Text

Part 6 of 6 - Tech Spec Pages for Amendments 231 and 212 for North Anna, Units 1 & 2. Pages B 3.8.2-1 Through B 3.9.7-2
	ML021220221
Person / Time
Site:	North Anna
Issue date:	04/05/2002
From:	; Office of Nuclear Reactor Regulation
To:	;
References
	TAC MB0799, TAC MB0800
	Download: ML021220221 (92)
	v • d • e

AC Sources-Shutdown B 3.8.2 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.2 AC Sources-Shutdown BASES BACKGROUND A description of the AC sources is provided in the Bases for LCO 3.8.1, "AC Sources-Operating."

APPLICABLE The OPERABILITY of the minimum AC sources during MODES 5 SAFETY ANALYSES and 6 and during movement of recently irradiated fuel assemblies ensures that:

a. The unit can be maintained in the shutdown or refueling condition for extended periods;

b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and

c. Adequate AC electrical power is provided to mitigate events postulated during shutdown, such as a fuel handling accident involving handling recently irradiated fuel.

Due to radioactive decay, AC electrical power is only required to mitigate fuel handling accident involving handling recently irradiated fuel. (i.e., fuel that has occupied part of a critical reactor core within a time frame established by analysis. The term recently is defined as all irradiated fuel assemblies, until analysis is performed to determine a specific time frame.)

In general, when the unit is shut down, the Technical Specifications requirements ensure that the unit has the capability to mitigate the consequences of postulated accidents. However, assuming a single failure and concurrent loss of all offsite or all onsite power is not required. The rationale for this is based on the fact that many Design Basis Accidents (DBAs) that are analyzed in MODES 1, 2, 3, and 4 have no specific analyses in MODES 5 and 6. Worst case bounding events are deemed not credible in MODES 5 and 6 because the energy contained within the reactor pressure boundary, reactor coolant temperature and pressure, and the corresponding stresses result in the probabilities of occurrence being significantly reduced or eliminated, and in (continued)

Revision 0 North Anna Units 1 and 2 B 3.8.2-1

AC Sources-Shutdown B 3.8.2 BASES APPLICABLE minimal consequences. These deviations from DBA analysis SAFETY ANALYSES assumptions and design requirements during shutdown (continued) conditions are allowed by the LCO for required systems.

During MODES 1, 2, 3,

and 4, various deviations from the analysis assumptions and design requirements are allowed within the Required Actions. This allowance is in recognition that certain testing and maintenance activities must be conducted provided an acceptable level of risk is not exceeded. During MODES 5 and 6, performance of a significant number of required testing and maintenance activities is also required. In MODES 5 and 6, the activities are generally planned and administratively controlled.

Relaxations from MODE 1, 2, 3, and 4 LCO requirements are acceptable during shutdown modes based on:

a. The fact that time in an outage is limited. This is a risk prudent goal as well as a utility economic consideration.

b. Requiring appropriate compensatory measures for certain conditions. These may include administrative controls, reliance on systems that do not necessarily meet typical design requirements applied to systems credited in operating MODE analyses, or both.

c. Prudent utility consideration of the risk associated with multiple activities that could affect multiple systems.

d. Maintaining, to the extent practical, the ability to perform required functions (even if not meeting MODE 1, 2, 3, and 4 OPERABILITY requirements) with systems assumed to function during an event.

In the event of an accident during shutdown, this LCO ensures the capability to support systems necessary to avoid immediate difficulty, assuming either a loss of all offsite power or a loss of all onsite emergency diesel generator (EDG) power.

The AC sources satisfy Criterion 3 of 10 CFR 50.36(c) (2) (ii).

LCO One offsite circuit capable of supplying the onsite Class 1E power distribution subsystem(s) of LCO 3.8.10, "Distribution Systems-Shutdown," ensures that all required loads are (continued)

Revision 0 North Anna Units 1 and 2 B 3.8.2-2

AC Sources-Shutdown B 3.8.2 BASES LCO powered from offsite power. An OPERABLE EDG, associated with (continued) the distribution system trains required to be OPERABLE by LCO 3.8.10, ensures a diverse power source is available to provide electrical power support, assuming a loss of the offsite circuit. Together, OPERABILITY of the required offsite circuit and EDG ensures the availability of sufficient AC sources to operate the unit in a safe manner and to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents involving handling recently irradiated fuel).

The qualified offsite circuit must be capable of maintaining rated frequency and voltage, and accepting required loads during an accident, while connected to the Engineered Safety Feature (ESF) bus(es). Qualified offsite circuits are those that are described in the UFSAR and are part of the licensing basis for the unit.

