Text

Part 2 of 10, North Anna Power Station, Units 1 & 2, Proposed Imposed Technical Specifications Comments on Draft Safety Evaluation, Certified Improved Technical Specifications (ITS) & Bases & Proposed License Conditions, Bases
	ML020700282
Person / Time
Site:	North Anna
Issue date:	02/22/2002
From:	Hartz L; Virginia Electric & Power Co (VEPCO)
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	02-053, CM/RAB R0, TAC MB0799, TAC MB0800
	Download: ML020700282 (166)
	v • d • e

SW System B 3.7.8 BASES BACKGROUND (continued) pressure signal the accident unit's Component Cooling (CC) heat exchangers are isolated from the SW System and its RS heat exchangers are placed into service. All safety-related systems or components requiring cooling during an accident are cooled by the SW System, including the RS heat exchangers, main control room air conditioning condensers, and charging pump lubricating oil and gearbox coolers.

The SW System also provides cooling to the instrument air compressors, which are not safety-related, and the non-accident unit's CC heat exchangers, and serves as a backup water supply to the Auxiliary Feedwater System, the spent fuel pool coolers, and the containment recirculation air cooling coils. The SW System has sufficient redundancy to withstand a single failure, including the failure of an emergency diesel generator on the affected unit.

Additional information about the design and operation of the SW System, along with a list of the components served, is presented in the UFSAR, Section 9.2.1 (Ref.

1). The principal safety related function of the SW System is the removal of decay heat from the reactor following a DBA via the RS System.

APPLICABLE SAFETY ANALYSES The design basis of the SW System is for one SW loop, in conjunction with the RS System, to remove core decay heat following a design basis LOCA as discussed in the UFSAR, Section 6.2.2 (Ref. 2). This prevents the containment sump fluid from increasing in temperature, once the cooler RWST water has reached equilibrium with the fluid in containment, during the recirculation phase following a LOCA and provides for a gradual reduction in the temperature of this fluid which is supplied to the Reactor Coolant System by the ECCS pumps. The SW System also prevents the buildup of containment pressure from exceeding the containment design pressure by removing heat through the RS System heat exchangers. The SW System is designed to perform its function with a single failure of any active component, assuming the loss of offsite power.

The SW System, in conjunction with the CC System, also cools the unit from residual heat removal (RHR),

as discussed in the UFSAR, Section 5.5.4, (Ref. 3) entry conditions to MODE 5 during normal and post accident operations. The time required for this evolution is a function of the number of CC and RHR System trains that are operating.

(continued)

North Anna Units 1 and 2 B 3.7.8-2 Revision 0, 04/02/02

SW System B 3.7.8 B 3.7 PLANT SYSTEMS B 3.7.8 Service Water (SW)

System BASES BACKGROUND The SW System provides a heat sink for the removal of process and operating heat from safety related components during a Design Basis Accident (DBA) or transient. During normal operation, and a normal shutdown, the SW System also provides this function for various safety related and nonsafety related components. The safety related function is covered by this LCO.

The SW System is common to Units 1 and 2 and is designed for the simultaneous operation of various subsystems and components of both units. The source of cooling water for the SW System is the Service Water Reservoir. The SW System consists of two loops and components can be aligned to operate on either loop. There are four main SW pumps taking suction on the Service Water Reservoir, supplying various components through the supply headers, and then returning to the Service Water Reservoir through the return headers.

Eight spray arrays are available to provide cooling to the service water, as well as two winter bypass lines. The isolation valves on the spray array lines automatically open, and the isolation valves on the winter bypass lines automatically shut, following receipt of a Safety Injection signal. The main SW pumps are powered from the four emergency buses (two from each unit). There are also two auxiliary SW pumps which take suction on North Anna Reservoir and discharge to the supply header. When the auxiliary SW pumps are in service, the return header may be redirected to waste heat treatment facility if desired. However, the auxiliary SW pumps are strictly a backup to the normal arrangement and are not credited in the analysis for a DBA.

During a design basis loss of coolant accident (LOCA) concurrent with a loss of offsite power to both units, one SW loop will provide sufficient cooling to supply post-LOCA loads on one unit and shutdown and cooldown loads on the other unit. During a DBA, the two SW loops are cross-connected at the recirculation spray (RS) heat exchanger supply and return headers of the accident unit. On a Safety Injection (SI) signal on either unit, all four main SW pumps start and the system is aligned for Service Water Reservoir spray operation. On a containment high-high (continued)

North Anna Units 1 and 2 B 3.7.8-1 Revision 0, 04/02/02

Intentionally Blank

Secondary Specific Activity B 3.7.7 BASES APPLICABILITY In MODES 1, 2, 3,

and 4, the limits on secondary specific activity apply due to the potential for secondary steam releases to the atmosphere.

In MODES 5 and 6, the steam generators are not being used for heat removal.

Both the RCS and steam generators are depressurized, and primary to secondary LEAKAGE is minimal.

Therefore, monitoring of secondary specific activity is not required.

ACTIONS A.1 and A.2 DOSE EQUIVALENT 1-131 exceeding the allowable value in the secondary coolant, is an indication of a problem in the RCS and contributes to increased post accident doses. If the secondary specific activity cannot be restored to within limits within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.7.1 REQUIREMENTS This SR verifies that the secondary specific activity is within the limits of the accident analysis. A gamma isotopic analysis of the secondary coolant, which determines DOSE EQUIVALENT 1-131, confirms the validity of the safety analysis assumptions as to the source terms in post accident releases. It also serves to identify and trend any unusual isotopic concentrations that might indicate changes in reactor coolant activity or LEAKAGE.

The 31 day Frequency is based on the detection of increasing trends of the level of DOSE EQUIVALENT 1-131, and allows for appropriate action to be taken to maintain levels below the LCO limit.

REFERENCES

1. 10 CFR 100.11.

2.

UFSAR, Chapter 15.

North Anna Units 1 and 2 B 3.7.7-3 Revision 0, 04/02/02

Secondary Specific Activity B 3.7.7 BASES APPLICABLE for determining the radiological consequences of the SAFETY ANALYSES postulated accident. The accident analysis, based on this (continued) and other assumptions, shows that the radiological consequences of an MSLB do not exceed a small fraction of the unit EAB limits (Ref.

1) for whole body and thyroid dose rates.

With the loss of offsite power, the remaining steam generators are available for core decay heat dissipation by venting steam to the atmosphere through the MSSVs and steam generator power operated relief valves (SG PORVs).

The Auxiliary Feedwater System supplies the necessary makeup to the steam generators. Venting continues until the reactor coolant temperature and pressure have decreased sufficiently for the Residual Heat Removal System to complete the cooldown.

In the evaluation of the radiological consequences of this accident, the activity released from the steam generator connected to the failed steam line is assumed to be released directly to the environment. The unaffected steam generator is assumed to discharge steam and any entrained activity through the MSSVs and SG PORV during the event. Since no credit is taken in the analysis for activity plateout or retention, the resultant radiological consequences represent a conservative estimate of the potential integrated dose due to the postulated steam line failure.

Secondary specific activity limits satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).

LCO As indicated in the Applicable Safety Analyses, the specific activity of the secondary coolant is required to be

0.10 gCi/gm DOSE EQUIVALENT 1-131 to limit the radiological consequences of a Design Basis Accident (DBA) to a small fraction of the required limit (Ref.

1).

Monitoring the specific activity of the secondary coolant ensures that when secondary specific activity limits are exceeded, appropriate actions are taken in a timely manner to place the unit in an operational MODE that would minimize the radiological consequences of a DBA.

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.7.7-2

Secondary Specific Activity B 3.7.7 B 3.7 PLANT SYSTEMS B 3.7.7 Secondary Specific Activity BASES BACKGROUND Activity in the secondary coolant results from steam generator tube outleakage from the Reactor Coolant System (RCS).

Under steady state conditions, the activity is primarily iodines with relatively short half lives and, thus, indicates current conditions. During transients, 1-131 spikes have been observed as well as increased releases of some noble gases. Other fission product isotopes, as well as activated corrosion products in lesser amounts, may also be found in the secondary coolant.

A limit on secondary coolant specific activity during power operation minimizes releases to the environment because of normal operation, anticipated operational occurrences, and accidents.

This limit is lower than the activity value that might be expected from a 1 gpm tube leak (LCO 3.4.13, "RCS Operational LEAKAGE")

of primary coolant at the limit of 1.0 gCi/gm (LCO 3.4.16, "RCS Specific Activity").

The steam line failure is assumed to result in the release of the noble gas and iodine activity contained in the steam generator inventory, the feedwater, and the reactor coolant LEAKAGE.

Most of the iodine isotopes have short half lives, (i.e.,

< 20 hours2.314815e-4 days 0.00556 hours 3.306878e-5 weeks 7.61e-6 months ).

With the specified activity limit, the resultant 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months thyroid dose to a person at the exclusion area boundary (EAB) would be about 0.58 rem if the main steam safety valves (MSSVs) open for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months following a trip from full power.

Operating a unit at the allowable limits could result in a 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months EAB exposure of a small fraction of the 10 CFR 100 (Ref. 1) limits, or the limits established as the NRC staff approved licensing basis.

APPLICABLE The accident analysis of the main steam line break (MSLB),

as SAFETY ANALYSES discussed in the UFSAR, Chapter 15 (Ref. 2) assumes the initial secondary coolant specific activity to have a radioactive isotope concentration of 0.10 ýtCi/gm DOSE EQUIVALENT 1-131. This assumption is used in the analysis (continued)

North Anna Units 1 and 2 B 3.7.7-1 Revision 0, 04/02/02

ECST B 3.7.6 BASES SURVEILLANCE REQUIREMENTS SR 3.7.6.1 This SR verifies that the ECST contains the required volume of cooling water. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is based on operating experience and the need for operator awareness of unit evolutions that may affect the ECST inventory between checks. Also, the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is considered adequate in view of other indications in the control room, including alarms, to alert the operator to abnormal deviations in the ECST level.

REFERENCES

1. UFSAR, Section 9.2.4.

2.

UFSAR, Chapter 6.

3.

UFSAR, Chapter 15.

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.7.6-4

ECST B 3.7.6 BASES LCO conditions within the limit of lO0°F/hour. The basis for (continued) these times is established in the accident analysis.

The OPERABILITY of the ECST is determined by maintaining the tank level at or above the minimum required level to ensure the minimum volume of water.

APPLICABILITY In MODES 1, 2, and 3, and in MODE 4, when steam generator is being relied upon for heat removal, the ECST is required to be OPERABLE.

In MODE 5 or 6, the ECST is not required because the AFW System is not required.

ACTIONS A.1 and A.2 If the ECST is not OPERABLE, the OPERABILITY of the backup supply, the Condensate Storage Tank, should be verified by administrative means within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months and once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter. OPERABILITY of the backup feedwater supply must include verification that the flow paths from the backup water supply to the AFW pumps are OPERABLE, and that the backup supply has the required volume of water available.

The ECST must be restored to OPERABLE status within 7 days, because the backup supply may be performing this function in addition to its normal functions. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is reasonable, based on operating experience, to verify the OPERABILITY of the backup water supply. Additionally, verifying the backup water supply every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is adequate to ensure the backup water supply continues to be available.

The 7 day Completion Time is reasonable, based on an OPERABLE backup water supply being available, and the low probability of an event occurring during this time period requiring the ECST.

B.1 and B.2 If the ECST cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 4, without reliance on the steam generator for heat

removal, within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

North Anna Units 1 and 2 B 3.7.6-3 Revision 0, 04/02/02

ECST B 3.7.6 BASES APPLICABLE The limiting event for the condensate volume is the large SAFETY ANALYSES feedwater line break coincident with a loss of offsite (continued) power. Single failures accommodated by the accident include the following:

a. Failure of the diesel generator powering the motor driven AFW pump to one unaffected steam generator (requiring additional steam to drive the remaining AFW pump turbine); and

b. Failure of the steam driven AFW pump (requiring a longer time for cooldown using only one motor driven AFW pump).

These are not usually the limiting failures in terms of consequences for these events.

A nonlimiting event considered in ECST inventory determinations is a break in either the main feedwater or AFW line near where the two join. This break has the potential for dumping condensate until terminated by operator action, since the Engineered Safety Features Actuation System (LCO 3.3.2, ESFAS) starts the AFW system and would not detect a difference in pressure between the steam generators for this break location. This loss of condensate inventory is partially compensated for by the retention of steam generator inventory.

The ECST satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO To satisfy accident analysis assumptions, the ECST must contain sufficient cooling water to remove decay heat for 30 minutes following a reactor trip from 102% RTP, and then to cool down the RCS to RHR entry conditions, assuming a coincident loss of offsite power and the most adverse single failure. In doing this, it must retain sufficient water to ensure adequate net positive suction head for the AFW pumps during cooldown, as well as account for any losses from the steam driven AFW pump turbine, or before isolating AFW to a broken line.

The ECST level required is equivalent to a contained volume of Ž 110,000 gallons, which is based on holding the unit in MODE 3 for 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , or maintaining the unit in MODE 3 for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months followed by a 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months cooldown to RHR entry (continued)

North Anna Units 1 and 2 B 3.7.6-2 Revision 0, 04/02/02

ECST B 3.7.6 B 3.7 PLANT SYSTEMS B 3.7.6 Emergency Condensate Storage Tank (ECST)

BASES BACKGROUND APPLICABLE SAFETY ANALYSES The ECST provides a safety grade source of water to the steam generators for removing decay and sensible heat from the Reactor Coolant System (RCS).

The ECST provides a passive flow of water, by gravity, to the Auxiliary Feedwater (AFW)

System (LCO 3.7.5). The steam produced is released to the atmosphere by the main steam safety valves (MSSVs) or the steam generator power operated relief valves (SG PORVs).

The AFW pumps operate with a continuous recirculation to the ECST.

When the main steam trip valves are open, the preferred means of heat removal is to discharge steam to the condenser by the nonsafety grade path of the steam dump valves. The condensed steam is returned to the hotwell and is pumped to the 300,000 gallon condensate storage tank which can be aligned to gravity feed the ECST. This has the advantage of conserving condensate while minimizing releases to the environment.

Because the ECST is a principal component in removing residual heat from the RCS, it is designed to withstand earthquakes and other natural phenomena, including missiles that might be generated by natural phenomena.

The ECST is designed to Seismic Category I to ensure availability of the feedwater supply. Feedwater is also available from alternate sources.

A description of the ECST is found in the UFSAR, Section 9.2.4 (Ref.

1).

The ECST provides cooling water to remove decay heat and to cool down the unit following all events in the accident analysis as discussed in the UFSAR, Chapters 6 and 15 (Refs.

2 and 3, respectively). For anticipated operational occurrences and accidents that do not affect the OPERABILITY of the steam generators, the analysis assumption is 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months in MODE 3, steaming through the MSSVs, followed by a 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months cooldown to residual heat removal (RHR) entry conditions at the design cooldown rate.

(continued)

North Anna Units I and 2 B 3.7.6-1 Revision 0, 04/02/02

Intentionally Blank

AFW System B 3.7.5 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.7.5.4 This SR verifies that the AFW pumps will start in the event of any accident or transient that generates an ESFAS by demonstrating that each AFW pump starts automatically on an actual or simulated actuation signal in MODES 1, 2, and 3.

In MODE 4, the required pump's autostart function is not required. The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

This SR is modified by two Notes. Note 1 indicates that the SR be deferred until suitable test conditions are established. This deferral is required because there may be insufficient steam pressure to perform the test. Note 2 states that the SR is not required in MODE 4. In MODE 4, the heat removal requirements would be less providing more time for operator action to manually start the required AFW pump.

SR 3.7.5.5 This SR verifies that the AFW is properly aligned by verifying the flow paths from the ECST to each steam generator prior to entering MODE 3 after more than 30 contiguous days in any combination of MODES 5, 6, or defueled. OPERABILITY of AFW flow paths must be verified before sufficient core heat is generated that would require the operation of the AFW System during a subsequent shutdown. The Frequency is reasonable, based on engineering judgement and other administrative controls that ensure that flow paths remain OPERABLE.

To further ensure AFW System alignment, flow path OPERABILITY is verified following extended outages to determine no misalignment of valves has occurred. This SR ensures that the flow path from the ECST to the steam generators is properly aligned.

REFERENCES

1. UFSAR, Section 10.4.3.2.

2.

ASME Code for Operation and Maintenance of Nuclear Power Plants.

North Anna Units 1 and 2 B 3.7.5-9 Revision 0, 04/02/02

AFW System B 3.7.5 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.7.5.2 Verifying that each AFW pump's developed head at the flow test point is greater than or equal to the required developed head ensures that AFW pump performance has not degraded during the cycle. Flow and differential head are normal tests of centrifugal pump performance required by the ASME Code (Ref 2). Because it is sometimes undesirable to introduce cold AFW into the steam generators while they are operating, this testing is typically performed on recirculation flow. This test confirms one point on the pump design curve and is indicative of overall performance. Such inservice tests confirm component OPERABILITY, trend performance, and detect incipient failures by indicating abnormal performance. Performance of inservice testing discussed in the ASME Code (Ref. 2) (only required at 3 month intervals) satisfies this requirement.

This SR is modified by a Note indicating that the SR should be deferred until suitable test conditions are established.

This deferral is required because there may be insufficient steam pressure to perform the test.

SR 3.7.5.3 This SR verifies that AFW can be delivered to the appropriate steam generator in the event of any accident or transient that generates an ESFAS, by demonstrating that each automatic valve in the flow path actuates to its correct position on an actual or simulated actuation signal. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. The 18 month Frequency is acceptable based on operating experience and the design reliability of the equipment.

This SR is modified by a Note that states the SR is not required in MODE 4. In MODE 4, the heat removal requirements would be less providing more time for operator action to manually align the required valves.

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.7.5-8

AFW System B 3.7.5 BASES ACTIONS D.1 (continued) perturbed by any action, including a power change, that might result in a trip. The seriousness of this condition requires that action be started immediately to restore one AFW train to OPERABLE status.

Required Action D.1 is modified by a Note indicating that all required MODE changes or power reductions required by the Technical Specifications are suspended until one AFW train is restored to OPERABLE status. In this case, LCO 3.0.3 is not applicable because it could force the unit into a less safe condition.

E.1 In MODE 4, either the reactor coolant pumps or the RHR loops can be used to provide forced circulation. This is addressed in LCO 3.4.6, "RCS Loops-MODE 4." With the required AFW train inoperable, action must be taken to immediately restore the inoperable train to OPERABLE status. The immediate Completion Time is consistent with LCO 3.4.6.

SURVEILLANCE SR 3.7.5.1 REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves in the AFW System water and steam supply flow paths provides assurance that the proper flow paths will exist for AFW operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since they are verified to be in the correct position prior to locking, sealing, or securing. This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves. This Surveillance does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position.

The 31 day Frequency is based on engineering judgment, is consistent with the procedural controls governing valve operation, and ensures correct valve positions.

North Anna Units 1 and 2 B 3.7.5-7 Revision 0, 04/02/02

AFW System B 3.7.5 BASES ACTIONS B.1 (continued) capabilities afforded by the AFW System, time needed for repairs, and the low probability of a DBA occurring during this time period.

The second Completion Time for Required Action B.1 establishes a limit on the maximum time allowed for any combination of Conditions to be inoperable during any contiguous failure to meet this LCO.

The 10 day Completion Time provides a limitation time allowed in this specified Condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which Conditions A and B are entered concurrently. The AND connector between 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months and 10 days dictates that both Completion Times apply simultaneously, and the more restrictive must be met.

C.1 and C.2 When Required Action A.1 or B.1 cannot be completed within the required Completion Time, or if two AFW trains are inoperable in MODE 1, 2, or 3, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 4 within 18 hours2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

In MODE 4, when the steam generator is relied upon for heat

removal, with two AFW trains inoperable, operation is allowed to continue because only one motor driven pump AFW train is required in accordance with the Note that modifies the LCO. Although not required, the unit may continue to cool down and initiate RHR.

D.1 If all three AFW trains are inoperable in MODE 1, 2, or 3, the unit is in a seriously degraded condition with no safety related means for conducting a cooldown, and only limited means for conducting a cooldown with nonsafety related equipment. In such a condition, the unit should not be (continued)

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.7.5-6

AFW System B 3.7.5 BASES ACTIONS A.1 (continued)

b. For the inoperability of a turbine driven AFW pump while in MODE 3 immediately subsequent to a refueling outage, the 7 day Completion Time is reasonable due to the minimal decay heat levels in this situation.

c. For both the inoperability of a steam supply line to the turbine driven pump and an inoperable turbine driven AFW pump while in MODE 3 immediately following a refueling outage, the 7 day Completion Time is reasonable due to the availability of redundant OPERABLE motor driven AFW pumps; and due to the low probability of an event requiring the use of the turbine driven AFW pump.

The second Completion Time for Required Action A.1 establishes a limit on the maximum time allowed for any combination of Conditions during any contiguous failure to meet this LCO.

The 10 day Completion Time provides a limitation time allowed in this specified Condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which Conditions A and B are entered concurrently. The AND connector between 7 days and 10 days dictates that both Completion Times apply simultaneously, and the more restrictive must be met.

Condition A is modified by a Note which limits the applicability of the Conditions to when the unit has not entered MODE 2 following a refueling. Condition A allows the turbine driven AFW train to be inoperable for 7 days vice the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time in Condition B. This longer Completion Time is based on the reduced decay heat following refueling and prior to the reactor being critical.

B.1 With one of the required AFW trains (pump or flow path) inoperable in MODE 1, 2, or 3 for reasons other than Condition A, action must be taken to restore OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This Condition includes the loss of two steam supply lines to the turbine driven AFW pump.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is reasonable, based on redundant (continued)

North Anna Units 1 and 2 B 3.7.5-5 Revision 0, 04/02/02

AFW System B 3.7.5 BASES LCO (continued)

APPLICABILITY ACTIONS steam supplies from each of two main steam supply paths through MS-TV-1I1A and MS-TV-111B (Unit 1), MS-TV-211A and MS-TV-211B (Unit 2), which receive steam from the three main steam lines upstream of the MSTVs.

The piping, valves, instrumentation, and controls in the required flow paths also are required to be OPERABLE.

The LCO is modified by a Note indicating that one AFW train, which includes a motor driven pump, is required to be OPERABLE in MODE 4 when the steam generator is relied upon for heat removal. This is because of the reduced heat removal requirements and short period of time in MODE 4 during which the AFW is required and the insufficient steam available in MODE 4 to power the turbine driven AFW pump.

In MODES 1, 2, and 3, the AFW System is required to be OPERABLE in the event that it is called upon to function when the MFW is lost. In addition, the AFW System is required to supply enough makeup water to replace the steam generator secondary inventory, lost as the unit cools to MODE 4 conditions.

In MODE 4 one AFW train is required to be OPERABLE when the steam generator(s) is relied upon for heat removal.

In MODE 5 or 6, the steam generators are not normally used for heat removal, and the AFW System is not required.

A.1 If one of the two steam supplies, MS-TV-111A and MS-TV-111B (Unit 1), MS-TV-211A and MS-TV-211B (Unit 2), to the turbine driven AFW train is inoperable or if a turbine driven AFW pump is inoperable while in MODE 3 immediately following refueling, action must be taken to restore the affected equipment to an OPERABLE status within 7 days. The 7 day Completion Time is reasonable, based on the following reasons:

a. For the inoperability of a steam supply to the turbine driven AFW pump, the 7 day Completion Time is reasonable since there is a redundant steam supply line for the turbine driven pump.

(continued)

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.7.5-4

AFW System B 3.7.5 BASES APPLICABLE In addition, the minimum available AFW flow and system SAFETY ANALYSES characteristics are considerations in the analysis of a (continued) small break loss of coolant accident (LOCA).

The AFW System design is such that it can perform its function following an FWLB between the MFW isolation valves and containment, combined with a loss of offsite power following turbine trip, and a single active failure of the steam turbine driven AFW pump.

In such a case, the ESFAS logic may not detect the affected steam generator if the backflow check valve to the affected MFW header worked properly. One motor driven AFW pump would deliver to the broken MFW header at maximum design flow until the problem was detected, and flow terminated by the operator.

Sufficient flow would be delivered to the intact steam generator by the redundant AFW pump.

The ESFAS automatically actuates the AFW turbine driven pump when required to ensure an adequate feedwater supply to its dedicated steam generator during loss of power. Air or motor operated valves are provided for each AFW line to control the AFW flow to each steam generator.

The AFW System satisfies the requirements of Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO This LCO provides assurance that the AFW System will perform its design safety function to mitigate the consequences of accidents that could result in overpressurization of the reactor coolant pressure boundary. Three independent AFW pumps in three diverse trains are required to be OPERABLE to ensure the availability of AFW capability for all events accompanied by a loss of offsite power and a single failure.

This is accomplished by powering two of the pumps from independent emergency buses. The third AFW pump is powered by a different means, a steam driven turbine supplied with steam from a source that is not isolated by closure of the MSTVs.

The AFW System is configured into three trains. The AFW System is considered OPERABLE when the components and flow paths required to provide redundant AFW flow to the steam generators are OPERABLE.

This requires that the two motor driven AFW pumps be OPERABLE in two diverse paths, each supplying AFW to separate steam generators. The turbine driven AFW pump is required to be OPERABLE with redundant (continued)

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.7.5-3

AFW System B 3.7.5 BASES BACKGROUND (continued)

The AFW pumps may be aligned and supply a common header capable of feeding all steam generators. One pump at full flow is sufficient to remove decay heat and cool the unit to residual heat removal (RHR) entry conditions. Thus, the requirement for diversity in motive power sources for the AFW System is met.

The AFW System is designed to supply sufficient water to the steam generator(s) to remove decay heat with steam generator pressure associated with the lowest setpoint MSSV.

Subsequently, the AFW System supplies sufficient water to cool the unit to RHR entry conditions, with steam released through the SG PORVs.

The AFW System actuates automatically on Steam Generator Water Level low-low by the ESFAS (LCO 3.3.2). The system also actuates on loss of offsite power, safety injection, and trip of all MFW pumps.

The AFW System is discussed in the UFSAR, Section 10.4.3.2 (Ref.

1).

APPLICABLE SAFETY ANALYSES The AFW System mitigates the consequences of any event with loss of normal feedwater.

The design basis of the AFW System is to supply water to the steam generator to remove decay heat and other residual heat by delivering at least the minimum required flow rate to the steam generators at pressures corresponding to the lowest steam generator safety valve set pressure plus 3%.

In addition, the AFW System must supply enough makeup water to replace steam generator secondary inventory lost as the unit cools to MODE 4 conditions. Sufficient AFW flow must also be available to account for flow losses such as pump recirculation and line breaks.

The limiting Design Basis Accidents (DBAs) and for the AFW System are as follows:

a. Feedwater Line Break (FWLB);

b.

Main Steam Line Break (MSLB); and

c. Loss of MFW.

transients (continued)

North Anna Units 1 and 2 B 3.7.5-2 Revision 0, 04/02/02

AFW System B 3.7.5 B 3.7 PLANT SYSTEMS B 3.7.5 Auxiliary Feedwater (AFW)

System BASES BACKGROUND The AFW System automatically supplies feedwater to the steam generators to remove decay heat from the Reactor Coolant System upon the loss of normal feedwater supply. The AFW pumps take suction through separate and independent suction lines from the emergency condensate storage tank (ECST)

(LCO 3.7.6) and pump to the steam generator secondary side via separate and independent connections to the main feedwater (MFW) piping outside containment. The steam generators function as a heat sink for core decay heat. The heat load is dissipated by releasing steam to the atmosphere from the steam generators via the main steam safety valves (MSSVs)

(LCO 3.7.1) or steam generator power operated relief valves (SG PORVs)

(LCO 3.7.4).

If the main condenser is available, steam may be released via the steam dump valves and recirculated to the condenser hotwell.

The AFW System consists of two motor driven AFW pumps and one steam turbine driven pump configured into three trains. Each pump is aligned to one steam generator, and the capacity of each pump is sufficient to provide the designated flow assumed in the accident analysis. The pumps are equipped with recirculation lines to prevent pump operation against a closed system. Each motor driven AFW pump is powered from an independent Class 1E power supply and normally feeds one steam generator, although each pump has the capability to be realigned to feed other steam generators. The steam turbine driven AFW pump receives steam from three main steam lines upstream of the main steam trip valves (MSTVs).

The steam supply lines combine into a header which is isolated from the steam driven auxiliary feedwater pump by two parallel valves. Main steam trip valves, MS-TV-1I1A and MS-TV-111B (Unit 1),

MS-TV-211A and MS-TV-211B (Unit 2) are powered from separate 125 V DC trains and actuated by the Engineered Safety Features Actuation System (ESFAS).

Opening of either trip valve will provide sufficient steam to the steam driven pump to produce the design flow rate from the ECST to the steam generator(s).

The AFW System is capable of supplying feedwater to the steam generators during normal unit startup, shutdown, and hot standby conditions.

(continued)

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.7.5-1

SG PORVs B 3.7.4 BASES ACTIONS C.1 and C.2 (continued) experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.4.1 REQUIREMENTS To perform a controlled cooldown of the RCS, the SG PORVs must be able to be opened either remotely or locally and throttled through their full range. This SR ensures that the SG PORVs are tested through a full control cycle at least once per fuel cycle. Performance of inservice testing or use of an SG PORV during a unit cooldown may satisfy this requirement. Operating experience has shown that these components usually pass the Surveillance when performed at the 18 month Frequency. The Frequency is acceptable from a reliability standpoint.

SR 3.7.4.2 The function of the upstream manual isolation valve is to isolate a failed SG PORV. Cycling the upstream manual isolation valve both closed and open demonstrates its capability to perform this function. Performance of inservice testing or use of the upstream manual isolation valve during unit cooldown may satisfy this requirement.

Operating experience has shown that these components usually pass the Surveillance when performed at the 18 month Frequency. The Frequency is acceptable from a reliability standpoint.

REFERENCES

1. UFSAR, Section 10.3.

2.

UFSAR, Section 15.4.3.

