1 and A.2 A leaking flow path must be isolated by two valves. Required Actions A.1 and A.2 are modified by a Note that the valves used for isolation must meet the same leakage requirements as the PIVs and must be within the RCPB or the high pressure portion of the system.
Required Action A.1 requires that isolation of the affected flow path with one valve must be performed within 4 hours. Four hours provides time to reduce leakage in excess of the allowable limit and to isolate the affected system if leakage cannot be reduced. The 4 hour Completion Time allows the actions and restricts operation with leaking isolation valves.
R.E. Ginna Nuclear Power Plant                B 3.4.14-4                                Revision 58
 
RCS PIV Leakage B 3.4.14 Required Action A.2 specifies that the double isolation barrier of two valves be restored by closing some other valve qualified for isolation.
The use of a valve other than the previously leaking PIV must include consideration that the plant may no longer be in an analyzed condition.
The 72 hour Completion Time after exceeding the limit considers the time required to complete the Action and the low probability of a second valve failing during this time period.
B.1 and B.2 If leakage cannot be reduced, the system isolated, or the other Required Actions accomplished, the plant must be brought to a MODE in which the requirement does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours and MODE 5 within 36 hours. This Action may reduce the leakage due to reduced RCS pressure while reducing the potential for a LOCA outside the containment. The allowed Completion Times are reasonable based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE          SR 3.4.14.1 REQUIREMENTS Performance of leakage testing on each RCS PIV or isolation valve used to satisfy Required Action A.1 and Required Action A.2 is required to verify that leakage is below the specified limit and to identify each leaking valve. The leakage limit of 0.5 gpm per inch of nominal valve diameter up to 5 gpm maximum applies to each valve and should be based on an RCS pressure of +/- 20 psig of normal system operating pressure.
Leakage testing requires a stable pressure condition.
For multiple in-series PIVs, the leakage requirement applies to each valve individually, except as noted below, and not to the combined leakage across both valves. If the PIVs are not individually leakage tested, one valve may have failed completely and not be detected if the other in-series valve meets the leakage requirement. In this situation, the protection provided by redundant valves would be lost.
R.E. Ginna Nuclear Power Plant                B 3.4.14-5                                  Revision 58
 
RCS PIV Leakage B 3.4.14 The SI hot leg injection lines are each configured with two check valves and a motor operated valve in series. Each of these components independently is considered a qualified pressure boundary. The two check valves function as a single pressure isolation barrier and the motor operated valve serves as the second pressure isolation barrier to prevent an intersystem LOCA. Both barriers need to be tested. Testing of the check valves (877A, 877B, 878F, and 878H) and the motor operated valves (878A and 878C) identified as PIVs in the SI hot leg injection lines is to be performed in accordance with the Surveillance Frequency Control Program.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
In addition to the periodic testing requirements, testing must be performed once after the valve has been opened by flow, exercised, or had maintenance performed on it to ensure tight reseating. This maintenance does not include minor activities such as packing adjustments which do not affect the leak tightness of the valve. PIVs disturbed in the performance of this Surveillance should also be tested unless documentation shows that an infinite testing loop cannot practically be avoided. Testing must be performed within 24 hours after the valve has been reseated. A limit of 24 hours is a reasonable and practical time limit for performing this test after opening or reseating a valve.
The leakage limit is to be met at the RCS pressure associated with MODES 1 and 2. This permits leakage testing at high differential pressures with stable conditions not possible in the MODES with lower pressures.
Entry into MODES 3 and 4 is allowed to establish the necessary differential pressures and stable conditions to allow for performance of this Surveillance.
SR 3.4.14.2 See SR 3.4.14.1 R.E. Ginna Nuclear Power Plant                    B 3.4.14-6                                  Revision 77
 
RCS PIV Leakage B 3.4.14 REFERENCES            1. 10 CFR 50.2.
: 2. 10 CFR 50.55a(c).
: 3. Atomic Industry Forum (AIF) GDC 53, Issued for comment July 10, 1967.
: 4. WASH-1400 (NUREG-75/014), "An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants," Appendix V, October 1975.
: 5. NUREG-0677, "The Probability of Intersystem LOCA: Impact Due to Leak Testing and Operational Changes," May 1980.
: 6. Generic Letter, "LWR Primary Coolant System Pressure Isolation Valves," dated February 23, 1980.
: 7. Deleted.
: 8. EG&G Report, EGG-NTAP-6175.
: 9. Deleted.
: 10. Deleted.
: 11. Deleted.
R.E. Ginna Nuclear Power Plant              B 3.4.14-7                              Revision 77
 
RCS Leakage Detection Instrumentation B 3.4.15 B 3.4    REACTOR COOLANT SYSTEM (RCS)
B 3.4.15    RCS Leakage Detection Instrumentation BASES BACKGROUND            Atomic Industry Forum (AIF) GDC 16 (Ref. 1) requires that means be provided to detect significant uncontrolled leakage from the reactor coolant pressure boundary (RCPB). AIF-GDC 34 (Ref. 1) also requires that the RCPB be designed to reduce the probability of rapid propagation failures. Thus, an early indication or warning signal is necessary to permit proper evaluation of all unidentified LEAKAGE. The leakage detection systems support these requirements by both detecting RCS LEAKAGE and identifying the location of its source.
Industry practice has shown that small water flow changes can be readily detected in contained volumes by monitoring changes in water level or in the operating frequency of a pump. The containment sump used to collect unidentified LEAKAGE (i.e., containment sump A) is monitored for level and sump pump actuation and can measure approximately a 2.0 gpm leak in one hour. This sensitivity is acceptable for detecting increases in unidentified LEAKAGE.
The reactor coolant contains radioactivity that, when released to the containment, can be detected by radiation monitoring instrumentation.
Reactor coolant radioactivity levels will be low during initial reactor startup and for a few weeks thereafter, until activated corrosion products have been formed and fission products appear from fuel element cladding contamination or cladding defects. The particulate monitor (R-11) can detect a leak as small as 0.018 gpm within 20 minutes assuming the presence of noble gas decay products. The gaseous monitor (R-12) can detect a leak of 2.0 to 7.0 gpm within 1 hour and is considered a backup to the particulate monitor. The range of sensitivity varies depending on the source of the leak and when in the operating cycle the leak occurs. A gas-space leak would offer the highest sensitivity due to the accumulation of Nobel Gases. End-of-cycle operations increases the concentration of AR-41 in the RCS, providing a sensitivity in the middle of the specified range. The presence of failed fuel would increase the sensitivity to levels beyond those documented here. Radioactivity detection systems are included for monitoring both particulate and gaseous activities because of their sensitivities and rapid responses to RCS LEAKAGE.
Alternative means also exist to monitor RCS LEAKAGE inside containment. These include humidity detectors, air temperature and pressure monitoring, and condensate flow rate from the air coolers. The capability of these systems to detect RCS leakage is influenced by several factors including containment free volume and detector location.
R.E. Ginna Nuclear Power Plant                  B 3.4.15-1                                    Revision 62
 
RCS Leakage Detection Instrumentation B 3.4.15 These systems are most useful as alarms or indirect indicating devices available to the operators and are not required by this LCO (Ref. 2).
The leakage detection systems are also used to support identification of leakage from open systems found in containment. This includes service water and fire service water systems. Leakage from these systems is required to be monitored in response to IE Bulletin No. 80-24 (Ref. 3).
APPLICABLE            The asymmetric loads produced by the postulated breaks are the result SAFETY                of an assumed pressure imbalance, both internal and external to the ANALYSES              RCS. The internal asymmetric loads result from a rapid decompression that cause large transient pressure differentials across the core barrel and fuel assemblies. The external asymmetric loads result from the rapid depressurization of annulus regions, such as the annulus between the reactor vessel and the shield wall, and cause large transient pressure differentials to act on the vessel. These asymmetric loads could damage RCS supports, core cooling equipment or core internals. This concern was first identified as Multiplant Action (MPA) D-10 and subsequently as Unresolved Safety Issue (USI) 2, "Asymmetric LOCA Loads" (Ref. 4).
The resolution of USI-2 for Westinghouse PWRs was use of fracture mechanics technology for RCS piping > 10 inches diameter (Ref. 5).
This technology became known as leak-before-break (LBB). Included within the LBB methodology was the requirement to have leakage detection systems capable of detecting a 1.0 gpm leak within four hours.
This leakage rate is designed to ensure that adequate margins exist to detect leaks in a timely manner during normal operating conditions. The use of LBB for the Ginna Station RCS is documented in Reference 6.
The LBB methodology was further expanded to include the portions of the residual heat removal (RHR) system piping from its connection to the RCS hot and cold leg piping to the first motor operated isolation valve.
The specific application of LBB to this piping was reviewed by the NRC and the staff concluded that, because the appropriate margins on leakage and crack size have been met given the Ginna leakage detection system capability of 0.25 gpm, it has been demonstrated that these sections of piping will exhibit LBB behavior.
The safety significance of RCS LEAKAGE varies widely depending on its source, rate, and duration. Therefore, detecting and monitoring RCS LEAKAGE into the containment area is necessary. Quickly separating the identified LEAKAGE from the unidentified LEAKAGE is necessary to provide quantitative information to the operators, allowing them to take corrective action should a leak occur that is detrimental to the safety of the plant and the public. Required corrective actions are provided in LCO 3.4.13, RCS Operational LEAKAGE. The capability of the leakage detection systems was evaluated by the NRC in References 7 and 8.
R.E. Ginna Nuclear Power Plant              B 3.4.15-2                                  Revision 62
 
RCS Leakage Detection Instrumentation B 3.4.15 RCS leakage detection instrumentation satisfies Criterion 1 of the NRC Policy Statement.
LCO                  One method of protecting against large RCS LEAKAGE derives from the ability of instruments to rapidly detect extremely small leaks. This LCO requires instruments of diverse monitoring principles to be OPERABLE to provide a high degree of confidence that extremely small leaks are detected in time to allow actions to place the plant in a safe condition, when RCS LEAKAGE indicates possible RCPB degradation.
The LCO is satisfied when monitors of diverse measurement means are available. Thus, the containment sump A monitor (level or pump actuation from either sump A pump), in combination with a gaseous (R-
: 12) and particulate (R-11) radioactivity monitor provides an acceptable minimum. Alternatively, the plant vent gaseous (R-14) or particulate (R-
: 13) monitors may be used in place of R-12 and R-11, respectively, provided that a flowpath through normally closed valve 1590 is available and R-14A is OPERABLE.
APPLICABILITY        Because of elevated RCS temperature and pressure in MODES 1, 2, 3, and 4, RCS leakage detection instrumentation is required to be OPERABLE.
In MODE 5 or 6, the temperature is  2 00&#xba;F and pressure is maintained low or at atmospheric pressure. Since the temperatures and pressures are far lower than those for MODES 1, 2, 3, and 4, the likelihood of leakage and crack propagation are much smaller. Therefore, the requirements of this LCO are not applicable in MODES 5 and 6.
ACTIONS              A.1.1, A.1.2, and A.2 With the required containment sump A monitor inoperable, no other form of sampling can provide the equivalent information; however, the containment atmosphere radioactivity monitors will provide indications of changes in leakage. In addition to OPERABLE gaseous and particulate atmosphere monitors, the containment air cooler condensate collection system must be verified to be OPERABLE within 24 hours, or the periodic surveillance for RCS water inventory balance, SR 3.4.13.1, must be performed at an increased frequency of 24 hours to provide information that is adequate to detect leakage.
R.E. Ginna Nuclear Power Plant              B 3.4.15-3                                  Revision 62
 
RCS Leakage Detection Instrumentation B 3.4.15 The containment air cooler condensate collection system is OPERABLE if the flow paths from all four containment air coolers to their respective collection tanks are available. The containment air cooler condensate collection system is provided as an option for detecting RCS leakage since SR 3.4.13.1 is not performed until after 12 hours of steady state operation. Therefore, this collection system can be used during MODE changes if the containment sump monitor is inoperable to meet the LCO.
Restoration of the required sump monitor to OPERABLE status within a Completion Time of 30 days is required to regain the function after the monitor's failure. This time is acceptable, considering the Frequency and adequacy of the RCS water inventory balance required by Required Action A.1.
B.1 With the gaseous (R-12) containment atmosphere radioactivity monitoring instrumentation channel inoperable (and its alternate R-14), a verification that the particulate (R-11) containment atmosphere radioactivity monitor is OPERABLE is required. The 1 hour Completion Time is based on the low probability of a RCS leak occurring during this time frame.
C.1 and C.2 With the particulate (R-11) containment atmosphere radioactivity monitoring instrumentation channel inoperable (and its alternate R-13) or Required Action B.1 not met, alternative action is required. Either grab samples of the containment atmosphere must be taken and analyzed or water inventory balances, in accordance with SR 3.4.13.1, must be performed to provide alternate periodic information as the gaseous (R-
: 12) containment atmosphere radioactivity monitor can only measure between a 2.0 and 7.0 gpm leak within one hour and the containment sump monitor can only measure a 2.0 gpm leak within one hour.
The 12 hour interval provides periodic information that is adequate to detect leakage and recognizes that at least one other form of leakage detection is available.
D.1 and D.2 With the gaseous (R-12) and the particulate (R-11) containment atmosphere radioactivity monitors inoperable, the only installed means of detecting leakage is the containment sump monitor. This condition does not provide a diverse means of leakage detection. Also, the sump monitor can only measure a 2.0 gpm leak within 1 hour.
In addition to the Required Actions of Conditions B and C, restoration of either of the inoperable monitors to OPERABLE status within 30 days is required to regain the intended leakage detection diversity. The 30 day R.E. Ginna Nuclear Power Plant                    B 3.4.15-4                                  Revision 62
 
RCS Leakage Detection Instrumentation B 3.4.15 Completion Time ensures that the plant will not be operated in a reduced configuration for a lengthy period of time.
E.1 and E.2 If a Required Action of Condition A, C, or D cannot be met, the plant must be brought to a MODE in which the requirement does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
F.1 With all required monitors inoperable, no automatic means of monitoring leakage are available, and immediate plant shutdown in accordance with LCO 3.0.3 is required.
SURVEILLANCE          SR 3.4.15.1 REQUIREMENTS This SR requires the performance of a CHANNEL CHECK of the containment atmosphere radioactivity monitors. The check gives reasonable confidence that the channels are operating properly. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.4.15.2 This SR requires the performance of a CHANNEL OPERATIONAL TEST (COT) on the containment atmosphere radioactivity monitors. The test ensures that the monitors can perform their function in the desired manner. The test verifies the alarm setpoint and relative accuracy of the instrument string. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.4.15.3 These SRs require the performance of a CHANNEL CALIBRATION for each of the RCS leakage detection instrumentation channels. The calibration verifies the accuracy of the instrument string, including the instruments located inside containment. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
R.E. Ginna Nuclear Power Plant                B 3.4.15-5                                  Revision 77
 
RCS Leakage Detection Instrumentation B 3.4.15 SR 3.4.15.4 See SR 3.4.
 
==15.3 REFERENCES==
: 1. Atomic Industry Forum (AIF) GDC 16 and 34, Issued for comment July 10, 1967.
: 2. Regulatory Guide 1.45.
: 3. IE Bulletin No. 80-24, "Prevention of Damage Due to Water Leakage Inside Containment."
: 4. NUREG-0609, "Asymmetric Blowdown Loads on PWR Primary Systems," 1981.
: 5. Generic Letter 84-04, "Safety Evaluation of Westinghouse Topical Reports Dealing With Elimination of Postulated Pipe Breaks in PWR Primary Main Loops."
: 6. Letter from D. C. DiIanni, NRC, to R. W. Kober, RG&E,
 
==Subject:==
 
                            "Generic Letter 84-04," dated September 9, 1986.
: 7. NUREG-0821, "Integrated Plant Safety Assessment, Systematic Evaluation Program, R. E. Nuclear Power Plant," December 1982.
: 8. Letter from Guy S. Vissing (NRC) to Robert C. Mecredy (RG&E),
                            "Staff Review of the Submittal by Rochester Gas and Electric Company to Apply Leak-Before-Break Status to Portions of the R.E.
Ginna Nuclear Power Plant Residual Heat Removal System Piping", dated February 25, 1999.
R.E. Ginna Nuclear Power Plant              B 3.4.15-6                              Revision 62
 
RCS Specific Activity B 3.4.16 B 3.4    REACTOR COOLANT SYSTEM (RCS)
B 3.4.16    RCS Specific Activity BASES BACKGROUND            The maximum dose that an individual can receive during an accident is specified in 10 CFR 50.67 (Ref. 1). The limits on specific activity ensure that the doses are held to a small fraction of the 10 CFR 50.67 limits during analyzed transients and accidents.
The RCS specific activity LCO limits the allowable concentration level of radionuclides in the reactor coolant. The LCO limits are established to minimize the offsite radioactivity dose consequences in the event of a steam generator tube rupture (SGTR) accident.
The specific activity limits for both DOSE EQUIVALENT I-131 and DOSE EQUIVALENT XE-133 are provided in the SRs. The allowable levels are intended to limit the dose to a small fraction of the 10 CFR 50.67 dose limits. The limits in the LCO are standardized, based on evaluations of offsite radioactivity dose consequences for typical site locations.
The evaluations showed the potential offsite dose levels for a SGTR accident were an appropriately small fraction of the 10 CFR 50.67 dose limits.
APPLICABLE            The LCO limits on the specific activity of the reactor coolant ensures that SAFETY                the resulting doses will not exceed a small fraction of the 10 CFR 50.67 ANALYSES              dose limits following a SGTR accident. The SGTR dose analysis (Ref. 2) assumes the specific activity of the reactor coolant at the LCO limit and an existing reactor coolant steam generator (SG) tube leakage rate of 150 gpd.
The analysis for the SGTR accident establishes the acceptance limits for RCS specific activity. Reference to this analysis is used to assess changes to the plant that could affect RCS specific activity, as they relate to the acceptance limits.
R.E. Ginna Nuclear Power Plant                B 3.4.16-1                                Revision 80
 
RCS Specific Activity B 3.4.16 The analysis is for two cases of reactor coolant specific activity (Ref. 2).
One case assumes specific activity at 1.0 Ci/gm DOSE EQUIVALENT I-131 with a concurrent large iodine spike that increases the I-131 activity in the reactor coolant by a factor of 335 for a duration of eight hours immediately after the accident. The second case assumes the initial reactor coolant iodine activity at 60.0 Ci/gm DOSE EQUIVALENT I-131 due to a pre-accident iodine spike caused by an RCS transient. In both cases, the noble gas activity in the reactor coolant assumes 1% failed fuel, which closely equals the LCO limit of 650 Ci/gm DOSE EQUIVALENT XE-133.
The assumption used to calculate dose for the Control Room, Exclusion Area Boundary (EAB) and Low Population Zone are included in Reference 2. The dose analysis shows the radiological consequences of an SGTR accident are within a small fraction of the Reference 1 dose limits. Operation with iodine specific activity levels greater than the LCO limit is permissible provided that the activity levels do not exceed 60.0 Ci/gm.
The increased permissible iodine levels are acceptable because of the low probability of a SGTR accident occurring during the established 7 day time limit. The occurrence of an SGTR accident at these permissible levels could increase dose levels, but they would still be within 10 CFR 50.67 dose limits.
RCS specific activity satisfies Criterion 2 of the NRC Policy Statement.
LCO                  The specific iodine activity is limited to 1.0 Ci/gm DOSE EQUIVALENT I-131, and the noble gas specific activity in the reactor coolant is limited to 650 Ci/gm DOSE EQUIVALENT XE-133, which ensures the dose to an individual during the Design Basis Accident (DBA) will be a small fraction of the allowed dose.
The SGTR accident analysis (Ref. 2) shows that the dose levels are within acceptable limits. Violation of the LCO may result in reactor coolant radioactivity levels that could, in the event of an SGTR, lead to doses that exceed the 10 CFR 50.67 dose limits.
R.E. Ginna Nuclear Power Plant              B 3.4.16-2                                  Revision 80
 
RCS Specific Activity B 3.4.16 APPLICABILITY        In MODES 1, 2, 3, and 4 operation within the LCO limits for DOSE EQUIVALENT I-131 and DOSE EQUIVALENT XE-133 are necessary to contain the potential consequences of an SGTR to within the acceptable dose values.
In MODES 5 and 6, the steam generators are not being used for decay heat removal, the RCS and steam generators are depressurized, and primary to secondary leakage is minimal. Therefore, the monitoring of RCS activity is not required.
ACTIONS              A.1 and A.2 With the DOSE EQUIVALENT I-131 greater than the LCO limit, samples at intervals of 8 hours must be taken to demonstrate that the limits of 60 Ci/gm are not exceeded. The Completion Time of 8 hours is required to obtain and analyze a sample. Sampling is done to continue to provide a trend.
The DOSE EQUIVALENT I-131 must be restored to within limits within 7 days if the limit violation resulted from normal iodine spiking.
A Note permits the use of the provisions of LCO 3.0.4.c. This allowance permits entry into the applicable MODE(S) while relying on the ACTIONS.
This allowance is provided because of the significant conservatism included in the LCO limit. Also, reducing the DOSE EQUIVALENT I-131 to within limits is accomplished through use of the Chemical and Volume Control System (CVCS) demineralizers. This cleanup operation parallels plant restart following a reactor trip which frequently results in iodine spikes due to the large step decrease in reactor power level and RCS pressure excursion. The cleanup operation can normally be accomplished within the LCO Completion Time of 7 days.
B.1 With the DOSE EQUIVALENT XE-133 greater than the LCO limit, DOSE EQUIVALENT XE-133 must be restored to within limit within 48 hours. The allowed Completion Time of 48 hours is acceptable since it is expected that, if there were a noble gas spike, the normal coolant noble gas concentration would be restored within this time period.
Also, there is a low probability of a SLB or SGTR occurring during this time period.
A Note permits the use of the provisions of LCO 3.0.4.c. This allowance permits entry into the applicable MODES, relying on Required Action B.1 while the DOSE EQUIVALENT XE-133 LCO limit R.E. Ginna Nuclear Power Plant                B 3.4.16-3                                  Revision 80
 
RCS Specific Activity B 3.4.16 is not met. This allowance is acceptable due to the significant conservatism incorporated into the specific activity limit, the low probability of an event which is limiting due to exceeding this limit, and the ability to restore transient specific activity excursions while the plant remains at, or proceeds to, power operation.
C.1 and C.2 If the Required Action and associated Completion Time of Condition A or B is not met, or if the DOSE EQUIVALENT I-131 is > 60.0 &#xb5;Ci/gm, the reactor must be brought to MODE 3 within 6 hours and MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE          SR 3.4.16.1 REQUIREMENTS This SR requires performing a gamma isotopic analysis as a measure of the noble gas specific activity of the reactor coolant. This measurement is the sum of the degassed gamma activities and the gaseous gamma activities in the sample taken. This Surveillance provides an indication of any increase in noble gas specific activity.
Trending the results of this Surveillance allows proper remedial action to be taken before reaching the LCO limit under normal operating conditions. The Surveillance is applicable in MODES 1, 2, 3, and 4.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. Due to the inherent difficulty in detecting Kr-85 in a reactor coolant sample due to masking from radioisotopes with similar decay energies, such as F-18 and I-134, it is acceptable to include the minimum detectable activity for Kr-85 in the SR 3.4.16.1 calculation. If a specific noble gas nuclide listed in the definition of DOSE EQUIVALENT XE-133 is not detected, it should be assumed to be present at the minimum detectable activity.
SR 3.4.16.2 This SR is performed to ensure iodine remains within limits during normal operation and following fast power changes when fuel failure is more likely to occur. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Frequency, between 2 and 10 hours after a power change  15% RTP within a 1 hour period, is established because the iodine levels peak during this time following fuel failure; samples at other times would provide inaccurate results.
R.E. Ginna Nuclear Power Plant              B 3.4.16-4                                  Revision 80
 
RCS Specific Activity B 3.4.16 REFERENCES                1. 10 CFR 50.67.
: 2. Design Analysis DA-NS-2001-084, Steam Generator Tube Rupture Offsite and Control Room Doses.
R.E. Ginna Nuclear Power Plant              B 3.4.16-5                          Revision 80
 
SG Tube Integrity B 3.4.17 B 3.4    REACTOR COOLANT SYSTEM (RCS)
B 3.4.17    Steam Generator (SG) Tube Integrity BASES BACKGROUND            Steam generator (SG) tubes are small diameter, thin walled tubes that carry primary coolant through the primary to secondary heat exchangers.
The SG tubes have a number of important safety functions. Steam generator tubes are an integral part of the reactor coolant pressure boundary (RCPB) and, as such, are relied on to maintain the primary system's pressure and inventory. The SG tubes isolate the radioactive fission products in the primary coolant from the secondary system. In addition, as part of the RCPB, the SG tubes are unique in that they act as the heat transfer surface between the primary and secondary systems to remove heat from the primary system. This Specification addresses only the RCPB integrity function of the SG. The SG heat removal function is addressed by LCO 3.4.4, "RCS Loops - MODES 1 > 8.5% RTP," LCO 3.4.5, "MODES 1  8.5% RTP, 2, and 3," LCO 3.4.6, "RCS Loops -
MODE 4," and LCO 3.4.7, "RCS Loops - MODE 5, Loops Filled."
SG tube integrity means that the tubes are capable of performing their intended RCPB safety function consistent with the licensing basis, including applicable regulatory requirements.
Steam generator tubing is subject to a variety of degradation mechanisms. Steam generator tubes may experience tube degradation related to corrosion phenomena, such as wastage, pitting, intergranular attack, and stress corrosion cracking, along with other mechanically induced phenomena such as denting and wear. These degradation mechanisms can impair tube integrity if they are not managed effectively.
The SG performance criteria are used to manage SG tube degradation.
Specification 5.5.8, "Steam Generator (SG) Program," requires that a program be established and implemented to ensure that SG tube integrity is maintained. Pursuant to Specification 5.5.8, tube integrity is maintained when the SG performance criteria are met. There are three SG performance criteria: structural integrity, accident induced leakage, and operational LEAKAGE. The SG performance criteria are described in Specification 5.5.8. Meeting the SG performance criteria provides reasonable assurance of maintaining tube integrity at normal and accident conditions.
The processes used to meet the SG performance criteria are defined by the Steam Generator Program Guidelines (Ref. 1).
R.E. Ginna Nuclear Power Plant                  B 3.4.17-1                                  Revision 46
 
SG Tube Integrity B 3.4.17 APPLICABLE            The steam generator tube rupture (SGTR) accident is the limiting SAFETY                design Specification. The analysis of a SGTR event assumes a ANALYSES              bounding primary to secondary LEAKAGE rate equal to the operational LEAKAGE rate limits in LCO 3.4.13, "RCS Operational LEAKAGE,"
plus the leakage rate associated with a double-ended rupture of a single tube. The accident analysis for a SGTR assumes the contaminated secondary fluid is released to the atmosphere via safety valves and the atmospheric relief valves.
The analysis for design basis accidents and transients other than a SGTR assume the SG tubes retain their structural integrity (i.e., they are assumed not to rupture.) In these analyses, the steam discharge to the atmosphere is based on primary to secondary LEAKAGE from each SG which is assumed to increase to 1 gpm (500 gallons per day for a locked rotor or rod ejection accident) as a result of accident induced conditions.
For accidents that do not involve fuel damage, the primary coolant activity level of DOSE EQUIVALENT I-131 is assumed to be equal to the LCO 3.4.16, "RCS Specific Activity," limits. For accidents that assume fuel damage, the primary coolant activity is a function of the amount of activity released from the damaged fuel. The dose consequences of these events are within the limits of GDC 19 (Ref. 2), 10 CFR 50.67 (Ref. 3) or the NRC approved licensing basis (e.g., a small fraction of these limits).
Steam generator tube integrity satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO                  The LCO requires that SG tube integrity be maintained. The LCO also requires that all SG tubes that satisfy the repair criteria be plugged in accordance with the Steam Generator Program.
During an SG inspection, any inspected tube that satisfies the Steam Generator Program repair criteria is removed from service by plugging. If a tube was determined to satisfy the repair criteria but was not plugged, the tube may still have tube integrity.
In the context of this Specification, a SG tube is defined as the entire length of the tube, including the tube wall, between the tube-to-tubesheet weld at the tube inlet and the tube-to-tubesheet weld at the tube outlet.
The tube-to-tubesheet weld is not considered part of the tube.
A SG tube has tube integrity when it satisfies the SG performance criteria. The SG performance criteria are defined in Specification 5.5.8, "Steam Generator (SG) Program," and describe acceptable SG tube performance. The Steam Generator Program also provides the R.E. Ginna Nuclear Power Plant                  B 3.4.17-2                                  Revision 46
 
SG Tube Integrity B 3.4.17 evaluation process for determining conformance with the SG performance criteria.
There are three SG performance criteria: structural integrity, accident induced leakage, and operational LEAKAGE. Failure to meet any one of these criteria is considered failure to meet the LCO.
The structural integrity performance criterion provides a margin of safety against tube burst or collapse under normal and accident conditions, and ensures structural integrity of the SG tubes under all anticipated transients included in the design specification. Tube burst is defined as, "The gross structural failure of the tube wall. The condition typically corresponds to an unstable opening displacement (e.g., opening area increased in response to constant pressure) accompanied by ductile (plastic) tearing of the tube material at the ends of the degradation."
Tube collapse is defined as, "For the load displacement curve for a given structure, collapse occurs at the top of the load versus displacement curve where the slope of the curve becomes zero." The structural integrity performance criterion provides guidance on assessing loads that have a significant effect on burst or collapse. In that context, the term "significant" is defined as "An accident loading condition other than differential pressure is considered significant when the addition of such loads in the assessment of the structural integrity performance criterion could cause a lower structural limit or limiting burst/collapse condition to be established." For tube integrity evaluations, except for circumferential degradation, axial thermal loads are classified as secondary loads. For circumferential degradation, the classification of axial thermal loads as primary or secondary loads will be evaluated on a case-by-case basis.
The division between primary and secondary classifications will be based on detailed analysis and/or testing.
Structural integrity requires that the primary membrane stress intensity in a tube not exceed the yield strength for all ASME Code, Section III, Service Level A (normal operating conditions) and Service Level B (upset or abnormal conditions) transients included in the design specification.
This includes safety factors and applicable design basis loads based on ASME Code, Section III, Subsection NB (Ref. 4) and Draft Regulatory Guide 1.121 (Ref. 5).
The accident induced leakage performance criterion ensures that the primary to secondary LEAKAGE caused by a design basis accident, other than a SGTR, is within the accident analysis assumptions. The accident analysis assumes that accident induced leakage does not exceed 1 gpm (500 gallons per day for a locked rotor or rod ejection accident) per SG. The accident induced leakage rate includes any primary to secondary LEAKAGE existing prior to the accident in addition to primary to secondary LEAKAGE induced during the accident.
R.E. Ginna Nuclear Power Plant                    B 3.4.17-3                                  Revision 46
 
SG Tube Integrity B 3.4.17 The operational LEAKAGE performance criterion provides an observable indication of SG tube conditions during plant operation. The limit on operational LEAKAGE is contained in LCO 3.4.13, "RCS Operational LEAKAGE," and limits primary to secondary LEAKAGE through any one SG to 150 gallons per day. This limit is based on the assumption that a single crack leaking this amount would not propagate to a SGTR under the stress conditions of a LOCA or a main steam line break. If this amount of LEAKAGE is due to more than one crack, the cracks are very small, and the above assumption is conservative.
APPLICABILITY        Steam generator tube integrity is challenged when the pressure differential across the tubes is large. Large differential pressures across SG tubes can only be experienced in MODE 1, 2, 3, or 4.
RCS conditions are far less challenging in MODES 5 and 6 than during MODES 1, 2, 3, and 4. In MODES 5 and 6, primary to secondary differential pressure is low, resulting in lower stresses and reduced potential for LEAKAGE.
ACTIONS              The ACTIONS are modified by a Note clarifying that the Conditions may be entered independently for each SG tube. This is acceptable because the Required Actions provide appropriate compensatory actions for each affected SG tube. Complying with the Required Actions may allow for continued operation, and subsequent affected SG tubes are governed by subsequent Condition entry and application of associated Required Actions.
A.1 and A.2 Condition A applies if it is discovered that one or more SG tubes examined in an inservice inspection satisfy the tube repair criteria but were not plugged in accordance with the Steam Generator Program as required by SR 3.4.17.2. An evaluation of SG tube integrity of the affected tube(s) must be made. Steam generator tube integrity is based on meeting the SG performance criteria described in the Steam Generator Program. The SG repair criteria define limits on SG tube degradation that allow for flaw growth between inspections while still providing assurance that the SG performance criteria will continue to be met. In order to determine if a SG tube that should have been plugged has tube integrity, an evaluation must be completed that demonstrates that the SG performance criteria will continue to be met until the next refueling outage or SG tube inspection. The tube integrity determination is based on the estimated condition of the tube at the time the situation is discovered and the estimated growth of the degradation prior to the next R.E. Ginna Nuclear Power Plant                  B 3.4.17-4                                  Revision 46
 
SG Tube Integrity B 3.4.17 SG tube inspection. If it is determined that tube integrity is not being maintained, Condition B applies.
A Completion Time of 7 days is sufficient to complete the evaluation while minimizing the risk of plant operation with a SG tube that may not have tube integrity.
If the evaluation determines that the affected tube(s) have tube integrity, Required Action A.2 allows plant operation to continue until the next refueling outage or SG inspection provided the inspection interval continues to be supported by an operational assessment that reflects the affected tubes. However, the affected tube(s) must be plugged prior to entering MODE 4 following the next refueling outage or SG inspection.
This Completion Time is acceptable since operation until the next inspection is supported by the operational assessment.
B.1 and B.2 If the Required Actions and associated Completion Times of Condition A are not met or if SG tube integrity is not being maintained, the reactor must be brought to MODE 3 within 6 hours and MODE 5 within 36 hours.
The allowed Completion Times are reasonable, based on operating experience, to reach the desired plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE          SR 3.4.17.1 REQUIREMENTS During shutdown periods the SGs are inspected as required by this SR and the Steam Generator Program. NEI 97-06, Steam Generator Program Guidelines (Ref. 1), and its referenced EPRI Guidelines, establish the content of the Steam Generator Program. Use of the Steam Generator Program ensures that the inspection is appropriate and consistent with accepted industry practices.
During SG inspections a condition monitoring assessment of the SG tubes is performed. The condition monitoring assessment determines the "as found" condition of the SG tubes. The purpose of the condition monitoring assessment is to ensure that the SG performance criteria have been met for the previous operating period.
The Steam Generator Program determines the scope of the inspection and the methods used to determine whether the tubes contain flaws satisfying the tube repair criteria. Inspection scope (i.e., which tubes or areas of tubing within the SG are to be inspected) is a function of existing and potential degradation locations. The Steam Generator Program also specifies the inspection methods to be used to find potential degradation.
R.E. Ginna Nuclear Power Plant                  B 3.4.17-5                                    Revision 46
 
SG Tube Integrity B 3.4.17 Inspection methods are a function of degradation morphology, non-destructive examination (NDE) technique capabilities, and inspection locations.
The Steam Generator Program defines the Frequency of SR 3.4.17.1.
The Frequency is determined by the operational assessment and other limits in the SG examination guidelines (Ref. 6). The Steam Generator Program uses information on existing degradations and growth rates to determine an inspection Frequency that provides reasonable assurance that the tubing will meet the SG performance criteria at the next scheduled inspection. In addition, Specification 5.5.8 contains prescriptive requirements concerning inspection intervals to provide added assurance that the SG performance criteria will be met between scheduled inspections.
SR 3.4.17.2 During an SG inspection, any inspected tube that satisfies the Steam Generator Program repair criteria is removed from service by plugging.
The tube repair criteria delineated in Specification 5.5.8 are intended to ensure that tubes accepted for continued service satisfy the SG performance criteria with allowance for error in the flaw size measurement and for future flaw growth. In addition, the tube repair criteria, in conjunction with other elements of the Steam Generator Program, ensure that the SG performance criteria will continue to be met until the next inspection of the subject tube(s). Reference 1 provides guidance for performing operational assessments to verify that the tubes remaining in service will continue to meet the SG performance criteria.
The Frequency of prior to entering MODE 4 following a SG inspection ensures that the Surveillance has been completed and all tubes meeting the repair criteria are plugged prior to subjecting the SG tubes to significant primary to secondary pressure differential.
R.E. Ginna Nuclear Power Plant                    B 3.4.17-6                                  Revision 46
 
SG Tube Integrity B 3.4.17 REFERENCES            1. NEI 97-06, "Steam Generator Program Guidelines."
: 2. CFR 50 Appendix A, GDC 19.
: 3. 10 CFR 50.67.
: 4. ASME Boiler and Pressure Vessel Code, Section III, Subsection NB.
: 5. Draft Regulatory Guide 1.121, "Basis for Plugging Degraded Steam Generator Tubes," August 1976.
: 6. EPRI, "Pressurized Water Reactor Steam Generator Examination Guidelines."
R.E. Ginna Nuclear Power Plant              B 3.4.17-7                              Revision 46
 
Accumulators B 3.5.1 B 3.5    EMERGENCY CORE COOLING SYSTEMS (ECCS)
B 3.5.1      Accumulators BASES BACKGROUND            The functions of the ECCS accumulators are to supply water to the reactor vessel during the blowdown phase of a large break loss of coolant accident (LOCA), to provide inventory to help accomplish the refill phase that follows thereafter, and to provide Reactor Coolant System (RCS) makeup for a small break LOCA.
The blowdown phase of a large break LOCA is the initial period of the transient during which the RCS departs from equilibrium conditions, and heat from fission product decay, hot internals, and the vessel continues to be transferred to the reactor coolant. The reactor coolant inventory is vacating the core during this phase through steam flashing and ejection out through the break. The blowdown phase of the transient ends when the RCS pressure falls to a value approaching that of the containment atmosphere.
In the refill phase of a LOCA, which immediately follows the blowdown phase, the core is essentially in adiabatic heatup. The balance of accumulator inventory is available to reflood the core and help fill voids in the lower plenum and reactor vessel downcomer so as to establish a recovery level at the bottom of the core.
The accumulators are pressure vessels partially filled with borated water and pressurized with nitrogen gas. The level transmitters for the accumulators measure the level over a 14" span for the corresponding 0-100% level indicated on the main control board. The accumulators are passive components, since no operator or control actions are required in order for them to perform their function. Internal accumulator tank pressure is sufficient to discharge the accumulator contents to the RCS, if RCS pressure decreases below the accumulator pressure.
Each accumulator is piped into an RCS cold leg via an accumulator line and is isolated from the RCS by a motor operated isolation valve and two check valves in series (see Figure B 3.5.2-1a). The motor operated isolation valves (841 and 865) are maintained open with AC power removed under administrative control when pressurizer pressure is
                      > 1600 psig. This feature ensures that the valves meet the single failure criterion of manually-controlled electrically operated valves per Branch Technical Position (BTP) ICSB-18 (Ref. 1). This is also discussed in References 2 and 3.
R.E. Ginna Nuclear Power Plant                B 3.5.1-1                                Revision 44
 
Accumulators B 3.5.1 The accumulator size, water volume, and nitrogen cover pressure are selected so that one of the two accumulators is sufficient to partially cover the core before significant clad melting or zirconium water reaction can occur following a LOCA. The need to ensure that one accumulator is adequate for this function is consistent with the LOCA assumption that the entire contents of one accumulator will be lost via the RCS pipe break during the blowdown phase of the LOCA.
APPLICABLE            The accumulators are assumed OPERABLE in both the large and small SAFETY                break LOCA analyses at full power (Ref. 4). These are the Design Basis ANALYSES              Accidents (DBAs) that establish the acceptance limits for the accumulators. Reference to the analyses for these DBAs is used to assess changes in the accumulators as they relate to the acceptance limits.
In performing the LOCA calculations, conservative assumptions are made concerning the availability of ECCS flow. In the early stages of a large break LOCA, with or without a loss of offsite power, the accumulators provide the sole source of makeup water to the RCS. The assumption of loss of offsite power is required by regulations and conservatively imposes a delay wherein the ECCS pumps cannot deliver flow until the emergency diesel generators start, come to rated speed, and go through their timed loading sequence. The large break LOCA also considers a case with offsite power available. In cold leg break scenarios, the entire contents of one accumulator are assumed to be lost through the break.
The largest break area considered for a large break LOCA is a double ended guillotine break at the discharge of the reactor coolant pump.
During this event, the accumulators discharge to the RCS as soon as RCS pressure decreases to below accumulator pressure. As a conservative estimate, no credit is taken for ECCS pump flow until an effective delay has elapsed. This delay accounts for SI signal generation, the diesels starting, and the pumps being loaded and delivering full flow.
During this time, the accumulators are analyzed as providing the sole source of emergency core cooling. No operator action is assumed during the blowdown stage of a large break LOCA.
The worst case small break LOCA analyses also assume a time delay before pumped flow reaches the core. For the larger range of small breaks, the rate of blowdown is such that the increase in fuel clad temperature is terminated solely by the accumulators, with pumped flow then providing continued cooling. As break size decreases, the accumulators and safety injection pumps both play a part in terminating the rise in clad temperature. As break size continues to decrease, the role of the accumulators continues to decrease until they are not required R.E. Ginna Nuclear Power Plant                B 3.5.1-2                                  Revision 44
 
Accumulators B 3.5.1 and the safety injection pumps become solely responsible for terminating the temperature increase.
This LCO helps to ensure that the following acceptance criteria established for the ECCS by 10 CFR 50.46 (Ref. 5) will be met following a LOCA:
: a. Maximum fuel element cladding temperature is  2200&#xba;F;
: b. Maximum cladding oxidation is  0.17 times the total cladding thickness before oxidation;
: c. Maximum hydrogen generation from a zirconium water reaction is 0.01 times the hypothetical amount that would be generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react; and
: d. Core is maintained in a coolable geometry.
Since the accumulators discharge during the blowdown phase of a LOCA, they do not contribute to the long term cooling requirements of 10 CFR 50.46.
For the small break LOCA analysis, a nominal contained accumulator water volume is used. The contained water volume is the same as the deliverable volume for the accumulators, since the accumulators are emptied, once discharged. For small breaks, an increase in water volume is a peak clad temperature penalty due to the reduced gas volume. A peak clad temperature penalty is an assumed increase in the calculated peak clad temperature due to a change in an input parameter.
For large breaks, an increase in water volume can be either a peak clad temperature penalty or benefit, depending on downcomer filling and subsequent spill through the break during the core reflooding portion of the transient. The large break analysis uses a range of accumulator water volumes consistent with the approved methodology. The large break LOCA analysis also considers the line water volume, however, this volume is not ranged.
The minimum boron concentration limit is used in the post LOCA sump boron concentration calculation. The calculation is performed to assure reactor subcriticality in a post LOCA environment. Of particular interest is the large break LOCA, since no credit is taken for control rod assembly insertion. A reduction in the accumulator minimum boron concentration would produce a subsequent reduction in the available containment sump concentration for post LOCA shutdown and an increase in the maximum sump pH. The maximum boron concentration is used in determining the time frame in which boron precipitation is addressed post LOCA. The maximum boron concentration limit is based on the coldest expected temperature of the accumulator water volume and on chemical R.E. Ginna Nuclear Power Plant                B 3.5.1-3                                Revision 44
 
Accumulators B 3.5.1 effects resulting from operation of the ECCS and the Containment Spray (CS) System. The maximum value of 3050 ppm would not create the potential for boron precipitation in the accumulator assuming a containment temperature of 60&#xba;F (Ref. 6). Analyses performed to address 10 CFR 50.49 (Ref. 7) assumed a chemical spray solution resulting from 2550-3050 ppm boron concentration in the accumulator and 2750-3050 ppm boron concentration in the RWST (Ref. 6). The chemical spray solution impacts sump pH and the resulting effect of chloride and caustic stress corrosion on mechanical systems and components. The sump pH also affects the rate of hydrogen generation within containment due to the interaction of CS and sump fluid with aluminum components.
The small break LOCA analysis is performed at the minimum nitrogen cover pressure, since sensitivity analyses have demonstrated that higher nitrogen cover pressure results in a computed peak clad temperature benefit. The large break LOCA analysis considers a range of accumulator nitrogen cover pressures consistent with the approved methodology. The maximum nitrogen cover pressure limit prevents accumulator relief valve actuation at 800 psig, and ultimately preserves accumulator integrity.
The effects on containment mass and energy releases from the accumulators are accounted for in the appropriate analyses (Refs. 8 and 9).
The accumulators satisfy Criterion 3 of the NRC Policy Statement.
LCO                  The LCO establishes the minimum conditions required to ensure that the accumulators are available to accomplish their core cooling safety function following a LOCA. Two accumulators are required to ensure that 100% of the contents of one accumulator will reach the core during a LOCA. This is consistent with the assumption that the contents of one accumulator spill through the break. If less than one accumulator is injected during the blowdown phase of a LOCA, the ECCS acceptance criteria of 10 CFR 50.46 (Ref. 5) could be violated.
For an accumulator to be considered OPERABLE, the motor-operated isolation valve must be fully open (see Figure B 3.5.2-1a), power removed above 1600 psig, and the limits established in the SRs for contained volume, boron concentration, and nitrogen cover pressure must be met.
R.E. Ginna Nuclear Power Plant              B 3.5.1-4                                  Revision 44
 
Accumulators B 3.5.1 APPLICABILITY        In MODES 1 and 2, and in MODE 3 with RCS pressure > 1600 psig, the accumulator OPERABILITY requirements are based on full power operation. Although cooling requirements decrease as power decreases, the accumulators are still required to provide core cooling as long as elevated RCS pressures and temperatures exist.
This LCO is only applicable at pressures > 1600 psig. At pressures 1600 psig, the rate of RCS blowdown is such that the ECCS pumps can provide adequate injection to ensure that peak clad temperature remains below the 10 CFR 50.46 (Ref. 5) limit of 2200&#xba;F.
In MODE 3, with RCS pressure  1600 psig, and in MODES 4, 5, and 6, the accumulator motor operated isolation valves are closed to isolate the accumulators from the RCS. This allows RCS cooldown and depressurization without discharging the accumulators into the RCS or requiring depressurization of the accumulators.
ACTIONS              A.1 If the boron concentration of one accumulator is not within limits, it must be returned to within the limits within 72 hours. In this Condition, the ability to maintain subcriticality or minimum boron precipitation time may be reduced. The boron in the accumulators contributes to the assumption that the combined ECCS water in the partially recovered core during the early reflooding phase of a large break LOCA is sufficient to keep that portion of the core subcritical. One accumulator below the minimum boron concentration limit, however, will have no effect on available ECCS water and an insignificant effect on core subcriticality during reflood since the accumulator water volume is very small when compared to RCS and RWST inventory. Boiling of ECCS water in the core during reflood concentrates boron in the saturated liquid that remains in the core. In addition, current analysis techniques demonstrate that the accumulators are not expected to discharge following a large steam line break. Even if they do discharge, their impact is minor and not a design limiting event. Thus, 72 hours is allowed to return the boron concentration to within limits.
B.1 If one accumulator is inoperable for a reason other than boron concentration, the accumulator must be returned to OPERABLE status within 24 hours. In this Condition, the required contents of one accumulator cannot be assumed to reach the core during a LOCA. Due to the severity of the consequences should a LOCA occur in these conditions, the 24 hour Completion Time to open the valve, remove R.E. Ginna Nuclear Power Plant                B 3.5.1-5                                  Revision 44
 
Accumulators B 3.5.1 power to the valve, or restore the proper water volume or nitrogen cover pressure ensures that prompt action will be taken to return the inoperable accumulator to OPERABLE status. The Completion Time minimizes the potential for exposure of the plant to a LOCA under these conditions.
The 24 hours allowed to restore an inoperable accumulator to OPERABLE status is justified in WCAP-15049-A, Rev. 1 (Ref. 10).
C.1 and C.2 If the accumulator cannot be returned to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours and pressurizer pressure reduced to 1600 psig within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
D.1 If both accumulators are inoperable, the plant is in a condition outside the accident analyses; therefore, LCO 3.0.3 must be entered immediately.
SURVEILLANCE        SR 3.5.1.1 REQUIREMENTS Each accumulator motor-operated isolation valve shall be verified to be fully open. Use of control board indication for valve position is an acceptable verification. This verification ensures that the accumulators are available for injection and ensures timely discovery if a valve should be less than fully open. If an isolation valve is not fully open, the rate of injection to the RCS would be reduced. Although a motor operated valve position should not change with power removed, a closed valve could result in not meeting accident analyses assumptions. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
R.E. Ginna Nuclear Power Plant                B 3.5.1-6                                  Revision 77
 
Accumulators B 3.5.1 SR 3.5.1.2 The borated water volume and nitrogen cover pressure shall be verified for each accumulator. The level transmitters for the accumulators measure the level over a 14" span for the corresponding 0-100% level indicated on the main control board. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.5.1.3 See SR 3.5.1.2 SR 3.5.1.4 The boron concentration shall be verified to be within required limits for each accumulator. This is accomplished by monitoring the level in each accumulator and comparing to the previous level readings. An unexplained increase in level could be an indication of inleakage and, therefore, dilution of the boron concentration. If an unexplained increase in level is detected, the ongoing change in boron concentration shall be determined by calculation. If the calculation indicates that the boron concentration had decreased to within 100 ppm of the lower limit, the affected accumulator shall be sampled to confirm boron concentration. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.5.1.5 Verification that power is removed from each accumulator isolation valve operator when the pressurizer pressure is > 1600 psig ensures that an active failure could not result in the undetected closure of an accumulator motor operated isolation valve. If this were to occur, no accumulators would be available for injection if the LOCA were to occur in the cold leg containing the only OPERABLE accumulator. The Surveillance Frequency is controlled under the Surveillance Frequency Program.
R.E. Ginna Nuclear Power Plant                    B 3.5.1-7                                  Revision 77
 
Accumulators B 3.
 
==5.1 REFERENCES==
: 1. Branch Technical Position (BTP) ICSB-18 "Application of the Single Failure Criterion to Manually-Controlled Electrically Operated Valves."
: 2. Letter from D. M. Crutchfield, NRC, to J. E. Maier, RG&E,
 
==Subject:==
 
                            "SEP Topics VI-7.F, VII-3, VII-6, and VIII-2," dated June 24, 1981.
: 3. Letter from R. A. Purple, NRC, to L. D. White, RG&E,
 
==Subject:==
 
                            "Issuance of Amendment 7 to Provisional Operating License No.
DPR-18," dated May 14, 1975.
: 4. UFSAR, Section 6.3.
: 5. 10 CFR 50.46.
: 6. UFSAR, Section 3.11.
: 7. 10 CFR 50.49.
: 8. UFSAR, Section 6.2.
: 9. UFSAR, Section 15.6.
: 10. WCAP-15049-A, Rev. 1, April 1999 R.E. Ginna Nuclear Power Plant              B 3.5.1-8                                  Revision 44
 
ECCS - MODES 1, 2, and 3 B 3.5.2 B 3.5    EMERGENCY CORE COOLING SYSTEMS (ECCS)
B 3.5.2      ECCS-MODES 1, 2, and 3 BASES BACKGROUND            The function of the ECCS is to provide core cooling and negative reactivity to ensure that the reactor core is protected after any of the following accidents:
: a. Loss of coolant accident (LOCA) and coolant leakage greater than the capability of the normal charging system;
: b. Rod ejection accident;
: c. Loss of secondary coolant accident, including uncontrolled steam release or loss of feedwater; and
: d. Steam generator tube rupture (SGTR).
The addition of negative reactivity is designed primarily for the loss of secondary coolant accident where primary cooldown could add enough positive reactivity to achieve criticality and return to significant power.
There are two phases of ECCS operation: injection and recirculation. In the injection phase, water is taken from the refueling water storage tank (RWST) and injected into the Reactor Coolant System (RCS) through the cold legs and reactor vessel upper plenum. When sufficient water is removed from the RWST to ensure that enough boron has been added to maintain the reactor subcritical and the containment sump has enough water to supply the required net positive suction head to the ECCS pumps, suction is switched to Containment Sump B for recirculation.
Within approximately 5.5 hours from initiation of sump recirculation, simultaneous ECCS injection is used to reduce the potential for boiling in the top of the core and any resulting boron precipitation.
The ECCS consists of two separate subsystems: safety injection (SI) and residual heat removal (RHR) (see Figure B 3.5.2-1A). Each subsystem consists of two redundant, 100% capacity trains. The ECCS accumulators and the RWST are also part of the ECCS, but are not considered part of an ECCS flow path as described by this LCO.
R.E. Ginna Nuclear Power Plant                B 3.5.2-1                                      Revision 76
 
ECCS - MODES 1, 2, and 3 B 3.5.2 The ECCS flow paths which comprise the redundant trains consist of piping, valves, heat exchangers, and pumps such that water from the RWST can be injected into the RCS following the accidents described in this LCO. The major components of each subsystem are the RHR pumps, heat exchangers, and the SI pumps. The RHR subsystem consists of two 100% capacity trains that are interconnected and redundant such that either train is capable of supplying 100% of the flow required to mitigate the accident consequences. The SI subsystem consists of three redundant, 50% capacity pumps which supply two RCS cold leg injection lines. Each injection line is capable of providing 100%
of the flow required to mitigate the consequences of an accident. These interconnecting and redundant subsystem designs provide the operators with the ability to utilize components from opposite trains to achieve the required 100% flow to the core.
Containment Sump B collects liquid discharged into the containment following a LOCA and then provides the source of water for long-term recirculation. The sump has been designed to protect against the entrance of debris through the use of concrete curbing, solid steel plating covering the sump, and steel debris strainers (screens) connected to the sump . The sump strainers serve as a means of allowing any postulated LOCA water into the sump. The strainers are credited as having the capability to exclude the detrimental debris from the RHR pump suction.
The sump cover plate prevents debris from bypassing the sump strainers to enter the sump, and provides a personnel egress route over the sump.
During the injection phase of LOCA recovery, suction headers supply water from the RWST to the ECCS pumps. A common supply header is used from the RWST to the safety injection (SI) and containment spray (CS) System pumps. This common supply header is provided with two in-series motor-operated isolation valves (896A and 896B) that receive power from separate sources for single failure considerations. These isolation valves are maintained open with DC control power removed via a key switch located in the control room. The removal of DC control power eliminates the most likely causes for spurious valve actuation while maintaining the capability to manually close the valves from the control room during the recirculation phase of the accident (Ref. 1). The SI pump supply header also contains two parallel motor-operated isolation valves (825A and 825B) which are maintained open by removing AC power. The removal of AC power to these isolation valves is an acceptable design against single failures that could result in undesirable component actuation (Ref. 2).
R.E. Ginna Nuclear Power Plant                B 3.5.2-2                                  Revision 76
 
ECCS - MODES 1, 2, and 3 B 3.5.2 A separate supply header is used for the residual heat removal (RHR) pumps. This supply header is provided with a check valve (854) and motor operated isolation valve (856) which is maintained open with DC control power removed via a key switch located in the control room. The removal of DC control power eliminates the most likely causes for spurious valve actuation while maintaining the capability to manually close the valve from the control room during the recirculation phase of the accident (Ref. 3).
The three SI pumps feed two RCS cold leg injection lines. SI Pumps A and B each feeds one of the two injection lines while SI Pump C can feed both injection lines. The discharge of SI Pump C is controlled through use of two normally open parallel motor operated isolation valves (871A and 871B). These isolation valves are designed to close based on the operating status of SI Pumps A and B to ensure that SI Pump C provides the necessary flow through the RCS cold leg injection line containing the failed pump.
The discharges of the two RHR pumps and heat exchangers feed a common injection line which penetrates containment. This line then divides into two redundant core deluge flow paths each containing a normally closed motor operated isolation valve (852A and 852B) and check valve (853A and 853B) which provide injection into the reactor vessel upper plenum. Each motor operated isolation valve (852A and 852B) also has a key switch located in the control room, which is maintained in the "off" position. This key switch removes DC control power to the closing circuit to reduce the possibility of a spurious closure of the valves, due to a single short or inadvertent operator misposition, after they have opened.
For LOCAs that are too small to depressurize the RCS below the shutoff head of the SI pumps, the steam generators provide core cooling until the RCS pressure decreases below the SI pump shutoff head.
During the recirculation phase of LOCA recovery, RHR pump suction is manually transferred to Containment Sump B (Refs. 4 and 5). This transfer is accomplished by stopping the RHR pumps, isolating RHR from the RWST by closing motor operated isolation valve 856, opening the Containment Sump B motor operated isolation valves to RHR (850A and 850B) and then starting the RHR pumps. If motor operated isolation valve 856 fails to close, check valve 854 provides necessary isolation of the RWST. The SI and CS pumps are then stopped and the RWST isolated by closing motor operated isolation valve 896A and 896B for the SI and CS pump common supply header and closing motor operated isolation valve 897 or 898 for the SI pumps recirculation line.
R.E. Ginna Nuclear Power Plant              B 3.5.2-3                                  Revision 76
 
ECCS - MODES 1, 2, and 3 B 3.5.2 The RHR pumps then supply the SI pumps if the RCS pressure remains above the RHR pump shutoff head as correlated through core exit temperature, containment pressure, and reactor vessel level indications (Ref. 6). The RHR pumps can also provide suction to the CS pumps for containment pressure control. This high-head recirculation path is provided through RHR motor operated isolation valves 857A, 857B, and 857C. These isolation valves are interlocked with valves 896A, 896B, 897, and 898. This interlock prevents opening of the RHR high-head recirculation isolation valves unless either 896A or 896B are closed and either 897 or 898 are closed. If RCS pressure is such that RHR provides adequate core and containment cooling, the SI and CS pumps remain in pull-stop. During recirculation, flow is discharged through the same paths as the injection phase. Within approximately 5.5 hours from initiation of sump recirculation, simultaneous injection by the SI and RHR pumps is used to prevent boron precipitation. This consists of providing SI through the RCS cold legs and into the lower plenum while providing RHR through the core deluge valves into the upper plenum.
The two redundant flow paths from Containment Sump B to the RHR pumps also contain a motor operated isolation valve located within the sump (851A and 851B). These isolation valves are maintained open with power removed to improve the reliability of switchover to the recirculation phase. The operators for isolation valves 851A and 851B are also not qualified for containment post accident conditions. The removal of AC power to these isolation valves is an acceptable design against single failures that could result in an undesirable actuation (Ref. 2).
The SI subsystem of the ECCS also functions to supply borated water to the reactor core following increased heat removal events, such as a steam line break (SLB). The limiting design conditions occur when the negative moderator temperature coefficient is highly negative, such as at the end of each cycle.
During low temperature conditions in the RCS, limitations are placed on the maximum number of ECCS pumps that may be OPERABLE. Refer to the Bases for LCO 3.4.12, "Low Temperature Overpressure Protection (LTOP) System," for the basis of these requirements.
R.E. Ginna Nuclear Power Plant              B 3.5.2-4                                  Revision 76
 
ECCS - MODES 1, 2, and 3 B 3.5.2 The ECCS subsystems are actuated upon receipt of an SI signal. The actuation of safeguard loads is accomplished in a programmed time sequence. If offsite power is available, the safeguard loads start immediately in the programmed sequence. If offsite power is not available, the Engineered Safety Feature (ESF) buses shed normal operating loads and are connected to the emergency diesel generators (EDGs). Safeguard loads are then actuated in the programmed time sequence. The time delay associated with diesel starting, sequenced loading, and pump starting determines the time required before pumped flow is available to the core following a LOCA.
The active ECCS components, along with the passive accumulators and the RWST covered in LCO 3.5.1, "Accumulators," and LCO 3.5.4, "Refueling Water Storage Tank (RWST)," provide the cooling water necessary to meet AIF-GDC 44 (Ref. 8).
APPLICABLE            The LCO helps to ensure that the following acceptance criteria for the SAFETY                ECCS, established by 10 CFR 50.46 (Ref. 9), will be met following a ANALYSES              LOCA:
: a. Maximum fuel element cladding temperature is  2200&#xba;F;
: b. Maximum cladding oxidation is  0.17 times the total cladding thickness before oxidation;
: c. Maximum hydrogen generation from a zirconium water reaction is 0.01 times the hypothetical amount generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react;
: d. Core is maintained in a coolable geometry; and
: e. Adequate long term core cooling capability is maintained.
The LCO also limits the potential for a post trip return to power following an SLB event and helps ensure that containment temperature limits are met post accident.
R.E. Ginna Nuclear Power Plant              B 3.5.2-5                                Revision 76
 