Offsite circuits consist of 34.5 kV buses 3, 4, and 5 supplying the Reserve Station Service Transformer(s) (RSST) which feed the transfer buses. The D, E, and F transfer buses supply the onsite electrical power to the four emergency buses for the two units. Unit 1 emergency bus H is fed through the F transfer bus from the C RSST. Unit I emergency bus J is fed through the D transfer bus from the A RSST.

Unit 1 station service bus 1B can be an alternate feed for Unit 1 H emergency bus, while Unit 1 J bus may be fed from Unit 2 station service bus 2B. Unit 2 emergency bus H is fed through the E transfer bus from the B RSST. Unit 2 emergency bus J is fed through the F transfer bus from the C RSST. The RSSTs can be fed by any 34.5 kV bus (3, 4, or 5) provided RSSTs A and B are fed from a different 34.5 kV bus than RSST C.

The EDG must be capable of starting, accelerating to rated speed and voltage, and connecting to its respective ESF bus on detection of bus undervoltage or degraded voltage. The EDG must be capable of accepting required loads within the assumed loading sequence intervals, and continue to operate until offsite power can be restored to the ESF bus. These capabilities are required to be met from a variety of initial conditions such as EDG in standby with the engine hot and the EDG in standby at ambient conditions.

Proper sequencing of loads is a required function for EDG OPERABILITY.

(conti nued)

Revision 0 North Anna Units 1 and 2 B 3.8.2-3

AC Sources-Shutdown B 3.8.2 BASES LCO It is acceptable for trains to be cross tied during shutdown (continued) conditions, allowing a single offsite power circuit to supply all required trains.

APPLICABILITY The AC sources required to be OPERABLE in MODES 5 and 6 and during movement of recently irradiated fuel assemblies provide assurance that:

a. Systems to provide adequate coolant inventory makeup are available for the irradiated fuel assemblies in the core;

b. Systems needed to mitigate a fuel handling accident involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within a time frame established by analysis. The term recently is defined as all irradiated fuel assemblies, until analysis is performed to determine a specific time frame.) are available;

c. Systems necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and

d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.

The AC power requirements for MODES 1, 2, 3, and 4 are covered in LCO 3.8.1.

ACTIONS A.1 An offsite circuit would be considered inoperable if it were not available to the necessary portions of the electrical power distribution subsystem(s).

One train with offsite power available may be capable of supporting sufficient required features to allow continuation of CORE ALTERATIONS and recently irradiated fuel movement. By the allowance of the option to declare required features inoperable, with no offsite power available, appropriate restrictions will be implemented in accordance with the affected required features LCO's ACTIONS.

Revision 0 North Anna Units 1 and 2 B 3.8.2-4

AC Sources-Shutdown B 3.8.2 BASES ACTIONS (continued)

A.2.1, A.2.2, A.2.3, A.2.4, B.1, B.2, B.3, and B.4 With the offsite circuit not available to all required trains, the option would still exist to declare all required features inoperable. Since this option may involve undesired administrative efforts, the allowance for sufficiently conservative actions is made. With the required EDG inoperable, the minimum required diversity of AC power sources is not available. It is, therefore, required to suspend CORE ALTERATIONS, movement of recently irradiated fuel assemblies, and operations involving positive reactivity additions that could result in loss of required SDM (MODE 5) or boron concentration (MODE 6). Suspending positive reactivity additions that could result in failure to meet the minimum SDM or boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than what would be required in the RCS for minimum SDM or refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. Introduction of temperature changes including temperature increases when operating with a positive MTC must also be evaluated to ensure they do not result in a loss of required SDM.

Suspension of these activities does not preclude completion of actions to establish a safe conservative condition. These actions minimize the probability or the occurrence of postulated events. It is further required to immediately initiate action to restore the required AC sources and to continue this action until restoration is accomplished in order to provide the necessary AC power to the unit safety systems.

The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required AC electrical power sources should be completed as quickly as possible in order to minimize the time during which the unit safety systems may be without sufficient power.

Pursuant to LCO 3.0.6, the Distribution System's ACTIONS would not be entered even if all AC sources to it are inoperable, resulting in de-energization. Therefore, the Required Actions of Condition A are modified by a Note to indicate that when Condition A is entered with no AC power to (continued)

Revision 0 North Anna Units 1 and 2 B 3.8.2-5

AC Sources-Shutdown B 3.8.2 BASES ACTIONS A.2.1, A.2.2, A.2.3, A.2.4, B.1, B.2. B.3, and B.4 (continued) any required ESF bus, the ACTIONS for LCO 3.8.10 must be immediately entered. This Note allows Condition A to provide requirements for the loss of the offsite circuit, whether or not a train is de-energized. LCO 3.8.10 would provide the appropriate restrictions for the situation involving a de-energized train.