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.7.4-4

SG PORVs B 3.7.4 BASES LCO Failure to meet the LCO can result in the inability to cool (continued) the unit to RHR entry conditions following an event in which the condenser is unavailable for use with the Steam Dump System.

An SG PORV is considered OPERABLE when it is capable of providing controlled relief of the main steam flow and capable of fully opening and closing, remotely or by local manual operation on demand.

APPLICABILITY In MODES 1, 2, and 3, and in MODE 4, when a steam generator is being relied upon for heat removal, the SG PORVs are required to be OPERABLE.

In MODE 5 or 6, an SGTR is not a credible event.

A.1 With one required SG PORV line inoperable, action must be taken to restore OPERABLE status within 7 days. The 7 day Completion Time allows for the redundant capability afforded by the remaining OPERABLE SG PORV lines, a nonsafety grade backup in the Steam Dump System, and MSSVs.

B.1 With two or more SG PORV lines inoperable, action must be taken to restore all but one SG PORV line to OPERABLE status.

Since the upstream manual isolation valve can be closed to isolate an SG PORV, some repairs may be possible with the unit at power. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is reasonable to repair inoperable SG PORV lines, based on the availability of the Steam Dump System and MSSVs, and the low probability of an event occurring during this period that would require the SG PORV lines.

C.1 and C.2 If the SG PORV lines cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 4, without reliance upon steam generator for heat removal, within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The allowed Completion Times are reasonable, based on operating (continued)

North Anna Units 1 and 2 ACTIONS B 3.7.4-3 Revision 0, 04/02/02

SG PORVs B 3.7.4 BASES APPLICABLE available). Adequate inventory is available in the ECST to SAFETY ANALYSES support operation for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months in MODE 3 followed by a 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months (continued) cooldown to the RHR entry conditions.

In the SGTR accident analysis presented in Reference 2, the SG PORVs are assumed to be used by the operator to cool down the unit to RHR entry conditions when the SGTR is accompanied by a loss of offsite power, which renders the condenser dump valves unavailable. Prior to operator actions to cool down the unit, the SG PORVs and main steam safety valves (MSSVs) are assumed to operate automatically to relieve steam and maintain the steam generator pressure below the design value. For the recovery from a steam generator tube rupture (SGTR) event, the operator is also required to perform a limited cooldown to establish adequate subcooling as a necessary step to terminate the primary to secondary break flow into the ruptured steam generator. The time required to terminate the primary to secondary break flow for an SGTR is more critical than the time required to cool down to RHR conditions for this event. Thus, the SGTR is the limiting event for the SG PORVs. The requirement for three SG PORVs to be OPERABLE satisfies the SGTR accident analysis requirements, including consideration of a single failure of one SG PORV to open on demand.

The SG PORVs are equipped with manual isolation valves in the event an SG PORV spuriously fails open or fails to close during use.

The SG PORVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO Three SG PORV lines are required to be OPERABLE.

One SG PORV line is required from each of three steam generators to ensure that at least one SG PORV line is available to conduct a unit cooldown following an SGTR, in which one steam generator becomes unavailable, accompanied by a single, active failure of a second SG PORV line on an unaffected steam generator. The manual isolation valves must be OPERABLE to isolate a failed open SG PORV line. A closed manual isolation valve does not render it or its SG PORV line inoperable because operator action time to open the manual isolation valve is supported in the accident analysis.

(continued)

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.7.4-2

SG PORVs B 3.7.4 B 3.7 PLANT SYSTEMS B 3.7.4 Steam Generator Power Operated Relief Valves (SG PORVs)

BASES BACKGROUND The SG PORVs provide a method for cooling the unit to residual heat removal (RHR) entry conditions should the preferred heat sink via the condenser dump valves not be available, as discussed in the UFSAR, Section 10.3 (Ref. 1).

This is done in conjunction with the Auxiliary Feedwater System providing cooling water from the emergency condensate storage tank (ECST)

(or, alternately, with main feedwater from the condenser hotwell or main condensate tanks, if available).

One SG PORV line for each of the three steam generators is provided. Each SG PORV line consists of one SG PORV and an associated upstream manual isolation valve.

The SG PORVs are provided with upstream manual isolation valves to permit their being tested at power, and to provide an alternate means of isolation. The SG PORVs are equipped with pneumatic controllers to permit control of the cooldown rate.

The SG PORVs are provided with a backup supply tank which is pressurized from the instrument air header via a check valve arrangement that, on a loss of pressure in the normal instrument air supply, automatically supplies air to operate the SG PORVs.

The air supply is sized to provide the sufficient pressurized air to operate the SG PORVs until manual operation of the SG PORVs can be established.

A description of the SG PORVs is found in Reference 1. The SG PORVs are OPERABLE when they are capable of providing controlled relief of the main steam flow and capable of being fully opened and closed, either remotely or by local manual operation.

APPLICABLE The design basis of the SG PORVs is established by the SAFETY ANALYSES capability to cool the unit to RHR entry conditions. The SG PORVs are used in conjunction with auxiliary feedwater supplied from the ECST (or, alternately, with main feedwater from the condenser hotwell or main condensate tanks, if (continued)

North Anna Units I and 2 B 3.7.4-1 Revision 0, 04/02/02

MFIVs, MFPDVs,

MFRVs, and MFRBVs B 3.7.3 BASES SURVEILLANCE SR 3.7.3.1 REQUIREMENTS This SR verifies that the isolation time of each MFIV,

MFRV, and MFRBV is

6.98 seconds and the isolation time for each MFPDV is

60 seconds. The isolation times are assumed in the accident and containment analyses. This Surveillance is normally performed during a refueling outage.

The Frequency for this SR is in accordance with the Inservice Testing Program.

SR 3.7.3.2 This SR verifies that each MFIV,

MFRV, MFRBV, and MFPDV can close on an actual or simulated actuation signal.

This Surveillance is normally performed upon returning the plant to operation following a refueling outage.

The Frequency for this SR is every 18 months. The 18 month Frequency for testing is based on the refueling cycle.

Operating experience has shown that these components usually pass the Surveillance when performed at the 18 month Frequency. Therefore, this Frequency is acceptable from a reliability standpoint.

REFERENCES

1. UFSAR, Section 10.4.7.

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.7.3-6

MFIVs, MFPDVs,

MFRVs, and MFRBVs B 3.7.3 BASES ACTIONS D.1 and D.2 (continued)

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time takes into account the redundancy afforded by the remaining OPERABLE valves and the low probability of an event occurring during this time period that would require isolation of the MFW flow paths.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is reasonable, based on operating experience.

Inoperable MFPDVs that are closed or isolated must be verified on a periodic basis that they are closed or isolated. This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day Completion Time is reasonable, based on engineering judgment, and in view of other administrative controls, to ensure that these valves are closed or isolated.

E.1 With two inoperable valves in the same flow path, there may be no redundant system to operate automatically and perform the required safety function. Under these conditions, the affected valves must be restored to OPERABLE status, or the affected flow path isolated within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . This action returns the system to the condition where at least one valve in each flow path is performing the required safety function. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is reasonable, based on operating experience, to complete the actions required to close the affected valves, or otherwise isolate the affected flow path.

F.1 and F.2 If the inoperable valve(s) cannot be restored to OPERABLE status, or closed, or isolated within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

North Anna Units I and 2 B 3.7.3-5 Revision 0, 04/02/02

MFIVs, MFPDVs,

MFRVs, and MFRBVs B 3.7.3 BASES ACTIONS B.1 and B.2 (continued) period that would require isolation of the MFW flow paths.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is reasonable, based on operating experience.

Inoperable MFRVs, that are closed or isolated, must be verified on a periodic basis that they are closed or isolated. This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day Completion Time is reasonable, based on engineering judgment, in view of other administrative controls to ensure that the valves are closed or isolated.

C.1 and C.2 With one MFRBV in one or more flow paths inoperable, action must be taken to restore the affected valves to OPERABLE status, or to close or isolate inoperable affected valves within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . When these valves are closed or isolated, they are performing their required safety function.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time takes into account the redundancy afforded by the remaining OPERABLE valves and the low probability of an event occurring during this time period that would require isolation of the MFW flow paths.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is reasonable, based on operating experience.

Inoperable MFRBVs that are closed or isolated must be verified on a periodic basis that they are closed or isolated. This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day Completion Time is reasonable, based on engineering judgment, in view of other administrative controls to ensure that these valves are closed or isolated.

D.1 and D.2 With one MFPDV in one or more flow paths inoperable, action must be taken to restore the affected valves to OPERABLE status, or to close or isolate inoperable affected valves within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . When these valves are closed or isolated, they are performing their required safety function.

(continued)

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.7.3-4

MFIVs, MFPDVs,

MFRVs, and MFRBVs B 3.7.3 BASES APPLICABILITY in the case of a secondary system pipe break inside (continued) containment. When the valves are closed and de-activated or isolated by a closed manual valve, they are already performing their safety function.

In MODES 4, 5,

and 6, steam generator energy is low.

Therefore, the MFIVs,

MFPDVs, MFRVs, and MFRBVs are not required to be OPERABLE.

ACTIONS The ACTIONS table is modified by a Note indicating that separate Condition entry is allowed for each valve.

A.1 and A.2 With one MFIV in one or more flow paths inoperable, action must be taken to restore the affected valves to OPERABLE status, or to close or isolate inoperable affected valves within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

When these valves are closed or isolated, they are performing their required safety function.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time takes into account the redundancy afforded by the remaining OPERABLE valves and the low probability of an event occurring during this time period that would require isolation of the MFW flow paths.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is reasonable, based on operating experience.

Inoperable MFIVs that are closed or isolated must be verified on a periodic basis that they are closed or isolated. This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day Completion Time is reasonable, based on engineering judgment, in view of other administrative controls, to ensure that these valves are closed or isolated.

B.1 and B.2 With one MFRV in one or more flow paths inoperable, action must be taken to restore the affected valves to OPERABLE status, or to close or isolate inoperable affected valves within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

When these valves are closed or isolated, they are performing their required safety function.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time takes into account the redundancy afforded by the remaining OPERABLE valves and the low probability of an event occurring during this time (continued)

North Anna Units 1 and 2 B 3.7.3-3 Revision 0, 04/02/02

MFIVs, MFPDVs,

MFRVs, and MFRBVs B 3.7.3 BASES BACKGROUND (continued)

APPLICABLE SAFETY ANALYSES LCO A description of the operation of the MFIVs,

MFPDVs, MFRVs, and MFRBVs is found in the UFSAR, Section 10.4.3 (Ref.

1).

The design basis for the closure of the MFIVs, MFPDVs, MFRVs, and MFRBVs is established by the analyses for the Main Steam Line Break (MSLB).

It is also influenced by the accident analysis for the Feedwater Line Break (FWLB).

Closure of the MFIVs and MFRBVs, or MFRVs and MFRBVs, or the MFPDVs, may also be relied on to terminate an MSLB on receipt of an SI signal for core response analysis and for an excess feedwater event upon the receipt of a Steam Generator Water Level-High High signal.

Failure of an MFIV and MFRV, or an MFRBV and MFPDV to close following an MSLB or FWLB can result in additional mass and energy being delivered to the steam generators, contributing to cooldown. This failure also results in additional mass and energy releases following an MSLB or FWLB event.

The MFIVs,

MFPDVs, MFRVs, and MFRBVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

This LCO ensures that the MFIVs,

MFPDVs, MFRVs, and MFRBVs will isolate MFW flow to the steam generators, following an FWLB or MSLB.

This LCO requires that three MFIVs, three MFPDVs, three

MFRVs, and three MFRBVs be OPERABLE.

The valves are considered OPERABLE when isolation times are within limits and they close on an isolation actuation signal.

Failure to meet the LCO requirements can result in additional mass and energy being released to containment following an MSLB or FWLB inside containment. A feedwater isolation signal on high high steam generator level is relied on to terminate an excess feedwater flow event, and failure to meet the LCO may result in the introduction of water into the main steam lines.

APPLICABILITY The MFIVs,

MFPDVs, MFRVs, and MFRBVs must be OPERABLE whenever there is significant mass and energy in the RCS and steam generators. In MODES 1, 2, and 3, the MFIVs,

MFPDVs, MFRVs, and MFRBVs are required to be OPERABLE to limit the amount of available fluid that could be added to containment (continued)

North Anna Units 1 and 2 B 3.7.3-2 Revision 0, 04/02/02

MFIVs, MFPDVs,

MFRVs, and MFRBVs B 3.7.3 B 3.7 PLANT SYSTEMS B 3.7.3 Main Feedwater Isolation Valves (MFIVs),

Main Feedwater Pump Discharge Valves (MFPDVs),

Main Feedwater Regulating Valves (MFRVs),

and Main Feedwater Regulating Bypass Valves (MFRBVs)

BASES BACKGROUND The MFIV and the MFRV are in series in the Main Feedwater (MFW) line upstream of each steam generator. The MFRBV is parallel to both the MFIV and the MFRV. The MFPDV is located at the discharge of each main feedwater pump. The valves are located outside of the containment. These valves provide the isolation of each MFW line by the closure of the MFIV and MFRBV, the MFRV and MFRBV, or the closure of the MFPDV. To provide the needed isolation given the single failure of one of the valves, all four valve types are required to be OPERABLE.

The safety-related function of the MFIVs,

MFPDVs, MFRVs and the MFRBVs is to provide isolation of MFW from the secondary side of the steam generators following a high energy line break. Closure of the MFIV and MFRBV, the MFRV and MFRBV, or the closure of the MFPDV terminates the addition of feedwater to an affected steam generator, limiting the mass and energy release for steam or feedwater line breaks and minimizing the positive reactivity effects of the Reactor Coolant System (RCS) cooldown associated with the blowdown.

In the event of pipe rupture inside the containment, the valves limit the quantity of high energy fluid that enters the containment through the broken loop.

The containment isolation MFW check valve in each loop provides the first pressure boundary for the addition of Auxiliary Feedwater (AFW) to the intact loops and prevents back flow in the feedwater line should a break occur upstream of these valves. These check valves also isolate the non-safety-related portion of the MFW system from the safety-related portion of the system. The piping volume from the feedwater isolation valve to the steam generators is considered in calculating mass and energy release following either a steam or feedwater line break.

The MFIVs,

MFPDVs, MFRVs, and MFRBVs close on receipt of Safety Injection or Steam Generator Water Level-High High signal. The MFIVs,

MFPDVs, MFRVs, and MFRBVs may also be actuated manually.

(continued)

North Anna Units 1 and 2 B 3.7.3-1 Revision 0, 04/02/02

MSTVs B 3.7.2 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.7.2.2 This SR verifies that each MSTV closes on an actual or simulated actuation signal. This Surveillance is normally performed upon returning the plant to operation following a refueling outage. The Frequency of MSTV testing is every 18 months. The 18 month Frequency for testing is based on the refueling cycle. Operating experience has shown that these components usually pass the Surveillance when performed at the 18 month Frequency. Therefore, this Frequency is acceptable from a reliability standpoint.

REFERENCES

1. UFSAR, Section 10.3.

2.

UFSAR, Section 6.2.

3. UFSAR, Section 15.4.2.

4.

10 CFR 100.11.

5.

ASME Code for Operation and Maintenance of Nuclear Power Plants.

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.7.2-6

MSTVs B 3.7.2 BASES ACTIONS C.1 and C.2 (continued)

For inoperable MSTVs that cannot be restored to OPERABLE status within the specified Completion Time, but are closed, the inoperable MSTVs must be verified on a periodic basis to be closed. This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day Completion Time is reasonable, based on engineering judgment, in view of MSTV status indications available in the control room, and other administrative controls, to ensure that these valves are in the closed position.

D.1 and D.2 If the MSTVs cannot be restored to OPERABLE status or are not closed within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed at least in MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from MODE 2 conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.2.1 REQUIREMENTS This SR verifies that MSTV isolation time is

5.0 seconds.

The MSTV isolation time is assumed in the accident and containment analyses. This Surveillance is normally performed upon returning the unit to operation following a refueling outage. The MSTVs should not be tested at power, since even a part stroke exercise increases the risk of a valve closure when the unit is generating power. As the MSTVs are not tested at power, they are exempt from the ASME Code (Ref.

5) requirements during operation in MODE 1 or 2.

The Frequency is in accordance with the Inservice Testing Program.

This test may be conducted in MODE 3 with the unit at operating temperature and pressure. This SR is modified by a Note that allows entry into and operation in MODE 3 prior to performing the SR. This allows a delay of testing until MODE 3, to establish conditions consistent with those under which the acceptance criterion was generated.

North Anna Units 1 and 2 B 3.7.2-5 Revision 0, 04/02/02

MSTVs B 3.7.2 BASES APPLICABILITY In MODE 5 or 6, the steam generators do not contain much (continued) energy because their temperature is below the boiling point of water; therefore, the MSTVs are not required for isolation of potential high energy secondary system pipe breaks in these MODES.

ACTIONS A.1 With one MSTV inoperable in MODE 1, action must be taken to restore OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . Some repairs to the MSTV can be made with the unit hot. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is reasonable, considering the low probability of an accident occurring during this time period that would require a closure of the MSTVs.

The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is greater than that normally allowed for containment isolation valves because the MSTVs are valves that isolate a closed system penetrating containment. These valves differ from other containment isolation valves in that the closed system provides an additional means for containment isolation.

B.1 If the MSTV cannot be restored to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in MODE 2 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and Condition C would be entered. The Completion Times are reasonable, based on operating experience, to reach MODE 2 and to close the MSTVs in an orderly manner and without challenging unit systems.

C.1 and C.2 Condition C is modified by a Note indicating that separate Condition entry is allowed for each MSTV.

Since the MSTVs are required to be OPERABLE in MODES 2 and 3, the inoperable MSTVs may either be restored to OPERABLE status or closed. When closed, the MSTVs are already in the position required by the assumptions in the safety analysis.

The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is consistent with that allowed in Condition A.

(continued)

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.7.2-4

MSTVs B 3.7.2 BASES APPLICABLE SAFETY ANALYSES (continued)

b. A break outside of containment and upstream from the MSTV is not a containment pressurization concern.

The uncontrolled blowdown of more than one steam generator must be prevented to limit the potential for uncontrolled RCS cooldown and positive reactivity addition. Closure of the MSTVs isolates the break and limits the blowdown to a single steam generator.

c. A break downstream of the MSTVs will be isolated by the closure of the MSTVs.

d. Following a steam generator tube rupture, closure of the MSTVs isolates the ruptured steam generator from the intact steam generators to minimize radiological releases.

e. The MSTVs are also utilized during other events such as a feedwater line break. This event is less limiting so far as MSTV OPERABILITY is concerned.

The MSTVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO This LCO requires that three MSTVs in the steam lines be OPERABLE.

The MSTVs are considered OPERABLE when the isolation times are within limits, and they close on an isolation actuation signal.

This LCO provides assurance that the MSTVs will perform their design safety function to mitigate the consequences of accidents that could result in offsite exposures comparable to the 10 CFR 100 (Ref.

4) limits or the NRC staff approved licensing basis.

APPLICABILITY The MSTVs must be OPERABLE in MODE 1, and in MODES 2 and 3 except when closed and de-activated, when there is significant mass and energy in the RCS and steam generators.

When the MSTVs are closed, they are already performing the safety function.

In MODE 4, the steam generator energy is low and the MSTVs are not required to support the safety analyses due to the low probability of a design basis accident.

(continued)

North Anna Units 1 and 2 B 3.7.2-3 Revision 0, 04/02/02

MSTVs B 3.7.2 BASES APPLICABLE The limiting case for the containment analysis is the MSLB SAFETY ANALYSES inside containment, with a loss of offsite power following (continued) turbine trip, and failure of the Non Return Valve (NRV) on the affected steam generator to close. At lower powers, the steam generator inventory and temperature are at their maximum, maximizing the analyzed mass and energy release to the containment. Due to reverse flow and failure of the NRV to close, the additional mass and energy in the steam headers downstream from the other MSTVs contribute to the total release. With the most reactive rod cluster control assembly assumed stuck in the fully withdrawn position, there is an increased possibility that the core will become critical and return to power. The core is ultimately shut down by the boric acid injection delivered by the Emergency Core Cooling System.

The accident analysis compares several different MSLB events against different acceptance criteria. The MSLB outside containment upstream of the MSTV is limiting for offsite dose, although a break in this short section of main steam header has a very low probability. The MSLB inside containment at hot zero power is the limiting case for a post trip return to power. The analysis includes scenarios with offsite power available, and with a loss of offsite power following turbine trip. With offsite power available, the reactor coolant pumps continue to circulate coolant through the steam generators, maximizing the Reactor Coolant System cooldown. With a loss of offsite power, the response of mitigating systems is delayed. Significant single failures considered include failure of an MSTV to close.

The MSTVs only serve a safety function and remain open during power operation. These valves operate under the following situations:

a. A HELB inside containment.

In order to maximize the mass and energy release into containment, the analysis assumes that the NRV in the affected steam generator remains open. For this accident scenario, steam is discharged into containment from all steam generators until the remaining MSTVs close. After MSTV closure, steam is discharged into containment only from the affected steam generator and from the residual steam in the main steam header downstream of the closed MSTVs in the unaffected loops. Closure of the MSTVs isolates the break from the unaffected steam generators.

(continued)

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.7.2-2

MSTVs B 3.7.2 B 3.7 PLANT SYSTEMS B 3.7.2 Main Steam Trip Valves (MSTVs)

BASES The MSTVs isolate steam flow steam generators following a MSTV closure terminates flow steam generators.

from high from the secondary side of the energy line break (HELB).

the unaffected (intact)

One MSTV is located in each main steam line outside, but close to, containment. The MSTVs are downstream from the main steam safety valves (MSSVs) and auxiliary feedwater (AFW) pump turbine steam supply, to prevent MSSV and AFW isolation from the steam generators by MSTV closure. Closing the MSTVs isolates each steam generator from the others, and isolates the turbine, Steam Dump System, and other auxiliary steam supplies from the steam generators.

The MSTVs close on a main steam isolation signal generated by either intermediate high high containment pressure, high steam flow coincident with low low RCS Tavg, or low steam line pressure. The MSTVs fail closed on loss of control air pressure.

Each MSTV has an MSTV bypass valve. Although these bypass valves are normally closed, they receive the same emergency closure signal as do their associated MSTVs. The MSTV bypass valves may also be actuated manually.

A description of the MSTVs is found in the UFSAR, Section 10.3 (Ref.

1).

APPLICABLE SAFETY ANALYSES The design basis of the MSTVs is established by the containment analysis for the main steam line break (MSLB) inside containment, discussed in the UFSAR, Section 6.2 (Ref.

2).

It is also affected by the accident analysis of the SLB events presented in the UFSAR, Section 15.4.2 (Ref.

3).

The design precludes the blowdown of more than one steam generator, assuming a single active component failure (e.g.,

the failure of one MSTV to close on demand).

(continued)

North Anna Units 1 and 2 BACKGROUND Revision 0, 04/02/02 B 3.7.2-1

Intentionally Blank

MSSVs B 3.7.1 BASES REFERENCES (continued)

6.

NRC Information Notice 94-60, "Potential Overpressurization of the Main Steam System,"

August 22, 1994.

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.7.1-7

MSSVs B 3.7.1 BASES SURVEILLANCE SR 3.7.1.1 (continued)

REQUIREMENTS requires that safety and relief valve tests be performed in accordance with ANSI/ASME OM-1-1987 (Ref.

5).

According to Reference 5, the following tests are required:

a. Visual examination;

b. Seat tightness determination;

c. Setpoint pressure determination (lift setting);

d. Compliance with owner's seat tightness criteria; and

e. Verification of the balancing device integrity on balanced valves.

The ANSI/ASME Standard requires that all valves be tested every 5 years, and a minimum of 20% of the valves be tested every 24 months. The ASME Code specifies the activities and frequencies necessary to satisfy the requirements.

Table 3.7.1-2 allows a +/-3% setpoint tolerance for OPERABILITY; however, the valves are reset to +/-1% during the Surveillance to allow for drift. The lift

settings, according to Table 3.7.1-2, correspond to ambient conditions of the valve at nominal operating temperature and pressure.

This SR is modified by a Note that allows entry into and operation in MODE 3 prior to performing the SR. The MSSVs may be either bench tested or tested in situ at hot conditions using an assist device to simulate lift pressure. If the MSSVs are not tested at hot conditions, the lift setting pressure shall be corrected to ambient conditions of the valve at operating temperature and pressure.

REFERENCES

1. UFSAR, Section 10.3.1.

2.

ASME, Boiler and Pressure Vessel Code,Section III, 1968 Edition with Addenda through Winter 1970.

3.

UFSAR, Section 15.2.

4.

ASME Code for Operation and Maintenance of Nuclear Power Plants.

5. ANSI/ASME OM-1-1987.

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.7.1-6

MSSVs B 3.7.1 BASES ACTIONS B.1 and B.2 (continued)

Action B.2 to reduce the setpoints. The Completion Time of 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months is based on a reasonable time to correct the MSSV inoperability, the time required to perform the power reduction, operating experience in resetting all channels of a protective function, and on the low probability of the occurrence of a transient that could result in steam generator overpressure during this period.

The maximum THERMAL POWER corresponding to the heat removal capacity of the remaining OPERABLE MSSVs is determined via a conservative heat balance calculation as described in the attachment to Reference 6, with an appropriate allowance for Nuclear Instrumentation System trip channel uncertainties.

Required Action B.2 is modified by a Note, indicating that the Power Range Neutron Flux-High reactor trip setpoint reduction is only required in MODE 1. In MODES 2 and 3 the reactor protection system trips specified in LCO 3.3.1, "Reactor Protection System Instrumentation," provide sufficient protection.

The allowed Completion Times are reasonable based on operating experience to accomplish the Required Actions in an orderly manner without challenging unit systems.

C.1 and C.2 If the Required Actions are not completed within the associated Completion Time, or if one or more steam generators have Ž 4 inoperable MSSVs, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.1.1 REQUIREMENTS This SR verifies the OPERABILITY of the MSSVs by the verification of each MSSV lift setpoint in accordance with the Inservice Testing Program. The ASME Code (Ref.

4)

(continued)

North Anna Units 1 and 2 B 3.7.1-5 Revision 0, 04/02/02

MSSVs B 3.7.1 BASES ACTIONS With one or more MSSVs inoperable, action must be taken so (continued) that the available MSSV relieving capacity meets Reference 2 requirements.

Operation with less than all five MSSVs OPERABLE for each steam generator is permissible, if THERMAL POWER is limited to the relief capacity of the remaining MSSVs. This is accomplished by restricting THERMAL POWER so that the energy transfer to the most limiting steam generator is not greater than the available relief capacity in that steam generator.

A.1 In the case of only a single inoperable MSSV on one or more steam generators, when the MTC is not positive, a reactor power reduction alone is sufficient to limit primary side heat generation such that overpressurization of the secondary side is precluded for any RCS heatup event.

Furthermore, for this case there is sufficient total steam flow capacity provided by the turbine and remaining OPERABLE MSSVs to preclude overpressurization in the event of an increased reactor power due to reactivity insertion, such as in the event of an uncontrolled RCCA bank withdrawal at power. Therefore, Required Action A.1 requires an appropriate reduction in reactor power within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

The maximum THERMAL POWER corresponding to the heat removal capacity of the remaining OPERABLE MSSVs is determined via a conservative heat balance calculation as described in the attachment to Reference 6, with an appropriate allowance for calorimetric power uncertainty.

B.1 and B.2 In the case of multiple inoperable MSSVs on one or more steam generators, with a reactor power reduction alone there may be insufficient total steam flow capacity provided by the turbine and remaining OPERABLE MSSVs to preclude overpressurization in the event of an increased reactor power due to reactivity insertion, such as in the event of an uncontrolled RCCA bank withdrawal at power. Furthermore, for a single inoperable MSSV on one or more steam generators when the MTC is positive the reactor power may increase as a result of an RCS heatup event such that flow capacity of the remaining OPERABLE MSSVs is insufficient. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time for Required Action B.1 is consistent with A.1. An additional 32 hours3.703704e-4 days 0.00889 hours 5.291005e-5 weeks 1.2176e-5 months is allowed in Required (continued)

North Anna Units 1 and 2 B 3.7.1-4 Revision 0, 04/02/02

MSSVs B 3.7.1 BA SES APPLICABLE SAFETY ANALYSES (continued)

LCO MSSVs.

Thus, for multiple inoperable MSSVs on the same steam generator it is necessary to prevent this power increase by lowering the Power Range Neutron Flux-High setpoint to an appropriate value. When Moderator Temperature Coefficient (MTC) is positive, the reactor power may increase above the initial value during an RCS heatup event (e.g., turbine trip). Thus, for any number of inoperable MSSVs it is necessary to reduce the trip setpoint if a positive MTC may exist at partial power conditions.

The MSSVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

The accident analysis requires five MSSVs per steam generator be OPERABLE to provide overpressure protection design basis transients occurring at 102% RTP.

The LCO requires that five MSSVs per steam generator be OPERABLE compliance with Reference 2, and the DBA analysis.

for in The OPERABILITY of the MSSVs is defined as the ability to open upon demand within the setpoint tolerances to relieve steam generator overpressure, and reseat when pressure has been reduced. The OPERABILITY of the MSSVs is determined by periodic surveillance testing in accordance with the Inservice Testing Program.

This LCO provides assurance that the MSSVs will perform their designed safety functions to mitigate the consequences of accidents that could result in a challenge to the RCPB or Main Steam System integrity.

APPLICABILITY In MODES 1, 2, and 3, five MSSVs per steam generator are required to be OPERABLE to prevent Main Steam System overpressurization.

In MODES 4 and 5, there are no credible transients requiring the MSSVs.

The steam generators are not normally used for heat removal in MODES 5 and 6, and thus cannot be overpressurized; there is no requirement for the MSSVs to be OPERABLE in these MODES.

ACTIONS The ACTIONS table is modified by a Note indicating that separate Condition entry is allowed for each MSSV.

(continued)

North Anna Units 1 and 2 B 3.7.1-3 Revision 0, 04/02/02

MSSVs B 3.7.1 BASES APPLICABLE operation of the pressurizer relief valves and spray. This SAFETY ANALYSES analysis demonstrates that the DNB design basis is met.