ECCS - MODES 1, 2, and 3 B 3.5.2 Both ECCS subsystems are taken credit for in a large break LOCA event at full power (Refs. 6 and 10). This event establishes the requirement for runout flow for the ECCS pumps, as well as the maximum response time for their actuation. The SI pumps are credited in a small break LOCA event. This event establishes the flow and discharge head at the design point for the pumps. The SGTR and SLB events also credit the SI pumps. The OPERABILITY requirements for the ECCS are based on the following LOCA analysis assumptions:
: a.      A large break LOCA event, with limiting offsite power assumptions and a single failure disabling one ECCS train (both EDG trains are assumed to operate for heat removal and spray systems in containment backpressure calculation); and
: b.      A small break LOCA event, with a loss of offsite power and a single failure disabling one ECCS train.
During the blowdown stage of a LOCA, the RCS depressurizes as primary coolant is ejected through the break into the containment. The nuclear reaction is terminated either by moderator voiding during large breaks or control rod insertion for small breaks. Following depressurization, emergency cooling water is injected by the SI pumps into the cold legs, flows into the downcomer, fills the lower plenum, and refloods the core. The RHR pumps inject directly into the core barrel by upper plenum injection.
The effects on containment mass and energy releases are accounted for in appropriate analyses (Refs. 10 and 11). The LCO ensures that an ECCS train will deliver sufficient water to match boiloff rates quickly enough to minimize the consequences of the core being uncovered following a large LOCA. It also ensures that the SI pumps will deliver sufficient water and boron during a small LOCA to maintain core subcriticality. For smaller LOCAs, the SI pumps deliver sufficient fluid to maintain RCS inventory. For a small break LOCA, the steam generators continue to serve as the heat sink, providing part of the required core cooling.
The ECCS trains satisfy Criterion 3 of the NRC Policy Statement.
R.E. Ginna Nuclear Power Plant                B 3.5.2-6                                Revision 76
 
ECCS - MODES 1, 2, and 3 B 3.5.2 LCO                  In MODES 1, 2, and 3, two independent (and redundant) ECCS trains are required to ensure that sufficient ECCS flow is available, assuming a single failure affecting either train. Additionally, individual components within the ECCS trains may be called upon to mitigate the consequences of other transients and accidents.
In MODES 1, 2, and 3, an ECCS train consists of an SI subsystem and an RHR subsystem (see Figure B 3.5.2-1A). Each train includes the piping, instruments, and controls to ensure an OPERABLE flow path capable of taking suction from the RWST upon an SI signal and transferring suction to Containment Sump B. This includes securing the motor operated isolation valves as specified in SR 3.5.2.1 in position by removing the power sources as listed below.
EIN                Position            Secured in Position By 825A                Open                Removal of AC Power 825B                Open                Removal of AC Power 826A                Closed              Removal of AC Power 826B                Closed              Removal of AC Power 826C                Closed              Removal of AC Power 826D                Closed              Removal of AC Power 851A                Open                Removal of AC Power 851B                Open                Removal of AC Power 856                Open                Removal of DC Control Power 878A                Closed              Removal of AC Power 878B                Open                Removal of AC Power 878C                Closed              Removal of AC Power 878D                Open                Removal of AC Power 896A                Open                Removal of DC Control Power 896B                Open                Removal of DC Control Power R.E. Ginna Nuclear Power Plant                B 3.5.2-7                                    Revision 76
 
ECCS - MODES 1, 2, and 3 B 3.5.2 The major components of an ECCS train consists of an RHR pump and heat exchanger taking suction from the RWST (and eventually Containment Sump B), and capable of injecting through one of the two isolation valves to the reactor vessel upper plenum and one of the two lines which provide high-head recirculation to the SI and CS pumps.
OPERABILITY of the RHR pumps includes their minimum recirculation lines.
Also included within the ECCS train are two of three SI pumps capable of taking suction from the RWST and Containment Sump B (via RHR), and injecting through one of the two RCS cold leg injection lines.
OPERABILITY of the SI pumps includes their minimum recirculation lines back to the RWST. These lines must remain open during the injection phase of a small break LOCA to prevent the SI pumps from deadheading.
MOVs 897 and 898 must also be capable of closing during the recirculation phase of an accident to prevent the addition of containment sump fluid to the RWST. In addition, both SI Pump C breakers (to Bus 14 and Bus 16) must be OPERABLE.
The flow path for each train must maintain its designed independence to ensure that no single failure can disable both ECCS trains. Due to the complex configuration of the two ECCS subsystems, Table B 3.5.2-1 provides a matrix of which ECCS train(s) are inoperable for major system component inoperabilities. In addition to the table, the following clarifications are provided. In the case where SI Pump C is inoperable, both RCS cold leg injection lines must be OPERABLE to provide 100% of the ECCS flow equivalent to a single train of SI due to the location of check valves 870A and 870B. If either SI Pump C breaker is inoperable, declare the associated ECCS train inoperable (e.g., if breaker to Bus 14 is inoperable, declare ECCS Train A inoperable.)
Since the Containment Sump B provides the source of water for long-term recirculation to both trains of ECCS, the physical integrity of the sump must be maintained. This includes the steel plating covering the sump and the sump strainers. Entering Sump B has the potential to allow debris to enter the sump following a LOCA and therefore both trains of ECCS must be declared inoperable if the sump is opened in MODES 1, 2, and 3.
Management of gas voids is important to ECCS OPERABILITY.
R.E. Ginna Nuclear Power Plant              B 3.5.2-8                                  Revision 76
 
ECCS - MODES 1, 2, and 3 B 3.5.2 APPLICABILITY        In MODES 1, 2, and 3, the ECCS OPERABILITY requirements for the limiting Design Basis Accident, a large break LOCA, are based on full power operation. Although reduced power would not require the same level of performance, the accident analysis does not provide for reduced cooling requirements in the lower MODES. The SI pump performance requirements are based on a small break LOCA. MODE 2 and MODE 3 requirements are bounded by the MODE 1 analysis.
In MODE 4, the ECCS requirements are as described in LCO 3.5.3, "ECCS-MODE 4."
In MODES 5 and 6, plant conditions are such that the probability of an event requiring ECCS injection is extremely low. Core cooling requirements in MODE 5 are addressed by LCO 3.4.7, "RCS Loops -
MODE 5, Loops Filled," and LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled." MODE 6 core cooling requirements are addressed by LCO 3.9.4, "Residual Heat Removal (RHR) and Coolant Circulation-Water Level  23 Ft," and LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation-Water Level < 23 Ft."
As indicated in Note 1, a SI flow path to the RCS may be isolated for up to 2 hours in MODE 3, under controlled conditions, to perform pressure isolation valve testing per SR 3.4.14.1. The flow path is readily restorable from the control room or by field test personnel. An SI flowpath is considered to be the cold and hot leg injection lines to one RCS loop such that only one of the two SI trains can be removed from service at one time. The note also allows an SI isolation MOV to be powered for up to 12 hours for the performance of this testing.
As indicated in Note 2, operation in MODE 3 with ECCS trains declared inoperable pursuant to LCO 3.4.12, "Low Temperature Overpressure Protection (LTOP) System," may be necessary since the LTOP arming temperature is near the MODE 3 boundary temperature of 350&#xba;F. LCO 3.4.12 requires that certain pumps be rendered inoperable at and below the LTOP arming temperature. When this temperature is near the MODE 3 boundary temperature, time is needed to restore the inoperable pumps to OPERABLE status.
R.E. Ginna Nuclear Power Plant              B 3.5.2-9                                  Revision 76
 
ECCS - MODES 1, 2, and 3 B 3.5.2 In MODES 4, 5 and 6, plant conditions are such that the probability of an event requiring ECCS injection is extremely low. Mode 4 core cooling requirements are addressed by LCO 3.4.6, "RCS Loops - MODE 4," and LCO 3.5.3, "ECCS - MODE 4." Core cooling requirements in MODE 5 are addressed by LCO 3.4.7, "RCS Loops - MODE 5, Loops Filled," and LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled." MODE 6 core cooling requirements are addressed by LCO 3.9.4, "Residual Heat Removal (RHR) and Coolant Circulation-Water Level  23 Ft," and LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation-Water Level < 23 Ft."
ACTIONS              A.1 With one train inoperable and at least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train available, the inoperable components must be returned to OPERABLE status within 72 hours. The 72 hour Completion Time is based on an NRC reliability evaluation (Ref. 12) and is a reasonable time for repair of many ECCS components.
An ECCS train is inoperable if it is not capable of delivering 100% design flow to the RCS. Individual components are inoperable if they are not capable of performing their design function.
The LCO requires the OPERABILITY of a number of independent subsystems. Due to the redundancy of trains and the diversity of subsystems, the inoperability of one active component in a train does not render the ECCS incapable of performing its function. Neither does the inoperability of two different components, each in a different train, necessarily result in a loss of function for the ECCS. The intent of this Condition is to maintain a combination of equipment such that 100% of the ECCS flow equivalent to a single OPERABLE ECCS train remains available. This allows increased flexibility in plant operations under circumstances when components in opposite trains are inoperable.
In the case where SI Pump C is inoperable, both RCS cold leg injection lines must be OPERABLE to provide 100% of the ECCS flow equivalent to a single train of SI due to the location of check valves 870A and 870B.
An event accompanied by a loss of offsite power and the failure of an EDG can disable one ECCS train until power is restored. A reliability analysis (Ref. 2) has shown that the impact of having one full ECCS train inoperable is sufficiently small to justify continued operation for 72 hours.
R.E. Ginna Nuclear Power Plant              B 3.5.2-10                                  Revision 76
 
ECCS - MODES 1, 2, and 3 B 3.5.2 B.1 and B.2 If the inoperable train cannot be returned to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours and MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
C.1 If both trains of ECCS are inoperable, the plant is in a condition outside the accident analyses; therefore, LCO 3.0.3 must be immediately entered. With one or more component(s) inoperable such that 100% of the flow equivalent to a single OPERABLE ECCS train is not available, the facility is in a condition outside the accident analysis. Therefore, LCO 3.0.3 must be immediately entered.
SURVEILLANCE          SR 3.5.2.1 REQUIREMENTS Verification of proper valve position ensures that the flow path from the ECCS pumps to the RCS is maintained. Use of control board indication for valve position is an acceptable verification. Misalignment of these valves could render both ECCS trains inoperable. The listed valves are secured in position by removal of AC power or key locking the DC control power. These valves are operated under administrative controls such that any changes with respect to the position of the valve breakers or key locks is unlikely. The verification of the valve breakers and key locks is performed by SR 3.5.2.3. Mispositioning of these valves can disable the function of both ECCS trains and invalidate the accident analyses. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.5.2.2 Verifying the correct alignment for manual, power operated, and automatic valves in the ECCS flow paths provides assurance that the proper flow paths will exist for ECCS operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an actuation signal is allowed to be in a nonaccident position provided the valve will automatically reposition within the proper stroke time. This Surveillance does not require any testing or valve manipulation. Rather, it involves verification that those valves capable of being mispositioned are in the correct position. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
R.E. Ginna Nuclear Power Plant                B 3.5.2-11                                  Revision 77
 
ECCS - MODES 1, 2, and 3 B 3.5.2 The Surveillance is modified by a Note which exempts system vent flow paths opened under administrative control. The administrative control should be proceduralized and include stationing a dedicated individual at the system vent flow path who is in continuous communication with the operators in the control room. This individual will have a method to rapidly close the system vent flow path if directed.
SR 3.5.2.3 Verification that AC or DC power is removed, as appropriate, for each valve specified in SR 3.5.2.1 ensures that an active failure could not result in an undetected misposition of a valve which affects both trains of ECCS. If this were to occur, no ECCS injection or recirculation would be available. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.5.2.4 Periodic surveillance testing of ECCS pumps to detect gross degradation caused by impeller structural damage or other hydraulic component problems is required by the ASME Code. This type of testing may be accomplished by measuring the pump developed head at a single point of the pump characteristic curve. This verifies both that the measured performance is within an acceptable tolerance of the original pump baseline performance and that the performance at the test flow is greater than or equal to the performance assumed in the plant safety analysis.
SRs are specified in the INSERVICE TESTING PROGRAM, which encompasses the ASME Code. The ASME Code provides the activities and Frequencies necessary to satisfy the requirements.
SR 3.5.2.5 These Surveillances demonstrate that each automatic ECCS valve actuates to the required position on an actual or simulated SI signal and that each ECCS pump starts on receipt of an actual or simulated SI signal. This surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
R.E. Ginna Nuclear Power Plant                      B 3.5.2-12                            Revision 81
 
ECCS - MODES 1, 2, and 3 B 3.5.2 SR 3.5.2.6 See SR 3.5.2.5 SR 3.5.2.7 Periodic inspections of the containment sump suction inlet to the RHR System ensure that it is unrestricted and stays in proper operating condition. The Surveillance Frequency is controlled under the Surveillance Frequency Program.
SR 3.5.2.8 ECCS piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the ECCS and may also prevent water hammer, pump cavitation, and pumping of noncondensible gas into the reactor vessel.
Selection of ECCS locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.
The ECCS is OPERABLE when it is sufficiently filled with water.
Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criteria for gas volume at the suction or discharge of a pump),
the Surveillance is not met. If it is determined by subsequent evaluation that the ECCS is not rendered inoperable by the accumulated gas (i.e.,
the system is sufficiently filled with water), the Surveillance may be declared met. Accumulated gas should be eliminated or brought within the acceptance criteria limits.
ECCS locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative sub-set of susceptible locations. Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety.
R.E. Ginna Nuclear Power Plant                B 3.5.2-13                                  Revision 77
 
ECCS - MODES 1, 2, and 3 B 3.5.2 For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location.
Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation.
REFERENCES            1. Letter from R. A. Purple, NRC, to L. D. White, RG&E,
 
==Subject:==
 
                                  "Issuance of Amendment 7 to Provisional Operating License No.
DPR-18," dated May 14, 1975.
: 2. Branch Technical Position (BTP) ICSB-18, "Application of the Single Failure Criterion to Manually-Controlled Electrically Operated Valves."
: 3. Letter from A. R. Johnson, NRC, to R. C. Mecredy, RG&E,
 
==Subject:==
 
                                  "Issuance of Amendment No. 42 to Facility Operating License No.
DPR-18, R. E. Ginna Nuclear Power Plant (TAC No. 79829)," dated June 3, 1991.
: 4. Letter from D. M. Crutchfield, NRC, to J. E. Maier, RG&E,
 
==Subject:==
 
                                  "SEP Topic VI-7.B: ESF Switchover from Injection to Recirculation Mode, Automatic ECCS Realignment, Ginna," dated December 31, 1981.
: 5. NUREG-0821.
: 6. UFSAR, Section 6.3.
: 7. Not Used
: 8. Atomic Industrial Forum (AIF) GDC 44, Issued for comment July 10, 1967.
: 9. 10 CFR 50.46.
: 10. UFSAR, Section 15.6.
: 11. UFSAR, Section 6.2.
: 12. NRC Memorandum to V. Stello, Jr., from R.L. Baer, Recommended Interim Revisions to LCOs for ECCS Components," December 1, 1975.
R.E. Ginna Nuclear Power Plant                  B 3.5.2-14                                  Revision 77
 
ECCS - MODES 1, 2, and 3 B 3.5.2 Table B 3.5.2-1 EMERGENCY CORE COOLING SYSTEM INOPERABILITY MATRIX, Page 1 of 2 RHR RHR      HX A  HX B  852A  852B    857A  857B      SI      SI      SI    896A  878B    878D Pump Pump                                    or          Pump    Pump    Pump      or A    B                                  857C            A      B        C    896B RHR A    A  ------ ------ ------ ------ ------  ------ ------  ------  ------  ------  ------ ------  ------
RHR B    All    B    ------ ------ ------ ------  ------ ------  ------  ------  ------  ------ ------  ------
HX A    A  All-1    A    ------ ------ ------  ------ ------  ------  ------  ------  ------ ------  ------
HX B  All-1  B    All    B    ------ ------  ------ ------  ------  ------  ------  ------ ------  ------
852A    A    AB      A    AB      A    ------  ------ ------  ------  ------  ------  ------ ------  ------
852B    AB    B    AB      B    All    B      ------ ------  ------  ------  ------  ------ ------  ------
857A    A  All-1    A    All    A    AB        A    ------  ------  ------  ------  ------ ------  ------
or 857C 857B  All-1  B    All    B    AB      B      All    B    ------  ------  ------  ------ ------  ------
SI A    A    AB      A    AB      A    AB        A    AB      A    ------  ------  ------ ------  ------
SI B    AB    B    AB      B    AB      B      AB      B      All      B      ------  ------ ------  ------
SI C  AB-1  AB-1  AB-1  AB-1  AB-1  AB-1    AB-1  AB-1    All-3  All-3    AB-1    ------ ------  ------
896A  All-2 All-2  All-2  All-2  All-2  All-2    All-2  All-2  All-2  All-2    All-2  All-2  ------  ------
or 896B 878B    A    AB      A    AB      A    AB        A    AB      A      All    All-3    All    A    ------
878D    AB    B    AB      B    AB      B      AB      B      All      B      All-3    All    All      B R.E. Ginna Nuclear Power Plant                  B 3.5.2-15                                        Revision 76
 
ECCS - MODES 1, 2, and 3 B 3.5.2 Table B 3.5.2-1 (Note)
EMERGENCY CORE COOLING SYSTEM INOPERABILITY MATRIX, Page 2 of 2
                    - - - - - - - - - - - - - - - - -- - - - - - - - - - NOTE - - - - - - - -- - - - - - - - - - - - - - - - - - - - - - -
Notes (see also LCO Bases and Table B 3.5.2-1):
: 1.                  This matrix was generated assuming all required support systems are OPERABLE. If support systems are inoperable, their effect must be cascaded to the ECCS in order to use this matrix.
: 2.                  If only one component is inoperable, use the box corresponding to the intersection of that component on the x and y axis (e.g., if RHR Pump A is inoperable, use box in upper left hand corner of matrix to identify that ECCS Train A is inoperable). If multiple components are inoperable, use the box corresponding to their intersection, not the individual boxes (e.g., if RHR Pump A and MOV 852B were inoperable, the intersection of these two components is ECCS Train AB, not ECCS Train A and ECCS Train B).
DEFINITIONS:
A                  Fails ECCS Train A; Condition A must be entered.
B                  Fails ECCS Train B; Condition A must be entered.
AB                  Fails one (1) ECCS train, but a second 100% capacity train comprised of components from both Trains A and B remains; Condition A must be entered.
AB-1                If only one (1) SI Pump C breaker is inoperable, declare affected ECCS train inoperable (e.g., if breaker from Bus 14 is inoperable, this is the same as declaring SI Pump A inoperable and the SI Pump A column may be used in place of the Pump C column for inoperability evaluation). If SI Pump C or both breakers are inoperable, then Note AB applies.
All                Both ECCS Trains are inoperable.
All-1              Both trains of ECCS are inoperable unless manual valves 709C and 709D are opened and it can be demonstrated that sufficient flow is available through this 8" line.
All-2              Both ECCS trains are inoperable. Also must enter LCO 3.6.6, Condition H for two CS trains inoperable.
All-3              Both ECCS trains are inoperable unless only one (1) SI Pump C breaker is inoperable whereby Note AB-1 would apply.
R.E. Ginna Nuclear Power Plant                                        B 3.5.2-16                                                                Revision 76
 
ECCS - MODES 1, 2, and 3 B 3.5.2 Figure B 3.5.2-1A Emergency Core Cooling System, Page 1 of 2 R.E. Ginna Nuclear Power Plant          B 3.5.2-17                          Revision 76
 
ECCS - MODES 1, 2, and 3 B 3.5.2 Figure B 3.5.2-1B Emergency Core Cooling System, Page 2 of 2 R.E. Ginna Nuclear Power Plant          B 3.5.2-18                          Revision 76
 
ECCS - MODE 4 B 3.5.3 B 3.5    EMERGENCY CORE COOLING SYSTEMS (ECCS)
B 3.5.3      ECCS-MODE 4 BASES BACKGROUND            The Background section for Bases 3.5.2, "ECCS-MODES 1, 2, and 3," is applicable to these Bases, with the following modifications.
In MODE 4, the required ECCS train consists of two separate subsystems: safety injection (SI) and residual heat removal (RHR).
The ECCS flow paths consist of piping, valves, heat exchangers, and pumps such that water from the refueling water storage tank (RWST) can be injected into the Reactor Coolant System (RCS). The RHR subsystem must also be capable of taking suction from containment Sump B to provide recirculation.
APPLICABLE            There are no Applicable Safety Analyses which apply to the ECCS in SAFETY                MODE 4 due to the stable conditions associated with operation in MODE ANALYSES              4 and the reduced probability of occurrence of a Design Basis Accident (DBA). Therefore, the ECCS operational requirements are reduced in MODE 4. It is understood in these reductions that certain automatic SI actuations are not available. In this MODE, sufficient time is expected for manual actuation of the required ECCS to mitigate the consequences of a DBA. This time is also required since the RHR System may be aligned to provide normal shutdown cooling while the SI System may be isolated from the RCS due to low temperature overpressure protection (LTOP) concerns. Therefore, only one train of ECCS is required for MODE 4.
This requirement dictates that single failures are not considered for this LCO due to the time available for operators to respond to an accident.
Even though there are no DBAs in MODE 4, after the initiation of RHR shutdown cooling, there is a temperature range during which, if a shutdown loss-of-coolant-accident (LOCA) occurred, the RHR subsystem may not be fully capable of delivering water from the RWST to the reactor core. That is, when the temperature in the RCS is above the saturation temperature associated with the RWST at the suction to the pump, RHR suction pipe flashing could occur when the RHR suction is transferred from the RCS to the RWST. Consequently, the SI subsystem must have two injection paths available to deliver water to the reactor. This will ensure that, should an unisolable LOCA occur in MODE 4, regardless of break location, the reactor fuel will remain cooled. Calculations show that one SI pump will provide sufficient core cooling through injecting the contents of the RWST via two injection paths.
R.E. Ginna Nuclear Power Plant              B 3.5.3-1                                  Revision 76
 
ECCS - MODE 4 B 3.5.3 The duration of time that passes while injecting the RWST contents down to the level (28%) where switchover to containment Sump B begins is long enough to allow the RHR suction pipe to cool to a temperature where the RHR system can be re-aligned and the pump re-started, taking suction from Sump B. In the event that a LOCA were to occur following RHR cooldown of the RCS to below the saturation temperature associated with the RWST, the suction of the RHR pump may be transferred to the RWST for use in providing ECCS capability. However, this flow path is not specifically credited in the definition of an RHR train while in MODE 4.
The ECCS trains satisfy Criterion 4 of the NRC Policy Statement.
LCO                  In MODE 4, one of the two independent (and redundant) ECCS trains is required to be OPERABLE to ensure that sufficient ECCS flow is available to the core following an accident.
In MODE 4, an ECCS train consists of an SI subsystem and an RHR subsystem. Each train includes the piping, instruments, and controls to ensure an OPERABLE flow path capable of providing cooling to the reactor. The major components of an ECCS train during MODE 4 consists of an RHR pump and heat exchanger, capable of taking suction from Containment Sump B, and able to inject through one of two isolation valves to the reactor vessel upper plenum. Also included within the ECCS train are at least one of three SI pumps capable of taking suction from the RWST and injecting through the RCS injection lines.
Specifically, when the RCS is above the saturation temperature of the RWST at the suction of the RHR pumps, two SI injection paths through any combination of the two RCS cold and the two RCS hot leg injection lines must be OPERABLE. Below the saturation temperature of the RWST, only one of the four available SI injection paths must be OPERABLE, along with the RHR flowpath.
The high-head recirculation flow path from RHR to the SI pumps is not required in MODE 4 since there is no accident scenario which prevents depressurization to the RHR pump shutoff head prior to depletion of the RWST. Also, SI Pump minimum recirculation lines are not required due to the low RCS pressure in MODE 4; however, they must be capable of being isolated during the recirculation phase.
R.E. Ginna Nuclear Power Plant                B 3.5.3-2                                    Revision 76
 
ECCS - MODE 4 B 3.5.3 Based on the expected time available to respond to accident conditions during MODE 4, and the configuration of the RHR and SI trains, ECCS components are OPERABLE if they are capable of being reconfigured to the injection mode (remotely or locally) within 10 minutes. This includes taking credit for an RHR pump and heat exchanger as being OPERABLE if they are being used for shutdown cooling purposes. LCO 3.4.12, "LTOP System" contains additional requirements for the configuration of the SI system. Limited access to Containment Sump B is allowed provided that the sump integrity can be restored in less than 10 minutes.
Management of gas voids is important to ECCS OPERABILITY.
APPLICABILITY        In MODES 1, 2, and 3, the OPERABILITY requirements for ECCS are covered by LCO 3.5.2.
In MODE 4, one OPERABLE ECCS train is acceptable without single failure consideration, on the basis of the stable reactivity of the reactor and the limited core cooling requirements.
In MODES 5 and 6, plant conditions are such that the probability of an event requiring ECCS injection is extremely low. Core cooling requirements in MODE 5 are addressed by LCO 3.4.7, "RCS Loops -
MODE 5, Loops Filled," and LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled." MODE 6 core cooling requirements are addressed by LCO 3.9.4, "Residual Heat Removal (RHR) and Coolant Circulation-Water Level  23 Ft," and LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation-Water Level < 23 Ft."
ACTIONS              A.1 With no ECCS RHR subsystem OPERABLE, the plant is not prepared to respond to a loss of coolant accident or to continue a cooldown using the RHR pumps and heat exchangers. The Completion Time of immediately to initiate actions that would restore at least one ECCS RHR subsystem to OPERABLE status ensures that prompt action is taken to restore the required cooling capacity. Normally, in MODE 4, reactor decay heat is removed from the RCS by an RHR loop. If no RHR loop is OPERABLE for this function, reactor decay heat must be removed by some alternate method, such as use of the steam generators. The alternate means of heat removal must continue until the inoperable RHR loop components can be restored to operation so that decay heat removal is continuous.
With both RHR pumps and heat exchangers inoperable, it would be unwise to require the plant to go to MODE 5, where the only available heat removal system is the RHR subsystem. Therefore, the appropriate action is to initiate measures to restore one ECCS RHR subsystem and R.E. Ginna Nuclear Power Plant                  B 3.5.3-3                                  Revision 76
 
ECCS - MODE 4 B 3.5.3 to continue the actions until the subsystem is restored to OPERABLE status.
B.1 With no ECCS SI subsystem OPERABLE, due to the inoperability of the SI pump or flow path from the RWST, the plant is not prepared to provide high pressure response to an accident requiring SI. The 1 hour Completion Time to restore at least one SI subsystem to OPERABLE status ensures that prompt action is taken to provide the required cooling capacity or to initiate actions to place the plant in MODE 5, where an ECCS train is not required.
Condition B is modified by a Note which prohibits the application of LCO 3.0.4.b. to an inoperable ECCS SI subsystem when entering MODE 4.
There is an increased risk associated with entering MODE 4 from MODE 5 with an inoperable ECCS SI subsystem and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the ECCS not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.
C.1 When the Required Actions of Condition B cannot be completed within the required Completion Time, a controlled shutdown should be initiated.
Twenty-four hours is a reasonable time, based on operating experience, to reach MODE 5 in an orderly manner and without challenging plant systems or operators.
SURVEILLANCE          SR 3.5.3.1 REQUIREMENTS The applicable Surveillance description from Bases 3.5.2 apply. This SR is modified by a Note that allows an RHR train to be considered OPERABLE during alignment and operation for decay heat removal, if capable of being manually realigned (remote or local) to the ECCS mode of operation and not otherwise inoperable. This allows operation in the RHR mode during MODE 4, if necessary.
REFERENCES            1. None.
R.E. Ginna Nuclear Power Plant                B 3.5.3-4                                Revision 76
 
RWST B 3.5.4 B 3.5    EMERGENCY CORE COOLING SYSTEMS (ECCS)
B 3.5.4      Refueling Water Storage Tank (RWST)
BASES BACKGROUND            The RWST supplies borated water to both trains of the ECCS and the Containment Spray (CS) System during the injection phase of a loss of coolant accident (LOCA) recovery (see Figure B 3.5.2-1A). A common supply header is used from the RWST to the safety injection (SI) and CS pumps. A separate supply header is used for the residual heat removal (RHR) pumps. Isolation valves and check valves are used to isolate the RWST from the ECCS and CS System prior to transferring to the recirculation mode. The recirculation mode is entered when pump suction is transferred to the containment sump based on RWST level.
Use of a single RWST to supply both trains of the ECCS and CS System is acceptable since the RWST is a passive component, and passive failures are not required to be assumed to occur coincidentally with Design Basis Events.
The RWST is located in the Auxiliary Building which is normally maintained between 50&#xba;F and 104&#xba;F (Ref. 1). These moderate temperatures provide adequate margin with respect to potential freezing or overheating of the borated water contained in the RWST.
During normal operation in MODES 1, 2, and 3, the safety injection (SI),
RHR, and CS pumps are aligned to take suction from the RWST.
The ECCS and CS pumps are provided with recirculation lines that ensure each pump can maintain minimum flow requirements when operating at or near shutoff head conditions. The recirculation lines for the RHR and CS pumps are directed from the discharge of the pumps to the pump suction. The recirculation lines for the SI pumps are directed back to the RWST.
When the suction for the ECCS and CS pumps is transferred to the containment sump, the RWST and SI pump recirculation flow paths must be isolated to prevent a release of the containment sump contents to the RWST, which could result in a release of contaminants to the Auxiliary Building and the eventual loss of suction head for the ECCS pumps.
This LCO ensures that:
: a. The RWST contains sufficient borated water to support the ECCS and CS system during the injection phase; R.E. Ginna Nuclear Power Plant                B 3.5.4-1                                Revision 42
 
RWST B 3.5.4
: b. Sufficient water volume exists in the containment sump to support continued operation of the ECCS and CS pumps at the time of transfer to the recirculation mode of cooling; and
: c. The reactor remains subcritical following a LOCA.
Insufficient water in the RWST could result in inadequate NPSH for the RHR pumps when the transfer to the recirculation mode occurs.
Improper boron concentrations could result in a reduction of SDM or excessive boric acid precipitation in the core following the LOCA, as well as excessive caustic stress corrosion of mechanical components and systems inside the containment.
APPLICABLE            During accident conditions, the RWST provides a source of borated water SAFETY                to the ECCS and CS pumps. As such, it provides containment cooling ANALYSES              and depressurization, core cooling, and replacement inventory and is a source of negative reactivity for reactor shutdown (Ref. 3). The design basis transients and applicable safety analyses concerning each of these systems are discussed in the Applicable Safety Analyses section of LCO 3.5.2, "ECCS-MODES 1, 2, and 3"; LCO 3.5.3, "ECCS-MODE 4"; and LCO 3.6.6, "Containment Spray (CS), Containment Recirculation Fan Cooler (CRFC), NaOH, and Containment Post-Accident Charcoal Systems." These analyses are used to assess changes to the RWST in order to evaluate their effects in relation to the acceptance limits in the analyses.
The RWST must also meet volume, boron concentration, and temperature requirements for non-LOCA events. The volume is not an explicit assumption in non-LOCA events since the volume required for Reactor Coolant System (RCS) makeup is a small fraction of the available RCS volume. The deliverable volume limit is set by the LOCA and containment analyses. For the RWST, the deliverable volume is selected such that switchover to recirculation does not occur until sufficient water has been pumped into containment to provide necessary NPSH for the RHR pumps. The minimum boron concentration is an explicit assumption in the steam line break (SLB) analysis to ensure the required shutdown capability. The maximum boron concentration is an explicit assumption in the evaluation of chemical effects resulting from the operation of the CS System.
Minimum mass and minimum boron concentrations for significant boron sources and maximum mass and minimum boron concentration for significant dilution sources are used to compute the post LOCA sump boron concentration necessary to assure subcriticality. The large break LOCA is the limiting case since the safety analysis assumes that all control rods are out of the core.
R.E. Ginna Nuclear Power Plant                    B 3.5.4-2                                    Revision 42
 
RWST B 3.5.4 The upper limit on boron concentration is used to determine the time frame in which boron precipitation is addressed post LOCA. The maximum boron concentration limit is based on the coldest expected temperature of the RWST water volume and on chemical effects resulting from operation of the ECCS and the CS System. A value  3050 ppm would not create the potential for boron precipitation in the RWST assuming an Auxiliary Building temperature of 50&#xba;F (Ref. 1). Analyses performed to address 10 CFR 50.49 (Ref. 2) assumed a chemical spray solution resulting from a 2550-3050 ppm boron concentration in the accumulator and 2750-3050 ppm boron concentration in the RWST (Ref.
1). The chemical spray solution impacts sump pH and the resulting effect of chloride and caustic stress corrosion on mechanical systems and components. The sump pH also affects the rate of hydrogen generation within containment due to the interaction of CS and sump fluid with aluminum components.
The RWST satisfies Criterion 3 of the NRC Policy Statement.
LCO                  The RWST ensures that an adequate supply of borated water is available to cool and depressurize the containment in the event of a Design Basis Accident (DBA), to cool and cover the core in the event of a LOCA, to maintain the reactor subcritical following a DBA, and to ensure adequate level in the containment sump to support ECCS and CS pump operation in the recirculation mode.
To be considered OPERABLE, the RWST must meet the water volume and boron concentration limits established in the SRs.
APPLICABILITY        In MODES 1, 2, 3, and 4, RWST OPERABILITY requirements are dictated by ECCS and CS System OPERABILITY requirements. Since both the ECCS and the CS System must be OPERABLE in MODES 1, 2, 3, and 4, the RWST must also be OPERABLE to support their operation.
Core cooling requirements in MODE 5 are addressed by LCO 3.4.7, "RCS Loops - MODE 5, Loops Filled," and LCO 3.4.8, "RCS Loops -
MODE 5, Loops Not Filled." MODE 6 core cooling requirements are addressed by LCO 3.9.4, "Residual Heat Removal (RHR) and Coolant Circulation-Water Level  3 Ft," and LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation-Water Level < 23 Ft."
R.E. Ginna Nuclear Power Plant                  B 3.5.4-3                                  Revision 42
 
RWST B 3.5.4 ACTIONS              A.1 With RWST boron concentration not within limits, it must be returned to within limits within 8 hours. Under these conditions neither the ECCS nor the CS System can perform its design function. Therefore, prompt action must be taken to restore the tank to OPERABLE condition. The 8 hour limit to restore the RWST boron concentration to within limits was developed considering the time required to change the boron concentration and the fact that the contents of the tank are still available for injection.
B.1 With the RWST water volume not within limits, it must be restored to OPERABLE status within 1 hour. In this Condition, neither the ECCS nor the CS System can perform its design function. Therefore, prompt action must be taken to restore the tank to OPERABLE status or to place the plant in a MODE in which the RWST is not required. The short time limit of 1 hour to restore the RWST to OPERABLE status is based on this condition simultaneously affecting redundant trains.
C.1 and C.2 If the RWST cannot be returned to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE          SR 3.5.4.1 REQUIREMENTS The RWST water volume should be verified to be above the required minimum level in order to ensure that a sufficient initial supply is available for injection and to support continued ECCS and CS System pump operation on recirculation. The Surveillance Frequency is controlled under the Surveillance Frequency Program.
R.E. Ginna Nuclear Power Plant                B 3.5.4-4                                  Revision 77
 
RWST B 3.5.4 SR 3.5.4.2 The boron concentration of the RWST should be verified to be within the required limits. This SR ensures that the reactor will remain subcritical following a LOCA. Further, it assures that the resulting sump pH will be maintained in an acceptable range so that boron precipitation in the core will not occur and the effect of chloride and caustic stress corrosion on mechanical systems and components will be minimized. The Surveillance Frequency is controlled under the Surveillance Frequency Program.
REFERENCES            1. UFSAR, Section 3.11.
: 2. 10 CFR 50.49.
: 3. UFSAR, Section 6.3 and Chapter 15.
R.E. Ginna Nuclear Power Plant              B 3.5.4-5                                  Revision 77
 
Containment B 3.6.1 B 3.6    CONTAINMENT SYSTEMS B 3.6.1      Containment BASES BACKGROUND            The containment consists of the concrete containment structure, its steel liner, and the penetrations through this structure. The structure is designed to contain radioactive material that may be released from the reactor core following a Design Basis Accident (DBA) in accordance with Atomic Industry Forum (AIF) GDC 10 and 49 (Ref. 1). Additionally, this structure provides shielding from the fission products that may be present in the containment atmosphere following accident conditions.
The containment is a reinforced concrete structure with a cylindrical wall, a flat base mat, and a hemispherical dome roof. The inside surface of the containment is lined with a carbon steel liner to ensure a high degree of leak tightness during operating and accident conditions. Each weld seam on the inside of the liner has a leak test channel welded over it to allow independent testing of the liner when the containment is open. The liner is also insulated with closed-cell polyvinyl foam covered with metal sheeting up to a point above the spring line and below the containment spray ring headers. The function of the liner insulation is to limit the mean temperature rise of the liner to only 10&#xba;F at the time associated with maximum pressure following a DBA (Ref. 2).
The containment hemispherical dome is constructed of reinforced concrete designed for all DBA related moments, axial loads, and shear forces. The cylinder wall is prestressed vertically and reinforced circumferentially with mild steel deformed bars. The base mat is a reinforced concrete slab that is connected to the cylinder wall by use of a hinge design which prevents the transfer of imposed shear from the cylinder wall to the base mat. This hinge consists of elastomer bearing pads located between the bottom of the cylinder wall and the base mat, and high strength steel bars which connect the cylinder walls horizontally to the base mat (Ref. 2).
The cylinder wall is connected to sandstone rock located beneath the containment by use of 160 post-tensioned rock anchors that are coupled with tendons located in the cylinder wall. This design ensures that the rock acts as an integral part of the containment structure.
R.E. Ginna Nuclear Power Plant                B 3.6.1-1                                  Revision 42
 
Containment B 3.6.1 The concrete containment structure is required for structural integrity of the containment under DBA conditions. The steel liner and its penetrations establish the leakage limiting boundary of the containment.
Maintaining the containment OPERABLE limits the leakage of fission product radioactivity from the containment to the outside environment to within the limits of 10 CFR 50.67 (Ref. 3). SR 3.6.1.1 leakage rate requirements comply with 10 CFR 50, Appendix J, Option B (Ref. 4), as modified by approved exemptions.
The isolation devices for the penetrations in the containment boundary are a part of the containment leak tight barrier. To maintain this leak tight barrier:
: a.      All penetrations required to be closed during accident conditions are either:
: 1. Capable of being closed by an OPERABLE automatic containment isolation system, or
: 2. Closed by OPERABLE containment isolation boundaries, except as provided in LCO 3.6.3, "Containment Isolation Boundaries."
: b.      Each air lock is OPERABLE, except as provided in LCO 3.6.2, "Containment Air Locks."
APPLICABLE            The safety design basis for the containment is that the containment must SAFETY                withstand the pressures and temperatures of the limiting DBA without ANALYSES              exceeding the design leakage rate.
The DBAs that result in a challenge to containment OPERABILITY from high pressures and temperatures are a loss of coolant accident (LOCA), a steam line break, and a rod ejection accident (REA) (Ref. 5). In addition, release of significant fission product radioactivity within containment can occur from a LOCA or REA. In the DBA analyses, it is assumed that the containment is OPERABLE such that, for the DBAs involving release of fission product radioactivity, release to the environment is controlled by the rate of containment leakage. The containment was originally strength tested at 69 psig (115% of design). The acceptance criteria for this test was 0.1% of the containment air weight per day at 60 psig which was based on the construction techniques that were used (Ref. 5). Following successful completion of this test, the accident analyses were performed assuming a leakage rate of 0.2% of the containment air weight per day. This leakage rate, in combination with the minimum containment engineered safeguards operating (i.e., single train) results in offsite doses well within the limits of10 CFR 50.67 (Ref. 3) in the event of a DBA.
R.E. Ginna Nuclear Power Plant                B 3.6.1-2                                      Revision 42
 
Containment B 3.6.1 The leakage rate of 0.2% of the containment air weight per day is defined in 10 CFR 50, Appendix J, Option B (Ref. 4), as La the maximum allowable containment leakage rate at the calculated peak containment internal pressure (Pa) resulting from the design basis LOCA. The allowable leakage rate represented by La forms the basis for the acceptance criteria imposed on all containment leakage rate testing. La is assumed to be 0.2% per day in the safety analysis at Pa = 60 psig.
Satisfactory leakage rate test results are a requirement for the establishment of containment OPERABILITY.
The containment satisfies Criterion 3 of the NRC Policy Statement.
LCO                  Containment OPERABILITY is maintained by limiting leakage to  1.0 La except prior to entering MODE 4 for the first time following performance of periodic testing performed in accordance with 10 CFR 50, Appendix J, Option B. At that time, the combined Type B and C leakage must be <
0.6 La on a maximum pathway leakage rate (MXPLR) basis, and the overall Type A leakage must be < 0.75 La. At all other times prior to performing as found testing, the acceptance criteria for Type B and C testing is < 0.6 La on a minimum pathway leakage rate (MNPLR) basis.
In addition to leakage considerations following a design basis LOCA, containment OPERABILITY also requires structural integrity following a DBA. Also considered for OPERABILITY is leakage from the Containment Spray, Safety Injection, and Residual Heat Removal systems as addressed in Specification 5.5.2, "Primary Coolant Sources Outside Containment Program" since these systems function as an extension of containment during the recirculation phase of a LOCA. The limit on total leakage from the portion of these three systems subject to Specification 5.5.2 is 2.0 gallons per hour (Ref. 9).
Compliance with this LCO will ensure a containment configuration, including personnel and equipment hatches, that is structurally sound and that will limit leakage to those leakage rates assumed in the safety analysis.
R.E. Ginna Nuclear Power Plant                B 3.6.1-3                              Revision 42
 
Containment B 3.6.1 Individual leakage rates specified for the containment air lock (LCO 3.6.2) and mini-purge valves with resilient seals (LCO 3.6.3) and administrative limits for individual isolation boundaries are not specifically part of the acceptance criteria of 10 CFR 50, Appendix J. Therefore, leakage rates exceeding these individual limits only result in the containment being inoperable when the leakage results in exceeding the acceptance criteria of Appendix J.
APPLICABILITY        In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material into containment. In MODE 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of this MODE. Therefore, containment is not required to be OPERABLE in MODE 5 to prevent leakage of radioactive material from containment. The requirements for containment during MODE 6 are addressed in LCO 3.9.3, "Containment Penetrations."
ACTIONS              A.1 In the event containment is inoperable, the containment must be restored to OPERABLE status within 1 hour. The 1 hour Completion Time provides a period of time to correct the problem commensurate with the importance of maintaining containment during MODES 1, 2, 3, and 4.
This time period also ensures that the probability of an accident (requiring containment OPERABILITY) occurring during periods when containment is inoperable is minimal.
B.1 and B.2 If containment cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
R.E. Ginna Nuclear Power Plant                B 3.6.1-4                                  Revision 42
 
Containment B 3.6.1 SURVEILLANCE          SR 3.6.1.1 REQUIREMENTS Maintaining the containment OPERABLE requires compliance with the visual examinations and leakage rate test requirements of the Containment Leakage Rate Testing Program. Failure to meet air lock and mini-purge valve with resilient seal leakage limits specified in LCO 3.6.2 and LCO 3.6.3 does not invalidate the acceptability of these overall leakage determinations unless their contribution to overall Type A, B, and C leakage causes these limits to be exceeded. As left leakage prior to entering MODE 4 for the first time following performance of required 10 CFR 50, Appendix J periodic testing, is required to be < 0.6 La for combined Type B and C leakage on a MXPLR basis, and < 0.75 La for overall Type A leakage (Ref. 6). At all other times between the required leakage tests, the acceptance criteria is based on an overall Type A leakage limit of  1.0 La. This is maintained by limiting combined Type B and C leakage to < 0.6 La on a MNPLR basis until performance of as found testing. At  1.0 La, the offsite dose consequences are bounded by the assumptions of the safety analysis. SR Frequencies are as required by the Containment Leakage Rate Testing Program. These periodic testing requirements verify that the containment leakage rate does not exceed the leakage rate assumed in the safety analysis.
SR 3.6.1.2 This SR ensures that the structural integrity of the containment will be maintained in accordance with the provisions of the Containment Tendon Surveillance Program. Testing and Frequency are generally consistent with the recommendations of Regulatory Guide 1.35 (Ref. 7) except that tendon material tests and inspections are not required (Ref. 8).
R.E. Ginna Nuclear Power Plant              B 3.6.1-5                                  Revision 42
 
Containment B 3.
 
==6.1 REFERENCES==
: 1. Atomic Industry Forum, GDC 10 and 49, issued for comment July 10, 1967.
: 2. UFSAR, Section 3.8.1.
: 3. 10 CFR 50.67.
: 4. 10 CFR 50, Appendix J, Option B.
: 5. UFSAR, Section 6.2.
: 6. NEI 94-01, "Industry Guideline for Implementing Performance-Based Option of 10 CFR 50, Appendix J," Revision 0.
: 7. Regulatory Guide 1.35, Revision 2.
: 8. Letter from J. A. Zwolinski, NRC, to R.W. Kober, RG&E,
 
==Subject:==
 
                              "Safety Evaluation, Containment Vessel Tendon Surveillance Program," dated August 19, 1985.
: 9. Design Analysis DA-NS-2001-087, Large-Break LOCA Offsite and Control Room Doses.
R.E. Ginna Nuclear Power Plant                B 3.6.1-6                              Revision 42
 
Containment Air Locks B 3.6.2 B 3.6    CONTAINMENT SYSTEMS B 3.6.2      Containment Air Locks BASES BACKGROUND            Containment air locks form part of the containment pressure boundary and provide a means for personnel access during all MODES of operation.
There are two containment air locks installed at Ginna Station, an equipment hatch and a personnel hatch. Both air locks are nominally a right circular cylinder with a door at each end to allow personnel access.
The two doors on each airlock are interlocked to prevent simultaneous opening. During periods when containment is not required to be OPERABLE, the door interlock mechanism may be disabled, allowing both doors of an air lock to remain open for extended periods when frequent containment entry is necessary. Each air lock door has been designed and tested to certify its ability to withstand a pressure in excess of the maximum expected pressure following a Design Basis Accident (DBA) in containment. As such, closure of a single door supports containment OPERABILITY. Each of the doors contains a double-tongue, single gasketed seal and local leakage rate testing capability to ensure pressure integrity. To effect a leak tight seal, the air lock design uses pressure seated doors (i.e., an increase in containment internal pressure results in increased sealing force on each door).
Each personnel air lock is provided with limit switches on both doors that provide a control board alarm if any door is opened. A single control board alarm exists for all four access doors. Additionally, a control board alarm is provided if high pressure exists between the two doors for either airlock.
The containment air locks form part of the containment pressure boundary. As such, air lock integrity and leak tightness is essential for maintaining the containment leakage rate within limit in the event of a DBA. Not maintaining air lock integrity or leak tightness may result in a leakage rate in excess of that assumed in the plant safety analyses.
R.E. Ginna Nuclear Power Plant                B 3.6.2-1                                  Revision 21
 
Containment Air Locks B 3.6.2 APPLICABLE            The DBAs that result in a release of radioactive material within SAFETY                containment are a loss of coolant accident and a rod ejection accident ANALYSES              (Ref. 1). In the analysis of each of these accidents, it is assumed that containment is OPERABLE such that release of fission products to the environment is controlled by the rate of containment leakage. The containment was designed with an allowable leakage rate of 0.2% of containment air weight per day (Ref. 1). This leakage rate is defined in 10 CFR 50, Appendix J, Option B (Ref. 2), as La = 0.2% of containment air weight per day, the maximum allowable containment leakage rate at the calculated peak containment internal pressure Pa = 60 psig following the design basis LOCA. This allowable leakage rate forms the basis for the acceptance criteria imposed on the SRs associated with the air locks.
The containment air locks satisfy Criterion 3 of the NRC Policy Statement.
LCO                  The equipment hatch and personnel hatch containment air locks form part of the containment pressure boundary. As part of containment, the air lock safety function is related to control of the containment leakage rate following a DBA. Thus, each air locks structural integrity and leak tightness are essential to the successful mitigation of such an event.
Each air lock is required to be considered OPERABLE, the air lock interlock mechanism must be OPERABLE, the air lock must be in compliance with the 10 CFR 50, Appendix J Type B air lock leakage test (i.e., SR 3.6.2.1), and both air lock doors must be OPERABLE such that they are closed with leakage within acceptable limits. The interlock allows only one door of an air lock to be opened at a time. This provision ensures that a gross breach of containment does not exist when containment is required to be OPERABLE. Closure of a single door in each air lock is sufficient to provide a leak tight barrier following postulated events. Nevertheless, both doors are kept closed when the air lock is not being used for normal entry into and exit from containment.
Normal entry into and exit from containment does not render the airlock inoperable.
R.E. Ginna Nuclear Power Plant                B 3.6.2-2                                    Revision 21
 
Containment Air Locks B 3.6.2 APPLICABILITY        In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material into containment. In MODE 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of this MODE. Therefore, the containment air locks are not required to be OPERABLE in MODE 5 to prevent leakage of radioactive material from containment. The requirements for the containment air locks during MODE 6 are addressed in LCO 3.9.3, "Containment Penetrations."
ACTIONS              The ACTIONS are modified by three Notes. The first Note allows entry and exit to perform repairs on the affected air lock component. If the outer door is inoperable, then it may be easily accessed to repair. If the inner door is the one that is inoperable, however, then a short time exists when the containment boundary is not intact (during access through the outer door). The ability to open the OPERABLE door, even if it means the containment boundary is temporarily not intact, is acceptable due to the low probability of an event that could pressurize the containment during the short time in which the OPERABLE door is expected to be open. After each entry and exit, the OPERABLE door must be immediately closed. If ALARA conditions permit, entry and exit should be via an OPERABLE air lock.
A second Note has been added to provide clarification that, for this LCO, separate Condition entry is allowed for each air lock.
In the event the air lock leakage results in exceeding the overall containment leakage rate acceptance criteria, Note 3 directs entry into the applicable Conditions and Required Actions of LCO 3.6.1, "Containment." This evaluation should be initiated immediately after declaring a containment air lock inoperable. This is required since the inoperability of an air lock may result in a significant increase in the overall containment leakage rate.
A.1, A.2, and A.3 With one air lock door in one or more containment air locks inoperable, the OPERABLE door must be verified closed (Required Action A.1) in each affected containment air lock. If the between air lock door volume exceeds the allowed leakage criteria, and leakage is verified to be into containment (e.g., leakage through the equalizing valve), then the inner airlock door shall be declared inoperable and this Condition entered. If leakage exists from containment to the outside environment, then Condition C is entered. This ensures that a leak tight containment barrier is maintained by the use of an OPERABLE air lock door. This action must be completed within 1 hour and may consist of verifying the control R.E. Ginna Nuclear Power Plant                B 3.6.2-3                                  Revision 21
 
Containment Air Locks B 3.6.2 board alarm status for the airlock doors. This specified time period is consistent with the ACTIONS of LCO 3.6.1, which requires containment be restored to OPERABLE status within 1 hour.
In addition, the affected air lock penetration must be isolated by locking closed the OPERABLE air lock door within the 24 hour Completion Time.
The 24 hour Completion Time is reasonable for locking the OPERABLE air lock door, considering the OPERABLE door of the affected air lock is being maintained closed.
Required Action A.3 verifies that an air lock with an inoperable door has been isolated by the use of a locked and closed OPERABLE air lock door. This ensures that an acceptable containment leakage boundary is maintained. The Completion Time of once per 31 days is based on engineering judgment and is considered adequate in view of the low likelihood of a locked door being mispositioned and other administrative controls. Required Action A.3 is modified by a Note that applies to air lock doors located in high radiation areas and allows these doors to be verified locked closed by use of administrative means. Allowing verification by administrative means (e.g., procedure control) is considered acceptable, since access to these areas is typically restricted.
Therefore, the probability of misalignment of the door, once it has been verified to be in the proper position, is small.
The Required Actions have been modified by two Notes. Note 1 specifies that Required Actions A.1, A.2, and A.3 are not applicable if both doors in the same air lock are inoperable. With both doors in the same air lock inoperable, an OPERABLE door is not available to be closed and Required Actions C.1, C.2, and C.3 are the appropriate remedial actions. The exception of Note 1 does not affect tracking the Completion Time from the initial entry into Condition A; only the requirement to comply with the Required Actions. Note 2 allows use of the air lock for entry and exit for 7 days under administrative controls if both air locks have an inoperable door. This 7 day restriction begins when the second air lock is discovered to be inoperable. Containment entry may be required on a periodic basis to perform Technical Specifications (TS) Surveillances and Required Actions, as well as other activities on equipment inside containment that are required by TS or activities on equipment that support TS-required equipment. This Note allows performing other activities (i.e., non TS-required activities) if the containment is entered, using the inoperable air lock, to perform an allowed activity listed above. This allowance is acceptable due to the low probability of an event that could pressurize the containment during the short time that the OPERABLE door is expected to be open.
R.E. Ginna Nuclear Power Plant                B 3.6.2-4                                  Revision 21
 
Containment Air Locks B 3.6.2 B.1, B.2, and B.3 With an air lock interlock mechanism inoperable in one or more air locks, the Required Actions and associated Completion Times are consistent with those specified in Condition A with the exception that both air lock doors are still OPERABLE and either door can be used to isolate the air lock penetration.
The Required Actions have been modified by two Notes. Note 1 specifies that Required Actions B.1, B.2, and B.3 are not applicable if both doors in the same air lock are inoperable. With both doors in the same air lock inoperable, an OPERABLE door is not available to be closed and Required Actions C.1, C.2, and C.3 are the appropriate remedial actions. Note 2 allows entry into and exit from containment through an air lock with an inoperable air lock interlock mechanism under the control of a dedicated individual stationed at the air lock to ensure that only one door is opened at a time (i.e., the individual performs the function of the interlock).
Required Action B.3 is modified by a Note that applies to air lock doors located in high radiation areas and allows these doors to be verified locked closed by use of administrative means. Allowing verification by administrative means (e.g., procedure control) is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of the door, once it has been verified to be in the proper position, is small.
C.1, C.2, and C.3 With one or more air locks inoperable for reasons other than those described in Condition A or B (e.g., both doors of an airlock are inoperable), Required Action C.1 requires action to be initiated immediately to evaluate previous combined leakage rates using current air lock test results. An evaluation per LCO 3.6.1 is acceptable, since it is overly conservative to immediately declare the containment inoperable if both doors in an air lock have failed a seal test or if the overall air lock leakage is not within the limits of SR 3.6.2.1. In many instances (e.g.,
only one seal per door has failed), containment remains OPERABLE per LCO 3.6.1 and it is not necessary to require restoration of the inoperable air lock door within the 1 hour Completion Time specified in LCO 3.6.1 before requiring a plant shutdown. In addition, even with both doors failing the seal test, the overall containment leakage rate can still be within limits due to the large margin between the airlock leakage and the containment overall leakage acceptance criteria.
Required Action C.2 requires that one door in the affected containment air lock must be verified to be closed within the 1 hour Completion Time.
This specified time period is consistent with the ACTIONS of LCO 3.6.1, which requires that containment be restored to OPERABLE status within 1 hour.
R.E. Ginna Nuclear Power Plant                B 3.6.2-5                                  Revision 21
 
Containment Air Locks B 3.6.2 Additionally, the affected air lock must be restored to OPERABLE status within the 24 hour Completion Time. The specified time period is considered reasonable for restoring an inoperable air lock to OPERABLE status, assuming that at least one door is maintained closed in each affected air lock and the containment overall leakage rate is acceptable.
D.1and D.2 If the inoperable containment air lock cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE          SR 3.6.2.1 REQUIREMENTS Maintaining containment air locks OPERABLE requires compliance with the leakage rate test requirements of the Containment Leakage Rate Testing Program. This SR reflects the leakage rate testing requirements with regard to air lock leakage (Type B leakage tests). The acceptance criteria were established based on industry experience. The periodic testing requirements verify that the air lock leakage does not exceed the allowed fraction of the overall containment leakage rate. The Frequency is as required by the Containment Leakage Rate Testing Program.
The SR has been modified by two Notes. Note 1 states that an inoperable air lock door does not invalidate the previous successful performance of the overall air lock leakage test. This is considered reasonable since either air lock door is capable of providing a fission product barrier in the event of a DBA. Note 2 requires that the results of this SR be evaluated against the acceptance criteria of the Containment Leakage Rate Testing Program. This ensures that air lock leakage is properly accounted for in determining the overall containment leakage rate.
R.E. Ginna Nuclear Power Plant                B 3.6.2-6                                Revision 21
 
Containment Air Locks B 3.6.2 SR 3.6.2.2 The air lock interlock is designed to prevent simultaneous opening of both doors in a single air lock. Since both the inner and outer doors of an air lock are designed to withstand the maximum expected post accident containment pressure, closure of either door will support containment OPERABILITY. Thus, the door interlock feature supports containment OPERABILITY while the air lock is being used for personnel transit in and out of the containment. Periodic testing of this interlock demonstrates that the interlock will function as designed and that simultaneous opening of the inner and outer doors will not inadvertently occur. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES            1. UFSAR, Section 6.2.1.1.
: 2. 10 CFR 50, Appendix J, Option B.
R.E. Ginna Nuclear Power Plant                B 3.6.2-7                                Revision 77
 
Containment Isolation Boundaries B 3.6.3 B 3.6    CONTAINMENT SYSTEMS B 3.6.3      Containment Isolation Boundaries BASES BACKGROUND            The containment isolation boundaries form part of the containment pressure barrier and provide a means for fluid penetrations to be provided with two isolation boundaries. These isolation boundaries are either passive or active (automatic). Manual valves, check valves, de-activated automatic valves secured in their closed position, blind flanges, and closed systems are considered passive boundaries. Automatic valves designed to close without operator action following an accident, are considered active boundaries. Two boundaries in series are provided for each penetration so that no single credible failure or malfunction of an active component can result in a loss of isolation or leakage that exceeds limits assumed in the safety analyses in accordance with Atomic Industry Forum (AIF) GDC 53 and 57 (Ref. 1). These active and passive boundaries make up the Containment Isolation System.
The Containment Isolation System is designed to provide isolation capability following a Design Basis Accident (DBA) for all fluid lines which penetrate containment. All major nonessential lines (i.e., fluid systems which do not perform an immediate accident mitigation function) which penetrate containment, except for the main feedwater lines, component cooling water to the reactor coolant pumps, and main steam lines, are either automatically isolated following an accident or are normally maintained closed in MODES 1, 2, 3, and 4. Automatic containment isolation valves are designed to close on a containment isolation signal which is generated by either an automatic safety injection (SI) signal or by manual actuation. The Containment Isolation System can also isolate essential lines at the discretion of the operators depending on the accident progression and mitigation. As a result, the containment isolation boundaries help ensure that the containment atmosphere will be isolated from the outside environment in the event of a release of fission product radioactivity to the containment atmosphere as a result of a DBA.
The OPERABILITY requirements for containment isolation boundaries help ensure that containment is isolated within the time limits assumed in the safety analyses. Therefore, the OPERABILITY requirements provide assurance that the containment function assumed in the safety analyses will be maintained.
In addition to the normal fluid systems which penetrate containment, there are two systems which can provide direct access from inside containment to the outside environment.
R.E. Ginna Nuclear Power Plant              B 3.6.3-1                                    Revision 64
 
Containment Isolation Boundaries B 3.6.3 Shutdown Purge System (36 inch purge valves)
The Shutdown Purge System operates to supply outside air into the containment for ventilation and cooling or heating and may also be used to reduce the concentration of noble gases within containment prior to and during personnel access below MODE 4. The supply and exhaust lines each contain one isolation valve and one double gasketed blind flange. Because of their large size, the shutdown purge valves are not qualified for automatic closure from their open position under DBA conditions. Also, due to the design of the blind flange assembly, the isolation valve is not required to be credited as a containment isolation barrier. Therefore, the blind flanges are installed in MODES 1, 2, 3, and 4 to ensure that the containment barrier is maintained (Ref. 2).
Mini-Purge System (6 inch purge valves)
The Mini-Purge System operates to:
: a. Reduce the concentration of noble gases within containment prior to and during personnel access, and
: b. Equalize internal and external pressures.
The system is designed with supply and exhaust lines both of which contain two air operated isolation valves. Since the valves used in the Mini-Purge System are designed to meet the requirements for automatic containment isolation valves, these valves may be opened as needed in MODES 1, 2, 3, and 4; however, emphasis shall be placed on limiting purging and venting times to as low as reasonably achievable. In the event that operational concerns warrant extended operation, an ALARA review should be performed to evaluate the release.
APPLICABLE            The containment isolation boundary LCO was derived from the SAFETY                assumptions related to minimizing the loss of reactor inventory and ANALYSES              establishing the containment barrier during major accidents. As part of the containment barrier, OPERABILITY of devices which act as containment isolation boundaries supports leak tightness of the containment. Therefore, the safety analyses of any event requiring isolation of containment is applicable to this LCO.
R.E. Ginna Nuclear Power Plant                  B 3.6.3-2                                  Revision 64
 