SURVEILLANCE SR 3.8.2.1 REQUIREMENTS SR 3.8.2.1 requires the SRs from LCO 3.8.1 that are necessary for ensuring the OPERABILITY of the AC sources in other than MODES 1, 2, 3, and 4. SR 3.8.1.8 is not required to be met since only one offsite circuit is required to be OPERABLE.

SR 3.8.1.11 and SR 3.8.1.17 are not required because the ESF actuation signals are not required to be OPERABLE.

SR 3.8.1.18 is excepted because starting independence is not required with the EDG(s) that is not required to be OPERABLE.

This SR is modified by a Note. The reason for this Note is to preclude requiring the required OPERABLE EDG(s) from being paralleled with the offsite power network or otherwise rendered inoperable during performance of SRs, and to preclude de-energizing a required 4160 V ESF bus or disconnecting a required offsite circuit during performance of SRs. With limited AC sources available, a single event could compromise both the required circuit and the EDG. It is the intent that these SRs must still be capable of being met, but actual performance is not required during periods when the EDG and offsite circuit is required to be OPERABLE. Refer to the corresponding Bases for LCO 3.8.1 for a discussion of each SR.

REFERENCES None.

Revision 0 North Anna Units 1 and 2 B 3.8.2-6

Diesel Fuel Oil and Starting Air B 3.8.3 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.3 Diesel Fuel Oil and Starting Air BASES BACKGROUND The fuel oil storage system has sufficient capacity to operate two EDGs for a period of 7 days with each supplying the maximum post loss of coolant accident load demand discussed in the UFSAR, Section 9.5.4.2 (Ref. 1). This onsite fuel oil capacity is sufficient to operate the EDGs for longer than the time to replenish the onsite supply from outside sources.

The fuel oil storage system consists of two underground tanks. Fuel oil is transferred from an underground tank to each EDG day tank by a lead fuel oil transfer pump. An additional underground tank and fuel oil transfer pump is associated with each EDG day tank to provide a redundant subsystem. Independent level switches on the day tank operate the lead and backup fuel oil transfer subsystems.

All outside tanks, pumps, and piping are located underground or in a missile protected area.

For proper operation of the standby EDGs, it is necessary to ensure the proper quality of the fuel oil. Regulatory Guide 1.137 (Ref. 2) addresses the recommended fuel oil practices as supplemented by ANSI N195 (Ref. 3). The fuel oil properties governed by these SRs are the water and sediment content, the kinematic viscosity, specific gravity (or API gravity), and impurity level.

Each EDG has an air start system that contains two separate and independent subsystems. Normally, each subsystem is aligned to provide starting air to the associated EDG.

Each subsystem consists of a receiver and a compressor. Only one air start subsystem is required for the EDG to be considered OPERABLE.

APPLICABLE The initial conditions of Design Basis Accident (DBA) and SAFETY ANALYSES transient analyses in the UFSAR, Chapter 6 (Ref. 4), and in the UFSAR, Chapter 15 (Ref. 5), assume Engineered Safety Feature (ESF) systems are OPERABLE. The EDGs are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that fuel, Reactor Coolant System and (continued)

Revision 0 North Anna Units 1 and 2 B 3.8.3-1

Diesel Fuel Oil and Starting Air B 3.8.3 BASES APPLICABLE containment design limits are not exceeded. These limits are SAFETY ANALYSES discussed in more detail in the Bases for Section 3.2, Power (continued)

Distribution Limits; Section 3.4, Reactor Coolant System (RCS); and Section 3.6, Containment Systems.

The DBA and transient analyses assume the operation of one EDG associated with the unit on which an accident is postulated to occur and the operation of one EDG on the unit which is unaffected by the accident to support shared systems.

LCO 3.8.1 requires two EDGs to be OPERABLE and one EDG from the other unit to be OPERABLE.

However, only sufficient fuel oil to operate one EDG and one EDG on the other unit is required to satisfy the assumptions of the DBA and transient analysis and to support EDG OPERABILITY.