(continued)

Another analysis is performed assuming no primary system pressure control, but crediting reactor trip on high pressurizer pressure and operation of the pressurizer safety valves. This analysis demonstrates that RCS integrity is maintained by showing that the maximum RCS pressure does not exceed 110% of the design pressure. All cases analyzed demonstrate that the MSSVs maintain Main Steam System integrity by limiting the maximum steam pressure to less than 110% of the steam generator design pressure.

In addition to the decreased heat removal events, reactivity insertion events may also challenge the relieving capacity of the MSSVs.

The uncontrolled rod cluster control assembly (RCCA) bank withdrawal at power event is characterized by an increase in core power and steam generation rate until reactor trip occurs when either the Overtemperature AT or Power Range Neutron Flux-High setpoint is reached. Steam flow to the turbine will not increase from its initial value for this event. The increased heat transfer to the secondary side causes an increase in steam pressure and may result in opening of the MSSVs prior to reactor trip, assuming no credit for operation of the atmospheric or condenser steam dump valves. The UFSAR Section 15.2 safety analysis of the RCCA bank withdrawal at power event for a range of initial core power levels demonstrates that the MSSVs are capable of preventing secondary side overpressurization for this AOO.

The UFSAR safety analyses discussed above assume that all of the MSSVs for each steam generator are OPERABLE.

If there are inoperable MSSV(s),

it is necessary to limit the primary system power during steady-state operation and AOOs to a value that does not result in exceeding the combined steam flow capacity of the turbine (if available) and the remaining OPERABLE MSSVs.

The required limitation on primary system power necessary to prevent secondary system overpressurization may be determined by system transient analyses or conservatively arrived at by a simple heat balance calculation. In some circumstances it is necessary to limit the primary side heat generation that can be achieved during an AOO by reducing the setpoint of the Power Range Neutron Flux-High reactor trip function. For example, if more than one MSSV on a single steam generator is inoperable, an uncontrolled RCCA bank withdrawal at power event occurring from a partial power level may result in an increase in reactor power that exceeds the combined steam flow capacity of the turbine and the remaining OPERABLE (continued)

North Anna Units I and 2 B 3.7. 1-2 Revision 0, 04/02/02

MSSVs B 3.7.1 B 3.7 PLANT SYSTEMS B 3.7.1 Main Steam Safety Valves (MSSVs)

BASES BACKGROUND The primary purpose of the MSSVs is to provide overpressure protection for the secondary system. The MSSVs also provide protection against overpressurizing the reactor coolant pressure boundary (RCPB) by providing a heat sink for the removal of energy from the Reactor Coolant System (RCS) if the preferred heat sink, provided by the Condenser and Circulating Water System, is not available.

Five MSSVs are located on each main steam header, outside containment, upstream of the main steam isolation valves, as described in the UFSAR, Section 10.3.1 (Ref.

1). The MSSVs must have sufficient capacity to limit the secondary system pressure to

110% of the steam generator design pressure in order to meet the requirements of the ASME Code,Section III (Ref. 2).

The MSSV design includes staggered setpoints, according to Table 3.7.1-2 in the accompanying LCO, so that only the needed valves will actuate. Staggered setpoints reduce the potential for valve chattering that is due to steam pressure insufficient to fully open all valves following a turbine reactor trip.

APPLICABLE SAFETY ANALYSES The design basis for the capacity of the MSSVs comes from Reference 2 and its purpose is to limit the secondary system pressure to

110% of design pressure for any anticipated operational occurrence (AOO) or accident considered in the Design Basis Accident (DBA) and transient analysis.

The events that challenge the relieving capacity of the

MSSVs, and thus RCS pressure, are those characterized as decreased heat removal events, which are presented in the

UFSAR, Section 15.2 (Ref. 3).

Of these, the full power turbine trip without steam dump is typically the limiting AOO.

This event also terminates normal feedwater flow to the steam generators.

The safety analysis demonstrates that the transient response for turbine trip occurring from full power without a direct reactor trip presents no hazard to the integrity of the RCS or the Main Steam System. One turbine trip analysis is performed assuming primary system pressure control via (continued)

North Anna Units 1 and 2 B 3.7.1-1 Revision 0, 04/02/02

Intentionally Blank

Hydrogen Recombiners B 3.6.9 BASES SURVEILLANCE SR 3.6.9.1 (continued)

REQUIREMENTS that each hydrogen recombiner purge blower operates for at least 15 minutes. Then, using containment atmosphere air at a flow rate of Ž 50 scfm, the SR verifies that the heater temperature increases to Ž 1100°F within 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months and is maintained for at least 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

Operating experience has shown that these components usually pass the Surveillance when performed at the 18 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

SR 3.6.9.2 This SR ensures there are no physical problems that could affect recombiner operation. Credible failures include fan failure, loss of power, blockage of the internal flow, missile impact, etc.

A visual inspection is sufficient to determine abnormal conditions that could cause such failures (i.e. loose wiring or structural connections, deposits of foreign materials, etc.). The 18 month Frequency for this SR was developed considering the incidence of hydrogen recombiners failing the SR in the past is low.

SR 3.6.9.3 This SR requires performance of a resistance to ground test for each heater phase to ensure that there are no detectable grounds in any heater phase. This is accomplished by verifying that the resistance to ground for any heater phase is Ž 10,000 ohms after performance of SR 3.6.9.1.

The 18 month Frequency for this Surveillance was developed considering the incidence of hydrogen recombiners failing the SR in the past is low.

REFERENCES

1. 10 CFR 50.44.

2. UFSAR, Section 3.1.37.

3. Regulatory Guide 1.7, dated March 10, 1971.

4.

UFSAR, Section 6.2.5.

North Anna Units 1 and 2 B 3.6.9-5 Revision 0, 04/02/02

Hydrogen Recombiners B 3.6.9 BASES ACTIONS B.1 and B.2 (continued)

With two hydrogen recombiners inoperable, the ability to perform the hydrogen control function via alternate capabilities must be verified by administrative means within I hour. The alternate hydrogen control capabilities are provided by the containment atmosphere cleanup system containment purge blowers. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time allows a reasonable period of time to verify that a loss of hydrogen control function does not exist. In addition, the alternate hydrogen control system capability must be verified once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter to ensure its continued availability.

Both the initial verification and all subsequent verifications may be performed as an administrative check by examining logs or other information to determine the availability of the alternate hydrogen control system. It does not mean to perform the Surveillances needed to demonstrate OPERABILITY of the alternate hydrogen control system. If the ability to perform the hydrogen control function is maintained, continued operation is permitted with two hydrogen recombiners inoperable for up to 7 days.

Seven days is a reasonable time to allow two hydrogen recombiners to be inoperable because the hydrogen control function is maintained and because of the low probability of the occurrence of a LOCA that would generate hydrogen in the amounts capable of exceeding the flammability limit.

C.1 If the inoperable hydrogen recombiner(s) cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.6.9.1 REQUIREMENTS Performance of a system functional test for each hydrogen recombiner ensures the recombiners are operational and can attain and sustain the temperature necessary for hydrogen recombination. In particular, this SR verifies that the minimum heater sheath temperature increases to Ž 700°F in

90 minutes, and is maintained for at least 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , and (continued)

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.6.9-4

Hydrogen Recombiners B 3.6.9 BASES LCO Two hydrogen recombiners must be OPERABLE.

This ensures operation of at least one hydrogen recombiner in the event of a worst case single active failure.

Operation with at least one hydrogen recombiner ensures that the post LOCA hydrogen concentration can be prevented from exceeding the flammability limit.

APPLICABILITY In MODES 1 and 2, two hydrogen recombiners are required to control the hydrogen concentration within containment below its flammability limit of 4.0 v/o following a LOCA, assuming a worst case single failure.

In MODES 3 and 4, both the hydrogen production rate and the total hydrogen produced after a LOCA would be less than that calculated for the DBA LOCA.

Also, because of the limited time in these MODES, the probability of an accident requiring the hydrogen recombiners is low. Therefore, the hydrogen recombiners are not required in MODE 3 or 4.

In MODES 5 and 6, the probability and consequences of a LOCA are low, due to the pressure and temperature limitations in these MODES. Therefore, hydrogen recombiners are not required in these MODES.

ACTIONS A.1 With one containment hydrogen recombiner inoperable, the inoperable recombiner must be restored to OPERABLE status within 30 days.

In this condition, the remaining OPERABLE hydrogen recombiner is adequate to perform the hydrogen control function. However, the overall reliability is reduced because a single failure in the OPERABLE recombiner could result in reduced hydrogen control capability. The 30 day Completion Time is based on the availability of the other hydrogen recombiner, the small probability of a LOCA occurring (that would generate an amount of hydrogen that exceeds the flammability limit), and the amount of time available after a LOCA (should one occur) for operator action to prevent hydrogen accumulation from exceeding the flammability limit.

North Anna Units 1 and 2 B 3.6.9-3 Revision 0, 04/02/02

Hydrogen Recombiners B 3.6.9 BASES APPLICABLE limiting DBA relative to hydrogen generation is a LOCA.

SAFETY ANALYSES Hydrogen may accumulate in containment following a LOCA as a (continued) result of:

a. A metal steam reaction between the zirconium fuel rod cladding and the reactor coolant;

b. Radiolytic decomposition of water in the Reactor Coolant System (RCS) and the containment sump;

c. Hydrogen in the RCS at the time of the LOCA (i.e.,

hydrogen dissolved in the reactor coolant and hydrogen gas in the pressurizer vapor space); or

d. Corrosion of metals exposed to containment spray and Emergency Core Cooling System solutions.

To evaluate the potential for hydrogen accumulation in containment following a LOCA, the hydrogen generation as a function of time following the initiation of the accident is calculated. Conservative assumptions recommended by Reference 3 are used to maximize the amount of hydrogen calculated.

Based on the conservative assumptions used to calculate the hydrogen concentration versus time after a LOCA, the hydrogen concentration in the containment would reach 3.5 v/o about 5 days after the LOCA and 4.0 v/o about 1 day later if no recombiner was functioning. Initiating the hydrogen recombiners within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after a LOCA will maintain the hydrogen concentration in the primary containment below flammability limits.

The hydrogen recombiners are designed such that, with the conservatively calculated hydrogen generation rates discussed above, a single recombiner, placed into service within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of the LOCA, is capable of limiting the peak hydrogen concentration in containment to less than 4.0 v/o (Ref. 4).

The containment atmosphere cleanup system containment purge blowers are similarly designed such that one of two redundant trains is an adequate backup to the redundant hydrogen recombiners.

The hydrogen recombiners satisfy Criterion 3 of 10 CFR

50. 36(c) (2) (i i).

North Anna Units 1 and 2 B 3.6.9-2 Revision 0, 04/02/02

Hydrogen Recombiners B 3.6.9 B 3.6 CONTAINMENT SYSTEMS B 3.6.9 Hydrogen Recombiners BASES BACKGROUND APPLICABLE SAFETY ANALYSES The function of the hydrogen recombiners is to eliminate the potential breach of containment due to a hydrogen oxygen reaction.

Per 10 CFR 50.44, "Standards for Combustible Gas Control Systems in Light-Water-Cooled Reactors" (Ref.

1), and UFSAR, Chapter 3, "Containment Atmosphere Cleanup" (Ref. 2),

hydrogen recombiners are required to reduce the hydrogen concentration in the containment following a loss of coolant accident (LOCA).

The recombiners accomplish this by recombining hydrogen and oxygen to form water vapor. The vapor is returned to containment, thus eliminating any discharge to the environment. The hydrogen recombiners are manually initiated since flammable limits would not be reached until several days after a Design Basis Accident (DBA).

Two 100% capacity independent hydrogen recombiner systems are provided. The two systems are shared with the other unit.

Each system consists of controls located in the recombiner vault, a power supply and a recombiner. Recombination is accomplished by heating a hydrogen air mixture to greater than or equal to 11000F. The resulting water vapor and discharge gases are cooled prior to discharge from the recombiner. A single recombiner is capable of maintaining the hydrogen concentration in containment below the 4.0 volume percent (v/o) flammability limit. Two recombiners are provided to meet the requirement for redundancy and independence. Each recombiner is powered from a separate Emergency Diesel Generator bus, is capable of being powered from any Emergency Diesel Generator bus, and is provided with a separate power panel and control panel.

The hydrogen recombiners provide for the capability of controlling the bulk hydrogen concentration in containment to less than the lower flammable concentration of 4.0 v/o following a DBA. This control would prevent a containment wide hydrogen burn, thus ensuring the pressure and temperature assumed in the analyses are not exceeded.

The (continued)

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.6.9-1

Intentionally Blank

Chemical Addition System B 3.6.8 BASES SURVEILLANCE REQUIREMENTS (continued)

REFERENCES SR 3.6.8.4 This SR provides verification that each automatic valve in the Chemical Addition System flow path actuates to its correct position. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has shown that these components usually pass the Surveillance when performed at the 18 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

SR 3.6.8.5 To ensure that the correct pH level is established in the borated water solution provided by the Quench Spray System, flow from the Chemical Addition System is verified once every 5 years by draining solution from the RWST and chemical addition tank through the drain lines in the cross connection between the tanks. This SR provides assurance that the correct amount of NaOH will be metered into the flow path upon Quench Spray System initiation. Due to the passive nature of the chemical addition flow controls, the 5 year Frequency is sufficient to identify component degradation that may affect flow rate.

None North Anna Units 1 and 2 B 3.6.8-5 Revision 0, 04/02/02

Chemical Addition System B 3.6.8 BASES SURVEILLANCE SR 3.6.8.1 REQUIREMENTS Verifying the correct alignment of Chemical Addition System manual, power operated, and automatic valves in the chemical addition flow path provides assurance that the system is able to provide additive to the Quench Spray System in the event of a DBA. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, or securing. This SR does not require any testing or valve manipulation. Rather, it involves verification, through a system walkdown, that those valves outside containment and capable of potentially being mispositioned are in the correct position.

SR 3.6.8.2 To provide effective iodine removal, the containment spray must be an alkaline solution. Since the RWST contents are normally acidic, the volume of the chemical addition tank must provide a sufficient volume of spray additive to adjust pH for all water injected. This SR is performed to verify the availability of sufficient NaOH solution in the Chemical Addition System. The 184 day Frequency was developed based on the low probability of an undetected change in tank volume occurring during the SR interval (the tank is isolated during normal unit operations). Tank level is also indicated and alarmed in the control room, so that there is high confidence that a substantial change in level would be detected.

SR 3.6.8.3 This SR provides verification, by chemical analysis, of the NaOH concentration in the chemical addition tank and is sufficient to ensure that the spray solution being injected into containment is at the correct pH level.

The 184 day Frequency is sufficient to ensure that the concentration level of NaOH in the chemical addition tank remains within the established limits. This is based on the low likelihood of an uncontrolled change in concentration (the tank is normally isolated) and the probability that any substantial variance in tank volume will be detected.

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.6.8-4

Chemical Addition System B 3.6.8 BASES LCO In addition, it is essential that valves in the Chemical (continued)

Addition System flow paths are properly positioned and that automatic valves are capable of activating to their correct positions.

APPLICABILITY In MODES 1, 2, 3,

and 4, a DBA could cause a release of radioactive material to containment requiring the operation of the Chemical Addition System. The Chemical Addition System assists in reducing the iodine fission product inventory prior to release to the environment.

In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES.

Thus, the Chemical Addition System is not required to be OPERABLE in MODE 5 or 6.

ACTIONS A.1 If the Chemical Addition System is inoperable, it must be restored to OPERABLE within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The pH adjustment of the Quench Spray System flow for iodine removal enhancement is reduced in this condition. The Quench Spray System would still be available and would remove some iodine from the containment atmosphere in the event of a DBA.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time takes into account the ability of the Quench Spray System to remove iodine at a reduced capability using the redundant Quench Spray flow path capabilities and the low probability of the worst case DBA occurring during this period.

B.1 and B.2 If the Chemical Addition System cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 84 hours9.722222e-4 days 0.0233 hours 1.388889e-4 weeks 3.1962e-5 months .

The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems. The extended interval to reach MODE 5 allows 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months for restoration of the Chemical Addition System in MODE 3 and 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months to reach MODE 5. This is reasonable when considering the reduced pressure and temperature conditions in MODE 3 for the release of radioactive material from the Reactor Coolant System.

North Anna Units 1 and 2 B 3.6.8-3 Revision 0, 04/02/02

Chemical Addition System B 3.6.8 BASES BACKGROUND sprayed into containment ensures a long term containment (continued) sump pH of Ž 7.0 and

9.5. This ensures the continued iodine retention effectiveness of the sump water during the recirculation phase of spray operation and also minimizes the occurrence of chloride induced stress corrosion cracking of the stainless steel recirculation piping.

APPLICABLE The Chemical Addition System is essential to the removal of SAFETY ANALYSES airborne iodine within containment following a DBA.

Following the assumed release of radioactive materials into containment, the containment is assumed to leak at its analysis value volume following the accident. The plant accident dose calculations use an effective containment coverage of 70% of the containment volume. The containment safety analyses implicitly assume that the containment atmosphere is so turbulent following an accidental release of high energy fluids inside containment that, for heat removal purposes, the containment volume is effectively completely covered by spray.

The DBA response time assumed for the Chemical Addition System is based on the Chemical Addition System isolation valves beginning to open 5 minutes after a QS pump start.

The DBA analyses assume that one train of the Quench Spray System is inoperable and that the entire chemical addition tank volume is added through the remaining Quench Spray System flow path.

The Chemical Addition System satisfies Criterion 3 of 10 CFR 50.36(c) (2) (ii).

LCO The Chemical Addition System is necessary to reduce the release of radioactive material to the environment in the event of a DBA.

To be considered OPERABLE, the volume and concentration of the chemical addition solution must be sufficient to provide NaOH injection into the spray flow until the Quench Spray System has completed pumping water from the RWST to the containment sump, and to raise the average spray solution pH to a level conducive to iodine

removal, namely, to between 8.5 and 10.5. This pH range maximizes the effectiveness of the iodine removal mechanism without introducing conditions that may induce caustic stress corrosion cracking of mechanical system components.

(continued)

North Anna Units 1 and 2 B 3.6.8-2 Revision 0, 04/02/02

Chemical Addition System B 3.6.8 B 3.6 CONTAINMENT SYSTEMS B 3.6.8 Chemical Addition System BASES BACKGROUND The Chemical Addition System is a subsystem of the Quench Spray System that assists in reducing the iodine fission product inventory in the containment atmosphere resulting from a Design Basis Accident (DBA).

Radioiodine in its various forms is the fission product of primary concern in the evaluation of a DBA.

It is absorbed by the spray from the containment atmosphere. To enhance the iodine absorption capacity of the spray, the spray solution is adjusted to an alkaline pH that promotes iodine hydrolysis, in which iodine is converted to nonvolatile forms. Because of its stability when exposed to radiation and elevated temperature, sodium hydroxide (NaOH) is the preferred spray additive. The NaOH added to the spray also ensures a pH value of between 7.0 and 9.5 of the solution recirculated from the containment sump. This pH band minimizes the evolution of iodine as well as the occurrence of chloride and caustic stress corrosion on mechanical systems and components.

The Chemical Addition System consists of one chemical addition tank, two parallel redundant motor operated valves in the line between the chemical addition tank and the refueling water storage tank (RWST),

instrumentation, and a recirculation pump.

The NaOH solution is added to the spray water by a balanced gravity feed from the chemical addition tank through the connecting piping into a weir within the RWST.

There, it mixes with the borated water flowing to the spray pump suction. Because of the hydrostatic balance between the two tanks, the flow rate of the NaOH is controlled by the volume per foot of height ratio of the two tanks. This ensures a spray mixture pH that is Ž 8.5 and

10.5.

The Quench Spray System actuation signal opens the valves from the chemical addition tank to the spray pump suctions or the quench spray pump start signal opens the valves from the chemical addition tank after a 5 minute delay. The 12% to 13% NaOH solution is drawn into the spray pump suctions. The chemical addition tank capacity provides for the addition of NaOH solution to all of the water sprayed from the RWST into containment. The percent solution and volume of solution (continued)

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.6.8-1

Intentionally Blank

RS System B 3.6.7 BASES REFERENCES (continued)

2. 10 CFR 50.49.

3. 10 CFR 50, Appendix K.

4.

ASME Code for Operation and Maintenance of Nuclear Power Plants.

North Anna Units 1 and 2 B 3.6.7-9 Revision 0, 04/02/02

RS System B 3.6.7 BASES SURVEILLANCE REQUIREMENTS (continued)

REFERENCES SR 3.6.7.5 Verifying that each RS and casing cooling pump's developed head at the flow test point is greater than or equal to the required developed head ensures that these pumps' performance has not degraded during the cycle. Flow and differential head are normal tests of centrifugal pump performance required by the ASME Code (Ref. 4). Since the RS System pumps cannot be tested with flow through the spray headers, they are tested on recirculation flow. This test confirms one point on the pump design curve and is indicative of overall performance. Such inservice tests confirm component OPERABILITY, trend performance, and detect incipient failures by indicating abnormal performance.

The Frequency of this SR is in accordance with the Inservice Testing Program.

SR 3.6.7.6 These SRs ensure that each automatic valve actuates and that the RS System and casing cooling pumps start upon receipt of an actual or simulated High-High containment pressure signal. Start delay times are also verified for the RS System pumps. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown that these components usually pass the Surveillance when performed at the 18 month Frequency.

Therefore, the Frequency was considered to be acceptable from a reliability standpoint.

SR 3.6.7.7 This SR ensures that each spray nozzle is unobstructed and that spray coverage of the containment will meet its design bases objective. An air or smoke test is performed through each spray header. Due to the passive design of the spray header and its normally dry state, a test at 10 year intervals is considered adequate for detecting obstruction of the nozzles.

1. UFSAR, Section 6.2.

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.6.7-8

RS System B 3.6.7 BASES SURVEILLANCE SR 3.6.7.1 (continued)

REQUIREMENTS the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency is considered adequate in view of other indications available in the control room, including alarms, to alert the operator to an abnormal condition.

SR 3.6.7.2 Verifying the casing cooling tank contained borated water volume provides assurance that sufficient water is available to support the outside RS subsystem pumps during the time they are required to operate. The 7 day Frequency of this SR was developed considering operating experience related to the parameter variations and instrument drift during the applicable MODES.

Furthermore, the 7 day Frequency is considered adequate in view of other indications available in the control room, including alarms, to alert the operator to an abnormal condition.

SR 3.6.7.3 Verifying the boron concentration of the solution in the casing cooling tank provides assurance that borated water added from the casing cooling tank to RS subsystems will not dilute the solution being recirculated in the containment sump. A Note states that for Unit 2, until the first entry into MODE 4 following the Unit 2 Fall 2002 refueling outage, the casing cooling tank boron concentration acceptance criteria shall be Ž 2300 ppm and

2400 ppm.

The 7 day Frequency of this SR was developed considering the known stability of stored borated water and the low probability of any source of diluting pure water.

SR 3.6.7.4 Verifying the correct alignment of manual, power operated, and automatic valves, excluding check valves, in the RS System and casing cooling tank provides assurance that the proper flow path exists for operation of the RS System. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since they are verified as being in the correct position prior to being secured. This SR does not require any testing or valve manipulation. Rather, it involves verification, through a system walkdown, that those valves outside containment and capable of potentially being mispositioned are in the correct position.

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.6.7-7

RS System B 3.6.7 BASES ACTIONS D.1 (continued) condition are capable of providing 100% of the heat removal needs after an accident. The casing cooling tank does not affect the OPERABILITY of the inside RS subsystem pumps.

The effect on NPSH of the outside RS pumps must be assessed as part of outside RS pump OPERABILITY.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time was chosen based on the same reasons as given in Required Action B.1.

E.1 and E.2 If the inoperable RS subsystem(s) or the casing cooling tank cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 84 hours9.722222e-4 days 0.0233 hours 1.388889e-4 weeks 3.1962e-5 months . The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems. The extended interval to reach MODE 5 allows additional time and is reasonable considering that the driving force for a release of radioactive material from the Reactor Coolant System is reduced in MODE 3.

F.1 With an inoperable inside RS subsystem in one train, and an inoperable outside RS subsystem in the other train, only 1800 containment spray coverage is available. This condition is outside accident analysis. With three or more RS subsystems inoperable, the unit is in a condition outside the accident analysis. With two inoperable outside RS subsystems, less than 100% of required RS flow is available. Therefore, in all three cases, LCO 3.0.3 must be entered immediately.

SURVEILLANCE SR 3.6.7.1 REQUIREMENTS Verifying that the casing cooling tank solution temperature is within the specified tolerances provides assurance that the water injected into the suction of the outside RS pumps will increase the NPSH available as per design. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency of this SR was developed considering operating experience related to the parameter variations and instrument drift during the applicable MODES.

Furthermore, (continued)

North Anna Units 1 and 2 B 3.6.7-6 Revision 0, 04/02/02

RS System B 3.6.7 BASES LCO 1800 coverage spray header, nozzles, valves, piping, (continued) instrumentation, and controls to ensure an OPERABLE flow path capable of taking suction from the containment sump.

APPLICABILITY In MODES 1, 2, 3,

and 4, a DBA could cause an increase in containment pressure and temperature requiring the operation of the RS System.

In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES.

Thus, the RS System is not required to be OPERABLE in MODE 5 or 6.

ACTIONS A.1 With one of the RS subsystems inoperable, the inoperable subsystem must be restored to OPERABLE status within 7 days.

The components in this degraded condition are capable of providing at least 100% of the heat removal needs (i.e.,

approximately 150% when one RS subsystem is inoperable) after an accident. The 7 day Completion Time was developed taking into account the redundant heat removal capabilities afforded by combinations of the RS and QS systems and the low probability of a DBA occurring during this period.

B.1 and C.1 With two of the required RS subsystems inoperable either in the same train, or both inside RS subsystems, at least one of the inoperable RS subsystems must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The components in this degraded condition are capable of providing 100% of the heat removal needs and 360' containment spray coverage after an accident.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time was developed taking into account the redundant heat removal capability afforded by the OPERABLE subsystems, a reasonable amount of time for repairs, and the low probability of a DBA occurring during this period.

D.1 With the casing cooling tank inoperable, the NPSH available to both outside RS subsystem pumps may not be sufficient. The inoperable casing cooling tank must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The components in this degraded (continued)

North Anna Units 1 and 2 B 3.6.7-5 Revision 0, 04/02/02

RS System B 3.6.7 BASES APPLICABLE the containment atmosphere temperature exceeds the SAFETY ANALYSES containment design temperature is short enough that there (continued) would be no adverse effect on equipment inside containment.

Therefore, it is concluded that the calculated transient containment atmosphere temperatures are acceptable for the SLB and LOCA.

The RS System actuation model from the containment analysis is based upon a response time associated with exceeding the High-High containment pressure signal setpoint to achieving full flow through the RS System spray nozzles. A delay in response time initiation provides conservative analyses of peak calculated containment temperature and pressure. The RS System's total response time is determined by the delay timers and system startup time.

For certain aspects of accident analyses, maximizing the calculated containment pressure is not conservative.

In particular, the cooling effectiveness of the Emergency Core Cooling System during the core reflood phase of a LOCA analysis increases with increasing containment backpressure.

For these calculations, the containment backpressure is calculated in a manner designed to conservatively minimize, rather than maximize, the calculated transient containment pressures in accordance with 10 CFR 50, Appendix K (Ref.

3).

The RS System satisfies Criterion 3 of 10 CFR 50.36(c) (2) (ii).

LCO During a DBA, one train (one inside and one outside RS subsystem in the same train) or two outside RS subsystems of the RS System are required to provide the minimum heat removal capability assumed in the safety analysis. To ensure that this requirement is met, four RS subsystems and the casing cooling tank must be OPERABLE.

This will ensure that at least one train will operate assuming the worst case single failure occurs, which is no offsite power and the loss of one emergency diesel generator. Inoperability of the casing cooling tank, the casing cooling pumps, the casing cooling valves, piping, instrumentation, or controls, or of the QS System requires an assessment of the effect on RS subsystem OPERABILITY.

Each RS train consists of one RS subsystem outside containment and one RS subsystem inside containment. Each RS subsystem includes one spray pump, one spray cooler, one (continued)

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.6.7-4

RS System B 3.6.7 BASES APPLICABLE The limiting DBAs considered are the loss of coolant SAFETY ANALYSES accident (LOCA) and the steam line break (SLB).

The LOCA and SLB are analyzed using computer codes designed to predict the resultant containment pressure and temperature transients; DBAs are assumed not to occur simultaneously or consecutively. The postulated DBAs are analyzed assuming no offsite power and the loss of one emergency diesel generator, which is the worst case single active failure for containment depressurization, resulting in one train of the QS and RS systems being rendered inoperable (Ref.

1).

The peak containment pressure following a high energy line break is affected by the initial total pressure and temperature of the containment atmosphere and the QS System operation. Maximizing the initial containment total pressure and average atmospheric temperature maximizes the calculated peak pressure. The heat removal effectiveness of the QS System spray is dependent on the temperature of the water in the refueling water storage tank (RWST).

The time required to depressurize the containment and the capability to maintain it depressurized below atmospheric pressure depend on the functional performance of the QS and RS systems and the service water temperature. When the Service Water temperature is elevated, it is more difficult to depressurize the containment within 60 minutes since the heat removal effectiveness of the RS System is limited.

During normal operation, the containment internal pressure is varied to maintain the capability to depressurize the containment to a subatmospheric pressure in less than 60 minutes after a DBA. This capability and the variation of containment pressure are functions of service water temperature, RWST water temperature, and the containment air temperature.

The DBA analyses show that the maximum peak containment pressure of 44.9 psig results from the SLB analysis and is calculated to be less than the containment design pressure.

The maximum 357 0F peak containment atmosphere temperature results from the SLB analysis and is calculated to exceed the containment design temperature for a relatively short period of time during the transient. The basis of the containment design temperature, however, is to ensure OPERABILITY of safety related equipment inside containment (Ref.

2).