Containment Isolation Boundaries B 3.6.3 The DBAs that result in a release of radioactive material within containment are a loss of coolant accident (LOCA) and a rod ejection accident (Ref. 3). Other DBAs (e.g., locked rotor) result in the release of radioactive material within the reactor coolant system. In the analyses for each of these accidents, it is assumed that containment isolation boundaries are either closed or function to close within the required isolation time following event initiation. This ensures that potential paths to the environment and other systems through containment isolation boundaries (including containment mini-purge valves) are minimized.
The safety analyses assume that the Shutdown Purge System is isolated at event initiation.
The containment isolation boundaries ensure that the containment design leakage rate remains within La by automatically isolating penetrations that do not serve post accident functions and providing isolation capability for penetrations associated with Engineered Safeguards Functions. The maximum isolation time for automatic containment isolation valves is 60 seconds (Ref. 3). This isolation time is based on engineering judgement since the control room and offsite dose calculations are performed assuming that leakage from containment begins immediately following the accident with no credit for transport time or radionuclide decay. The 60 second isolation time takes into consideration the time required to drain piping of fluid which can provide an initial containment barrier before the containment isolation valves are required to close and the conservative assumptions with respect to core damage occurring immediately following the accident. The containment isolation total response time of 60 seconds includes signal delay, diesel generator startup (only for motor operated valves affected by a loss of offsite power), and containment isolation valve stroke times.
The containment mini-purge valves are air operated valves which have isolation times shorter than 60 seconds since these penetrations may be opened and provide direct access to the outside environment. The accident analyses assume that these valves close prior to a hot rod burst (20 seconds) which occurs following a large break LOCA since the hot rod burst directly leads to higher radiation concentrations within containment. A 5 second isolation time for the mini-purge valves is used for additional conservatism (Ref. 3). The 5 second total isolation response time includes signal delay and containment isolation valve stroke times.
Containment isolation is also required for events which result in hot rod bursts but do not breach the integrity of the RCS (e.g., locked rotor accident). The isolation of containment following these events also isolates the RCS from all non essential systems to prevent the release of radioactive material outside the RCS. The containment isolation time requirements for these events are bounded by those for the LOCA.
R.E. Ginna Nuclear Power Plant              B 3.6.3-3                                  Revision 64
 
Containment Isolation Boundaries B 3.6.3 The Containment Isolation System is designed to provide two in series boundaries for each penetration so that no single credible failure or malfunction of an active component can result in a loss of isolation or leakage that exceeds the limits in the safety analyses. This system was originally designed in accordance with AIF GDC 53 (Ref. 1) which does not contain the specific design criteria specified in 10 CFR 50, Appendix A, GDC 55, 56, and 57 (Ref. 5). In general, the Containment Isolation System meets the current GDC requirements; however, several penetrations differ from the GDC from the standpoint of installed valve type (e.g., check valve versus automatic isolation valve) or valve location (e.g., both containment isolation boundaries are located inside containment). The evaluation of these penetrations is provided in Reference 3.
The containment isolation boundaries satisfy Criterion 3 of the NRC Policy Statement.
LCO                  Containment isolation boundaries form a part of the containment pressure barrier. The containment isolation boundaries' safety function is related to minimizing the loss of reactor coolant inventory and establishing the containment barrier leakage rates during a DBA.
The boundaries covered by this LCO are listed in Reference 6. These boundaries consist of isolation valves (manual valves, check valves, air operated valves, and motor operated valves), pipe and end caps, closed systems, and blind flanges. There are three major categories of containment isolation boundaries which are used depending on the type of penetration and the safety function of the associated piping system:
: a. Automatic containment isolation boundaries which receive a containment isolation signal to close following an accident;
: b. Normally closed containment isolation boundaries which are maintained closed in MODES 1, 2, 3, and 4 since they do not receive a containment isolation signal to close and the penetration is not used for normal power operation (but may be used for a long term accident mitigation function); and
: c. Normally open, but nonautomatic containment isolation boundaries which are maintained open since the penetrations are required for normal power operation. Penetrations which utilize these type of isolation boundaries also contain a passive device (i.e., closed system), such that the normally open, but nonautomatic isolation boundary is only closed after the first passive boundary has failed.
R.E. Ginna Nuclear Power Plant              B 3.6.3-4                                  Revision 64
 
Containment Isolation Boundaries B 3.6.3 The automatic containment isolation boundaries (i.e., valves) are considered OPERABLE when they are capable of closing within the stroke time specified in Reference 6. The normally closed containment isolation boundaries are considered OPERABLE when the manual valves are closed, air operated or motor operated valves are de-activated and secured in their closed position, check valves are closed with flow secured through the valve, blind flanges, pipe and end caps are in place, and closed systems are intact. The normally open, but nonautomatic, containment isolation boundaries (e.g. check valves and manual valves) are considered OPERABLE when they are capable of being closed. In addition, both penetrations associated with the Shutdown Purge System must be isolated by a blind flange containing redundant gaskets, or a single gasketed blind flange with a de-activated automatic isolation valve (i.e., two passive barriers).
Containment isolation boundary leakage per 10 CFR 50, Appendix J, Type B and C testing, is only addressed by LCO 3.6.1, "Containment,"
and is not a consideration in determination of containment isolation boundary OPERABILITY.
This LCO provides assurance that the containment isolation boundaries will perform their designed safety functions to control leakage from the containment during DBAs.
The LCO is modified by three Notes. The first Note states that the LCO is not applicable to the main steam safety valves in MODES 1, 2, and 3.
These valves are addressed by LCO 3.7.1, "Main Steam Safety Valves (MSSVs)," which provides appropriate Required Actions in the event these valves are declared inoperable.
The second Note states that the LCO is not applicable to the main steam isolation valves (MSIVs) in MODE 1, and in MODES 2 and 3 with the MSIVs open or closed and not deactivated. These valves are addressed by LCO 3.7.2, "Main Steam Isolation Valves (MSIVs) and Non-Return Check Valves."
The third Note states that the atmospheric relief valves are not addressed by this LCO in MODES 1 and 2, and MODE 3 when the Reactor Coolant System average temperature (Tavg) is  500&#xba;F. These valves are addressed by LCO 3.7.4, "Atmospheric Relief Valves (ARVs)," which provides appropriate Required Actions in the event these valves are declared inoperable.
R.E. Ginna Nuclear Power Plant            B 3.6.3-5                                    Revision 64
 
Containment Isolation Boundaries B 3.6.3 APPLICABILITY        In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material into containment. In MODE 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of this MODE. Therefore, the containment isolation boundaries are not required to be OPERABLE in MODE 5. The requirements for containment isolation boundaries during MODE 6 are addressed in LCO 3.9.3, "Containment Penetrations."
ACTIONS              The ACTIONS are modified by four Notes. The first Note allows penetration flow paths, except for the Shutdown Purge System valve penetration flow paths, to be unisolated intermittently under administrative controls. These administrative controls consist of stationing a dedicated individual qualified in accordance with plant procedures at the valve controls, who is in continuous communication with the control room. In this way, the penetration can be rapidly isolated when a need for containment isolation is indicated. Due to the size of the shutdown purge line penetration and the fact that these penetrations exhaust directly from the containment atmosphere to the outside environment, the penetration flow path containing these valves may not be opened under administrative controls.
A second Note has been added to provide clarification that, for this LCO, separate Condition entry is allowed for each penetration flow path. This is acceptable since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable containment isolation boundary. Complying with the Required Actions may allow for continued operation, and subsequent inoperable containment isolation boundaries are governed by subsequent Condition entry and application of associated Required Actions.
A third Note has been added which ensures appropriate remedial actions are taken, if necessary, if the affected systems are rendered inoperable by an inoperable containment isolation boundary, or as the result of performing the Required Actions described below.
Finally, in the event the isolation boundary leakage results in exceeding the overall containment leakage rate acceptance criteria, Note 4 directs entry into the applicable Conditions and Required Actions of LCO 3.6.1.
This evaluation should be initiated immediately after declaring a containment isolation boundary inoperable. This is required since the inability of an isolation boundary to close may result in a significant increase in the overall containment leakage rate if the in-series and redundant isolation boundary has a large "as-left" leakage rate associated with it.
R.E. Ginna Nuclear Power Plant                B 3.6.3-6                                    Revision 64
 
Containment Isolation Boundaries B 3.6.3 A.1 In the event one containment isolation boundary in one or more penetration flow paths is inoperable (except for mini-purge valve leakage not within limit), the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation boundary that cannot be adversely affected by a single active failure (including a single human error). For automatic valves, this requires two independent means to prevent the valve from re-opening. Isolation boundaries that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, a blind flange, and a check valve with flow through the valve secured. For a penetration flow path isolated in accordance with Required Action A.1, the boundary used to isolate the penetration should be the closest available one to containment.
Required Action A.1 must be completed within 4 hours. The 4 hour Completion Time is reasonable, considering the time required to isolate the penetration and the relative importance of supporting containment OPERABILITY during MODES 1, 2, 3, and 4.
A.2 For affected penetration flow paths that cannot be restored to OPERABLE status within the 4 hour Completion Time and that have been isolated in accordance with Required Action A.1, the affected penetration flow paths must be verified to be isolated on a periodic basis. This is necessary to ensure that containment penetrations required to be isolated following an accident and no longer capable of being isolated following a single failure will be in the isolation position should an event occur. This Required Action does not require any testing or device manipulation. Rather, it involves verification, through a system walkdown, that those isolation boundaries capable of being mispositioned are in the correct position. The Completion Time of "once per 31 days for isolation boundaries outside containment" is appropriate considering the fact that the boundaries are operated under administrative controls and the probability of their misalignment is low.
For the isolation boundaries inside containment, the time period specified as "prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of the inaccessibility of the isolation boundaries and other administrative controls that will ensure that isolation boundary misalignment is an unlikely possibility.
Required Action A.2 is modified by a Note that applies to isolation boundaries located in high radiation areas and allows these boundaries to be verified closed by use of administrative means (e.g., ensuring that all valve manipulations in these areas have been independently verified).
Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of these boundaries, once they have been verified to be in the proper position, is small.
R.E. Ginna Nuclear Power Plant              B 3.6.3-7                                    Revision 64
 
Containment Isolation Boundaries B 3.6.3 Condition A is modified by a Note indicating that this Condition is only applicable to those penetration flowpaths which do not use a closed system as a containment isolation boundary. For those penetrations which do use a closed system, Condition C provides the appropriate actions.
B.1 With two containment isolation boundaries in one or more penetration flow paths inoperable (except for mini-purge valve leakage not within limit), the affected penetration flow path must be isolated within 1 hour.
The method of isolation must include the use of at least one isolation boundary that cannot be adversely affected by a single active failure (including a single human error). For automatic valves, this requires two independent means to prevent the valve from re-opening. Isolation boundaries that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange. Check valves and closed systems are not acceptable isolation boundaries in this instance since they cannot be assured to meet the design requirements of a normal containment isolation boundary. The 1 hour Completion Time is consistent with the ACTIONS of LCO 3.6.1.
Following completion of Required Action B.1, verification that the affected penetration flow path remains isolated must be performed in accordance with Required Action A.2.
Condition B is modified by a Note indicating that this Condition is only applicable to penetration flow paths which do not use a closed system as containment isolation boundary. For those penetrations which do use a closed system, Condition C provides the appropriate actions.
C.1 With one or more penetration flow paths with one containment isolation boundary inoperable, the inoperable boundary must be restored to OPERABLE status or the affected penetration flow path must be isolated.
The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure (including a single human error). For automatic valves, this requires two independent means to prevent the valve from re-opening. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange. A check valve may not be used to isolate the affected penetration flow path. Required Action C.1 must be completed within the 72 hour Completion Time. The specified time period is reasonable considering the relative stability of the closed system (hence, reliability) to act as a penetration isolation boundary and the relative importance of maintaining containment integrity during MODES 1, 2, 3, and 4.
R.E. Ginna Nuclear Power Plant              B 3.6.3-8                                    Revision 64
 
Containment Isolation Boundaries B 3.6.3 C.2 In the event the affected penetration flow path is isolated in accordance with Required Action C.1, the affected penetration flow path must be verified to be isolated on a periodic basis. This periodic verification is necessary to assure leak tightness of containment and that containment penetrations requiring isolation following an accident are isolated. This Required Action does not require any testing or device manipulation.
Rather, it involves verification through a system walkdown, that these isolation boundaries capable of being mispositioned are in the correct position. The Completion Time of "once per 31 days for isolation boundaries outside containment" is appropriate considering the fact that the boundaries are operated under administrative controls and the probability of their misalignment is low. For the isolation boundaries inside containment, the time period specified as "prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of the inaccessibility of the isolation boundaries and other administrative controls that will ensure that isolation boundary misalignment is an unlikely possibility.
Required Action C.2 is modified by a Note that applies to isolation boundaries located in high radiation areas and allows these boundaries to be verified closed by use of administrative means (e.g., ensuring that all valve manipulations in these areas have been independently verified).
Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of these devices, once they have been verified to be in the proper position, is small.
Condition C is modified by a Note indicating that this Condition is only applicable to those penetration flow paths which use a closed system as a containment isolation boundary. This Note is necessary since this Condition is written to specifically address those penetration flow paths which utilize a closed system as defined in Reference 7.
D.1 In the event one or more containment mini-purge penetration flow paths contain one valve not within the mini-purge valve leakage limits, mini-purge valve leakage must be restored to within limits, or the affected penetration flow path must be isolated. The method of isolation must be by the use of at least one isolation boundary that cannot be adversely affected by a single active failure (including a single human error). For automatic valves, this requires two independent means to prevent the valve from re-opening. Isolation boundaries that meet this criterion are a closed and de-activated automatic valve, closed manual valve, or blind flange. A purge valve with resilient seals utilized to satisfy Required Action D.1 must have been demonstrated to meet the leakage requirements of SR 3.6.3.5. The specified Completion Time is R.E. Ginna Nuclear Power Plant              B 3.6.3-9                                  Revision 64
 
Containment Isolation Boundaries B 3.6.3 reasonable, considering that one containment purge valve remains closed so that a major violation of containment does not exist.
D.2 In accordance with Required Action D.2, this penetration flow path must be verified to be isolated on a periodic basis. The periodic verification is necessary to ensure that containment penetrations required to be isolated following an accident, which are no longer capable of being automatically isolated, will be in the isolation position should an event occur. This Required Action does not require any testing or valve manipulation. Rather, it involves verification, through a system walkdown, that those isolation boundaries capable of being mispositioned are in the correct position. The Completion Time of "once every 31 days for isolation boundaries outside containment" is appropriate considering the fact that the boundaries are operated under administrative controls and the probability of their misalignment is low.
For the isolation boundaries inside containment, the time period specified as "prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of the inaccessibility of the isolation boundaries and other administrative controls that will ensure that isolation boundary misalignment is an unlikely possibility.
Required Action D.2 is modified by a Note that applies to isolation boundaries located in high radiation areas and allows these boundaries to be verified closed by use of administrative means (e.g., ensuring that all valve manipulations in these areas have been independently verified).
Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of these boundaries, once they have been verified to be in the proper position, is small.
E.1 In the event one or more containment mini-purge penetration flow paths contain two valves not within the mini-purge valve leakage limits, Required Action E.1 requires action to be initiated immediately to evaluate previous combined leakage rates using current mini-purge results. An evaluation per LCO 3.6.1 is acceptable, since it is overly conservative to immediately declare the containment inoperable if both mini-purge valves have failed a leakage test or are not within the limits of SR 3.6.3.5. In many instances, containment remains OPERABLE per LCO 3.6.1 and it is not necessary to require restoration of the mini-purge penetration flow path within the 1 hour Completion Time specified in LCO 3.6.1 before requiring a plant shutdown. In addition, even with both valves failing the leakage test, the overall containment leakage rate can still be within limits due to the large margin between the mini-purge valve leakage and the containment overall leakage acceptance criteria.
R.E. Ginna Nuclear Power Plant                B 3.6.3-10                                Revision 64
 
Containment Isolation Boundaries B 3.6.3 E.2 Required Action E.2 requires that the mini-purge valve leakage must be restored to within limits, or the affected penetration flow path must be isolated within 1 hour. The method of isolation must be by the use of at least one isolation barrier that cannot be adversely affected by a single active failure (including a single human error). For automatic valves, this requires two independent means to prevent the valve from re-opening.
Isolation barriers that meet this criterion are a closed and de-activated automatic valve, closed manual valve, or blind flange. A purge valve with resilient seals utilized to satisfy Required Action E.2 must have been demonstrated to meet the leakage requirements of SR 3.6.3.5. The specified Completion Time is reasonable, considering that one containment purge valve remains closed so that a major violation of containment does not exist.
Following completion of Required Action E.1, verification that the affected penetration flow path remains isolated must be performed in accordance with Required Action D.2.
F.1 and F.2 If the Required Actions and associated Completion Times are not met, the plant must be brought to a MODE in which the LCO does not apply.
To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE          SR 3.6.3.1 REQUIREMENTS This SR ensures that the mini-purge valves are closed except when the valves are opened under administrative control. The mini-purge valves are capable of closing in the environment following a LOCA. Therefore, these valves are allowed to be open for limited periods of time. The valves may be opened for pressure control, ALARA or air quality considerations for personnel entry, maintenance activities, operational requirements, or for Surveillances that require the valves to be open. To be opened, the valves must be capable of closing under accident conditions, the containment isolation signal to the valves must be OPERABLE, and the effluent release must be monitored to ensure that it remains within regulatory limits. The Surveillance Frequency is controlled under the Surveillance Frequency Program.
R.E. Ginna Nuclear Power Plant                    B 3.6.3-11                                Revision 77
 
Containment Isolation Boundaries B 3.6.3 SR 3.6.3.2 This SR requires verification that each containment isolation boundary located outside containment and not locked, sealed or otherwise secured in the required position is performing its containment isolation accident function. Containment isolation boundaries located beneath Appendix R fire wrap may be considered secured in the required position due to the administrative controls in place provided that a verification of the boundary position was made prior to securing the fire wrap. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside of the containment barrier is within design limits. This SR does not require any testing or valve manipulation. Rather, it involves verification, through a system walkdown, that those isolation boundaries outside containment and capable of being mispositioned are in the correct position. This includes manual valves, blind flanges, pipe and end caps, and closed systems. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The SR specifies that isolation boundaries that are open under administrative controls are not required to meet the SR during the time the boundaries are open.
The SR is modified by two notes. The first Note applies to containment isolation boundaries located in high radiation areas and allows these boundaries to be verified closed by use of administrative means.
Allowing verification by administrative means (e.g., procedure control) is considered acceptable, since access to these areas is typically restricted during MODES 1, 2, 3 and 4 for ALARA reasons. Therefore, the probability of misalignment of these isolation boundaries, once they have been verified to be in the proper position, is small. The Second Note states that this SR is not applicable to containment isolation boundaries which receive an automatic signal since the isolation times of these valves are verified by SR 3.6.3.4 and the boundaries are required to be OPERABLE.
SR 3.6.3.3 This SR requires verification that each containment isolation boundary located inside containment and not locked, sealed or otherwise secured in the required position is performing its containment isolation accident function. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside of the containment barrier is within design limits. This SR does not require any testing or valve manipulation.
Rather, it involves verification, through a system walkdown, that those isolation boundaries inside containment and capable of being mispositioned are in the correct position. This includes manual valves, blind flanges, pipe and end caps, and closed systems. Since containment isolation boundaries are maintained under administrative controls, the R.E. Ginna Nuclear Power Plant              B 3.6.3-12                                  Revision 78
 
Containment Isolation Boundaries B 3.6.3 probability of their misalignment is low and Frequency of "prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is appropriate. The SR specifies that isolation boundaries that are open under administrative controls are not required to meet the SR during the time they are open.
The SR is modified by two notes. The first Note applies to containment isolation boundaries located in high radiation areas and allows these boundaries to be verified closed by use of administrative means.
Allowing verification by administrative means (e.g., procedure control) is considered acceptable, since access to these areas is typically restricted during MODES 1, 2, 3, and 4 for ALARA reasons. Therefore, the probability of misalignment of these isolation boundaries, once they have been verified to be in the proper position, is small. The Second Note states that this SR is not applicable to containment isolation boundaries which receive an automatic signal since the signal provides assurance the valve will be closed following an accident.
SR 3.6.3.4 Verifying that the isolation time of each automatic containment isolation valve is within limits is required to demonstrate OPERABILITY. The isolation time test ensures the valve will isolate in a time period less than or equal to that assumed in the safety analyses. The isolation time and Frequency of this SR are in accordance with the INSERVICE TESTING PROGRAM.
SR 3.6.3.5 For containment mini-purge valves with resilient seals, additional leakage rate testing beyond the test requirements of 10 CFR 50, Appendix J, Option B, is required to ensure OPERABILITY. Operating experience has demonstrated that this type of seal has the potential to degrade in a shorter time period than do other seal types. Based on this observation and the importance of maintaining this penetration leak tight (due to the direct path between containment and the outside environment), a leakage acceptance criteria of  0.05 La when tested at  Pa is specified for each mini-purge isolation valve with resilient seals in the Containment Leakage Rate Testing Program. The Frequency of testing is also specified in the Containment Leakage Rate Program.
R.E. Ginna Nuclear Power Plant                      B 3.6.3-13                          Revision 81
 
Containment Isolation Boundaries B 3.6.3 SR 3.6.3.6 Automatic containment isolation valves close on a containment isolation signal to prevent leakage of radioactive material from containment following a DBA. This SR ensures that each automatic containment isolation valve will actuate to its isolation position on a containment isolation signal. This surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES            1. Atomic Industry Forum GDC 53 and 57, issued for comment July 10, 1967.
: 2. Branch Technical Position CSB 6-4, "Containment Purging During Normal Operation."
: 3. UFSAR, Section 6.2.4 and Table 6.2-15.
: 4. Regulatory Guide 1.4, Revision 2.
: 5. 10 CFR 50, Appendix A, GDC 55, 56, and 57.
: 6. Ginna Station Procedure A-3.3.
: 7. NUREG-0800, Section 6.2.4.
R.E. Ginna Nuclear Power Plant              B 3.6.3-14                                    Revision 78
 
Containment Pressure B 3.6.4 B 3.6    CONTAINMENT SYSTEMS B 3.6.4      Containment Pressure BASES BACKGROUND            The containment structure serves to contain radioactive material that may be released from the reactor core following a Design Basis Accident (DBA). The containment pressure is limited during normal operation to preserve the initial conditions assumed in the accident analyses for a loss of coolant accident (LOCA) and steam line break (SLB). These limits also prevent the containment pressure from exceeding the containment design negative pressure differential with respect to the outside atmosphere.
Containment pressure is a process variable that is monitored and controlled. The containment pressure limits are derived from the input conditions used in the containment functional analyses and the containment structure external pressure analysis. Should operation occur outside these limits coincident with a DBA, post accident containment pressures could exceed calculated values. Exceeding containment design pressure may result in leakage greater than that assumed in the accident analysis. Operation with containment pressure outside the limits of the LCO violates an initial condition assumed in the accident analysis.
APPLICABLE            Containment internal pressure is an initial condition used in the DBA SAFETY                analyses performed to establish the maximum peak containment internal ANALYSES              pressure. The limiting DBAs considered, relative to containment pressure, are the LOCA and SLB, which are analyzed using computer codes designed to predict the resultant containment pressure transients.
No two DBAs are assumed to occur simultaneously or consecutively.
The worst case SLB generates larger mass and energy releases than the worst case LOCA. Thus, the SLB event bounds the LOCA event from the containment peak pressure standpoint (Ref. 1).
The initial pressure condition used in the containment analysis was 15.7 psia (1.0 psig). The maximum containment pressure resulting from the worst case SLB, 59.7 psig, does not exceed the containment design pressure, 60 psig.
The containment was also designed for an external pressure load equivalent to -2.5 psig. However, internal pressure is limited to -2.0 psig based on concerns related to providing continued cooling for the reactor coolant pump motors inside containment.
R.E. Ginna Nuclear Power Plant                    B 3.6.4-1                                Revision 72
 
Containment Pressure B 3.6.4 For certain aspects of transient accident analyses, maximizing the calculated containment pressure is not conservative. In particular, the cooling effectiveness of the Emergency Core Cooling System during the core reflood phase of a LOCA analysis increases with increasing containment backpressure. Therefore, for the reflood phase, the containment backpressure is calculated in a manner designed to conservatively minimize, rather than maximize, the containment pressure response in accordance with 10 CFR 50, Appendix K (Ref. 2). Service Water System (LCO 3.7.8) temperature plays an important role in both maximizing and minimizing containment pressure following a DBA response.
Containment pressure satisfies Criterion 2 of the NRC Policy Statement.
LCO                  Maintaining containment pressure at less than or equal to the LCO upper pressure limit ensures that, in the event of a DBA, the resultant peak containment accident pressure will remain below the containment design pressure. Maintaining containment pressure at greater than or equal to the LCO lower pressure limit ensures that the containment will not exceed the design negative differential pressure. However, the lower pressure limit specified for this LCO is set at a more limiting pressure to ensure continued cooling of the reactor coolant pump motors inside containment which are required to be OPERABLE for a large portion of MODES 1, 2, 3, and 4.
APPLICABILITY        In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material into containment. Since maintaining containment pressure within limits is essential to ensure initial conditions assumed in the accident analyses are maintained, the LCO is applicable in MODES 1, 2, 3 and 4.
In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, maintaining containment pressure within the limits of the LCO is not required in MODE 5 or 6.
ACTIONS              A.1 When containment pressure is not within the limits of the LCO, it must be restored to within these limits within 8 hours. The Required Action is necessary to return operation to within the bounds of the containment analysis. The 8 hour Completion Time is greater than the ACTIONS of LCO 3.6.1, "Containment," which requires that containment be restored R.E. Ginna Nuclear Power Plant                B 3.6.4-2                                  Revision 78
 
Containment Pressure B 3.6.4 to OPERABLE status within 1 hour. However, due to the large containment free volume and limited size of the containment Mini-Purge System, 8 hours is allowed to restore containment pressure to within limits. This is justified by the low probability of a DBA during this time period.
B.1 and B.2 If containment pressure cannot be restored to within limits within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE          SR 3.6.4.1 REQUIREMENTS Verifying that containment pressure is within limits ensures that plant operation remains within the limits assumed in the containment analysis.
This verification should normally be performed using PI-944. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
Calibration of PI-944 or other containment pressure monitoring devices should be performed in accordance with industry standards.
REFERENCES            1. UFSAR, Section 6.2.1.2.
: 2. 10 CFR 50, Appendix K.
R.E. Ginna Nuclear Power Plant                B 3.6.4-3                                  Revision 77
 
Containment Air Temperature B 3.6.5 B 3.6    CONTAINMENT SYSTEMS B 3.6.5      Containment Air Temperature BASES BACKGROUND            The containment structure serves to contain radioactive material that may be released from the reactor core following a Design Basis Accident (DBA). The containment average air temperature is limited during normal operation to preserve the initial conditions assumed in the accident analyses for a loss of coolant accident (LOCA) and steam line break (SLB).
The containment average air temperature limit is derived from the input conditions used in the containment functional analyses and the containment structure external pressure analyses. This LCO ensures that initial conditions assumed in the analysis of containment response to a DBA are not violated during plant operations. The total amount of energy to be removed from containment by the Containment Spray (CS) and Containment Recirculation Fan Cooler (CRFC) Systems during post accident conditions is dependent upon the energy released to the containment due to the event, as well as the initial containment temperature and pressure. The higher the initial temperature, the more energy that must be removed, resulting in higher peak containment pressure and temperature. Exceeding containment design pressure may result in leakage greater than that assumed in the accident analysis.
Operation with containment temperature in excess of the LCO limit violates an initial condition assumed in the accident analysis.
APPLICABLE            Containment average air temperature is an initial condition used in the SAFETY                DBA analyses to ensure that the total amount of energy within ANALYSES              containment is within the capacity of the CS and CRFC Systems. The containment average air temperature is also an important consideration in establishing the containment environmental qualification operating envelope for both pressure and temperature. The limit for containment average air temperature ensures that operation is maintained within the assumptions used in the DBA analyses for containment (Ref. 1).
The limiting DBAs considered relative to containment OPERABILITY are the LOCA and SLB which are analyzed using computer codes designed to predict the resultant containment pressure transients. No two DBAs are assumed to occur simultaneously or consecutively. The postulated DBAs are analyzed with regard to the capability of the Engineered Safety Feature (ESF) systems to mitigate the accident, assuming the worst case single active failure. Consequently, the ESF systems must continue to R.E. Ginna Nuclear Power Plant                B 3.6.5-1                                Revision 78
 
Containment Air Temperature B 3.6.5 function within the environment resulting from the DBA which includes humidity, pressure, temperature, and radiation considerations.
The initial containment average air temperature assumed in the design basis analyses (Ref. 1) is 125&#xba;F. The postulated SLB accident results in maximum containment air temperatures that can exceed 350&#xba;F.
The initial temperature limit specified in this LCO is also used to establish the environmental qualification operating envelope for containment. The maximum SLB peak containment air temperature was calculated to exist for only a few seconds during the transient. The basis of the containment design temperature, however, is to ensure the performance of safety related equipment inside containment (Ref. 2). Thermal analyses show that the time interval during which the containment air temperature peaked was short enough that the equipment surface temperatures remained below their design temperatures. Also, the equipment and cabling inside containment are protected against the direct effects of a SLB by concrete floors and shields. Therefore, it was concluded that the calculated transient containment air temperature following a LOCA (284.96&#xba;F) becomes limiting for environmental qualification reasons and is below the containment analysis criteria of the containment design temperature of 286&#xba;F.
The containment pressure transient is sensitive to the initial air mass in containment and, therefore, to the initial containment air temperature.
The limiting DBA for establishing the maximum peak containment internal pressure is a SLB. The temperature limit is used in this analysis to ensure that in the event of an accident the maximum allowable containment internal pressure will not be exceeded.
Containment average air temperature satisfies Criterion 2 of the NRC Policy Statement.
LCO                  During a DBA, with an initial containment average air temperature less than or equal to the LCO temperature limit, the resultant peak accident temperature is maintained below the containment design temperature.
As a result, the ability of containment to perform its design function is ensured and the OPERABILITY of equipment within containment is maintained.
APPLICABILITY        In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material into containment. In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, maintaining R.E. Ginna Nuclear Power Plant                    B 3.6.5-2                                  Revision 72
 
Containment Air Temperature B 3.6.5 containment average air temperature within the limit is not required in MODE 5 or 6.
ACTIONS              A.1 When containment average air temperature is not within the limit of the LCO, it must be restored to within the limit within 24 hours. This Required Action is necessary to return operation to within the bounds of the containment analysis. The 24 hour Completion Time is acceptable considering the sensitivity of the analysis to variations in this parameter and provides sufficient time to correct minor problems.
B.1 and B.2 If the containment average air temperature cannot be restored to within its limit within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE          SR 3.6.5.1 REQUIREMENTS Verifying that containment average air temperature is within the LCO limit ensures that containment operation remains within the limit assumed for the containment analyses. In order to determine the containment average air temperature, an arithmetic average is calculated using measurements taken at locations within the containment selected to provide a representative sample of the overall containment atmosphere.
There are 6 containment air temperature indicators (TE-6031, TE-6035, TE-6036, TE-6037, TE-6038, and TE-6045) such that a minimum of three should be used for calculating the arithmetic average. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
Calibration of these temperature indicators shall be performed in accordance with industry standards.
R.E. Ginna Nuclear Power Plant                B 3.6.5-3                                  Revision 77
 
Containment Air Temperature B 3.
 
==6.5 REFERENCES==
: 1. UFSAR, Section 6.2.1.2.
: 2. 10 CFR 50.49.
R.E. Ginna Nuclear Power Plant            B 3.6.5-4                  Revision 72
 
CS, CRFC and NaOH Systems B 3.6.6 B 3.6    CONTAINMENT SYSTEMS B 3.6.6      Containment Spray (CS), Containment Recirculation Fan Cooler (CFRC) and NaOH Systems BASES BACKGROUND            The CS and CRFC systems provide containment atmosphere cooling to limit post accident pressure and temperature in containment to less than the design values. Reduction of containment pressure and the iodine removal capability of the CS System and the NaOH System reduces the release of fission product radioactivity from containment to the environment, in the event of a Design Basis Accident (DBA), to within limits. The CS, CRFC and NaOH are designed to meet the requirements of Atomic Industry Forum (AIF) GDC 49, 52, 58, 59, 60, and 61 (Ref. 1).
The CS and NaOH also are designed to limit offsite doses following a DBA within 10 CFR <50.67 guidelines.
The CRFC System, CS System and NaOH System are Engineered Safety Feature (ESF) systems. They are designed to ensure that the heat removal capability required during the post accident period can be attained and reduce the potential release of radioactive material, principally iodine, from the containment to the outside environment. The CS System, CRFC System and NaOH System provide redundant methods to limit and maintain post accident conditions to less than the containment design values.
Containment Spray and NaOH Systems The CS System consists of two redundant, 100% capacity trains. Each train includes a pump, spray headers, spray eductors, nozzles, valves, and piping (see Figure B 3.6.6-1). Each train is powered from a separate ESF bus. The refueling water storage tank (RWST) supplies borated water to the CS System during the injection phase of operation through a common supply header shared by the safety injection (SI) system. In the recirculation mode of operation, CS pump suction can be transferred from the RWST to Containment Sump B via the residual heat removal (RHR) system.
R.E. Ginna Nuclear Power Plant                B 3.6.6-1                                Revision 76
 
CS, CRFC and NaOH Systems B 3.6.6 The CS System provides a spray of cold borated water mixed with sodium hydroxide (NaOH) from the spray additive tank into the upper regions of containment to reduce the containment pressure and temperature and to scavenge fission products from the containment atmosphere during a DBA. The RWST solution temperature is an important factor in determining the heat removal capability of the CS System during the injection phase. In the recirculation mode of operation, heat is removed from the containment sump water by the residual heat removal coolers. However, the CS System can provide additional containment heat removal capability if required. Each train of the CS System provides adequate spray coverage to meet the system design requirements for containment heat removal.
The NaOH mixture is injected into the CS flowpath via a liquid eductor during the injection phase of an accident. The eductors ensure that the pH of the spray mixture is a caustic solution. The NaOH added in the spray ensures an alkaline pH for the solution recirculated in the containment sump. The alkaline pH of the containment sump water minimizes the evolution of iodine and minimizes the occurrence of chloride and caustic stress corrosion on mechanical systems and components exposed to the fluid (Ref. 2).
The CS System is actuated either automatically by a containment Hi-Hi pressure signal or manually. DBAs which can generate an automatic actuation signal include the loss of coolant accident (LOCA) and steam line break (SLB). An automatic actuation opens the CS pump motor operated discharge valves (860A, 860B, 860C, and 860D), opens NaOH addition valves 836A and 836B, starts the two CS pumps, and begins the injection phase. A manual actuation of the CS System requires the operator to actuate two separate pushbuttons simultaneously on the main control board to begin the same sequence. The injection phase continues until an RWST low level alarm is received signaling the start of the recirculation phase of the accident.
During the recirculation phase of LOCA recovery, RHR pump suction is manually transferred to Containment Sump B (Refs. 3 and 4). This transfer is accomplished by stopping the RHR pumps, isolating RHR from the RWST by closing motor operated valve 856, opening the Containment Sump B motor operated isolation valves to RHR (850A and 850B) and then starting the RHR pumps. The SI and CS pumps are then stopped and the RWST isolated by closing motor operated isolation valve 896A or 896B for the SI and CS pump common supply header and closing motor operated isolation valve 897 or 898 for the SI pumps recirculation line.
R.E. Ginna Nuclear Power Plant              B 3.6.6-2                                  Revision 76
 
CS, CRFC and NaOH Systems B 3.6.6 The RHR pumps then supply the SI pumps if the RCS pressure remains above the RHR pump shutoff head as correlated through core exit temperature, containment pressure, and reactor vessel level indications (Ref. 5). This high-head recirculation path is provided through RHR motor operated isolation valves 857A, 857B, and 857C. These isolation valves are interlocked with 896A, 896B, 897, and 898. This interlock prevents opening of the RHR high head recirculation isolation valves unless either 896A or 896B are closed and either 897 or 898 are closed.
If RCS pressure is such that RHR provides adequate injection flow for core cooling, the SI pumps remain in pull-stop.
The CS System is only used during the recirculation phase if containment pressure increases above a pressure at which containment integrity is potentially challenged. Otherwise, the containment heat removal provided by the CRFC units and Containment Sump B (via the RHR system) is adequate to support containment heat removal needs and the limits on sump pH (Refs. 2 and 6).
Operation of the CS System in the recirculation mode is controlled by the operator in accordance with the emergency operating procedures.
Containment Recirculation Fan Cooler System The CRFC System consists of four fan units (A, B, C, and D). Each cooling unit consists of a motor, fan, cooling coils, dampers, moisture separators, high efficiency particulate air (HEPA) filters, duct distributors and necessary instrumentation and controls (see Figure B 3.6.6-2).
CRFC units A and D are supplied by one ESF bus while CRFC units B and C are supplied by a redundant ESF bus. All four CRFC units are supplied cooling water by the Service Water (SW) System via a common loop header. Air is drawn into the coolers through the fan and discharged into the containment atmosphere including the various compartments (e.g., steam generator and pressurizer compartments). Although the charcoal filters associated with the A and C CRFC's are aligned during an SI, they are not credited for iodine removal in the dose analysis.
During normal operation, at least two fan units are typically operating.
The CRFC System, operating in conjunction with other containment ventilation and air conditioning systems, is designed to limit the ambient containment air temperature during normal plant operation to less than the limit specified in LCO 3.6.5, "Containment Air Temperature." This temperature limitation ensures that the containment temperature does not exceed the initial temperature conditions assumed for the DBAs.
In post accident operation following a SI actuation signal, the CRFC System fans are designed to start automatically if not already running.
The temperature of the cooling water supplied by SW System (LCO 3.7.8) is an important factor in the heat removal capability of the fan units.
R.E. Ginna Nuclear Power Plant                B 3.6.6-3                                  Revision 76
 
CS, CRFC and NaOH Systems B 3.6.6 APPLICABLE            The CS System and CRFC System limit the temperature and pressure SAFETY                that could be experienced following a DBA. The limiting DBAs ANALYSES              considered are the LOCA and the SLB which are analyzed using computer codes designed to predict the resultant containment pressure and temperature transients. No two DBAs are assumed to occur simultaneously or consecutively. The postulated DBAs are analyzed with regard to containment ESF systems, assuming the worst case single active failure.
The operability requirements for the CS System and the CRFC System are based on the following LOCA long-term containment response assumptions:
: a. A LOCA mass and energy event with a loss of offsite power, and a single failure of an EDG, which causes the loss of one of two containment spray pumps and two of four fan coolers; and
: b. For the LOCA long-term containment response the containment spray is credited only during the injection phase of the transient and is terminated during the transition to sump recirculation.
The analysis and evaluation show that under the worst case scenario, the highest peak containment pressure is 59.7 psig and the peak containment temperature is greater than 350&#xba;F (both experienced during an SLB). Both results meet the intent of the design basis. (See the Bases for LCO 3.6.4, "Containment Pressure," and LCO 3.6.5,"
Containment Temperature," for a detailed discussion.) The analyses and evaluations assume a plant specific power level of 1817MWt, one CS train and one containment cooling train operating, and initial (pre-accident) containment conditions of 125&#xba;F and 1.0 psig. The analyses also assume a response time delayed initiation to provide conservative peak calculated containment pressure and temperature responses.
For certain aspects of transient accident analyses, maximizing the calculated containment pressure is not conservative. In particular, the effectiveness of the Emergency Core Cooling System during the core reflood phase of a LOCA analysis increases with increasing containment backpressure. For these calculations, the containment backpressure is calculated in a manner designed to conservatively minimize, rather than maximize, the containment pressure response in accordance with 10 CFR 50, Appendix K (Ref. 7).
The effect of an inadvertent CS actuation is not considered since there is no single failure, including the loss of offsite power, which results in a spurious CS actuation.
R.E. Ginna Nuclear Power Plant                B 3.6.6-4                                  Revision 76
 
CS, CRFC and NaOH Systems B 3.6.6 The modeled CS System actuation for the containment analysis is based on a response time associated with exceeding the containment Hi-Hi pressure setpoint to achieving full flow through the CS nozzles. To increase the response of the CS System, the injection lines to the spray headers are maintained filled with water. The CS System total response time is 28.5 seconds for one pump to the upper spray header and 26.5 seconds for two pumps (average time between upper and lower spray headers). These total response times (assuming the containment Hi-Hi pressure is reached at time zero) include opening of the required motor operated isolation valve, containment spray pump startup, and spray line filling (Ref. 8).
The modeled CRFC System actuation for the containment analysis is based upon a response time associated with exceeding the SI actuation levels to achieving full CRFC System air and safety grade cooling water flow. The CRFC System total response time of 44 seconds, includes signal delay, DG startup (for loss of offsite power), and service water pump and CRFC unit startup times (Ref. 9).
During a SLB or LOCA, a minimum of two CRFC units and one CS train are required to maintain containment peak pressure and temperature below the design limits.
The CS and NaOH Systems operate to reduce the release of fission product radioactivity from containment to the outside environment in the event of a DBA. The DBAs that result in a release of radioactive iodine within containment are the LOCA or a rod ejection accident (REA). In the analysis for each of these accidents, it is assumed that adequate containment leak tightness is intact at event initiation to limit potential leakage to the environment. Additionally, it is assumed that the amount of radioactive iodine released is limited by reducing the iodine concentration present in the containment atmosphere.
The required iodine removal capability of the CS and NaOH Systems is established by the consequences of the limiting DBA, which is a LOCA.
The accident analyses (Ref. 10) assume that one train of CS (taking suction from the NaOH System), and one CRFC train operate to remove radioactive iodine from the containment atmosphere.
The CS System, CRFC System and NaOH System satisfy Criterion 3 of the NRC Policy Statement.
R.E. Ginna Nuclear Power Plant              B 3.6.6-5                                    Revision 76
 
CS, CRFC and NaOH Systems B 3.6.6 LCO                  During a DBA, a minimum of 2 CRFC units and one CS train are required to maintain the containment peak pressure and temperature below the design limits (Ref. 8). Additionally, one CS train taking suction from the NaOH System and two CRFC units are also required to remove iodine from the containment atmosphere and maintain concentrations below those assumed in the safety analysis. To ensure that these requirements are met, two CS trains, four CRFC units, and the NaOH System must be OPERABLE. Therefore, in the event of an accident, at least one CS train, the NaOH System, and two CRFC units operate, assuming the worst case single active failure occurs.
Each CS train includes a spray pump, spray headers, nozzles, valves, spray eductors, piping, instruments, and controls to ensure an OPERABLE flow path capable of taking suction from the RWST upon an ESF actuation signal and manually transferring suction to Containment Sump B via the RHR pumps. Only the CS pump motor operated discharge valves that are powered by the same electrical train (860A and 860D) that powers the respective CS pump are required to be operable.
The redundant discharge valves (860B and 860C) are not assumed to open following a DBA. Management of gas voids is important to CS System OPERABILITY.
For the NaOH System to be OPERABLE, the volume and concentration of spray additive solution in the tank must be within limits and air operated valves 836A and 836B must be OPERABLE.
Each CRFC unit includes a motor, fan cooling coils, dampers, moisture separators, HEPA filters, duct distributors, instruments, and controls to ensure an OPERABLE flow path.
The LCO is modified by a Note which states that in MODE 4, both CS pumps may be placed in pull-stop, with power restored to motor operated valves 896A and 896B and the valves placed in the closed position for interlock and valve testing of motor operated valves 857A, 857B, and 857C. This Note provides 2 hours for each test of each motor operated valve 857A, 857B, and 857C. The Note is required since the installed interlocks on 857A, 857B, and 857C require closure of valves 896A and 896B while other valve testing (e.g., differential pressure tests) require a pressurized RHR system. Performance of these tests in MODEs 5 and 6 would render the RHR system inoperable when it is required for core cooling.
R.E. Ginna Nuclear Power Plant              B 3.6.6-6                                    Revision 76
 
CS, CRFC and NaOH Systems B 3.6.6 APPLICABILITY        In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment and an increase in containment pressure and temperature requiring the operation of the CS System, CRFC System and NaOH System.
In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Thus, the CS System, CRFC System and NaOH System are not required to be OPERABLE in MODES 5 and 6.
ACTIONS              A.1 With one CS train inoperable, the inoperable CS train must be restored to OPERABLE status within 72 hours. In this Condition, the remaining OPERABLE spray and CRFC units are adequate to perform the iodine removal and containment cooling functions. The 72 hour Completion Time takes into account the redundant heat and iodine removal capability afforded by the CRFCs, reasonable time for repairs, and low probability of a DBA occurring during this period.
B.1 With the NaOH System inoperable, OPERABLE status must be restored within 72 hours. The pH adjustment of the Containment Spray System flow for corrosion protection and iodine removal enhancement is reduced in this condition. The Containment Spray System would still be available and would remove some iodine from the containment atmosphere in the event of a DBA. The 72 hour completion time takes into account the redundant flow path capabilities and the low probability of the worst case DBA occurring during this period.
C.1 and C.2 If the inoperable CS train or the NaOH System cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 84 hours. The allowed Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems. The extended interval to reach MODE 5 allows additional time for attempting restoration of the inoperable component(s) and is reasonable when considering the driving force for a release of radioactive material from the Reactor Coolant System is reduced in MODE 3.
R.E. Ginna Nuclear Power Plant              B 3.6.6-7                                  Revision 76
 
CS, CRFC and NaOH Systems B 3.6.6 D.1 With one or two CRFC units inoperable, the inoperable CRFC unit(s) must be restored to OPERABLE status within 7 days. The inoperable CRFC units provided up to 100% of the containment heat removal needs.
The 7 day Completion Time is justified considering the redundant heat removal capabilities afforded by combinations of the CS System and CRFC System and the low probability of DBA occurring during this period.
E.1 and E.2 If the Required Action and associated Completion Time of Condition D of this LCO are not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
F.1 With two CS trains inoperable, or three or more CRFC units inoperable, the plant is in a condition outside the accident analysis. Therefore, LCO 3.0.3 must be entered immediately.
SURVEILLANCE          SR 3.6.6.1 REQUIREMENTS The applicable SR descriptions from Bases 3.5.2 apply. This SR is required since the OPERABILITY of valves 896A and 896B is also required for the CS System.
SR 3.6.6.2 Verifying the correct alignment for manual, power operated, and automatic valves in the CS flow path provides assurance that the proper flow paths will exist for CS System operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these were verified to be in the correct position prior to locking, sealing, or securing. This SR does not require any testing or valve manipulation.
Rather, it involves verification, through a system walkdown, that those valves outside containment (there are no valves inside containment) and capable of potentially being mispositioned are in the correct position. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
The Surveillance is modified by a Note which exempts system vent flow paths opened under administrative control. The administrative control should be proceduralized and include stationing a dedicated individual at the system vent flow path who is in continuous communication with the R.E. Ginna Nuclear Power Plant                    B 3.6.6-8                                    Revision 77
 
CS, CRFC and NaOH Systems B 3.6.6 operators in the control room. This individual will have a method to rapidly close the system vent flow path if directed.
SR 3.6.6.3 Verifying the correct alignment for manual, power operated, and automatic valves in the NaOH System flow path provides assurance that the proper flow paths will exist for NaOH System operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these were verified to be in the correct position prior to locking, sealing, or securing. This SR does not require any testing or valve manipulation. Rather, it involves verification, through a system walkdown, that those valves outside containment (there are no valves inside containment) and capable of potentially being mispositioned are in the correct position. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.6.6.4 Operating each CRFC unit for  15 minutes ensures that all CRFC units are OPERABLE and that all associated controls are functioning properly. It also ensures that blockage, fan or motor failure, damper failures, or excessive vibration can be detected for corrective action.
The A and C CRFC units must be operated with their respective charcoal filter train in the post accident alignment. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.6.6.5 Verifying cooling water (i.e., SW) flow to each CRFC unit provides assurance that the energy removal capability of the CRFC assumed in the accident analyses will be achieved (Ref. 11). The minimum and maximum SW flows are not required to be specifically determined by this SR due to the potential for a containment air temperature transient.
Instead, this SR verifies that SW flow is available to each CRFC unit.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.6.6.6 Verifying each CS pump's developed head at the flow test point is greater than or equal to the required developed head ensures that spray pump performance has not degraded during the cycle. Flow and differential pressure are normal tests of centrifugal pump performance required by the ASME Code (Ref. 12). Since the CS pumps cannot be tested with flow through the spray headers, they are tested on recirculation flow.
This test confirms one point on the pump design curve and is indicative of overall performance. Such inservice testing confirms component R.E. Ginna Nuclear Power Plant                B 3.6.6-9                                Revision 77
 
CS, CRFC and NaOH Systems B 3.6.6 OPERABILITY, trends performance, and detects incipient failures by abnormal performance. The Frequency of the SR is in accordance with the INSERVICE TESTING PROGRAM.
SR 3.6.6.7 To provide effective iodine removal, the containment spray must be an alkaline solution. Since the RWST contents are normally acidic, the spray additive tank must provide a sufficient volume of spray additive to adjust pH for all water that is injected. This SR is performed to verify the availability of sufficient NaOH solution in the spray additive tank. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. Tank level is also indicated and alarmed in the control room, so that there is high confidence that a substantial change in level would be detected.
SR 3.6.6.8 This SR provides verification of the NaOH concentration in the spray additive tank and is sufficient to ensure that the spray solution being injected into containment is at the correct pH level. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.6.6.9 This SR verifies that the required CRFC unit testing is performed in accordance with the VFTP. The VFTP includes testing HEPA filter performance. The minimum required flow rate through each of the four CRFC units is 33,000 cubic feet per minute at accident conditions (or 38,500 cubic feet per minute at normal operating conditions). Specific test frequencies and additional information are discussed in detail in the VFTP. However, the maximum surveillance interval for refueling outage tests is based on 24 month refueling cycles and not 18 month cycles as defined by Regulatory Guide 1.52 (Ref. 13).
SR 3.6.6.10 These SRs require verification that each automatic CS valve in the flowpath (860A and 860D) actuates to its correct position and that each CS pump starts upon receipt of an actual or simulated actuation of a containment High pressure signal. This surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
R.E. Ginna Nuclear Power Plant                      B 3.6.6-10                            Revision 81
 
CS, CRFC and NaOH Systems B 3.6.6 SR 3.6.6.11 See SR 3.6.6.10 SR 3.6.6.12 This SR requires verification that each CRFC unit, and the charcoal filter train associated with the A and C units, actuates upon receipt of an actual or simulated safety injection signal. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.6.6.13 This SR provides verification that each automatic valve in the NaOH System flow path that is not locked, sealed, or otherwise secured in position (836A and 836B) actuates to its correct position upon receipt of an actual or simulated actuation of a containment Hi-Hi pressure signal.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.6.6.14 To ensure that the correct pH level is established in the borated water solution provided by the CS System, flow through the eductor is verified in accordance with the Surveillance Frequency Control Program. This SR in conjunction with SR 3.6.6.13 provides assurance that NaOH will be added into the flow path upon CS initiation. A minimum flow of 20 gpm through the eductor must be established as assumed in the accident analyses. A flow path must also be verified from the NaOH tank to the eductors. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.6.6.15 With the CS inlet valves closed and the spray header drained of any solution, low pressure air or smoke can be blown through test connections. As an alternative, a visual inspection (e.g. boroscope) of the nozzles or piping could be utilized in lieu of an air or smoke test if a visual inspection is determined to provide an equivalent or a more effective post-maintenance test. A visual inspection may be more effective if the potential for material intrusion is localized and the affected area is accessible. This SR ensures that each spray nozzle is unobstructed and provides assurance that spray coverage of the R.E. Ginna Nuclear Power Plant              B 3.6.6-11                                    Revision 77
 
CS, CRFC and NaOH Systems B 3.6.6 containment during an accident is not degraded. Due to the passive design of the nozzle, and the corrosion resistant design of the system, a test performed following maintenance which could result in nozzle blockage is considered adequate to detect obstruction of the nozzles.
Maintenance that could result in nozzle blockage would be those maintenance activities where the Foreign Material Exclusion program controls were deemed ineffective. For activities, such as valve repair/
replacement, a visual inspection would be the preferred post-maintenance test since small debris in a localized area is the most likely concern. A smoke or air test may be appropriate following an event where a large amount of debris potentially entered the system or borated water was actually discharged through the spray nozzles.
SR 3.6.6.16 Containment Spray System piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the containment spray trains and may also prevent water hammer and pump cavitation.
Selection of Containment Spray System locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration.
Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.
The Containment Spray System is OPERABLE when it is sufficiently filled with water. Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criteria for gas volume at the suction or discharge of a pump), the Surveillance is not met. If it is determined by subsequent evaluation that the Containment Spray System is not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water), the Surveillance may be declared met.
Accumulated gas should be eliminated or brought within the acceptance criteria limits.
Containment Spray System locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative sub-set of susceptible locations. Monitoring may not be practical for locations that R.E. Ginna Nuclear Power Plant                      B 3.6.6-12                                Revision 76
 
CS, CRFC and NaOH Systems B 3.6.6 are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation.
REFERENCES            1. Atomic Industry Forum (AIF) GDC 49, 52, 58, 59, 60, and 61, issued for comment July 10, 1967.
: 2. Branch Technical Position MTEB 6-1, "pH For Emergency Coolant Water For PWRs."
: 3. Letter from D. M. Crutchfield, NRC, to J. E. Maier, RG&E,
 
==Subject:==
 
                                    "SEP Topic VI-7.B: ESF Automatic Switchover from Injection to Recirculation Mode, Automatic ECCS Realignment, Ginna," dated December 31, 1981.
: 4. NUREG-0821.
: 5. UFSAR, Section 6.3.
: 6. UFSAR, Section 6.1.2.4.
: 7. 10 CFR 50, Appendix K.
: 8. UFSAR, Section 6.2.1.2.
: 9. UFSAR, Section 6.2.2.2.
: 10. UFSAR, Section 6.5.
: 11. UFSAR, Section 6.2.2.1.
: 12. ASME Code for Operation and Maintenance of Nuclear Power Plants.
: 13. Regulatory Guide 1.52, Revision 2.
: 14. Design Analysis DA-NS-2001-087, Large Break LOCA Offsite and Control Room Doses.
R.E. Ginna Nuclear Power Plant                    B 3.6.6-13                                Revision 77
 
CS, CRFC and NaOH Systems B 3.6.6 Figure B 3.6.6-1 Containment Spray and NaOH Systems R.E. Ginna Nuclear Power Plant          B 3.6.6-14                        Revision 76
 
CS, CRFC and NaOH Systems B 3.6.6 Figure B 3.6.6-2 CRFC and Containment Post-Accident Charcoal Systems R.E. Ginna Nuclear Power Plant          B 3.6.6-15                          Revision 76
 
MSSVs B 3.7.1 B 3.7    PLANT SYSTEMS B 3.7.1      Main Steam Safety Valves (MSSVs)
BASES BACKGROUND            The primary purpose of the MSSVs is to provide overpressure protection for the secondary system. The MSSVs also provide protection against overpressurizing the reactor coolant pressure boundary (RCPB) by providing a heat sink for the removal of energy from the Reactor Coolant System (RCS) if the preferred (but non safety related) heat sink, provided by the condenser and circulating water system, is not available.
Four MSSVs are located on each main steam header, outside containment in the Intermediate Building, upstream of the main steam isolation valves (Ref. 1). MSSVs 3509, 3511, 3513, and 3515 are located on the steam generator (SG) A main steam header while MSSVs 3508, 3510, 3512 and 3514 are located on the SG B main steam header. The MSSVs are designed to limit the secondary system to  110% of design pressure when passing 100% of design flow. The MSSV design includes staggered setpoints so that only the needed valves will actuate.
Staggered setpoints reduce the potential for valve chattering that is due to steam pressure insufficient to fully open all valves following a turbine/
reactor trip.
APPLICABLE            The design basis for the MSSVs is to limit the secondary system SAFETY                pressure to  110% of design pressure when passing 100% of design ANALYSES              steam flow. This design basis is sufficient to cope with any anticipated operational occurrence (AOO) or accident considered in the Design Basis Accident (DBA) and transient analysis. The events that challenge the relieving capacity of the MSSVs, and thus RCS pressure, are those characterized as decreased RCS heat removal events (Ref. 2). Of these, the full power loss of external load event is the limiting AOO. This event also results in the loss of normal feedwater flow to the SGs.
The transient response for a loss of external load event without a direct reactor trip (i.e., loss of load when < 50% RTP) presents no hazard to the integrity of the RCS or the Main Steam System. For transients at power levels > 50%, the effect on RCS safety limits is evaluated with no credit taken for the pressure relieving capability of pressurizer spray, the steam dump system, and the SG atmospheric relief valves. The reactor is tripped on high pressurizer pressure with the pressurizer safety valves and MSSVs required to be opened to maintain the RCS and Main Steam System within 110% of their design values.
R.E. Ginna Nuclear Power Plant                  B 3.7.1-1                                Revision 58
 
MSSVs B 3.7.1 The MSSVs are assumed to have two active and one passive failure modes. The active failure modes are spurious opening (as an initiating event only), and failure to reclose once opened. The passive failure mode is failure to open upon demand which is not considered in the accident analyses.
The MSSVs satisfy Criterion 3 of the NRC Policy Statement.
LCO                  The accident analysis requires four MSSVs per steam generator to provide overpressure protection for design basis transients occurring at 1817 MWt. The OPERABILITY of the MSSVs is defined as the ability to open within the setpoint tolerances, relieve SG overpressure, and reseat when pressure has been reduced. The OPERABILITY of the MSSVs is determined by periodic surveillance testing in accordance with the INSERVICE TESTING PROGRAM.
The lift settings, according to SR 3.7.1.1 in the accompanying LCO, correspond to ambient conditions of the valve at nominal operating temperature and pressure.
This LCO provides assurance that the MSSVs will perform their designed safety functions to mitigate the consequences of accidents that could result in a challenge to the RCPB or secondary system.
APPLICABILITY        In MODES 1, 2, and 3, four MSSVs per SG are required to be OPERABLE to ensure that the RCS remains within its pressure safety limit and that the secondary system, from the SGs to the main steam isolation valves, is limited to  110% of design pressure for all DBAs.
In MODES 4 and 5, there are no credible transients requiring the MSSVs.
The SGs are not normally used for heat removal in MODES 5 and 6, and thus cannot be overpressurized; there is no requirement for the MSSVs to be OPERABLE in these MODES.
R.E. Ginna Nuclear Power Plant                            B 3.7.1-2                      Revision 81
 
MSSVs B 3.7.1 ACTIONS              The ACTIONS table is modified by a Note indicating that separate Condition entry is allowed for each MSSV.
A.1 With one or more MSSVs inoperable, the assumptions used in the accident analysis for loss of external load may no longer be valid and the safety valve(s) must be restored to OPERABLE status within 4 hours.
This Condition specifically addresses the appropriate ACTIONS to be taken in the event that a non-significant discrepancy related to the MSSVs is discovered with the plant operating in MODES 1, 2, or 3.
Examples of this type of discrepancy include administrative (e.g.,
documentation of inspection results) or similar deviations which do not result in a loss of MSSV capability to relieve steam. The 4 hour Completion Time allows a reasonable period of time for correction of administrative only problems or for the plant to contact the NRC to discuss appropriate action. The 4 hour Completion time is based on engineering judgement.
This Condition is not applicable to a situation in which the ability of a MSSV to open or reclose is questionable. In this event, this Condition is no longer applicable and Condition B of this LCO should be entered immediately since no corrective actions can be implemented during MODES 1, 2, and 3.
B.1 and B.2 If the MSSV(s) cannot be restored to OPERABLE status within the associated Completion Time, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours, and in MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
R.E. Ginna Nuclear Power Plant              B 3.7.1-3                                    Revision 58
 