Since diesel fuel oil and the air start subsystem support the operation of the standby AC power sources, they satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO Stored diesel fuel oil is required to have sufficient supply for 7 days of full load operation for two EDGs. It is also required to meet specific standards for quality. This requirement, in conjunction with an ability to obtain replacement supplies within 2 days, supports the availability of EDGs required to shut down the reactor and to maintain it in a safe condition for an anticipated operational occurrence (AOO) or a postulated DBA with loss of offsite power. EDG day tank fuel requirements, as well as transfer capability from the storage tank to the day tank, are addressed in LCO 3.8.1, "AC Sources-Operating," and LCO 3.8.2, "AC Sources-Shutdown."

One air start subsystem is required to ensure EDG OPERABILITY. The required starting air subsystem receiver is required to have a minimum of 175 psig to provide the EDG with more than one start attempt without recharging the air start receivers.

APPLICABILITY The AC sources (LCO 3.8.1 and LCO 3.8.2) are required to ensure the availability of the required power to shut down the reactor and maintain it in a safe shutdown condition after an AO0 or a postulated DBA. Since stored diesel fuel oil and the starting air subsystem support LCO 3.8.1 and (continued)

Revision 0 North Anna Units 1 and 2 B 3.8.3-2

Diesel Fuel Oil and Starting Air B 3.8.3 BASES APPLICABILITY LCO 3.8.2, stored diesel fuel oil and starting air are (continued) required to be within limits when the EDG(s) is required to be OPERABLE.

All four EDGs (two per unit) are normally associated with both tanks which make up the fuel oil storage system. All EDGs that are required to be OPERABLE are associated with the fuel oil storage system. The determination of which EDGs are required to be OPERABLE is based on the requirements of LCO 3.8.1, "AC Sources-Operating," and LCO 3.8.2, "AC Sources-Shutdown."

ACTIONS The ACTIONS Table is modified by a Note indicating that separate Condition entry is allowed for each EDG. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable EDG subsystem. Complying with the Required Actions for one inoperable EDG subsystem may allow for continued operation, and subsequent inoperable EDG subsystem(s) are governed by separate Condition entry and application of associated Required Actions.

A.1, A.2, A.3, and A.4 In this Condition, an underground fuel oil storage tank is not within limits for the purpose of tank repair or inspection. Every ten years a fuel oil tank must be inspected for integrity under the requirements of ASME Code,Section XI. Because both tanks are the source of fuel oil for all EDGs on both units, a dual unit outage would be required in order to provide the necessary time to complete the required maintenance or inspection. Prior to removal of the tank for repairs or inspection, verify 50,000 gallons of replacement fuel oil is available offsite and transportation is available to deliver that volume of fuel oil within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . Restrictions are placed on the remaining fuel oil storage tank and the 210,000-gallon above ground tank. Under this Condition, verification of the redundant fuel oil tank is required to confirm the required minimum amount of diesel fuel oil. In addition, the above ground tank, used to supply make up to the underground tanks, is required to be verified to contain the minimum level corresponding to 100,000 gallons. Verifications of onsite fuel oil are required on a 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months frequency to ensure an adequate source of fuel oil to the EDGs remains available. The underground fuel oil tank that is being inspected or repaired must be (continued)

Revision 0 North Anna Units 1 and 2 B 3.8.3-3

Diesel Fuel Oil and Starting Air B 3.8.3 BASES ACTIONS A.1, A.2, A.3, and A.4 (continued) restored within limits in 7 days. This time is considered reasonable based on the required maintenance and the requirements provided by the Required Actions.

B.1 In this Condition, the 7 day fuel oil supply is not available. The EDG fuel oil transfer pumps are aligned so that the lead pump for each EDG takes suction on the

'A' tank. The backup pumps are aligned to take suction on the

'B' tank. However, the Condition is restricted to fuel oil level reductions that maintain at least a 6 day supply.

These circumstances may be caused by events, such as full load operation required after an inadvertent start while at minimum required level, or feed and bleed operations, which may be necessitated by increasing particulate levels or any number of other oil quality degradations. This restriction allows sufficient time for obtaining the requisite replacement volume and performing the analyses required prior to addition of fuel oil to the tank. A period of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is considered sufficient to complete restoration of the required level prior to declaring the EDG inoperable.

This period is acceptable based on the remaining capacity

(> 6 days), the fact that procedures will be initiated to obtain replenishment, and the low probability of an event during this brief period. This Condition applies for reasons other than Condition A.

C.1 This Condition is entered as a result of a failure to meet the acceptance criterion of SR 3.8.3.2. Normally, trending of particulate levels allows sufficient time to correct high particulate levels prior to reaching the limit of acceptability. Poor sample procedures (bottom sampling),

contaminated sampling equipment, and errors in laboratory analysis can produce failures that do not follow a trend.