Thermal analyses show that the time interval during which (continued)

North Anna Units 1 and 2 B 3.6.7-3 Revision 0, 04/02/02

RS System B 3.6.7 BASES BACKGROUND cooling tank. The casing cooling pumps are considered part (continued) of the outside RS subsystems. Each casing cooling pump is powered from a separate ESF bus.

The inside RS subsystem pump NPSH is increased by reducing the temperature of the water at the pump suction. Flow is diverted from the QS system to the suction of the inside RS pump on the same safety train as the quench spray pump supplying the water.

The RS System provides a spray of subcooled water into the upper regions of containment to reduce the containment pressure and temperature during a DBA.

Upon receipt of a High-High containment pressure signal, the two casing cooling pumps start, the casing cooling discharge valves open, and the RS pump suction and discharge valves receive an open signal to assure the valves are open. After a 195+/-9.75 second time delay, the inside RS pumps start, and after a 210+/-21 second time delay, the outside RS pumps start. The RS pumps take suction from the containment sump and discharge through their respective spray coolers to the spray headers and into the containment atmosphere. Heat is transferred from the containment sump water to service water in the spray coolers.

The Chemical Addition System supplies a sodium hydroxide (NaOH) solution to the RWST water supplied to the suction of the QS System pumps.

The NaOH added to the QS System spray ensures an alkaline pH for the solution recirculated in the containment sump. The resulting alkaline pH of the RS spray (pumped from the sump) enhances the ability of the spray to scavenge iodine fission products from the containment atmosphere. The alkaline pH of the containment sump water minimizes the evolution of iodine and minimizes the occurrence of chloride and caustic stress corrosion on mechanical systems and components exposed to the fluid.

The RS System is a containment ESF system. It is designed to ensure that the heat removal capability required during the post accident period can be attained. Operation of the QS and RS systems provides the required heat removal capability to limit post accident conditions to less than the containment design values and depressurize the containment structure to subatmospheric pressure in < 60 minutes following a DBA.

The RS System limits the temperature and pressure that could be expected following a DBA and ensures that containment leakage is maintained consistent with the accident analysis.

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.6.7-2

RS System B 3.6.7 B 3.6 CONTAINMENT SYSTEMS B 3.6.7 Recirculation Spray (RS)

System BASES BACKGROUND The RS System, operating in conjunction with the Quench Spray (QS)

System, is designed to limit the post accident pressure and temperature in the containment to less than the design values and to depressurize the containment structure to a subatmospheric pressure in less than 60 minutes following a Design Basis Accident (DBA).

The reduction of containment pressure and the removal of iodine from the containment atmosphere by the spray limit the release of fission product radioactivity from containment to the environment in the event of a DBA.

The RS System consists of two separate trains of equal capacity, each capable of meeting the design and accident analysis bases. Each train includes one RS subsystem outside containment and one RS subsystem inside containment. Each subsystem consists of one approximately 50% capacity spray pump, one spray cooler, one 1800 coverage spray header, nozzles, valves, piping, instrumentation, and controls. Each outside RS subsystem also includes a casing cooling pump with its own valves, piping, instrumentation, and controls.

The two outside RS subsystems' spray pumps are located outside containment and the two inside RS subsystems' spray pumps are located inside containment. Each RS train (one inside and one outside RS subsystem) is powered from a separate Engineered Safety Features (ESF) bus. Each train of the RS System provides adequate spray coverage to meet the system design requirements for containment heat and iodine fission product removal.

Two spray pumps are required to provide 3600 of containment spray coverage assumed in the accident analysis. One train of RS or two outside RS subsystems will provide the containment spray coverage and required flow.

The two casing cooling pumps and common casing cooling tank are designed to increase the net positive suction head (NPSH) available to the outside RS pumps by injecting cold water into the suction of the spray pumps.

They are also beneficial to the containment depressurization analysis. The casing cooling tank contains at least 116,500 gal of chilled and borated water. Each casing cooling pump supplies one outside spray pump with cold borated water from the casing (continued)

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.6.7-1

QS System B 3.6.6 BASES SURVEILLANCE SR 3.6.6.5 (continued)

REQUIREMENTS spray nozzle is unobstructed and that spray coverage of the containment during an accident is not degraded. Due to the passive nature of the design of the nozzle and the non-corrosive design of the system, a test at 10 year intervals is considered adequate to detect obstruction of the nozzles.

REFERENCES

1. UFSAR, Section 6.2.

2.

10 CFR 50.49.

3.

10 CFR 50, Appendix K.

4.

ASME Code for Operation and Maintenance of Nuclear Power Plants.

North Anna Units 1 and 2 B 3.6.6-6 Revision 0, 04/02/02

QS System B 3.6.6 BASES SURVEILLANCE SR 3.6.6.1 (continued)

REQUIREMENTS since they were verified to be in the correct position prior to being secured. This SR does not require any testing or valve manipulation. Rather, it involves verification, through a system walkdown, that those valves outside containment and capable of potentially being mispositioned are in the correct position.

SR 3.6.6.2 Verifying that each QS pump's developed head at the flow test point is greater than or equal to the required developed head ensures that QS pump performance is consistent with the safety analysis assumptions. Flow and differential head are normal tests of centrifugal pump performance required by the ASME Code (Ref. 4). Since the QS System pumps cannot be tested with flow through the spray headers, they are tested on recirculation flow. This test confirms one point on the pump design curve and is indicative of overall performance.

Such inservice tests confirm component OPERABILITY, trend performance, and detect incipient failures by indicating abnormal performance. The Frequency of this SR is in accordance with the Inservice Testing Program.

SR 3.6.6.3 and SR 3.6.6.4 These SRs ensure that each QS automatic valve actuates to its correct position and each QS pump starts upon receipt of an actual or simulated Containment Pressure high-high signal.

This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The 18 month Frequency is based on the need to perform these Surveillances under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillances were performed with the reactor at power.

Operating experience has shown that these components usually pass the Surveillances when performed at an 18 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

SR 3.6.6.5 With the quench spray inlet valves closed and the spray header drained of any solution, low pressure air or smoke can be blown through test connections. This SR ensures that each (continued)

North Anna Units 1 and 2 B 3.6.6-5 Revision 0, 04/02/02

QS System B 3.6.6 BASES LCO (continued)

Each QS train includes a spray pump, a dedicated spray header, nozzles, valves, piping, instruments, and controls to ensure an OPERABLE flow path capable of taking suction from the RWST.

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment and an increase in containment pressure and temperature requiring the operation of the QS System.

In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Thus, the QS System is not required to be OPERABLE in MODE 5 or 6.

ACTIONS A.1 If one QS train is inoperable, it must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The components available in this degraded condition are capable of providing 100% of the heat removal and iodine removal needs after an accident. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time was developed taking into account the redundant heat removal and iodine removal capabilities afforded by the OPERABLE train and the low probability of a DBA occurring during this period.

B.1 and B.2 If the Required Action and associated Completion Time are not met, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.6.6.1 REQUIREMENTS Verifying the correct alignment of manual, power operated, and automatic valves, excluding check valves, in the QS System provides assurance that the proper flow path exists for QS System operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, (continued)

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.6.6-4

QS System B 3.6.6 BASES APPLICABLE Therefore, it is concluded that the calculated transient SAFETY ANALYSES containment atmosphere temperatures are acceptable for the (continued)

SLB.

The modeled QS System actuation from the containment analysis is based upon a response time associated with exceeding the containment High-High pressure signal setpoint to achieving full flow through the spray nozzles. A delayed response time initiation provides conservative analyses of peak calculated containment temperature and pressure responses. The QS System total response time of 71.1 seconds comprises the signal delay, diesel generator startup time, and system startup time, including pipe fill time.

For certain aspects of accident analyses, maximizing the calculated containment pressure is not conservative. In particular, the cooling effectiveness of the Emergency Core Cooling System during the core reflood phase of a LOCA analysis increases with increasing containment backpressure.

For these calculations, the containment backpressure is calculated in a manner designed to conservatively minimize, rather than maximize, the calculated transient containment pressures in accordance with 10 CFR 50, Appendix K (Ref. 3).

Inadvertent actuation of the QS System is evaluated in the analysis, and the resultant reduction in containment pressure is calculated. The maximum calculated reduction in containment pressure results in containment pressures within the design containment minimum pressure.

The QS System satisfies Criterion 3 of 10 CFR 50.36(c) (2)(ii).

LCO During a DBA, one train of the QS System is required to provide the heat removal capability assumed in the safety analyses for containment. In addition, one QS System train, with spray pH adjusted by the contents of the chemical addition tank, is required to scavenge iodine fission products from the containment atmosphere and ensure their retention in the containment sump water. To ensure that these requirements are met, two QS System trains must be OPERABLE with power from two safety related, independent power supplies. Therefore, in the event of an accident, at least one train of QS will operate, assuming that the worst case single active failure occurs.

(continued)

North Anna Units 1 and 2 B 3.6.6-3 Revision 0, 04/02/02

QS System B 3.6.6 BASES BACKGROUND (continued)

APPLICABLE SAFETY ANALYSES The QS System is a containment ESF system. It is designed to ensure that the heat removal capability required during the post accident period can be attained. Operation of the QS System and RS System provides the required heat removal capability to limit post accident conditions to less than the containment design values and depressurize the containment structure to subatmospheric pressure in

< 60 minutes following a DBA.

The QS System limits the temperature and pressure that could be expected following a DBA and ensures that containment leakage is maintained consistent with the accident analysis.

The limiting DBAs considered are the loss of coolant accident (LOCA) and the steam line break (SLB).

The LOCA and SLB are analyzed using computer codes designed to predict the resultant containment pressure and temperature transients. No DBAs are assumed to occur simultaneously or consecutively. The postulated DBAs are analyzed, with respect to containment ESF Systems, assuming no offsite power and the loss of one emergency diesel generator, which is the worst case single active failure, resulting in one train of the QS System and the RS System inoperable.

During normal operation, the containment internal pressure is varied, along with other parameters, to maintain the capability to depressurize the containment to a subatmospheric pressure in < 60 minutes after a DBA. This capability and the variation of containment pressure during a DBA are functions of the service water temperature, the RWST water temperature, and the containment air temperature.

The DBA analyses (Ref.

1) show that the maximum peak containment pressure of 44.9 psig results from the SLB analysis and is calculated to be less than the containment design pressure. The maximum peak containment atmosphere temperature of 3570F results from the SLB analysis and was calculated to exceed the containment design temperature for a relatively short period of time during the transient. The basis of the containment design temperature, however, is to ensure OPERABILITY of safety related equipment inside containment (Ref.

2).

Thermal analyses show that the time interval during which the containment atmosphere temperature exceeded the containment design temperature was short enough that there would be no adverse effect on equipment inside containment assumed to mitigate the consequences of the DBA.

(continued)

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.6.6-2

QS System B 3.6.6 B 3.6 CONTAINMENT SYSTEMS B 3.6.6 Quench Spray (QS) System BASES BACKGROUND The QS System is designed to provide containment atmosphere cooling to limit post accident pressure and temperature in containment to less than the design values. The QS System, operating in conjunction with the Recirculation Spray (RS)

System, is designed to cool and depressurize the containment structure to subatmospheric pressure in less than 60 minutes following a Design Basis Accident (DBA).

Reduction of containment pressure and the iodine removal capability of the spray limit the release of fission product radioactivity from containment to the environment in the event of a DBA.

The QS System consists of two separate trains of equal capacity, each capable of meeting the design bases. Each train includes a spray pump, a dedicated spray header, nozzles, valves, and piping. Each train is powered from a separate Engineered Safety Features (ESF) bus. The refueling water storage tank (RWST) supplies borated water to the QS System.

The QS System is actuated either automatically by a containment High-High pressure signal or manually. The QS System provides a spray of cold borated water into the upper regions of containment to reduce the containment pressure and temperature during a DBA.

Each train of the QS System provides adequate spray coverage to meet the system design requirements for containment heat and iodine fission product removal.

The QS System also provides flow to the Inside RS pumps to improve the net positive suction head available.

The Chemical Addition System supplies a sodium hydroxide (NaOH) solution into the spray. The resulting alkaline pH of the spray enhances the ability of the spray to scavenge iodine fission products from the containment atmosphere. The NaOH added to the spray also ensures an alkaline pH for the solution recirculated in the containment sump. The alkaline pH of the containment sump water minimizes the evolution of iodine and minimizes the occurrence of chloride and caustic stress corrosion on mechanical systems and components exposed to the fluid.

(continued)

North Anna Units 1 and 2 B 3.6.6-1 Revision 0, 04/02/02

Containment Air Temperature B 3.6.5 BASES SURVEILLANCE REQUIREMENTS SR 3.6.5.1 (continued) a weighted average is calculated using measurements taken at locations within containment selected to provide a representative sample of the overall containment atmosphere.

The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency of this SR is considered acceptable based on observed slow rates of temperature increase within containment as a result of environmental heat sources (due to the large volume of containment). Furthermore, the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency is considered adequate in view of other indications available in the control room, including alarms, to alert the operator to an abnormal containment temperature condition.

REFERENCES

1. UFSAR, Section 6.2.

2.

10 CFR 50.49.

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.6.5-4

Containment Air Temperature B 3.6.5 BASES During an SLB, with an initial containment average temperature less than or equal to the LCO temperature limits, the resultant peak accident temperature exceeds containment design temperature for a relatively short period of time, but otherwise is maintained below the containment design temperature.

As a result, the ability of containment to perform its design function is ensured.

APPLICABILITY ACTIONS In MODES 1, 2, 3, and 4, an SLB could cause an accidental release of radioactive material to the environment or a reactivity excursion.

In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, maintaining containment average air temperature within the limit is not required in MODE 5 or 6.

A.1 When containment average air temperature is not within the limits of the LCO, it must be restored to within limits within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . This Required Action is necessary to return operation to within the bounds of the containment analysis.

The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is acceptable considering the sensitivity of the analysis to variations in this parameter and provides sufficient time to correct minor problems.

B.1 and B.2 If the containment average air temperature cannot be restored to within its limits within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.6.5.1 REQUIREMENTS Verifying that containment average air temperature is within the LCO limits ensures that containment operation remains within the limits assumed for the containment analyses.

In order to determine the containment average air temperature, (continued)

North Anna Units 1 and 2 LCO Revision 0, 04/02/02 B 3.6.5-3

Containment Air Temperature B 3.6.5 BASES APPLICABLE Engineered Safety Feature (ESF) systems, assuming no offsite SAFETY ANALYSES power and the loss of one emergency diesel generator, which (continued) is the worst case single active failure, resulting in one train of the Quench Spray (QS)

System and Recirculation Spray System being rendered inoperable.

The limiting DBA for the maximum peak containment air temperature is an SLB. The initial containment average air temperature assumed in the design basis analyses is 1207F.

This resulted in a maximum containment air temperature of 3570F. The design temperature is 280 0F.

The temperature upper limit is used to establish the environmental qualification operating envelope for containment. The maximum peak containment air temperature was calculated to exceed the containment design temperature for a relatively short period of time during the transient.

The basis of the containment design temperature, however, is to ensure the performance of safety related equipment inside containment (Ref.

2).

Thermal analyses showed that the time interval during which the containment air temperature exceeded the containment design temperature was short enough that there would be no adverse effect on equipment inside containment assumed to mitigate the consequences of the DBA.

Therefore, it is concluded that the calculated transient containment air temperature is acceptable for the DBA SLB.

The temperature upper limit is also used in the depressurization analyses to ensure that the minimum pressure limit is maintained following an inadvertent actuation of the QS System (Ref. 1).

The containment pressure transient is sensitive to the initial air mass in containment and, therefore, to the initial containment air temperature. The limiting DBA for establishing the maximum peak containment internal pressure is an SLB. The temperature upper limit is used in the SLB analysis to ensure that, in the event of an accident, the maximum containment internal pressure will not be exceeded.

Containment average air temperature satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.6.5-2

Containment Air Temperature B 3.6.5 B 3.6 CONTAINMENT SYSTEMS B 3.6.5 Containment Air Temperature BASES BACKGROUND The containment structure serves to contain radioactive material that may be released from the reactor core following a Design Basis Accident (DBA).

The containment average air temperature is limited during normal operation to preserve the initial conditions assumed in the accident analyses for a loss of coolant accident (LOCA) or steam line break (SLB).

The containment average air temperature limit is derived from the input conditions used in the containment functional analyses and the containment structure external pressure analyses. This LCO ensures that initial conditions assumed in the analysis of containment response to a DBA are not violated during unit operations. The total amount of energy to be removed from containment by the Containment Spray and Cooling systems during post accident conditions is dependent upon the energy released to the containment due to the event, as well as the initial containment temperature and pressure.

The higher the initial temperature, the more energy which must be removed, resulting in a higher peak containment pressure and temperature. Exceeding containment design pressure may result in leakage greater than that assumed in the accident analysis. Operation with containment temperature in excess of the LCO limit violates an initial condition assumed in the accident analysis.

APPLICABLE SAFETY ANALYSES Containment average air temperature is an initial condition used in the DBA analyses that establishes the containment environmental qualification operating envelope for both pressure and temperature. The limit for containment average air temperature ensures that operation is maintained within the assumptions used in the DBA analyses for containment (Ref. 1).

The limiting DBAs considered relative to containment OPERABILITY are the LOCA and SLB.

The DBA LOCA and SLB are analyzed using computer codes designed to predict the resultant containment pressure transients. No two DBAs are assumed to occur simultaneously or consecutively. The postulated DBAs are analyzed with regard to containment (continued)

North Anna Units 1 and 2 B 3.6.5-1 Revision 0, 04/02/02

Containment Pressure B 3.6.4 BASES SURVEILLANCE REQUIREMENTS SR 3.6.4.1 Verifying that containment air partial pressure is within limits ensures that operation remains within the limits assumed in the containment analysis. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency of this SR was developed considering operating experience related to trending of containment pressure variations and pressure instrument drift during the applicable MODES.

Furthermore, the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is considered adequate in view of other indications available in the control room, including alarms, to alert the operator to an abnormal containment pressure condition.

REFERENCES

1. UFSAR, Section 6.2.

2.

10 CFR 50, Appendix K.

North Anna Units 1 and 2 B 3.6.4-4 Revision 0, 04/02/02

Containment Pressure B 3.6.4 BASES APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment. Since maintaining containment pressure within design basis limits is essential to ensure initial conditions assumed in the accident analyses are maintained, the LCO is applicable in MODES 1, 2, 3, and 4.

In MODES 5 and 6, the probability and consequences of these events are reduced due to the Reactor Coolant System pressure and temperature limitations of these MODES.

Therefore, maintaining containment pressure within the limits of the LCO is not required in MODE 5 or 6.

ACTIONS A.1 When containment air partial pressure is not within the limits of the LCO, containment pressure must be restored to within these limits within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The Required Action is necessary to return operation to within the bounds of the containment analysis. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is consistent with the ACTIONS of LCO 3.6.1, "Containment,"

which requires that containment be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

B.1 and B.2 If containment air partial pressure cannot be restored to within limits within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

North Anna Units 1 and 2 B 3.6.4-3 Revision 0, 04/02/02

Containment Pressure B 3.6.4 BASES APPLICABLE The maximum design internal pressure for the containment is SAFETY ANALYSES 45.0 psig. The initial conditions used in the containment (continued) design basis analyses were an air partial pressure of 11.7 psia and an air temperature of 120 0F. This resulted in a maximum peak containment internal pressure of 44.9 psig, which is less than the maximum design internal pressure for the containment.

The containment was also designed for an external pressure load of 9.2 psid (i.e., a design minimum pressure of 5.5 psia). The inadvertent actuation of the QS System was analyzed to determine the reduction in containment pressure (Ref.

1). The initial conditions used in the analysis were 8.6 psia and 120'F. This resulted in a minimum pressure inside containment of 7.4 psia, which is considerably above the design minimum of 5.5 psia.

For certain aspects of transient accident analyses, maximizing the calculated containment pressure is not conservative. In particular, the cooling effectiveness of the Emergency Core Cooling System during the core reflood phase of a LOCA analysis increases with increasing containment backpressure. For the reflood phase calculations, the containment backpressure is calculated in a manner designed to conservatively minimize, rather than maximize, the containment pressure response in accordance with 10 CFR 50, Appendix K (Ref. 2).

Containment pressure satisfies Criterion 2 of 10 CFR 50.36(c) (2) (ii).

LCO Maintaining containment pressure within the limits shown in Figure 3.6.4-1 of the LCO ensures that in the event of a DBA the resultant peak containment accident pressure will be maintained below the containment design pressure. These limits also prevent the containment pressure from exceeding the containment design negative pressure differential with respect to the outside atmosphere in the event of inadvertent actuation of the QS System. The LCO limits also ensure the return to subatmospheric conditions within 60 minutes following a DBA.

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.6.4-2

Containment B 3.6 CONTAINMENT SYSTEMS B 3.6.4 Containment Pressure BASES BACKGROUND Containment air partial pressure is a process variable that is monitored and controlled. The containment air partial pressure is maintained as a function of refueling water storage tank temperature and service water temperature according to Figure 3.6.4-1 of the LCO, to ensure that, following a Design Basis Accident (DBA),

the containment would depressurize in < 60 minutes to subatmospheric conditions. Controlling containment partial pressure within prescribed limits also prevents the containment pressure from exceeding the containment design negative pressure differential with respect to the outside atmosphere in the event of an inadvertent actuation of the Quench Spray (QS)

System.

The containment internal air partial pressure limits of Figure 3.6.4-1 are derived from the input conditions used in the containment DBA analyses. Limiting the containment internal air partial pressure and temperature in turn limits the pressure that could be expected following a DBA, thus ensuring containment OPERABILITY. Ensuring containment OPERABILITY limits leakage of fission product radioactivity from containment to the environment.

APPLICABLE SAFETY ANALYSES Containment air partial pressure is an initial condition used in the containment DBA analyses to establish the maximum peak containment internal pressure. The limiting DBAs considered relative to containment pressure are the loss of coolant accident (LOCA) and steam line break (SLB).

The LOCA and SLB are analyzed using computer codes designed to predict the resultant containment pressure transients.

DBAs are assumed not to occur simultaneously or consecutively. The postulated DBAs are analyzed assuming degraded containment Engineered Safety Feature (ESF) systems (i.e., assuming no offsite power and the loss of one emergency diesel generator, which is the worst case single active failure, resulting in one train of the QS System and one train of the Recirculation Spray System becoming inoperable). The containment analysis for the DBA (Ref. 1) shows that the maximum peak containment pressure results from the limiting design basis SLB.

(continued)

North Anna Units 1 and 2 Pressure B 3.6.4 B 3.6.4-1 Revision 0, 04/02/02

Intentionally Blank

Containment Isolation Valves B 3.6.3 SURVEILLANCE REQUIREMENTS (continued)

SR 3.6.3.5 Automatic containment isolation valves close on a containment isolation signal to prevent leakage of radioactive material from containment following a DBA. This SR ensures that each automatic power operated containment isolation valve will actuate to its isolation position on a containment isolation signal.

Check valves which are containment isolation valves are not considered automatic valves for the purpose of this Surveillance as they do not receive a containment isolation signal. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown that these components usually pass this Surveillance when performed at the 18 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

SR 3.6.3.6 The check valves that serve a containment isolation function are weight or spring loaded to provide positive closure in the direction of flow. This ensures that these check valves will remain closed when the inside containment atmosphere returns to subatmospheric conditions following a DBA.

SR 3.6.3.6 verifies the operation of the check valves that are not testable during unit operation. The Frequency of 18 months is based on such factors as the inaccessibility of these valves, the fact that the unit must be shut down to perform the tests, and the successful results of the tests on an 18 month basis during past unit operation.

REFERENCES

1. UFSAR, Chapter 15.

2. Technical Requirements Manual.

3. Standard Review Plan 6.2.4.

4.

UFSAR, Section 6.2.4.2.

North Anna Units 1 and 2 BASES B 3.6.3-11 Revision 0, 04/02/02

Containment Isolation Valves B 3.6.3 BASES SURVEILLANCE SR 3.6.3.2 (continued)

REQUIREMENTS valves that are locked, sealed, or otherwise secured in the closed position, since these were verified to be in the correct position upon locking, sealing, or securing.

This Note allows valves and blind flanges located in high radiation areas to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted during MODES 1, 2, 3, and 4, for ALARA reasons. Therefore, the probability of misalignment of these containment isolation valves, once they have been verified to be in their proper position, is small.

SR 3.6.3.3 Verifying that the isolation time of each automatic power operated containment isolation valve is within limits is required to demonstrate OPERABILITY.

The isolation time test ensures the valve will isolate in a time period less than or equal to that assumed in the safety analyses. The isolation time and Frequency of this SR are in accordance with the Inservice Testing Program.

SR 3.6.3.4 For containment purge valves with resilient seals, additional leakage rate testing beyond the test requirements of 10 CFR 50, Appendix J, Option B, is required to ensure OPERABILITY.

Operating experience has demonstrated that this type of seal has the potential to degrade in a shorter time period than do other seal types.

This SR must be performed prior to entering MODE 4 from MODE 5 after containment vacuum has been broken. This Frequency was chosen recognizing that cycling the valve could introduce additional seal degradation (beyond that occurring to a valve that has not been opened).

This Frequency will ensure that each time these valves are cycled they will be leak tested.

North Anna Units 1 and 2 B 3.6.3-10 Revision 0, 04/02/02

Containment Isolation Valves B 3.6.3 BASES SURVEILLANCE SR 3.6.3.1 (continued)

REQUIREMENTS boundary is within design limits. This SR does not require any testing or valve manipulation. Rather, it involves verification, through a system walkdown, that those containment isolation valves outside containment and capable of being mispositioned are in the correct position. Since verification of valve position for containment isolation valves outside containment is relatively easy, the 31 day Frequency is based on engineering judgment and was chosen to provide added assurance of the correct positions. The SR specifies that containment isolation valves that are open under administrative controls are not required to meet the SR during the time the valves are open. This SR does not apply to valves that are locked, sealed, or otherwise secured in the closed position, since these were verified to be in the correct position upon locking, sealing, or securing.

The Note applies to valves and blind flanges located in high radiation areas and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted during MODES 1, 2, 3 and 4 for ALARA reasons. Therefore, the probability of misalignment of these containment isolation valves, once they have been verified to be in the proper position, is small.

SR 3.6.3.2 This SR requires verification that each containment isolation manual valve and blind flange located inside containment and not locked, sealed, or otherwise secured and required to be closed during accident conditions is closed.

The SR helps to ensure that post accident leakage of radioactive fluids or gases outside of the containment boundary is within design limits. For containment isolation valves inside containment, the Frequency of "prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is appropriate since these containment isolation valves are operated under administrative controls and the probability of their misalignment is low. The SR specifies that containment isolation valves that are open under administrative controls are not required to meet the SR during the time they are open. This SR does not apply to (continued)

North Anna Units 1 and 2 B 3.6.3-9 Revision 0, 04/02/02

Containment Isolation Valves B 3.6.3 BASES ACTIONS C.1 and C.2 (continued) by administrative means is considered acceptable, since the function of locking, sealing, or securing components is to ensure that these devices are not inadvertently repositioned. Therefore, the probability of misalignment of these valves, once they have been verified to be in the proper position, is small.

D.1 With the purge valve penetration leakage rate (SR 3.6.3.4) not within limit, the assumptions of the safety analyses are not met. Therefore, the leakage must be restored to within limit. Restoration can be accomplished by isolating the penetration(s) that caused the limit to be exceeded by use of one closed and de-activated automatic valve, closed manual valve, or blind flange. When a penetration is isolated the leakage rate for the isolated penetration is assumed to be the actual pathway leakage through the isolation device.

If two isolation devices are used to isolate the penetration, the leakage rate is assumed to be the lesser actual pathway leakage of the two devices. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time for purge valve penetration leakage is acceptable considering the purge valves remain closed so that a gross breach of containment does not exist.

E.1 and E.2 If the Required Actions and associated Completion Times are not met, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.6.3.1 REQUIREMENTS This SR requires verification that each containment isolation manual valve and blind flange located outside containment and not locked, sealed, or otherwise secured and required to be closed during accident conditions is closed.

The SR helps to ensure that post accident leakage of radioactive fluids or gases outside of the containment (continued)

North Anna Units 1 and 2 B 3.6.3-8 Revision 0, 04/02/02

Containment Isolation Valves B 3.6.3 BASES ACTIONS C.1 and C.2 (continued)

With one or more penetration flow paths with one containment isolation valve inoperable, the inoperable valve flow path must be restored to OPERABLE status or the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange. A check valve may not be used to isolate the affected penetration flow path, with the exception of valves specified in Reference 4. Required Action C.1 must be completed within the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time. The specified time period is reasonable considering the relative stability of the closed system (hence, reliability) to act as a penetration isolation boundary and the relative importance of maintaining containment integrity during MODES 1, 2, 3, and 4. In the event the affected penetration flow path is isolated in accordance with Required Action C.1, the affected penetration flow path must be verified to be isolated on a periodic basis. This periodic verification is necessary to assure leak tightness of containment and that containment penetrations requiring isolation following an accident are isolated. The Completion Time of once per 31 days for verifying that each affected penetration flow path is isolated is appropriate because the valves are operated under administrative controls and the probability of their misalignment is low.

Condition C is modified by a Note indicating that this Condition is only applicable to those penetration flow paths with only one containment isolation valve and a closed system. The closed system must meet the requirements of Reference 3. This Note is necessary since this Condition is written to specifically address those penetration flow paths in a closed system.

Required Action C.2 is modified by two Notes. Note 1 applies to valves and blind flanges located in high radiation areas and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Note 2 applies to isolation devices that are locked, sealed, or otherwise secured in position and allows these devices to be verified closed by use of administrative means. Allowing verification (continued)

North Anna Units 1 and 2 B 3.6.3-7 Revision 0, 04/02/02

Containment Isolation Valves B 3.6.3 BASES ACTIONS A.1 and A.2 (continued) administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Note 2 applies to isolation devices that are locked, sealed, or otherwise secured in position and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since the function of locking, sealing, or securing components is to ensure that these devices are not inadvertently repositioned. Therefore, the probability of misalignment of these devices once they have been verified to be in the proper position, is small.