MSSVs B 3.7.1 SURVEILLANCE          SR 3.7.1.1 REQUIREMENTS This SR verifies the OPERABILITY of the MSSVs by the verification of each MSSV lift setpoint in accordance with the INSERVICE TESTING PROGRAM. The ASME Code (Ref. 3), requires that safety and relief valve tests be performed in accordance with Appendix I of ASME OM Code- 1998 (Ref. 4). According to Reference 4, the following tests are required:
: a.      Visual examination;
: b.      Seat tightness determination;
: c.      Setpoint pressure determination (lift setting);
: d.      Compliance with owner's seat tightness criteria; and
: e.      Verification of the balancing device integrity on balanced valves.
The ASME Standard requires that all valves be tested every 5 years, and a minimum of 20% of the valves be tested every 24 months. The ASME Code specifies the activities and frequencies necessary to satisfy the requirements. This SR allows a +1% and -3% setpoint tolerance for OPERABILITY; however, the valves are reset to +/--1% during the Surveillance to allow for drift.
This SR is modified by a Note that allows entry into and operation in MODE 3 prior to performing the SR. The MSSVs may be either bench tested or tested in situ at hot conditions using an assist device to simulate lift pressure. If the MSSVs are not tested at hot conditions, the lift setting pressure shall be corrected to ambient conditions of the valve at operating temperature and pressure.
REFERENCES            1.      UFSAR, Section 10.3.2.4.
: 2.      UFSAR, Section 15.2.
: 3.      ASME Code for Operation and Maintenance of Nuclear Power Plants.
: 4.      Appendix I of ASME OM Code-1998.
R.E. Ginna Nuclear Power Plant                      B 3.7.1-4                                Revision 81
 
MSIVs and Non-Return Check Valves B 3.7.2 B 3.7    PLANT SYSTEMS B 3.7.2      Main Steam Isolation Valves (MSIVs) and Non-Return Check Valves BASES BACKGROUND            The MSIVs (3516 and 3517) isolate steam flow from the secondary side of the steam generators (SGs) following a Design Basis Accident (DBA).
MSIV closure is necessary to isolate a SG affected by a steam generator tube rupture (SGTR) event or a steam line break (SLB) to stop the loss of SG inventory and to protect the integrity of the unaffected SG for decay heat removal. The MSIVs are air operated swing disk check valves that are held open by an air operator against spring pressure. The MSIVs are installed to use steam flow to assist in the closure of the valve (Ref. 1).
A MSIV is located in each main steam line header outside containment in the Intermediate Building. The MSIVs are downstream from the main steam safety valves (MSSVs) and turbine driven auxiliary feedwater (AFW) pump steam supply, to assure the MSSVs prevent overpressure on the secondary side and assure steam is available to the AFW system following MSIV closure. Closing the MSIVs isolates each SG from the other, and isolates the turbine, steam dump system, and other auxiliary steam supplies from the SGs.
The MSIVs close on a main steam isolation signal generated by either high containment pressure, high steam flow coincident with low Tavg and safety injection (SI), or high-high steam flow coincident with SI.
The MSIVs are designed to work with non-return check valves (3518 and 3519) located immediately downstream of each MSIV to preclude the blowdown of more than one SG following a SLB. The MSIVs fail closed on loss of control or actuation power and loss of instrument air once the air is bled off from the supply line. The MSIVs may also be actuated manually.
Each MSIV has a normally closed manual MSIV bypass valve.
R.E. Ginna Nuclear Power Plant                B 3.7.2-1                                  Revision 58
 
MSIVs and Non-Return Check Valves B 3.7.2 APPLICABLE          The design basis of the MSIVs and non-return check valves is SAFETY              established by the large SLB (Ref. 2). The SLB is evaluated for two ANALYSES            cases, one with respect to reactor core response and the second with respect to containment integrity. The SLB for reactor core response is evaluated assuming initial conditions and single failures which have the highest potential for power peaking or departure from nucleate boiling (DNB). The most limiting single failure for this evaluation is the loss of a safety injection pump which reduces the rate of boron injection into the Reactor Coolant System (RCS) delaying the return to subcriticality. The MSIV on the intact SG for this case is assumed to close to prevent excessive cooldown of the RCS which could result in a lower DNB ratio.
The SLB for containment integrity is evaluated assuming initial conditions and single failures which result in the addition of the largest amount of mass and energy into containment. For this scenario, offsite power is assumed to be available and reactor power is below 100% RTP. With offsite power available, the reactor coolant pumps continue to circulate coolant maximizing the RCS cooldown. At lower power levels, the SG inventory and temperature are at their greatest, which maximizes the analyzed mass and energy release to containment. Due to the non-return check valve on the faulted SG, reverse flow from the steam headers downstream of the MSIV and from the intact SG is prevented from contributing to the energy and mass released inside containment by the SLB. This check valve is a passive device which is not assumed to fail.
SLBs outside of containment can occur in the Intermediate Building and downstream of the MSIVs in the Turbine Building. A SLB in piping > 6 inches diameter in the Intermediate Building is not required to be considered due to an augmented piping inspection program (Ref. 3). For a SLB in the Turbine building, the MSIVs on both SGs must close to isolate the break and terminate the event.
The MSIVs are also credited in a SGTR to manually isolate the SG with the ruptured tube. In addition to minimizing the radiological releases, this assists the operator in isolating the RCS flow through the ruptured SG by preventing the SG from continuing to depressurize and creating a higher pressure difference between the secondary system and the primary system.
The MSIVs are also considered in other DBAs such as the feedwater line break in which closure of the MSIV on the intact SG maximizes the effect of the break since the energy removal capability of the intact SG would be reduced with respect to long term heat removal.
R.E. Ginna Nuclear Power Plant              B 3.7.2-2                                  Revision 58
 
MSIVs and Non-Return Check Valves B 3.7.2 In addition to providing isolation of a faulted SG during a SLB, feedwater line break, or a SGTR, the MSIVs also serve as a containment isolation boundary. The MSIVs are the second containment isolation boundary for the main steam line penetrations which use the steam lines and SGs inside containment as the first boundary. The MSIVs do not receive an automatic containment isolation signal since a spurious signal could result in a significant plant transient.
The MSIVs and non-return check valves satisfy Criterion 3 of the NRC Policy Statement.
LCO                  This LCO requires that two MSIVs and the non-return check valves in the steam lines be OPERABLE. The MSIVs are considered OPERABLE when their isolation times are within limits and they can close on an isolation actuation signal. A MSIV must also be capable of isolating a SG for containment isolation purposes. The non-return check valves are considered OPERABLE when they are capable of closing.
This LCO provides assurance that the MSIVs and non-return check valves will perform their design safety function to mitigate the consequences of accidents that could result in offsite exposures comparable to the 10 CFR 50.67 (Ref. 4) limits.
APPLICABILITY        The MSIVs and non-return check valves must be OPERABLE in MODES 1, 2, and 3 when there is significant mass and energy in the RCS and SGs to challenge the integrity of containment, or allow a transient to approach DNBR limits. When the MSIVs are closed and de-activated in MODES 2 and 3, they are already performing their safety function and the MSIVs and their associated non-return check valves are not required to be OPERABLE per this LCO.
In MODE 4, the MSIVs and non-return check valves are normally closed, and the RCS and SG energy is low. In MODE 5 or 6, the SGs do not contain much energy because their temperature is below the boiling point of water; therefore, the MSIVs and non-return check valves are not required for isolation of potential main steam pipe breaks in these MODES.
R.E. Ginna Nuclear Power Plant                B 3.7.2-3                                Revision 58
 
MSIVs and Non-Return Check Valves B 3.7.2 ACTIONS              A.1 With one or more valves inoperable in flow path from a SG in MODE 1, ACTION must be taken to restore OPERABLE status within 8 hours.
Some repairs to these valves can be made with the plant under hot conditions. The 8 hour Completion Time is reasonable, considering the low probability of an accident occurring during this time period that would require a closure of the MSIVs and non-return check valves and the ability to isolate the affected SG by turbine stop valves.
The 8 hour Completion Time is greater than that normally allowed for containment isolation boundaries because the MSIVs are valves that isolate a closed system penetrating containment. These valves differ from most other containment isolation boundaries in that the closed system provides an additional means for containment isolation. Failure of this closed system can only result from a SGTR which is not postulated to occur with any other DBA (e.g., LOCA).
B.1 If the MSIV and/or non-return check valve from a SG cannot be restored to OPERABLE status within 8 hours, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in MODE 2 within 6 hours and Condition C would be entered.
The Completion Time is reasonable, based on operating experience, to reach MODE 2 in an orderly manner without challenging plant systems.
C.1 and C.2 Since the MSIVs and non-return check valve are required to be OPERABLE in MODES 2 and 3, the inoperable valve(s) may either be restored to OPERABLE status or the associated MSIV closed. When closed, the MSIVs are already in the position required by the assumptions in the safety analysis and the non-return check valve is no longer required.
The 8 hour Completion Time is consistent with that allowed in Condition A.
For inoperable valves that cannot be restored to OPERABLE status within the specified Completion Time, but the associated MSIV is closed, the MSIV must be verified on a periodic basis to be closed. This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day Completion Time is reasonable, based on engineering judgement, in view of MSIV status indications available in the control room, and other administrative controls, to ensure that these valves are in the closed position.
R.E. Ginna Nuclear Power Plant                B 3.7.2-4                                Revision 58
 
MSIVs and Non-Return Check Valves B 3.7.2 D.1 and D.2 If the MSIVs and/or non-return check valve cannot be restored to OPERABLE status or the associated MSIV is not closed within the associated Completion Time, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be placed at least in MODE 3 within 6 hours, and in MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from MODE 2 conditions in an orderly manner without challenging plant systems.
E.1 If one or more valves in the flow path from each SG are inoperable, the plant is in a condition outside of the accident analyses; therefore, LCO 3.0.3 must be entered immediately. This Condition must be entered when any combination of MSIVs and non-return check valves are inoperable such that at least one valve is inoperable in each of the two main steam flow paths.
SURVEILLANCE          SR 3.7.2.1 REQUIREMENTS This SR verifies that MSIV closure time is  5 seconds under no flow and no load conditions. The MSIVs are swing-disk check valves that are held open by their air operators against spring pressure. Once the MSIVs begin to close during hot conditions, the steam flow will assist the valve closure such that testing under no flow and no load conditions is conservative. The 5 second closure time is consistent with the expected response time for instrumentation associated with the MSIV and the accident analysis assumptions.
As the MSIVs are not tested at power, they are exempt from the ASME Code (Ref. 5), requirements during operation in MODE 1, 2, or 3. The Frequency is in accordance with the INSERVICE TESTING PROGRAM.
SR 3.7.2.2 This SR verifies that each main steam non-return check valve can close.
As the non-return check valves are not tested at power, they are exempt from the ASME Code (Ref. 5), requirements during operation in MODE 1, 2, or 3. The Frequency is in accordance with the INSERVICE TESTING PROGRAM.
R.E. Ginna Nuclear Power Plant                    B 3.7.2-5                                  Revision 81
 
MSIVs and Non-Return Check Valves B 3.7.2 SR 3.7.2.3 This SR verifies that each MSIV can close on an actual or simulated actuation signal. This Surveillance is normally performed upon returning the plant to operation following a refueling outage. The MSIVs should not be tested at power, since even a partial stroke exercise increases the risk of a valve closure and plant transient when the plant is above MODE 4.
As the MSIVs are not tested at power, they are exempt from the ASME Code (Ref. 5), requirements during operation in MODES 1, 2 and 3.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES            1. UFSAR, Section 5.4.4.
: 2. UFSAR, Section 15.1.5.
: 3. UFSAR, Section 3.6.2.5.1.
: 4. 10 CFR 50.67.
: 5. ASME Code for Operation and Maintenance of Nuclear Power Plants.
R.E. Ginna Nuclear Power Plant                  B 3.7.2-6                                Revision 77
 
MFIVs, MFRVs, and Associated Bypass Valves B 3.7.3 B 3.7    PLANT SYSTEMS B 3.7.3      Main Feedwater Isolation Valves (MFIVs), Main Feedwater Regulating Valves (MFRVs), and Associated Bypass Valves BASES BACKGROUND            The MFRVs (4269 and 4270) and their associated bypass valves (4271 and 4272), and MFIVs (3994 and 3995) isolate main feedwater (MFW) flow to the secondary side of the steam generators (SGs) following a Design Basis Accident (DBA). The safety related function of the MFRVs, associated bypass valves, and MFIVs is to provide for isolation of MFW flow to the secondary side of the SGs terminating the DBA for line breaks occurring downstream of the valves. Closure effectively terminates the addition of feedwater to an affected SG, limiting the mass and energy release for steam line breaks (SLBs) or feedwater line breaks (FWLBs) inside containment, and reducing the cooldown effects for SLBs.
The MFRVs, associated bypass valves, and MFIVs in conjunction with check valves located in the flowpath also provide a pressure boundary for the controlled addition of auxiliary feedwater (AFW) to the intact SG.
One MFIV is located on each MFW line to its respective SG, outside containment, in the Intermediate Building. One MFRV and associated bypass valve is located on each MFW line to its respective SG, outside containment in the Turbine Building (Ref. 1). The MFRVs, associated bypass valves, and MFIVs are located upstream of the AFW injection point so that AFW may be supplied to the SGs following closure of the MFRVs, bypass valves, and MFIVs. The piping volume from these valves to the SGs is accounted for in calculating mass and energy releases, and must be refilled prior to AFW reaching the SG following either an SLB or FWLB.
The MFIVs close on receipt of a safety injection signal and are actuated by air from local accumulators. The MFRVs and bypass valves close on receipt of a safety injection signal, a SG high level signal, or on a reactor trip with Tavg < 554&#xba;F with the associated MFRV in auto. All valves may also be actuated manually. In addition to the MFRVs, associated bypass valves and MFIVs, a check valve located outside containment for each feedwater line is available. The check valve isolates the feedwater line penetrating containment providing a containment isolation boundary.
APPLICABLE            The design basis of the MFRVs, associated bypass valves, and MFIVs is SAFETY                established by the analyses for the SLB. The SLB is evaluated for two ANALYSES              cases, one with respect to reactor core response and the second with respect to containment integrity (Ref. 2). The SLB for reactor core R.E. Ginna Nuclear Power Plant                B 3.7.3-1                                  Revision 58
 
MFIVs, MFRVs, and Associated Bypass Valves B 3.7.3 response is evaluated assuming initial conditions and single failures which have the highest potential for power peaking or departure from nucleate boiling (DNB). The most limiting single failure for this evaluation is the loss of a safety injection pump which reduces the rate of boron injection into the Reactor Coolant System (RCS) delaying the return to subcriticality. The MFRV and bypass valve on the intact SG for this case are assumed to close on a safety injection signal to prevent excessive cooldown of the RCS which could result in a lower DNB ratio. The failure of either of these valves is bounded by the eventual coastdown of the MFW pumps, which have their breakers opened by a SI signal, and the MFIVs which close on a safety injection signal.
The SLB for containment integrity is evaluated assuming initial conditions and single failures which result in the addition of the largest amount of mass and energy into containment. For this scenario, offsite power is assumed to be available and reactor power is below 100% RTP. With offsite power available, the reactor coolant pumps continue to circulate coolant, maximizing the RCS cooldown. At lower power levels, the SG inventory and temperature are at their greatest, which maximizes the analyzed mass and energy release to containment. The MFRV and bypass valve on the faulted SG are assumed to close on a safety injection signal to prevent continued contribution to the energy and mass released inside containment by the SLB. The failure of either of these valves is bounded by the eventual coastdown of the MFW pumps and closure of the MFIVs.
The MFRVs and bypass valves are also credited for isolation in the feedwater transient analyses (e.g., increase in feedwater flow). These valves close on either a safety injection or high SG level signal depending on the scenario. The valves also must close on a FWLB to limit the amount of additional mass and energy delivered to the SGs and containment.
The failure of the MFRVs to control flow is also considered as an initiating event. This includes consideration of a valve failure coincident with an atmospheric relief valve failure since a single component in the Advanced Digital Feedwater Control System (ADFCS) controls both components (Ref. 3). This combined valve failure accident scenario is evaluated with respect to DNB since a large RCS cooldown is possible with this combination of failures. However, this scenario is bounded by the SLB accident.
The MFRVs, associated bypass valves, and MFIVs satisfy Criterion 3 of the NRC Policy Statement.
R.E. Ginna Nuclear Power Plant              B 3.7.3-2                                  Revision 58
 
MFIVs, MFRVs, and Associated Bypass Valves B 3.7.3 LCO                  This LCO ensures that the MFRVs, associated bypass valves, and MFIVs will isolate MFW flow to the SGs, following a FWLB or SLB.
This LCO requires that two MFIVs, two MFRVs, and two MFRV bypass valves be OPERABLE. The MFRVs, associated bypass valves, and MFIVs are considered OPERABLE when isolation times are within limits and they can close on an isolation actuation signal. The isolation signal from reactor trip with Tavg < 554&#xba;F with the associated MFRV in auto is not a requirement for OPERABILITY. The local MFIV air accumulator is required to be > 265 psig to support MFIV OPERABILITY.
Failure to meet the LCO requirements can result in additional mass and energy being released to containment following an SLB or FWLB inside containment. It may also result in the introduction of water into the main steam lines for an excess feedwater flow event.
APPLICABILITY        The MFRVs, associated bypass valves, and MFIVs valves must be OPERABLE whenever there is significant mass and energy in the RCS and SGs. This ensures that, in the event of a DBA, the accident analysis assumptions are maintained. In MODES 1, 2, and 3, the MFRVs, associated bypass valves, and MFIVs are required to be OPERABLE to limit the amount of available fluid that could be added to containment in the case of a secondary system pipe break inside containment. When the valves are closed and de-activated or isolated by a closed manual valve such that both SGs are isolated from both MFW pumps, they are already performing their safety function and no longer required to be OPERABLE.
In MODE 4, the MFIVs, MFRVs and associated bypass valves, are normally closed since AFW is providing decay heat removal due to the low SG energy level. In MODE 5 or 6, the SGs do not contain much energy because their temperature is below the boiling point of water; therefore, the MFRVs, associated bypass valves, and MFIVs are not required for isolation of potential pipe breaks in these MODES.
ACTIONS              The ACTIONS table is modified by a Note indicating that separate Condition entry is allowed for each valve.
A.1 With one or more MFIV(s) inoperable, action must be taken to restore the affected valve to OPERABLE status, or to close or isolate the inoperable valve within 72 hours. The 72 hour Completion Time takes into account R.E. Ginna Nuclear Power Plant              B 3.7.3-3                                  Revision 58
 
MFIVs, MFRVs, and Associated Bypass Valves B 3.7.3 the redundancy afforded by the remaining OPERABLE valves and the low probability of an event occurring during this time period that would require isolation of the MFW flow paths. The 72 hour Completion Time is reasonable, based on operating experience.
An inoperable MFIV that is closed or isolated must be verified on a periodic basis that it remains closed or isolated. This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day Completion time is reasonable, based on engineering judgement, in view of valve status indications available in the control room, and other administrative controls, to ensure that these valves are closed or isolated.
B.1 and B.2 With one or more MFRV(s) inoperable, action must be taken to restore the affected valve to OPERABLE status, or to close or isolate the inoperable valve within 72 hours. The 72 hour Completion Time takes into account the redundancy afforded by the remaining OPERABLE valves and the low probability of an event occurring during this time period that would require isolation of the MFW flow paths. The 72 hour Completion Time is reasonable, based on operating experience.
An inoperable MFRV that is closed or isolated must be verified on a periodic basis that it remains closed or isolated. This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day Completion time is reasonable, based on engineering judgement, in view of valve status indications available in the control room, and other administrative controls, to ensure that these valves are closed or isolated.
C.1and C.2 With one or more MFRV bypass valve(s) inoperable, action must be taken to restore the affected valve to OPERABLE status, or to close or isolate the inoperable valve within 72 hours. The 72 hour Completion Time takes into account the redundancy afforded by the remaining OPERABLE valves and the low probability of an event occurring during this time period that would require isolation of the MFW flow paths. The 72 hour Completion Time is reasonable, based on operating experience.
An inoperable MFRV bypass valve that is closed or isolated must be verified on a periodic basis that it remains closed or isolated. This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day Completion Time is reasonable, based on engineering judgment, in view of valve status indications available in the control room, and other administrative controls, to ensure that these valves are closed or isolated.
R.E. Ginna Nuclear Power Plant              B 3.7.3-4                                  Revision 58
 
MFIVs, MFRVs, and Associated Bypass Valves B 3.7.3 D.1 With two inoperable valves in the same flow path, there may be no redundant system to operate automatically and perform the required safety function. Although the containment can be isolated with the failure of two valves in parallel in the same flow path, the double failure can be an indication of a common mode failure in the valves of this flow path, and as such, is treated the same as a loss of the isolation capability of this flow path. Under these conditions, affected valves in each flow path must be restored to OPERABLE status, or the affected flow path isolated within 8 hours. This action returns the system to the condition where at least one valve in each flow path is performing the required safety function. The 8 hour Completion Time is reasonable, based on operating experience, to complete the actions required to close the MFIV or MFRV, or otherwise isolate the affected flow path.
E.1 and E.2 If a Required Action and associated completion time is not met, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours, and in MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE          SR 3.7.3.1 REQUIREMENTS This SR verifies that the closure time of each MFIV is  30 seconds from the full open position on an actual or simulated actuation signal. The valve closure times are assumed in the accident and containment analyses. This Surveillance is normally performed upon returning the plant to operation following a refueling outage. These valves should not be tested at power since even a partial stroke exercise increases the risk of a valve closure with the plant generating power. As these valves are not tested at power, they are exempt from the ASME Code (Ref. 4) requirements during operation in MODES 1, 2, and 3.
The Frequency for this SR is in accordance with the INSERVICE TESTING PROGRAM.
SR 3.7.3.2 This SR verifies that the closure time of each MFRV and associated bypass valve is 1 0 seconds from the full open position on an actual or simulated actuation signal. The valve closure times are assumed in the R.E. Ginna Nuclear Power Plant                        B 3.7.3-5                              Revision 81
 
MFIVs, MFRVs, and Associated Bypass Valves B 3.7.3 accident and containment analyses. This Surveillance is normally performed upon returning the plant to operation following a refueling outage. These valves should not be tested at power since even a partial stroke exercise increases the risk of a valve closure with the plant generating power. As these valves are not tested at power, they are exempt from the ASME Code (Ref. 4), requirements during operation in MODES 1, 2, and 3.
The Frequency for this SR is in accordance with the INSERVICE TESTING PROGRAM.
REFERENCES            1. UFSAR, Section 10.4.5.3.
: 2. UFSAR, Section 15.1.5.
: 3. UFSAR, Section 15.1.6.
: 4. ASME Code for Operation and Maintenance of Nuclear Power Plants.
R.E. Ginna Nuclear Power Plant                    B 3.7.3-6                                Revision 81
 
MFIVs, MFRVs, and Associated Bypass Valves B 3.7.3 Figure B 3.7.3-1 MFIVs,MFRVs, and Associated Bypass Valves R.E. Ginna Nuclear Power Plant          B 3.7.3-7                            Revision 58
 
ARVs B 3.7.4 B 3.7    PLANT SYSTEMS B 3.7.4      Atmospheric Relief Valves (ARVs)
BASES BACKGROUND            There is an ARV (3410 and 3411) located on the main steam header from each steam generator (SG). The ARVs are provided with upstream block valves to permit their being tested at power, and to provide an alternate means of isolation. The ARVs have two functions (Ref. 1):
: a. provide secondary system overpressure protection below the setpoint of the main steam safety valves (MSSVs); and
: b. provide a method for cooling the plant should the preferred heat sink via the steam dump system to the condenser not be available.
The accident analyses do not credit either of these functions since the ARVs do not have a safety-related source of motive air and the accident analyses do not typically require cooldown to the residual heat removal entry conditions since the plant was originally designed to maintain Hot Shutdown conditions indefinitely. The only exception is with respect to steam generator tube rupture (SGTR) events which require the use of at least one ARV to provide heat removal from the Reactor Coolant System (RCS) to prevent saturation conditions from developing.
The ARVs are air operated valves located in the Intermediate Building with a relief capacity of 329,000 lbm/hr each (approximately 4% of RTP).
The ARVs are normally closed, fail closed valves which receive motive air from the instrument air system. The valves can also receive motive air from a non-seismic backup nitrogen bottle bank system. The valves are equipped with pneumatic controllers to permit control of the cooldown rate. The ARVs are normally controlled by the Advanced Digital Feedwater Control System (ADFCS) but can also be remote manually operated and opened locally by use of handwheels located on the valves.
R.E. Ginna Nuclear Power Plant                B 3.7.4-1                                Revision 69
 
ARVs B 3.7.4 APPLICABLE            The design basis for the ARVs is established by the SGTR event (Ref. 2).
SAFETY                For this accident scenario, the operator is required to perform a limited ANALYSES              cooldown to establish adequate subcooling as a necessary step to terminate the primary to secondary break flow into the ruptured SG.
Following a SGTR, the MSSVs will maintain the secondary system pressure at approximately 1085 psig which could result in the loss of subcooling margin since the RCS average temperature is attempting to stabilize at approximately 547&#xba;F. The ARVs are used during the first 20 to 60 minutes of the SGTR to continue the RCS cooldown in an effort to reduce, and eventually terminate, the primary to secondary system flow in the ruptured SG. The inability to cooldown could result in inadequate subcooling margin which would delay the termination of the leakage through the ruptured tube.
The opening of the ARVs is also considered coincident with a failure of a main feedwater regulating valve (Ref. 3) since a single component in the ADFCS controls both components. This combined valve failure accident scenario is evaluated with respect to departure from nucleate boiling since a large RCS cooldown is possible with this combination of failures.
However, this scenario is bounded by the steam line break accident.
The ARVs are equipped with block valves in the event the ARV spuriously fails to open or fails to close during use.
The ARVs satisfy Criterion 3 of the NRC Policy Statement.
LCO                  Two ARVs and their associated manual block valves are required to be OPERABLE. The ARVs may be operated either locally (using the handwheel) or remotely to relieve main steam pressure; however, only local operation is credited for OPERABILITY. The ARV block valves must be OPERABLE to isolate a failed open ARV. A closed block valve does not render it or its ARV line inoperable if operator ACTION time to open the block valve can be accomplished within the time frames specified below. Failure to meet the LCO can result in the inability to cool the plant following a SGTR event in which the condenser is unavailable for use with the steam dump system.
An ARV line is considered OPERABLE when it is capable of being locally opened within 8 minutes of determining the need to utilize the ARV following a SGTR. The ARV line must also be capable of being locally closed within 8 minutes in the event the ARV spuriously opens on the SG with the ruptured tube. Finally, the ARV line must be capable of being locally closed within 5 minutes in the event that the ARV on the intact SG fails to close following initiation of a cooldown. For the closure requirements, either the ARV or its associated block valve may be credited for OPERABILITY.
R.E. Ginna Nuclear Power Plant                    B 3.7.4-2                                    Revision 85
 
ARVs B 3.7.4 APPLICABILITY        In MODES 1 and 2, and in MODE 3 with RCS average temperature 500&#xba;F, the ARV lines are required to be OPERABLE.
In MODE 3 with RCS average temperature < 500&#xba;F, and in MODE 4, the ARVs are not required since the saturation pressure of the reactor coolant is below the lift settings of the MSSVs. In MODE 5 or 6, an SGTR is not a credible event since the water in the SGs is below the boiling point and RCS pressure is low.
ACTIONS              A.1 With one ARV line inoperable, ACTION must be taken to restore the valve to OPERABLE status within 7 days. The 7 day Completion Time allows for the redundant capability afforded by the remaining OPERABLE ARV line and a nonsafety grade backup in the steam dump system.
B.1 If the ARV line cannot be restored to OPERABLE status within the associated Completion Time, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in at least MODE 3 with RCS average temperature < 500&#xba;F within 8 hours. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
C.1 If both ARV lines are inoperable, the plant is in a condition outside of the accident analyses for a SGTR event; therefore, LCO 3.0.3 must be entered immediately.
R.E. Ginna Nuclear Power Plant              B 3.7.4-3                                  Revision 69
 
ARVs B 3.7.4 SURVEILLANCE          SR 3.7.4.1 REQUIREMENTS To perform a cooldown of the RCS, the ARVs must be able to be opened either remotely or locally. This SR ensures that the ARVs are tested through a full control cycle at least once per fuel cycle. Performance of inservice testing or use of an ARV during a plant cooldown may satisfy this requirement. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.7.4.2 The function of the block valve is to isolate a failed open ARV. Cycling the block valve both closed and open demonstrates its capability to perform this function. Performance of inservice testing or use of the block valve during plant cooldown may satisfy this requirement. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES            1. UFSAR, Section 10.3.2.5.
: 2. UFSAR, Section 15.6.3.
: 3. UFSAR, Section 15.1.6.
R.E. Ginna Nuclear Power Plant              B 3.7.4-4                                  Revision 77
 
AFW System B 3.7.5 B 3.7    PLANT SYSTEMS B 3.7.5      Auxiliary Feedwater (AFW) System BASES BACKGROUND              The AFW System supplies feedwater to the steam generators (SGs) to remove decay heat from the Reactor Coolant System (RCS) upon the loss of normal feedwater supply. The SGs function as a heat sink for core decay heat. The heat load is dissipated by releasing steam to the atmosphere from the SGs via the main steam safety valves (MSSVs) or atmospheric relief valves (ARVs). If the main condenser is available, steam may be released via the steam dump valves. The AFW System is comprised of two separate systems, a preferred AFW System and a Standby AFW (SAFW) System (Ref. 1).
AFW System The preferred AFW System consists of two motor driven AFW (MDAFW) pumps and one turbine driven AFW (TDAFW) pump configured into three separate trains which are all located in the Intermediate Building (see Figure B 3.7.5-1). The pumps are equipped with independent recirculation lines to the condensate storage tanks (CSTs). Each MDAFW train is powered from an independent Class 1E power supply and feeds one SG, although each pump has the capability to be realigned from the control room to feed the other SG via cross-tie lines containing normally closed motor operated valves (4000A and 4000B). The two MDAFW trains will actuate automatically on a low-low level signal in either SG, opening of the main feedwater (MFW) pump breakers, a safety injection (SI) signal, or the ATWS mitigation system actuation circuitry (AMSAC). The pumps can also be manually started from the control room.
The TDAFW pump receives steam from each main steam line upstream of the two main steam isolation valves. Either of the steam lines will supply 100% of the requirements of the TDAFW pump. The TDAFW pump supplies a common header capable of feeding both SGs by use of normally maintained open, air-operated control valves (4297 and 4298). The TDAFW pump will actuate automatically on a low-low level signal in both SGs, loss of voltage on 4160 V Buses 11A and 11B, or the ATWS mitigation system actuation circuitry (AMSAC). The pump can also be manually started from the control room.
The normal source of water for the AFW System is the CSTs which are located in the non-seismic Service Building. The Service Water (SW) System (LCO 3.7.8) can also be used to supply a safety-R.E. Ginna Nuclear Power Plant                  B 3.7.5-1                                  Revision 75
 
AFW System B 3.7.5 related source of water through normally closed motor operated valves (4013, 4027, and 4028) which supply each AFW train.
SAFW System The SAFW System consists of two motor driven pumps configured into two separate trains (see Figure B 3.7.5-2). Each motor driven SAFW train supplies one SG through the use of a normally open motor-operated stop check valve. Each pump has the capability to be realigned from the control room to feed the other SG via normally closed motor operated valves (9703A and 9703B). Each pump is powered from an independent Class 1E power supply and can be powered from the diesel generators provided that the breaker for the associated MDAFW pump is opened. The safety-related source of water for the SAFW System is the SW System through two normally closed motor operated valves (9629A and 9629B). Condensate can also be supplied by a 160,000 gallon DI water storage tank and the yard fire hydrant yard loop.
The SAFW System is manually actuated in the event that the preferred AFW System has failed due to a high energy line break (HELB) in the Intermediate Building, a seismic or fire event. The SAFW trains are located in the SAFW Pump Building located adjacent to the Auxiliary Building.
The SAFW Pump Building environment is controlled by room coolers which are supplied by the same SW header as the pump trains. These coolers are required to ensure the SAFW Pump Building remains  120&#xba;F during accident conditions.
The AFW System is designed to supply sufficient water to the SG(s) to remove decay heat with SG pressure at the lowest MSSV set pressure plus 1%. Subsequently, the AFW System supplies sufficient water to cool the plant to RHR entry conditions, with steam released through the ARVs.
APPLICABLE            The design basis of the AFW System is to supply water to the SG(s) to SAFETY                remove decay heat and other residual heat by delivering at least the ANALYSES              minimum required flow rate to the SGs at pressures corresponding to the lowest MSSV set pressure plus 1%.
The AFW System mitigates the consequences of any event with the loss of normal feedwater. The limiting Design Basis Accidents (DBAs) and transients for the AFW System are as follows (Ref. 2):
: a. Feedwater Line Break (FWLB);
R.E. Ginna Nuclear Power Plant                      B 3.7.5-2                                  Revision 78
 
AFW System B 3.7.5
: b. Loss of MFW (with and without offsite power);
: c. Steam Line Break (SLB);
: d. Small break loss of coolant accident (LOCA);
: e. Steam generator tube rupture (SGTR); and AFW is also used to mitigate the effects of an ATWS event (which is a beyond design basis event) and external events (tornados and seismic events) all of which are not addressed by this LCO.
The AFW System design is such that any of the above DBAs can be mitigated using the preferred AFW System or SAFW System. For the FWLB and SLB, (items a and c), the worst case scenario is the loss of all three preferred AFW trains due to a HELB in the Intermediate or Turbine Building. For these events, the use of the SAFW System within 14.5 minutes is assumed by the accident analyses. Since a single failure must also be assumed in addition to the HELB, the capability of the SAFW System to supply flow to an intact SG could be compromised if the SAFW cross-tie or intact SG flowpath is not available. For HELBs within containment, use of either the SAFW System (within 14.5 minutes) or the AFW System (within 1 minute) to the intact SG is assumed.
For the SGTR events (item e), the accident analyses assume that one AFW train is available upon a SI signal or low-low SG level signal.
Additional inventory is being added to the ruptured SG as a result of the SGTR such that AFW flow is not a critical feature for this DBA.
The loss of MFW (item b) is a Condition 2 event (Ref. 3) which places limits on the response of the RCS from the transient (e.g., no challenge to the pressurizer power operated relief valves due to a water solid pressurizer is allowed). This analysis has been performed assuming no AFW flow is available until 1 minute with acceptable results. The most limiting small break LOCA (item d) analysis has also been performed assuming no AFW flow with no adverse impact on peak cladding temperature.
In addition to its accident mitigation function, the energy and mass addition capability of the AFW System is also considered with respect to HELBs within containment. For SLBs and FWLBs within containment, maximum pump flow from all three AFW pumps is assumed for 10 minutes until operations can isolate the flow by tripping the AFW pumps or by closing the respective pump discharge flow path(s). Therefore, the motor operated discharge isolation valves for the motor MDAFW pump trains (4007 and 4008) are designed to limit flow to  235 gpm to limit the energy and mass addition so that containment remains within design limits for items a and c. The TDAFW train is assumed to be at runout conditions (i.e., 630 gpm).
R.E. Ginna Nuclear Power Plant                B 3.7.5-3                                  Revision 75
 
AFW System B 3.7.5 The AFW System satisfies the requirements of Criterion 3 of the NRC Policy Statement.
LCO                  This LCO provides assurance that the AFW System will perform its design safety function to mitigate the consequences of accidents that could result in overpressurization of the reactor coolant pressure boundary or containment.
The AFW System is comprised of two systems which are configured into five trains. The AFW System is considered OPERABLE when the components and flow paths required to provide redundant AFW flow to the SGs are OPERABLE (see Figures B 3.7.5-1 and B 3.7.5-2). This requires that the following be OPERABLE:
: a. Two MDAFW trains taking suction from the CSTs as required by LCO 3.7.6 (and capable of taking suction from the SW system within 14.5 minutes), and capable of supplying their respective SG with  170 gpm (recirculation valve open) or  195 gpm (recirculation valve closed) within 1 minute and  235 gpm upon AFW actuation (on a per pump basis);
: b. The TDAFW train taking suction from the CSTs as required by LCO 3.7.6 (and capable of taking suction from the SW system within 14.5 minutes), provided steam is available from both main steam lines upstream of the MSIVs, and capable of supplying  170 gpm to either SG within 1 minute and  235 gpm to either SG within 14.5 minutes; and
: c. Two motor driven SAFW trains capable of being initiated either locally or from the control room within 14.5 minutes, taking suction from the SW System, and supplying their respective SG and the opposite SG through the SAFW cross-tie line with  215 gpm.
The piping, valves, instrumentation, and controls in the required flow paths are also required to be OPERABLE. The pump recirculation lines are required to be OPERABLE for this LCO. Valves in the recirculation line must be open, or able to open to be OPERABLE. The TDAFW train is comprised of a common pump and two flow paths. A TDAFW train flow path is defined as the steam supply line and the SG injection line from/to the same SG. The failure of the pump or both flow paths renders the TDAFW train inoperable.
The cross-tie line for the preferred MDAFW pumps is not required for this LCO. However, since the accident analyses have been performed assuming a 14.5 minute delay for AFW for a HELB, and there are two separate systems, the use of this cross-tie line is allowed in MODES 1, 2, and 3.
R.E. Ginna Nuclear Power Plant                B 3.7.5-4                                  Revision 75
 
AFW System B 3.7.5 The SAFW Pump Building room coolers are required to be OPERABLE.
If one room cooler is inoperable, the associated SAFW train is inoperable.
APPLICABILITY        In MODES 1, 2, and 3, the AFW System is required to be OPERABLE in the event that it is called upon to function when the MFW System is lost.
In addition, the AFW System is required to supply enough makeup water to replace the lost SG secondary inventory as the plant cools to MODE 4 conditions.
In MODE 4, 5, or 6, the SGs are not normally used for heat removal, and the AFW System is not required.
ACTIONS              A.1 If one of the TDAFW train flow paths is inoperable, action must be taken to restore the flow path to OPERABLE status within 7 days. The 7 day Completion Time is reasonable, based on the following reasons:
: a. The redundant OPERABLE turbine driven AFW pump flow path;
: b. The availability of redundant OPERABLE MDAFW and SAFW pumps; and
: c. The low probability of an event occurring that requires the inoperable TDAFW pump flow path.
A TDAFW train flow path is defined as the steam supply line and SG injection line from/to the same SG.
B.1 If one MDAFW train is inoperable, action must be taken to restore the train to OPERABLE status within 7 days. The 7 day Completion Time is reasonable, based on the following reasons:
: a. The redundant OPERABLE MDAFW train;
: b. The availability of redundant OPERABLE TDAFW and SAFW pumps; and
: c. The low probability of an event occurring that requires the inoperable MDAFW train.
R.E. Ginna Nuclear Power Plant                B 3.7.5-5                                  Revision 75
 
AFW System B 3.7.5 C.1 With the TDAFW train inoperable, or both MDAFW trains inoperable, or one TDAFW train flow path and one MDAFW train inoperable to opposite SGs, action must be taken to restore OPERABLE status within 72 hours.
If the inoperable MDAFW train supplies the same SG as the inoperable TDAFW flow path, Condition D must be entered.
The combination of failures which requires entry into this Condition all result in the loss of one train (or one flow path) of preferred AFW cooling to each SG such that redundancy is lost. The 72 hour Completion Time is reasonable, based on redundant capabilities afforded by the SAFW System, time needed for repairs, and the low probability of a DBA occurring during this time period.
Condition C is modified by a Note which prohibits the application of LCO 3.0.4.b with a TDAFW train inoperable, or both MDAFW trains inoperable, or one TDAFW train flow path and one MDAFW train inoperable to opposite SGs. There is an increased risk associated with entering a MODE or other specified condition in the Applicability with a TDAFW train inoperable, or both MDAFW trains inoperable, or one TDAFW train flow path and one MDAFW train inoperable to opposite SGs consequently the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in these circumstances.
D.1 With all AFW trains to one or both SGs inoperable, action must be taken to restore at least one train or TDAFW flow path to each affected SG to OPERABLE status within 4 hours.
The combination of failures which require entry into this Condition all result in the loss of preferred AFW cooling to at least one SG. If a SGTR were to occur in this condition, preferred AFW is potentially unavailable to the unaffected SG. If AFW is unavailable to both SGs, the accident analyses for small break LOCAs and loss of MFW would not be met.
The two MDAFW trains of the preferred AFW System are normally used for decay heat removal during low power operations since air operated bypass control valves are installed in each train to better control SG level (see Figure B 3.7.5-1). Since a feedwater transient is more likely during reduced power conditions, 4 hours is provided to restore at least one train of additional preferred AFW before requiring a controlled cooldown. This will also provide time to find a condensate source other than the SW System for the SAFW System if all three AFW trains are inoperable. The 4 hour Completion Time is reasonable, based on redundant capabilities afforded by the SAFW System, time needed for repairs, and the low probability of a DBA occurring during this time period.
R.E. Ginna Nuclear Power Plant                B 3.7.5-6                                  Revision 75
 
AFW System B 3.7.5 Condition D is modified by a Note which prohibits the application of LCO 3.0.4.b with all AFW trains to one or both SGs inoperable. There is an increased risk associated with entering a MODE or other specified condition in the Applicability with all AFW trains to one or both SGs inoperable and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in these circumstances.
E.1 With one SAFW train inoperable, action must be taken to restore OPERABLE status within 14 days. This Condition includes the inoperability of one of the two SAFW cross-tie valves which requires declaring the associated SAFW train inoperable (e.g., failure of 9703B would result in declaring SAFW train D inoperable). However, the inoperability of either flow path downstream of the SAFW cross-tie is addressed by Condition F. The 14 day Completion Time is reasonable, based on redundant capabilities afforded by the AFW System, time needed for repairs, and the low probability of a HELB or other event which would require the use of the SAFW System during this time period.
F.1 With both SAFW trains inoperable, action must be taken to restore at least one SAFW train to OPERABLE status within 7 days. This Condition includes the inoperability of both of the SAFW cross-tie valves (9703A and 9703B) or the inoperability of either flow path down stream of the SAFW cross-tie. The 7 day Completion Time is reasonable, based on redundant capabilities afforded by the AFW System, time needed for repairs, and the low probability of a HELB or other event which would require the use of the SAFW System during this time period.
G.1 and G.2 When Required Action A.1, B.1, C.1, D.1, E.1, or F.1 cannot be completed within the required Completion Time, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours, and in MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant condition from full power conditions in an orderly manner and without challenging plant systems.
H.1 If all three preferred AFW trains and both SAFW trains are inoperable the plant is in a seriously degraded condition with no safety related means for conducting a cooldown, and only limited means for conducting a cooldown with nonsafety related equipment. In such a condition, the R.E. Ginna Nuclear Power Plant                B 3.7.5-7                                Revision 75
 
AFW System B 3.7.5 plant should not be perturbed by any action, including a power change, that might result in a trip. The seriousness of this condition requires that action be started immediately to restore one MDAFW, TDAFW, or SAFW train to OPERABLE status. For the purposes of this Required Action, only one TDAFW train flow path and the pump must be restored to exit this Condition.
Required Action H.1 is modified by a Note indicating that all required MODE changes or power reductions are suspended until one MDAFW, TDAFW, or SAFW train is restored to OPERABLE status. In this case, LCO 3.0.3 is not applicable because it could force the plant into a less safe condition.
SURVEILLANCE          SR 3.7.5.1 REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves in the AFW and SAFW System water and steam supply flow paths provides assurance that the proper flow paths will exist for AFW operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since they are verified to be in the correct position prior to locking, sealing, or securing. This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves. This Surveillance does not require any testing or valve manipulation; rather, it involves verification, through a system walkdown, that those valves capable of being mispositioned are in the correct position.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.7.5.2 Periodically comparing the reference differential pressure and flow of each AFW pump in accordance with the inservice testing requirements of the ASME Code (Ref. 4) detects trends that might be indicative of an incipient failure. The Frequency of this surveillance is specified in the INSERVICE TESTING PROGRAM, which encompasses the ASME Code. The ASME Code provides the activities and Frequencies necessary to satisfy this requirement.
This SR is modified by a Note indicating that the SR is only required to be met prior to entering MODE 1 for the TDAFW pump since suitable test conditions have not been established. This deferral is required because there is insufficient steam pressure to perform the test.
R.E. Ginna Nuclear Power Plant                B 3.7.5-8                                Revision 81
 
AFW System B 3.7.5 SR 3.7.5.3 Periodically comparing the reference differential pressure and flow of each SAFW pump in accordance with the inservice testing requirements of the ASME Code (Ref. 4) detects trends that might be indicative of an incipient failure. Because it is undesirable to introduce SW into the SGs while they are operating, this testing is performed using the test condensate tank. The Frequency of this surveillance is specified in the INSERVICE TESTING PROGRAM, which encompasses the ASME Code. The ASME Code provides the activities and Frequencies necessary to satisfy this requirement.
SR 3.7.5.4 This SR verifies that each AFW and SAFW motor operated suction valve from the SW System (4013, 4027, 4028, 9629A, and 9629B), each AFW and SAFW discharge motor operated valve (4007, 4008, 9701A, 9701B, 9704A, 9704B, and 9746), and each SAFW cross-tie motor operated valve (9703A and 9703B) can be operated when required. The Frequency of this Surveillance is specified in the INSERVICE TESTING PROGRAM and is consistent with the ASME Code (Ref. 4). The TDAFW discharge motor operated valve (3996) is maintained open and not required to be closed for the DBA's and transients described within the Applicable Safety Analyses section. Therefore, testing of the TDAFW discharge motor operating valve is not required.
SR 3.7.5.5 This SR verifies that AFW can be delivered to the appropriate SG in the event of any accident or transient that generates an actuation signal, by demonstrating that each automatic valve in the flow path actuates to its correct position on an actual or simulated actuation signal. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.7.5.6 This SR verifies that the AFW pumps will start in the event of any accident or transient that generates an actuation signal by demonstrating that each AFW pump starts automatically on an actual or simulated actuation signal. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
R.E. Ginna Nuclear Power Plant              B 3.7.5-9                                  Revision 81
 
AFW System B 3.7.5 This SR is modified by a Note indicating that the SR is only required to be met prior to entering MODE 1 for the TDAFW pump since suitable test conditions may have not been established. This deferral is required because there is insufficient steam pressure to perform the test.
SR 3.7.5.7 This SR verifies that the SAFW System can be actuated and controlled from the control room. The SAFW System is assumed to be manually initiated within 14.5 minutes in the event that the preferred AFW System is inoperable. This Surveillance includes the verification of the automatic response of the motor operated discharge valves (9701A and 9701B) and the recirculation valves (9710A and 9710B). The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES            1. UFSAR, Section 10.5.
: 2. UFSAR Chapter 15.
: 3. American National Standard, "Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants," N18.2-1973.
: 4. ASME Code for Operation and Maintenance of Nuclear Power Plants.
R.E. Ginna Nuclear Power Plant              B 3.7.5-10                                  Revision 77
 
AFW System B 3.7.5 Figure B 3.7.5-1 Preferred AFW System R.E. Ginna Nuclear Power Plant        B 3.7.5-11    Revision 75
 
AFW System B 3.7.5 R.E. Ginna Nuclear Power Plant B 3.7.5-12  Revision 78
 
CSTs B 3.7.6 B 3.7    PLANT SYSTEMS B 3.7.6      Condensate Storage Tanks (CSTs)
BASES BACKGROUND            The CSTs provide a source of water to the steam generators (SGs) for removing decay and sensible heat from the Reactor Coolant System (RCS). The CST provides a passive flow of water, by gravity, to the preferred Auxiliary Feedwater (AFW) System (LCO 3.7.5) (see Figure B 3.7.5-1). The resulting steam produced in the SGs is released to the atmosphere by the main steam safety valves or the atmospheric relief valves.
When the main steam isolation valves are open, the preferred means of heat removal from the RCS is to discharge steam to the condenser by the nonsafety grade path of the steam dump valves. The condensed steam is then returned to the SGs by the main feedwater system. This has the advantage of conserving condensate while minimizing releases to the environment.
There are two 30,000 gallon CSTs located in the non-seismic Service Building (Ref. 1). The CSTs are not considered safety related components since the tanks are not protected against earthquakes or other natural phenomena, including missiles. The safety related source of condensate for the AFW and Standby AFW Systems is the Service Water (SW) System (LCO 3.7.8). The CSTs are connected by a common header which leads to the suction of all three AFW pumps. A single level transmitter is provided for each CST (LT-2022A and LT-2022B). The CSTs can be refilled from the condenser hotwell or the all-volatile-treatment condensate storage tank.
APPLICABLE            The CSTs provide cooling water to remove decay heat and to cooldown SAFETY                the plant following all events in the accident analysis (Ref. 2) which ANALYSES              assumes that the preferred AFW System is available immediately following an accident. For any event in which AFW is not required for at least 14.5 minutes following the accident, the SW System provides the source of cooling water to remove decay heat.
The preferred AFW pumps receive various automatic actuation signals.
Assuming that all three AFW pumps initiate at their maximum flowrate, the CSTs provide sufficient inventory for at least 20 minutes (at greater than required flowrates) before operator ACTION to refill the CSTs or transfer suction to the SW System is required.
R.E. Ginna Nuclear Power Plant                B 3.7.6-1                                  Revision 60
 
CSTs B 3.7.6 A nonlimiting event considered in CST inventory determinations is a main feedwater line break inside containment. This break has the potential for dumping condensate until terminated by operator ACTION after 10 minutes since there is no automatic re-configuration of the AFW System.
Following termination of the AFW flow to the affected SG by closing the AFW train discharge valves or stopping a pump, flow from the remaining AFW train or the SAFW System is directed to the intact SG for decay heat removal. This loss of condensate is partially compensated for by the retention of inventory in the intact SG.
For cooldowns following loss of all onsite and offsite AC electrical power, the CSTs contain sufficient inventory to provide a minimum of 2 hours of decay heat removal via the turbine-driven AFW pump as required by NUREG-0737 (Ref. 4), item II.E.1.1. This beyond DBA requirement provides more limiting criteria for CST inventory.
The CSTs satisfy Criterion 3 of the NRC Policy Statement.
LCO                  To satisfy accident analysis assumptions, the CST must contain sufficient inventory to support operation of the preferred AFW system for at least 14.5 minutes. After this time period, the accident analyses assume that AFW pump suction can be transferred to the safety related suction source (i.e., the SW System).
However, the required CST water volume is  24,350 gallons, which is based on the need to provide at least 2 hours of decay heat removal via the turbine-driven AFW pump following loss of all AC electrical power (i.e., a beyond design basis event). The CSTs are considered OPERABLE when at least 24,350 gallons of water is available. The 24,350 gal minimum volume is met if one CST is  22.8 ft (including instrument uncertainty) or if both CSTs are 1 3.6 ft (including instrument uncertainty). Since the CSTs are 30,000 gallon tanks, only one CST is required to meet the minimum required water volume for this LCO.
The OPERABILITY of the CSTs is determined by maintaining the tank level at or above the minimum required water volume.
APPLICABILITY        In MODES 1, 2, and 3, the CSTs are required to be OPERABLE to support the AFW System requirements.
In MODE 4, 5, or 6, the CST is not required because the AFW System is not required to be OPERABLE.
R.E. Ginna Nuclear Power Plant                  B 3.7.6-2                                  Revision 60
 
CSTs B 3.7.6 ACTIONS              A.1 and A.2 If the CST water volume is not within limits, the OPERABILITY of the backup supply should be verified by administrative means within 4 hours.
OPERABILITY of the backup feedwater supply must include verification that the flow paths from the backup water supply to the preferred AFW pumps are OPERABLE and immediately available upon AFW initiation, and that the backup supply has the required volume of water available.
Alternate sources of water include, but is not limited to, the SW System and the all-volatile-treatment condensate tank. In addition, the CSTs must be restored to OPERABLE status within 7 days, because the backup supply may be performing this function in addition to its normal functions. Continued verification of the backup supply is not required due to the large volume of water typically available from these alternate sources. The 7 day Completion Time is reasonable, based on an OPERABLE backup water supply being available, and the low probability of an event occurring during this time period requiring the CSTs.
B.1 and B.2 If the backup supply cannot be verified or the CSTs cannot be restored to OPERABLE status within the associated Completion Time, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours, and in MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE          SR 3.7.6.1 REQUIREMENTS This SR verifies that the CSTs contain the required volume of cooling water. The 24,350 gal minimum volume is met if one CST is  2 2.8 ft (including instrument uncertainty) or if both CSTs are  13.6 ft (including instrument uncertainty). The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
R.E. Ginna Nuclear Power Plant                    B 3.7.6-3                                  Revision 77
 
CSTs B 3.
 
==7.6 REFERENCES==
: 1. UFSAR, Section 10.7.4.
: 2. UFSAR, Chapter 15.
: 3. American National Standard, "Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants," N18.2-1973.
: 4. NUREG-0737, "Clarification of TMI ACTION Plan Requirements,"
November 1980.
R.E. Ginna Nuclear Power Plant              B 3.7.6-4                                  Revision 60
 
CCW System B 3.7.7 B 3.7    PLANT SYSTEMS B 3.7.7      Component Cooling Water (CCW) System BASES BACKGROUND            The CCW System provides a heat sink for the removal of process and operating heat from safety related components during a Design Basis Accident (DBA) or transient. During normal operation, and a normal shutdown, the CCW System also provides this function for various safety related and nonsafety related components. The CCW System serves as a barrier to the release of radioactive byproducts between potentially radioactive systems and the Service Water (SW) System, and thus to the environment. The safety related functions of the CCW system are covered by this LCO.
The CCW System consists of a single loop header supplied by two separate, 100% capacity, safety related pump and heat exchanger trains (Ref. 1) (see Figure B 3.7.7-1). Each CCW train consists of a manual suction and discharge valve, a pump, and a discharge check valve. The trains discharge to a common header which then supplies two heat exchangers, either of which can supply the safety related and non-safety related components cooled by CCW. The CCW loop header begins at the common piping at the discharge of the two parallel heat exchangers, and continues up to the first isolation valve for each component supplied by the CCW System. The CCW loop header then continues from the last isolation valve on the discharge of each supplied load to the common piping at the suction of the CCW pumps. Each pump is powered from a separate Class 1E electrical bus. An open surge tank in the system provides for thermal expansion and contraction of the CCW system and ensures that sufficient net positive suction head is available to the pumps.
The CCW System is also provided with a radiation detector (R-17) to isolate the surge tank from the Auxiliary Building environment and to provide indication of a leak of radioactive water into the CCW System.
The CCW System is normally maintained below 100&#xba;F by the use of one pump train in conjunction with one heat exchanger. The standby CCW pump will automatically start if the system pressure falls to 50 psig.
R.E. Ginna Nuclear Power Plant                B 3.7.7-1                                  Revision 58
 
CCW System B 3.7.7 The principal safety related function of the CCW System is the removal of decay heat from the reactor via the Residual Heat Removal (RHR)
System. Since the removal of decay heat via the RHR System is only performed during the recirculation phase of an accident, the CCW pumps do not receive an automatic start signal. Following the generation of a safety injection signal, the normally operating CCW pump will remain in service unless an undervoltage signal is present on either Class 1E electrical Bus 14 or Bus 16 at which time the pump is stripped from its respective bus. A CCW pump can then be manually placed into service prior to switching to recirculation operations which would not be required until a minimum of 24.1 minutes following an accident.
APPLICABLE            The design basis of the CCWSystem is for one CCW train and one CCW SAFETY                heat exchanger to remove the loss of coolant accident (LOCA) heat load ANALYSES              from the containment sump during the recirculation phase. The Emergency Core Cooling System (ECCS) and containment models for a LOCA each consider the minimum performance of the CCW System.
The normal temperature of the CCW is  100&#xba;F, and, during LOCA conditions, a maximum temperature of 120&#xba;F is assumed. This prevents the CCW System from exceeding its design temperature limit of 200&#xba;F, and provides for a gradual reduction in the temperature of containment sump fluid as it is recirculated to the Reactor Coolant System (RCS) by the ECCS pumps. The CCW System is designed to perform its function with a single failure of any active component, assuming a coincident loss of offsite power.
The CCW trains, heat exchangers, and loop headers are manually placed into service prior to the recirculation phase of an accident (i.e.,
22.4 minutes following a large break LOCA).
The CCW System can also function to cool the plant from RHR entry conditions (Tavg < 350&#xba;F), to MODE 5 (Tavg < 200&#xba;F), during normal cooldown operations. The time required to cool from 350&#xba;F to 200&#xba;F is a function of the number of CCW and RHR trains operating. Since CCW is comprised of a large loop header, a passive failure can be postulated during this cooldown period which results in draining the CCW System within a short period of time. The CCW System is also vulnerable to external events such as tornados. The plant has been evaluated for the loss of CCW under these conditions with the use of alternate cooling mechanisms (e.g., providing for natural circulation using the atmospheric relief valves and the Auxiliary Feedwater System) with acceptable results (Ref. 1). Leaks within the CCW System during post accident conditions can be mitigated by the available makeup water sources.
The CCW System satisfies Criterion 3 of the NRC Policy Statement.
R.E. Ginna Nuclear Power Plant                B 3.7.7-2                                Revision 58
 
CCW System B 3.7.7 LCO                  In the event of a DBA, one CCW train, one heat exchanger, and the loop header is required to provide the minimum heat removal capability assumed in the safety analysis for the systems to which it supplies cooling water (see Figure B 3.7.7-1). To ensure this requirement is met, two trains of CCW, two heat exchangers, and the loop header must be OPERABLE. At least one CCW train will operate assuming the worst case single active failure occurs coincident with a loss of offsite power.
A CCW train is considered OPERABLE when the pump is OPERABLE and capable of providing cooling water to the loop header. The automatic start logic associated with low CCW system pressure is not required for this LCO. In addition, if a CCW pump fails an INSERVICE TESTING PROGRAM surveillance (e.g., pump developed head) the pump is only declared inoperable when the flowrate to required components is below that required to provide the heat removal capability assumed in the accident analyses.
The CCW loop header is considered OPERABLE when the associated piping, valves, surge tank, and the instrumentation and controls required to provide cooling water to the following safety related components are available and capable of performing their safety related function:
: a. Two RHR heat exchangers;
: b. Two RHR pump mechanical seal coolers and bearing water jackets;
: c. Three safety injection pump mechanical seal coolers; and
: d. Two containment spray pump mechanical seal coolers.
The CCW loop header temperature must also be  120&#xba;F prior to the CCW cooling water reaching the first isolation valve supplying these components.
The CCW loop header begins at the common piping at the discharge of the CCW heat exchangers and continues up to the first isolation valve for each of the above components. The CCW loop header then continues from the last isolation valve on the discharge of each of the above components to the common piping at the suction of the CCW pumps.
The portion of CCW piping, valves, instrumentation and controls between the isolation valves to components a through d above is addressed by the following LCOs:
: a. LCO 3.4.6, "RCS Loops - MODE 4,"
: b. LCO 3.4.7, "RCS Loops - MODE 5, Loops Filled,"
R.E. Ginna Nuclear Power Plant              B 3.7.7-3                                    Revision 81
 
CCW System B 3.7.7
: c. LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled,"
: d. LCO 3.5.2, "ECCS - MODES 1, 2, and 3,"
: e. LCO 3.5.3, "ECCS - MODE 4,"
: f. LCO 3.9.4, "RHR and Coolant Circulation - Water Level  23 Ft,"
and
: g. LCO 3.9.5, "RHR and Coolant Circulation - Water Level < 23 Ft."
The CCW piping inside containment for the reactor coolant pumps (RCPs) and the reactor support coolers also serves as a containment isolation boundary. This is addressed by LCO 3.6.3, "Containment Isolation Boundaries."
The CCW system radiation detector (R-17) is not required to be OPERABLE for this LCO since the CCW system outside containment is not required to be a closed system.
The isolation of CCW from other components or systems not required for safety may render those components or systems inoperable but does not affect the OPERABILITY of the CCW System.
APPLICABILITY        In MODES 1, 2, 3, and 4, the CCW System is a normally operating system, which must be capable to perform its post accident safety functions. The failure to perform this safety function could result in the loss of reactor core cooling and containment integrity during the recirculation phase following a LOCA.
In MODE 5 or 6, the OPERABILITY requirements of the CCW System are determined by LCO 3.4.7, LCO 3.4.8, LCO 3.9.4, and LCO 3.9.5.
ACTIONS              A.1 If one CCW train is inoperable, action must be taken to restore OPERABLE status within 72 hours. In this Condition, the remaining OPERABLE CCW train is adequate to perform the heat removal function.
However, the overall reliability is reduced because a single failure in the OPERABLE CCW train could result in loss of CCW function. The 72 hour Completion Time is reasonable, based on the redundant capabilities afforded by the OPERABLE train, and the low probability of a DBA occurring during this period.
R.E. Ginna Nuclear Power Plant              B 3.7.7-4                                  Revision 58
 
CCW System B 3.7.7 B.1 If one CCW heat exchanger is inoperable, action must be taken to restore OPERABLE status within 31 days. In this Condition, the remaining OPERABLE heat exchanger is adequate to perform the heat removal function. However, the overall reliability is reduced because a passive failure in the OPERABLE CCW heat exchanger could result in a loss of CCW function. The 31 day Completion Time is reasonable, based on the redundant capabilities afforded by the OPERABLE train, and the low probability of a passive failure of the remaining heat exchanger.
C.1 and C.2 If the CCW train or CCW heat exchanger cannot be restored to OPERABLE status within the associated Completion Time, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours and in MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
D.1, D.2, and D.3 With both CCW trains, both CCW heat exchangers, or the loop header inoperable, action must be immediately initiated to restore OPERABLE status to one CCW train, one CCW heat exchanger, and the loop header.
In this Condition, there is no OPERABLE CCW System available to provide necessary cooling water which is a loss of a safety function.
Also, the plant must be placed in a MODE in which the consequences of a loss of CCW coincident with an accident are reduced. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours and in MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. The plant is not required to exit the Applicability for this LCO (i.e., enter MODE 5) until at least one CCW train, one CCW heat exchanger, and the loop header is restored to OPERABLE status to support RHR operation.
Required Actions D.1, D.2, and D.3 are modified by a Note indicating that all required MODE changes or power reductions required by other LCOs are suspended until one CCW train, one CCW heat exchanger, and the loop header are restored to OPERABLE status. In this case, LCO 3.0.3 is not applicable because it could force the plant into a less safe condition.
R.E. Ginna Nuclear Power Plant                B 3.7.7-5                                  Revision 58
 
CCW System B 3.7.7 SURVEILLANCE          SR 3.7.7.1 REQUIREMENTS Verifying the correct alignment for manual and power operated valves in the CCW flow path provides assurance that the proper flow paths exist for CCW operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves are verified to be in the correct position prior to locking, sealing, or securing. This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves. This Surveillance does not require any testing or valve manipulation; rather, it involves verification, through a system walkdown, that those valves capable of being mispositioned are in the correct position.
The Surveillance Frequency Control Program is controlled under the Surveillance Frequency Control Program.
This SR is modified by a Note indicating that the isolation of the CCW flow to individual components may render those components inoperable but does not affect the OPERABILITY of the CCW loop header.
SR 3.7.7.2 This SR verifies that the two motor operated isolation valves to the RHR heat exchangers (738A and 738B) can be operated when required since the valves are normally maintained closed. The Frequency of this Surveillance is specified in the INSERVICE TESTING PROGRAM and is consistent with the ASME Code (Ref. 2).
REFERENCES            1. UFSAR, Section 9.2.2.
: 2. ASME Code for Operation and Maintenance of Nuclear Power Plants.
R.E. Ginna Nuclear Power Plant                  B 3.7.7-6                                    Revision 81
 
CCW System B 3.7.7 Figure B 3.7.7-1 CCW System R.E. Ginna Nuclear Power Plant    B 3.7.7-7      Revision 58
 
SW System B 3.7.8 B 3.7    PLANT SYSTEMS B 3.7.8      Service Water (SW) System BASES BACKGROUND            The SW System provides a heat sink for the removal of process and operating heat from safety related components during a Design Basis Accident (DBA) or transient. During normal operation, and a normal shutdown, the SW system also provides this function for various safety related and nonsafety related components. The safety related functions of the SW System are covered by this LCO.
The SW System consists of a single loop header. Four pumps, two from each class 1E electrical bus (Buses 17 and 18), supply the SW loop header (see Figure B 3.7.8-1).
The SW loop header begins from the discharge of the pumps and supplies the safety related and nonsafety related components cooled by SW. The pumps in the system are normally manually aligned. One pump from each electrical train is selected to automatically start after diesel generator supply breaker closure on its respective bus when a safety injection signal is absent. Upon receipt of a safety injection signal, one SW pump on each electrical train will automatically start in a predetermined sequence.
The SW loop header supplies the cooling water to all safety related and nonsafety related components. The nonsafety related and long-term safety functions (e.g., component cooling water heat exchangers) can be isolated from the loop header through use of redundant motor operated isolation valves. These valves automatically close on a coincident safety injection signal and undervoltage signal on Buses 14 and 16.
The suction source for the SW System is the screenhouse which is a seismic structure located on Lake Ontario. The discharge from the SW System supplied loads returns back to Lake Ontario. The principal safety related functions of the SW system is the removal of decay heat from the reactor via the Component Cooling Water (CCW) System, provide cooling water to the diesel generators (DGs) and containment recirculation fan coolers (CRFCs) and to provide a safety related source of water to the Auxiliary Feedwater (AFW) System.
R.E. Ginna Nuclear Power Plant              B 3.7.8-1                                    Revision 68
 
SW System B 3.7.8 APPLICABLE            The design basis of the SW System is for two SW pumps in conjunction SAFETY                with a 100% capacity containment cooling system (i.e., CRFC) to provide ANALYSES              for heat removal following a steam line break (SLB) or loss of coolant accident (LOCA) inside containment to ensure containment integrity. The SW System is also designed, in conjunction with the CCW System and a 100% capacity Emergency Core Cooling System and containment cooling system, to remove the loss of coolant accident (LOCA) heat load from the containment sump during the recirculation phase (Ref. 2). This prevents the containment sump fluid from increasing in temperature during the recirculation phase following a LOCA and provides for a gradual reduction in the temperature of this fluid as it is recirculated to the Reactor Coolant System by the ECCS pumps. The SW System is designed to perform its function with a single failure of any active component, assuming a coincident loss of offsite power. Only one pump is needed during safe shutdown operation or during the injection phase of a postulated loss of coolant accident, and two are required during the recirculation phase of the accident.
Upon an undervoltage signal, all running SW pumps are stripped from their respective safeguards bus. The selected SW pumps are sequenced to start after a 40 second time delay following energization of the electrical bus supplying the selected pump (i.e., Bus 17 or Bus 18) if no safety injection signal is present.
Following the receipt of a safety injection signal, one preselected SW pump is designed to start on each electrical train within 17 seconds (if not already running) to supply the system loads. The two non-selected SW pumps will continue to operate if they were already running. If a coincident safety injection and undervoltage signal occurs, then each nonessential load within the SW System is isolated by redundant motor operated valves that are powered by separate Class 1E electrical trains.
The SW pumps and loop header are assumed to supply the following components following an accident:
: a. The CRFCs, DGs and safety injection pump bearing housing coolers immediately following a safety injection signal (i.e., after the loop header becomes refilled);
: b. The preferred AFW and SAFW pumps within 14.5 minutes (Ref. 3) following receipt of a low SG level signal; and
: c. The CCW heat exchangers within 24.1 minutes (Ref. 4) following a safety injection signal.
R.E. Ginna Nuclear Power Plant B 3.7.8-2                                    Revision 68
 
SW System B 3.7.8 The SW system, in conjunction with the CCW System, can also cool the plant from residual heat removal (RHR) entry conditions (Tavg < 350&#xba;F) to MODE 5 (Tavg < 200&#xba;F) during normal operations. The time required to cool from 350&#xba;F to 200&#xba;F is a function of the number of CCW and RHR System trains that are operating. Since SW is comprised of a large loop header, a passive failure can be postulated during this cooldown period which results in failing the SW System to potentially multiple safety related functions. The SW system has been evaluated to demonstrate the capability to meet cooling needs with an assumed 640 gpm leak. The SW System is also vulnerable to external events such as tornados. The plant has been evaluated for the loss of SW under these conditions with the use of alternate cooling mechanisms (e.g., providing for natural circulation using the atmospheric relief valves and the AFW Systems) with acceptable results (Ref. 1).
The temperature of the fluid supplied by the SW System is also a consideration in the accident analyses. If the cooling water supply to the containment recirculation fan coolers and CCW heat exchangers is too warm, the accident analyses with respect to containment pressure response following a SLB and the containment sump fluid temperature following a LOCA may no longer be bounding. As the cooling water supply temperature is lowered, the containment heat removal systems become more efficient which causes the backpressure in containment to be reduced, resulting in increased peak clad temperatures. The bounding minimum cooling water temperature assumed in the accident analysis is 30&#xba;F, which is lower than the freezing point of the cooling water supply. The bounding maximum SW water temperature assumed for the long-term containment response and SLB analysis is 85&#xba;F.
The SW system satisfies Criterion 3 of the NRC Policy Statement.
LCO                  In the event of a DBA, two SW pumps and the loop header are required to be OPERABLE to provide the minimum heat removal capability to ensure that the system functions to remove post accident heat loads as assumed in the safety analyses. To ensure this requirement is met, four SW pumps and the loop header must be OPERABLE (see Figure B 3.7.8-1). At least two SW pumps will operate assuming that the worst case single active failure occurs coincident with the loss of offsite power.
R.E. Ginna Nuclear Power Plant B 3.7.8-3                                  Revision 68
 
SW System B 3.7.8 A SW pump is considered OPERABLE when it is capable of taking suction from the screenhouse and providing cooling water to the loop header as assumed in the accident analyses. This includes consideration of available net positive suction head (NPSH) to the SW pumps and the temperature of the suction source. The following are the minimum requirements of the screenhouse bay with respect to OPERABILITY of the SW system:
: a. Level  14 feet; and
: b. Temperature  8 5&#xba;F.
The screenhouse bay level verification should normally be performed using LI-3006. Monitoring screenhouse bay temperature (normally performed by using T3001 or T3002) is an acceptable means of ensuring inlet temperature to safety related loads are within limits.
OPERABLE SW pumps also require that all nonessential and nonsafety related loads can be isolated by the six motor operated isolation valves which are powered from the same Class 1E electrical train as the pumps.
Therefore, motor operated valves 4609, 4614, 4615, 4616, 4663, and 4670 must be OPERABLE and capable of closing for SW Pumps A and C while valves 4613, 4664, 4733, 4734, 4735, and 4780 must be OPERABLE and capable of closing for SW Pumps B and D. As an alternative, the nonessential or nonsafety related load flow paths may be isolated with one of the following options:
: a. A locked closed manual valve, or
: b. A closed motor-operated valve with power locked off.
Both of these options provide the same isolation function without being susceptible to a single active failure. For any load isolated by one of these alternative options, enter the respective LCO for the isolated component, as applicable.
R.E. Ginna Nuclear Power Plant              B 3.7.8-4                                  Revision 68
 
SW System B 3.7.8 The SW loop header is considered OPERABLE when the associated piping, valves, and the instrumentation and controls required to provide cooling water to the following safety related components are available and capable of performing their safety related function:
: a. Four CRFCs;
: b. Two CCW heat exchangers;
: c. Two DGs;
: d. Three preferred AFW pumps;
: e. Two standby AFW pumps; and
: f. Three safety injection pump bearing housing coolers.
An OPERABLE SW loop header also requires a flow path through the diesel generator (4665, 4760, and 4669) and CRFC (4623, 4640, 4756, and 4639) cross-ties. The major service water loop isolation valves (4610, 4611, 4612, and 4779) are also required to be maintained closed.
The diesel generator cross-tie valves (4665, 4760, and 4669) may be individually (one at a time) closed intermittently under administrative controls, such as during surveillance testing. These administrative controls consist of direction in plant procedures for the field personnel to restore the isolation valve if needed. This is allowed since flow to the diesel generators is also being supplied by the CRFC cross-tie valves which remain open. Diesel generator cross-tie valve 4668B may be closed, and does not require restoration to open for SW flow requirements to be met.
The SW loop header begins at the common piping at the SW pump discharge valves and ends at the first valve that will isolate flow to any of the above components. Since the SW System discharges back to Lake Ontario, the cooling water flow path through the above components and subsequent discharge is addressed under their respective LCO. This includes:
: a. LCO 3.5.2, "ECCS - MODES 1, 2, and 3;"
: b. LCO 3.5.3, "ECCS - MODE 4;"
: c. LCO 3.6.6, "CS, CRFC, and Containment Post-Accident Charcoal Systems;"
: d. LCO 3.7.5, "AFW Systems;"
: e. LCO 3.7.7, "CCW System;"
: f. LCO 3.8.1, "AC Sources - MODES 1, 2, 3, and 4;" and
: g. LCO 3.8.2, "AC Sources - MODES 5 and 6."
R.E. Ginna Nuclear Power Plant              B 3.7.8-5                                    Revision 84
 
SW System B 3.7.8 The SW piping inside containment for the CRFCs and the reactor compartment coolers also serves as a containment isolation boundary.
This is addressed under LCO 3.6.3, "Containment Isolation Boundaries."
APPLICABILITY        In MODES 1, 2, 3, and 4, the SW System is a normally operating system which must be capable of performing its post accident safety functions.
The failure to perform this safety function could result in the loss of reactor core cooling during the recirculation phase following a LOCA or loss of containment integrity following a SLB.
In MODES 5 and 6, the OPERABILITY requirements of the SW system are determined by LCO 3.7.7 and LCO 3.8.2.
ACTIONS              A.1 If one SW pump is inoperable, action must be taken to restore OPERABLE status within 14 days. In this Condition, the remaining OPERABLE SW pumps are more than adequate to perform the heat removal function. However, the overall reliability is reduced because a single failure of the opposite electrical train could result in loss of SW System function. The 14 day Completion Time is based on the redundant capabilities afforded by the OPERABLE pumps, and the low probability of a DBA occurring during this time period.
B.1 If two SW pumps are inoperable, action must be taken to restore at least one of the inoperable pumps to OPERABLE status within 72 hours. In this condition, the remaining OPERABLE SW pumps are adequate to perform the heat removal function. However, any single failure of the remaining pumps would result in a loss of SW System function in a DBA.
The 72 hour Completion time is based on the reliability of the remaining two pumps and the low probability of a DBA occurring during this time period. To ensure the possibility of a common cause failure mode is not present to reduce the reliability of the remaining pumps, further actions may be required. Specifically, if one SW pump is inoperable due to equipment failure, and a second SW pump fails before the first pump is returned to service, an evaluation of possible common cause and determination of the operability of the remaining pumps shall be performed within 24 hours of the second failure (commitment per Reference 5).
R.E. Ginna Nuclear Power Plant                B 3.7.8-6                                    Revision 68
 
SW System B 3.7.8 C.1 and C.2 If the SW pumps cannot be restored to OPERABLE status within the associated Completion Time, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours and in MODE 5 within 36 hours.
The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
D.1 With three or more SW pumps or the loop header inoperable, the plant is in a condition outside of the accident analyses; therefore, LCO 3.0.3 must be entered immediately.
Required Action D.1 is modified by a Note requiring that the applicable Conditions and Required Actions of LCO 3.7.7, "CCW System," be entered for the component cooling water heat exchanger(s) made inoperable by SW. This note is provided since the inoperable SW system may prevent the plant from reaching MODE 5 as required by LCO 3.0.3 if both CCW heat exchangers are rendered inoperable.
SURVEILLANCE          SR 3.7.8.1 REQUIREMENTS This SR verifies that adequate NPSH is available to operate the SW pumps and that the SW suction source temperature is within the limits assumed by the accident analyses and the system design. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.7.8.2 Verifying the correct alignment for manual, power operated, and automatic valves in the SW flow path provides assurance that the proper flow paths exist for SW operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since they are verified to be in the correct position prior to being locked, sealed, or secured. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves. This SR does not require any testing or valve manipulation; rather, it involves verification, through a system walkdown, that those valves capable of being mispositioned are in the correct position.
R.E. Ginna Nuclear Power Plant                B 3.7.8-7                                    Revision 77
 
SW System B 3.7.8 The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
This SR is modified by a Note indicating that the isolation of the SW flow to individual components or systems may render those components inoperable, but does not affect the OPERABILITY of the SW System.
SR 3.7.8.3 This SR verifies that all SW loop header cross-tie valves are locked in the correct position. This includes verification that manual valves 4623, 4639, 4640, 4665, 4669, 4756, and 4760 are locked open and that manual valves 4610, 4611, 4612, and 4779 are locked closed. The diesel generator cross-tie valves (4665, 4760, and 4669) may be individually (one at a time) closed intermittently under administrative controls, such as during surveillance testing, as described in the LCO Bases. Diesel generator cross-tie valve 4668B may be closed, and does not require restoration to open for SW flow requirements to be met. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.7.8.4 This SR verifies proper automatic operation of the SW motor operated isolation valves on an actual or simulated actuation signal (i.e., coincident safety injection and undervoltage signal). SW is a normally operating system that cannot be fully actuated as part of normal testing. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.7.8.5 This SR verifies proper automatic operation of the SW pumps on an actual or simulated actuation signal. This includes the actuation of the SW pumps following an undervoltage signal and following a coincident safety injection and undervoltage signal. SW is a normally operating system that cannot be fully actuated as part of normal testing during normal operation. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
R.E. Ginna Nuclear Power Plant              B 3.7.8-8                                  Revision 84
 
SW System B 3.
 
==7.8 REFERENCES==
: 1. UFSAR, Section 9.2.1.
: 2. UFSAR, Section 6.2.
: 3. CN-TA-05-30, R. E. Finna Feedline Break NOTRUMP/RETRAN Analysis for Extended Power Uprate.
: 4. DBCOR 2004-0052, Post LOCA Sub-Criticality, Long Term Core Cooling and Boron Precipitation Analysis Data Input requested by Westinghouse.
: 5. Letter to USNRC Document Control Desk from Maria Korsnick (Ginna), Response to Request for Additional Information and Revised Mark-up Regarding Service Water Pump Operability Requirements for the R.E. Ginna Nuclear Power Plant, dated February 12, 2007.
R.E. Ginna Nuclear Power Plant              B 3.7.8-9                                Revision 68
 
SW System B 3.7.8 Figure B 3.7.8-1 SW System R.E. Ginna Nuclear Power Plant    B 3.7.8-10    Revision 68
 
CREATS B 3.7.9 B 3.7    PLANT SYSTEMS B 3.7.9      Control Room Emergency Air Treatment System (CREATS)
BASES BACKGROUND            According to Atomic Industry Forum (AIF) GDC 11 (Ref. 1), a control room shall be provided which permits continuous occupancy under any credible postaccident condition without excessive radiation exposures of personnel. Exposure limits are provided in GDC 19 of 10 CFR 50, Appendix A (Ref. 2), or 10 CFR 50.67 (Ref. 7). By conversion to the alternate source term (AST), Ginna's dose to the control room personnel is restricted to 5 rem TEDE (Ref. 7) for the duration of the accident. The CREATS provides a protected environment from which occupants can control the plant following an uncontrolled release of radioactivity, hazardous chemicals, or smoke.
The CREATS consists of two independent, redundant trains that re-circulate and filter the air in the control room envelope (CRE) and a CRE boundary that limits the inleakage of unfiltered air. Each CREATS train consists of a pre-filter, a high efficiency particulate air (HEPA) filter, an activated charcoal adsorber section for removal of gaseous activity (principally iodines), and a fan. Ductwork, valves or dampers, doors, barriers, and instrumentation also form part of the system. A second bank of filters follows the adsorber section to collect carbon fines.
The CRE is the area within the confines of the CRE boundary that contains the spaces that control room occupants inhabit to control the unit during normal and accident conditions. This area encompasses the control room, the Shift Managers office, the lavatory and the kitchen. The CRE is protected during normal operation, natural events, and accident conditions. The CRE boundary is the combination of walls, floor, roof, ducting, doors, penetrations and equipment that physically form the CRE.
The OPERABILITY of the CRE boundary must be maintained to ensure that the inleakage of unfiltered air into the CRE will not exceed the inleakage assumed in the licensing basis analysis of design basis accident (DBA) consequences to CRE occupants. The CRE and its boundary are defined in the Control Room Envelope Habitability Program.
The CREATS is an emergency system. Actuation of the CREATS starts both recirculation fans and closes dampers AKD02, AKD03, AKD21, AKD22, AKD23, AKD24. This action isolates the CRE, and begins cleanup recirculation of the control room environment.
The air entering the CRE is continuously monitored by radiation and toxic gas detectors. Detector output above the setpoint will cause actuation of the CREATS. Redundant recirculation trains provide the required R.E. Ginna Nuclear Power Plant                    B 3.7.9-1                                      Revision 51
 
CREATS B 3.7.9 filtration should a fan fail to start or an excessive pressure drop across the other filter train develops. Normally open isolation dampers are arranged in series pairs so that the failure of one damper to shut will not result in a breach of isolation. The CREATS is designed in accordance with Seismic Category I requirements.
The CREATS is designed to maintain a habitable environment in the CRE for 30 days of continuous occupancy after a Design Basis Accident (DBA) without exceeding 5 rem total effective dose equivalent (TEDE).
APPLICABLE            The CREATS components are arranged in redundant, safety related SAFETY                ventilation trains. The location of components and ducting within the ANALYSES              CRE ensures an adequate supply of filtered air to all areas requiring access. The CREATS provides airborne radiological protection for the CRE occupants in MODES 1, 2, 3, and 4, as demonstrated by the accident dose analyses for the applicable DBA (Ref. 3). This analysis shows that with credit for the CREATS, the dose rates to control room personnel remain within 10 CFR 50.67 limits.
During movement of irradiated fuel assemblies, the CREATS ensures CRE habitability in the event of a fuel handling accident. It has been demonstrated that the CREATS is not required in the event of a waste gas decay tank rupture (Ref. 3), or a spent fuel pool tornado missile accident (Ref. 3).
The CREATS provides protection from smoke and hazardous chemicals to the CRE occupants. The analysis of hazardous chemical releases demonstrates that the toxicity limits are not exceeded in the CRE following a hazardous chemical release (Ref. 3). The evaluation of a smoke challenge demonstrates that it will not result in the inability of the CRE occupants to control the reactor either from the control room or from the remote shutdown panels (Ref. 4). The worst case single active failure of a component of the CREATS, assuming a loss of offsite power, does not impair the ability of the system to perform its design function.
The CREATS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii) .
LCO                  Two independent and redundant CREATS trains are required to be OPERABLE to ensure that at least one is available if a single active failure disables the other train. Total system failure, such as from a loss of both CREATS ventilation trains or from an inoperable CRE boundary, could result in exceeding a dose of 5 rem TEDE to the CRE occupants in the event of a large radioactive release.
R.E. Ginna Nuclear Power Plant                    B 3.7.9-2                                  Revision 51
 
CREATS B 3.7.9 Each CREATS train is considered OPERABLE when the individual components necessary to limit CRE occupant exposure are OPERABLE.
A CREATS train is OPERABLE when the associated:
: a. Recirculation fan is OPERABLE and capable of providing forced flow;
: b. HEPA filters and charcoal adsorbers are not excessively restricting flow, and are capable of performing their filtration functions;
: c. Ductwork and dampers associated with the OPERABLE CREATS fan are OPERABLE, and the CREATS filter flow is a nominal 6000 cfm; and
: d. CRE dampers are OPERABLE. Dampers AKD03, AKD21, and AKD23 are associated with the A Train. Dampers AKD02, AKD22 and AKD24 are associated with the B train.
The CRE automatic isolation dampers are considered OPERABLE when the damper can close on an actuation signal to isolate outside air or is closed with motive force removed. As an alternative, the redundant isolation damper may be closed with the motive force removed, such that the flow path is not susceptible to the single active failure.
In order for the CREATS trains to be considered OPERABLE, the CRE boundary must be maintained such that the CRE occupant dose from a large radioactive release does not exceed the calculated dose in the licensing basis consequence analyses for DBAs, and that CRE occupants are protected from hazardous chemicals and smoke.
The LCO is modified by a Note allowing the CRE boundary to be opened intermittently under administrative controls. This Note only applies to openings in the CRE boundary that can be rapidly restored to the design condition, such as doors, hatches, floor plugs, and access panels. For entry and exit through doors, the administrative control of the opening is performed by the person(s) entering or exiting the area. For other openings, these controls should be proceduralized and consist of stationing a dedicated individual at the opening who is in continuous communication with the operators in the CRE. This individual will have a method to rapidly close the opening and to restore the CRE boundary to a condition equivalent to the design condition when a need for CRE isolation is indicated. The assumed isolation times in the analyses are 60 seconds for radiation and 30 seconds for toxic chemicals.
The ventilation ductwork may also be opened for extended periods provided that the affected CREATS filtration train is declared inoperable, and the portion of ductwork that is open is isolated from the CRE by a damper that is closed with motive force removed or a passive isolation device. Dampers and duct work in the normal control room HVAC system R.E. Ginna Nuclear Power Plant                    B 3.7.9-3                                    Revision 51
 
CREATS B 3.7.9 are isolated by dampers AKD21, AKD22, AKD23, and AKD24, and are not part of CRE.
APPLICABILITY        In MODES 1, 2, 3, and 4, two CREATS trains must be OPERABLE to ensure that the CRE will remain inhabitable during and following a DBA.
During movement of irradiated fuel assemblies two CREATS trains must be OPERABLE to cope with the release from a fuel handling accident.
ACTIONS              A.1 When one CREATS train is inoperable, for reasons other than an inoperable CRE boundary, action must be taken to restore OPERABLE status within 7 days. In this Condition, the remaining OPERABLE CREATS train is adequate to perform the CRE occupant protection function. However, the overall reliability is reduced because a failure in the OPERABLE CREATS train could result in loss of CREATS function.
The 7 day Completion Time is based on the low probability of a DBA occurring during this time period, and ability of the remaining train to provide the required capability.
B.1, B.2, and B.3 If the unfiltered inleakage of potentially contaminated air past the CRE boundary and into the CRE can result in CRE occupant radiological dose greater than the calculated dose of the licensing basis analyses of DBA consequences (allowed to be up to 5 rem TEDE), or inadequate protection of CRE occupants from hazardous chemicals or smoke, the CRE boundary is inoperable. Actions must be taken to restore an OPERABLE CRE boundary within 90 days.
During the period that the CRE boundary is considered inoperable, action must be initiated to implement mitigating actions to lessen the effect on CRE occupants from the potential hazards of a radiological or chemical event or a challenge from smoke. Actions must be taken within 24 hours to verify that in the event of a DBA, the mitigating actions will ensure that CRE occupant radiological exposures will not exceed the calculated dose of the licensing basis analyses of DBA consequences, and that CRE occupants are protected from hazardous chemicals and smoke. These mitigating actions (i.e., actions that are taken to offset the consequences of the inoperable CRE boundary) should be preplanned for implementation upon entry into the condition, regardless of whether entry is intentional or unintentional. The 24 hour Completion Time is reasonable based on the low probability of a DBA occurring during this time period, and the use of mitigating actions. The 90 day Completion R.E. Ginna Nuclear Power Plant                    B 3.7.9-4                                  Revision 51
 
CREATS B 3.7.9 Time is reasonable based on the determination that the mitigating actions will ensure protection of CRE occupants within analyzed limits while limiting the probability that CRE occupants will have to implement protective measures that may adversely affect their ability to control the reactor and maintain it in a safe shutdown condition in the event of a DBA. In addition, the 90 day Completion Time is a reasonable time to diagnose, plan and possibly repair, and test most problems with the CRE boundary.
C.1 and C.2 In MODE 1, 2, 3, or 4, if the inoperable CREATS train or the CRE boundary cannot be restored to OPERABLE status within the required Completion Time, the unit must be placed in a MODE that minimizes accident risk. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours, and in MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging plant systems.
D.1 and D.2 During movement of irradiated fuel assemblies, if the inoperable CREATS train cannot be restored to OPERABLE status within the required Completion Time, action must be taken to immediately place the OPERABLE CREATS train in the emergency mode. This action ensures that the remaining train is OPERABLE, that no failures preventing automatic actuation will occur, and that any active failure would be readily detected.
An alternative to Required Action D.1 is to immediately suspend activities that could result in a release of radioactivity that might require isolation of the CRE. This places the unit in a condition that minimizes the accident risk. This does not preclude the movement of fuel to a safe position.
E.1 During movement of irradiated fuel assemblies, with two CREATS trains inoperable or with one or more CREATS trains inoperable due to an inoperable CRE boundary, action must be taken immediately to suspend activities that could result in a release of radioactivity that might require isolation of the CRE. This places the unit in a condition that minimizes the accident risk. This does not preclude the movement of fuel to a safe position.
F.1 If both CREATS trains are inoperable in MODE 1, 2, 3, or 4 for reasons other than an inoperable CRE boundary (i.e., Condition B), the CREATS may not be capable of performing the intended function and the unit is in R.E. Ginna Nuclear Power Plant                    B 3.7.9-5                                    Revision 51
 
CREATS B 3.7.9 a condition outside the accident analyses. Therefore, LCO 3.0.3 must be entered immediately.
SURVEILLANCE          SR 3.7.9.1 REQUIREMENTS Standby systems should be checked periodically to ensure that they function properly. As the environment and normal operating conditions on this system are not too severe, testing each CREATS filtration train for  15 minutes provides an adequate check of this system. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.7.9.2 This SR verifies that the required CREATS testing is performed in accordance with the Ventilation Filter Testing Program (VFTP). The VFTP includes testing the performance of the HEPA filter, charcoal adsorber efficiency, flow rate, and the physical properties of the activated charcoal. The required flowrate through each CREATS filtration train is 6000 cubic feet per minute (+/-10%). Specific test Frequencies and additional information are discussed in detail in the VFTP.
The value of 1.5% methyl iodide penetration was chosen for the laboratory test sample acceptance criteria because, even though the new system contains 4-inch charcoal beds, the design face velocity is 61 fpm.
Regulatory Guide 1.52, Revision 3 (Ref. 9), Table 1, provides testing criteria assuming a 40 fpm face velocity. The value of 1.5% was interpolated between the two values listed because of the higher face velocity of Ginna's system. The face velocity is listed in the specification because it is a non standard number. Testing at 61 fpm or greater satifies the criteria.
SR 3.7.9.3 This SR verifies that each CREATS train starts and operates and that each CREATS automatic damper actuates on an actual or simulated actuation signal. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.7.9.4 This SR verifies the OPERABILITY of the CRE boundary by testing for unfiltered air inleakage past the CRE boundary and into the CRE. The details of the testing are specified in the Control Room Envelope Habitability Program.
The CRE is considered habitable when the radiological dose to CRE occupants calculated in the licensing basis analyses of DBA R.E. Ginna Nuclear Power Plant                    B 3.7.9-6                                  Revision 77
 
CREATS B 3.7.9 consequences is no more than 5 rem TEDE and the CRE occupants are protected from hazardous chemicals and smoke. This SR verifies that the unfiltered air inleakage into the CRE is no greater than the flow rate assumed in the licensing basis analyses of DBA consequences. When unfiltered air inleakage is greater than the assumed flow rate, Condition B must be entered. Required Action B.3 allows time to restore the CRE boundary to OPERABLE status provided mitigating actions can ensure that the CRE remains within the licensing basis habitability limits for the occupants following an accident. Compensatory measures are discussed in Regulatory Guide 1.196, Section C.2.7.3, (Ref. 5 which endorses, with exceptions, NEI 99-03, Section 8.4 and Appendix F (Ref.
6). These compensatory measures may also be used as mitigating actions as required by Required Action B.2. Temporary analytical methods may also be used as compensatory measures to restore OPERABILITY (Ref. 8). Options for restoring the CRE boundary to OPERABLE status include changing the licensing basis DBA consequence analysis, repairing the CRE boundary, or a combination of these actions. Depending upon the nature of the problem and the corrective action, a full scope inleakage test may not be necessary to establish that the CRE boundary has been restored to OPERABLE status.
REFERENCES            1. Atomic Industry Forum (AIF) GDC 11, Issued for comment July 10, 1967.
: 2. 10 CFR 50, Appendix A, GDC 19.
: 3. UFSAR, Section 6.4.
: 4. UFSAR, Section 7.4
: 5. Regulatory Guide 1.196
: 6. NEI 99-03, "Control Room Habitability Assessment", June 2001.
: 7. 10 CFR50.67, Accident Source Term
: 8. Letter from Eric J. Leeds (NRC) to James W. Davis (NEI) dated January 30, 2004, "NEI Draft White Paper, Use of Generic Letter 91 18 Process and Alternative Source Terms in the Context of Control Room Habitability." (ADAMS Accession No. ML040300694).
: 9. Regulatory Guide 1.52, Revision 3 R.E. Ginna Nuclear Power Plant                    B 3.7.9-7                                  Revision 51
 
CREATS B 3.7.9 Figure B 3.7.9-1 CREATS R.E. Ginna Nuclear Power Plant    B 3.7.9-8    Revision 51
 
ABVS B 3.7.10 B 3.7    PLANT SYSTEMS B 3.7.10    Auxiliary Building Ventilation System (ABVS)
BASES BACKGROUND              The ABVS filters airborne radioactive particulates from the area of the spent fuel pool (SFP) following a fuel handling accident. The ABVS, in conjunction with other normally operating systems, also provides environmental control of temperature and humidity in the Auxiliary Building including the SFP area.
The ABVS consists of an air handling unit, a series of exhaust fans, charcoal filters, ductwork, and dampers (Ref. 1). The exhaust fans include the following fans which all discharge into a common ductwork that supplies the Auxiliary Building main exhaust fans A and B (see Figure B 3.7.10-1):
: a.      Intermediate Building exhaust fans A and B;
: b.      Auxiliary Building exhaust fan C;
: c.      Auxiliary Building charcoal filter fans A and B;
: d.      Auxiliary Building exhaust fan G; and
: e.      Control access exhaust fans A and B.
The only components which filter the environment associated with the SFP are the Auxiliary Building main exhaust fans and Auxiliary Building exhaust fan C. Therefore, these are the only fans considered with respect to the ABVS in this LCO.
Auxiliary Building exhaust fan C takes suction from the SFP and decontamination pit areas on the operating level of the Auxiliary Building.
The air is first drawn through the SFP Charcoal Adsorber System which consists of roughing filters and charcoal adsorbers. The roughing filters protect the charcoal adsorbers from being fouled with dirt particles while the charcoal adsorbers remove the radioactive iodines from the atmosphere. Auxiliary Building exhaust fan C then discharges into the common ductwork that supplies the Auxiliary Building main exhaust fans.
This common ductwork contains a high efficiency particulate air (HEPA) filter which is not credited in the dose analyses.
R.E. Ginna Nuclear Power Plant                  B 3.7.10-1                                Revision 62
 
ABVS B 3.7.10 The Auxiliary Building main exhaust fans are each 100% capacity fans which can maintain a negative pressure on the operating floor of the Auxiliary Building through orientation of the system dampers. This negative pressure causes air flow on the operating floor to be toward the SFP which ensures that air in the vicinity of the SFP is first filtered through the SFP Charcoal Adsorber System. The Auxiliary Building main exhaust fans and exhaust fan C are powered from non-Engineered Safeguards Features buses.
The Auxiliary Building main exhaust fans discharge to the plant vent stack. The plant vent stack is continuously monitored for noble gases (R-14), particulates (R-13) and iodine (R-10B). During normal power operation, the ABVS is placed in the "out" mode by the interlock mode switch where "out" defines the status of the SFP charcoal filters. This causes all exhaust fans without any HEPA or charcoal filters (excluding the Auxiliary Building Main exhaust fans) and Auxiliary Building exhaust fan C to trip upon a signal from R-13 or R-14 to stop the release of any radioactive gases. During fuel movement within the Auxiliary Building, the interlock mode switch is placed in the "in" mode such that only exhaust fans without any HEPA or charcoal filters (excluding Auxiliary Building main exhaust fans) are tripped.
APPLICABLE            The ABVS design basis is established by the consequences of the Fuel SAFETY                Handling Accident (FHA) in the Spent Fuel Pool (SFP) as modeled in ANALYSES              Reference 6 and approved by the NRC in Reference 7. Reference 6 describes the analysis of two FHA scenarios, one modeling activity egress through the open roll-up door in the south wall of the auxiliary building into the Canister Prep Building without ABVS or filtration and the second modeling activity egress through the plant vent with ABVS and filtration. The limiting FHA in the SFP is the release through the open roll-up door in the south wall of the auxiliary building. The offsite and control room doses for this FHA exceed that of the FHA which assumes activity egress through the plant vent. Consistent with Reference 2, the FHA scenario with activity egress through the open roll-up door in the south wall of the auxiliary building into the Canister Prep Building is the Design Basis Accident (DBA) for FHA in the SFP area. The FHA analyses further assume that all fuel rods in the highest powered assembly are damaged and, in the case of release through the plant vent, account for the reduction in airborne radioactive material provided by the minimum filtration system components. Since SFP filtration is credited in the FHA analyses, the Auxiliary Building exhaust fan C, and either Auxiliary Building main exhaust fan A or B and SFP filtration must be OPERABLE and in operation. The FHA analyses result in offsite and control room doses well within the limits of 10 CFR 50.67 (Ref. 3). The FHA assumptions and analyses follow the guidance provided in Regulatory Guide 1.183 (Ref. 4).
R.E. Ginna Nuclear Power Plant                    B 3.7.10-2                                  Revision 62
 
ABVS B 3.7.10 The remainder of the ABVS described in the Background is not required for any DBA since it is non-safety related and supplied only from offsite power sources.
The ABVS satisfies Criterion 3 of the NRC Policy Statement.
LCO                  The ABVS is required to be OPERABLE to ensure that offsite and control room doses are well within the limits of 10 CFR 50.67 (Ref. 3) following a fuel handling accident in the Auxiliary Building.
The ABVS is considered OPERABLE when the individual components necessary to control exposure in the Auxiliary Building following a fuel handling accident are OPERABLE and in operation (see Figure B 3.7.10-1). The ABVS is considered OPERABLE when its associated:
: a. Auxiliary Building exhaust fan C and either Auxiliary Building main exhaust fan A or B is OPERABLE and in operation;
: b. Auxiliary Building main exhaust fan HEPA filter and SFP charcoal adsorbers are not excessively restricting flow, and the SFP Charcoal Adsorber System is capable of performing its filtration function;
: c. Ductwork, valves, and dampers are OPERABLE, and air circulation and negative pressure can be maintained on the Auxiliary Building operating floor; and
: d. Interlock mode switch is placed in the "in" mode.
APPLICABILITY        During movement of irradiated fuel in the Auxiliary Building, the ABVS is required to be OPERABLE to alleviate the consequences of a fuel handling accident. The ABVS is only required when one or more fuel assemblies in the Auxiliary Building has decayed < 60 days since being irradiated. Any fuel handling accident which occurs after 60 days results in offsite doses which are well within 10 CFR 50.67 limits (Ref. 3) due to the decay rate of iodine.
Since a fuel handling accident can only occur as a result of fuel movement, the ABVS is not MODE dependant and only required when irradiated fuel is being moved.
R.E. Ginna Nuclear Power Plant                    B 3.7.10-3                                Revision 62
 
ABVS B 3.7.10 ACTIONS              A.1 When the ABVS is inoperable, action must be taken to place the plant in a condition in which the LCO does not apply. Action must be taken immediately to suspend movement of irradiated fuel assemblies in the Auxiliary Building. This does not preclude the movement of fuel to a safe position.
Required Action A.1 is modified by a Note indicating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies in the Auxiliary Building which have decayed < 60 days since being irradiated, the fuel movement is independent of reactor operations. Therefore, inability to suspend movement of irradiated fuel assemblies is not sufficient reason to require a reactor shutdown.
SURVEILLANCE          SR 3.7.10.1 REQUIREMENTS This SR verifies the OPERABILITY of the ABVS. During fuel movement operations, the ABVS is designed to maintain a slight negative pressure in the Auxiliary Building to prevent unfiltered LEAKAGE. This SR ensures that Auxiliary Building exhaust fan C, and either Auxiliary Building main exhaust fan A or B are in operation and that the ABVS interlock mode switch is in the correct position. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.7.10.2 This SR verifies the integrity of the Auxiliary Building enclosure. The ability of the Auxiliary Building to maintain negative pressure with respect to the uncontaminated outside environment must be periodically verified to ensure proper functioning of the ABVS. During fuel movement operations, the ABVS is designed to maintain a slight negative pressure in the Auxiliary Building to prevent unfiltered leakage. This SR ensures that a negative pressure is being maintained in the Auxiliary Building.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.7.10.3 This SR verifies that the required SFP Charcoal Adsorber System testing is performed in accordance with the Ventilation Filter Testing Program (VFTP). The SFP Charcoal Adsorber System filter tests are in general accordance with Regulatory Guide 1.52 (Ref. 5). The VFTP includes R.E. Ginna Nuclear Power Plant                B 3.7.10-4                                  Revision 77
 
ABVS B 3.7.10 testing charcoal adsorber efficiency, minimum system flow rate, and the physical properties of the activated charcoal (general use and following specific operations). There is no minimum required flowrate through the SFP charcoal adsorbers since SR 3.7.10.2 requires verification that a negative pressure is maintained during fuel movement in the Auxiliary Building. As long as this minimum pressure is maintained by drawing air from the surface of the SFP through the SFP charcoal adsorbers, the assumptions of the accident analyses are met. Specific test frequencies and additional information are discussed in detail in the VFTP. However, the maximum surveillance interval for refueling outage tests is based on 24 month refueling cycles and not 18 month cycles as defined by Regulatory Guide 1.52 (Ref. 5).
REFERENCES            1. UFSAR, Section 9.4.2.
: 2. UFSAR, Section 15.7.3.
: 3. 10 CFR 50.67.
: 4. Regulatory Guide 1.183.
: 5. Regulatory Guide 1.52, Rev. 2.
: 6. Calculation DA-NS-08-050 Rev. 0, "Ginna Fuel Handling Accident Offsite and Control Room Doses", 10/30/2008.
: 7. License Amendment No. 107, "R.E. Ginna Nuclear Power Plant -
Amendment Re: Containment Operability during Refueling Operations (TAC No. ME0203)," 8/12/2009.
R.E. Ginna Nuclear Power Plant                  B 3.7.10-5                                Revision 62
 
ABVS B 3.7.10 Figure B 3.7.10-1 ABVS R.E. Ginna Nuclear Power Plant    B 3.7.10-6    Revision 62
 
SFP Water Level B 3.7.11 B 3.7    PLANT SYSTEMS B 3.7.11    Spent Fuel Pool (SFP) Water Level BASES BACKGROUND            The minimum water level in the spent fuel pool (SFP) meets the assumptions of iodine decontamination factors following a fuel handling accident. The specified water level provides protection against exceeding the offsite dose limits.
The SFP is a seismically designed structure located in the Auxiliary Building (Ref. 1). Thepool is internally clad with stainless steel that has a leak chase system at each weld seam to minimize accidental drainage through the liner. The SFP is also provided with a barrier between the spent fuel storage racks and the fuel transfer system winch. This barrier, up to the height of the spent fuel racks, prevents inadvertent drainage of the SFP via the fuel transfer tube.
The SFP Cooling System is designed to maintain the pool  120&#xba;F during normal conditions and refueling operations (Ref. 2). The cooling system normally takes suction near the surface of the SFP such that a failure of any pipe in the system will not drain the pool. The cooling system return line to the pool also contains a passive siphon breaker device located approximately 18 inches below normal pool level to prevent siphoning.
Finally, control board alarms exist with respect to the SFP level and temperature. These features all help to prevent inadvertent draining of the SFP.
APPLICABLE            The minimum water level in the SFP is an assumption of the fuel handling SAFETY                accident described in the UFSAR (Ref. 3) and Regulatory Guide 1.183 ANALYSES              (Ref. 4). With a minimum decay time of 72 hours, the resultant 2 hour TEDE per person at the exclusion area boundary as based on this assumption is a small fraction of the 10 CFR 50.67 (Ref. 5) limits. Fuel moved in the SFP is required to have 100 hours of decay in order to maintain the assumptions used in the tornado missile accident described in the UFSAR (Ref. 6).
Based on the requirements of Reference 4, there must be 23 ft of water between the top of the damaged fuel bundle and the fuel pool surface during a fuel handling accident. With 23 ft of water available, the assumptions of Reference 4 can be used directly. These assumptions include the use of an overall decontamination factor of 200 in the analysis for iodine. A decontamination factor of 200 enables the analysis to assume that 99.5% of the total iodine released from the pellet to cladding gap of all dropped fuel assembly rods is retained by the SFP R.E. Ginna Nuclear Power Plant                  B 3.7.11-1                                  Revision 79
 
SFP Water Level B 3.7.11 water. The fuel pellet to cladding gap is assumed to contain 10% to 16%
of the total fuel rod iodine inventory based on Reference 3.
In practice, this LCO preserves this assumption for the bulk of the fuel in the storage racks. In the case of a single bundle dropped and lying horizontally on top of the spent fuel storage racks, however, there may be
                          < 23 ft of water between the top of the fuel bundle and the surface, indicated by the width of the bundle and difference between the top of the rack and active fuel. To offset this small nonconservatism, the analysis assumes that all fuel rods fail, although analysis shows that only the first few rows fail from a hypothetical maximum drop.
The SFP water level satisfies Criterion 2 of the NRC Policy Statement.
LCO                  The SFP water level is required to be  23 ft over the top of irradiated fuel assemblies seated in the storage racks. The specified water level preserves the assumptions of the fuel handling accident analysis (Ref. 3).
As such, it is the minimum required during movement of irradiated fuel assemblies within the SFP.
APPLICABILITY        This LCO applies during movement of irradiated fuel assemblies in the spent fuel pool, since the potential for a release of fission products exists.
Since a fuel handling accident can only occur during movement of fuel, this LCO is not applicable during other conditions. During refueling operations in MODE 6, the SFP water level (and boron concentration) are in equilibrium with the refueling water cavity. The water level under these conditions is then controlled by LCO 3.9.6, "Refueling Cavity Water Level" which requires the refueling cavity water level to be maintained 23 feet above the top of the reactor vessel flange. A refueling cavity water level of  23 feet above the top of the reactor vessel flange will result in > 23 feet of water above the top of the active fuel in the storage racks assuming that atmospheric pressure within containment and the Auxiliary Building are equivalent.
R.E. Ginna Nuclear Power Plant                    B 3.7.11-2                                  Revision 59
 
SFP Water Level B 3.7.11 ACTIONS              A.1 When the initial conditions assumed in the fuel handling accident analysis cannot be met, steps should be taken to preclude the accident from occurring. When the SFP water level is lower than the required level, the movement of irradiated fuel assemblies in the SFP is immediately suspended. This action effectively precludes the occurrence of a fuel handling accident. This does not preclude movement of a fuel assembly to a safe position (e.g., movement to an available rack position).
Required Action A.1 is modified by a Note indicating that LCO 3.0.3 does not apply since if moving irradiated fuel assemblies while in MODE 5 or 6, LCO 3.0.3 would not be applicable. If moving irradiated fuel assemblies while in MODES 1, 2, 3, and 4, the fuel movement is independent of reactor operations. Therefore, inability to suspend movement of irradiated fuel assemblies is not sufficient reason to require a reactor shutdown.
SURVEILLANCE          SR 3.7.11.1 REQUIREMENTS This SR verifies sufficient SFP water is available in the event of a fuel handling accident. The water level in the spent fuel pool must be checked periodically during movement of irradiated fuel assemblies to ensure the fuel handling accident assumptions are met. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
Verification of SFP water level can be accomplished by several means.
The top of the upper SFP pump suction line is 23 ft above the fuel stored in the pool. If there is  23 ft of water above the reactor vessel flange (as required by LCO 3.9.6), with equal pressure in the containment and the Auxiliary Building, then at least 23 ft of water is available above the top of the active fuel in the storage racks.
In addition to the physical design features, there are two SFP level alarms (LAL 634) which are available to alert the operators of changing SFP level. A low level alarm will actuate when the SFP water level falls below elevation 276' 1.5" (22.5 inches from top of liner), while a high level alarm will actuate when the SFP water level rises above elevation 277' (12 inches from top of liner). These alarms must receive a calibration consistent with industry practices before they are to be used to meet this SR.
R.E. Ginna Nuclear Power Plant                B 3.7.11-3                                  Revision 79
 
SFP Water Level B 3.7.11 REFERENCES            1. UFSAR, Section 9.1.2.
: 2. UFSAR, Section 9.1.3.
: 3. UFSAR, Section 15.7.3.
: 4. Regulatory Guide 1.183.
: 5. 10 CFR 50.67.
: 6. UFSAR, Section 9.1.2.7 R.E. Ginna Nuclear Power Plant              B 3.7.11-4    Revision 59
 
SFP Boron Concentration B 3.7.12 B 3.7    PLANT SYSTEMS B 3.7.12    Spent Fuel Pool (SFP) Boron Concentration BASES BACKGROUND            The water in the spent fuel pool (SFP) normally contains soluble boron, which results in large subcriticality margins under actual operating conditions. To maintain a 5% subcritical margin (Keff  0.95), a total of 975 ppm of soluble boron is required. This total is composed of four components; 377 ppm for Keff  0.95, 207 ppm to account for reactivity equivalencing methodologies, 381 ppm for the most limiting fuel mishandling event, and 10 ppm to account for B-10 depletion from recycled boron. In the absence of all soluble boron, the spent fuel pool is subcritical (Keff < 1.00), not accounting for a fuel mishandling event.
These two conditions (established in References 3 and 4) are met without crediting any of the Boraflex that was originally installed in Region 2.
Hence, the design of both SFP regions is such that the SFP configuration control (i.e., controlling the movement of the fuel assembly and checking the location of each assembly after movement) maintains each region in a subcritical condition during normal operation with the regions fully loaded.
The soluble boron concentration (975 ppm), required to maintain Keff 0.95 also addresses the single most limiting reactivity insertion accident in the spent fuel pool, a fuel mishandling event in a Region 2 Type 1 cell.
Therefore, the 975 ppm (determined from Reference 7) of soluble boron will maintain Keff  0.95 assuming the most limiting fuel mishandling event. This was established without crediting any Boraflex in the Region 2 Type 1 cells. Safe operation of the storage racks may therefore be achieved by controlling the location of each assembly in accordance with LCO 3.7.13, "Spent Fuel Pool (SFP) Storage" and by maintaining the minimum boron concentration required. Within 7 days prior to movement of an assembly into a SFP region, it is necessary to perform SR 3.7.12.1.
Prior to moving an assembly into a SFP region, it is also necessary to perform SR 3.7.13.1.
R.E. Ginna Nuclear Power Plant                    B 3.7.12-1                                Revision 83
 
SFP Boron Concentration B 3.7.12 APPLICABLE            The postulated accidents in the SFP can be divided into three basic SAFETY                categories (Refs. 1, 2, 5, 6, and 7). The first category are events which ANALYSES              cause a loss of cooling in the SFP. Changes in the SFP temperature could result in an increase in positive reactivity. However, the positive reactivity is ultimately limited by a combination of voiding (which would result in the addition of negative reactivity) and the SFP geometry, and the high boron concentration in the SFP. The SFP criticality safety analysis encompasses a temperature range of 50-212&#xba;F. The second category is related to the movement of fuel assemblies in the SFP (i.e., a fuel handling accident) and is the most limiting accident scenario with respect to reactivity. The types of accidents within this category include an incorrectly transferred fuel assembly and a dropped fuel assembly.
However, for both of these accidents, the negative reactivity effect of the soluble boron compensates for the increased reactivity. By closely controlling the movement of each assembly and by checking the location of each assembly after movement, the time period for potential accidents which credit use of the soluble boron may be limited to a small fraction of the total operating time. The third category consists of boron reduction events for which an analysis of potential scenarios which could dilute the boron concentration in the SFP has been performed (Reference 6). The analysis demonstrates that sufficient time is available to detect and mitigate the dilution prior to exceeding the 0.95 keff design basis. The potential plant events were quantified to show that sufficient time is available to enable adequate detection and mitigation of any postulated dilution event. Determinisitic dilution event calculations were performed to define the dilution times and volumes necessary to dilute the 213,600 gallon SFP water inventory from the minimum required 2300 ppm to a soluble boron concentration of 975 ppm. Assuming a well mixed pool, the volume required to dilute the pool from 2300 to 975 ppm was determined to be 183,000 gallons. Based on the above evaluation, an unplanned or inadvertent event which would reduce the SFP boron concentration from 2300 ppm to 975 ppm is not credible.
The concentration of dissolved boron in the SFP satisfies Criterion 2 of the NRC Policy Statement.
LCO                  The SFP boron concentration is required to be  2300 ppm. The total soluble boron required to maintain Keff  0.95 (with soluble boron credit) is determined to be 975 ppm. The specified boron concentration also addresses the single fuel mishandling accident and is the minimum required concentration for fuel assembly storage.
R.E. Ginna Nuclear Power Plant                  B 3.7.12-2                                  Revision 83
 
SFP Boron Concentration B 3.7.12 APPLICABILITY        This LCO applies whenever fuel assemblies are stored in the SFP to ensure the SFP keff remains  0.95 at all times.
ACTIONS              A.1 and A.2 When the concentration of boron in the SFP is less than required, immediate action must be taken to preclude the occurrence of an accident or to mitigate the consequences of an accident in progress. This is most efficiently achieved by immediately suspending the movement of fuel assemblies. The initiation of actions to restore concentration of boron is simultaneous with suspending movement of fuel assemblies.
The Required Actions are modified by a Note indicating that LCO 3.0.3 does not apply since if the LCO is not met while moving irradiated fuel assemblies in MODE 5 or 6, LCO 3.0.3 would not be applicable. If moving irradiated fuel assemblies while in MODE 1, 2, 3, or 4, the fuel movement is independent of reactor operation. Therefore, inability to suspend movement of fuel assemblies is not sufficient reason to require a reactor shutdown.
SURVEILLANCE          SR 3.7.12.1 REQUIREMENTS This SR verifies that the concentration of boron in the SFP is within the limit. As long as this SR is met, the analyzed accidents are fully addressed. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
R.E. Ginna Nuclear Power Plant                  B 3.7.12-3                                Revision 77
 
SFP Boron Concentration B 3.7.12 REFERENCES            1. Framatome Technologies, Inc., "R.E. Ginna Nuclear Power Plant, Spent Fuel Pool Re-racking Licensing Report," Section 4, February 1997.
: 2. UFSAR, Section 15.7.3.
: 3. Newmeyer, W.D., "Westinghouse Spent Fuel Rack Criticality Analysis Methodology", WCAP-14416-NP-A, Revision 1, November 1996.
: 4. Letter from T.E. Collins, U.S. NRC to T. Greene, WOG, "Acceptance for Referencing Topical Report WCAP-1446-P, Westinghouse Spent Fuel Rack Methodology (TAC No. M93254)",
October 25, 1996.
: 5. ABB Combustion Engineering Nuclear Power, "R.E. Ginna Nuclear Power Plant Criticality Safety Analysis for the Spent Fuel Storage Rack Using Soluble Boron Credit", February 2000.
: 6. ABB Combustion Engineering Nuclear Power, "R.E. Ginna Spent Fuel Pool Boron Dilution Analysis", January 2000.
: 7. A-RGE-FE-0003, "Ginna Spent Fuel Pool Criticality Analysis,"
Revision 003, March 22, 2016.
R.E. Ginna Nuclear Power Plant              B 3.7.12-4                                  Revision 83
 
SFP Storage B 3.7.13 B 3.7    PLANT SYSTEMS B 3.7.13    Spent Fuel Pool (SFP) Storage BASES BACKGROUND            The spent fuel pool (SFP) is divided into two separate and distinct regions (see Figure B 3.7.13-1) which, for the purpose of criticality considerations, are considered as separate pools (Ref. 1). Region 1 is designed to accomodate new or spent fuel. Region 2 is designed to accomodate spent fuel. The total storage capacity of the SFP is limited to the equivalent of 1321 fuel assemblies (Ref. 8)
Region 1, with 294 storage positions, is designed to accommodate new or high reactivity spent fuel utilizing a checkerboard arrangement. New fuel assemblies are limited to a maximum nominal initial enrichment of 5.0 wt% U-235. The nominal enrichment does not include the standard manufacturing tolerance of +/- 05 wt% about the nominal fresh reference enrichment. The tolerance is taken into account in the criticality analysis.
Fuel assemblies with minimum burnups above the curve in Figure 3.7.13-1 (area A) may be stored at any location within Region 1. Fuel assemblies with minimum burnups below the curve in Figure 3.7.13-1 (area B) may be stored in cells with lead-in funnels only. This will result in a Keff  95 (with soluble boron credit) for Region 1.
Region 2, with 1027 storage positions, is designed to accommodate fuel of various initial enrichments which have various accumulated minimum burnups and decay times. Decay time refers to the time period for which the fuel assembly has been residing since irradiation from power operation in the reactor. Region 2 is described by two types of cells; Type 1 and Type 2 cells.
For the storage of fuel assemblies in Type 1 cells, the acceptable combination of initial enrichment, burnups and decay times are according to Figures 3.7.13-2 through 3.7.13-6. Fuel assemblies with initial enrichments, burnups and decay times, within domain A1 of Figures 3.7.13-2 through 3.7.13-6 may be stored in any location in Region 2 Type 1 cells. Fuel assemblies with initial enrichments, burnups and decay times, within domain A2 of Figures 3.7.13-2 through 3.7.13-6 shall be stored face-adjacent to a Type A1 or A2 assembly, or a water cell in Region 2 Type 1 cells. Fuel assemblies with initial enrichment, burnups and decay times, within domain B of Figures 3.7.13-2 through 3.7.13-6 shall be stored face-adjacent to a Type A1 assembly, or a water cell within Region 2 Type 1 cells. Fuel assemblies with initial enrichments, burnups and decay times, within domain C of Figures 3.7.13-2 through 3.7.13-6 shall be stored face-adjacent to a water cell only, in Region 2 Type 1 cells.
R.E. Ginna Nuclear Power Plant                    B 3.7.13-1                                Revision 49
 
SFP Storage B 3.7.13 For the storage of fuel assemblies in Type 2 cells, the acceptable combination of initial enrichment, burnups and decay times are according to Figures 3.7.13-7 through 3.7.13-11. Fuel assemblies with initial enrichments, burnups and decay times, within domain A1 of Figures 3.7.13-7 through 3.7.13-11 may be stored in any location in Region 2 Type 2 cells. Fuel assemblies with initial enrichments, burnups and decay times, within domain A2 of Figures 3.7.13-7 through 3.7.13-11 shall be stored face-adjacent to a Type A1 or A2 assembly, or a water cell in Region 2 Type 2 cells. Fuel assemblies with initial enrichments, burnups and decay times, within domain B of Figures 3.7.13-7 through 3.7.13-11 shall be stored face-adjacent to a Type A1 assembly, or a water cell in Region 2 Type 2 cells. Fuel assemblies with initial enrichments, burnups and decay times, within domain C of Figures 3.7.13-7 through 3.7.13-11 shall be stored face-adjacent to a water cell only, in Region 2 Type 2 cells.
The word "face-adjacent" is defined to mean that the flat surface of a fuel assembly in one cell faces the flat surface of the fuel assembly in the next cell. The storage of fuel assemblies which are within the acceptable ranges of Figures 3.7.13-2 through 3.7.13-6 and 3.7.13-7 through 3.7.13-11, in Region 2 ensures a Keff  0.95 (with soluble boron credit) in this region.
Consolidated rod storage canisters can also be stored in either region in the SFP provided that the minimum burnup of Figures 3.7.13-1 through Figure 3.7.13-11 are met (Ref. 2). The canisters are stainless steel containers which contain the fuel rods of a maximum of two fuel assemblies (i.e., 358 rods). In addition, failed fuel rods may be stored in the consolidated rod storage canisters. All bowed, broken, or otherwise failed fuel rods are first stored in a stainless steel tube of 0.75 inch outer diameter before being placed in a canister. Each canister will accommodate 110 failed fuel rod tubes.
The failed fuel storage basket has been explicitly modeled with up to nominal 5.0 wt% enriched fuel rods in each location in the basket. It has been shown to be acceptable in any location in the pool regardless of the burnup of the rods contained within it (A1 status for Region 2).
Other items may be stored in the SFP in addition to fresh or discharged fuel assemblies. These items, in general, fall into the category of Non-Special Nuclear Material (SNM). These items are non-multiplying and, in general, are parasitic to the spent fuel rack local reactivity. Some of the items which fall under this category that can be safely stored in the spent fuel pool are: Dummy Canisters containing Non-SNM, Consolidation Hardware, Dummy Fuel Assemblies, Trash Basket containing full length control rods, etc. The general rule for safely storing these types of items is very simple: any non-multiplying and non-fissile item can be safely stored in any cell location. The storing of these components within a R.E. Ginna Nuclear Power Plant                    B 3.7.13-2                                    Revision 78
 