B.1 With two containment isolation valves in one or more penetration flow paths inoperable, except for purge valve leakage not within limit, the affected penetration flow path must be isolated within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is consistent with the ACTIONS of LCO 3.6.1. In the event the affected penetration is isolated in accordance with Required Action B.1, the affected penetration must be verified to be isolated on a periodic basis per Required Action A.2, which remains in effect. This periodic verification is necessary to assure leak tightness of containment and that penetrations requiring isolation following an accident are isolated. The Completion Time of once per 31 days for verifying each affected penetration flow path is isolated is appropriate considering the fact that the valves are operated under administrative control and the probability of their misalignment is low.

Condition B is modified by a Note indicating this Condition is only applicable to penetration flow paths with two containment isolation valves. Condition A of this LCO addresses the condition of one containment isolation valve inoperable in this type of penetration flow path.

North Anna Units 1 and 2 B 3.6.3-6 Revision 0, 04/02/02

Containment Isolation Valves B 3.6.3 BASES ACTIONS A.1 and A.2 (continued) de-activated automatic containment isolation valve, a closed manual valve, a blind flange, or a check valve with flow through the valve secured. For a penetration flow path isolated in accordance with Required Action A.1, the device used to isolate the penetration should be the closest available one to containment. Required Action A.1 must be completed within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is reasonable, considering the time required to isolate the penetration and the relative importance of supporting containment OPERABILITY during MODES 1, 2, 3, and 4.

For affected penetration flow paths that cannot be restored to OPERABLE status within the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time and that have been isolated in accordance with Required Action A.1, the affected penetration flow paths must be verified to be isolated on a periodic basis. This is necessary to ensure that containment penetrations required to be isolated following an accident and no longer capable of being automatically isolated will be in the isolation position should an event occur. This Required Action does not require any testing or device manipulation. Rather, it involves verification, through a system walkdown, that those isolation devices outside containment and capable of being mispositioned are in the correct position. The Completion Time of "once per 31 days for isolation devices outside containment" is appropriate considering the fact that the devices are operated under administrative controls and the probability of their misalignment is low. For the isolation devices inside containment, the time period specified as "prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of the inaccessibility of the isolation devices and other administrative controls that will ensure that isolation device misalignment is an unlikely possibility.

Condition A has been modified by a Note indicating that this Condition is only applicable to those penetration flow paths with two containment isolation valves. For penetration flow paths with only one containment isolation valve and a closed system, Condition C provides the appropriate actions.

Required Action A.2 is modified by two Notes. Note 1 applies to isolation devices located in high radiation areas and allows these devices to be verified closed by use of (continued)

North Anna Units 1 and 2 B 3.6.3-5 Revision 0, 04/02/02

Containment Isolation Valves B 3.6.3 BASES ACTIONS The ACTIONS are modified by a Note allowing penetration flow paths, except for 36 inch purge and exhaust valve, 18 inch containment vacuum breaking valve, 8 inch purge bypass valve, and steam jet air ejector suction penetration flow paths, to be unisolated intermittently under administrative controls. These administrative controls consist of stationing a dedicated operator at the valve controls, who is in continuous communication with the control room.

In this way, the penetration can be rapidly isolated when a need for containment isolation is indicated. Due to the fact that the 36 inch valves are not qualified for automatic closure from their open position under DBA conditions and that these and the other penetrations listed as excepted exhaust directly from the containment atmosphere to the environment, the penetration flow path containing these valves may not be opened under administrative controls.

A second Note has been added to provide clarification that, for this LCO, separate Condition entry is allowed for each penetration flow path. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable containment isolation valve. Complying with the Required Actions may allow for continued operation, and subsequent inoperable containment isolation valves are governed by subsequent Condition entry and application of associated Required Actions.

The ACTIONS are further modified by a third Note, which ensures appropriate remedial actions are taken, if necessary, if the affected systems are rendered inoperable by an inoperable containment isolation valve.

In the event the leakage for a containment penetration flow path results in exceeding the overall containment leakage rate acceptance criteria, Note 4 directs entry into the applicable Conditions and Required Actions of LCO 3.6.1.

A.1 and A.2 In the event one containment isolation valve in one or more penetration flow paths is inoperable, except for purge valve leakage not within limit, the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and (continued)

North Anna Units 1 and 2 B 3.6.3-4 Revision 0, 04/02/02

Containment Isolation Valves B 3.6.3 BASES APPLICABLE SAFETY ANALYSES (continued)

LCO APPLICABILITY The containment isolation valves satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

Containment isolation valves form a part of the containment boundary. The containment isolation valves' safety function is related to minimizing the loss of reactor coolant inventory and establishing the containment boundary during a DBA.

The automatic power operated isolation valves are required to have isolation times within limits and to actuate on an automatic isolation signal. The 36, 18, and 8 inch purge valves must be maintained locked, sealed, or otherwise secured closed. The valves covered by this LCO are listed along with their associated stroke times in the Technical Requirements Manual (Ref. 2).

The normally closed isolation valves are considered OPERABLE when manual valves are closed, automatic valves are de-activated and secured in their closed position, blind flanges are in place, and closed systems are intact. These passive isolation valves/devices are those listed in Reference 2.

Purge valves with resilient seals must meet additional leakage rate requirements. The other containment isolation valve leakage rates are addressed by LCO 3.6.1, "Containment," as Type C testing.

This LCO provides assurance that the containment isolation valves and purge valves will perform their designed safety functions to minimize the loss of reactor coolant inventory and establish the containment boundary during accidents.

In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment.

In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES.

Therefore, the containment isolation valves are not required to be OPERABLE in MODE 5.

The requirements for containment isolation valves during MODE 6 are addressed in LCO 3.9.4, "Containment Penetrations."

North Anna Units 1 and 2 B 3.6.3-3 Revision 0, 04/02/02

Containment Isolation Valves B 3.6.3 BASES BACKGROUND (continued)

Containment Purge System (36 inch purge and exhaust valves, 18 inch containment vacuum breaking valve, and 8 inch purge bypass valve)

The Containment Purge System operates to supply outside air into the containment for ventilation and cooling or heating and may also be used to reduce the concentration of noble gases within containment prior to and during personnel access. The supply and exhaust lines each contain two isolation valves. Because of their large size, the 36 inch purge valves are not qualified for automatic closure from their open position under Design Basis Accident (DBA) conditions. Therefore, the 36 inch purge valves are maintained closed in MODES 1, 2, 3, and 4 to ensure the containment boundary is maintained. The 18 inch containment vacuum breaking valve and 8 inch bypass valve are also maintained closed in MODES 1, 2, 3, and 4.

APPLICABLE SAFETY ANALYSES The containment isolation valve LCO was derived from the assumptions related to minimizing the loss of reactor coolant inventory and establishing the containment boundary during major accidents. As part of the containment boundary, containment isolation valve OPERABILITY supports leak tightness of the containment. Therefore, the safety analyses of any event requiring isolation of containment is applicable to this LCO.

The DBAs that result in a release of radioactive material within containment are a loss of coolant accident (LOCA) and a rod ejection accident (Ref.

1). In the analyses for each of these accidents, it is assumed that containment isolation valves are either closed or function to close within the required isolation time following event initiation. This ensures that potential paths to the environment through containment isolation valves (including containment purge valves) are minimized. The safety analyses assume that the 36 inch purge and exhaust valves are closed at event initiation.

The DBA analysis assumes that, within 60 seconds after the accident, isolation of the containment is complete and leakage terminated except for the design leakage rate, La.

The containment isolation total response time of 60 seconds includes signal delay, diesel generator startup (for loss of offsite power),

and containment isolation valve stroke times.

(continued)

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.6.3-2

Containment Isolation Valves B 3.6.3 B 3.6 CONTAINMENT SYSTEMS B 3.6.3 Containment Isolation Valves BASES BACKGROUND The containment isolation valves form part of the containment pressure boundary and provide a means for fluid penetrations not serving accident consequence limiting systems to be provided with two isolation barriers that are closed on a containment isolation signal. These isolation devices are either passive or active (automatic).

Manual valves, de-activated automatic valves secured in their closed position (including check valves with flow through the valve secured), blind flanges, and closed systems are considered passive devices. Automatic valves designed to close without operator action following an accident are considered active devices. Two barriers in series are provided for each penetration so that no single credible failure or malfunction of an active component can result in a loss of isolation or leakage that exceeds limits assumed in the safety analyses. One of these barriers may be a closed system. These barriers (typically containment isolation valves) make up the Containment Isolation System.

Automatic isolation signals are produced during accident conditions. Containment Phase "A" isolation occurs upon receipt of a safety injection signal.

The Phase "A" isolation signal isolates nonessential process lines in order to minimize leakage of fission product radioactivity.

Containment Phase "B" isolation occurs upon receipt of a containment pressure High-High signal and isolates the remaining process lines, except systems required for accident mitigation.

The OPERABILITY requirements for containment isolation valves help ensure that containment is isolated within the time limits assumed in the safety analyses. Therefore, the OPERABILITY requirements provide assurance that the containment function assumed in the safety analyses will be maintained.

(continued)

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.6.3-1

Containment Air Locks B 3.6.2 BASES SURVEILLANCE SR 3.6.2.2 (continued)

REQUIREMENTS OPERABILITY if the Surveillance were performed with the reactor at power. Operating experience has shown these components usually pass the Surveillance when performed at the 24 month Frequency. The 24 month Frequency is also based on engineering judgment and is considered adequate given that the interlock is not challenged during use of the air lock.

REFERENCES

1. 10 CFR 50, Appendix J, Option B.

2.

UFSAR, Section 6.2.

3.

UFSAR, Chapter 15.

North Anna Units 1 and 2 B 3.6.2-8 Revision 0, 04/02/02

Containment Air Locks B 3.6.2 BASES SURVEILLANCE SR 3.6.2.1 REQUI REMENTS Maintaining containment air locks OPERABLE requires compliance with the leakage rate test requirements of the Containment Leakage Rate Testing Program. This SR reflects the leakage rate testing requirements with regard to air lock leakage (Type B leakage tests). The acceptance criteria were established during initial air lock and containment OPERABILITY testing. The periodic testing requirements verify that the air lock leakage does not exceed the allowed fraction of the overall containment leakage rate. The Frequency is required by the Containment Leakage Rate Testing Program.

The SR has been modified by two Notes. Note 1 states that an inoperable air lock door does not invalidate the previous successful performance of the overall air lock leakage test.

This is considered reasonable since either air lock door is capable of providing a fission product barrier in the event of a DBA. Note 2 has been added to this SR requiring the results to be evaluated against the acceptance criteria which are applicable to SR 3.6.1.1. This ensures that air lock leakage is properly accounted for in determining the combined Type B and C containment leakage rate.

SR 3.6.2.2 The air lock interlock is designed to prevent simultaneous opening of both doors in a single air lock. Since both the inner and outer doors of an air lock are designed to withstand the maximum expected post accident containment pressure, closure of either door will support containment OPERABILITY.

Thus, the door interlock feature supports containment OPERABILITY while the air lock is being used for personnel transit in and out of the containment. Periodic testing of this interlock demonstrates that the interlock will function as designed and that simultaneous opening of the inner and outer doors will not inadvertently occur when combined with administrative procedures. Due to the purely mechanical nature of this interlock, and given that the interlock mechanism is not normally challenged when the containment door is used for entry and exit (procedures require strict adherence to single door opening), this test is only required to be performed every 24 months. The 24 month Frequency is based on the need to perform this surveillance under the conditions that apply during a unit outage, and the potential for loss of containment (continued)

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.6.2-7

Containment Air Locks B 3.6.2 BASES ACTIONS C.1, C.2, and C.3 (continued)

With one or more air locks inoperable for reasons other than those described in Condition A or B, Required Action C.1 requires action to be initiated immediately to evaluate previous combined leakage rates using current air lock test results. An evaluation is acceptable, since it is overly conservative to immediately declare the containment inoperable if both doors in an air lock have failed a seal test or if the overall air lock leakage is not within limits.

In many instances (e.g., only one seal per door has failed),

containment remains OPERABLE, yet only 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months (per LCO 3.6.1) would be provided to restore the air lock door to OPERABLE status prior to requiring a unit shutdown. In addition, even with both doors failing the seal test, the overall containment leakage rate can still be within limits.

Required Action C.2 requires that one door in the affected containment air lock must be verified to be closed within the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time. This specified time period is consistent with the ACTIONS of LCO 3.6.1, which requires that containment be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

Additionally, the affected air lock(s) must be restored to OPERABLE status within the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time. The specified time period is considered reasonable for restoring an inoperable air lock to OPERABLE status, assuming that at least one door is maintained closed in each affected air lock.

D.1 and D.2 If the inoperable containment air lock cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

North Anna Units 1 and 2 B 3.6.2-6 Revision 0, 04/02/02

Containment Air Locks B 3.6.2 BASES ACTIONS A.1, A.2, and A.3 (continued) begins when the air lock door is discovered inoperable.

Containment entry may be required on a periodic basis to perform Technical Specifications (TS)

Surveillances and Required Actions, as well as other activities on equipment inside containment that are required by TS or activities on equipment that support TS-required equipment. This Note is not intended to preclude performing other activities (i.e.,

non-TS-required activities) if the containment is entered, using the inoperable air lock, to perform an allowed activity listed above. This allowance is acceptable due to the low probability of an event that could pressurize the containment during the short time that the OPERABLE door is expected to be open.

B.1, B.2, and B.3 With an air lock interlock mechanism inoperable in one or more air locks, the Required Actions and associated Completion Times are consistent with those specified in Condition A.

The Required Actions have been modified by two Notes. Note I ensures that only the Required Actions and associated Completion Times of Condition C are required if both doors in the same air lock are inoperable. With both doors in the same air lock inoperable, an OPERABLE door is not available to be closed. Required Actions C.1 and C.2 are the appropriate remedial actions. Note 2 allows entry into and exit from containment under the control of a dedicated individual stationed at the air lock to ensure that only one door is opened at a time (i.e., the individual performs the function of the interlock).

Required Action B.3 is modified by a Note that applies to air lock doors located in high radiation areas and allows these doors to be verified locked closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of the door, once it has been verified to be in the proper position, is small.

North Anna Units 1 and 2 B 3.6.2-5 Revision 0, 04/02/02

Containment Air Locks B 3.6.2 BASES ACTIONS A.1, A.2, and A.3 (conti nued)

With one air lock door in one or more containment air locks inoperable, the OPERABLE door must be verified closed (Required Action A.1) in each affected containment air lock.

This ensures that a leak tight containment barrier is maintained by the use of an OPERABLE air lock door. This action must be completed within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . This specified time period is consistent with the ACTIONS of LCO 3.6.1, which requires containment be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

In addition, the affected air lock penetration must be isolated by locking closed the OPERABLE air lock door within the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is reasonable for locking the OPERABLE air lock door, considering the OPERABLE door of the affected air lock is being maintained closed.

Required Action A.3 verifies that an air lock with an inoperable door has been isolated by the use of a locked and closed OPERABLE air lock door. This ensures that an acceptable containment leakage boundary is maintained. The Completion Time of once per 31 days is based on engineering judgment and is considered adequate in view of the low likelihood of a locked door being mispositioned and other administrative controls. Required Action A.3 is modified by a Note that applies to air lock doors located in high radiation areas and allows these doors to be verified locked closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of the door, once it has been verified to be in the proper position, is small.

The Required Actions have been modified by two Notes. Note I ensures that only the Required Actions and associated Completion Times of Condition C are required if both doors in the same air lock are inoperable. With both doors in the same air lock inoperable, an OPERABLE door is not available to be closed. Required Actions C.1 and C.2 are the appropriate remedial actions. The exception of Note 1 does not affect tracking the Completion Time from the initial entry into Condition A; only the requirement to comply with the Required Actions. Note 2 allows use of the air lock for entry and exit for 7 days under administrative controls if the air lock has an inoperable door. This 7 day restriction (continued)

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.6.2-4

Containment Air Locks B 3.6.2 BASES APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment.

In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES.

Therefore, the containment air locks are not required in MODE 5 to prevent leakage of radioactive material from containment. The requirements for the containment air locks during MODE 6 are addressed in LCO 3.9.4, "Containment Penetrations."

ACTIONS The ACTIONS are modified by a Note that allows entry and exit to perform repairs on the affected air lock component. If the outer door is inoperable, then it may be easily accessed for most repairs. It is preferred that the 7 ft personnel air lock be used for access to Containment due to the size and configuration of the 5.75 ft equipment hatch escape air locks. The equipment hatch escape air lock is typically only used in case of emergency. This means there is a short time during which the containment boundary is not intact (during access through the OPERABLE door).

The ability to open the OPERABLE door, even if it means the containment boundary is temporarily not intact, is acceptable due to the low probability of an event that could pressurize the containment during the short time in which the OPERABLE door is expected to be open. After each entry and exit, the OPERABLE door must be immediately closed.

A second Note has been added to provide clarification that, for this LCO, separate Condition entry is allowed for each air lock. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable air lock. Complying with the Required Actions may allow for continued operation, and a subsequent inoperable air lock is governed by subsequent Condition entry and application of associated Required Actions.

In the event the air lock leakage results in exceeding the overall containment leakage rate, Note 3 directs entry into the applicable Conditions and Required Actions of LCO 3.6.1, "Containment."

North Anna Units 1 and 2 B 3.6.2-3 Revision 0, 04/02/02

Containment Air Locks B 3.6.2 BASES APPLICABLE SAFETY ANALYSES The DBAs that result in a release of radioactive material within containment are a loss of coolant accident and a rod ejection accident (Ref.

3). In the analysis of each of these accidents, it is assumed that containment is OPERABLE such that release of fission products to the environment is controlled by the rate of containment leakage. The containment was designed with an allowable leakage rate of 0.1% of containment air weight per day (Ref. 2). This leakage rate is defined in 10 CFR 50, Appendix J, Option B (Ref.

1), as La = 0.1% of containment air weight per day, the maximum allowable containment leakage rate at the calculated peak containment internal pressure Pa = 44.1 psig following a design basis LOCA. This allowable leakage rate forms the basis for the acceptance criteria imposed on the SRs associated with the air locks.

The containment air locks satisfy Criterion 3 of 10 CFR 50.36(c) (2) (ii).

Each containment air lock forms part of the containment pressure boundary. As part of the containment pressure boundary, the air lock safety function is related to control of the containment leakage rate resulting from a DBA. Thus, each air lock's structural integrity and leak tightness are essential to the successful mitigation of such an event.

Each air lock is required to be OPERABLE. For the air lock to be considered OPERABLE, the air lock interlock mechanism must be OPERABLE, the air lock must be in compliance with the Type B air lock leakage test, and both air lock doors must be OPERABLE.

Opening or closing of the manways of the 7 ft personnel air lock is treated in the same manner as opening or closing of the associated door. The interlock allows only one air lock door of an air lock to be opened at one time.

Operation of the manways of the 7 ft personnel air lock is controlled administratively. These provisions ensure that a gross breach of containment does not exist when containment is required to be OPERABLE. Closure of a single door in each air lock is sufficient to provide a leak tight barrier following postulated events. Nevertheless, both doors are kept closed when the air lock is not being used for entry into or exit from containment.

North Anna Units 1 and 2 LCO Revision 0, 04/02/02 B 3.6.2-2

Containment Air Locks B 3.6.2 B 3.6 CONTAINMENT SYSTEMS B 3.6.2 Containment Air Locks BASES BACKGROUND Containment air locks form part of the containment pressure boundary and provide a means for personnel access during all MODES of operation.

Each air lock is nominally a right circular cylinder, one of which is 7 ft in diameter, the other 5.75 ft in diameter, with a door at each end. The 5.75 ft diameter equipment hatch escape air lock is an integral part of the containment equipment hatch. The doors are interlocked to prevent simultaneous opening. During periods when containment is not required to be OPERABLE, the door interlock mechanism may be disabled, allowing both doors of an air lock to remain open for extended periods when frequent containment entry is necessary. Each air lock door has been designed and tested to certify its ability to withstand a pressure in excess of the maximum expected pressure following a Design Basis Accident (DBA) in containment. As such, closure of a single door supports containment OPERABILITY.

Each of the doors contains double gasketed seals and local leakage rate testing capability to ensure pressure integrity. The inner and outer door of the 7 ft diameter personnel air lock include an 18 inch diameter emergency manway.

The manways contain double gasketed seals and local leak rate testing capability to ensure pressure integrity. The manways are to be used only for emergency entrance or exit from the air lock. Operation of the manways of the 7 ft personnel air lock is controlled administratively.

The 7 ft personnel air lock is provided with limit switches on both doors that provide control room alarm of inside or outside door operation. Outside access to the 5.75 ft equipment hatch escape air lock is controlled by an alarmed door to the space outside containment which provides access to the air lock.

The containment air locks form part of the containment pressure boundary. As such, air lock integrity and leak tightness is essential for maintaining the containment leakage rate within limit in the event of a DBA.

Not maintaining air lock integrity or leak tightness may result in a leakage rate in excess of that assumed in the unit safety analyses.

North Anna Units 1 and 2 B 3.6.2-1 Revision 0, 04/02/02

Containment B 3.6.1 BASES SURVEILLANCE SR 3.6.1.1 REQUIREMENTS Maintaining the containment OPERABLE requires compliance with the visual examinations and leakage rate test requirements of the Containment Leakage Rate Testing Program. Failure to meet air lock and purge valves with resilient seal leakage limits specified in LCO 3.6.2 and LCO 3.6.3 does not invalidate the acceptability of these overall leakage determinations unless their contribution to overall Type A, B, and C leakage causes that to exceed limits. As left leakage prior to the first startup after performing a required Containment Leakage Rate Testing Program, leakage test is required to be

0.6 La for combined Type B and C leakage, and *0.75 La for overall Type A leakage. At all other times between required leakage rate tests, the acceptance criteria is based on an overall Type A leakage limit of

1.0 La. At

1.0 La the offsite dose consequences are bounded by the assumptions of the safety analysis. SR Frequencies are as required by the Containment Leakage Rate Testing Program. These periodic testing requirements verify that the containment leakage rate does not exceed the leakage rate assumed in the safety analysis.

REFERENCES

1. 10 CFR 50, Appendix J, Option B.

2. UFSAR, Chapter 15.

3. UFSAR, Section 6.2.

North Anna Units 1 and 2 B 3.6.1-4 Revision 0, 04/02/02

Containment B 3.6.1 BASES LCO (continued)

Compliance with this LCO will ensure a containment configuration, including the equipment hatch, that is structurally sound and that will limit leakage to those leakage rates assumed in the safety analysis.

Individual leakage rates specified for the containment air lock (LCO 3.6.2) and purge valves with resilient seals (LCO 3.6.3) are not specifically part of the acceptance criteria of 10 CFR 50, Appendix J. Therefore, leakage rates exceeding these individual limits only result in the containment being inoperable when the leakage results in exceeding the overall acceptance criteria of 1.0 La.

APPLICABILITY In MODES 1, 2, 3,

and 4, a DBA could cause a release of radioactive material into containment. In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES.

Therefore, containment is not required to be OPERABLE in MODE 5 to prevent leakage of radioactive material from containment. The requirements for containment during MODE 6 are addressed in LCO 3.9.4, "Containment Penetrations."

ACTIONS A.1 In the event containment is inoperable, containment must be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time provides a period of time to correct the problem commensurate with the importance of maintaining containment during MODES 1, 2, 3,

and 4. This time period also ensures that the probability of an accident (requiring containment OPERABILITY) occurring during periods when containment is inoperable is minimal.

B.1 and B.2 If containment cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

North Anna Units 1 and 2 B 3.6.1-3 Revision 0, 04/02/02

Containment B 3.6.1 BASES BACKGROUND

b. Each air lock is OPERABLE, except as provided in (continued)

LCO 3.6.2, "Containment Air Locks";

c. All equipment hatches are closed; and

d. The sealing mechanism associated with each penetration (e.g. welds, bellows, or O-rings) is OPERABLE.

APPLICABLE The safety design basis for the containment is that the SAFETY ANALYSES containment must withstand the pressures and temperatures of the limiting DBA without exceeding the design leakage rate.

The DBAs that result in a challenge to containment OPERABILITY from high pressures and temperatures are a LOCA, a steam line break, and a rod ejection accident (REA)

(Ref.

2).

In addition, release of significant fission product radioactivity within containment can occur from a LOCA or REA.

In the DBA analyses, it is assumed that the containment is OPERABLE such that, for the DBAs involving release of fission product radioactivity, release to the environment is controlled by the rate of containment leakage. The containment was designed with an allowable leakage rate of 0.1% of containment air weight per day (Ref. 3). This leakage rate, used to evaluate offsite doses resulting from accidents, is defined in 10 CFR 50, Appendix J, Option B (Ref.

1), as La: the maximum allowable containment leakage rate at the calculated peak containment internal pressure (Pa) resulting from the limiting design basis LOCA.

The allowable leakage rate represented by La forms the basis for the acceptance criteria imposed on all containment leakage rate testing. La is assumed to be 0.1% of containment air weight per day in the safety analyses at Pa = 44.1 psig (Ref.

3).

Satisfactory leakage rate test results are a requirement for the establishment of containment OPERABILITY.

The containment satisfies Criterion 3 of 10 CFR 50.36(c) (2) (ii).

LCO Containment OPERABILITY is maintained by limiting leakage to

1.0 La, except prior to the first startup after performing a required Containment Leakage Rate Testing Program leakage test. At this time the applicable leakage limits must be met.

(continued)

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.6.1-2

Containment B 3.6.1 B 3.6 CONTAINMENT SYSTEMS B 3.6.1 Containment BASES BACKGROUND The containment consists of the concrete reactor building, its steel liner, and the penetrations through this structure. The structure is designed to contain radioactive material that may be released from the reactor core following a design basis loss of coolant accident (LOCA).

Additionally, this structure provides shielding from the fission products that may be present in the containment atmosphere following accident conditions.

The containment is a reinforced concrete structure with a cylindrical wall, a flat foundation mat, and a hemispherical dome roof. The inside surface of the containment is lined with a carbon steel liner to ensure a high degree of leak tightness during operating and accident conditions.

The concrete reactor building is required for structural integrity of the containment under Design Basis Accident (DBA) conditions. The steel liner and its penetrations establish the leakage limiting boundary of the containment.

Maintaining the containment OPERABLE limits the leakage of fission product radioactivity from the containment to the environment.

SR 3.6.1.1 leakage rate requirements comply with 10 CFR 50, Appendix J, Option B (Ref.

1), as modified by approved exemptions.

The isolation devices for the penetrations in the containment boundary are a part of the containment leak tight barrier. To maintain this leak tight barrier:

a. All penetrations required to be closed during accident conditions are either:

1. capable of being closed by an OPERABLE automatic containment isolation system, or

2. closed by manual valves, blind flanges, or de-activated automatic valves secured in their closed positions, except as provided in LCO 3.6.3, "Containment Isolation Valves";

North Anna Units I and 2 Revision 0, 04/02/02 B 3.6.1-1

Intentionally Blank

BIT B 3.5.6 BASES SURVEILLANCE REQUIREMENTS (continued)

REFERENCES SR 3.5.6.2 Verification every 7 days that the BIT contained volume is above the required limit is frequent enough to assure that this volume will be available for quick injection into the RCS. The 900 gallon limit corresponds to the BIT being completely full. Methods of verifying that the BIT is completely full include venting from the high point vent, and recirculation flow with the Boric Acid Storage Tanks.

If the volume is too low, the BIT would not provide enough borated water to ensure subcriticality during recirculation or to provide additional core shutdown margin following an MSLB.

Since the BIT volume is normally stable, a 7 day Frequency is appropriate and has been shown to be acceptable through operating experience.

SR 3.5.6.3 Verification every 7 days that the boron concentration of the BIT is within the required band ensures that the reactor remains subcritical following a LOCA; it limits return to power following an MSLB, and maintains the resulting sump pH in an acceptable range so that boron precipitation will not occur in the core. In addition, the effect of chloride and caustic stress corrosion on mechanical systems and components will be minimized.

The BIT is in a recirculation loop that provides continuous circulation of the boric acid solution through the BIT and the boric acid tank (BAT).

There are a number of points along the recirculation loop where local samples can be taken. The actual location used to take a sample of the solution is specified in the unit Surveillance procedures. Sampling from the BAT to verify the concentration of the BIT is not recommended, since this sample may not be homogenous and the boron concentration of the two tanks may differ.

The sample should be taken from the BIT or from a point in the flow path of the BIT recirculation loop.

1. UFSAR, Chapter 6 and Chapter 15.

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.5.6-5

BIT B 3.5.6 BASES ACTIONS B.1, B.2, and B.3 (continued)

When Required Action A.1 cannot be completed within the required Completion Time, a controlled shutdown should be initiated. Six hours is a reasonable time, based on operating experience, to reach MODE 3 from full power conditions and to be borated to the required SDM without challenging unit systems or operators. Borating to the required SDM assures that the unit is in a safe condition, without need for any additional boration.

After determining that the BIT is inoperable and the Required Actions of B.1 and B.2 have been completed, the tank must be returned to OPERABLE status within 7 days.

These actions ensure that the unit will not be operated with an inoperable BIT for a lengthy period of time. It should be noted, however, that changes to applicable MODES cannot be made until the BIT is restored to OPERABLE status, except as provided by LCO 3.0.4.

C.1 Even though the RCS has been borated to a safe and stable condition as a result of Required Action B.2, either the BIT must be restored to OPERABLE status (Required Action C.1) or the unit must be placed in a condition in which the BIT is not required (MODE 4).

The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time to reach MODE 4 is reasonable, based on operating experience and normal cooldown rates, and does not challenge unit safety systems or operators.

SURVEILLANCE SR 3.5.6.1 REQUIREMENTS Verification every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months that the BIT water temperature is at or above the specified minimum temperature is frequent enough to identify a temperature change that would approach the acceptable limit. The solution temperature is also monitored by an alarm that provides further assurance of protection against low temperature. This Frequency has been shown to be acceptable through operating experience.

North Anna Units 1 and 2 B 3.5.6-4 Revision 0, 04/02/02

BIT B 3.5.6 BASES LCO To be considered OPERABLE, the limits established in the SR (continued) for water volume, boron concentration, and temperature must be met.