SFP Storage B 3.7.13 water cell does not affect the classification of the cell, i.e., it is still considered a water cell.
The water in the SFP contains soluble boron, which results in large subcriticality margins under actual operating conditions. To maintain a 5% subcritical margin (Keff  0.95), a total of 975 ppm of soluble boron is required. This total is composed of four components; 377 ppm for Keff 0 .95, 207 ppm to account for reactivity equivalencing methodologies, 381 ppm for the most limiting fuel mishandling event, and 10 ppm to account for B-10 depletion from recycled boron. In the absence of all soluble boron, the spent fuel pool is subcritical (Keff < 1.00), not accounting for a fuel mishandling event. These two conditions (established in References 4 and 5) are met without crediting any of the Boraflex that was originally installed in Region 2. Hence, the design of both regions is such that the SFP configuration control (i.e., controlling the movement of the fuel assembly and checking the location of each assembly after movement) maintains each region in a subcritical condition during normal operation with the regions fully loaded.
The soluble boron concentration (975 ppm), required to maintain Keff 0.95 also addresses the single most limiting reactivity insertion accident in the spent fuel pool, a fuel mishandling event in a Region 2 Type 1 cell.
Therefore, the 975 ppm (determined from Reference 6) of soluble boron will maintain Keff  0.95 assuming the most limiting fuel mishandling event. The was established without crediting any Boraflex in the Region 2 Type 1 cells.
Safe operation of the storage racks may therefore be achieved by controlling the location of each assembly in accordance with this LCO and by maintaining the minimum boron concentration required per LCO 3.7.12. Within 7 days prior to movement of an assembly into a SFP region, it is necessary to perform SR 3.7.12.1. Prior to moving an assembly into a SFP region, it is also necessary to perform SR 3.7.13.1.
APPLICABLE            The postulated accidents in the SFP can be divided into three basic SAFETY                categories (Refs. 2, 3, 6, and 7). The first category are events which ANALYSES              cause a loss of cooling in the SFP. Changes in the SFP temperature could result in an increase in positive reactivity. However, the positive reactivity is ultimately limited by a combination of voiding (which would result in the addition of negative reactivity), the SFP geometry, and the high boron concentration in the SFP. The SFP criticality safety analysis encompasses a temperature range of 50-212&#xba;F. The second category is related to the movement of fuel assemblies in the SFP (i.e., a fuel handling accident) and is the most limiting accident scenario with respect to reactivity. The types of accidents within this category include an incorrectly transferred fuel assembly and a dropped fuel assembly.
R.E. Ginna Nuclear Power Plant                B 3.7.13-3                                      Revision 49
 
SFP Storage B 3.7.13 However, for both of these accidents, the negative reactivity effect of the soluble boron compensates for the increased reactivity. By closely controlling the movement of each assembly and by checking the location of each assembly after movement, the time period for potential accidents may be limited to a small fraction of the total operating time. The third category consists of boron reduction events for which an analysis of potential scenarios which could dilute the boron concentration in the SFP has been performed (Reference 7). The analysis demonstrates that sufficient time is available to detect and mitigate the dilution prior to exceeding the 0.95 keff design basis. The potential plant events were quantified to show that sufficient time is available to enable adequate detection and mitigation of any potential dilution event. Deterministic dilution event calculations were performed to define the dilution times and volumes necessary to dilute the 213,600 gallon SFP water inventory from the minimum required 2300 ppm to a soluble boron concentration of 975 ppm. Assuming a well mixed pool, the volume required to dilute the pool from 2300 to 975 ppm was determined to be 183,000 gallons.
Based on the above evaluation, an unplanned or inadvertent event which would reduce the SFP boron concentration from 2300 ppm to 975 ppm is not credible.
The configuration of fuel assemblies in the spent fuel pool satisfies Criterion 2 of the NRC Policy Statement.
LCO                  The restrictions on the placement of fuel assemblies within the SFP ensure the Keff of the SFP will always remain  0.95 (with soluble boron credit). For fuel assemblies stored in Region 1, the maximum nominal enrichment of the fuel assembly shall not be greater than 5.0 wt% and the initial enrichment and burnup values are within the acceptable area of Figure 3.7.13-1. For fuel assemblies stored in Region 2 Type 1 cells, the initial enrichment and burnup values for various decay times shall be within the acceptable area of Figures 3.7.13-2 through 3.7.13-6. For fuel assemblies stored in Region 2 Type 2 cells, the initial enrichment and burnup values for various decay times shall be within the acceptable area of Figures 3.7.13-7 through 3.7.13-11. The word "face-adjacent" is defined to mean that the flat surface of a fuel assembly in one cell faces the flat surface of the assembly in the next cell.
The x-axis of all these figures is the nominal U-235 enrichment wt%
which does not include the +/- 0.05 wt% tolerance that is allowed for fuel manufacturing.
R.E. Ginna Nuclear Power Plant                  B 3.7.13-4                                    Revision 49
 
SFP Storage B 3.7.13 APPLICABILITY        This LCO applies whenever any fuel assembly is stored in the SFP.
ACTIONS              A.1 When the configuration of fuel assemblies stored in either Region 1 or Region 2 of the SFP is not within the LCO limits, the immediate action is to initiate action to make the necessary fuel assembly movement(s) to bring the configuration into compliance with Specification 4.3.1.1. This compliance can be made by relocating the fuel assembly to a different region or to an acceptable new location within the same region.
Required ACTION A.1 is modified by a Note indicating that LCO 3.0.3 does not apply since if the LCO is not met while moving irradiated fuel assemblies in MODE 5 or 6, LCO 3.0.3 would not be applicable. If moving irradiated fuel assemblies while in MODE 1, 2, 3, or 4, the ACTION is independent of reactor operation. Therefore, inability to move fuel assemblies is not sufficient reason to require a reactor shutdown.
SURVEILLANCE          SR 3.7.13.1 REQUIREMENTS This SR verifies by administrative means that the maximum nominal initial enrichment of each fuel assembly is  5.0 wt% U-235 and that the initial enrichment and burnup values of the fuel assemblies, with various decay times, are in accordance with Figures 3.7.13-1 through 3.7.13-11 prior to storage or movement in the SFP. Once a fuel assembly has been verified to be within the acceptable range of Figures 3.7.13-1 through 3.7.13-11 for its correct location, further verfications are no longer required since the initial enrichment of each assembly will not change (i.e., increase) while partially burned fuel assemblies are less reactive than when they were new. Performance of this SR ensures compliance with Specification 4.3.1.1.
R.E. Ginna Nuclear Power Plant                B 3.7.13-5                                  Revision 49
 
SFP Storage B 3.7.13 REFERENCES          1. UFSAR, Section 9.1.2.
: 2. Framatome Technologies, Inc., "R.E. Ginna Nuclear Power Plant, Spent Fuel Pool Re-racking Licensing Report," Section 4, February 1997.
: 3. UFSAR, Section 15.7.3.
: 4. Newmeyer, W.D., "Westinghouse Spent Fuel Rack Criticality Analysis Methodology", WCAP-14416-NP-A, Revision 1, November 1996.
: 5. Letter from T.E. Collins, U.S. NRC to T. Greene, WOG, "Acceptance for Referencing Topical Report WCAP-14416-P, Westinghouse Spent Fuel Rack Methodology (TAC No. M93254)", October 25, 1996.
: 6. ABB Combustion Engineering Nuclear Power, "R.E. Ginna Nuclear Power Plant Criticality Safety Analysis for the Spent Fuel Storage Rack Using Soluble Boron Credit", February 2000.
: 7. ABB Combustion Engineering Nuclear Power, "R.E. Ginna Spent Fuel Pool Boron Dilution Analysis", January 2000.
: 8. Letter from P. D. Milano (NRC) to M. G. Korsnick (Ginna LLC), "R.
E. Ginna Nuclear Power Plant-Amendment Re: 16.8 Percent Power Uprate (TAC No. MC7382)", dated July 11, 2006.
R.E. Ginna Nuclear Power Plant              B 3.7.13-6                                Revision 49
 
SFP Storage B 3.7.13 Figure B 3.7.13-1 Spent Fuel Pool R.E. Ginna Nuclear Power Plant    B 3.7.13-7      Revision 49
 
Secondary Specific Activity B 3.7.14 B 3.7    PLANT SYSTEMS B 3.7.14    Secondary Specific Activity BASES BACKGROUND            Activity in the secondary coolant results from steam generator (SG) tube outleakage from the Reactor Coolant System (RCS). Under steady state conditions, the activity is primarily iodines with relatively short half lives and, thus, indicates current conditions. During transients, I-131 spikes can be observed as well as increased releases of some noble gases.
Other fission product isotopes, as well as activated corrosion products in lesser amounts, may also be found in the secondary coolant.
A limit on secondary coolant specific activity during power operation minimizes releases to the environment because of normal operation, anticipated operational occurrences, and Design Basis accidents (DBAs).
This limit is based on an activity value that might be expected from a 0.1 gpm tube leak (LCO 3.4.13, "RCS Operational LEAKAGE") of primary coolant at the limit of 1.0 PCi/gm (LCO 3.4.16, "RCS Specific Activity"). A steam line break (SLB) is assumed to result in the release of the noble gas and iodine activity contained in the SG inventory, the feedwater, and the reactor coolant LEAKAGE. Most of the iodine isotopes have short half lives (i.e., < 20 hours). I-131, with a half life of 8.04 days, concentrates faster than it decays, but does not reach equilibrium because of blowdown and other losses.
Operating a plant at the allowable limits could result in exposure of a small fraction of the 10 CFR 50.67 (Ref. 1) limits.
APPLICABLE            The accident analysis of the SLB, (Ref. 2) assumes the initial secondary SAFETY                coolant specific activity to have a radioactive isotope concentration of ANALYSES              1.10 PCi/gm DOSE EQUIVALENT I-131. This assumption is used in the analysis for determining the radiological consequences of the postulated accident. The accident analysis, based on this and other assumptions, shows that the radiological consequences of an SLB do not exceed a small fraction of the 10 CFR 50.67 limits (Ref. 1).
R.E. Ginna Nuclear Power Plant                    B 3.7.14-1                                  Revision 42
 
Secondary Specific Activity B 3.7.14 With the loss of offsite power, the remaining SG is available for core decay heat dissipation by venting steam to the atmosphere through the MSSVs and steam generator atmospheric relief valve (ARV). The Auxiliary Feedwater System supplies the necessary makeup to the SG.
Venting continues until the reactor coolant temperature and pressure have decreased sufficiently for the Residual Heat Removal System to complete the cooldown.
In the evaluation of the radiological consequences of this accident, the activity released from the SG connected to the failed steam line is assumed to be released directly to the environment for approximately 600 seconds. The unaffected SG is assumed to discharge steam and any entrained activity through the MSSVs and ARV for the initial eight hours of the event. Primary coolant was assumed to be 1.0 PCi/gm for this analysis based on limits specified in LCO 3.4.16. The dose analysis (Ref. 2) shows the radiological consequences of a SLB accident are within a small fraction of the Reference 1 dose limits.
Secondary specific activity limits satisfy Criterion 2 of the NRC Policy Statement.
LCO                  The specific activity of the secondary coolant is required to be  0.10 PCi/
gm DOSE EQUIVALENT I-131 to limit the radiological consequences of a DBA to a small fraction of the required limit (Ref. 1).
Monitoring the specific activity of the secondary coolant ensures that when secondary specific activity limits are exceeded, appropriate actions are taken in a timely manner to place the plant in an operational MODE that would minimize the radiological consequences of a DBA.
APPLICABILITY        In MODES 1, 2, 3, and 4, the limits on secondary specific activity apply due to the potential for secondary steam releases to the atmosphere from a SLB.
In MODES 5 and 6, the SGs are not being used for heat removal. Both the RCS and SGs are depressurized, and primary to secondary LEAKAGE is minimal. Therefore, monitoring of secondary specific activity is not required.
R.E. Ginna Nuclear Power Plant                    B 3.7.14-2                                Revision 42
 
Secondary Specific Activity B 3.7.14 ACTIONS              A.1 and A.2 DOSE EQUIVALENT I-131 exceeding the allowable value in the secondary coolant, is an indication of a problem in the RCS and contributes to increased post accident doses. If the secondary specific activity is not within limits the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours, and in MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE          SR 3.7.14.1 REQUIREMENTS This SR verifies that the secondary specific activity is within the limits of the accident analysis. A gamma isotopic analysis of the secondary coolant, which determines DOSE EQUIVALENT I-131, confirms the validity of the safety analysis assumptions as to the source terms in post accident releases. It also serves to identify and trend any unusual isotopic concentrations that might indicate changes in reactor coolant activity or LEAKAGE. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES            1. 10 CFR 50.67.
: 2. Design Analysis DA-NS-2002-007, Main Steam Line Break Offsite and Control Room Doses.
R.E. Ginna Nuclear Power Plant                    B 3.7.14-3                                  Revision 77
 
AC Sources - MODES 1, 2, 3, and 4 B 3.8.1 B 3.8    ELECTRICAL POWER SYSTEMS B 3.8.1      AC Sources - MODES 1, 2, 3, and 4 BASES BACKGROUND            A source of electrical power is required for most safety related and nonessential active components. Two sources of electrical power are available, alternating current (AC) and direct current (DC). Separate distribution systems are developed for each of these electrical power sources which are further divided and organized based on voltage considerations and safety classification. This LCO is provided to specify the minimum sources of AC power which are required to supply the 480 V safeguards buses and associated distribution subsystem during MODES 1, 2, 3, and 4.
The plant AC sources consist of an independent offsite power source and the onsite standby emergency power source (Ref. 1). Atomic Industrial Forum (AIF) GDC 39 (Ref. 2) requires emergency power sources be provided and designed with adequate independence, redundancy, capacity, and testability to permit the functioning of the Engineered Safety Features (ESF) and protection systems. The offsite and onsite AC sources can each supply power to 480 V safeguards buses to ensure that reliable power is available during any normal or emergency mode of plant operation. The 480 V safeguards buses are divided into redundant trains so that the loss of any one train does not prevent the minimum safety functions from being performed. Safeguards Buses 14 and 18 are associated with Train A and safeguards Buses 16 and 17 are associated with Train B. Since only the onsite standby power source is classified as Class 1E, the offsite power source is not required to be separated into redundant trains.
The independent offsite power source consists of breakers, transformers, switches, interrupting devices, cabling, and controls required to transmit power from the offsite transmission network to the onsite 480 V safeguards buses. The independent offsite power source essentially begins from two station auxiliary transformers (SAT 12A and 12B) each supplied from an independent transmission line emanating from the same switchyard (see Figure B 3.8.1-1). SAT 12A is connected to the 115 kV transmission system (via 34.5 kV circuit 7T) and SAT 12B is connected to the 115 kV transmission system (via 34.5 kV circuit 767). The SATs may be configured in the following modes:
: a. SAT 12A (or SAT 12B) supplies safeguards Buses 16 and 17 and SAT 12B (or SAT 12A) supplies safeguards Buses 14 and 18 (50/
50 mode);
R.E. Ginna Nuclear Power Plant              B 3.8.1-1                                    Revision 74
 
AC Sources - MODES 1, 2, 3, and 4 B 3.8.1
: b. SAT 12A supplies all safeguards Buses (0/100 mode); or
: c. SAT 12B supplies all safeguards Buses (100/0 mode).
The preferred configuration is the 50/50 mode; however, all three modes of operation meet applicable design requirements for normal operation (Ref. 1). Offsite power can also be provided during an emergency through the plant auxiliary transformer 11 by backfeeding from the 115 kV transmission system and main transformer.
SATs 12A and 12B are each connected to two non-Class 1E, 4.16 kV buses (12A and 12B). The 4.16 kV Bus 12A feeds the Class 1E loads on the 480 V safeguards Buses 14 and 18 and 4.16 kV Bus 12B feeds the Class 1E loads on the 480 V safeguards Buses 16 and 17 (see Figure B 3.8.1-1). Loss of power to any of the safeguards buses, as a result of inoperable offsite circuit component(s), is a loss of offsite power. The offsite power source ends after the feeder breaker supplying each 480 V safeguards bus.
The onsite standby power sources consist of two 1950 kW continuous rating emergency diesel generators (DGs) connected to the safeguards buses to supply emergency power in the event of loss of all other AC power. The DGs are located in separate rooms in a Seismic Category I structure located adjacent to the northeast wall of the Turbine Building.
Each DG room has its own ventilation system. The ventilation system is designed to maintain the DG room between 60&#xba;F and 104&#xba;F during normal operation and to remove any hydrocarbon gases in the room (Ref.
3). Each ventilation system consists of two fans and associated ductwork and dampers. One fan is given a start permissive on DG actuation and will start when bus voltage is restored with normal operating room temperatures. The second fan designed to start when the room temperature reaches 90&#xba;F. The second fan's discharge air flow is directed to the DG instrument panel and starts after the room temperature reaches a preset temperature to prevent potentially freezing the cooling water jacket piping during cold weather conditions. During accident conditions the ventilation system has been analyzed to maintain the room 1 25&#xba;F on a maximum degree day and  140&#xba;F if only one fan is running (Ref. 9).
The DGs utilize an air motor for starting. The air motor is supplied by two receivers which provide sufficient air for five DG starts before requiring a recharge of the receivers. The DGs are supplied by separate fuel oil day tanks. Additional fuel oil can be transferred from redundant underground fuel oil storage tanks. A dedicated fuel oil transfer pump is used for this transfer. A cross-connection allows each transfer pump to supply either day tank. Redundancy of pumps and piping precludes the failure of one pump, or the rupture of any pipe, valve, or tank, to result in the loss of more than one DG.
R.E. Ginna Nuclear Power Plant                    B 3.8.1-2                                    Revision 74
 
AC Sources - MODES 1, 2, 3, and 4 B 3.8.1 DG A is dedicated to safeguards Buses 14 and 18 and DG B is dedicated to safeguards Buses 16 and 17. A DG starts automatically on a safety injection (SI) signal or on an undervoltage signal on its corresponding 480 V buses (refer to LCO 3.3.4, "Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation"). In the event of only an SI signal, the DGs automatically start and operate in the standby mode without tying to the safeguards buses.
In the event of loss of offsite power, or abnormal offsite power where offsite power is tripped as a consequence of bus undervoltage or degraded voltage, the DGs automatically start and tie to their respective buses. All bus loads except for the containment spray (CS) pump, component cooling water (CCW) pump and safety related motor control centers are tripped upon actuation of the undervoltage relays. This is independent of or coincident with an SI signal. Once the undervoltage relay resets independent of a SI signal, the operator may manually connect loads onto the bus(es). During a coincident SI signal, the CCW pump is also tripped and loads are sequentially connected to their respective buses by the automatic load sequencer.
In the event of loss of offsite power to only one safeguards bus in a train, the DG will automatically start and tie only to the affected bus. During a coincident SI signal, the normal feed breaker on the second bus on the affected train will be tripped by the undervoltage relay on the failed bus causing the DG to automatically tie to both buses. This condition will then actuate the automatic load sequencer.
In the event of a loss of offsite power and a coincident SI signal, the electrical loads are automatically connected to the DGs in sufficient time to provide for safe reactor shutdown and to mitigate the consequences of a Design Basis Accident (DBA). Certain required plant loads are returned to service in a predetermined sequence by the automatic load sequencer in order to prevent overloading the DG during the start process. Within approximately 1 minute after the initiating signal is received, all loads needed to recover the plant or maintain it in a safe condition are returned to service.
APPLICABLE            The initial conditions of DBA and transient analyses (Refs. 4 and 5)
SAFETY                assume ESF systems are OPERABLE. The AC electrical power sources ANALYSES              are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor Coolant System (RCS), and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, "Power Distribution Limits;" Section 3.4, "Reactor Coolant System (RCS);" and Section 3.6, "Containment Systems."
R.E. Ginna Nuclear Power Plant                B 3.8.1-3                                  Revision 74
 
AC Sources - MODES 1, 2, 3, and 4 B 3.8.1 The OPERABILITY of the AC electrical power sources is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the plant. This results in maintaining at least one train of the onsite standby power or offsite AC sources OPERABLE in the event of:
: a.      An assumed loss of all AC offsite power or all onsite standby AC power; and
: b.      A worst case single failure.
In the event of a DBA, the OPERABILITY requirements of the AC electrical power sources ensures that one train of offsite or onsite standby AC power is available with:
: a.      An assumed loss of all offsite power; and
: b.      A worst case single failure (including the loss of one train of onsite standby power).
In general, the accident analyses assume that all offsite power is lost at the time of the initiating event except where the availability of offsite power provides worst case conditions (e.g., steam line break with continued operation of the reactor coolant pumps). The availability of redundant offsite power sources (i.e., circuits 7T and 767) helps to reduce the potential to lose all offsite power. Providing redundant sources of offsite power also ensures that at least one AC power source is available if all onsite standby AC power is unavailable coincident with a single failure of one offsite power source during non accident conditions. In the event the plant is in the 100/0 or 0/100 mode, a redundant source of offsite power can be obtained by backfeeding through the main transformer using a flexible connection that can be tied into the plant auxiliary transformer 11. The plant can survive on the available battery power, alternate power sources, and turbine driven Auxiliary Feedwater pump during the estimated 8 hours required to provide this power transfer (Ref. 1). Therefore, the requirements of GDC 17 (Ref. 6) can be met at all times.
The DGs are designed to operate following a DBA or anticipated operational occurrence (AOO) until offsite power can be restored. An AOO is defined as a Condition 2 event in Reference 7 (i.e., events which can be expected to occur during a calendar year with moderate frequency). The DGs are required to start within 10 seconds and begin loading. The DGs can begin receiving up to 30% of design loads after the 10 second start time and can accept 100% of design loads within 30 seconds. The DGs are manually loaded if only an undervoltage signal is present and load sequenced if a coincident undervoltage and SI signal is present. The loads are sequenced as follows (assume SI signal at 0 seconds):
R.E. Ginna Nuclear Power Plant              B 3.8.1-4                                    Revision 74
 
AC Sources - MODES 1, 2, 3, and 4 B 3.8.1 DG Load                                                  DG A        DG B Time        Time 480V safeguards buses and CS pumps                        10        10 SI pump A and B                                          10        10 SI pump C                                                15        17 Residual heat removal pump                                20        22 Selected service water pump                              25        27 First containment recirculation fan cooler                30        32 Second containment recirculation fan cooler              35        37 Motor driven auxiliary feedwater pump                    40        42 The pumps and fans are assumed to be running within 5 seconds following breaker closure.
Since the DGs must start and begin loading within 10 seconds, only one air start must be available in the air receivers as assumed in the accident analyses. The long term operation of the DGs (until offsite power is restored) is discussed in LCO 3.8.3, "Diesel Fuel Oil."
The AC sources satisfy Criterion 3 of NRC Policy Statement.
LCO                  One qualified independent offsite power circuit connected between the offsite transmission network and the onsite 480 V safeguards buses and separate and independent DGs for each train ensure availability of the required power to shut down the reactor and maintain it in a safe shutdown condition after an AOO or a postulated DBA.
An OPERABLE qualified independent offsite power circuit is one that is capable of maintaining rated voltage, and accepting required loads during an accident, while connected to the 480 V safeguards buses required by LCO 3.8.9, "Distribution Subsystems - MODES 1, 2, 3, and 4." Power from either offsite power circuit 7T or 767 satisfies this requirement.
R.E. Ginna Nuclear Power Plant              B 3.8.1-5                                    Revision 74
 
AC Sources - MODES 1, 2, 3, and 4 B 3.8.1 A DG is considered OPERABLE when:
: a. The DG is capable of starting, accelerating to rated speed and voltage, and connecting to its respective 480 V safeguards buses on actuation of Loss of Power (LOP) DG Instrumentation within 10 seconds;
: b. All loads on each 480 V safeguards bus except for the safety related motor control centers, CCW pump, and CS pump are capable of being tripped on an undervoltage signal (CCW pump must be capable of being tripped on coincident SI and undervoltage signal);
: c. The DG is capable of accepting required loads both manually and within the assumed loading sequence intervals following a coincident SI and undervoltage signal, and continue to operate until offsite power can be restored to the safeguards bus (i.e., 40 hours);
: d. The DG day tank is available to provide fuel oil for  1 hour at 110%
design loads;
: e. The fuel oil transfer pump from the fuel oil storage tank to the associated day tank is OPERABLE including all required piping, valves, and instrumentation (long-term fuel oil supplies are addressed by LCO 3.8.3, "Diesel Fuel Oil");
: f. A ventilation train consisting of at least one of two fans and the associated ductwork and dampers is OPERABLE;
: g. The service water (SW) 'p through the diesel generator heat exchangers is within the limits specified in plant operating procedures for SW system configuration (as demonstrated during monthly testing); and
: h. Two service water AOVs to the diesel generator heat exchangers are OPERABLE (capable of opening) or, either one AOV is open or the manual bypass valve is open.
Any 480 V bus fault which opens and/or prevents closure of the breakers from offsite power or the DGs requires declaring the offsite power source or DG inoperable, as applicable.
The AC sources in one train must be separate and independent of the AC sources in the other train. For the DGs, separation and independence must be complete assuming a single active failure. For the independent offsite power source, separation and independence are to the extent practical (i.e., operation is preferred in the 50/50 mode, but may also exist in the 100/0 or 0/100 mode).
R.E. Ginna Nuclear Power Plant              B 3.8.1-6                                  Revision 74
 
AC Sources - MODES 1, 2, 3, and 4 B 3.8.1 APPLICABILITY        The AC sources are required to be OPERABLE in MODES 1, 2, 3, and 4 to ensure that:
: a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients; and
: b. Adequate core cooling is provided and containment OPERABILITY and other vital functions are maintained in the event of a postulated DBA.
The AC power requirements for MODES 5 and 6 are covered in LCO 3.8.2, "AC Sources - MODES 5 and 6."
ACTIONS              A Note prohibits the application of LCO 3.0.4.b to an inoperable DG.
There is an increased risk associated with entering a MODE or other specified condition in the Applicability with an inoperable DG and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.
A.1 and A.2 With offsite power to one or more 480V safeguard bus(es) inoperable, assurance must be provided that a coincident single failure will not result in a complete loss of required safety features. If the redundant safety feature to the component or train affected by the loss of offsite power is also unavailable, the assumption that two complete safety trains are OPERABLE may no longer exist. As an example, if offsite power were unavailable to 480 V Bus 14, DG A could supply the necessary power to the bus. If residual heat removal pump (RHR) B (supplied power by Bus
: 16) were inoperable at the same time, or at any time after the loss of offsite power to Bus 14, a loss of redundant required safety features exists since a failure of DG A would result in the loss of emergency core cooling. Therefore, RHR pump A on Bus 14 would have to be declared inoperable within 12 hours after RHR pump B and offsite power to Bus 14 were declared unavailable.
The Completion Time of 12 hours as provided by Required Action A.1 to declare the required safety features inoperable is based on the fact that it is less than the Completion Time for restoring OPERABILITY of the offsite power circuit and all safety features affected by the loss of the 480 V bus. A shorter Completion Time is provided since the required safety features have been potentially degraded by the loss of offsite power (i.e.,
R.E. Ginna Nuclear Power Plant              B 3.8.1-7                                    Revision 74
 
AC Sources - MODES 1, 2, 3, and 4 B 3.8.1 using the same example as above, the 72 hour Completion Time for restoring RHR pump B was developed assuming that RHR pump A had both offsite and onsite standby emergency power available). Therefore, a penalty is assessed to only allow 12 hours in this configuration.
The Completion Time for Required Action A.1 is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time is an exception to the normal "time zero" for beginning the allowed outage time "clock." In this Required Action the Completion Time only begins on discovery that:
: a. There is no offsite power available to one or more 480 V safeguards bus; and
: b. A redundant required feature is inoperable on a second 480 V safeguards bus.
If at any time during the existence of Condition A, a redundant required feature becomes inoperable, this Completion Time begins to be tracked.
Required Action A.1 can be exited if the inoperable DG or the required feature on the OPERABLE DG is restored to OPERABLE status.
The level of degradation during Condition A means that the offsite electrical power system does not have the capability to effect a safe shutdown and to mitigate the effects of an accident; however, the onsite standby AC sources have not been degraded. This level of degradation generally corresponds to either:
: a. Loss of offsite power sources to SAT 12A and/or SAT 12B;
: b. Failure of SAT 12A or 12B or 4.16 kV Bus 12A or 12B; or
: c. Failure of a station service transformer supplying a 480 V safeguards bus.
With a total loss of the offsite power sources to SAT 12A and 12B, the offsite electrical power system does not have the capability to effect a safe shutdown and to mitigate the effects of an accident for either train.
With loss of offsite power to SAT 12A or 12B, failure of SAT 12A or 12B, or failure of Bus 12A or 12B, the offsite electrical power system does not have the capability to effect a safe shutdown and to mitigate the effects of an accident for a single AC electrical train. With a failure of a station service transformer, the offsite electrical power system does not have the capability to effect a safe shutdown and to mitigate the consequences of an accident for one 480 V safeguards bus in one AC electrical train. In all cases, sufficient onsite AC sources are available to maintain the plant in a safe shutdown condition in the event of a DBA or transient. In fact, a simultaneous loss of offsite AC sources, a LOCA, and a worst case single failure were postulated as a part of the design basis in the safety analysis. Thus, the 72 hour Completion Time provides a period of time to R.E. Ginna Nuclear Power Plant              B 3.8.1-8                                    Revision 74
 
AC Sources - MODES 1, 2, 3, and 4 B 3.8.1 effect restoration of the offsite circuit commensurate with the importance of maintaining an AC electrical power system capable of meeting its design criteria.
B.1 With one DG inoperable, it is necessary to verify the availability of the offsite circuit to each of the affected 480 V safeguards buses on a more frequent basis. Since the Required Action only specifies "perform," a failure of SR 3.8.1.1 acceptance criteria does not result in a Required Action being not met (i.e., Condition D would not apply). However, if a circuit fails to pass SR 3.8.1.1, it is inoperable and Condition C would be entered. The Completion Time of 1 hour to perform SR 3.8.1.1 is based on the importance of this verification to ensure that offsite power is available to the affected bus. The Frequency of once per 8 hours thereafter is based on the alarms and indications of breaker status that are available in the control room.
B.2 Required Action B.2 is intended to provide assurance that a loss of offsite power, during the period that a DG is inoperable, does not result in a complete loss of a safety feature. These features are designed with redundant safety related trains which are supplied power from separate and independent onsite power sources. If one onsite power source is inoperable, it must be assured that the redundant safety related train supplied by the OPERABLE DG is available to provide the necessary safety function.
The Completion Time of 4 hours for Required Action B.2 is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time is an exception to the normal "time zero" for beginning the allowed outage time "clock." In this Required Action, the Completion Time only begins on discovery that both:
: a. An inoperable DG exists; and
: b. A required feature on the other train (Train A or Train B) is inoperable.
If at any time during the existence of this Condition (one DG inoperable) a required feature supported by the OPERABLE DG subsequently becomes inoperable, this Completion Time would begin to be tracked.
Discovering one required DG inoperable coincident with one or more inoperable required support or supported features, or both, that are supplied power by the OPERABLE DG, results in starting the Completion Time for Required Action B.2. In this Condition, the remaining OPERABLE DG and the offsite circuit are adequate to supply electrical power to the onsite 480 V safeguards buses.
R.E. Ginna Nuclear Power Plant              B 3.8.1-9                                  Revision 74
 
AC Sources - MODES 1, 2, 3, and 4 B 3.8.1 The Completion Time of 4 hours to declare the required safety features inoperable is based on the fact that it is less than the Completion Time for restoring OPERABILITY of the DG and all safety features supported by the DG. A shorter Completion Time is provided since the required safety features have been potentially degraded by the inoperable DG.
Therefore, a penalty is assessed to only allow 4 hours in this configuration. Additionally, the 4 hour Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period. Required Action B.2 can be exited if the inoperable DG or the required feature on the OPERABLE DG is restored to OPERABLE status.
B.3.1 and B.3.2 Required Action B.3.1 provides an allowance to avoid unnecessary testing of the OPERABLE DG. If it can be determined within 24 hours that the cause of the inoperable DG does not exist on the OPERABLE DG, SR 3.8.1.2 is not required to be performed. If the cause of inoperability is determined to exist on the other DG, the second DG would be declared inoperable upon discovery and Condition E would be entered. Once the failure is repaired, the common cause failure no longer exists, and Required Action B.3.1 is satisfied. If the cause of the initial inoperable DG cannot be confirmed not to exist on the second DG within 24 hours, performance of SR 3.8.1.2 suffices to provide assurance of continued OPERABILITY of that DG.
In the event the inoperable DG is restored to OPERABLE status prior to completing either B.3.1 or B.3.2, activities must continue to evaluate the common cause possibility. This continued evaluation, however, is no longer under the 24 hour constraint imposed while in Condition B.
The 24 hour Completion Time is reasonable to confirm that the OPERABLE DG is not affected by the same problem as the inoperable DG (Ref. 8).
B.4 With one inoperable DG, the remaining OPERABLE DG and the offsite circuit are adequate to supply electrical power to the onsite 480 V safeguards buses. The 7 day Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.
R.E. Ginna Nuclear Power Plant              B 3.8.1-10                                Revision 74
 
AC Sources - MODES 1, 2, 3, and 4 B 3.8.1 C.1 With offsite power to one or more 480 V safeguards bus(es) and one DG inoperable, redundancy is lost in both the offsite and onsite AC electrical power systems. Since power system redundancy is provided by these two diverse sources of power, the AC power sources are only degraded and no loss of safety function has occurred since at least one DG and potentially one offsite AC power source are available. However, the plant is vulnerable to a single failure which could result in the loss of multiple safety functions. Therefore, a Completion Time of 12 hours is provided to either restore the offsite power circuit or the DG to OPERABLE status.
This Completion Time is less than that for an inoperable offsite power source or an inoperable DG due to the single failure vulnerability of this configuration.
As discussed in LCO 3.0.6, the AC electrical power distribution subsystem ACTIONS would not be entered even if all AC sources to either train were inoperable, resulting in de-energization. Therefore, the Required Actions of this Condition are modified by a Note which states that the Required Actions of LCO 3.8.9, "Distribution Systems - MODES 1, 2, 3, and 4" must also be immediately entered with no AC power source to one distribution train. This allows Condition C to provide requirements for the loss of an offsite power circuit and one DG, without regard to whether a train is de-energized. LCO 3.8.9 provides the appropriate restrictions for a de-energized train.
D.1 and D.2 If the inoperable AC electric power sources cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
E.1 If both DGs are inoperable, a loss of safety function would exist if offsite power were unavailable; therefore, LCO 3.0.3 must be entered.
R.E. Ginna Nuclear Power Plant B 3.8.1-11                                  Revision 74
 
AC Sources - MODES 1, 2, 3, and 4 B 3.8.1 SURVEILLANCE          The AC sources are designed to permit inspection and testing of all REQUIREMENTS          important areas and features, especially those that have a standby function (Ref. 2). Periodic component tests are supplemented by extensive functional tests during refueling outages (under simulated accident conditions).
SR 3.8.1.1 This SR ensures proper circuit continuity for the independent offsite power source to each of the onsite 480 V safeguards buses and availability of offsite AC electrical power. Checking breaker alignment and indicated power availability verifies that each breaker is in its correct position to ensure that distribution buses and loads are connected to their qualified power source. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.8.1.2 This SR verifies that each DG starts from standby conditions and achieves rated voltage and frequency. This ensures the availability of the DG to mitigate DBAs and transients and to maintain the plant in a safe shutdown condition. The DG voltage control may be either in manual or automatic during the performance of this SR. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
This SR is modified by two Notes. Note 1 indicates that performance of SR 3.8.1.9 satisfies this SR since SR 3.8.1.9 is a complete test of the DG.
The second Note states that all DG starts may be preceded by an engine prelube period and followed by a warmup period prior to loading. This minimizes the wear on moving parts that do not get lubricated when the engine is not running.
SR 3.8.1.3 This SR verifies that the DGs are capable of synchronizing with the offsite electrical system and accepting loads greater than or equal to the equivalent of the maximum expected accident loads. A minimum run time of 60 minutes is required to stabilize engine temperatures. A maximum run time of < 120 minutes minimizes the time that the DG is connected to the offsite source.
R.E. Ginna Nuclear Power Plant                B 3.8.1-12                                Revision 77
 
AC Sources - MODES 1, 2, 3, and 4 B 3.8.1 Although no power factor requirements are established by this SR, the DG is normally operated at a power factor between 0.85 lagging and 0.95 lagging. The upper load band limit of < 2250 kW is the DG two-hour rating and is provided to avoid routine overloading of the DG which may result in more frequent inspections in accordance with vendor recommendations in order to maintain DG OPERABILITY. The lower band limit of 2025 kW bounds the maximum expected load following a DBA, based on worst case loading during the injection phase of the accident. The diesel generator loading will be below the long-term rating of 1950 kW within two hours.
In addition to verifying the DG capability for synchronizing with the offsite electrical system and accepting loads, the DG ventilation system should also be verified during this surveillance.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
This SR is modified by four Notes. Note 1 indicates that diesel engine runs for this Surveillance may include gradual loading, as recommended by the manufacturer, so that mechanical stress and wear on the diesel engine are minimized. Note 2 states that momentary transients outside the load band (e.g., due to changing bus loads), do not invalidate this test. Similarly, momentary power factor transients above or below the administrative limit do not invalidate the test. Note 3 indicates that this Surveillance shall be conducted on only one DG at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations. Note 4 stipulates a prerequisite requirement for performance of this SR. A successful performance of SR 3.8.1.2 or SR 3.8.1.9 must precede this surveillance to prevent unnecessary starts of the DGs.
SR 3.8.1.4 This SR provides verification that the level of fuel oilin each day tank is at or above the minimum level, including instrument uncertainty, at which fuel oil is automatically added when the fuel oil transfer pump is in auto and the DG is operating. This level ensures adequate fuel oil for a minimum of 1 hour of DG operation at 110% of full load. A level of 8.75 inches, as read on the local sight glass, achieves these requirements.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.8.1.5 This SR demonstrates that each DG fuel oil transfer pump operates and transfers fuel oil from its associated storage tank to its associated day tank. This is required to support continuous operation of the DGs. This R.E. Ginna Nuclear Power Plant              B 3.8.1-13                                  Revision 77
 
AC Sources - MODES 1, 2, 3, and 4 B 3.8.1 Surveillance provides assurance that the fuel oil transfer pump is OPERABLE, the fuel oil piping system is intact, the fuel delivery piping is not obstructed, and the controls and control systems for automatic or manual fuel transfer systems are OPERABLE.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.8.1.6 This SR involves the transfer of the 480 V safeguards bus power supply from the 50/50 mode to the 100/0 mode and 0/100 mode which demonstrates the OPERABILITY of the alternate circuit distribution network to power the required loads. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.8.1.7 This SR verifies that each DG does not trip during and following a load rejection of  295 kW. Each DG is provided with an engine overspeed trip to prevent damage to the engine. Recovery from the transient caused by the loss of a large load could cause diesel engine overspeed, which, if excessive, might result in a trip of the engine. This SR demonstrates the DG load response characteristics and capability to reject the largest single load on the buses supplied by the DG (i.e., a safety injection pump).
In order to ensure that the DG is tested under load conditions that are as close to design basis conditions as possible, testing must be performed using a power factor  0.9 lagging. This power factor is chosen to be representative of the actual design basis inductive loading that the DG would experience.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
This SR is modified by two Notes. The first Note states that this Surveillance shall not be performed in MODE 1, 2, 3, or 4. The reason for the Note is that during operation in these MODES, performance of this SR could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, plant R.E. Ginna Nuclear Power Plant              B 3.8.1-14                                  Revision 77
 
AC Sources - MODES 1, 2, 3, and 4 B 3.8.1 safety systems. The second Note acknowledges that credit may be taken for unplanned events that satisfy this SR.
SR 3.8.1.8 This SR demonstrates that DG noncritical protective functions (e.g.,
overcurrent, reverse power, local stop pushbutton) are bypassed on an actual or simulated SI actuation signal. The noncritical trips are bypassed during DBAs but still provide an alarm on an abnormal engine condition. This alarm provides the operator with sufficient time to react appropriately. The DG availability to mitigate the DBA is more critical than protecting the engine against minor problems that are not immediately detrimental to emergency operation of the DG. The DG critical protective functions (engine overspeed, low lube oil pressure, and start failure (overcrank) relay) will be tested periodically per the station periodic maintenance program.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
This SR is modified by two Notes. The first Note states that this Surveillance shall not be performed in MODE 1, 2, 3, or 4. The reason for the Note is that performing the Surveillance would remove a required DG from service which is undesirable in these MODES. The second Note acknowledges that credit may be taken for unplanned events that satisfy this SR.
SR 3.8.1.9 In the event of a DBA coincident with a loss of offsite power, the DGs are required to supply the necessary power to ESF systems so that the fuel, RCS, and containment design limits are not exceeded.
This SR demonstrates the DG operation during an actual or simulated loss of offsite power signal in conjunction with an actual or simulated SI actuation signal. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the DG system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.
Since it is not possible to operate all sequenced motors at their DBA loadings, a transient simulation program is used to demonstrate acceptable DG governor and voltage regulator operation. To successfully validate the testing data with the transient simulation program, the largest loads (with respect to both kW and current) must be sequenced on the R.E. Ginna Nuclear Power Plant              B 3.8.1-15                                  Revision 77
 
AC Sources - MODES 1, 2, 3, and 4 B 3.8.1 DG during performance of this test. This includes two SI pumps, a CS and RHR pump, and safety-related motor control centers, as a minimum.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
This SR is modified by three Notes. Note 1 states that all DG starts may be preceded by an engine prelube period which is intended to minimize wear and tear on the DGs during testing. For the purpose of this testing, the DGs must be started from standby conditions, that is, with the engine lube oil continuously circulated and temperature maintained consistent with manufacturer recommendations for the DGs. Note 2 states that this Surveillance shall not be performed in MODE 1, 2, 3, or 4 since performing the Surveillance during these MODES would remove a required offsite circuit from service, cause perturbations to the electrical distribution systems, and challenge safety systems. Note 3 acknowledges that credit may be taken for unplanned events that satisfy this SR.
REFERENCES            1. UFSAR, Chapter 8.
: 2. Atomic Industrial Forum (AIF) GDC 39, Issued for comment July 10, 1967.
: 3. UFSAR, Section 9.4.9.5.
: 4. UFSAR, Chapter 6.
: 5. UFSAR, Chapter 15.
: 6. 10 CFR 50, Appendix A, GDC 17.
: 7.    "American National Standard, Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants," N18.2-1973.
: 8. Generic Letter 84-15, "Proposed Staff Actions to Improve and Maintain Diesel Generator Reliability," July 2, 1984.
: 9. UFSAR Section 3.11 R.E. Ginna Nuclear Power Plant                  B 3.8.1-16                                Revision 77
 
AC Sources - MODES 1, 2, 3, and 4 B 3.8.1 Figure B 3.8.1-1 R.E. Ginna Nuclear Power Plant    B 3.8.1-17                        Revision 74
 
AC Sources - MODES 5 and 6 B 3.8.2 B 3.8    ELECTRICAL POWER SYSTEMS B 3.8.2      AC Sources - MODES 5 and 6 BASES BACKGROUND            The Background section for Bases 3.8.1, "AC Sources - MODES 1, 2, 3, and 4" is applicable to theses Bases, with the following modifications.
In MODE 5 or 6 the minimum required AC sources may be reduced since less energy is retained within the reactor coolant system than during higher MODES. Also, a significant number of required testing and maintenance activities must be performed under these conditions such that equipment and systems, including the AC power sources, must be removed from service. The minimum required AC sources is based on the requirements of LCO 3.8.10, "Distribution Systems - MODES 5 and 6."
APPLICABLE            The OPERABILITY of the minimum AC electrical power sources during SAFETY                MODES 5 and 6 ensures that:
ANALYSES
: a. Systems needed to mitigate a fuel handling accident are available; and
: b. Systems necessary to mitigate the effects of events that can lead to core damage during shutdown are available; In general, when the plant is shut down, the Technical Specifications requirements ensure that the plant has the capability to mitigate the consequences of postulated accidents. However, assuming a single failure and concurrent loss of all offsite or all onsite power is not required.
Therefore, the OPERABILITY of the AC electrical power sources ensures that one train of the onsite power or offsite AC sources are OPERABLE in the event of:
: a. An assumed loss of all offsite AC power;
: b. An assumed loss of all onsite standby AC power; or
: c. A worst case single failure.
This reduction in required AC sources is allowed because many Design Basis Accidents (DBAs) that are analyzed in MODES 1, 2, 3, and 4 have no specific analyses in MODES 5 and 6. Worst case bounding events are deemed not credible in MODES 5 and 6 because the energy contained within the reactor pressure boundary (reactor coolant R.E. Ginna Nuclear Power Plant                B 3.8.2-1                                      Revision 61
 
AC Sources - MODES 5 and 6 B 3.8.2 temperature and pressure) and the corresponding stresses result in the probabilities of occurrence being significantly reduced or eliminated, and result in minimal consequences. These deviations from DBA analysis assumptions and design requirements during shutdown conditions are allowed by the LCOs for the systems required in MODES 5 and 6.
During MODES 1, 2, 3, and 4, various deviations from the analysis assumptions and design requirements are allowed within the Required Actions. This allowance is in recognition that certain testing and maintenance activities must be conducted provided an acceptable level of risk is not exceeded. During MODES 5 and 6, performance of a significant number of required testing and maintenance activities is also required. In MODES 5 and 6, the activities are generally planned and administratively controlled. Relaxations from MODE 1, 2, 3, and 4 LCO requirements are acceptable during shutdown modes based on:
: a. The fact that time in an outage is limited. This is a risk prudent goal as well as a utility economic consideration.
: b. Requiring appropriate compensatory measures for certain conditions. These may include administrative controls, reliance on systems that do not necessarily meet typical design requirements applied to systems credited in operating MODE analyses, or both.
: c. Prudent utility consideration of the risk associated with multiple activities that could affect multiple systems.
: d. Maintaining, to the extent practical, the ability to perform required functions (even if not meeting MODE 1, 2, 3, and 4 OPERABILITY requirements) for systems assumed to function during an event.
In the event of an accident while in MODE 5 or 6 this LCO ensures the capability to support systems necessary to mitigate the postulated events during shutdown, assuming either a loss of all offsite power or a loss of all onsite diesel generator (DG) power.
The AC sources satisfy Criterion 3 of the NRC Policy Statement.
LCO                  One qualified independent offsite power circuit supplying the associated AC electrical power distribution subsystem required to be OPERABLE by LCO 3.8.10, "Distribution Systems - MODES 5 and 6," ensures that all required loads are powered from offsite power. An OPERABLE DG, capable of supporting the distribution system required to be OPERABLE by LCO 3.8.10, ensures a diverse power source is available to provide electrical power support, assuming a loss of the independent offsite power circuit. Together, OPERABILITY of the required offsite circuit and DG ensures the availability of sufficient AC sources to operate the plant in R.E. Ginna Nuclear Power Plant                B 3.8.2-2                                    Revision 61
 
AC Sources - MODES 5 and 6 B 3.8.2 a safe manner and to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents).
An OPERABLE qualified offsite circuit is one that is capable of maintaining rated frequency and voltage, and accepting required loads during an accident, while connected to the 480 V safeguards bus(es).
Power from either offsite power circuit 7T or 767, or by backfeeding through auxiliary transformer 11 satisfies this requirement.
A DG is considered OPERABLE when:
: a. The DG is capable of starting, accelerating to rated speed and voltage, and connecting to its respective 480 V safeguards buses on actuation of Loss of Power (LOP) DG Instrumentation within 10 seconds;
: b. All loads on each 480 V safeguards bus except for the safety related motor control centers, component cooling water (CCW) pump, and containment spray (CS) pump are capable of being tripped on an undervoltage signal (CCW) pump must be capable of being tripped on coincident safety injection (SI) and undervoltage signal);
: c. The DG is capable of accepting required loads manually. Since most equipment which receives a SI signal are isolated in these MODES due to maintenance or low temperature overpressure protection concerns, and the DBA of concern (i.e., a fuel handling accident) would not generate a SI signal, manual loading of the DGs will most likely be required. These loads must be capable of being added to the OPERABLE DG within 10 minutes;
: d. The DG day tank is available to provide fuel oil for  1 hour at 110%
design loads;
: e. The fuel oil transfer pump from the fuel oil storage tank to the associated day tank is OPERABLE including all required piping, valves, and instrumentation (long-term fuel oil supplies are addressed by LCO 3.8.3, "Diesel Fuel Oil");
: f. A ventilation train consisting of at least one of two fans and the associated ductwork and dampers is OPERABLE; and
: g. The service water (SW) 'p through the diesel generator heat exchangers is within the limits specified in plant operating procedures for SW system configuration.
R.E. Ginna Nuclear Power Plant              B 3.8.2-3                                  Revision 61
 
AC Sources - MODES 5 and 6 B 3.8.2 APPLICABILITY        The AC sources required to be OPERABLE in MODES 5 and 6 provide assurance that systems required to mitigate the effects of postulated events and to maintain the plant in the cold shutdown or refueling condition are available.
The AC power requirements for MODES 1, 2, 3, and 4 are covered in LCO 3.8.1, "AC Sources - MODES 1, 2, 3, and 4."
ACTIONS              A.1 As discussed in LCO 3.0.6, the Distribution System's ACTIONS would not be entered even if all AC sources to it are inoperable, resulting in de-energization. Therefore, the Required Actions of Condition A are modified by a Note to indicate that when Condition A is entered with no onsite or offsite AC power to any required 480 V safeguards bus, the ACTIONS for LCO 3.8.10 must also be immediately entered. This Note allows Condition A to provide requirements for the loss of the offsite power circuit, whether or not a train is de-energized. LCO 3.8.10 would provide the appropriate restrictions for the situation involving a completely de-energized train.
With offsite power to one or more required 480 V safeguards bus(es) inoperable, assurance must be provided that there is not a complete loss of required safety features. Although two trains may be required by LCO 3.8.10, one train with offsite power available may be capable of supporting sufficient required features to allow continuation of CORE ALTERATIONS, or operations involving positive reactivity additions. By allowing the option to declare required features inoperable that are not powered from offsite power, appropriate restrictions will be implemented in accordance with the LCO ACTIONS of the affected required features.
Required features remaining powered from a qualified offsite power circuit, even if that circuit is considered inoperable because it is not powering other required features, are not declared inoperable by this Required Action.
R.E. Ginna Nuclear Power Plant                  B 3.8.2-4                                  Revision 61
 
AC Sources - MODES 5 and 6 B 3.8.2 A.2.1, A.2.2, A.2.3, and A.2.4 With the offsite power circuit not available to all required AC electrical trains, the option exists to declare all required features inoperable per Required Action A.1. Since this option may involve undesired administrative efforts, the allowance for sufficiently conservative actions is made. It is, therefore, required to suspend CORE ALTERATIONS, movement of irradiated fuel assemblies, and operations involving positive reactivity additions that could result in loss of required SDM (Mode 5) or boron concentration (Mode 6). Suspending positive reactivity additions that could result in failure to meet the minimum SDM or boron concentration limit is required to assure continued safe operation.
Introduction of coolant inventory must be from sources that have a boron concentration greater than that required in the RCS for minimum SDM or refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. Introduction of temperature changes including temperature increases when operating with a positive MTC must also be evaluated to ensure they do not result in a loss of required SDM.
Performance of Required Actions A.2.1, A.2.2, and A.2.3 shall not preclude completion of movement of a component to a safe position or normal cooldown of the coolant volume for the purpose of system temperature control within established procedures.
It is further required to immediately initiate action to restore the required offsite power AC sources and to continue this action until restoration is accomplished in order to provide the necessary AC power to the plant safety systems.
The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required offsite power sources should be completed as quickly as possible in order to minimize the time during which the plant safety systems may be without sufficient power.
B.1, B.2, B.3, and B.4 With the required DG inoperable, the minimum required diversity of AC power sources is not available. It is, therefore, required to suspend CORE ALTERATIONS, movement of irradiated fuel assemblies, and operations involving positive reactivity additions that could result in loss of required SDM (Mode 5) or boron concentration (Mode 6). Suspending positive reactivity additions that could result in failure to meet the minimum SDM or boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than that required in the RCS for minimum SDM or refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. Introduction of temperature changes including temperature increases when operating R.E. Ginna Nuclear Power Plant                    B 3.8.2-5                                    Revision 61
 
AC Sources - MODES 5 and 6 B 3.8.2 with a positive MTC must also be evaluated to ensure they do not result in a loss of required SDM. Performance of Required Action B.1, B.2, and B.3 shall not preclude completion of movement of a component to a safe position or normal cooldown of the coolant volume for the purpose of temperature control within established procedures.
It is further required to immediately initiate action to restore the required DG to OPERABLE status and to continue this action until restoration is accomplished in order to provide the necessary AC power redundancy to plant safety systems.
The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required DG should be completed as quickly as possible in order to minimize the time during which the plant safety systems may be without sufficient redundant power.
SURVEILLANCE          SR 3.8.2.1 REQUIREMENTS This SR requires the performance of SRs from LCO 3.8.1 that are necessary for ensuring the OPERABILITY of the AC sources in MODES 5 and 6.
This SR precludes requiring the OPERABLE DGs from being paralleled with the offsite power network or otherwise rendered inoperable during performance of SRs, precludes de-energizing a required 480 V safeguards bus, and precludes unnecessary transfers of the offsite power source configurations. With limited AC sources available, a single event could compromise both the required circuit and the DG. Therefore, the requirement to perform SR 3.8.1.3, and SR 3.8.1.6 through 3.8.1.9 is suspended. It is the intent that these SRs must still be capable of being met, but actual performance is not required during periods when the DG is required to be OPERABLE. Refer to the corresponding Bases for LCO 3.8.1 for a discussion of each SR.
REFERENCES            1.      None.
R.E. Ginna Nuclear Power Plant                    B 3.8.2-6                                    Revision 61
 
Diesel Fuel Oil B 3.8.3 B 3.8    ELECTRICAL POWER SYSTEMS B 3.8.3      Diesel Fuel Oil BASES BACKGROUND            Fuel oil is provided to each emergency diesel generator (DG) by a dedicated 350 gal day tank located near the DG. Each day tank is supplied from an associated 6000 gal underground fuel oil storage tank.
Each storage tank provides a minimum fuel oil capacity of 5000 gal. The two storage tanks are sufficient to operate both DGs at design ratings for 24 hours. The total minimum fuel oil capacity also ensures that both DGs can operate for a period of 40 hours while providing for a maximum post loss of coolant accident (LOCA) load demand. The maximum load demand is calculated using the assumption that both DGs are available and is less than the DG design rating. The minimum onsite fuel capacity is sufficient to operate the DGs for longer than 8 hours which is the time required to replenish the onsite supply from outside sources (Ref. 1).
Fuel oil is transferred from each storage tank to the associated day tank by a dedicated fuel oil transfer pump. Each fuel oil transfer pump is powered by a 480 V safeguards bus that is backed by the associated DG.
One fuel oil transfer pump has the capability to supply both DGs operating with 110% of their design loads. Redundancy of pumps and piping precludes the failure of one pump, or the rupture of any pipe, valve or tank to result in the loss of more than one DG.
All outside tanks, pumps, and piping are located underground to protect them from potential missiles. Heat tracing is provided in the exposed suction piping to the fuel oil pumps in the event that heating is lost in the DG rooms. The heat tracing is thermostatically controlled to maintain the fuel oil in the pipe > 40&#xba;F which is above the cloud point temperature of the fuel oil (23&#xba;F).
APPLICABLE            The initial conditions of Design Basis Accident (DBA) and transient SAFETY                analyses (Refs. 2 and 3), assume Engineered Safety Feature (ESF)
ANALYSES              systems are OPERABLE. The DGs are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that fuel, Reactor Coolant System and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, "Power Distribution Limits;" Section 3.4, "Reactor Coolant System (RCS);" and Section 3.6, "Containment Systems."
R.E. Ginna Nuclear Power Plant                    B 3.8.3-1                                  Revision 48
 
Diesel Fuel Oil B 3.8.3 Since diesel fuel oil supports the operation of the standby AC power sources, it satisfies Criterion 3 of the NRC Policy Statement.
LCO                  Stored onsite diesel fuel oil is required to have sufficient supply for 40 hours of maximum post-LOCA load demand. It is also required to meet specific standards for quality. This requirement, in conjunction with an ability to obtain replacement fuel oil supplies within 8 hours, supports the availability of DGs required to shut down the reactor and to maintain it in a safe condition for an anticipated operational occurrence (AOO) or a postulated DBA with loss of offsite power. DG day tank fuel requirements, as well as transfer capability from the storage tank to the day tank, are addressed in LCO 3.8.1, "AC Sources - MODES 1, 2, 3, and 4," and LCO 3.8.2, "AC Sources - MODES 5 and 6."
APPLICABILITY        The AC sources (LCO 3.8.1 and LCO 3.8.2) are required to ensure the availability of the required power to shut down the reactor and maintain it in a safe shutdown condition after an AOO or a postulated DBA. Since stored diesel fuel oil supports LCO 3.8.1 and LCO 3.8.2, stored diesel fuel oil is required to be within limits in MODES 1, 2, 3 and 4, and when the associated DG is required to be OPERABLE in MODES 5 and 6.
ACTIONS              A.1 With one or more required DGs with an onsite supply of < 5000 gal of fuel oil, the assumed 40 hour fuel oil supply for a DG is not available.
This circumstance may be caused by events, such as full load operation after an inadvertent start with an initial minimum required fuel oil level, or feed and bleed operations, which may be necessitated by increasing fuel oil particulate levels or any number of other oil quality degradations.
Required Action A.1 allows sufficient time for obtaining the requisite replacement volume and performing the analyses required prior to addition of fuel oil to the tank. The Completion Time of 12 hours is considered sufficient to complete restoration of the required level prior to declaring the DG inoperable. This period is acceptable based on the remaining capacity, the fact that actions will be initiated to obtain replenishment, and the low probability of an event during this brief period.
B.1 If one or more DGs has stored fuel oil with total particulates not within limits for reasons not related to new fuel oil, the fuel oil must be restored within limits within 7 days. The fuel oil particulate properties are verified by SR 3.8.3.2. Trending of particulate levels normally allows sufficient R.E. Ginna Nuclear Power Plant                B 3.8.3-2                                  Revision 48
 
Diesel Fuel Oil B 3.8.3 time to correct high particulate levels prior to reaching the limit of acceptability. Poor sample practices (bottom sampling), contaminated sampling equipment, or errors in laboratory analysis can produce failures that do not follow a trend. Since the presence of particulates does not mean failure of the fuel oil to burn properly in the diesel engine, and particulate concentration is unlikely to change significantly between Surveillance Frequency intervals, and proper engine performance has been recently demonstrated (within 31 days), it is prudent to allow a brief period prior to declaring the associated DG inoperable. The 7 day Completion Time allows for further evaluation, resampling and re-analysis of the DG fuel oil.
C.1 With the new fuel oil properties defined in SR 3.8.3.2 not within required limits, a period of 30 days is allowed for restoring the stored fuel oil properties. This period provides sufficient time to test the stored fuel oil to determine that the new fuel oil, when mixed with previously stored fuel oil, remains acceptable, or to restore the stored fuel oil properties. This restoration may involve feed and bleed procedures, filtering, or combinations of these procedures. Even if a DG start and load was required during this time interval and the fuel oil properties were outside limits, there is a high likelihood that the DG would still be capable of performing its intended function.
D.1 With a Required Action and associated Completion Time not met, or one or more DG's fuel oil not within limits for reasons other than addressed by Conditions A, B, or C (e.g., cloud point temperature reached), the associated DG may be incapable of performing its intended function and must be immediately declared inoperable.
SURVEILLANCE          SR 3.8.3.1 REQUIREMENTS This SR verifies an onsite supply of  5000 gal of fuel oil is available for each required DG. This ensures that there is an adequate inventory of fuel oil in the storage tanks to support each DG's operation for 40 hours while providing maximum post-LOCA loads. The 40 hour period is sufficient time to place the plant in a safe shutdown condition and to bring in replenishment fuel from an offsite location.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
R.E. Ginna Nuclear Power Plant                B 3.8.3-3                                    Revision 77
 