APPLICABILITY In MODES 1, 2, and 3, the BIT OPERABILITY requirements are consistent with those of LCO 3.5.2, "ECCS-Operating."

In MODES 4, 5, and 6, the respective accidents are less severe, so the BIT is not required in these lower MODES.

ACTIONS A.1 If the required volume is not present in the BIT, both the hot leg recirculation switchover time analysis and the boron precipitation analysis may not be correct. Under these conditions, prompt action must be taken to restore the volume to above its required limit to declare the tank OPERABLE, or the unit must be placed in a MODE in which the BIT is not required.

The BIT boron concentration is considered in the hot leg recirculation switchover time analysis, the boron precipitation analysis, and may effect the reactivity analysis for an MSLB.

If the concentration were not within the required limits, these analyses could not be relied on.

Under these conditions, prompt action must be taken to restore the concentration to within its required limits, or the unit must be placed in a MODE in which the BIT is not required.

The BIT temperature limit is established to ensure that the solution does not reach the boric acid crystallization point. If the temperature of the solution drops below the minimum, prompt action must be taken to raise the temperature and declare the tank OPERABLE, or the unit must be placed in a MODE in which the BIT is not required.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time to restore the BIT to OPERABLE status is consistent with other Completion Times established for loss of a safety function and ensures that the unit will not operate for long periods outside of the safety analyses.

North Anna Units 1 and 2 B 3.5.6-3 Revision 0, 04/02/02

BIT B 3.5.6 BASES APPLICABLE The contents of the BIT are not credited for core cooling or SAFETY ANALYSES immediate boration in the LOCA analysis, but are for post (continued)

LOCA recovery. The BIT maximum boron concentration of 15,750 ppm is used to determine the minimum time for hot leg recirculation switchover. The minimum boron concentration of 12,950 ppm is used to determine the minimum mixed mean sump boron concentration for post LOCA shutdown requirements.

For the MSLB, the BIT is the primary mechanism for injecting boron into the core to counteract the positive increases in reactivity caused by an RCS cooldown. The MSLB core response analysis conservatively assumes a 0 ppm minimum boron concentration of the BIT, which also affects the departure from nucleate boiling design analysis. The MSLB containment response analysis conservatively assumes a 2000 ppm minimum boron concentration of the BIT. Reference to the LOCA and MSLB analyses is used to assess changes to the BIT to evaluate their effect on the acceptance limits contained in these analyses.

The minimum temperature limit of 1150F for the BIT ensures that the solution does not reach the boric acid precipitation point. The temperature of the solution is monitored and alarmed on the main control board.

The BIT boron concentration limits are established to ensure that the core remains subcritical during post LOCA recovery.

The BIT will counteract any positive increases in reactivity caused by an RCS cooldown.

The BIT water volume of 900 gallons is used to ensure that the appropriate quantity of highly borated water with sufficient negative reactivity is injected into the RCS to shut down the core following an MSLB, to determine the hot leg recirculation switchover time, and to safeguard against boron precipitation.

The BIT satisfies Criteria 2 and 3 of 10 CFR 50.36(c) (2) (i i).

LCO This LCO establishes the minimum requirements for contained volume, boron concentration, and temperature of the BIT inventory. This ensures that an adequate supply of borated water is available in the event of a LOCA or MSLB to maintain the reactor subcritical following these accidents.

(continued)

North Anna Units 1 and 2 B 3.5.6-2 Revision 0, 04/02/02

BIT B 3.5.6 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.6 Boron Injection Tank (BIT)

BASES BACKGROUND The BIT is the primary means of quickly introducing negative reactivity into the Reactor Coolant System (RCS) on a safety injection (SI) signal.

The main flow the discharge through lines parallel that operated from elements have these valves, path through the Boron Injection Tank is from of the High Head Safety Injection (HHSI) pumps equipped with a flow element and two valves in open on an SI signal. The valves can be the main control board. The valves and flow main control board indications. Downstream of the flow enters the BIT (Ref. 1).

The BIT is a stainless steel clad tank containing concentrated boric acid. Two trains of strip heaters are mounted on the tank to keep the temperature of the boric acid solution above the precipitation point. The strip heaters are controlled by temperature elements located near the bottom of the BIT. The temperature elements also activate High and Low temperature alarms in the Control Room. In addition to the strip heaters on the BIT, there is a recirculation system with a heat tracing system, including the piping section between the motor operated isolation valves, which further ensures that the boric acid stays in solution. The entire contents of the BIT are injected when required; thus, the contained and deliverable volumes are the same.

During normal operation, a boric acid transfer pump provides recirculation between the boric acid tank and the BIT. On receipt of an SI signal, the recirculation line valves close. Flow to the BIT is then supplied from the HHSI pumps.

The solution of the BIT is injected into the RCS through the RCS cold legs.

APPLICABLE During a main steam line break (MSLB) or loss of coolant SAFETY ANALYSES accident (LOCA),

the BIT provides an immediate source of concentrated boric acid that quickly introduces negative reactivity into the RCS.

(continued)

North Anna Units 1 and 2 B 3.5.6-1 Revision 0, 04/02/02

Seal Injection Flow B 3.5.5 BASES SURVEILLANCE SR 3.5.5.1 (continued)

REQUIREMENTS judgment and is consistent with other ECCS valve Surveillance Frequencies. The Frequency has proven to be acceptable through operating experience.

As noted, the Surveillance is not required to be performed until 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after the RCS pressure has stabilized within a

+/- 20 psi range of normal operating pressure. The RCS pressure requirement is specified since this configuration will produce the required pressure conditions necessary to assure that the manual valves are set correctly. The exception is limited to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to ensure that the Surveillance is timely.

REFERENCES

1. UFSAR, Chapter 6 and Chapter 15.

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.5.5-4

Seal Injection Flow B 3.5.5 BASES APPLICABILITY injection flow is less critical as a result of the lower (continued) initial RCS pressure and decay heat removal requirements in these MODES. Therefore, RCP seal injection flow must be limited in MODES 1, 2, and 3 to ensure adequate ECCS performance.

ACTIONS A.1 With the seal injection flow exceeding its limit, the amount of charging flow available to the RCS may be reduced or, following a LOCA, pump runout could occur. Under this Condition, action must be taken to restore the flow to below its limit. The operator has 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months from the time the flow is known to be above the limit to correctly position the manual valves and thus be in compliance with the accident analysis.

The Completion Time minimizes the potential exposure of the unit to a LOCA with insufficient injection flow and provides a reasonable time to restore seal injection flow within limits. This time is conservative with respect to the Completion Times of other ECCS LCOs; it is based on operating experience and is sufficient for taking corrective actions by operations personnel.

B.1 and B.2 When the Required Actions cannot be completed within the required Completion Time, a controlled shutdown must be initiated. The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for reaching MODE 3 from MODE 1 is a reasonable time for a controlled shutdown, based on operating experience and normal cooldown rates, and does not challenge unit safety systems or operators. Continuing the unit shutdown begun in Required Action B.1, an additional 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is a reasonable time, based on operating experience and normal cooldown rates, to reach MODE 4, where this LCO is no longer applicable.

SURVEILLANCE SR 3.5.5.1 REQUIREMENTS Verification every 31 days that the manual seal injection throttle valves are adjusted to give a flow within the limit ensures that proper manual seal injection throttle valve position, and hence, proper seal injection flow, is maintained. The Frequency of 31 days is based on engineering (continued)

North Anna Units 1 and 2 B 3.5.5-3 Revision 0, 04/02/02

Seal Injection Flow B 3.5.5 BASES APPLICABLE sufficient water for a small LOCA and sufficient boron to SAFETY ANALYSES maintain the core subcritical. For smaller LOCAs, the HHSI (continued) pumps alone deliver sufficient fluid to overcome the loss and maintain RCS inventory.

Seal injection flow satisfies Criterion 2 of 10 CFR 50.36(c) (2) (ii).

LCO The intent of the LCO limit on seal injection flow is to make sure that flow through the RCP seal water injection line is low enough to ensure that sufficient HHSI pump injection flow is directed to the RCS via the injection points and to prevent pump runout.

The LCO is not strictly a flow limit, but rather a flow limit based on a flow line resistance. In order to establish the proper flow line resistance, a pressure and flow must be known.

The flow line resistance is determined by assuming that the RCS pressure is at normal operating pressure as specified in this LCO.

The HHSI pump discharge header pressure remains essentially constant through all the applicable MODES of this LCO.

A reduction in RCS pressure would result in more flow being diverted to the RCP seal injection line than at normal operating pressure. The valve settings established at the prescribed RCS pressure result in a conservative valve position should RCS pressure decrease. The additional modifier of this LCO, the seal injection (air operated) hand control valve being full open, is required since the valve is designed to fail open for the accident condition. With the discharge pressure and control valve position as specified by the LCO, a flow path resistance limit is established. It is this resistance limit that is used in the accident analyses.

The limit on seal injection flow, combined with the RCS pressure limit and an open wide condition of the seal injection hand control valve, must be met to render the ECCS OPERABLE.

If these conditions are not met, the ECCS flow to the core could be less than that assumed in the accident analyses.

APPLICABILITY In MODES 1, 2, and 3, the seal injection flow limit is dictated by ECCS flow requirements, which are specified for MODES 1, 2, 3, and 4. The seal injection flow limit is not applicable for MODE 4 and lower, however, because high seal (continued)

North Anna Units 1 and 2 B 3.5.5-2 Revision 0, 04/02/02

Seal Injection Flow B 3.5.5 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.5 Seal Injection Flow BASES BACKGROUND APPLICABLE SAFETY ANALYSES The function of the seal injection throttle valves during an accident is similar to the function of the ECCS throttle valves in that each restricts flow from the High Head Safety Injection (HHSI) pump header to the Reactor Coolant System (RCS).

The restriction on reactor coolant pump (RCP) seal injection flow limits the amount of ECCS flow that would be diverted from the injection path following an accident and precludes HHSI pump runout due to excessive seal injection flow. This limit is based on safety analysis assumptions that are required because RCP seal injection flow is not isolated during safety injection (SI).

All ECCS subsystems are assumed to be OPERABLE in the large break loss of coolant accident (LOCA) at full power (Ref.

1). The LOCA analysis establishes the minimum flow for the HHSI pumps. The HHSI pumps are also credited in the small break LOCA analysis. This analysis establishes the flow and discharge head requirements at the design point for the HHSI pumps. The steam generator tube rupture and main steam line break event analyses also credit the HHSI pumps, but are not limiting in their design. Reference to these analyses is made in assessing changes to the Seal Injection System for evaluation of their effects in relation to the acceptance limits in these analyses.

This LCO ensures that seal injection flow of

30 gpm, with RCS pressure Ž 2215 psig and

2255 psig and seal injection (air operated) hand control valve full open, will be limited in such a manner that the ECCS trains will be capable of delivering sufficient water to provide adequate core cooling following a large LOCA, and protect against HHSI pump runout. The analysis conservatively neglects the contribution from seal injection to the RCS.

This conservatism bounds the minor effect of instrument uncertainty, so instrument uncertainties have not been included in the derivation of the flow (30 gpm) and RCS pressure (Ž 2215 psig and

2255 psig) setpoints. The flow limit also ensures that the HHSI pumps will deliver (continued)

North Anna Units 1 and 2 B 3.5.5-1 Revision 0, 04/02/02

RWST B 3.5.4 BASES SURVEILLANCE SR 3.5.4.2 (continued)

REQUIREMENTS support continued ECCS and Recirculation Spray System pump operation on recirculation. Since the RWST volume is normally stable and is protected by an alarm, a 7 day Frequency is appropriate and has been shown to be acceptable through operating experience.

SR 3.5.4.3 The boron concentration of the RWST should be verified every 7 days to be within the required limits. A Note states that for Unit 2, until the first entry into MODE 4 following the Unit 2 Fall 2002 refueling outage, the RWST boron concentration acceptance criteria shall be Ž 2300 ppm and

2400 ppm. This SR ensures that the reactor will remain subcritical following a LOCA. Further, it assures that the resulting sump pH will be maintained in an acceptable range so that boron precipitation in the core will not occur and the effect of chloride and caustic stress corrosion on mechanical systems and components will be minimized. Since the RWST volume is normally stable, a 7 day sampling Frequency to verify boron concentration is appropriate and has been shown to be acceptable through operating experience.

REFERENCES

1. UFSAR, Chapter 6 and Chapter 15.

North Anna Units 1 and 2 B 3.5.4-6 Revision 0, 04/02/02

RWST B 3.5.4 BASES ACTIONS A.1 (continued)

OPERABLE condition. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months limit to restore the RWST temperature or boron concentration to within limits was developed considering the time required to change either the boron concentration or temperature and the fact that the contents of the tank are still available for injection.

B.1 With the RWST inoperable for reasons other than Condition A (e.g., water volume),

it must be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

In this Condition, neither the ECCS nor the Quench Spray System can perform its design function. Therefore, prompt action must be taken to restore the tank to OPERABLE status or to place the unit in a MODE in which the RWST is not required. The short time limit of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to restore the RWST to OPERABLE status is based on this condition simultaneously affecting redundant trains.

C.1 and C.2 If the RWST cannot be returned to OPERABLE status within the associated Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.5.4.1 REQUIREMENTS The RWST borated water temperature should be verified every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to be within the limits assumed in the accident analyses band. This Frequency is sufficient to identify a temperature change that would approach either limit and has been shown to be acceptable through operating experience.

SR 3.5.4.2 The RWST water volume should be verified every 7 days to be above the required minimum level in order to ensure that a sufficient initial supply is available for injection and to (continued)

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.5.4-5

RWST B 3.5.4 BASES APPLICABLE SAFETY ANALYSES (continued)

LCO and containment OPERABILITY analysis. Exceeding this temperature will result in a higher peak clad temperature, because there is less heat transfer from the core to the injected water for the small break LOCA and higher containment pressures due to reduced quench spray cooling capacity. For the containment response following an MSLB, the lower limit on boron concentration and the upper limit on RWST water temperature are used to maximize the total energy release to containment.

The RWST satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

The RWST ensures that an adequate supply of borated water is available to cool and depressurize the containment in the event of a Design Basis Accident (DBA),

to cool and cover the core in the event of a LOCA, to maintain the reactor subcritical following a DBA, and to ensure adequate level in the containment sump to support ECCS and Recirculation Spray System pump operation in the recirculation mode.

To be considered OPERABLE, the RWST must meet the water volume, boron concentration, and temperature limits established in the SRs.

APPLICABILITY In MODES 1, 2, 3, and 4, RWST OPERABILITY requirements are dictated by ECCS and Quench Spray System OPERABILITY requirements. Since both the ECCS and the Quench Spray System must be OPERABLE in MODES 1, 2, 3,

and 4, the RWST must also be OPERABLE to support their operation. Core cooling requirements in MODE 5 are addressed by LCO 3.4.7, "RCS Loops-MODE 5, Loops Filled," and LCO 3.4.8, "RCS Loops-MODE 5, Loops Not Filled." MODE 6 core cooling requirements are addressed by LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation-High Water Level," and LCO 3.9.6, "Residual Heat Removal (RHR) and Coolant Circulation-Low Water Level."

ACTIONS A.1 With RWST boron concentration or borated water temperature not within limits, they must be returned to within limits within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . Under these conditions neither the ECCS nor the Quench Spray System can perform its design function.

Therefore, prompt action must be taken to restore the tank to (continued)

North Anna Units 1 and 2 B 3.5.4-4 Revision 0, 04/02/02

RWST B 3.5.4 BASES APPLICABLE SAFETY ANALYSES (continued) available volume. The deliverable volume limit is assumed by the Large Break LOCA containment analyses. For the RWST, the deliverable volume is different from the total volume contained. Because of the design of the tank, more water can be contained than can be delivered. The upper RWST volume limit is assumed for pH control after a LBLOCA. The minimum boron concentration is an explicit assumption in the main steam line break (MSLB) analysis to ensure the required shutdown capability. The importance of its value is small because of the boron injection tank (BIT) with a high boron concentration. The maximum boron concentration is an explicit assumption in the inadvertent ECCS actuation analysis, although it is typically a nonlimiting event and the results are very insensitive to boron concentrations.

The maximum RWST temperature ensures that the amount of containment cooling provided from the RWST during containment pressurization events is consistent with safety analysis assumptions. The minimum RWST temperature is an assumption in the inadvertent Quench Spray actuation analyses.

For a large break LOCA analysis, the minimum water volume limit of 466,200 gallons and the lower boron concentration limit of 2600 ppm are used to compute the post LOCA sump boron concentration necessary to assure subcriticality. For Unit 2, until the first entry into MODE 4 following the Unit 2 Fall 2002 refueling outage, the minimum RWST boron concentration acceptance criteria shall be Ž 2300 ppm. The large break LOCA is the limiting case since the safety analysis assumes that all control rods are out of the core.

The upper limit on boron concentration of 2800 ppm is used to determine the maximum allowable time to switch to hot leg recirculation following a LOCA. For Unit 2, until the first entry into MODE 4 following the Unit 2 Fall 2002 refueling outage, the maximum RWST boron concentration acceptance criteria shall be

2400 ppm. The purpose of switching from cold leg to hot leg injection is to avoid boron precipitation in the core following the accident.

In the ECCS analysis, the quench spray temperature is bounded by the RWST lower temperature limit of 400F. If the lower temperature limit is violated, the quench spray further reduces containment pressure, which decreases the rate at which steam can be vented out the break and increases peak clad temperature. The upper temperature limit of 50F is bounded by the values used in the small break LOCA analysis (continued)

North Anna Units 1 and 2 B 3.5.4-3 Revision 0, 04/02/02

RWST B 3.5.4 BASES BACKGROUND (continued)

When the suction for the ECCS pumps is transferred to the containment sump, the recirculation lines are isolated to prevent a release of the containment sump contents to the RWST, which could result in a release of contaminants to the atmosphere and the eventual loss of suction head for the ECCS pumps.

This LCO ensures that:

a. The RWST contains sufficient borated water to support the ECCS during the injection phase and Quench Spray System;

b. Sufficient water volume exists in the containment sump to support continued operation of the ECCS and Recirculation Spray System pumps following transfer to the recirculation mode of cooling; and

c. The reactor remains subcritical following a loss of coolant accident (LOCA).

Insufficient water volume in the RWST could result in insufficient cooling capacity when the transfer to the recirculation mode occurs. Improper boron concentrations could result in a reduction of SDM or excessive boric acid precipitation in the core following the LOCA, as well as excessive caustic stress corrosion of mechanical components and systems inside the containment.

APPLICABLE SAFETY ANALYSES During accident conditions, the RWST provides a source of borated water to the ECCS and Quench Spray System pumps. As such, it provides containment cooling and depressurization, core cooling, and replacement inventory to the RCS and is a source of negative reactivity for reactor shutdown (Ref.

1).

The design basis transients and applicable safety analyses concerning each of these systems are discussed in the Applicable Safety Analyses section of B 3.5.2, "ECCS-Operating"; B 3.5.3, "ECCS-Shutdown"; and B 3.6.6, "Quench Spray System." These analyses are used to assess changes to the RWST in order to evaluate their effects in relation to the acceptance limits in the analyses.

The RWST must also meet volume, boron concentration, and temperature requirements for certain non-LOCA events. The volume is not an explicit assumption in non-LOCA events since the required volume is a small fraction of the (continued)

North Anna Units 1 and 2 B 3.5.4-2 Revision 0, 04/02/02

RWST B 3.5.4 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.4 Refueling Water Storage Tank (RWST)

BASES BACKGROUND The RWST supplies borated water to the Chemical and Volume Control System (CVCS) during abnormal operating conditions, to the refueling pool during refueling, and to the ECCS and the Quench Spray System during accident conditions.

The RWST supplies water to the ECCS pumps through a common supply header. Water from the supply header enters the low head safety injection (LHSI) pumps through parallel, normally open, motor operated valves. Water to the High Head Safety Injection (HHSI) pumps is supplied via parallel motor operated valves to ensure that at least one opens on receipt of a safety injection actuation signal.

The supply header then branches to the three HHSI pumps. The RWST supplies water to the Quench Spray pumps via separate, redundant lines. A motor operated isolation valve is provided in each header to isolate the RWST from the ECCS once the system has been transferred to the recirculation mode.

The recirculation mode is entered when pump suction is transferred to the containment sump either manually or automatically following receipt of the RWST-Low Low level signal.

Use of a single RWST to supply both trains of the ECCS and Quench Spray System is acceptable since the RWST is a passive component used for a short period of time following an accident, and passive failures are not required to be assumed to occur during the time the RWST is needed following Design Basis Events.

The switchover from normal operation to the injection phase of ECCS operation requires changing HHSI pump suction from the CVCS volume control tank (VCT) to the RWST through the use of isolation valves.

During normal operation, the LHSI pumps are aligned to take suction from the RWST.

The ECCS pumps are provided with recirculation lines that ensure each pump can maintain minimum flow requirements when operating at or near shutoff head conditions.

(continued)

North Anna Units 1 and 2 B 3.5.4-1 Revision 0, 04/02/02

Intentionally Blank

ECCS-Shutdown B 3.5.3 BASES SURVEILLANCE SR 3.5.3.1 REQUIREMENTS The applicable Surveillance descriptions from Bases 3.5.2 apply.

REFERENCES The applicable references from Bases 3.5.2 apply.

North Anna Units 1 and 2 B 3.5.3-3 Revision 0, 04/02/02

ECCS-Shutdown B 3.5.3 BASES LCO taking suction from the RWST and transferring suction to the (continued) containment sump.

During an event requiring ECCS actuation, a flow path is required to provide an abundant supply of water from the RWST to the RCS via the ECCS pumps and their respective supply headers to each of the three cold leg injection nozzles. In the long term, this flow path may be switched to take its supply from the containment sump and to deliver its flow to the RCS hot or cold legs.

APPLICABILITY In MODES 1, 2, and 3, the OPERABILITY requirements for ECCS are covered by LCO 3.5.2.

In MODE 4 with RCS temperature below 3500F, one OPERABLE ECCS train is acceptable without single failure consideration, on the basis of the stable reactivity of the reactor and the limited core cooling requirements.

In MODES 5 and 6, unit conditions are such that the probability of an event requiring ECCS injection is extremely low. Core cooling requirements in MODE 5 are addressed by LCO 3.4.7, "RCS Loops-MODE 5, Loops Filled,"

and LCO 3.4.8, "RCS Loops-MODE 5, Loops Not Filled." MODE 6 core cooling requirements are addressed by LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation-High Water Level," and LCO 3.9.6, "Residual Heat Removal (RHR) and Coolant Circulation-Low Water Level."

ACTIONS A.1 With no ECCS train OPERABLE, due to the inoperability of the ECCS flow path, the unit is not prepared to respond to Design Basis Events requiring SI. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time to restore at least one ECCS train to OPERABLE status ensures that prompt action is taken to provide the required cooling capacity or to initiate actions to place the unit in MODE 5, where an ECCS train is not required.

B.1 When the Required Actions of Condition A cannot be completed within the required Completion Time, the unit should be placed in MODE 5. Twenty-four hours is a reasonable time, based on operating experience, to reach MODE 5 in an orderly manner and without challenging unit systems or operators.

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.5.3-2

ECCS-Shutdown B 3.5.3 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.3 ECCS-Shutdown BASES BACKGROUND The Background section for Bases 3.5.2, "ECCS-Operating," is applicable to these Bases, with the following modifications.

In MODE 4, the required ECCS train consists of two separate subsystems: High Head Safety Injection (HHSI) and Low Head Safety Injection (LHSI).

The ECCS flow paths consist of piping, valves and that water from the refueling water storage tank be injected into the Reactor Coolant System (RCS) the accidents described in Bases 3.5.2.

APPLICABLE SAFETY ANALYSES pumps such (RWST) can following The Applicable Safety Analyses section of Bases 3.5.2 also applies to this Bases section.

Due to the stable conditions associated with operation in MODE 4 and the reduced probability of occurrence of a Design Basis Accident (DBA),

the ECCS operational requirements are reduced.

It is understood in these reductions that certain automatic safety injection (SI) actuation is not available.

In this MODE, sufficient time exists for manual actuation of the required ECCS to mitigate the consequences of a DBA. The safety analysis assumes that flow from one HHSI pump is manually initiated 10 minutes after the DBA.

Only one train of ECCS is required for MODE 4. This requirement dictates that single failures are not considered during this MODE of operation.

The ECCS trains satisfy Criterion 3 of 10 CFR 50.36(c) (2) (ii).

LCO In MODE 4, one of the two independent (and redundant) ECCS trains is required to be OPERABLE to ensure that sufficient ECCS flow is available to the core following a DBA.

In MODE 4, an ECCS train consists of an HHSI subsystem and an LHSI subsystem. Each train includes the piping, instruments, and controls to ensure an OPERABLE flow path capable of (continued)

North Anna Units 1 and 2 B 3.5.3-1 Revision 0, 04/02/02

Intentionally Blank

ECCS-Operating B 3.5.2 BASES REFERENCES (continued)

5.

NRC Memorandum to V. Stello, Jr., from R.L. Baer, "Recommended Interim Revisions to LCOs for ECCS Components," December 1, 1975.

North Anna Units 1 and 2 B 3.5-2-11 Revision 0, 04/02/02

ECCS-Operating B 3.5.2 BASES SURVEILLANCE SR 3.5.2.5 and SR 3.5.2.6 (continued)

REQUIREMENTS starting automatically starts on receipt of an actual or simulated SI signal. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The 18 month Frequency is based on the need to perform these Surveillances under the conditions that apply during a unit outage and the potential for unplanned unit transients if the Surveillances were performed with the reactor at power.

The 18 month Frequency is also acceptable based on consideration of the design reliability (and confirming operating experience) of the equipment. The actuation logic is tested as part of ESF Actuation System testing, and equipment performance is monitored as part of the Inservice Testing Program.

SR 3.5.2.7 Proper throttle valve position is necessary for proper ECCS performance and to prevent pump runout and subsequent component damage. The Surveillance verifies each listed ECCS throttle valve is secured in the correct position. The 18 month Frequency is based on the same reasons as those stated in SR 3.5.2.5 and SR 3.5.2.6.

SR 3.5.2.8 Periodic inspections of the containment sump suction inlet ensure that it is unrestricted and stays in proper operating condition. The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and on the need to have access to the location. This Frequency has been found to be sufficient to detect abnormal degradation and is confirmed by operating experience.

REFERENCES

1. UFSAR, Section 3.1.31.

2.

10 CFR 50.46.

3. UFSAR, Section 15.4.1.

4. UFSAR, Section 6.2 and Chapter 15.

North Anna Units I and 2 Revision 0, 04/02/02 B 3.5.2-10

ECCS-Operating B 3.5.2 BASES SURVEILLANCE SR 3.5.2.3 (continued)

REQUIREMENTS void size are gradual in nature, and the system is operated in accordance with procedures to preclude growth in these voids.

To provide additional assurances that the system will function, a verification is performed every 92 days that the system is sufficiently full of water. The system is sufficiently full of water when the voids and pockets of entrained gases in the ECCS piping are small enough in size and number so as to not interfere with the proper operation of the ECCS. Verification that the ECCS piping is sufficiently full of water can be performed by venting the necessary high point ECCS vents outside containment, using NDE, or using other Engineering-justified means. Maintaining the piping from the ECCS pumps to the RCS sufficiently full of water ensures that the system will perform properly, injecting its full capacity into the RCS upon demand. This will also prevent water hammer, pump cavitation, and pumping of excess noncondensable gas (e.g., air, nitrogen, or hydrogen) into the reactor vessel following an SI signal or during shutdown cooling. The 92 day frequency takes into consideration the gradual nature of the postulated void generation mechanism.

SR 3.5.2.4 Periodic surveillance testing of ECCS pumps to detect gross degradation caused by impeller structural damage or other hydraulic component problems is required by the ASME Code.

This type of testing may be accomplished by measuring the pump developed head at only one point of the pump characteristic curve. This verifies both that the measured performance is within an acceptable tolerance of the original pump baseline performance and that the performance at the test flow is greater than or equal to the performance assumed in the safety analysis. SRs are specified in the Inservice Testing Program, which encompasses the ASME Code.

The ASME Code provides the activities and Frequencies necessary to satisfy the requirements.

SR 3.5.2.5 and SR 3.5.2.6 These Surveillances demonstrate that each automatic ECCS valve actuates to the required position on an actual or simulated SI signal and that each ECCS pump capable of (continued)

North Anna Units 1 and 2 B 3.5.2-9 Revision 0, 04/02/02

ECCS-Operating B 3.5.2 BASES SURVEILLANCE SR 3.5.2.1 REQUIREMENTS Verification of proper valve position ensures that the flow path from the ECCS pumps to the RCS is maintained.

Misalignment of these valves could render both ECCS trains inoperable. Securing these valves in position by removal of power or by key locking the control in the correct position ensures that they cannot change position as a result of an active failure or be inadvertently misaligned. These valves are of the type that can disable the function of both ECCS trains and invalidate the accident analyses. A 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is considered reasonable in view of other administrative controls that will ensure a mispositioned valve is unlikely.

SR 3.5.2.2 Verifying the correct alignment for manual, power operated, and automatic valves in the ECCS flow paths provides assurance that the proper flow paths will exist for ECCS operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an actuation signal is allowed to be in a nonaccident position provided the valve will automatically reposition within the proper stroke time. This Surveillance does not require any testing or valve manipulation. Rather, it involves verification that those valves capable of being mispositioned are in the correct position. The 31 day Frequency is appropriate because the valves are operated under administrative control, and an improper valve position would only affect a single train. This Frequency has been shown to be acceptable through operating experience.