Diesel Fuel Oil B 3.8.3 SR 3.8.3.2 This SR provides a means of determining whether new and stored fuel oil has been contaminated with substances that would have an immediate, detrimental impact on diesel engine combustion. This ensures the availability of high quality fuel oil for the DGs. Fuel oil degradation during long term storage is indicated by an increase in particulate, due mostly to oxidation. The presence of particulate does not mean the fuel oil will not burn properly in a diesel engine. The particulate can cause fouling of filters and fuel oil injection equipment, however, which could eventually cause engine failure.
A fuel oil sample is analyzed to establish that properties specified in Table 1 of ASTM D975-78 (Ref. 4) for viscosity, water, and sediment are met for the stored fuel oil.
The Frequency of this SR takes into consideration fuel oil degradation trends that indicate that particulate concentration is unlikely to change significantly between Frequency intervals. The Frequency, as specified in the Diesel Fuel Oil Testing Program, is 92 days.
REFERENCES            1.      UFSAR, Section 9.5.4.
: 2.      UFSAR, Chapter 6.
: 3.      UFSAR, Chapter 15.
: 4.      ASTM Standards, D975-78, Table 1.
R.E. Ginna Nuclear Power Plant                  B 3.8.3-4                                  Revision 48
 
DC Sources - MODES 1, 2, 3, and 4 B 3.8.4 B 3.8    ELECTRICAL POWER SYSTEMS B 3.8.4      DC Sources - MODES 1, 2, 3, and 4 BASES BACKGROUND            A source of electrical power is required for most safety related and nonessential active components. Two sources of electrical power are available, alternating current (AC) and direct current (DC). Separate distribution systems are developed for these two electrical power sources which are further divided and organized based on voltage considerations and whether they are Class 1E (i.e., supply safety related or engineered safeguards functions) or nonessential. This LCO is provided to specify the minimum sources of DC power which are required to supply the DC buses and their associated distribution system during MODES 1, 2, 3, and 4.
The station DC electrical power subsystem provides the AC emergency power system with control power. It also provides both motive and control power to selected safety related equipment and preferred AC instrument bus power (via inverters). Atomic Industrial Forum (AIF) GDC 39 (Ref. 1) requires emergency power sources be provided and designed with adequate independence, redundancy, capacity, and testability to permit the functioning of the engineered safety features and protection systems.
The 125 VDC electrical power system consists of two independent and redundant safety related Class 1E DC electrical power distribution train (Train A and Train B). Each subsystem consists of one 125 VDC battery, two battery chargers supplied from the 480 V system, distribution panels and buses, and all the associated control equipment and interconnecting cabling (see Figure B 3.8.4-1). The batteries and battery chargers are addressed by this LCO.
Each battery provides a separate source of DC power independent of AC power. Each of the two batteries is capable of carrying its expected shutdown loads following a plant trip and a loss of all AC power for a period of 4 hours without battery terminal voltage falling below 108.6 V.
Major loads and approximate operating times on each battery are discussed in the UFSAR (Ref. 2).
There are four battery chargers available to the batteries, each with a capacity of 200 amps. Battery chargers A and B are current limited to 165 amps. Normally, only one battery charger is aligned to a battery while the second battery charger is maintained in standby. A charging capacity of at least 150 amps is normally required to supply the necessary DC loads on each train and to provide a full battery charge to ensure the availability of the required power to shut down the reactor and R.E. Ginna Nuclear Power Plant              B 3.8.4-1                                  Revision 41
 
DC Sources - MODES 1, 2, 3, and 4 B 3.8.4 maintain it in a safe condition after an anticipated operational occurrence (AOO) or a postulated Design Basis Accident (DBA). The DC power distribution system is described in more detail in Bases for LCO 3.8.9, "Distribution Systems - MODES 1, 2, 3, and 4," and LCO 3.8.10, "Distribution Systems - MODES 5 and6." The normal equalize voltage of the battery chargers is limited to  140 volts when tied to the DC electrical power distribution system, due to the voltage rating of various components and fuses.
The DC electrical power distribution subsystem also provide DC electrical power to the inverters, which in turn power the AC instrument buses. The inverters are described in more detail in Bases for LCO 3.8.7, "AC Instrument Bus Sources - MODES 1, 2, 3, and 4," and LCO 3.8.8, "AC Instrument Bus Sources - MODES 5 and 6."
Train A Engineered Safety Feature (ESF) equipment is supplied from battery A, while Train B ESF equipment is supplied from battery B.
Additionally, the 480 V ESF switchgear and diesel generator (DG) control panels are supplied from either battery by means of an automatic transfer circuit in the switchgear and control panels. The normal supply from Train A (Buses 14 and 18 and DG A) is from DC distribution panels A.
These panels also provide the emergency DC supply for Train B.
Similarly, the normal supply from Train B (Buses 16 and 17 and DG B) is from DC distribution panels B. These panels also provide the emergency DC supply for Train A.
Each 125 VDC battery and associated battery chargers are separately housed in a ventilated room with its associated distribution center. Each subsystem is located in an area separated physically and electrically from the other subsystem to ensure that a single failure in one subsystem does not cause a failure in a redundant subsystem. The two battery rooms are supplied with ventilation by a common AC powered air conditioning and heating unit which also provides sufficient air changes to prevent hydrogen buildup. A redundant DC powered fan is also available in the event that all AC power is lost. The failure of both the AC powered and DC powered units does not result in unacceptable room service conditions until after 5 hours of continuous battery operation during a DBA (Ref. 2).
The batteries for Train A and Train B DC electrical power distribution subsystem are sized to produce required capacity at 80% of nameplate rating, corresponding to warranted capacity at end of life cycles and the 100% design demand. Battery size is based on 125% of required capacity for aging considerations. The minimum voltage limit is 2.13 V per cell, which corresponds to a total minimum voltage output of 128 V per battery.
R.E. Ginna Nuclear Power Plant                B 3.8.4-2                                  Revision 41
 
DC Sources - MODES 1, 2, 3, and 4 B 3.8.4 Each battery charger for the Train A and Train B DC electrical power distribution subsystem has ample power output capacity for the steady state operation of connected loads required during normal operation, while at the same time maintaining its battery bank fully charged. Each battery charger also has sufficient capacity to restore the battery from the design minimum charge to its fully charged state within 24 hours while supplying normal steady state loads discussed in the UFSAR, Chapter 8 (Ref. 2).
APPLICABLE            The initial conditions of a DBA and transient analyses (Refs. 3, 4, and 5),
SAFETY                assume that ESF systems are OPERABLE. The DC electrical power ANALYSES              system provides normal and emergency DC electrical power for the DGs, emergency auxiliaries, and control and switching during all MODES of operation.
The OPERABILITY of the DC sources is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the plant. This includes maintaining at least one train of DC source OPERABLE in the event of:
: a. An assumed loss of all offsite AC power or all onsite standby AC power; and
: b. A worst case single failure.
In the event of a DBA, the OPERABILITY requirements of the DC electrical power sources ensures that one train of DC electrical power is available with:
: a. An assumed loss of all offsite power; and
: b. A worst case single failure (including the loss of one DC electrical power source).
In general, the accident analyses assume that all offsite power is lost at the time of the initiating event except where the availability of offsite power provides worst case conditions (e.g., steam line break with continued operation of the reactor coolant pumps). The availability of redundant offsite power sources (i.e., circuits 7T and 767) helps to reduce the potential to lose all offsite power. Providing redundant sources of DC power ensures that at least one DC power source is available if all onsite standby AC power is unavailable coincident with a single failure of one offsite power source during non accident conditions. In the event the plant is in the 100/0 or 0/100 mode, a redundant source of offsite power can be obtained by backfeeding through the main transformer using a flexible connection that can be tied into the plant auxiliary transformer 11.
The plant can survive on the available battery power, alternate power R.E. Ginna Nuclear Power Plant                    B 3.8.4-3                                  Revision 41
 
DC Sources - MODES 1, 2, 3, and 4 B 3.8.4 sources, and turbine driven Auxiliary Feedwater pump during the estimated 8 hours required to provide this power transfer (Ref. 6).
Therefore, the requirements of GDC 17 (Ref. 7) can be met at all times.
The DC sources satisfy Criterion 3 of the NRC Policy Statement.
LCO                  The Train A and Train B DC electrical power sources, each consisting of one battery, a charging capacity of at least 150 amps, and the corresponding control equipment and interconnecting cabling within the train are required to be OPERABLE to ensure the availability of the required power to shut down the reactor and maintain it in a safe condition after an AOO or a postulated DBA. Loss of any one train DC electrical power source does not prevent the minimum safety function from being performed.
An OPERABLE DC electrical power source requires the battery and at least one battery charger with a capacity  150 amps to be operating and connected to the associated DC bus. The battery charger output voltage must be 1 40 volts when it is being used for this LCO. The AC powered and DC powered fan units are not required to be OPERABLE for this LCO, but some form of ventilation may be required for SR 3.8.6.4 and SR 3.8.6.5.
APPLICABILITY        The DC electrical power sources are required to be OPERABLE in MODES 1, 2, 3, and 4 to ensure safe plant operation and to ensure that:
: a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients; and
: b. Adequate core cooling is provided, and containment OPERABILITY and other vital functions are maintained in the event of a postulated DBA.
The DC electrical power requirements for MODES 5 and 6 are addressed in LCO 3.8.5, "DC Sources - MODES 5 and 6."
R.E. Ginna Nuclear Power Plant                B 3.8.4-4                                Revision 41
 
DC Sources - MODES 1, 2, 3, and 4 B 3.8.4 ACTIONS              A.1 With one DC electrical power source inoperable, OPERABILITY must be restored within 2 hours. In this Condition, redundancy is lost and only one train is capable to completely respond to an event. If one of the required DC electrical power sources is inoperable, the remaining DC electrical power source has the capacity to support a safe shutdown and to mitigate an accident condition. A subsequent worst case single failure would, however, result in the complete loss of the remaining 125 VDC electrical power distribution subsystem with attendant loss of ESF functions. The 2 hour Completion Time reflects a reasonable time to assess plant status as a function of the inoperable DC electrical power subsystem and, if the DC electrical power source is not restored to OPERABLE status, to prepare to effect an orderly and safe plant shutdown.
B.1 and B.2 If the inoperable DC electrical power source cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
C.1 If both DC electrical power sources are inoperable, a loss of multiple safety functions exists; therefore, LCO 3.0.3 must be immediately entered.
R.E. Ginna Nuclear Power Plant              B 3.8.4-5                                  Revision 41
 
DC Sources - MODES 1, 2, 3, and 4 B 3.8.4 SURVEILLANCE          SR 3.8.4.1 REQUIREMENTS Verifying battery terminal voltage while on float charge for the batteries helps to ensure the effectiveness of the charging system and the ability of the batteries to perform their intended function. Float charge is the condition in which the charger is supplying the continuous charge required to overcome the internal losses of a battery (or battery cell) and maintain the battery (or a battery cell) in a fully charged state. The voltage requirements are based on the nominal design voltage of the battery and are consistent with the initial voltages assumed in the battery sizing calculations. The elevated equalize charge capability of the battery chargers is not an OPERABILITY requirement of the battery chargers and is not to be in service during the surveillance. The voltage drop when changing from the equalize conditions to the normal float conditions occurs relatively quickly. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.8.4.2 This SR verifies that the capacity of each battery is adequate to supply and maintain in OPERABLE status, the required emergency loads for the design duty cycle when subjected to a battery service test. A battery service test is a special test of battery capability, as found, to satisfy the design requirements (battery duty cycle) of the DC electrical power system. The discharge rate and test length corresponds to the design duty cycle requirements specified in Reference 2.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
This SR is modified by two Notes. Note 1 states that SR 3.8.4.3 may be performed in lieu of SR 3.8.4.2. This substitution is acceptable because SR 3.8.4.3 represents a more severe test of battery capacity than does SR 3.8.4.2. Note 2 states that this surveillance shall not be performed in MODE 1, 2, 3, or 4 because performing the Surveillance would perturb the electrical distribution system and challenge safety systems.
SR 3.8.4.3 This Surveillance verifies that each battery capacity is  80% of the manufacturer's rating when subjected to a performance discharge test. A battery performance test is a test of constant current capacity of a battery, normally done in the as found condition, after having been in service, to detect any change in the capacity as determined by specified acceptance R.E. Ginna Nuclear Power Plant                B 3.8.4-6                                    Revision 77
 
DC Sources - MODES 1, 2, 3, and 4 B 3.8.4 criteria. The test is intended to determine overall battery degradation due to age and usage.
A battery modified performance discharge test is a simulated duty cycle consisting of just two rates; the one minute rate published for the battery or the largest current load of the duty cycle, followed by the test rate employed for the performance test, both of which envelope the duty cycle of the service test. Since the ampere-hours removed by a rated one minute discharge represents a very small portion of the battery capacity, the test rate can be changed to that for the performance test without compromising the results of the performance discharge test. The battery terminal voltage for the modified performance discharge test should remain greater than or equal to the minimum battery terminal voltage specified in the battery performance discharge test.
A modified performance discharge test is a test of the battery capacity and its ability to provide a high rate, short duration load (usually the highest rate of the duty cycle). This will often confirm the battery's ability to meet the critical period of the load duty cycle, in addition to determining its percentage of rated capacity. Initial conditions for the modified performance discharge test should be identical to those specified for a service test.
Either the battery performance discharge test or the modified performance discharge test is acceptable for satisfying SR 3.8.4.3.
A battery should be replaced if its capacity is below 80% of the manufacturer rating. A capacity of 80% shows that the battery rate of deterioration is increasing, even if there is ample capacity to meet the load requirements.
The Frequency for this SR is in accordance with the Surveillance Frequency Program when the battery is < 85% of its expected life with no degradation and 12 months if the battery shows degradation or has reached 85% of its expected life with a capacity < 100% of the manufacturer's rating. When the battery has reached 85% of its expected life with capacity 100% of the manufacturer's rating, the Frequency becomes 24 months. Battery degradation is indicated when the battery capacity drops by more than 10% relative to its capacity on the previous performance test or when it is 10% below the manufacturer rating. These Frequencies are considered acceptable based on the testing being performed in a conservative manner relative to the battery life and degradation. This ensures that battery capacity is adequately monitored and that the battery remains capable of performing its intended function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
This SR is modified by a Note stating that this SR shall not be performed in MODE 1, 2, 3, or 4. The reason for the Note is that during operation in these MODES, performance of this SR could cause perturbations to the electrical distribution system and challenge safety systems.
R.E. Ginna Nuclear Power Plant                B 3.8.4-7                                  Revision 87
 
DC Sources - MODES 1, 2, 3, and 4 B 3.
 
==8.4 REFERENCES==
: 1. Atomic Industrial Forum (AIF) GDC 39, Issued for comment July 10, 1967.
: 2. UFSAR, Section 8.3.2.
: 3. UFSAR, Section 9.4.9.3.
: 4. UFSAR, Chapter 6.
: 5. UFSAR, Chapter 15.
: 6. UFSAR, Section 8.3.1.
: 7. 10 CFR 50, Appendix A, GDC 17.
: 8. IEEE-450-1980.
: 9. Deleted.
: 10. Deleted.
R.E. Ginna Nuclear Power Plant                B 3.8.4-8                            Revision 77
 
DC Sources - MODES 1, 2, 3, and 4 B 3.8.4 Figure B 3.8.4-1 R.E. Ginna Nuclear Power Plant    B 3.8.4-9                        Revision 41
 
DC Sources - MODES 5 and 6 B 3.8.5 B 3.8    ELECTRICAL POWER SYSTEMS B 3.8.5      DC Sources - MODES 5 and 6 BASES BACKGROUND            The Background section of the Bases for LCO 3.8.4, "DC Sources -
MODES 1, 2, 3, and 4" is applicable to these Bases, with the following modifications.
In MODE 5 or 6, the number of required DC electrical sources may be reduced since less energy is retained within the reactor coolant system than during higher MODES. Also, a significant number of required testing and maintenance activities must be performed under these conditions such that equipment and systems, including the DC electrical sources, must be removed from service.
In addition to the DC sources described in the Bases for LCO 3.8.4, there is a non-class 1E Technical Support Center (TSC) battery charger. The TSC battery charger may be tied to the Class 1E A train or B train so that the train's Class 1E battery and chargers may be removed from service.
The TSC battery charger has a capacity of 500 amps at 130 volts DC which is over three times the required 150 amp capacity of the Class 1E DC systems. The TSC battery charger may be tied to the Class 1E A train or B train DC electrical power distribution system provided the charger output voltage is 140 volts. The normal equalize voltage of the TSC battery system is limited to 140 volts when tied to the TSC DC eletrical power distribution system or when tied to the class 1E A train or B train DC electrical power distribution system, due to the voltage rating of various components and fuses in the Class 1E DC distribution system.
The TSC battery charger is physically separated from the Class 1E A train and B train chargers and batteries. The TSC DC system is connected to either Class 1E train through a manual throwover switch and an isolation switch. A failure in the TSC system while connected to one of the Class 1E trains will not cause a failure in the redundant train.
The TSC battery charger is normally supplied from non-Class 1E 480 volt Bus 15. The power supply can be backed up by a non-class 1E diesel generator.
The minimum required DC electrical sources is based on the requirements of LCO 3.8.10, "Distribution Systems - MODES 5 and 6.
R.E. Ginna Nuclear Power Plant                B 3.8.5-1                                Revision 61
 
DC Sources - MODES 5 and 6 B 3.8.5 APPLICABLE            The OPERABILITY of the minimum DC electrical power sources during SAFETY                MODES 5 and 6 ensures that:
ANALYSES
: a. Required features needed to mitigate a fuel handling accident are available;
: b. Required features necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and
: c. Instrumentation and control capability is available for monitoring and maintaining the plant in a cold shutdown condition or refueling condition.
In general, when the plant is shut down, the Technical Specifications requirements ensure that the plant has the capability to mitigate the consequences of postulated accidents. However, assuming a single failure and concurrent loss of all offsite or all onsite power is not required.
Therefore, the OPERABILITY of the DC electrical power sources ensures that one train of DC sources are OPERABLE in the event of:
: a. An assumed loss of all offsite AC power;
: b. An assumed loss of all onsite standby AC power; or
: c. A worst case single failure.
This reduction in required AC sources is allowed because many Design Basis Accidents (DBAs) that are analyzed in MODES 1, 2, 3, and 4 have no specific analyses in MODES 5 and 6. Worst case bounding events are deemed not credible in MODES 5 and 6 because the energy contained within the reactor pressure boundary (reactor coolant temperature and pressure) and the corresponding stresses result in the probabilities of occurrence being significantly reduced or eliminated, and result in minimal consequences. These deviations from DBA analysis assumptions and design requirements during shutdown conditions are allowed by the LCOs for the systems required in MODES 5 and 6.
During MODES 1, 2, 3, and 4, various deviations from the analysis assumptions and design requirements are allowed within the Required Actions. This allowance is in recognition that certain testing and maintenance activities must be conducted provided an acceptable level of risk is not exceeded. During MODES 5 and 6, performance of a significant number of required testing and maintenance activities is also required. In MODES 5 and 6, the activities are generally planned and administratively controlled. Relaxations from MODE 1, 2, 3, and 4 LCO requirements are acceptable during shutdown modes based on:
R.E. Ginna Nuclear Power Plant              B 3.8.5-2                                      Revision 61
 
DC Sources - MODES 5 and 6 B 3.8.5
: a. The fact that time in an outage is limited. This is a risk prudent goal as well as a utility economic consideration.
: b. Requiring appropriate compensatory measures for certain conditions. These may include administrative controls, reliance on systems that do not necessarily meet typical design requirements applied to systems credited in operating MODE analyses, or both.
: c. Prudent utility consideration of the risk associated with multiple activities that could affect multiple systems.
: d. Maintaining, to the extent practical, the ability to perform required functions (even if not meeting MODE 1, 2, 3, and 4 OPERABILITY requirements) for systems assumed to function during an event.
In the event of an accident while in MODE 5 or 6, this LCO ensures the capability to support systems necessary to mitigate the postulated events during shutdown, assuming either a loss of all offsite power or a loss of all onsite diesel generator (DG) power.
The DC sources satisfy Criterion 3 of the NRC Policy Statement.
LCO                  The DC electrical power sources are required to be OPERABLE to support the distribution subsystems required OPERABLE by LCO 3.8.10, "Distribution Systems - MODES 5 and 6." If only one DC electrical power distribution train is required to be OPERABLE, the minimum source consists of a battery, a charging capacity of at least 150 amps, and the corresponding control equipment and interconnecting cabling within the required train. If both DC electrical power trains are required, one DC source must contain a battery, a charging capacity of at least 150 amps, and the corresponding control equipment and interconnecting cabling within the train system. The second DC source may consist of only a battery charger with a capacity of at least 150 amps, or a battery, and the corresponding control equipment and interconnecting cabling. The non-Class 1E TSC battery charger and the corresponding interconnecting cabling may be used as the second DC source. The battery charger output voltage must be 1 40 volts when it is being used for this LCO.
The TSC battery charger is OPERABLE when it is supplied by either offsite power or the TSC diesel generator. The two DC sources must be sufficiently independent that a loss of all offsite power sources, a loss of onsite standby power, or a worst case single failure does not affect more than one required DC electrical power train. This ensures the availability of sufficient DC electrical power sources to operate the plant in a safe manner and to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents).
R.E. Ginna Nuclear Power Plant                B 3.8.5-3                                    Revision 61
 
DC Sources - MODES 5 and 6 B 3.8.5 The AC powered and DC powered fan ventilation units associated with the Class 1E battery systems are not required to be OPERABLE for this LCO, but some form of ventilation may be required to meet SR 3.8.6.4 and SR 3.8.6.5.
APPLICABILITY        The DC electrical power sources required to be OPERABLE in MODES 5 and 6 provide assurance that systems required to mitigate the affects of a DBA and to maintain the plant in the cold shutdown or refueling condition are available.
The DC electrical power requirements for MODES 1, 2, 3, and 4 are covered in LCO 3.8.4, "DC Sources - MODES 1, 2, 3, and 4."
ACTIONS              A.1 Although two trains may be required by LCO 3.8.10, "Distribution Systems - MODES 5 and 6," the remaining DC electrical train may be capable of supporting sufficient systems to allow continuation of CORE ALTERATIONS, and operations with a potential for positive reactivity additions. By allowing the option to declare required features inoperable associated with the required inoperable DC power source(s), appropriate restrictions will be implemented in accordance with the LCO ACTIONS of the affected required features. Required features remaining powered from a DC electrical source, even if that source is considered inoperable because it is not powering other required features, are not declared inoperable by this Required Action.
A.2.1, A.2.2, A.2.3, and A.2.4 With one or more required DC electrical power sources inoperable, the option exists to declare all required features inoperable per Required Action A.1. Since this option may involve undesired administrative efforts, the allowance for sufficiently conservative actions is made.
Therefore allowance for sufficiently conservative actions is made (i.e., to suspend CORE ALTERATIONS, movement of irradiated fuel assemblies, and operations involving positive reactivity additions) that could result in loss of required SDM (Mode 5) or boron concentration (Mode 6).
Suspending positive reactivity additions that could result in failure to meet the minimum SDM or boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than that required in the RCS for minimum SDM or refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. Introduction of temperature changes including temperature increases when operating R.E. Ginna Nuclear Power Plant                    B 3.8.5-4                                  Revision 61
 
DC Sources - MODES 5 and 6 B 3.8.5 with a positive MTC must also be evaluated to ensure they do not result in a loss of required SDM. Performance of Required Actions A.2.1, A.2.2, and A.2.3 shall not preclude completion of movement of a component to a safe position or normal cooldown of the coolant volume for the purpose of system temperature control within established procedures.
It is further required to immediately initiate action to restore the required DC electrical power source and to continue this action until restoration is accomplished in order to provide the necessary DC electrical power to the plant safety systems.
The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required DC electrical power subsystems should be completed as quickly as possible in order to minimize the time during which the plant safety systems may be without sufficient power.
SURVEILLANCE          SR 3.8.5.1 REQUIREMENTS This SR requires the performance of SRs from LCO 3.8.4 that are necessary for ensuring the OPERABILITY of the DC electrical power subsystem in MODES 5 and 6.
If the TSC battery charger system is being used for the second DC power source, battery terminal/charger voltage should be  130.2 V on float charge. This value is higher than that specified in SR 3.8.4.1 (129 V) to account for voltage drop between the TSC battery charger system and the Class 1E system tie.
This SR precludes requiring the OPERABILITY DC electrical power source from being removed from service to perform a battery service test or a performance discharge test. With limited DC sources available, a single event could compromise multiple required safety features. It is the intent that these SRs must still be capable of being met, but actual performance is not required during periods when the DC electrical power source is required to be OPERABILITY. Refer to the corresponding Bases for LCO 3.8.4 for a discussion of the specified SR.
REFERENCES            1.      None.
R.E. Ginna Nuclear Power Plant                    B 3.8.5-5                                    Revision 61
 
Battery Cell Parameters B 3.8.6 B 3.8    ELECTRICAL POWER SYSTEMS B 3.8.6      Battery Cell Parameters BASES BACKGROUND            Each DC electrical power train contains a 125 VDC battery which is capable of carrying the expected shutdown loads following a plant trip and a loss of all AC power for a period of 4 hours without battery terminal voltage falling below 108.6 V. This ensures that devices supplied by the batteries have adequate voltage levels after accounting for line losses between the battery terminals and the devices. Major loads and approximate operating times on each battery are discussed in the UFSAR (Ref. 1). The batteries are normally in standby since the associated battery chargers provide for the required DC system loads.
The batteries for Train A and Train B DC electrical power are sized to produce required capacity at 80% of nameplate rating, corresponding to warranted capacity at end of life cycles and 100% design demand.
Battery size is based on 125% of required capacity for aging considerations.
This LCO delineates the limits on electrolyte temperature, level, float voltage, and specific gravity for the DC power source batteries to ensure that the batteries are capable of performing their safety function as required by LCO 3.8.4, "DC Sources - MODES 1, 2, 3, and 4," and LCO 3.8.5, "DC Sources - MODES 5 and 6."
APPLICABLE                The initial conditions of Design Basis Accident (DBA) and transient SAFETY                    analyses assume Engineered Safety Feature systems are OPERABLE ANALYSES                  (Refs. 2 and 3). The DC electrical power system provides normal and emergency DC electrical power for the diesel generators, emergency auxiliaries, and control and switching during all MODES of operation. The DC sources are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to Engineered Safety Feature systems so that fuel, Reactor Coolant System and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, "Power Distribution Limits;" Section 3.4, "Reactor Coolant System (RCS);" and Section 3.6, "Containment Systems."
Battery cell parameters satisfy Criterion 3 of the NRC Policy Statement.
R.E. Ginna Nuclear Power Plant                      B 3.8.6-1                                  Revision 40
 
Battery Cell Parameters B 3.8.6 LCO                  This LCO requires that battery cell parameters for Train A and B batteries be within limits to ensure availability of the required DC power to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence or a postulated DBA. Battery cell parameters are defined for electrolyte level, temperature, float voltage, and specific gravity. The limits for electrolyte level, float voltage, and specific gravity are conservatively established for both designated pilot cells and connected cells within plant procedures. Failure to meet these established limits may allow continued DC electrical system function provided that the limit specified in the associated Surveillance Requirement for each connected cell is not exceeded. The term "connected cell" excludes any battery cell that may be jumpered out.
APPLICABILITY        The battery cell parameters for Train A and Train B batteries are required solely for the support of the associated DC electrical power subsystem.
Therefore, the battery cell parameter limits are required to be met when the DC power source is required to be OPERABLE. Since the Train A and Train B batteries support LCO 3.8.4 and LCO 3.8.5, the battery cell parameters are required to be met in MODES 1, 2, 3, and 4, and when the associated DC electrical power subsystems are required to be OPERABLE in MODES 5 and 6.
ACTIONS              The ACTIONS are modified by a Note to provide clarification that separate condition entry is allowed for each battery. Separate Condition entry is acceptable since the battery cell parameters are provided on a battery basis.
A.1 With one or more batteries with one or more battery cell parameters outside the limits for any connected cell, sufficient capacity to supply the maximum expected load requirement is not assured and the corresponding DC electrical power train must be immediately declared inoperable and actions taken per LCO 3.8.4 or LCO 3.8.5.
R.E. Ginna Nuclear Power Plant                B 3.8.6-2                                    Revision 40
 
Battery Cell Parameters B 3.8.6 SURVEILLANCE          SR 3.8.6.1 REQUIREMENTS This SR verifies that the electrolyte level of each connected battery cell is above the top of the plates and not overflowing. This is consistent with IEEE-450 (Ref. 4) and ensures that the plates suffer no physical damage and maintain adequate electron transfer capability. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.8.6.2 This SR verifies that the float voltage of each connected battery cell is
                      > 2.07 V. This limit is based on IEEE-450 (Ref. 4) which states that a cell voltage of 2.07 V or below, under float conditions and not caused by elevated temperature of the cell, indicates internal cell problems and may require cell replacement. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.8.6.3 This SR verifies the specific gravity of the designated pilot cell in each battery is  1.195. This value is based on manufacturer recommendations. According to IEEE-450 (Ref. 4), the specific gravity readings are based on a temperature of 77&#xba;F (25&#xba;C). The specific gravity readings are corrected for actual electrolyte temperature. For each 3&#xba;F (1.67&#xba;C) above 77&#xba;F (25&#xba;C), 1 point (0.001) is added to the reading; 1 point is subtracted for each 3&#xba;F below 77&#xba;F. The specific gravity of the electrolyte in a cell increases with a loss of water due to electrolysis or evaporation.
Because of specific gravity gradients that are produced during the recharging process, delays of several days may occur while waiting for the specific gravity to stabilize. A stabilized charger current is an acceptable alternative to specific gravity measurement for determining the state of charge. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.8.6.4 This SR verifies the average electrolyte temperature of the designated pilot cell in each battery is  55&#xba;F. This temperature limit is an initial assumption of the battery capacity calculations. The Surveillance Frequency is controlled under the Surveillance Frequency Program.
R.E. Ginna Nuclear Power Plant                B 3.8.6-3                                  Revision 77
 
Battery Cell Parameters B 3.8.6 SR 3.8.6.5 This SR verifies that the average temperature of every fifth cell of each battery is  55&#xba;F. This is consistent with the recommendations of IEEE-450 (Ref. 4). Lower than normal temperatures act to inhibit or reduce battery capacity. This SR ensures that the operating temperatures remain within an acceptable operating range. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.8.6.6 This SR verifies the specific gravity of each connected cell is not more than 0.020 below average of all connected cells and that the average of all connected cells is  1.195. This value is based on manufacturer recommendations and IEEE-450 (Ref. 4) which ensures that the effect of a highly charged or new cell does not mask overall degradation of the battery. The temperature correction for specific gravity readings is the same as that discussed for SR 3.8.6.3. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES            1. UFSAR, Section 3.8.2.
: 2. UFSAR, Chapter 6.
: 3. UFSAR, Chapter 15.
: 4. IEEE-450-1980.
R.E. Ginna Nuclear Power Plant              B 3.8.6-4                                  Revision 77
 
AC Instrument Bus Sources - MODES 1, 2, 3, and 4 B 3.8.7 B 3.8    ELECTRICAL POWER SYSTEMS B 3.8.7      AC Instrument Bus Sources - MODES 1, 2, 3, and 4 BASES BACKGROUND            The AC instrument bus electrical power distribution subsystem consists of four 120 VAC instrument buses. The power source for one 120 VAC instrument bus (Instrument Bus D) is normally supplied from offsite power via a non-Class 1E constant voltage transformer (CVT) such that only three buses are considered safety related (see Figure B 3.8.4-1). These three 120 VAC instrument buses (A, B, and C) supply a source of power to instrumentation and controls which are used to monitor and acu  t ate the Reactor Protection System (RPS) and Engineered Safety Features (ESF) and other components (Ref. 1). The loss of Instrument Bus D is addressed in Technical Requirements Manual (TRM) TR 3.8.2, "Instrument Bus D."
Instrument Buses A and C can be supplied power either from inverters which are powered from separate and redundant DC power sources, a non-Class 1E CVT (maintenance CVT) powered from offsite power, or a Class 1E CVT (see Figure B 3.8.4-1). The inverters are the preferred source of power for Instrument Bus A and C because of the stability and reliability they achieve.
Instrument Bus B can be supplied power from either a Class 1E CVT or a non-Class 1E CVT (maintenance CVT) powered from offsite power. The Class 1E CVT, supplied by motor control center C (MCC C is supplied by 480 V safeguards Bus 14), is the preferred source of power for Instrument Bus B because of the potential to have a power interruption if offsite power were unavailable.
The majority of instrumentation and controls supplied by the 120 VAC instrument buses are fail safe devices such that they go to their post accident position upon loss of power. However, a notable exception to this is the actuation logic for Containment Spray (CS) System which requires 120 VAC and 125 VDC power in order to function. This prevents a spurious CS actuation from occurring if control power were lost. The actuation logic for CS is powered from all three instrument buses and from both DC electrical power distribution trains.
R.E. Ginna Nuclear Power Plant                B 3.8.7-1                                Revision 41
 
AC Instrument Bus Sources - MODES 1, 2, 3, and 4 B 3.8.7 APPLICABLE            The initial conditions of Design Basis Accident (DBA) and transient SAFETY                analyses (Refs. 2 and 3), assume Engineered Safety Feature systems ANALYSES              are OPERABLE. The AC instrument bus power sources are designed to provide the required capacity, capability, redundancy, and reliability to ensure the availability of necessary power to the RPS and ESF instrumentation and controls so that the fuel, Reactor Coolant System, and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, "Power Distribution Limits;" Section 3.4, "Reactor Coolant System (RCS);" and Section 3.6, "Containment Systems."
The OPERABILITY of the AC instrument bus power sources is consistent with the initial assumptions of the accident analyses and is based on meeting the design basis of the plant. This includes maintaining required AC instrument buses OPERABLE in the event of:
: a. An assumed loss of all offsite AC electrical power or all onsite standby AC power; and
: b. A worst case single failure.
In the event of a DBA, the OPERABILITY requirements of the AC instrument bus power sources ensures that one train of AC instrument buses are available with:
: a. An assumed loss of all offsite power; and
: b. A worst case single failure (including the loss of one AC instrument bus power source).
In general, the accident analyses assume that all offsite power is lost at the time of the initiating event except where the availability of offsite power provides worst case conditions (e.g., steam line break with continued operation of the reactor coolant pumps). The availability of redundant offsite power sources (i.e., circuits 7T and 767) helps to reduce the potential to lose all offsite power. Providing redundant sources of AC instrument bus power also ensures that at least one train of AC instrument buses is available if all onsite standby AC power is unavailable coincident with a single failure of one offsite power source during non accident conditions. In the event the plant is in the 100/0 or 0/
100 mode, a redundant source of offsite power can be obtained by backfeeding through the main transformer using a flexible connection that can be tied into the plant auxiliary transformer 11. The plant can survive on the available battery power, alternate power sources, and turbine driven Auxiliary Feedwater pump during the estimated 8 hours required to provide this power transfer (Ref. 4). Therefore, the requirements of GDC 17 (Ref. 5) can be met at all times.
R.E. Ginna Nuclear Power Plant                      B 3.8.7-2                                  Revision 41
 
AC Instrument Bus Sources - MODES 1, 2, 3, and 4 B 3.8.7 The AC instrument bus sources satisfy Criterion 3 of the NRC Policy Statement.
LCO                  The AC instrument bus sources ensure the availability of 120 VAC electrical power for the instrumentation for systems required to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence (AOO) or a postulated DBA.
Maintaining the required AC instrument bus sources OPERABLE ensures that the redundancy incorporated into the design of the RPS and ESF instrumentation and controls is maintained. The two inverters ensure an uninterruptible supply of AC electrical power to AC Instrument Bus A and C even if the 480 V safeguards buses are de-energized. The Class 1E 480 V safeguard bus supply to Instrument Bus B provides a reliable source for the third instrument bus.
For an inverter to be OPERABLE, the associated instrument bus must be powered by the inverter with output voltage within tolerances with power input to the inverter from a 125 VDC power source (see LCO 3.8.4, "DC Sources - MODES 1, 2, 3, and 4").
For a Class 1E CVT to be OPERABLE, the associated instrument bus must be powered by the CVT with the output voltage within tolerances with power to the CVT from a Class 1E 480 V safeguards bus. The 480 V safeguards bus must be powered from an acceptable AC source (see LCO 3.8.1, "AC Sources - MODES 1, 2, 3, and 4").
APPLICABILITY        The AC instrument bus power sources are required to be OPERABLE in MODES 1, 2, 3, and 4 to ensure that:
: a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients; and
: b. Adequate core cooling is provided and containment OPERABILITY and other vital functions are maintained in the event of a postulated DBA.
AC instrument bus power requirements for MODES 5 and 6 are covered in the Bases for LCO 3.8.8, "AC Instrument Bus Sources - MODES 5 and 6."
R.E. Ginna Nuclear Power Plant                B 3.8.7-3                                  Revision 41
 
AC Instrument Bus Sources - MODES 1, 2, 3, and 4 B 3.8.7 ACTIONS                A.1, A.2, and A.3 With an inverter inoperable, its associated AC instrument bus becomes inoperable until it is re-energized from either its Class 1E or non-Class 1E CVT.
Required Action A.1 allows the instrument bus to be powered from either its associated Class 1E CVT or from a non-Class 1E CVT. For Instrument Buses A and C, the non-Class 1E power is supplied by a non-safety related motor control center (MCC A) which is supplied by 480 V Bus 13. The Completion Time of 2 hours is consistent with LCO 3.8.9, "Distribution Systems - MODES 1, 2, 3, and 4."
Required Action A.2 is intended to limit the amount of time that the instrument bus can be connected to a non-Class 1E power supply. The 24 hour Completion Time is based upon engineering judgement, taking into consideration the time required to repair the Class 1E CVT or the inverter and the additional risk to which the plant is exposed because of the connection to a non-Class 1E power supply.
Required Action A.3 allows 72 hours to fix the inoperable inverter and restore it to OPERABLE status. The 72 hour Completion Time is based upon engineering judgment, taking into consideration the time required to repair an inverter and the additional risk to which the plant is exposed because of the inverter inoperability. This must be balanced against the risk of an immediate shutdown, along with the potential challenges to safety systems such a shutdown might entail. When the AC instrument bus is powered from its CVT, it is relying upon interruptible AC electrical power sources (offsite and onsite). The uninterruptible, battery backed inverter source to the AC instrument buses is the preferred source for powering instrumentation trip setpoint devices.
R.E. Ginna Nuclear Power Plant                  B 3.8.7-4                                  Revision 41
 
AC Instrument Bus Sources - MODES 1, 2, 3, and 4 B 3.8.7 B.1 and B.2 With the Class 1E CVT for Instrument Bus B inoperable, the instrument bus becomes inoperable until it is re-energized from its non-Class 1E CVT. Required Action B.1 requires Instrument Bus B to be powered from its non-Class 1E CVT within 2 hours. The non-Class 1E power is supplied by a nonsafety related 480 V motor control center (MCC A) which is supplied by 480 V Bus 13.
Required Action B.2 is intended to limit the amount of time that Instrument Bus B can be connected to a non-Class 1E power supply.
The 7 day limit is based on engineering judgement, taking into consideration the time required to repair the Class 1E CVT and the additional risk to which the plant is exposed because of the Class 1E CVT inoperability. This must be balanced against the risk of an immediate shutdown, along with the potential challenges to safety systems such a shutdown might entail. When Instrument Bus B is powered from its non-Class 1E CVT, it is relying upon interruptible offsite AC electrical power sources. The Class 1E, diesel generator backed, CVT to Instrument Bus B is the preferred power source for powering instrumentation trip setpoint devices.
C.1 and C.2 If the inoperable devices or components cannot be restored to OPERABLE status or other Required Actions are not completed within the required Completion Time of Condition A or B, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
D.1 If two or more required AC instrument bus power sources are inoperable, the plant is in a condition outside the accident analyses; therefore, LCO 3.0.3 must be entered immediately. This Condition must be entered when both inverters, or one or more inverters and the Class 1E CVT to Instrument Bus B are discovered to be inoperable.
R.E. Ginna Nuclear Power Plant              B 3.8.7-5                                  Revision 41
 
AC Instrument Bus Sources - MODES 1, 2, 3, and 4 B 3.8.7 SURVEILLANCE        SR 3.8.7.1 REQUIREMENTS This SR verifies correct static switch alignment to Instrument Bus A and C. This verifies that the inverters are functioning properly and AC Instrument Bus A and C are energized from their respective inverter. The verification ensures that the required power is available for the instrumentation of the RPS and ESF connected to the AC instrument buses. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.8.7.2 This SR verifies the correct Class 1E CVT alignment to Instrument Bus B.
This verifies that the Class 1E CVT is functioning properly and supplying power to AC Instrument Bus B. The verification ensures that the required power is available for the instrumentation of the RPS and ESF connected to the AC instrument bus. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES        1.      UFSAR, Chapter 8.3.2.
: 2.      UFSAR, Chapter 6.
: 3.      UFSAR, Chapter 15.
: 4.      UFSAR, Section 8.3.1.
: 5.      10 CFR 50, Appendix A, GDC 17.
R.E. Ginna Nuclear Power Plant                B 3.8.7-6                                Revision 77
 
AC Instrument Bus Sources - MODES 5 and 6 B 3.8.8 B 3.8    ELECTRICAL POWER SYSTEMS B 3.8.8      AC Instrument Bus Sources - MODES 5 and 6 BASES BACKGROUND            The Background section of the Bases for LCO 3.8.7, "AC Instrument Bus Sources - MODES 1, 2, 3, and 4" is applicable to these Bases, with the following modifications.
In MODE 5 or 6, the number of required AC instrument buses may be reduced since less energy is retained within the reactor coolant system than during higher MODES. Also, a significant number of required testing and maintenance activities must be performed under these conditions such that equipment and systems, including the AC instrument bus sources, must be removed from service. The minimum required AC instrument bus electrical subsystem is based on the requirements of LCO 3.8.10, "Distribution Systems - MODES 5 and 6."
APPLICABLE            The OPERABILITY of the minimum AC instrument bus power sources SAFETY                to each required AC instrument bus during MODES 5 and 6 ensures ANALYSES              that:
: a. Systems needed to mitigate a fuel handling accident are available;
: b. Systems necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and
: c. Instrumentation and control capability is available for monitoring and maintaining the plant in a cold shutdown condition or refueling condition.
In general, when the plant is shut down, the Technical Specifications requirements ensure that the plant has the capability to mitigate the consequences of postulated accidents. However, assuming a single failure and concurrent loss of all offsite or all onsite power is not required. Therefore, the OPERABILITY of the AC instrument bus power sources ensures that one train of the AC instrument buses are OPERABLE in the event of:
: a. An assumed loss of all offsite AC power;
: b. An assumed loss of all onsite standby AC power; or
: c. A worst case single failure.
R.E. Ginna Nuclear Power Plant              B 3.8.8-1                                    Revision 61
 
AC Instrument Bus Sources - MODES 5 and 6 B 3.8.8 This reduction in required AC sources is allowed because many Design Basis Accidents (DBAs) that are analyzed in MODES 1, 2, 3, and 4 have no specific analyses in MODES 5 and 6. Worst case bounding events are deemed not credible in MODES 5 and 6 because the energy contained within the reactor pressure boundary (reactor coolant temperature and pressure) and the corresponding stresses result in the probabilities of occurrence being significantly reduced or eliminated, and result in minimal consequences. These deviations from DBA analysis assumptions and design requirements during shutdown conditions are allowed by the LCOs for the systems required in MODES 5 and 6.
During MODES 1, 2, 3, and 4, various deviations from the analysis assumptions and design requirements are allowed within the Required Actions. This allowance is in recognition that certain testing and maintenance activities must be conducted provided an acceptable level of risk is not exceeded. During MODES 5 and 6, performance of a significant number of required testing and maintenance activities is also required. In MODES 5 and 6, the activities are generally planned and administratively controlled. Relaxations from MODE 1, 2, 3, and 4 LCO requirements are acceptable during shutdown modes based on:
: a. The fact that time in an outage is limited. This is a risk prudent goal as well as a utility economic consideration.
: b. Requiring appropriate compensatory measures for certain conditions. These may include administrative controls, reliance on systems that do not necessarily meet typical design requirements applied to systems credited in operating MODE analyses, or both.
: c. Prudent utility consideration of the risk associated with multiple activities that could affect multiple systems.
: d. Maintaining, to the extent practical, the ability to perform required functions (even if not meeting MODE 1, 2, 3, and 4 OPERABILITY requirements) for systems assumed to function during an event.
In the event of an accident while in MODE 5 or 6, this LCO ensures the capability to support systems necessary to mitigate the postulated events during shutdown, assuming either a loss of all offsite power or a loss of all onsite diesel generator (DG) power.
The AC instrument bus power sources satisfy Criterion 3 of the NRC Policy Statement.
R.E. Ginna Nuclear Power Plant                B 3.8.8-2                                  Revision 61
 
AC Instrument Bus Sources - MODES 5 and 6 B 3.8.8 LCO                  Maintaining the required AC instrument bus sources OPERABLE ensures that the redundancy incorporated into the design of the instrumentation and controls required during MODES 5 and 6 is maintained. The two inverters ensure an uninterruptible supply of AC electrical power to AC Instrument Bus A and C even if the 480 V safeguards buses are de-energized. The Class 1E 480 V safeguard bus supply to Instrument Bus B provides a reliable source. The non-Class 1E CVT powered from offsite power provides an available power source, if required.
For an inverter to be OPERABLE, the associated instrument bus must be powered by the inverter with output voltage within tolerances with power input to the inverter from a 125 VDC power source (see LCO 3.8.5, "DC Sources - MODES 5 and 6).
For a Class 1E CVT to be OPERABLE, the associated instrument bus must be powered by the CVT with the output voltage within tolerances with power to the CVT from a Class 1E 480 V safeguards bus. The 480 V safeguards bus must be powered from an acceptable AC source (see LCO 3.8.2, "AC Sources - MODES 5 and 6).
The non-Class 1E CVT may be used to power one required instrument bus provided the instrument bus output voltage is within tolerances and the redundant required instrument bus is capable of being powered from an OPERABLE DG and that instrument bus has output voltages within tolerances.
The instrument bus power sources must be sufficiently independent such that a loss of all offsite power sources, a loss of onsite standby power, or a worst case single failure does not affect more than one required instrument bus. This ensures the availability of sufficient power to the required AC instrument buses to operate the plant in a safe manner and to mitigate the consequences of postulated events during shutdown (e.g.,
fuel handling accidents).
APPLICABILITY        The AC instrument power sources required to be OPERABLE in MODES 5 and 6 provide assurance that systems required to mitigate the effects of a DBA and to maintain the plant in the cold shutdown or refueling condition are available.
AC Instrument Bus power requirements for MODES 1, 2, 3, and 4 are covered in LCO 3.8.7.
R.E. Ginna Nuclear Power Plant                  B 3.8.8-3                                Revision 61
 
AC Instrument Bus Sources - MODES 5 and 6 B 3.8.8 ACTIONS              A.1 Although two trains may be required by LCO 3.8.10, "Distribution Systems - MODES 5 and 6," the remaining OPERABLE AC instrument bus train may be capable of supporting sufficient required features to allow continuation of CORE ALTERATIONS and operations with a potential for positive reactivity additions. By allowing the option to declare required features inoperable with the associated AC instrument bus power source inoperable, appropriate restrictions will be implemented in accordance with the LCO ACTIONS of the affected required features. This condition must be entered when the inverters for Instrument Bus A or C are required and inoperable, or the Class 1E CVT for Instrument Bus B is required and inoperable.
A.2.1, A.2.2, A.2.3, and A.2.4 With one or more required AC instrument bus power sources inoperable, the option exists to declare all required features inoperable per Required Action A.1. Since this option may involve undesired administrative efforts, the allowance for sufficiently conservative actions is made.
Therefore, the allowance for sufficiently conservative actions is made (i.e., to suspend CORE ALTERATIONS, movement of irradiated fuel assemblies, and operations involving positive reactivity additions) that could result in loss of required SDM (Mode 5) or boron concentration (Mode 6). Suspending positive reactivity additions that could result in failure to meet the minimum SDM or boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than that required in the RCS for minimum SDM or refueling boron concentration.
This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation.
Introduction of temperature changes including temperature increases when operating with a positive MTC must also be evaluated to ensure they do not result in a loss of required SDM. Performance of Required Actions A.2.1, A.2.2, and A.2.3 shall not preclude completion of movement of a component to a safe position or normal cooldown of the coolant volume for the purpose of system temperature control within established procedures.
It is further required to immediately initiate action to restore the required AC instrument bus power source and to continue this action until restoration is accomplished in order to provide the necessary power to the plant safety systems.
R.E. Ginna Nuclear Power Plant                    B 3.8.8-4                                  Revision 61
 
AC Instrument Bus Sources - MODES 5 and 6 B 3.8.8 The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required AC instrument bus power source should be completed as quickly as possible in order to minimize the time the plant safety systems may be without power or powered from an alternate power source.
SURVEILLANCE          SR 3.8.8.1 REQUIREMENTS This SR verifies correct static switch alignment to the required AC instrument buses. This SR verifies that the inverter is functioning properly and the AC instrument bus is energized from the inverter. The verification ensures that the required power is available for the instrumentation connected to the AC instrument bus. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.8.8.2 This SR verifies the correct Class 1E CVT alignment when Instrument Bus B is required. This verifies that the Class 1E CVT is functioning properly and supplying power to AC Instrument Bus B. The verification ensures that the required power is available for the instrumentation of the RPS and ESF connected to the AC instrument bus. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES            1. None.
R.E. Ginna Nuclear Power Plant              B 3.8.8-5                                  Revision 77
 
Distribution Systems - MODES 1, 2, 3, and 4 B 3.8.9 B 3.8    ELECTRICAL POWER SYSTEMS B 3.8.9    Distribution Systems - MODES 1, 2, 3, and 4 BASES BACKGROUND            A source of electrical power is required for most safety related and nonessential action components. Two sources of electrical power are available, alternating current (AC) and direct current (DC). Separate distribution systems are developed for each of these electrical power sources which are further divided and organized based on voltage considerations and safety classification. This LCO is provided to specify the AC, DC, and AC instrument bus power electrical power distribution subsystems which are required to supply safety related and Engineered Safety Feature (ESF) Systems in MODES 1, 2, 3, and 4.
The onsite Class 1E AC, DC, and AC instrument bus electrical power distribution subsystems are each divided into two redundant and independent distribution trains. Each of these electrical power distribution subsystems, and their trains, are discussed in detail below.
AC Electrical Power Distribution Subsystem The Class 1E AC electrical power distribution subsystem is organized into two redundant and independent trains (Train A and Train B). Each train consists of two 480 V safeguards buses, distribution panels, motor control centers and load centers (see Figure B 3.8.1-1). The 480 V safeguards buses for each train are capable of being supplied from two sources of offsite power as well as a dedicated onsite emergency diesel generator (DG) source. These power sources are discussed in more detail in the Bases for LCO 3.8.1, "AC Sources - MODES 1, 2, 3, and 4."
The 480 V safeguards buses in turn supply motor control centers which supply motive power to required motor operated valves, pumps, dampers, or any other component which requires AC power to perform its safety related function. The AC electrical power distribution subsystem also supplies one of the three required AC instrument buses through a constant voltage transformer and provides a backup source for the other two instrument buses. The list of all required AC 480 V safeguards buses and motor control centers is provided in Table B 3.8.9-1.
R.E. Ginna Nuclear Power Plant                B 3.8.9-1                                  Revision 68
 
Distribution Systems - MODES 1, 2, 3, and 4 B 3.8.9 DC Electrical Power Distribution Subsystem The Class 1E DC electrical power distribution subsystem is organized into two redundant and independent trains (Train A and Train B). Each train consists of a Class 1E battery and two battery chargers (with a charging capacity of at least 150 amps) which supply a main 125 VDC distribution panel (see Figure B 3.8.4-1). These power sources are discussed in more detail in the Bases for LCO 3.8.4, "DC Sources -
MODES 1, 2, 3, and 4." Each main distribution panel supplies secondary distribution panels which provide control power to AC powered components and control power for other devices such as solenoid operated valves and air operated valves. The DC electrical power distribution subsystem also supplies two of the four AC instrument buses through inverters. The list of all required DC distribution panels is provided in Table B 3.8.9-1.
AC Instrument Bus Electrical Power Distribution Subsystem The AC instrument bus electrical power distribution subsystem consists of four 120 VAC instrument buses. In addition to the four instrument buses, one channel each of containment wide range pressure and steam generator B pressure instrumentation (PT-950 and PT-479) are fed from a separate inverter (MQ-483), which is supplied from 125 VDC Train A.
The power source for one 120 VAC instrument bus (Instrument Bus D) is supplied from offsite power via a non Class 1E constant voltage transformer (CVT) such that only three buses are considered safety related (see Figure B 3.8.4-1). These three buses are organized into two redundant and independent trains (Train A and Train B). These trains supply a source of power to instrumentation and controls which are used to monitor and actuate ESF and other components. Train A consists of two buses and their respective power distribution panels with one bus (Instrument Bus A) normally powered from an inverter and the other (Instrument Bus B) normally powered from a Class 1E CVT. Train B consists of one bus (Instrument Bus C) and its power distribution panel normally powered from an inverter. The long-term alternate power supplies for Instrument Bus A and C are two Class 1E CVTs, each powered from the same train as the associated battery chargers, and their use is governed by LCO 3.8.7, "AC Instrument Bus Sources -
MODES 1, 2, 3, and 4." The list of required 120 VAC instrument buses and their respective power distribution panels is provided in Table B 3.8.9-1. The loss of Instrument Bus D is addressed in Technical Requirements Manual (TRM) TR 3.8.2, "Instrument Bus D." The loss of inverter MQ-483 is addressed in LCO 3.3.2, "Engineered Safety Feature Actuation System (ESFAS) Instrumentation" and LCO 3.3.3, "Post Accident Monitoring (PAM) Instrumentation" for the affected individual containment wide range pressure and steam generator B pressure instrumentation (PT-950 and PT-479).
R.E. Ginna Nuclear Power Plant              B 3.8.9-2                                  Revision 68
 
Distribution Systems - MODES 1, 2, 3, and 4 B 3.8.9 APPLICABLE            The initial conditions of Design Basis Accident (DBA) and transient SAFETY                analyses (Refs. 1 and 2) assume ESF systems are OPERABLE. The ANALYSES              AC, DC, and AC instrument bus electrical power distribution subsystems are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor Coolant System, and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, "Power Distribution Limits;" Section 3.4, "Reactor Coolant System (RCS);" and Section 3.6, "Containment Systems."
The OPERABILITY of the AC, DC, and AC instrument bus electrical power distribution subsystems is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the plant. This includes maintaining power distribution subsystems OPERABLE in the event of:
: a. An assumed loss of all AC offsite power or all onsite standby AC power; and
: b. A worst case single failure.
In the event of a DBA, the OPERABILITY requirements of the AC, DC, and AC instrument bus electrical power distribution subsystems ensures that one train of each distribution subsystem is available with:
: a. An assumed loss of all offsite power; and
: b. A worst case single failure (including the loss of one train of offsite standby AC power).
In general, the accident analyses assume that all offsite power is lost at the time of the initiating event except where the availability of offsite power provides worst case conditions (e.g., steam line break with continued operation of the reactor coolant pumps). The availability of redundant offsite power sources (i.e., circuits 7T and 767) helps to reduce the potential to lose all offsite power. Providing redundant sources of offsite power also ensures that at least one AC, DC, and AC instrument bus train is available if all onsite standby AC power is unavailable coincident with a single failure of one offsite power source during non accident conditions. In the event the plant is in the 100/0 or 0/100 mode, a redundant source of offsite power can be obtained by backfeeding through the main transformer into the plant auxiliary transformer 11. The plant can survive on the available battery power, alternate power sources, and turbine driven Auxiliary Feedwater train during the estimated 8 hours required to provide this power transfer (Ref. 3).
Therefore, the requirements of GDC 17 (Ref. 4) can be met at all times.
R.E. Ginna Nuclear Power Plant                B 3.8.9-3                                  Revision 68
 
Distribution Systems - MODES 1, 2, 3, and 4 B 3.8.9 The AC, DC, and AC instrument bus electrical power distribution subsystems satisfy Criterion 3 of the NRC Policy Statement.
LCO                  Train A and Train B of the AC, DC, and AC instrument bus electrical power distribution subsystems are required to be OPERABLE. The power distribution subsystems and their trains listed in Table B 3.8.9-1 ensure the availability of AC, DC, and AC instrument bus electrical power for the systems required to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence (AOO) or a postulated DBA.
OPERABLE AC, DC, and AC instrument bus electrical power distribution subsystems require the associated buses, motor control centers, and distribution panels to be energized to their proper voltages. Maintaining the Train A and Train B AC, DC, and AC instrument bus electrical power distribution subsystems OPERABLE ensures that the redundancy incorporated into the design of ESF is not compromised. Therefore, a single failure within any system or within the electrical power distribution subsystems will not prevent safe shutdown of the reactor.
Tie breakers between redundant safety related AC, DC, and AC instrument bus power distribution subsystems, if they exist, must be open. This prevents any electrical malfunction in any power distribution subsystem from propagating to the redundant subsystem, which could cause the failure of a redundant subsystem and a loss of essential safety function(s).
If any of the following listed tie breakers are closed, the affected redundant electrical power distribution subsystem is considered inoperable (see Notes at end of listing). This does not, however, preclude AC buses from being powered from the same offsite circuit.
: a. AC power 480 V safeguards bus tie breakers (Ref. 5)
Bus-Tie 14-16 (Note 1)
Bus-Tie 16-14 (Note 1)
Bus-Tie 17-18 (Note 1)
Bus-Tie 16-15 (Note 2)
Bus-Tie 14-13 (Note 2)
R.E. Ginna Nuclear Power Plant                B 3.8.9-4                                  Revision 68
 
Distribution Systems - MODES 1, 2, 3, and 4 B 3.8.9
: b. DC control power automatic throwover switches (in normal position)
(Ref. 6)
DG Control Panel A (Note 1)
DG Control Panel B (Note 1)
Bus 14 Control Power and Undervoltage Cabinet (Note 1)
Bus 16 Control Power and Undervoltage Cabinet (Note 1)
Bus 17 Control Power and Undervoltage Cabinet (Note 1)
Bus 18 Control Power and Undervoltage Cabinet (Note 1)
: c. Technical Support Center battery connections to DC power Battery A and B (Ref. 6)
TSC/Battery A Fused Disconnect Switch (Note 3)
TSC/Battery B Fused Disconnect Switch (Note 3)
Notes:
: 1. If tie breaker/connection is closed such that both trains are connected, declare both electrical power distribution subsystems inoperable.
: 2. If tie breaker is closed with Bus 15 (or Bus 13) normal supply breaker closed declare electrical power distribution Train B (or Train A) inoperable. If Bus 15 (or bus 13) normal supply breaker is open, tie breaker may be closed without impacting LCO.
: 3. An individual TSC/Battery fused disconnect switch may be closed with the affected DC distribution subsystem considered OPERABLE provided:
: i.      No single failure, malfunction, or operator action can lead to cross-tying the affected DC distribution subsystem to the redundant train or the TSC battery, and ii. Any connected loads have been evaluated for the loading affects on the supply source and the adequacy of fault protection.
R.E. Ginna Nuclear Power Plant                B 3.8.9-5                                  Revision 68
 
Distribution Systems - MODES 1, 2, 3, and 4 B 3.8.9 The trains as specified in Table B 3.8.9-1 identify the major AC, DC, and AC instrument bus electrical power distribution subsystem components.
A train is defined to begin from the boundary of the power source for the respective subsystem (as defined in the power source LCOs), and continues up to the isolation device for the supplied safety related or ESF component (e.g., safety injection pump). The isolation device for the supplied safety related or ESF component is only considered part of the train when the device is not capable of opening to isolate the failed component from the train (e.g., breaker unable to open an overcurrent).
Otherwise, the failure of the isolation device to close to provide power to the component is addressed by the respective component's LCO. The isolation device for nonsafety related components are considered part of the train since these devices must be available to protect the safety related functions. Therefore, the train boundary essentially ends at the motor control center, distribution panel, or bus which supplies multiple components.
The inoperability of any component within the above defined train boundaries renders the train inoperable.
APPLICABILITY        The electrical power distribution subsystems are required to be OPERABLE in MODES 1, 2, 3, and 4 to ensure that:
: a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients; and
: b. Adequate core cooling is provided, and containment OPERABILITY and other vital functions are maintained in the event of a postulated DBA.
Electrical power distribution subsystem requirements for MODES 5 and 6 are addressed in LCO 3.8.10, "Distribution Systems - MODES 5 and 6."
ACTIONS              A.1 With one AC electrical power distribution train inoperable, the remaining AC electrical power distribution train is capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition. The overall reliability is reduced, however, because a single failure in the remaining AC power distribution train could result in the minimum required ESF functions not being supported. Therefore, the required AC buses, motor control centers, and distribution panels which comprise a train must be restored to OPERABLE status within 8 hours.
R.E. Ginna Nuclear Power Plant                B 3.8.9-6                                  Revision 68
 
Distribution Systems - MODES 1, 2, 3, and 4 B 3.8.9 The worst case Condition A scenario is one train without AC power (i.e.,
no offsite power to the train and the associated DG inoperable). In this Condition, the plant is more vulnerable to a complete loss of AC power.
The Completion Time for restoring the inoperable train before requiring a plant shutdown is limited to 8 hours because of:
: a. The potential for decreased safety if the plant operator's attention is diverted from the evaluations and actions necessary to restore power to the affected train; and
: b. The potential for an event in conjunction with a single failure of a redundant component in the OPERABLE train with AC power which results in the loss of multiple safety functions.
B.1 With one AC instrument bus electrical power distribution train inoperable, the remaining OPERABLE AC instrument bus train is capable of supporting the minimum safety functions necessary to shut down the plant and maintain it in the safe shutdown condition. Overall reliability is reduced, however, because a single failure in the remaining AC instrument bus train could result in the minimum ESF functions not being supported. Therefore, the AC instrument bus train must be restored to OPERABLE status within 2 hours.
Condition B represents one AC instrument bus train without power which includes the potential loss of both the DC source and the associated AC sources to the instrument bus. In this situation, the plant is significantly more vulnerable to a complete loss of all noninterruptible power.
Therefore, the Completion Time is limited to 2 hours due to the potential vulnerabilities. Taking exception to LCO 3.0.2 for components without adequate 120 VAC power, that would have Completion Times shorter than 2 hours if declared inoperable, is acceptable because of:
: a. The potential for decreased safety by requiring a change in plant conditions (i.e., requiring a shutdown) and not allowing stable operations to continue;
: b. The potential for decreased safety by requiring entry into numerous Applicable Conditions and Required Actions for components without adequate 120 VAC power and not providing sufficient time for the operators to perform the necessary evaluations and actions for restoring power to the affected train; and R.E. Ginna Nuclear Power Plant                B 3.8.9-7                                  Revision 68
 
Distribution Systems - MODES 1, 2, 3, and 4 B 3.8.9
: c. The potential for an event in conjunction with a single failure of a redundant component in the OPERABLE AC instrument bus train.
The 2 hour Completion Time takes into account the importance to safety of restoring the AC instrument bus train to OPERABLE status, the redundant capability afforded by the other OPERABLE instrument bus train, and the low probability of a DBA occurring during this period.
C.1 With one DC electrical power distribution train inoperable, the remaining DC electrical power distribution train is capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition. The overall reliability is reduced, however, because a single failure in the remaining DC electrical power distribution train could result in the minimum required ESF functions not being supported. Therefore, the required DC distribution panels must be restored to OPERABLE status within 2 hours.
Condition C represents one train without adequate DC power. In this situation, the plant is significantly more vulnerable to a complete loss of all DC power. Therefore, the Completion Time is limited to 2 hours due to this potential vulnerability. Taking exception to LCO 3.0.2 for components without adequate DC power, which would have Completion Times shorter than 2 hours, is acceptable because of:
: a. The potential for decreased safety by requiring a change in plant conditions (i.e., requiring a shutdown) and not allowing stable operations to continue;
: b. The potential for decreased safety by requiring entry into numerous applicable Conditions and Required Actions for components without DC power and not providing sufficient time for the operators to perform the necessary evaluations and actions for restoring power to the affected train; and
: c. The potential for an event in conjunction with a single failure of a redundant component in the OPERABLE train with DC power.
]
R.E. Ginna Nuclear Power Plant                B 3.8.9-8                                    Revision 68
 
Distribution Systems - MODES 1, 2, 3, and 4 B 3.8.9 D.1 and D.2 If the inoperable distribution subsystem cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
E.1 With two trains with inoperable electrical power distribution subsystems, the potential for a loss of safety function is greater. If a loss of safety function exists, no additional time is justified for continued operation and LCO 3.0.3 must be entered. This Condition may be entered with the loss of two trains of the same electrical power distribution subsystem, or with loss of Train A of one electrical power distribution subsystem coincident with the loss of Train B of a second electrical power distribution subsystem such that a loss of safety function exists.
SURVEILLANCE          SR 3.8.9.1 REQUIREMENTS This SR verifies that the electrical power trains are functioning properly, with all required power source circuit breakers closed, tie-breakers open, and the buses energized from their allowable power sources. Required voltage for the AC electrical power distribution subsystem is  420 VAC; for the DC electrical power distribution subsystem,  129 VDC and 140 VDC; and for AC instrument bus electrical power distribution subsystem, between 113 VAC and 123 VAC at the instrument buses.
Required voltage for the instrument distribution panels is between 110 VAC and 123 VAC. Required voltage for inverter MQ-483 is between 107 volts and 129.8 volts. The loss of inverter MQ-483 is addressed in LCO 3.3.2, "Engineered Safety Feature Actuation System (ESFAS)
Instrumentation" and LCO 3.3.3, "Post Accident Monitoring (PAM)
Instrumentation" for the affected individual containment wide range pressure and steam generator B pressure instrumentation (PT-950 and PT-479). The verification of proper voltage availability on the buses ensures that the required power is readily available for motive as well as control functions for critical system loads connected to these buses. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
R.E. Ginna Nuclear Power Plant                B 3.8.9-9                                    Revision 90
 
Distribution Systems - MODES 1, 2, 3, and 4 B 3.
 
==8.9 REFERENCES==
: 1. UFSAR, Chapter 6.
: 2. UFSAR, Chapter 15.
: 3. UFSAR, Section 8.3.1.
: 4. 10 CFR 50, Appendix A, GDC 17.
: 5. Drawing 33013-0623.
: 6. Drawing 03202-0102.
R.E. Ginna Nuclear Power Plant            B 3.8.9-10                            Revision 68
 
Distribution Systems - MODES 1, 2, 3, and 4 B 3.8.9 Table B 3.8.9-1 AC and DC Electrical Power Distribution Systems DISTRIBUTION    VOLTAGE                  TRAIN A                                TRAIN B SUBSYSTEM AC Power      480 V                    Bus 14                                  Bus 16 Bus 18                                  Bus 17 MCC 1C                                  MCC 1D MCC 1H                                  MCC 1J MCC 1K                                MCC 1M MCC 1L DC Power      125 V          Main DC Fuse Cabinet A                  Main DC Fuse Cabinet B (DCPDPCB02A)                            (DCPDPCB02B)
Main DC Distribution Panel A            Main DC Distribution Panel B (DCPDPCB03A)                            (DCPDPCB03B)
MCB DC Distribution Panel A            MCB DC Distribution Panel B (DCPDPDCB04A)                            (DCPDPCB04B)
Aux Bldg DC Distribution Panel A        Aux Bldg DC Distribution Panel B (DCPDPAB01A)                            (DCPDPAB01B)
Aux Bldg DC Distribution Panel A1        Aux Bldg DC Distribution Panel B1 (DCPDPAB02A)                            (DCPDPAB02B)
DG A DC Distribution Panel A            DG B DC Distribution Panel B (DCPDPDG01A)                            (DCPDPDG01B)
Screenhouse DC Distribution Panel A    Screenhouse DC Distribution Panel B (DCPDPSH01A)                            (DCPDPSH01B)
Turbine Bldg DC Distribution Panel (DCPDPTB01B)
AC Instrument    120 V                      Bus A                                  Bus C Bus                                    Bus B                          Distribution Panel C Distribution Panel A                        (IBPDPCBC)
(IBPDPCBA)
Distribution Panel E (IBPDPCBE)
Distribution Panel B (IBPDPCBB)
Distribution Panel F (IBPDPCBF)
R.E. Ginna Nuclear Power Plant                    B 3.8.9-11                                    Revision 68
 
Distribution Systems - MODES 5 and 6 B 3.8.10 B 3.8    ELECTRICAL POWER SYSTEMS B 3.8.10    Distribution Systems - MODES 5 and 6 BASES BACKGROUND              The Background section of the Bases for LCO 3.8.9, "Distribution Systems - MODES 1, 2, 3, and 4" is applicable to these Bases, with the following modifications.
In MODES 5 or 6, the number of required AC, DC, and AC instrument bus electrical power distribution subsystems, or the number of required trains within these electrical power distribution subsystems may be reduced since less energy is retained within the reactor coolant system than during higher MODES. Also, a significant number of required testing and maintenance activities must be performed under these conditions such that equipment and systems, including the electrical power distribution subsystems, must be removed from service.
APPLICABLE              The OPERABILITY of the minimum AC, DC, and AC instrument bus SAFETY                  electrical power distribution subsystems during MODES 5 and 6 ensures ANALYSES                that:
: a. Systems needed to mitigate a fuel handling accident are available;
: b. Systems necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and
: c. Instrumentation and control capability is available for monitoring and maintaining the plant in a cold shutdown condition and refueling condition.
In general, when the plant is shut down, the Technical Specifications requirements ensure that the plant has the capability to mitigate the consequences of postulated accidents. However, assuming a single failure and concurrent loss of all offsite or all onsite power is not required.
Therefore, the OPERABILITY of the AC, DC, and AC instrument bus electrical power distribution subsystems ensures that one train of the onsite power or offsite AC sources are OPERABLE in the event of:
: a. An assumed loss of all offsite AC power;
: b. An assumed loss of all onsite standby AC power; or
: c. A worst case single failure.
R.E. Ginna Nuclear Power Plant                B 3.8.10-1                                      Revision 61
 
Distribution Systems - MODES 5 and 6 B 3.8.10 This reduction in required AC sources is allowed because many Design Basis Accidents (DBAs) that are analyzed in MODES 1, 2, 3, and 4 have no specific analyses in MODES 5 and 6. Worst case bounding events are deemed not credible in MODES 5 and 6 because the energy contained within the reactor pressure boundary (reactor coolant temperature and pressure) and the corresponding stresses result in the probabilities of occurrence being significantly reduced or eliminated, and result in minimal consequences. These deviations from DBA analysis assumptions and design requirements during shutdown conditions are allowed by the LCOs for the systems required in MODES 5 and 6.
During MODES 1, 2, 3, and 4, various deviations from the analysis assumptions and design requirements are allowed within the Required Actions. This allowance is in recognition that certain testing and maintenance activities must be conducted provided an acceptable level of risk is not exceeded. During MODES 5 and 6, performance of a significant number of required testing and maintenance activities is also required. In MODES 5 and 6, the activities are generally planned and administratively controlled. Relaxations from MODE 1, 2, 3, and 4 LCO requirements are acceptable during shutdown modes based on:
: a. The fact that time in an outage is limited. This is a risk prudent goal as well as a utility economic consideration.
: b. Requiring appropriate compensatory measures for certain conditions. These may include administrative controls, reliance on systems that do not necessarily meet typical design requirements applied to systems credited in operating MODE analyses, or both.
: c. Prudent utility consideration of the risk associated with multiple activities that could affect multiple systems.
: d. Maintaining, to the extent practical, the ability to perform required functions (even if not meeting MODE 1, 2, 3, and 4 OPERABILITY requirements) for systems assumed to function during an event.
In the event of an accident while in MODE 5 or 6 this LCO ensures the capability to support systems necessary to mitigate the postulated events during shutdown, assuming either a loss of all offsite power or a loss of all onsite diesel generator (DG) power.
The AC, DC, and AC instrument bus electrical power distribution subsystems satisfy Criterion 3 of the NRC Policy Statement.
R.E. Ginna Nuclear Power Plant                B 3.8.10-2                                  Revision 61
 
Distribution Systems - MODES 5 and 6 B 3.8.10 LCO                  Various combinations of AC, DC, and AC instrument bus electrical power distribution subsystems, trains within these subsystems, and equipment and components within these trains are required OPERABLE by other LCOs, depending on the specific plant condition. Implicit in those requirements is the required OPERABILITY of necessary support features. This LCO explicitly requires energization of the portions of the electrical distribution system necessary to support OPERABILITY of required systems, equipment, and components all specifically addressed in each LCO and implicitly required via the definition of OPERABILITY.
The LCOs which apply when the Reactor Coolant System is  200&#xba;F and which may require a source of electrical power are:
LCO 3.1.1          SHUTDOWN MARGIN (SDM)
LCO 3.3.1          Reactor Trip System (RTS) Instrumentation LCO 3.3.4          Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation LCO 3.3.5          Containment Ventilation Isolation Instrumentation LCO 3.3.6          Control Room Emergency Air Treatment System (CREATS) Actuation LCO 3.4.7          RCS Loops - MODE 5, Loops Filled LCO 3.4.8          RCS Loops - MODE 5, Loops Not Filled LCO 3.4.12          Low Temperature Overpressure Protection (LTOP)
System LCO 3.7.9          Control Room Emergency Air Treatment System (CREATS)
LCO 3.9.2          Nuclear Instrumentation LCO 3.9.4          Residual Heat Removal (RHR) and Coolant Circulation -
Water Level  23 Ft LCO 3.9.5          Residual Heat Removal (RHR) and Coolant Circulation -
Water Level < 23 Ft R.E. Ginna Nuclear Power Plant                B 3.8.10-3                                Revision 61
 
Distribution Systems - MODES 5 and 6 B 3.8.10 Maintaining the necessary trains of the AC, DC, and AC instrument bus electrical power distribution subsystems energized ensures the availability of sufficient power to operate the plant in a safe manner to mitigate the consequences of postulated events during shutdown (e.g.,
fuel handling accidents).
Bus-tie breakers required to be open during MODES 1, 2, 3, and 4 per SR 3.8.9.1 may be closed during MODES 5 and 6 provided that the distribution system alignment continues to support systems necessary to mitigate the postulated events assuming either a loss of all offsite power, loss of all onsite DG power, or a worst case single failure. The postulated events during MODES 5 and 6 include a boron dilution event and fuel handling accident. Examples of allowed configurations are as follows (note that other configurations are acceptable provided that they meet the above criteria):
: a. Bus-Tie Breakers 16-15 and 14-13 (and their associated "dummy" breakers on non-safeguards Buses 13 and 15) provide the capability to cross-tie the safeguards and non-safeguards 480 V buses. Closure of these bus-ties is allowed provided that the OPERABLE DG per LCO 3.8.2 can accept all loads which would be automatically loaded from the safeguards and non-safeguards buses, and accept those loads which must be manually loaded to mitigate the accident.
: b. Bus-Tie Breakers 14-16, 16-14, and 17-18 provide the capability to cross-tie the two safeguard electrical trains. Closure of these bus-ties is allowed provided that the OPERABLE DG per LCO 3.8.2 can accept all loads which would be automatically loaded, and accept those loads which must be manually loaded to mitigate the accident. In addition, the automatic trip logic of the bus-ties due to an undervoltage signal from either of the two cross-tied buses must be OPERABLE. This trip logic ensures that upon a fault of either 480 V safeguards bus as the single failure, the redundant bus is capable of mitigating the accident using either the DG or offsite power if two AC electrical subsystems are required.
APPLICABILITY        The AC, DC, and AC instrument bus electrical power distribution subsystems required to be OPERABLE in MODES 5 and 6 provide assurance that systems required to mitigate the effects of a postulated event and maintain the plant in the cold shutdown or refueling condition are available.
The AC, DC, and AC instrument bus electrical power distribution subsystems requirements for MODES 1, 2, 3, and 4 are covered in LCO 3.8.9, "Distribution Systems - MODES 1, 2, 3, and 4."
R.E. Ginna Nuclear Power Plant                B 3.8.10-4                                Revision 61
 
Distribution Systems - MODES 5 and 6 B 3.8.10 ACTIONS              A.1 Although redundant required features may require redundant trains of electrical power distribution subsystems to be OPERABLE, one OPERABLE distribution subsystem train may be capable of supporting sufficient required features to allow continuation of CORE ALTERATIONS and operations involving positive reactivity additions. By allowing the option to declare required features associated with an inoperable distribution subsystem or train inoperable, appropriate restrictions are implemented in accordance with the LCO ACTIONS of the affected required features.
A.2.1, A.2.2, A.2.3, A.2.4, and A.2.5 With one or more required electrical power distribution subsystems or trains inoperable, the option exists to declare all required features inoperable per Required Action A.1. Since this option may involve undesired administrative efforts, the allowance for sufficiently conservative actions is made. Therefore, the allowance for sufficiently conservative actions is made (i.e., to suspend CORE ALTERATIONS, movement of irradiated fuel assemblies, and operations involving positive reactivity additions) that could result in loss of required SDM (Mode 5) or boron concentration (Mode 6). Suspending positive reactivity additions that could result in failure to meet the minimum SDM or boron concentration limit is required to assure continued safe operation.
Introduction of coolant inventory must be from sources that have a boron concentration greater than that required in the RCS for minimum SDM or refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. Introduction of temperature changes including temperature increases when operating with a positive MTC must also be evaluated to ensure they do not result in a loss of required SDM.
Performance of Required Actions A.2.1, A.2.2, and A.2.3 shall not preclude completion of movement of a component to a safe position or normal cooldown of the coolant volume for the purpose of system temperature control within established procedures.
It is further required to immediately initiate action to restore the required AC, DC, and AC instrument bus electrical power distribution subsystems and to continue this action until restoration is accomplished in order to provide the necessary power to the plant safety systems.
In addition to performance of the above conservative Required Actions, a required residual heat removal (RHR) loop may be inoperable. In this case, Required Actions A.2.1, A.2.2, A.2.3, and A.2.4 do not adequately address the concerns relating to coolant circulation and heat removal.
Pursuant to LCO 3.0.6, the RHR ACTIONS would not be entered.
R.E. Ginna Nuclear Power Plant                    B 3.8.10-5                                    Revision 61
 
Distribution Systems - MODES 5 and 6 B 3.8.10 Therefore, Required Action A.2.5 requires declaring RHR inoperable, which results in taking the appropriate RHR actions.
The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required distribution subsystems should be completed as quickly as possible in order to minimize the time the plant safety systems may be without power.
SURVEILLANCE        SR 3.8.10.1 REQUIREMENTS This Surveillance verifies that the electrical power distribution trains are functioning properly, with all the required power source circuit breakers closed, required tie-breakers open, and the required buses energized from their allowable power sources. Required voltage for the AC power distribution electrical subsystem is  420 VAC, for the DC power distribution electrical subsystem 129 VDC and 140 VDC, and for AC instrument bus power distribution electrical subsystem is between 113 VAC and 123 VAC at the instrument buses. Required voltage for the instrument distribution panels is between 110 VAC and 123 VAC.
Required voltage for inverter MQ-483 is between 107 volts and 129.8 volts. The verification of proper voltage availability on the buses ensures that the required power is readily available for motive as well as control functions for critical system loads connected to these buses. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES          1. None.
`
R.E. Ginna Nuclear Power Plant                B 3.8.10-6                                  Revision 90
 
Boron Concentration B 3.9.1 B 3.9    REFUELING OPERATIONS B 3.9.1      Boron Concentration BASES BACKGROUND            The limit on the boron concentration ensures the reactor remains subcritical during MODE 6. Refueling boron concentration is the soluble boron concentration in the filled portions of the Reactor Coolant System (RCS), the refueling canal, and the refueling cavity that are hydraulically coupled to the reactor core during refueling.
The soluble boron concentration offsets the core reactivity and is measured by chemical analysis of a representative sample of the coolant.
The refueling boron concentration limit is specified in the Core Operation Limits Report (COLR). Plant refueling procedures ensure the specified boron concentration in order to maintain an overall core reactivity of keff 0.95 during fuel handling, with control rods and fuel assemblies assumed to be in the most adverse configuration (least negative reactivity) allowed by plant refueling procedures.
Atomic Industrial Forum (AIF) GDC 27 requires that two independent reactivity control systems preferably of different design principles be provided (Ref. 1). In addition to the reactivity control achieved by the control rods, reactivity control is provided by the chemical and volume control system (CVCS) which regulates the concentration of boric acid solution (neutron absorber) in the RCS. The CVCS is designed to prevent, under anticipated system malfunction, uncontrolled or inadvertent reactivity changes which may stress or damage the fuel beyond allowable limits.
The reactor is brought to shutdown conditions (i.e., MODE 5) before beginning operations to open the reactor vessel for refueling. After the RCS is cooled and depressurized the vessel head is unbolted and removed. The refueling canal and the refueling cavity are then flooded with borated water from the refueling water storage tank through the open reactor vessel by gravity feeding or by use of the Residual Heat Removal (RHR) System pumps.
The pumping action of the RHR System into the RCS, and the natural circulation due to thermal driving heads in the reactor vessel and refueling cavity provide mixing for the borated coolant in the refueling canal.
R.E. Ginna Nuclear Power Plant                B 3.9.1-1                                  Revision 61
 
Boron Concentration B 3.9.1 The RHR System is in operation during refueling (see LCO 3.9.4, "Residual Heat Removal (RHR) and Coolant Circulation-Water Level  23 Ft," and LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation-Water Level < 23 Ft") to provide forced circulation in the RCS and assist in maintaining the boron concentration in the RCS, the refueling canal, and the refueling cavity above the COLR limit.
APPLICABLE            During refueling operations, two types of accidents can occur within SAFETY              containment that affect the fuel and require control of reactivity. These ANALYSES            two accident types are a fuel handling accident and a boron dilution event. Both accidents assume that initial core reactivity is at its highest (i.e., at the beginning of the fuel cycle or the end of refueling).
A fuel handling accident can occur during fuel movement in the reactor vessel, the refueling canal, or the refueling cavity and includes a dropped fuel assembly and an incorrectly transferred fuel assembly.
The most limiting fuel handling accident is a dropped fuel assembly which is dropped adjacent to other fuel assemblies such that it results in the largest exposure of fuel in the dropped assembly. The negative reactivity effect of the soluble boron compensates for the increased reactivity for both types of accidents. Hence, the boron concentration ensures that keff  0.95 (i.e., 5% 'k/k SHUTDOWN MARGIN) during the refueling operation.
The second type of accident is a boron dilution event which results from inadvertent addition of unborated water to the RCS, refueling cavity, and refueling canal. The assumptions used in the boron dilution event (Ref.
: 2) provide for a maximum dilution flow of 120 gpm through two charging pumps (i.e., 60 gpm per pump) using unborated water as supplied by the two reactor makeup water pumps (60 gpm per pump). The RCS is also assumed to be at low water levels, uniformly mixed by the RHR System, with the minimum boron concentration as specified in the COLR. The operator has prompt and definite indication of significant boron dilution from an audible count rate function provided by the source range neutron flux instrumentation (see LCO 3.9.2, "Nuclear Instrumentation"). The increased count rate is a function of the effective subcritical multiplication factor. The results of this analysis conclude that an operator has at least 32 minutes before SHUTDOWN MARGIN is lost and the reactor goes critical which is sufficient time for operators to mitigate this event. This time is also greater than the 30 minutes required by Reference 3 for dilution events during refueling. Isolating the boron dilution source is performed by closing valves and/or stopping the reactor makeup water pumps.
The RCS boron concentration satisfies Criterion 2 of the NRC Policy Statement.
R.E. Ginna Nuclear Power Plant              B 3.9.1-2                                    Revision 61
 
Boron Concentration B 3.9.1 LCO                  The LCO requires that a minimum boron concentration be maintained in the refueling canal, the refueling cavity and the portions of the RCS that are hydraulically coupled with the reactor core while in MODE 6. The boron concentration limit specified in the COLR ensures that a core keff of  0.95 is maintained during fuel handling operations and that a core keff of < 1.0 is maintained during a boron dilution event. Violation of the LCO could lead to an inadvertent criticality during MODE 6.
APPLICABILITY        This LCO is applicable in MODE 6 to ensure that the fuel in the reactor vessel will remain subcritical. The required boron concentration ensures a keff  0.95 during fuel handling operations. In MODES 1 and 2 with keff 1.0, LCO 3.1.4, "Rod Group Alignment Limits," LCO 3.1.5, "Shutdown Bank Insertion Limit," and LCO 3.1.6, "Control Bank Insertion Limits" ensure an adequate amount of negative reactivity is available to shut down the reactor. In MODES 2 with keff < 1.0 and MODES 3, 4, and 5, LCO 3.1.1, "SHUTDOWN MARGIN (SDM)" ensures an adequate amount of negative reactivity is available to maintain the reactor subcritical.
ACTIONS              A.1, A.2, and A.3 If the boron concentration of the filled portions of the RCS, the refueling canal, and the refueling cavity hydraulically coupled to the reactor core, is less than its limit, an inadvertent criticality may occur due to a boron dilution event or incorrect fuel loading. To minimize the potential of an inadvertent criticality resulting from a fuel loading error or an operation that could cause a reduction in boron concentration, CORE ALTERATIONS and positive reactivity additions must be suspended immediately.
Suspension of CORE ALTERATIONS and positive reactivity additions shall not preclude moving a component to a safe position. Operations that individually add limited positive reactivity (e.g., temperature fluctuations from inventory addition or temperature control fluctuations),
but when combined with all other operations affecting core reactivity (e.g.,
intentional boration) result in overall net negative reactivity addition, are not precluded by this action.
In addition to immediately suspending CORE ALTERATIONS and positive reactivity additions, boration to restore the concentration must be initiated immediately.
R.E. Ginna Nuclear Power Plant                    B 3.9.1-3                                  Revision 61
 
Boron Concentration B 3.9.1 There are no safety analysis assumptions of boration flow rate and concentration that must be satisfied. The only requirement is to restore the boron concentration to its required value as soon as possible. In order to raise the boron concentration as soon as possible, the operator should begin boration with the best source available for plant conditions.
Once action has been initiated, it must be continued until the boron concentration is restored. The restoration time depends on the amount of boron that must be injected to reach the required concentration.
SURVEILLANCE          SR 3.9.1.1 REQUIREMENTS This SR ensures the coolant boron concentration of the refueling canal, the refueling cavity, and the portions of the RCS that are hydraulically coupled, is within the COLR limits. The boron concentration of the coolant is determined by chemical analysis. The sample should be representative of the portions of the RCS, the refueling canal, and the refueling cavity that are hydraulically coupled with the reactor core.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES            1. Atomic Industrial Forum (AIF) GDC 27, Issued for comment July 10, 1967.
: 2. UFSAR, Section 15.4.4.2.
: 3. NUREG-0800, Section 15.4.6.
R.E. Ginna Nuclear Power Plant                B 3.9.1-4                                  Revision 77
 
Nuclear Instrumentation B 3.9.2 B 3.9    REFUELING OPERATIONS B 3.9.2      Nuclear Instrumentation BASES BACKGROUND            The source range neutron flux monitors are used during refueling operations to monitor the core reactivity condition. The installed source range neutron flux monitors (N-31 and N-32) are part of the Nuclear Instrumentation System (NIS). These detectors are located external to the reactor vessel and detect neutrons leaking from the core.
The installed source range neutron flux detectors are proportional counters that are filled with boron triflouride (BF3) gas (Ref. 1). The detectors monitor the neutron flux in counts per second and provide continuous visual indication in the control room. Audible count rate is also available in the control room from either of the source range neutron flux monitors to alert operators to a possible boron dilution event. The NIS is designed in accordance with the criteria presented in Reference 2.
APPLICABLE            Two OPERABLE source range neutron flux monitors are required to SAFETY                provide redundant indication to alert operators of unexpected changes in ANALYSES              core reactivity. An increase in the audible count rate alerts the operators that a boron dilution event is in progress. Sufficient time is available for the operator to recognize the increase in audible count rate and to terminate the event prior to a loss of SHUTDOWN MARGIN (see Bases for LCO 3.9.1, "Boron Concentration"). Isolating the boron dilution source is performed by closing valves and stopping reactor makeup water pumps.
The source range neutron flux monitors satisfy Criterion 3 of the NRC Policy Statement.
LCO                    This LCO requires two source range neutron flux monitors be OPERABLE to ensure redundant monitoring capability is available to detect changes in core reactivity.
To be OPERABLE, each monitor must provide visual indication and at least one of the two monitors must provide an audible count rate function in the control room.
R.E. Ginna Nuclear Power Plant                B 3.9.2-1                                    Revision 61
 
Nuclear Instrumentation B 3.9.2 With the discharge of fuel from core positions adjacent to source range detector locations, counts decreasing to zero is the expected response.
Based on this indication alone, source range detection should not be considered inoperable. Following a full core discharge, source range response is verified with the initial fuel assemblies reloaded.
APPLICABILITY        In MODE 6, the source range neutron flux monitors must be OPERABLE to determine changes in core reactivity. There are no other direct means available to check core reactivity conditions in this MODE. In MODES 2, 3, 4, and 5, these same installed source range detectors and circuitry are also required to be OPERABLE by LCO 3.3.1, "Reactor Trip System (RTS) Instrumentation."
ACTIONS              A.1 and A.2 With only one source range neutron flux monitor OPERABLE, redundancy has been lost. Since these instruments are the only direct means of monitoring core reactivity conditions, CORE ALTERATIONS and introduction of coolant into the RCS with boron concentration less than required to meet the minimum boron concentration LCO 3.9.1 must be suspended immediately. Suspending positive reactivity additions that could result in failure to meet the minimum boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than that required in the RCS for minimum refueling boron concentration.
This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation.
Performance of Required Actions A.1 and A.2 shall not preclude completion of movement of a component to a safe position (i.e., other than normal cooldown of the coolant volume for the purpose of system temperature control within established procedures).
B.1 and B.2 With no source range neutron flux monitor OPERABLE there are no direct means of detecting changes in core reactivity. Therefore, actions to restore a monitor to OPERABLE status shall be initiated immediately and continue until a source range neutron flux monitor is restored to OPERABLE status.
Since CORE ALTERATIONS and positive reactivity additions are not to be made per Required Actions A.1 and A.2, the core reactivity condition is stabilized until the source range neutron flux monitors are OPERABLE.
This stabilized condition is determined by performing SR 3.9.1.1 to ensure the required boron concentration exists.
R.E. Ginna Nuclear Power Plant                      B 3.9.2-2                                Revision 61
 
Nuclear Instrumentation B 3.9.2 The Completion Time of 4 hours is sufficient to obtain and analyze coolant samples for boron concentration. The Frequency of once per 12 hours ensures unplanned changes in boron concentration would be identified. The 12 hour Frequency is reasonable, considering the low probability of a change in core reactivity during this time period.
C.1, C.2, and C.3 With no audible count rate available, only visual indication is available and prompt and definite indication of a boron dilution event has been lost.
Therefore, CORE ALTERATIONS and positive reactivity additions must be suspended immediately. Performance of Required Actions C.1 and C.2 shall not preclude completion of movement of a component to a safe position (i.e., other than a normal cooldown of the coolant volume for the purpose of system temperature control within established procedures).
Since CORE ALTERATIONS and positive reactivity additions are not to be made, the core reactivity condition is stabilized until the audible count rate capability is restored. This stabilized condition is determined by performing SR 3.9.1.1 to ensure that the required boron concentration exists.
The Completion time of 4 hours is sufficient to obtain and analyze coolant samples for boron concentration. The Frequency of once per 12 hours ensures unplanned changes in boron concentration would be identified.
The 12 hour Frequency is reasonable, considering the low probability of a change in core reactivity during this time period.
SURVEILLANCE          SR 3.9.2.1 REQUIREMENTS This SR is the performance of a CHANNEL CHECK, which is a comparison of the parameter indicated on one monitor to a similar parameter on another monitor. It is based on the assumption that the two indication channels should be consistent with core conditions. Changes in fuel loading and core geometry can result in significant differences between source range monitors, but each monitor should be consistent with its local conditions.
The inoperability of one source range neutron flux channel prevents performance of a CHANNEL CHECK for the operable channel. However, the Required Actions for the inoperable channel requires suspension of CORE ALTERATIONS and positive reactivity addition such that the CHANNEL CHECK of the operable channel can consist of ensuring consistency with known core conditions.
R.E. Ginna Nuclear Power Plant                B 3.9.2-3                                  Revision 61
 
Nuclear Instrumentation B 3.9.2 The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.9.2.2 This SR is the performance of a CHANNEL CALIBRATION. This SR is modified by a Note stating that neutron detectors are excluded from the CHANNEL CALIBRATION. The CHANNEL CALIBRATION for the source range neutron flux monitors consists of obtaining the detector plateau or preamp discriminator curves, evaluating those curves, and comparing the curves to baseline data. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES            1. UFSAR, Section 7.7.3.2.
: 2. Atomic Industrial Forum (AIF) GDC 13 and 19, Issued for Comment July 10, 1967.
R.E. Ginna Nuclear Power Plant              B 3.9.2-4                                  Revision 77
 
Containment Penetrations B 3.9.3 B 3.9    REFUELING OPERATIONS B 3.9.3      Containment Penetrations BASES BACKGROUND            During CORE ALTERATIONS or movement of irradiated fuel assemblies within containment, a release of fission product radioactivity within containment will be restricted from escaping to the environment when the LCO requirements are met. In MODES 1, 2, 3, and 4, this is accomplished by maintaining containment OPERABLE as described in LCO 3.6.1, "Containment." In MODE 5, there are no accidents of concern which require containment. In MODE 6, the potential for containment pressurization as a result of an accident is not likely; therefore, requirements to isolate the containment from the outside atmosphere can be less stringent. The LCO requirements are referred to as "containment closure" rather than "containment OPERABILITY."
Containment closure means that all potential escape paths are closed or capable of being closed. Since there is no potential for containment pressurization, the Appendix J leakage criteria and tests are not required.
The containment serves to contain fission product radioactivity that may be released from the reactor core following an accident, such that offsite and control room radiation exposures are maintained within the requirements of 10 CFR 50.67. Additionally, the containment provides radiation shielding from the fission products that may be present in the containment atmosphere following accident conditions.
The containment equipment hatch, which is part of the containment pressure boundary, provides a means for moving large equipment and components into and out of containment. During CORE ALTERATIONS or movement of irradiated fuel assemblies within containment, the equipment hatch must be bolted in place. Good engineering practice dictates that a minimum of 4 bolts be used to hold the equipment hatch in place and that the bolts be approximately equally spaced. As an alternative, the equipment hatch opening can be isolated by a closure plate that restricts air flow from containment or by an installed roll up door and enclosure building. Both equipment hatch air lock doors, the closure plate door, or the enclosure building rollup door may remain open if able to be closed under administrative control within 30 minutes.
The containment equipment and personnel air locks, which are also part of the containment pressure boundary, provide a means for personnel access during MODES 1, 2, 3, and 4 in accordance with LCO 3.6.2, "Containment Air Locks." Each air lock has a door at both ends. The doors are normally interlocked to prevent simultaneous opening when containment OPERABILITY is required. During periods of plant shutdown when containment closure is not required, the door interlock R.E. Ginna Nuclear Power Plant                B 3.9.3-1                                  Revision 53
 
Containment Penetrations B 3.9.3 mechanism may be disabled, allowing both doors of an air lock to remain open for extended periods when frequent containment entry is necessary.
During CORE ALTERATIONS or movement of irradiated fuel assemblies within containment, containment closure is required; therefore, the door interlock mechanism may remain disabled, but one personnel hatch air lock door must remain closed or capable of being closed under administrative control within 30 minutes.
The requirements for containment penetration closure ensure that a release of fission product radioactivity within containment will be restricted from escaping to the environment. The closure restrictions are sufficient to restrict fission product radioactivity release from containment due to a fuel handling accident during refueling.
The Containment Purge and Exhaust System includes two subsystems.
The Shutdown Purge System includes a 36 inch purge penetration and a 36 inch exhaust penetration. The second subsystem, a Mini-Purge System, includes a 6 inch purge penetration and a 6 inch exhaust penetration. During MODES 1, 2, 3, and 4, the shutdown purge and exhaust penetrations are isolated by a blind flange with two O-rings that provide the necessary boundary. The two air operated valves in each of the two mini-purge penetrations can be opened intermittently, but are closed automatically by the Containment Ventilation Isolation Instrumentation System. Neither of the subsystems is subject to a Specification in MODE 5.
In MODE 6, large air exchangers are used to support refueling operations. The normal 36 inch Shutdown Purge System is used for this purpose, and each air operated valve is closed by the Containment Ventilation Isolation Instrumentation in accordance with LCO 3.3.5, "Containment Ventilation Isolation Instrumentation."
The Mini-Purge System also remains operational in MODE 6, and all four valves are also closed by the Containment Ventilation Isolation Instrumentation.
The other containment penetrations that provide direct access from containment atmosphere to outside atmosphere must be isolated on at least one side. Isolation may be achieved by an OPERABLE automatic isolation valve, or by a manual isolation valve, blind flange, or equivalent.
Equivalent isolation methods may include use of a material that can provide a temporary, atmospheric pressure, ventilation barrier for the other containment penetrations during fuel movements.
R.E. Ginna Nuclear Power Plant                      B 3.9.3-2                                  Revision 53
 
Containment Penetrations B 3.9.3 APPLICABLE            During CORE ALTERATIONS or movement of irradiated fuel assemblies SAFETY                within containment, the most severe radiological consequences result ANALYSES              from a fuel handling accident. The fuel handling accident is a postulated event that involves damage to irradiated fuel (Ref. 1). Fuel handling accidents, analyzed using the criteria of Reference 2, include dropping a single irradiated fuel assembly and handling tool or a heavy object onto other irradiated fuel assemblies. Per 10 CFR 50.67, Accident Source Term, the NRC approved the Alternate Source Term Methodology in Reference 3 as amended by Reference 4. The requirements of LCO 3.9.6, "Refueling Cavity Water Level," and the minimum decay time of 72 hours prior to CORE ALTERATIONS ensure that the release of fission product radioactivity, subsequent to a fuel handling accident, results in doses that are within the guideline values specified in 10 CFR 50.67.
Reference 5 assumes that the equipment and personnel hatches are open for the duration of the accident. However, to provide a factor of safety, Appendix B to Reference 6 stipulates open penetrations be closed within 30 minutes.
Containment penetrations satisfy Criterion 3 of the NRC Policy Statement since these are assumed in the SRP.
LCO                  This LCO limits the consequences of a fuel handling accident in containment by limiting the potential escape paths for fission product radioactivity released within containment. The LCO requires any penetration providing direct access from the containment atmosphere to the outside atmosphere to be closed except for the OPERABLE containment purge and exhaust and hatch penetrations. For the OPERABLE containment purge and exhaust penetrations, this LCO ensures that at least one valve in each of these penetrations is isolable by the Containment Ventilation Isolation System. For the OPERABLE hatch penetrations, this LCO ensures that the penetrations are either closed or capable of being closed under administrative control.
APPLICABILITY        The containment penetration requirements are applicable during CORE ALTERATIONS or movement of irradiated fuel assemblies within containment because this is when there is a potential for a fuel handling accident. In MODES 1, 2, 3, and 4, containment penetration requirements are addressed by LCO 3.6.1. In MODES 5 and 6, when CORE ALTERATIONS or movement of irradiated fuel assemblies within containment are not being conducted, the potential for a fuel handling accident does not exist. Therefore, under these conditions, no requirements are placed on containment penetration status.
R.E. Ginna Nuclear Power Plant                    B 3.9.3-3                                Revision 53
 
Containment Penetrations B 3.9.3 ACTIONS              A.1 and A.2 If the containment equipment hatch (or its closure plate or roll up door and associated enclosure building), air lock doors, or any containment penetration that provides direct access from the containment atmosphere to the outside atmosphere is not in the required status, including the Containment Ventilation Isolation System not capable of automatic actuation when the purge and exhaust valves are open, the plant must be placed in a condition where the isolation function is not needed. This is accomplished by immediately suspending CORE ALTERATIONS and movement of irradiated fuel assemblies within containment.
Performance of these actions shall not preclude completion of movement of a component to a safe position.
SURVEILLANCE          SR 3.9.3.1 REQUIREMENTS This SR demonstrates that each of the containment penetrations are in the required status. The Surveillance on the open purge and exhaust valves will demonstrate that the valves are not blocked or otherwise prevented from closing (e.g., solenoid unable to vent).
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.9.3.2 This SR demonstrates that each containment purge and exhaust valve actuates to its isolation position on manual initiation or on an actual or simulated high radiation signal. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
R.E. Ginna Nuclear Power Plant                B 3.9.3-4                                  Revision 77
 
Containment Penetrations B 3.
 
==9.3 REFERENCES==
: 1. UFSAR, Section 15.7.
: 2. NUREG-0800, Section 15.7.4, Rev. 1, July 1981.
: 3. Letter from Donna M. Skay (NRC) to Mary G. Korsnick (Ginna), R.
E. Ginna Nuclear Power Plant - Modification of the Control Room Emergency Air Treatment System and Change to Dose Calculation Methodology to Alternate Source Term (TAC No. MB9123),
February 25, 2005.
: 4. Letter from Donna M. Skay (NRC) to Mary G. Korsnick (Ginna), R.
E. Ginna Nuclear Power Plant - Correction to Amendment No. 87 Re: Modification of the Control Room Emergency Air Treatment System (TAC No. MB9123), May 18, 2005.
: 5. DA-NS-08-050, Ginna Fuel Handling Accident Offsite and Control Room Doses, Revision 0.
: 6. Regulatory Guide 1.183, Alternate Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors.
R.E. Ginna Nuclear Power Plant                B 3.9.3-5                                Revision 53
 
RHR and Coolant Circulation - Water Level  23 Ft.
B 3.9.4 B 3.9    REFUELING OPERATIONS B 3.9.4      Residual Heat Removal (RHR) and Coolant Circulation-Water Level  23 Ft BASES BACKGROUND            The purpose of the RHR System in MODE 6 is to remove decay heat and sensible heat from the Reactor Coolant System (RCS), and to provide mixing of the borated coolant to prevent thermal and boron stratification (Ref. 1). Heat is removed from the RCS by circulating reactor coolant through the RHR heat exchanger(s) where the heat is transferred to the Component Cooling Water System. The coolant is then returned to the RCS via the RCS loop "B" cold leg. Operation of the RHR System for normal cooldown or decay heat removal is manually accomplished from the control room. The heat removal rate is adjusted by controlling the flow of reactor coolant through the RHR heat exchanger(s) and bypass line(s). Mixing of the reactor coolant is maintained by this continuous circulation of reactor coolant through the RHR System.
APPLICABLE            The safety analysis for the boron dilution event during refueling assumes SAFETY                one RHR loop is in operation (Ref. 2). This initial assumption ensures ANALYSES              continuous mixing of the borated coolant in the reactor vessel. The analysis also assumes the RCS is at equilibrium boron concentration and dilution occurs uniformly throughout the system. Therefore, thermal or boron stratification is not postulated. In order to ensure adequate mixing of the borated coolant, one loop of the RHR System is required to be OPERABLE, and in operation while in MODE 6, with water level  23 ft above the top of the reactor vessel flange.
While there is no explicit analysis assumption for the decay heat removal function of the RHR System in MODE 6, if the reactor coolant temperature is not maintained, boiling of the coolant could result. Due to the water volume available in the RCS with a water level  23 ft above the top of the reactor vessel flange, a significant amount of time exists before boiling of the coolant would occur following a loss of the required RHR pump. Since the loss of the required RHR pump results in the requirement to suspend operations involving a reduction in reactor coolant boron concentration, a boron dilution event is very unlikely.
Therefore, this requirement dictates that single failures are not considered for this LCO due to the time available to operators to respond to a loss of the operating RHR pump.
R.E. Ginna Nuclear Power Plant                B 3.9.4-1                                  Revision 76
 
RHR and Coolant Circulation - Water Level  23 Ft B 3.9.4 The LCO permits de-energizing the required RHR pump for short durations provided no operations are permitted that would cause a reduction in the RCS boron concentration. This conditional de-energizing of the required RHR pump does not result in a challenge to the fission product barrier or result in coolant stratification.
RHR and Coolant Circulation-Water Level  23 Ft satisfies criterion 2 of the NRC Policy Statement.
LCO                  Only one RHR loop is required for decay heat removal in MODE 6, with the water level  23 ft above the top of the reactor vessel flange, because the volume of water above the reactor vessel flange provides backup decay heat removal capability. One RHR loop is required to be OPERABLE and in operation to provide mixing of borated coolant to minimize the possibility of criticality.
An OPERABLE RHR loop includes an RHR pump, a heat exchanger, valves, piping, instruments, and controls to ensure an OPERABLE flow path. The flow path starts in the RCS loop "A" hot leg and is returned to the RCS loop "B" cold leg. Also included are all necessary support systems not addressed by applicable LCOs (e.g., component cooling water and service water). Management of gas voids is important to RHR System OPERABILITY.
The LCO is modified by a Note that allows the required operating RHR loop to be removed from service for up to 1 hour per 8 hour period provided no operations are permitted that would dilute the RCS boron concentration with coolant at boron concentrations less than required to meet the minimum boron concentration of LCO 3.9.1. Boron concentration reduction with coolant at boron concentrations less than required to assure the minimum required RCS boron concentration is maintained is prohibited because uniform concentration distribution cannot be ensured without forced circulation. This allows the operator to view the core and permits operations such as core mapping or alterations in the vicinity of the reactor vessel hot leg nozzles. This also permits operations such as RCS to RHR isolation valve testing. During this 1 hour period, decay heat is removed by natural convection to the large mass of water in the refueling cavity. Should both RHR loops become inoperable at anytime during operation in accordance with this Note, the Required Actions of this LCO should be immediately taken.
R.E. Ginna Nuclear Power Plant                    B 3.9.4-2                                Revision 76
 
RHR and Coolant Circulation - Water Level  23 Ft B 3.9.4 APPLICABILITY        One RHR loop must be OPERABLE and in operation in MODE 6, with the water level  23 ft above the top of the reactor vessel flange, to provide decay heat removal and mixing of the borated coolant. The 23 ft water level was selected because it corresponds to the 23 ft requirement established for fuel movement in LCO 3.9.6, "Refueling Cavity Water Level."
Requirements for the RHR System in MODES 1, 2, 3, 4, and 5 are covered by LCO 3.4.6, "RCS Loops - MODE 4;" LCO 3.4.7, "RCS Loops -
MODE 5, Loops Filled;" LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled," LCO 3.5.2, "ECCS-MODES 1, 2, and 3," and LCO 3.5.3, "ECCS-MODE 4." The RHR loop requirements in MODE 6 with the water level
                      < 23 ft are located in LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation-Water Level < 23 Ft."
ACTIONS              A.1, A.2, and A.3 If RHR loop requirements are not met, there will be no forced circulation to provide mixing to establish uniform boron concentrations. Suspending positive reactivity additions that could result in failure to meet the minimum boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than that required in the RCS for minimum refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation.
With no forced circulation cooling, decay heat removal from the core occurs by natural convection to the heat sink provided by the water above the core. A minimum refueling water level of 23 ft above the reactor vessel flange provides an adequate available heat sink. Suspending any operation that would increase decay heat load, such as loading a fuel assembly, is a prudent action under this condition. Therefore, actions shall be taken immediately to suspend loading irradiated fuel assemblies in the core.
With the plant in MODE 6 and the refueling water level  23 ft above the top of the reactor vessel flange, removal of decay heat is by ambient losses only. Therefore, corrective actions shall be initiated immediately and shall continue until RHR loop requirements are satisfied.
R.E. Ginna Nuclear Power Plant                B 3.9.4-3                                    Revision 76
 
RHR and Coolant Circulation - Water Level  23 Ft B 3.9.4 A.4 If RHR loop requirements are not met, all containment penetrations providing direct access from the containment atmosphere to the outside atmosphere must be closed within 4 hours. With the RHR loop requirements not met, the potential exists for the coolant to boil and release radioactive gas to the containment atmosphere. Closing containment penetrations that are open to the outside atmosphere ensures dose limits are not exceeded.
The Completion Time of 4 hours is reasonable, based on the low probability of the coolant boiling in that time.
SR 3.9.4.1 SURVEILLANCE REQUIREMENTS          This SR requires verification that one RHR loop is in operation and circulating reactor coolant. Verification includes flow rate, temperature, or pump status monitoring, which help ensure that forced flow is providing decay heat removal capability and mixing of the borated coolant to prevent thermal and boron stratification in the core. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.9.4.2 RHR System piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the RHR loops and may also prevent water hammer, pump cavitation, and pumping of noncondensible gas into the reactor vessel.
Selection of RHR System locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.
The RHR System is OPERABLE when it is sufficiently filled with water.
Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an R.E. Ginna Nuclear Power Plant                    B 3.9.4-4                                  Revision 77
 
RHR and Coolant Circulation - Water Level  23 Ft B 3.9.4 acceptance criteria for gas volume at the suction or discharge of a pump),
the Surveillance is not met. If it is determined by subsequent evaluation that the RHR System is not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water), the Surveillance may be declared met. Accumulated gas should be eliminated or brought within the acceptance criteria limits. RHR System locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative sub-set of susceptible locations. Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation.
REFERENCES            1.      UFSAR, Section 5.4.5.
: 2.      UFSAR, Section 15.4.4.2.
R.E. Ginna Nuclear Power Plant                  B 3.9.4-5                                    Revision 77
 
RHR and Coolant Circulation - Water Level < 23 Ft B 3.9.5 B 3.9    REFUELING OPERATIONS B 3.9.5      Residual Heat Removal (RHR) and Coolant Circulation-Water Level < 23 Ft BASES BACKGROUND            The purpose of the RHR System in MODE 6 is to remove decay heat and sensible heat from the Reactor Coolant System (RCS), and to provide mixing of the borated coolant to prevent thermal and boron stratification (Ref. 1). Heat is removed from the RCS by circulating reactor coolant through the RHR heat exchanger(s) where the heat is transferred to the Component Cooling Water System. The coolant is then returned to the RCS via the RCS loop "B" cold leg. Operation of the RHR System for normal cooldown or decay heat removal is manually accomplished from the control room. The heat removal rate is adjusted by controlling the flow of reactor coolant through the RHR heat exchanger(s) and bypass line(s). Mixing of the reactor coolant is maintained by this continuous circulation of reactor coolant through the RHR System.
APPLICABLE            The safety analysis for the boron dilution event during refueling assumes SAFETY                one RHR loop is in operation (Ref. 2). This initial assumption ensures ANALYSES              continuous mixing of the borated coolant in the reactor vessel. The analysis also assumes the RCS is at equilibrium boron concentration and dilution occurs uniformly throughout the system. Therefore, thermal or boron stratification is not postulated.
While there is no explicit analysis assumption for the decay heat removal function of the RHR System in MODE 6, if the reactor coolant temperature is not maintained, boiling of the coolant could result. This could lead to a loss of coolant in the reactor vessel. In addition, boiling of the coolant could lead to a reduction in boron concentration in the coolant due to boron plating out on components near the areas of the boiling activity. The loss of coolant and the reduction of boron concentration in the reactor coolant could eventually challenge the integrity of the fuel cladding, which is a fission product barrier.
In order to prevent a challenge to fuel cladding and to ensure adequate mixing of the borated coolant, two loops of the RHR System are required to be OPERABLE, and one loop in operation while in MODE 6, with the water level < 23 ft above the top of the reactor vessel flange.
RHR and Coolant Circulation-Water Level < 23 Ft satisfies criterion 4 of the NRC Policy Statement.
R.E. Ginna Nuclear Power Plant                B 3.9.5-1                                  Revision 76
 
RHR and Coolant Circulation - Water Level < 23 Ft B 3.9.5 LCO                  Both RHR loops must be OPERABLE in MODE 6, with the water level
                        < 23 ft above the top of the reactor vessel flange. In addition, one RHR loop must be in operation in order to remove decay heat and provide mixing of borated coolant to minimize the possibility of criticality.
An OPERABLE RHR loop includes an RHR pump, a heat exchanger, valves, piping, instruments and controls to ensure an OPERABLE flow path. The flow path starts in the RCS loop "A" hot leg and is returned to the RCS loop "B" cold leg. Also included are all necessary support systems not addressed by applicable LCOs (e.g., component cooling water and service water). Management of gas voids is important to RHR System OPERABILITY.
The RHR flow path described above is considered OPERABLE if modified during filling of the refueling canal or in order to perform surveillance tests during this time. This modified flow path starts from either the RCS Loop "A" hot leg or the RWST, is pumped through the RHR bypass line, and is returned to the reactor vessel through the deluge valves. This flow path is acceptable provided operations involving a reduction of boron concentration are not conducted or the source of the injection has a boron concentration greater than the requirements of LCO 3.9.1; "Boron Concentration", and during surveillance testing when only one deluge valve is open the duration is  1 hour.
APPLICABILITY        Two RHR loops are required to be OPERABLE, and one RHR loop must be in operation in MODE 6, with the water level < 23 ft above the top of the reactor vessel flange, to provide decay heat removal and mixing of the borated coolant.
Requirements for the RHR System in MODES 1, 2, 3, 4, and 5 are covered by LCO 3.4.6, "RCS Loops - MODE 4;" LCO 3.4.7, "RCS Loops -
MODE 5, Loops Filled;" LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled;" LCO 3.5.2, "ECCS-MODES 1, 2, and 3," and LCO 3.5.3, "ECCS-MODE 4." The RHR loop requirements in MODE 6 with the water level 23 ft are located in LCO 3.9.4, "Residual Heat Removal (RHR) and Coolant Circulation-Water Level  23 Ft."
R.E. Ginna Nuclear Power Plant                  B 3.9.5-2                                    Revision 76
 
RHR and Coolant Circulation - Water Level < 23 Ft B 3.9.5 ACTIONS              A.1 and A.2 If less than the required number of RHR loops are OPERABLE, action shall be immediately initiated and continued until the RHR loop is restored to OPERABLE status or until  23 ft of water level is established above the reactor vessel flange. When the water level is  23 ft above the reactor vessel flange, the Applicability changes to that of LCO 3.9.4, and only one RHR loop is required to be OPERABLE and in operation.
An immediate Completion Time is necessary for an operator to initiate corrective actions.
B.1 and B.2 If no RHR loop is in operation, there will be no forced circulation to provide mixing to establish uniform boron concentrations. Suspending positive reactivity additions that could result in failure to meet the minimum boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than that required in the RCS for minimum refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. Actions shall also be initiated immediately, and continued, to restore one RHR loop to operation. Since the plant is in Conditions A and B concurrently, the restoration of two OPERABLE RHR loops and one operating RHR loop should be accomplished expeditiously.
B.3 If no RHR loop is in operation, all containment penetrations providing direct access from the containment atmosphere to the outside atmosphere must be closed within 4 hours. With the RHR loop requirements not met, the potential exists for the coolant to boil and release radioactive gas to the containment atmosphere. Closing containment penetrations that are open to the outside atmosphere ensures that dose limits are not exceeded.
The Completion Time of 4 hours is reasonable, based on the low probability of the coolant boiling in that time.
R.E. Ginna Nuclear Power Plant                B 3.9.5-3                                    Revision 76
 
RHR and Coolant Circulation - Water Level < 23 Ft B 3.9.5 SURVEILLANCE          SR 3.9.5.1 REQUIREMENTS This SR requires verification that one RHR loop is in operation and circulating reactor coolant. Verification includes flow rate, temperature, or pump status monitoring, which help ensure that forced flow is providing decay heat removal capability and mixing of the borated coolant to prevent thermal and boron stratification in the core. The Surveillance Frequency is controlled under the Surveillance Frequency Program.
SR 3.9.5.2 Verification that a second RHR pump is OPERABLE ensures that an additional pump can be placed in operation, if needed, to maintain decay heat removal and reactor coolant circulation. Verification is performed by verifying proper breaker alignment and power available to the standby pump. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.9.5.3 RHR System piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the RHR loops and may also prevent water hammer, pump cavitation, and pumping of noncondensible gas into the reactor vessel.
Selection of RHR System locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.
The RHR System is OPERABLE when it is sufficiently filled with water.
Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criteria for gas volume at the suction or discharge of a pump),
the Surveillance is not met. If it is determined by subsequent evaluation that the RHR System is not rendered inoperable by the accumulated gas R.E. Ginna Nuclear Power Plant                    B 3.9.5-4                                  Revision 77
 
RHR and Coolant Circulation - Water Level < 23 Ft B 3.9.5 (i.e., the system is sufficiently filled with water), the Surveillance may be declared met. Accumulated gas should be eliminated or brought within the acceptance criteria limits.
RHR System locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative sub-set of susceptible locations. Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation.
REFERENCES            1.      UFSAR, Section 5.4.5.
: 2.      UFSAR, Section 15.4.4.
R.E. Ginna Nuclear Power Plant                    B 3.9.5-5                                    Revision 77
 
Refueling Cavity Water Level B 3.9.6 B 3.9    REFUELING OPERATIONS B 3.9.6      Refueling Cavity Water Level BASES BACKGROUND            The movement of irradiated fuel assemblies within containment or performance of CORE ALTERATIONS, except during latching and unlatching of control rod drive shafts, requires a minimum water level of 23 ft above the top of the reactor vessel flange. This requirement ensures a sufficient level of water is maintained in the refueling cavity or portions hydraulically connected (e.g., refueling canal) to retain iodine fission product activity resulting from a fuel handling accident in containment (Ref. 1). The retention of iodine activity by the water limits the offsite dose from the accident well within the values specified in 10 CFR 50.67 (Ref. 2).
APPLICABLE            During CORE ALTERATIONS and movement of irradiated fuel SAFETY                assemblies, the water level in the refueling cavity is an initial condition ANALYSES              design parameter in the analysis of a fuel handling accident in containment (Ref. 1). A minimum water level of 23 ft allows an overall decontamination factor of 200 to be used in the accident analysis for iodine (Ref. 3). This relates to the assumption that 99.5% of the total iodine released from the pellet to cladding gap of all the dropped fuel assembly rods is retained by the refueling cavity water. The fuel pellet to cladding gap is assumed to contain 10% to 16% of the total fuel rod iodine inventory (Ref. 1).
With a minimum water level of 23 ft and a minimum decay time of 72 hours prior to fuel handling, the analysis and test programs demonstrate that the iodine release due to a postulated fuel handling accident is adequately captured by the water and offsite doses are maintained within allowable limits (Ref. 2).
Refueling cavity water level satisfies Criterion 2 of the NRC Policy Statement.
R.E. Ginna Nuclear Power Plant                    B 3.9.6-1                                    Revision 59
 
Refueling Cavity Water Level B 3.9.6 LCO                  A minimum refueling cavity water level of 23 ft above the reactor vessel flange is required to ensure the radiological consequences of a postulated fuel handling accident inside containment are within acceptable limits and preserves the assumptions of the fuel handling accident analysis (Ref. 1). As such, it is the minimum required level during movement of fuel assemblies within containment. Maintaining this minimum water level in the refueling cavity also ensures that  23 ft of water is available in the spent fuel pool during fuel movement assuming that containment and Auxiliary Building atmospheric pressures are equal.
APPLICABILITY        This LCO is applicable when moving irradiated fuel assemblies within containment. This LCO is also applicable during CORE ALTERATIONS, except during latching and unlatching of control rod drive shafts. The LCO ensures a sufficient level of water is present in therefueling cavity to minimize the radiological consequences of a fuel handling accident in containment. Requirements for fuel handling accidents in the spent fuel pool are covered by LCO 3.7.11, "Spent Fuel Pool (SFP) Water Level."
ACTIONS              A.1 and A.2 When the initial condition assumed in the fuel handling accident cannot be met, steps should be taken to preclude the accident from occurring.
With a water level of < 23 ft above the top of the reactor vessel flange, all operations involving CORE ALTERATIONS or movement of irradiated fuel assemblies within the containment shall be suspended immediately to ensure that a fuel handling accident cannot occur.
The suspension of CORE ALTERATIONS and fuel movement shall not preclude completion of movement of a component to a safe position.
SURVEILLANCE          SR 3.9.6.1 REQUIREMENTS Verification of a minimum refueling cavity water level of 23 ft above the top of the reactor vessel flange ensures that the design basis for the analysis of the postulated fuel handling accident during refueling operations is met. Water at the required level above the top of the reactor vessel flange limits the consequences of damaged fuel rods that are postulated to result from a fuel handling accident inside containment (Ref. 1).
R.E. Ginna Nuclear Power Plant                B 3.9.6-2                                  Revision 78
 
Refueling Cavity Water Level B 3.9.6 The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES            1. UFSAR, Section 15.7.3.
: 2. 10 CFR 50.67.
: 3. Regulatory Guide 1.183.
R.E. Ginna Nuclear Power Plant              B 3.9.6-3                                Revision 77}}

Latest revision as of 02:16, 5 January 2025

0 to Technical Specification Bases
ML19150A511
Person / Time
Site: Ginna Constellation icon.png
Issue date: 05/10/2019
From:
Exelon Generation Co
To:
Office of Nuclear Reactor Regulation
Shared Package
ML19150A453 List: ... further results
References
Download: ML19150A511 (615)
v • d • e


Text

Retrieved from "https://kanterella.com/w/index.php?title=ML19150A511&oldid=4928517"