SR 3.5.2.3 With the exception of the operating charging pump, the ECCS pumps are normally in a standby nonoperating mode. As such, some flow path piping has the potential to develop pockets of entrained gases. Plant operating experience and analysis has shown that after proper system filling (following maintenance or refueling outages), some entrained noncondensable gases remain. These gases will form small voids, which remain stable in the system in both normal and transient operation. Mechanisms postulated to increase the (continued)

North Anna Units 1 and 2 B 3.5.2-8 Revision 0, 04/02/02

ECCS-Operating B 3.5.2 BASES ACTIONS A.1 (continued)

The LCO requires the OPERABILITY of a number of independent subsystems. Due to the redundancy of trains and the diversity of subsystems, the inoperability of one active component in a train does not render the ECCS incapable of performing its function. Neither does the inoperability of two different components, each in a different train, necessarily result in a loss of function for the ECCS (e.g.,

an inoperable HHSI pump in one train, and an inoperable LHSI pump in the other). This allows increased flexibility in unit operations under circumstances when components in opposite trains are inoperable.

An event accompanied by a loss of offsite power and the failure of an EDG can disable one ECCS train until power is restored. A reliability analysis (Ref.

5) has shown that the impact of having one full ECCS train inoperable is sufficiently small to justify continued operation for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

B.1 and B.2 If the inoperable trains cannot be returned to OPERABLE status within the associated Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

C.1 Condition A is applicable with one or more trains inoperable. The allowed Completion Time is based on the assumption that at least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train is available. With less than 100% of the ECCS flow equivalent to a single OPERABLE ECCS train available, the facility is in a condition outside of the accident analyses. Therefore, LCO 3.0.3 must be entered immediately.

North Anna Units I and 2 B 3.5.2-7 Revision 0, 04/02/02

ECCS-Operati ng B 3.5.2 BASES LCO (continued)

APPLICABILITY ACTIONS As indicated in the Note, the SI flow paths may be isolated for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months in MODE 3, under controlled conditions, to perform pressure isolation valve testing per SR 3.4.14.1.

The flow path is readily restorable from the control room.

In MODES 1, 2, and 3, the ECCS OPERABILITY requirements for the limiting Design Basis Accident, a large break LOCA, are based on full power operation. Although reduced power would not require the same level of performance, the accident analysis does not provide for reduced cooling requirements in the lower MODES.

MODE 2 and MODE 3 requirements are bounded by the MODE 1 analysis.

This LCO is only applicable in MODE 3 and above. Below MODE 3, the SI signal setpoint has already been manually bypassed by operator control, and system functional requirements are relaxed as described in LCO 3.5.3, "ECCS-Shutdown."

In MODES 5 and 6, unit conditions are such that the probability of an event requiring ECCS injection is extremely low. Core cooling requirements in MODE 5 are addressed by LCO 3.4.7, "RCS Loops-MODE 5, Loops Filled,"

and LCO 3.4.8, "RCS Loops-MODE 5, Loops Not Filled." MODE 6 core cooling requirements are addressed by LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation-High Water Level," and LCO 3.9.6, "Residual Heat Removal (RHR) and Coolant Circulation-Low Water Level."

A.1 With one or more trains inoperable and at least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train available, the inoperable components must be returned to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based on an NRC reliability evaluation (Ref.

5) and is a reasonable time for repair of many ECCS components.

An ECCS train is inoperable if it is not capable of delivering design flow to the RCS. Individual components are inoperable if they are not capable of performing their design function or supporting systems are not available.

(continued)

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.5.2-6

ECCS-Operating B 3.5.2 BASES APPLICABLE or control rod insertion for small breaks. Following SAFETY ANALYSES depressurization, emergency cooling water is injected into (continued) the cold legs, flows into the downcomer, fills the lower plenum, and refloods the core.

The effects on containment mass and energy releases are accounted for in appropriate analysis (Ref. 3).

The LCO ensures that an ECCS train will deliver sufficient water to match boiloff rates soon enough to minimize the consequences of the core being uncovered following a large LOCA. It also ensures that the HHSI pumps will deliver sufficient water and boron during a small LOCA to maintain core subcriticality. For smaller LOCAs, the HHSI pump delivers sufficient fluid to maintain RCS inventory. For a small break LOCA, the steam generators continue to serve as the heat sink, providing part of the required core cooling.

The ECCS trains satisfy Criterion 3 of 10 CFR 50.36(c) (2) (ii).

LCO In MODES 1, 2, and 3, two independent (and redundant) ECCS trains are required to ensure that sufficient ECCS flow is available, assuming a single failure affecting either train.

Additionally, individual components within the ECCS trains may be called upon to mitigate the consequences of other transients and accidents.

In MODES 1, 2, and 3, an ECCS train consists of an HHSI subsystem and a LHSI subsystem. Each train includes the piping, instruments, and controls to ensure an OPERABLE flow path capable of taking suction from the RWST upon an SI signal and automatically transferring suction to the containment sump.

During an event requiring ECCS actuation, a flow path is required to provide an abundant supply of water from the RWST to the RCS via the ECCS pumps and their respective supply headers to each of the three cold leg injection nozzles.

In the long term, this flow path may be switched to take its supply from the containment sump and to supply its flow to the RCS hot and cold legs.

The flow path for each train must maintain its designed independence to ensure that no single failure can disable both ECCS trains.

(continued)

North Anna Units 1 and 2 B 3.5.2-5 Revision 0, 04/02/02

ECCS-Operating B 3.5.2 BASES APPLICABLE The LCO helps to ensure that the following acceptance SAFETY ANALYSES criteria for the ECCS, established by 10 CFR 50.46 (Ref.

2),

will be met following a LOCA:

a. Maximum fuel element cladding temperature is

2200°F;

b.

Maximum cladding oxidation is

0.17 times the total cladding thickness before oxidation;

c. Maximum hydrogen generation from a zirconium water reaction is

0.01 times the hypothetical amount generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react;

d.

Core is maintained in a coolable geometry; and

e. Adequate long term core cooling capability is maintained.

The LCO also limits the magnitude of post trip return to power following an MSLB event and ensures that containment temperature limits are met.

Each ECCS subsystem is taken credit for in a large break LOCA event at full power (Refs.

3 and 4). This event establishes the maximum flow requirement for the ECCS pumps. The HHSI pumps are credited in a small break LOCA event. This event relies upon the flow and discharge head of the HHSI pumps.

The SGTR and MSLB events also credit the HHSI pumps.

The OPERABILITY requirements for the ECCS are based on the following LOCA analysis assumptions:

a. A large break LOCA event, with loss of offsite power and a single failure disabling one LHSI pump (both EDG trains are assumed to operate due to requirements for modeling full active containment heat removal system operation);

and

b. A small break LOCA event, with a loss of offsite power and a single failure disabling one Emergency Diesel Generator.

During the blowdown stage of a large break LOCA, the RCS depressurizes as primary coolant is ejected through the break into the containment.

The nuclear reaction is terminated either by moderator voiding during large breaks (continued)

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.5.2-4

ECCS-Operating B 3.5.2 BASES BACKGROUND The HHSI subsystem of the ECCS also functions to supply (continued) borated water to the reactor core following increased heat removal events, such as an MSLB.

The limiting design conditions occur when the negative moderator temperature coefficient is highly negative, such as at the end of each cycle.

HHSI pumps A and B are capable of being automatically started and are powered from separate emergency buses. HHSI pump C can only be manually started, but can be powered from either of the emergency buses that HHSI pumps A and B are powered from. An interlock prevents HHSI pump C from being powered from both emergency buses simultaneously. For HHSI pump C to be OPERABLE, it must be running since it does not start automatically. In the event of a Safety Injection signal coincident with a loss of offsite power, interlocks prevent automatic operation of two HHSI pumps on the same emergency bus to prevent overloading the emergency diesel generators.

HHSI pump C is normally either running, or available but not running. HHSI pump C is normally running if either HHSI pump A or B is inoperable or both are otherwise preferred to not be in operation. HHSI pump C is normally available but not running when either HHSI pump A or B is running.

The ECCS subsystems are actuated upon receipt of an SI signal.

The actuation of safeguard loads is accomplished in a programmed time sequence. If offsite power is available, the safeguard loads start immediately in the programmed sequence. If offsite power is not available, the Engineered Safety Feature (ESF) buses shed normal operating loads and are connected to the emergency diesel generators (EDGs).

Safeguard loads are then actuated in the programmed time sequence. The time delay associated with diesel starting and pump starting determines the time required before pumped flow is available to the core following a LOCA.

The active ECCS components, along with the passive accumulators and the RWST covered in LCO 3.5.1, "Accumulators," and LCO 3.5.4, "Refueling Water Storage Tank (RWST),"

provide the cooling water necessary to meet Reference 1.

North Anna Units 1 and 2 B 3.5.2-3 Revision 0, 04/02/02

ECCS-Operating B 3.5.2 BASES BACKGROUND (continued)

The ECCS flow paths consist of piping, valves, and pumps such that water from the RWST can be injected into the RCS following the accidents described in this LCO. The major components of each subsystem are the HHSI pumps and the LHSI pumps.

Each of the two subsystems consists of two 100%

capacity trains that are interconnected and redundant such that either train is capable of supplying 100% of the flow required to mitigate the accident consequences. This interconnecting and redundant subsystem design provides the operators with the ability to utilize components from opposite trains to achieve the required 100% flow to the core.

During the injection phase of LOCA recovery, a suction header supplies water from the RWST to the ECCS pumps. Water from the supply header enters the LHSI pumps through parallel, normally open, motor operated valves. Water to the HHSI pumps is supplied via parallel motor operated valves to ensure that at least one valve opens on receipt of a safety injection actuation signal. The supply header then branches to the three HHSI pumps through normally open, motor operated valves. The discharge from the HHSI pumps combines prior to entering the boron injection tank (BIT) and then divides again into three supply lines, each of which feeds the injection line to one RCS cold leg. The discharge from the LHSI pumps combine and then divide into three supply lines, each of which feeds the injection line to one RCS cold leg. Control valves in the HHSI lines are set to balance the flow to the RCS. This balance ensures sufficient flow to the core to meet the analysis assumptions following a LOCA in one of the RCS cold legs and preclude pump runout.

For LOCAs that are too small to depressurize the RCS below the shutoff head of the LHSI pumps, the HHSI pumps supply water until the RCS pressure decreases below the LHSI pump shutoff head. During this period, the steam generators are used to provide part of the core cooling function.

During the recirculation phase of LOCA recovery, LHSI pump suction is transferred to the containment sump. The LHSI pumps then supply the HHSI pumps. Initially, recirculation is through the same paths as the injection phase.

Subsequently, recirculation alternates injection between the hot and cold legs.

(continued)

North Anna Units 1 and 2 B 3.5.2-2 Revision 0, 04/02/02

ECCS-Operating B 3.5.2 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.2 ECCS-Operating BASES BACKGROUND The function of the ECCS is to provide core cooling and negative reactivity to ensure that the reactor core is protected after any of the following accidents:

a. Loss of coolant accident (LOCA),

coolant leakage greater than the capability of the normal charging system;

b. Rupture of a control rod drive mechanism-control rod assembly ejection accident;

c. Loss of secondary coolant accident, including uncontrolled steam release or loss of feedwater; and

d. Steam generator tube rupture (SGTR).

The addition of negative reactivity is designed primarily for the MSLB where primary cooldown could add enough positive reactivity to achieve criticality and return to significant power.

There are three phases of ECCS operation: injection, cold leg recirculation, and hot leg recirculation. In the injection phase, water is taken from the refueling water storage tank (RWST) and injected into the Reactor Coolant System (RCS) through the cold legs. When sufficient water is removed from the RWST to ensure that enough boron has been added to maintain the reactor subcritical and the containment sumps have enough water to supply the required net positive suction head to the ECCS pumps, suction is switched to the containment sump for cold leg recirculation.

Within approximately 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months , the ECCS flow is shifted to the hot leg recirculation phase to provide a backflush, which would reduce the boiling in the top of the core and any resulting boron precipitation.

The ECCS consists of two separate subsystems: High Head Safety Injection (HHSI) and Low Head Safety Injection (LHSI).

Each subsystem consists of two redundant, 100%

capacity trains. The ECCS accumulators and the RWST are also part of the ECCS, but are not considered part of an ECCS flow path as described by this LCO.

(continued)

North Anna Units 1 and 2 B 3.5.2-1 Revision 0, 04/02/02

Accumulators B 3.5.1 BASES SURVEILLANCE REQUIREMENTS SR 3.5.1.5 (continued) result in the closure of an accumulator motor operated isolation valve. If this were to occur, only one accumulator would be available for injection given a single failure coincident with a LOCA. Since power is removed under administrative control, the 31 day Frequency will provide adequate assurance that power is removed.

This SR allows power to be supplied to the motor operated isolation valves when RCS pressure is < 2000 psig, thus allowing operational flexibility by avoiding unnecessary delays to manipulate the breakers during unit startups or shutdowns.

REFERENCES

1. UFSAR, Chapter 6 and Chapter 15.

2. 10 CFR 50.46.

3.

NUREG-1366, February 1990.

North Anna Units 1 and 2 B 3.5.1-8 Revision 0, 04/02/02

Accumulators B 3.5.1 BASES SURVEILLANCE SR 3.5.1.2 and SR 3.5.1.3 REQUIREMENTS (continued)

Every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , borated water volume and nitrogen cover pressure are verified for each accumulator. This Frequency is sufficient to ensure adequate injection during a LOCA.

Because of the static design of the accumulator, a 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency usually allows the operator to identify changes before limits are reached. Operating experience has shown this Frequency to be appropriate for early detection and correction of off normal trends.

SR 3.5.1.4 The boron concentration should be verified to be within required limits for each accumulator every 31 days since the static design of the accumulators limits the ways in which the concentration can be changed. A Note states that for Unit 2, until the first entry into MODE 4 following the Unit 2 Fall 2002 refueling outage, the accumulator boron concentration acceptance criteria shall be Ž 2200 ppm and

2400 ppm. The 31 day Frequency is adequate to identify changes that could occur from mechanisms such as stratification or inleakage. Sampling the affected accumulator within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months after a 50% increase of indicated level will identify whether inleakage has caused a reduction in boron concentration to below the required limit. It is not necessary to verify boron concentration if the added water inventory is from the refueling water storage tank (RWST),

because the water contained in the RWST is within the accumulator boron concentration requirements. This is consistent with the recommendation of NUREG-1366 (Ref.

3).

Although the run of piping between the two accumulator discharge check valves is credited in demonstrating compliance with Technical Specification 3.5.1 minimum accumulator volume requirement, the minimum boron concentration requirement does not apply to this run of piping. Applicable accident analyses have explicitly considered in-leakage from the RCS, and the resulting reduction in boron concentration in this run of piping, which is not sampled.

SR 3.5.1.5 Verification every 31 days that power is removed from each accumulator isolation valve operator when the RCS pressure is Ž 2000 psig ensures that an active failure could not (continued)

North Anna Units 1 and 2 B 3.5.1-7 Revision 0, 04/02/02

Accumulators B 3.5.1 BASES ACTIONS B.1 (continued) reach the core during a large break LOCA.

Due to the severity of the consequences should a large break LOCA occur in these conditions, the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time to open the valve, remove power to the valve, or restore the proper water volume or nitrogen cover pressure ensures that prompt action will be taken to return the inoperable accumulator to OPERABLE status. The Completion Time minimizes the time the unit is exposed to a LOCA under these conditions.

C.1 and C.2 If the accumulator cannot be returned to OPERABLE status within the associated Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and RCS pressure reduced to

1000 psig within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

D.1 If more than one accumulator is inoperable, the unit is in a condition outside the accident analyses; therefore, LCO 3.0.3 must be entered immediately.

SURVEILLANCE REQUIREMENTS SR 3.5.1.1 Each accumulator isolation valve should be verified to be fully open every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . This verification ensures that the accumulators are available for injection and ensures timely discovery if a valve should be less than fully open.

If an isolation valve is not fully open, the rate of injection to the RCS would be reduced. Although a motor operated valve position should not change with power

removed, a closed valve could result in not meeting accident analyses assumptions. This Frequency is considered reasonable in view of other administrative controls that ensure a mispositioned isolation valve is unlikely.

North Anna Units 1 and 2 B 3.5. 1-6 Revision 0, 04/02/02

Accumulators B 3.5.1 BASES APPLICABILITY In MODES 1 and 2, and in MODE 3 with RCS pressure

> 1000 psig, the accumulator OPERABILITY requirements are based on full power operation. Although cooling requirements decrease as power decreases, the accumulators are still required to provide core cooling as long as elevated RCS pressures and temperatures exist.

This LCO is only applicable at pressures > 1000 psig. At pressures

1000 psig, the rate of RCS blowdown is such that the ECCS pumps can provide adequate injection to ensure that peak clad temperature remains below the 10 CFR 50.46 (Ref.

2) limit of 22007F.

In MODE 3, with RCS pressure

1000 psig, and in MODES 4, 5,

and 6, the accumulator motor operated isolation valves are closed to isolate the accumulators from the RCS. This allows RCS cooldown and depressurization without discharging the accumulators into the RCS or requiring depressurization of the accumulators.

ACTIONS A.1 If the boron concentration of one accumulator is not within limits, it must be returned to within the limits within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this Condition, ability to maintain subcriticality or minimum boron precipitation time may be reduced. The boron in the accumulators contributes to the assumption that the combined ECCS water in the partially recovered core during the early reflooding phase of a large break LOCA is sufficient to keep that portion of the core subcritical. One accumulator below the minimum boron concentration limit, however, will have no effect on available ECCS water and an insignificant effect on core subcriticality during reflood. Boiling of ECCS water in the core during reflood concentrates boron in the saturated liquid that remains in the core. In addition, the accumulators do not discharge following a large main steam line break. Thus, 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is allowed to return the boron concentration to within limits.

B.1 If one accumulator is inoperable for a reason other than boron concentration, the accumulator must be returned to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . In this Condition, the required contents of two accumulators cannot be assumed to (continued)

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.5.1-5

Accumulators B 3.5.1 BASES APPLICABLE environment. Of particular interest is the large break LOCA, SAFETY ANALYSES since no credit is taken for control rod assembly insertion.

(continued)

A reduction in the accumulator minimum boron concentration would produce a subsequent reduction in the available containment sump concentration for post LOCA shutdown and an increase in the maximum sump pH.

The maximum boron concentration is used in determining the cold leg to hot leg recirculation injection switchover time and minimum sump pH.

The large and small break LOCA peak clad temperature analyses are performed at the minimum nitrogen cover pressure, since sensitivity analyses have demonstrated that higher nitrogen cover pressure results in a computed peak clad temperature benefit. The maximum nitrogen cover pressure limit prevents accumulator relief valve actuation, and ultimately preserves accumulator integrity.

The effects on containment mass and energy releases from the accumulators are accounted for in the appropriate analyses (Ref.

1). The large break LOCA containment analyses assume that the accumulator nitrogen is discharged into the containment, which affects transient subatmospheric pressure.

The accumulators satisfy Criterion 3 of 10 CFR 50.36(c) (2) (ii).

LCO The LCO establishes the minimum conditions required to ensure that the accumulators are available to accomplish their core cooling safety function following a LOCA. Three accumulators are required to ensure that 100% of the contents of two of the accumulators will reach the core during a large break LOCA. This is consistent with the assumption that the contents of one accumulator spill through the break. If less than two accumulators are injected during the blowdown phase of a large break LOCA, the ECCS acceptance criteria of 10 CFR 50.46 (Ref. 2) could be violated.

For an accumulator to be considered OPERABLE, the isolation valve must be fully open, power removed above 2000 psig, and the limits established in the SRs for contained volume, boron concentration, and nitrogen cover pressure must be met.

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.5. 1-4

Accumulators B 3.5.1 BASES APPLICABLE Head Safety Injection (HHSI) pumps both play a part in SAFETY ANALYSES terminating the rise in clad temperature.

As break size (continued) continues to decrease, the role of the accumulators continues to decrease until they are not required and the HHSI pumps become solely responsible for terminating the temperature increase.

This LCO helps to ensure that the following acceptance criteria established for the ECCS by 10 CFR 50.46 (Ref.

2) will be met following a LOCA:

a. Maximum fuel element cladding temperature is

2200°F;

b. Maximum cladding oxidation is

0.17 times the total cladding thickness before oxidation;

c.

Maximum hydrogen generation from a zirconium water reaction is

0.01 times the hypothetical amount that would be generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react; and

d.

Core is maintained in a coolable geometry.

Since the accumulators discharge during the blowdown phase of a LBLOCA, they do not contribute to the long term cooling requirements of 10 CFR 50.46.

For both the large and small break LOCA analyses, a nominal contained accumulator water volume is used. For small breaks, the accumulator water volume only affects the mass flow rate of water into the RCS since the tanks do not empty for most break sizes analyzed. The assumed water volume has an insignificant effect upon the peak clad temperature.

For large breaks, an increase in water volume can be either a peak clad temperature penalty or benefit, depending on downcomer filling and subsequent spill through the break during the core reflooding portion of the transient. The safety analysis supports operation with a contained water volume of between 7580 gallons and 7756 gallons per accumulator.

The minimum boron concentration setpoint is used in the post LOCA boron concentration calculation. The calculation is performed to assure reactor subcriticality in a post LOCA (continued)

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.5. 1-3

Accumulators B 3.5.1 BASES BACKGROUND (continued)

APPLICABLE SAFETY ANALYSES occur following a large break LOCA.

The need to ensure that two accumulators are adequate for this function is consistent with the large break LOCA assumption that the entire contents of one accumulator will be lost via the RCS pipe break during the blowdown phase of the large break LOCA.

The accumulators are assumed OPERABLE in both the large and small break LOCA analyses at full power (Ref.

1). These are the Design Basis Accidents (DBAs) that establish the acceptance limits for the accumulators. Reference to the analyses for these DBAs is used to assess changes in the accumulators as they relate to the acceptance limits.

In performing the LOCA calculations, conservative assumptions are made concerning the availability of ECCS flow. In the early stages of a large break LOCA, with or without a loss of offsite power, the accumulators provide the sole source of makeup water to the RCS. The assumption of loss of offsite power is required by regulations and conservatively imposes a delay wherein the ECCS pumps cannot deliver flow until the emergency diesel generators start, come to rated speed, and energize their respective buses. In cold leg large break scenarios, the entire contents of one accumulator are assumed to be lost through the break.

The limiting large break LOCA is a double ended guillotine break at the discharge of the reactor coolant pump. During this event, the accumulators discharge to the RCS as soon as RCS pressure decreases to below accumulator pressure.

As a conservative estimate, no credit is taken for ECCS pump flow until an effective delay has elapsed. This delay accounts for the diesels starting and the pumps being loaded and delivering full flow. The delay time is conservatively set with an additional 2 seconds to account for SI signal generation. During this time, the accumulators are analyzed as providing the sole source of emergency core cooling. No operator action is assumed during the blowdown stage of a large break LOCA.

The worst case small break LOCA analyses also assume a time delay before pumped flow reaches the core. For the larger range of small breaks, the rate of blowdown is such that the increase in fuel clad temperature is terminated solely by the accumulators, with pumped flow then providing continued cooling. As break size decreases, the accumulators and High (continued)

North Anna Units 1 and 2 B 3.5.1-2 Revision 0, 04/02/02

Accumulators B 3.5.1 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.1 Accumulators BASES BACKGROUND The functions of the ECCS accumulators are to supply water to the reactor vessel during the blowdown phase of a loss of coolant accident (LOCA),

to provide inventory to help accomplish the refill phase that follows thereafter, and to provide Reactor Coolant System (RCS) makeup for a small break LOCA.

The blowdown phase of a large break LOCA is the initial period of the transient during which the RCS departs from equilibrium conditions, and heat from fission product decay, hot internals, and the vessel continues to be transferred to the reactor coolant. The blowdown phase of the transient ends when the RCS pressure falls to a value approaching that of the containment atmosphere.

In the refill phase of a large break LOCA, which immediately follows the blowdown phase, reactor coolant inventory has vacated the core through steam flashing and ejection out through the break. The core is essentially in adiabatic heatup. The balance of accumulator inventory is then available to help fill voids in the lower plenum and reactor vessel downcomer so as to establish a recovery level at the bottom of the core and ongoing reflood of the core with the addition of safety injection (SI) water.

The accumulators are pressure vessels partially filled with borated water and pressurized with nitrogen gas. The accumulators are passive components, since no operator or control actions are required in order for them to perform their function. Internal accumulator tank pressure is sufficient to discharge the accumulator contents to the RCS, if RCS pressure decreases below the accumulator pressure.

Each accumulator is piped into an RCS cold leg via an accumulator line and is isolated from the RCS by a motor operated isolation valve and two check valves in series.

The accumulator size, water volume, and nitrogen cover pressure are selected so that two of the three accumulators are sufficient to partially cover the core before significant clad melting or zirconium water reaction can (continued)

North Anna Units 1 and 2 B 3.5.1-1 Revision 0, 04/02/02

RCS Loops-Test Exceptions B 3.4.19 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.4.19.3 The Low Power Reactor Trips Block, P-7 interlock, must be verified to be OPERABLE in MODE 1 by LCO 3.3.1, "Reactor Trip System Instrumentation." The P-7 interlock is actuated from either the Power Range Neutron Flux, P-1O, or the Turbine Impulse Chamber Pressure, P-13 interlock. The P-7 interlock is a logic Function. An ACTUATION LOGIC TEST is performed to verify OPERABILITY of the P-7 interlock prior to initiation of startup and PHYSICS TESTS. This will ensure that the RTS is properly functioning to provide the required degree of core protection during the performance of the PHYSICS TESTS.

REFERENCES

1. 10 CFR 50, Appendix B, Section XI.

2.

UFSAR, Section 3.1.1.

North Anna Units 1 and 2 B 3.4.19-4 Revision 0, 04/02/02

RCS Loops-Test Exceptions B 3.4.19 BASES ACTIONS A.1 When THERMAL POWER is Ž the P-7 interlock setpoint 10%, the only acceptable action is to ensure the reactor trip breakers (RTBs) are opened immediately in accordance with Required Action A.1 to prevent operation of the fuel beyond its design limits. Opening the RTBs will shut down the reactor and prevent operation of the fuel outside of its design limits.

SURVEILLANCE SR 3.4.19.1 REQUIREMENTS Verification that the power level is < the P-7 interlock setpoint (10%) will ensure that the fuel design criteria are not violated during the performance of the PHYSICS TESTS.

The Frequency of once per hour is adequate to ensure that the power level does not exceed the limit. Unit operations are conducted slowly during the performance of PHYSICS TESTS and monitoring the power level once per hour is sufficient to ensure that the power level does not exceed the limit.

SR 3.4.19.2 The power range and intermediate range neutron detectors, P-10, and P-13 interlock setpoint must be verified to be OPERABLE and adjusted to the proper value. The Low Power Reactor Trips Block, P-7 interlock, is actuated from either the Power Range Neutron Flux, P-10, or the Turbine Impulse Chamber Pressure, P-13 interlock. The P-7 interlock is a logic Function with train, not channel identity. A COT is performed prior to initiation of the PHYSICS TESTS. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL OPERATIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. This will ensure that the RTS is properly aligned to provide the required degree of core protection during the performance of the PHYSICS TESTS. The SR 3.3.1.8 Frequency is sufficient for the power range and intermediate range neutron detectors to ensure that the instrumentation is OPERABLE before initiating PHYSICS TESTS.

North Anna Units 1 and 2 B 3.4. 19-3 Revision 0, 04/02/02

RCS Loops-Test Exceptions B 3.4.19 BASES APPLICABLE SAFETY ANALYSES (continued)

LCO As described in LCO 3.0.7, compliance with Test Exception LCOs is optional, and therefore no criteria of 10 CFR 50.36(c)(2)(ii) apply. Test Exception LCOs provide flexibility to perform certain operations by appropriately modifying requirements of other LCOs.

A discussion of the criteria satisfied for the other LCOs is provided in their respective Bases.

This LCO provides an exemption to the requirements of LCO 3.4.4.

The LCO is provided to allow for the performance of PHYSICS TESTS in MODE 2 (after a refueling), where the core cooling requirements are significantly different than after the core has been operating. Without the LCO, unit operations would be held bound to the normal operating LCOs for reactor coolant loops and circulation (MODES 1 and 2),

and the appropriate tests could not be performed.

In MODE 2, where core power level is considerably lower and the associated PHYSICS TESTS must be performed, operation is allowed under no flow conditions provided THERMAL POWER is

P-7 and the reactor trip setpoints of the OPERABLE power level channels are set

25% RTP. This ensures, if some problem caused the unit to enter MODE 1 and start increasing unit power, the Reactor Trip System (RTS) would automatically shut it down before power became too high, and thereby prevent violation of fuel design limits.

The exemption is allowed even though there are no bounding safety analyses. However, these tests are performed under close supervision during the test program and provide valuable information on the unit's capability to cool down without offsite power available to the reactor coolant pumps.

APPLICABILITY This LCO is applicable when performing low power PHYSICS TESTS without any forced convection flow. This testing is performed to establish that heat input from nuclear heat does not exceed the natural circulation heat removal capabilities. Therefore, no safety or fuel design limits will be violated as a result of the associated tests.

North Anna Units 1 and 2 B 3.4.19-2 Revision 0, 04/02/02

RCS Loops-Test Exceptions B 3.4.19 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.19 RCS Loops-Test Exceptions BASES BACKGROUND The primary purpose of this test exception is to provide an exception to LCO 3.4.4, "RCS Loops-MODES 1 and 2," to permit reactor criticality under no forced flow conditions during certain PHYSICS TESTS (natural circulation demonstration, station blackout, and loss of offsite power) to be performed while at low THERMAL POWER levels.Section XI of 10 CFR 50, Appendix B (Ref.

1), requires that a test program be established to ensure that structures, systems, and components will perform satisfactorily in service. All functions necessary to ensure that the specified design conditions are not exceeded during normal operation and anticipated operational occurrences must be tested. This testing is an integral part of the design, construction, and operation of the power plant as specified in General Design Criteria 1, "Quality Standards and Records" (Ref. 2).

The key objectives of a test program are to provide assurance that the facility has been adequately designed to validate the analytical models used in the design and analysis, to verify the assumptions used to predict unit response, to provide assurance that installation of equipment at the unit has been accomplished in accordance with the design, and to verify that the operating and emergency procedures are adequate. Testing is performed prior to initial criticality, during startup, and following low power operations.

The tests will include verifying the ability to establish and maintain natural circulation following a unit trip, performing natural circulation cooldown on emergency power, and during the cooldown, showing that adequate boron mixing occurs and that pressure can be controlled using auxiliary spray and pressurizer heaters powered from the emergency power sources.

APPLICABLE The tests described above require operating the unit without SAFETY ANALYSES forced convection flow and as such are not bounded by any safety analyses. However, operating experience has demonstrated this exception to be safe under the present applicability.

(continued)

North Anna Units 1 and 2 B 3.4.19-1 Revision 0, 04/02/02

RCS Isolated Loop Startup B 3.4.18 BASES SURVEILLANCE SR 3.4.18.5 (continued)

REQUIREMENTS for seal injection are required to be borated to at least the required boron concentration and are periodically verified by other specifications. The Frequency of within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months prior to initiating seal injection flow and once per hour during filling of an initially drained loop from the active RCS volume is considered a reasonable time to monitor the seal injection boron concentration.

SR 3.4.18.6 This Surveillance verifies that there is sufficient water in the RCS when filling an initially drained, isolated portion of the RCS. The volume of water required is sufficient to continue to support RHR operation in the event of the inadvertent opening of the isolation valves on three isolated and drained loops. The required level of 32%

incorporates inaccuracies due to use of instruments calibrated at cold conditions. If instruments calibrated at hot conditions are used, an indicated level of 39% is required due to the increased instrument uncertainty. The Frequency of every 15 minutes during filling of a drained, isolated loop ensures that the operators are aware of the water level during the filling operation. The Surveillance is modified by a Note which states that the Surveillance is only required to be met when utilizing the requirements of the LCO applicable to starting a drained, isolated loop.

SR 3.4.18.7 This Surveillance is performed to ensure that the boron concentration of an isolated loop satisfies the boron concentration requirements of the RCS prior to completely opening the cold leg isolation valve or opening the hot leg isolation valve. The Surveillance is modified by a Note which states that the Surveillance is only required to be met when utilizing the requirements of the LCO applicable to starting an initially drained, isolated loop. The Frequency of within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months prior to fully opening the cold leg isolation valve or opening the hot leg isolation valve is considered a reasonable time to prepare for the opening of the isolation valves.

REFERENCES

1. UFSAR, Section 15.2.6.

North Anna Units 1 and 2 B 3.4. 18-8 Revision 0, 04/02/02

RCS Isolated Loop Startup B 3.4.18 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.4.18.3 This Surveillance is performed to ensure that a filled, isolated loop is recirculated, with the hot leg isolation valve open, for at least 90 minutes at a flow rate of at least 125 gpm. This will ensure that the boron concentration and temperature of the isolated loop is similar to those of the operating loops. The Frequency of within 30 minutes prior to opening the cold leg isolation valve in a filled, isolated loop is considered a reasonable time to prepare for the opening of the cold leg isolation valve. The Surveillance is modified by a Note which states that the Surveillance is only required to be met when utilizing the requirements of the LCO applicable to starting a filled, isolated loop.

SR 3.4.18.4 This Surveillance is performed to ensure that an isolated loop is drained before opening an isolation valve to fill the isolated portion of the RCS from the RCS active volume or before initiating seal injection to the RCP in the isolated loop. This verification is performed to prevent unsampled water in a partially filled, isolated loop from mixing with the water in the RCS and potentially causing reactivity changes due to differences in boron concentration.

The Frequency of within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months prior to filling an initially drained loop from the active RCS volume or within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months of initiating seal injection to the RCP in the isolated loop is considered a reasonable time to prepare for the opening of the isolation valve. The Surveillance is modified by a Note which states that the Surveillance is only required to be met when utilizing the requirements of the LCO applicable to starting an initially drained, isolated loop.

SR 3.4.18.5 This Surveillance verifies that the boron concentration of the water used for seal injection to the RCP in the isolated loop is borated to the same requirement as the RCS. This will prevent the water used for seal injection from diluting the water in the RCS.

The LCO is modified by two Notes. Note 1 states that the Surveillance is only required to be met when utilizing the requirements of the LCO applicable to starting an initially drained, isolated loop. Note 2 states that the Surveillance is only required to be met when using blended flow as the source for RCP seal injection. The other sources (continued)

North Anna Units 1 and 2 B 3.4.18-7 Revision 0, 04/02/02

RCS Isolated Loop Startup B 3.4.18 BASES SURVEILLANCE SR 3.4.18.1 (continued)

REQUIREMENTS ensure that the temperature of the isolated loop is equalized with the temperature of the operating loops by requiring that the isolated loop is operated for at least 90 minutes with a recirculation flow of Ž 125 gpm. The safety analysis neglects the uncertainty associated with measuring recirculation flow due to the insignificant effect on the analysis. Performing the Surveillance 30 minutes prior to opening the cold leg isolation valve in the isolated loop provides reasonable assurance, based on engineering judgment, that the temperature differential will stay within limits until the cold leg isolation valve is opened. This Frequency has been shown to be acceptable through operating experience.

The Surveillance is modified by a Note which states that the Surveillance is only required to be met when utilizing the requirements of the LCO applicable to starting a filled, isolated loop.

SR 3.4.18.2 To ensure that the boron concentration of a filled, isolated loop is greater than or equal to the boron concentration required to meet the SDM of LCO 3.1.1 or the boron concentration of LCO 3.9.1, a Surveillance is performed 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months prior to opening either the hot or cold leg isolation valve. Performing the Surveillance 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months prior to opening either the hot or cold leg isolation valve provides reasonable assurance the boron concentration difference will stay within acceptable limits until the loop is unisolated.

This Frequency is a reasonable amount of time given that the isolated loop boron concentration changes slowly and the time required to request and have analyzed a boron concentration measurement prior to opening the isolation valve.

The Surveillance is modified by a Note which states that the Surveillance is only required to be met when utilizing the requirements of the LCO applicable to starting a filled, isolated loop.

North Anna Units 1 and 2 B 3.4.18-6 Revision 0, 04/02/02

RCS Isolated Loop Startup B 3.4.18 BASES ACTIONS D.1, D.2, E.1 and E.2 (continued)

Required Actions D.1, D.2, E.1 and E.2 apply when the requirements of LCO 3.4.18.b are not met and an initially drained, isolated loop is filled from the active RCS volume by opening a loop isolation valve. If the RCS water level requirement is not met, there is the possibility of insufficient net positive suction head to support the RHR pumps.

If the RCP seal injection boron concentration requirements are not met, there is the possibility of diluting the reactor coolant boron concentration below that which is required. In both cases, the isolation valve(s) are to be closed and the requirements of the LCO must be met prior to opening the isolation valves. If both isolation valves on the loop are not fully opened within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , the lack of flow through the closed valve(s) could result in the boron concentration of the previously isolated portion of the loop being significantly different from the remainder of the RCS. The boron concentration in the isolated loop must be verified to be within limit or the isolation valve(s) are to be closed and the requirements of the LCO must be met prior to opening the isolation valves.

F.1 If power is restored to one or more closed loop isolation valve operators without the initial conditions in LCO 3.4.18.a.1 or LCO 3.4.18.b.1 being met, the potential exists for accidental startup of an isolated loop and possible reduction in shutdown margin. The loop isolation valves have motor operators. Therefore, these valves will maintain their last position when power is removed from the valve operator.

With power applied to the valve operators, only the interlocks prevent the valve from being operated. Although operating procedures and interlocks make the occurrence of this event unlikely, the prudent action is to remove power from the loop isolation valve operators. The Completion Time of 30 minutes to remove power from the loop isolation valve operators is sufficient considering the complexity of the task.

SURVEILLANCE SR 3.4.18.1 REQUIREMENTS This Surveillance is performed to ensure that the temperature differential between a filled, isolated loop and the operating loops is

20 0F. The loop stop valve interlocks (continued)

North Anna Units 1 and 2 B 3.4.18-5 Revision 0, 04/02/02

RCS Isolated Loop Startup B 3.4.18 BASES LCO (continued)

APPLICABILITY the isolated loop, the RCP seals must be filled with water.

The boron concentration of the water used for seal injection must meet the same requirements as the reactor coolant system and the loop must be drained prior to starting seal injection in order to be sure that no water at a boron concentration less than required remains in the isolated loop.

The LCO is modified by a Note which allows a hot or cold leg isolation valve to be closed for up to two hours without considering the loop isolated and meeting the LCO requirements when opening the closed valve. This allows for necessary maintenance and testing on the valves and the valve operators. If the closed valve is not reopened with two hours, it is necessary to close both isolation valves on the affected loop and follow the requirements of the LCO when reopening the isolation valves. This is required because there is a possibility that the water in the isolated loop has become diluted or cooled to the point that reintroduction of the water into to the reactor vessel could result in a significant reactivity change.

In MODES 5 and 6, RCS loops may be isolated to perform maintenance.

When a filled, isolated loop is to be put in operation, the isolated loop boron concentration and temperature must be controlled prior to opening the loop isolation valves in order to avoid the potential for positive reactivity addition. When an initially drained, isolated loop is to be put into operation, sufficient RCS inventory must be available to ensure that RCS water level continues to support RHR operation. The LCO water level requirement is sufficient to ensure that RCS water level does not drop below that required for RHR operation.

In MODES 1, 2, 3 and 4, the loop isolation valves are required to be open with power to the valve operators removed by LCO 3.4.17, "RCS Loop Isolation Valves."

ACTIONS A.1, B.1, and C.1 Required Actions A.1, B.1, and C.1 apply when the requirements of LCO 3.4.18.a are not met and a loop isolation valve has been opened. Therefore, the Actions require immediate closure of isolation valves to preclude a boron dilution event or a cold water event or RCS water level falling below that required for RHR operation.

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.4.18-4

RCS Isolated Loop Startup B 3.4.18 BASES LCO Loop isolation valves are used for performing maintenance when the unit is in MODE 5 or 6. This LCO governs the return to operation of an isolated loop (i.e., the hot and cold leg loop isolation valves are initially closed) and ensures that the loop isolation valves remain closed unless acceptable conditions for opening the valves are established.

There are two methods for returning an isolated loop to operation. The first method is used when the isolated loop is filled with water. When using the filled loop method, the hot leg isolation valve (e.g., the inlet valve to the isolated portion of the loop) is opened first. As described in LCO 3.4.18.a, the water in the isolated loop must be borated to at least the boron concentration needed to provide the required shutdown margin prior to opening the hot leg isolation valve. This ensures that the RCS boron concentration is not reduced below that required to maintain the required shutdown margin. The water in the isolated loop is then mixed with the water in the RCS by establishing flow through the recirculation line (which bypasses the cold leg isolation valve). After the flow through the recirculation line has thoroughly mixed the water in the isolated loop with the water in the RCS and it is verified that the isolated loop temperature is no more than 20°F below the temperature of the RCS (to avoid reactivity additions due to reduced RCS temperature), the cold leg isolation valve may be opened.

The second method for returning an isolated loop to operation is described in LCO 3.4.18.b and is used when the isolated loop is drained of water. In the drained loop method, the water in the RCS is used to fill the isolated portion of the loop. The LCO also requires that the pressurizer water level be established sufficiently high prior to and during the opening of the isolation valves to ensure that the inadvertent opening of all three sets of loop isolation valves on three drained and isolated loops would not result in loss of net positive suction head for the Residual Heat Removal system.

The LCO is modified by a Note which allows Reactor Coolant Pump (RCP) seal injection to be initiated to a RCP in a drained, isolated loop. This is to support vacuum assisted backfill of the loop. In this method, a vacuum is drawn on the isolated loop prior to opening the cold leg isolation valve in order to minimize the amount of trapped air in the loop and to minimize the need to run the RCP in the isolated loop to clear out air pockets. In order to draw a vacuum on (continued)

North Anna Units 1 and 2 B 3.4. 18-3 Revision 0, 04/02/02

RCS Isolated Loop Startup B 3.4.18 BASES BACKGROUND

b.

(continued)

> 90 minutes. This ensures that the temperatures of both the hot leg and cold leg of the isolated loop are within 20°F of the operating loops and the boron concentration of the isolated loop is greater than or equal to the boron concentration required to meet the SDM of LCO 3.1.1 or the boron concentration of LCO 3.9.1. Compliance with the recirculation requirement is ensured by operating procedures and automatic interlocks.

c. Other automatic interlocks prevent opening the hot leg loop isolation valve unless the cold leg loop isolation valve is fully closed.

The startup of an initially drained, isolated loop is performed in a controlled manner to ensure that sufficient water is available in the RCS to support RHR operation. In this case, the automatic interlocks are defeated and the isolated loop is filled under administrative control.

APPLICABLE During startup of a filled isolated loop, the cold leg loop SAFETY ANALYSES isolation valve interlocks and operating procedures prevent opening the valve until the isolated loop and active RCS volume temperatures are equalized and the boron concentration is within limit. This ensures that any undesirable reactivity effect from the isolated loop does not occur.

An evaluation of the effects of opening the loop isolation valves with the boron concentration or temperature requirements of the filled, isolated portion not met is described in Reference 1. Failure to follow the requirements in the LCO could result in the RCS boron concentration or coolant temperature being reduced with a corresponding reduction in SDM.

The evaluation concluded that adequate time is available for an operator to identify and respond to such an event prior to reactor criticality.

The initial RCS volume requirements ensure that the operation of the RHR System is not impaired during the filling of an isolated loop from the RCS should the isolation valves on three drained, isolated loops be inadvertently opened.

RCS isolated loop startup satisfies Criterion 2 of 10 CFR 50.36(c) (2) (ii).

North Anna Units 1 and 2 B 3.4.18-2 Revision 0, 04/02/02

RCS Isolated Loop Startup B 3.4.18 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.18 RCS Isolated Loop Startup BASES BACKGROUND The RCS may be operated with loops isolated in MODES 5 and 6 in order to perform maintenance. While operating with a loop isolated, there is potential for inadvertently opening the isolation valves in the isolated loop. In this event, any coolant in the isolated loop would begin to mix with the coolant in the operating loops. This situation has the potential of causing a positive reactivity addition with a corresponding reduction of SDM if:

a. The temperature in the isolated loop is lower than the temperature in the operating Residual Heat Removal (RHR) or RCS loops (cold water incident); or

b. The boron concentration in the isolated loop is lower than the boron concentration required to meet the SDM of LCO 3.1.1 or the boron concentration of LCO 3.9.1 (boron dilution incident).

If the loop is drained of coolant, startup of an isolated loop will cause coolant to flow from the RCS into the isolated portion of the loop with the potential to lower the RCS water level and cause a loss of suction to the RHR System pumps.

As discussed in the UFSAR (Ref.

1), the startup of a filled, isolated loop is done in a controlled manner that virtually eliminates any sudden reactivity addition from cold water or boron dilution because:

a. This LCO and unit operating procedures require that the boron concentration in the isolated loop be equal to or greater than the boron concentration required to meet the SDM of LCO 3.1.1 or the boron concentration of LCO 3.9.1 prior to opening the isolation valves, thus eliminating the potential for introducing coolant from the isolated loop that could dilute the boron concentration in the operating loops below the required limit.

b. The cold leg loop isolation valve cannot be opened unless the loop has been operated with the hot leg isolation valve open and recirculation flow of Ž 125 gpm for (continued)

North Anna Units 1 and 2 B 3.4. 18-1 Revision 0, 04/02/02

Intentionally Blank

RCS Loop Isolation Valves B 3.4.17 BASES ACTIONS B.1, B.2, and B.3 (continued) resulting in positive reactivity insertion. The Completion Time of Required Action B.1 allows time for borating the operating loops to a shutdown boration level such that the unit can be brought to MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.4.17.1 REQUIREMENTS The Surveillance is performed to ensure that the RCS loop isolation valves are open prior to removing power from the isolation valve operator. There is no remote position indication available after power is removed from the valve operators. The valves will maintain their last position when power is removed for the valve operator.

SR 3.4.17.2 The primary function of this Surveillance is to ensure that power is removed from the valve operators, since SR 3.4.4.1 of LCO 3.4.4, "RCS Loops-MODES 1 and 2," ensures that the loop isolation valves are open by verifying every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months that all loops are operating and circulating reactor coolant. The Frequency of 31 days ensures that the required flow will remain available, is based on engineering judgment, and has proven to be acceptable. Operating experience has shown that the failure rate is so low that the 31 day Frequency is justified.

REFERENCES

1. UFSAR, Section 15.2.6.

North Anna Units 1 and 2 B 3.4.17-3 Revision 0, 04/02/02

RCS Loop Isolation Valves B 3.4.17 BASES LCO The safety analyses assume that the loop isolation valves (continued) are open in any RCS loops required to be OPERABLE by LCO 3.4.4, "RCS Loops-MODES 1 and 2," LCO 3.4.5, "RCS Loops-MODE 3," or LCO 3.4.6, "RCS Loops-MODE 4."

APPLICABILITY In MODES 1 through 4, this LCO ensures that the loop isolation valves are open and power to the valve operators is removed. The safety analyses assume that the loop isolation valves are open in any RCS loops required to be OPERABLE.

In MODES 5 and 6, the loop isolation valves may be closed.

Controlled startup of an isolated loop is governed by the requirements of LCO 3.4.18, "RCS Isolated Loop Startup."

ACTIONS The Actions have been provided with a Note to clarify that all RCS loop isolation valves for this LCO are treated as separate entities, each with separate Completion Times, i.e., the Completion Time is on a component basis.

A.1 If power is inadvertently restored to one or more loop isolation valve operators, the potential exists for accidental isolation of a loop. The loop isolation valves have motor operators. Therefore, these valves will maintain their last position when power is removed from the valve operator. With power applied to the valve operators, only the interlocks prevent the valve from being operated.

Although operating procedures and interlocks make the occurrence of this event unlikely, the prudent action is to remove power from the loop isolation valve operators. The Completion Time of 30 minutes to remove power from the loop isolation valve operators is sufficient considering the complexity of the task.

B.1, B.2, and B.3 Should a loop isolation valve be closed in MODES 1 through 4, the affected loop isolation valve(s) must remain closed and the unit placed in MODE 5. Once in MODE 5, the isolated loop may be started in a controlled manner in accordance with LCO 3.4.18, "RCS Isolated Loop Startup."

Opening the closed isolation valve in MODES 1 through 4 could result in colder water or water at a lower boron concentration being mixed with the operating RCS loops (continued)

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.4.17-2

RCS Loop Isolation Valves B 3.4.17 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.17 RCS Loop Isolation Valves BASES BACKGROUND APPLICABLE SAFETY ANALYSES LCO The reactor coolant loops are equipped with loop isolation valves that permit any loop to be isolated from the reactor vessel.

One valve is installed on each hot leg and one on each cold leg. The loop isolation valves are used to perform maintenance on an isolated loop. Power operation with a loop isolated is not permitted.

To ensure that inadvertent closure of a loop isolation valve does not occur, the valves must be open with power to the valve operators removed in MODES 1, 2, 3 and 4. If the valves are closed, a set of administrative controls and equipment interlocks must be satisfied prior to opening the isolation valves as described in LCO 3.4.18, "RCS Isolated Loop Startup."

The safety analyses performed for the reactor at power assume that all reactor coolant loops are initially in operation and the loop isolation valves are open. This LCO places controls on the loop isolation valves to ensure that the valves are not inadvertently closed in MODES 1, 2, 3 and 4. The inadvertent closure of a loop isolation valve when the Reactor Coolant Pumps (RCPs) are operating will result in a partial loss of forced reactor coolant flow (Ref.

1).

If the reactor is at power at the time of the event, the effect of the partial loss of forced coolant flow is a rapid increase in the coolant temperature which could result in DNB with subsequent fuel damage if the reactor is not tripped by the Low Flow reactor trip. If the reactor is shutdown and an RCS loop is in operation removing decay heat, closure of the loop isolation valve associated with the operating loop could also result in increasing coolant temperature and the possibility of fuel damage.

RCS Loop Isolation Valves satisfy Criterion 2 of 10 CFR 50.36 (c) (2) (ii).

This LCO ensures that the loop isolation valves are open and power to the valve operators is removed.

Loop isolation valves are used for performing maintenance in MODES 5 and 6.

(continued)

North Anna Units 1 and 2 B 3.4.17-1 Revision 0, 04/02/02

RCS Specific Activity B 3.4.16 BASES REFERENCES

1. 10 CFR 100.11.

2.

UFSAR, Section 15.4.3.

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.4.16-6

RCS Specific Activity B 3.4.16 BASES SURVEILLANCE SR 3.4.16.1 (continued)

REQUIREMENTS sum of the degassed gamma activities and the gaseous gamma activities in the sample taken. This Surveillance provides an indication of any increase in gross specific activity.

Trending the results of this Surveillance allows proper remedial action to be taken before reaching the LCO limit under normal operating conditions. The Surveillance is applicable in MODES 1 and 2, and in MODE 3 with Tavg at least 500'F. The 7 day Frequency considers the unlikelihood of a gross fuel failure during the time.

SR 3.4.16.2 This Surveillance is performed in MODE 1 only to ensure iodine remains within limit during normal operation and following fast power changes when fuel failure is more apt to occur. The 14 day Frequency is adequate to trend changes in the iodine activity level, considering gross activity is monitored every 7 days. The Frequency, between 2 and 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months after a power change Ž 15% RTP within a 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months period, is established because the iodine levels peak during this time following fuel failure; samples at other times would provide inaccurate results.

SR 3.4.16.3 A radiochemical analysis for E determination is required every 184 days (6 months) with the unit operating in MODE I equilibrium conditions. The E determination directly relates to the LCO and is required to verify unit operation within the specified gross activity LCO limit. The analysis for E is a measurement of the average energies per disintegration for isotopes with half lives longer than 15 minutes, excluding iodines. The Frequency of 184 days recognizes E does not change rapidly.

This SR has been modified by a Note that indicates sampling is required to be performed within 31 days after a minimum of 2 effective full power days and 20 days of MODE 1 operation have elapsed since the reactor was last subcritical for at least 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . This ensures that the radioactive materials are at equilibrium so the analysis for E is representative and not skewed by a crud burst or other similar abnormal event.

North Anna Units 1 and 2 B 3.4.16-5 Revision 0, 04/02/02

RCS Specific Activity B 3.4.16 BASES ACTIONS A.1 and A.2 With the DOSE EQUIVALENT 1-131 greater than the LCO limit, samples at intervals of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months must be taken to demonstrate that the limits of Figure 3.4.16-1 are not exceeded.

The Completion Time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is required to obtain and analyze a sample. Sampling is done to continue to provide a trend.

The DOSE EQUIVALENT 1-131 must be restored to within limits within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . The Completion Time of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is required, if the limit violation resulted from normal iodine spiking.

B.1 With the gross specific activity in excess of the allowed limit, the unit must be placed in a MODE in which the requirement does not apply.

The change within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to MODE 3 and RCS average temperature < 500OF lowers the saturation pressure of the reactor coolant below the setpoints of the main steam safety valves and prevents venting the SG to the environment in an SGTR event. The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach MODE 3 below 5007F from full power conditions in an orderly manner and without challenging unit systems.

C.1 If a Required Action and the associated Completion Time of Condition A is not met or if the DOSE EQUIVALENT 1-131 is in the unacceptable region of Figure 3.4.16-1, the reactor must be brought to MODE 3 with RCS average temperature < 500°F within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach MODE 3 below 500'F from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.4.16.1 REQUIREMENTS SR 3.4.16.1 requires performing a gamma isotopic analysis as a measure of the gross specific activity of the reactor coolant at least once every 7 days. While basically a quantitative measure of radionuclides with half lives longer than 15 minutes, excluding iodines, this measurement is the (continued)

North Anna Units 1 and 2 Revision 0, 04/02/02 B 3.4.16-4

RCS Specific Activity B 3.4.16 BASES APPLICABLE The limits on RCS specific activity are also used for SAFETY ANALYSES establishing standardization in radiation shielding and (continued) plant personnel radiation protection practices.

RCS specific activity satisfies Criterion 2 of 10 CFR 50.36(c) (2) (ii).

LCO The specific iodine activity is limited to 1.0 gCi/gm DOSE EQUIVALENT 1-131, and the gross specific activity in the reactor coolant is limited to the number of pCi/gm equal to 100 divided by F (average disintegration energy of the sum of the average beta and gamma energies of the coolant nuclides). The limit on DOSE EQUIVALENT 1-131 ensures the 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months thyroid dose to an individual at the site boundary during the Design Basis Accident (DBA) will be a small fraction of the allowed thyroid dose. The limit on gross specific activity ensures the 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months whole body dose to an individual at the site boundary during the DBA will be a small fraction of the allowed whole body dose.

The SGTR accident analysis (Ref.

2) shows that the 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months site boundary dose levels are within acceptable limits.

Violation of the LCO may result in reactor coolant radioactivity levels that could, in the event of an SGTR, lead to site boundary doses that exceed the 10 CFR 100 dose guideline limits.

APPLICABILITY In MODES 1 and 2, and in MODE 3 with RCS average temperature

Ž 500F, operation within the LCO limits for DOSE EQUIVALENT 1-131 and gross specific activity are necessary to contain the potential consequences of an SGTR to within the acceptable site boundary dose values.

For operation in MODE 3 with RCS average temperature < 5000F, and in MODES 4 and 5, the release of radioactivity in the event of a SGTR is unlikely since the saturation pressure of the reactor coolant is below the lift pressure settings of the main steam safety valves and SG power operated relief valves.

North Anna Units 1 and 2 B 3.4.16-3 Revision 0, 04/02/02

RCS Specific Activity B 3.4.16 BASES APPLICABLE The analysis for the SGTR accident establishes the SAFETY ANALYSES acceptance limits for RCS specific activity. Reference to (continued) this analysis is used to assess changes to the unit that could affect RCS specific activity, as they relate to the acceptance limits.

The analysis is for two cases of reactor coolant specific activity. One case assumes specific activity at 1.0 gCi/gm DOSE EQUIVALENT 1-131 with a concurrent large iodine spike that increases the 1-131 release rate to the reactor coolant by a factor of 500 immediately after the accident. The second case assumes the initial reactor coolant iodine activity at 60.0 gCi/gm DOSE EQUIVALENT 1-131 due to a pre-accident iodine spike caused by an RCS transient. In both cases, the noble gas activity in the reactor coolant assumes 1% failed fuel, which closely equals the LCO limit of 100/E jiCi/gm for gross specific activity.

The radiologically limiting SGTR analysis also assumes a loss of offsite power at the same time as the SGTR event. The SGTR causes a reduction in reactor coolant inventory. The reduction initiates a reactor trip from a low pressurizer pressure signal or an RCS overtemperature AT signal.

The coincident loss of offsite power causes the steam dump valves to close to protect the condenser. The rise in pressure in the ruptured SG discharges radioactively contaminated steam to the atmosphere through the SG power operated relief valves and the main steam safety valves. The unaffected SGs remove core decay heat by venting steam to the atmosphere until the cooldown ends.

The safety analysis shows the radiological consequences of an SGTR accident are within a small fraction of the Reference 1 dose guideline limits. Operation with iodine specific activity levels greater than the LCO limit is permissible, if the activity levels do not exceed the limits shown in Figure 3.4.16-1, in the applicable specification, for more than 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

The remainder of the above LCO limit permissible iodine levels shown in Figure 3.4.16-1 are acceptable because of the low probability of a SGTR accident occurring during the established 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months time limit. The occurrence of an SGTR accident at these permissible levels could increase the site boundary dose levels, but still be within 10 CFR 100 dose guideline limits.

(continued)

North Anna Units 1 and 2 B 3.4.16-2 Revision 0, 04/02/02

RCS Specific B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.16 RCS Specific Activity BASES BACKGROUND APPLICABLE SAFETY ANALYSES The maximum dose to the whole body and the thyroid that an individual at the site boundary can receive for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months during an accident is specified in 10 CFR 100 (Ref.

1). The limits on specific activity ensure that the doses are held to a small fraction of the 10 CFR 100 limits during analyzed transients and accidents.

The RCS specific activity LCO limits the allowable concentration level of radionuclides in the reactor coolant.

The LCO limits are established to minimize the offsite radioactivity dose consequences in the event of a steam generator tube rupture (SGTR) accident.

The LCO contains specific activity limits for both DOSE EQUIVALENT 1-131 and gross specific activity. The allowable levels are intended to limit the 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months dose at the site boundary to a small fraction of the 10 CFR 100 dose guideline limits. The limits in the LCO are standardized, based on parametric evaluations of offsite radioactivity dose consequences for typical site locations.

The parametric evaluations showed the potential offsite dose levels for a SGTR accident were an appropriately small fraction of the 10 CFR 100 dose guideline limits. Each evaluation assumes a broad range of site applicable atmospheric dispersion factors in a parametric evaluation.

The LCO limits on the specific activity of the reactor coolant ensures that the resulting 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months doses at the site boundary will not exceed a small fraction of the 10 CFR 100 dose guideline limits following a SGTR accident. The SGTR safety analysis (Ref. 2) assumes the specific activity-of the reactor coolant at the LCO limit and an existing reactor coolant steam generator (SG) tube leakage rate of 1 gpm. The safety analysis assumes the specific activity of the secondary coolant at its limit of 0.1 gCi/gm DOSE EQUIVALENT 1-131 from LCO 3.7.7, "Secondary Specific Activity."

(continued)

North Anna Units 1 and 2 Activity B 3.4.16 B 3.4.16-1 Revision 0, 04/02/02

v t e Letter Sequence Draft Other
TAC:MB0799, Nis Power Range Channel Daily SR TS Change to Address LOW Power Decalibration, Revise Containment Requirements During Handling Irradiated Fuel and Core Alterations (Approved, Closed) TAC:MB0800, Nis Power Range Channel Daily SR TS Change to Address LOW Power Decalibration, Revise Containment Requirements During Handling Irradiated Fuel and Core Alterations (Approved, Closed)
Initiation Request, Request, Request, Request Acceptance... Administration Questions Answers Results Approval Other: ML020650715, ML020840253, ML021220053, ML021220061, ML021220067, ML021220088, ML021220108, ML021220166, ML021220192, ML021220214, ML021220221, ML021220224, ML021220254, ML021550518
MONTHYEAR2002-02-20 [Table View]

ML020700282

Text

Navigation menu

Search