Since the presence of particulates does not mean failure of the fuel oil to burn properly in the diesel engine, and particulate concentration is unlikely to change significantly between Surveillance Frequency intervals, and proper engine performance has been recently demonstrated (within 31 days), it is prudent to allow a brief period prior to declaring the associated EDG inoperable. The 7 day (continued)

Revision 0 North Anna Units 1 and 2 B 3.8.3-4

Diesel Fuel Oil and Starting Air B 3.8.3 BASES ACTIONS C.1 (continued)

Completion Time allows for further evaluation, resampling and re-analysis of the EDG fuel oil stored in the below ground tanks.

D.1 With the new fuel oil properties defined in the Bases for SR 3.8.3.2 not within the required limits, a period of 30 days is allowed for restoring the stored fuel oil properties. This period provides sufficient time to test the stored fuel oil to determine that the new fuel oil, when mixed with previously stored fuel oil, remains acceptable, or to restore the stored fuel oil properties. This restoration may involve feed and bleed procedures, filtering, or combinations of these procedures. Even if an EDG start and load was required during this time interval and the fuel oil properties were outside limits, there is a high likelihood that the EDG would still be capable of performing its intended function.

E.1 With the one required starting air receiver pressure

< 175 psig, sufficient capacity for several EDG start attempts does not exist. However, as long as the receiver pressure is > 150 psig, there is adequate capacity for at least one start attempt, and the EDG can be considered OPERABLE while the air receiver pressure is restored to the required limit. A period of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is considered sufficient to complete restoration to the required pressure prior to declaring the EDG inoperable. This period is acceptable based on the remaining air start capacity, the fact that most EDG starts are accomplished on the first attempt, and the low probability of an event during this brief period.

F.1 With a Required Action and associated Completion Time not met, or one or more EDG's fuel oil or the required starting air subsystem not within limits for reasons other than addressed by Conditions A through E, the associated EDG(s) may be incapable of performing its intended function and must be inmediately declared inoperable. Only one starting air subsystem is required.

Revision 0 North Anna Units 1 and 2 B 3.8.3-5

Diesel Fuel Oil and Starting Air B 3.8.3 BASES SURVEILLANCE SR 3.8.3.1 REQU IREMENTS This SR provides verification that there is an adequate inventory of fuel oil in the storage tanks to support two EDGs' operation for 7 days at full load. The 7 day period is sufficient time to place the unit in a safe shutdown condition and to bring in replenishment fuel from an offsite location.

The 31 day Frequency is adequate to ensure that a sufficient supply of fuel oil is available, since low level alarms are provided and unit operators would be aware of any large uses of fuel oil during this period.

SR 3.8.3.2 The tests listed below are a means of determining whether new fuel oil is of the appropriate grade and has not been contaminated with substances that would have an immediate, detrimental impact on diesel engine combustion. If results from these tests are within acceptable limits, the fuel oil may be added to the storage tanks without concern for contaminating the entire volume of fuel oil in the storage tanks. These tests are to be conducted prior to adding the new fuel to the storage tank(s), but in no case is the time between receipt of new fuel and conducting the tests to exceed 31 days. The tests, limits, and applicable ASTM Standards are as follows:

a. Sample the new fuel oil in accordance with ASTM D4057-88 (Ref. 6);

b. Verify in accordance with the tests specified in ASTM D975-83 (Ref.

6) that the sample has an absolute specific gravity at 60/60'F of Ž 0.83 and

0.89 or an API gravity at 60°F of Ž 270 and : 390, a kinematic viscosity at W0OOF of Ž 1.9 centistokes and

4.1 centistokes, and a flash point of Ž 125 0F; and

c. Verify that the new fuel oil is checked for water and sediment in accordance with the Diesel Fuel Oil Testing Program.

(conti nued)

Revision 0 North Anna Units 1 and 2 B 3.8.3-6

Diesel Fuel Oil and Starting Air B 3.8.3 BASES SURVEILLANCE SR 3.8.3.2 (continued)

REQUI REMENTS Failure to meet any of the above limits is cause for rejecting the new fuel oil, but does not represent a failure to meet the LCO concern since the fuel oil is not added to the storage tanks.

Within 31 days following the initial new fuel oil sample, the fuel oil is analyzed to establish that the other properties specified in Table 1 of ASTM D975-89a (Ref.

7) are met for new fuel oil when tested in accordance with ASTM D975-83 (Ref. 6), except that the analysis for sulfur may be performed in accordance with ASTM D1552-88 (Ref.

6) or ASTM D2622-82 (Ref. 6). The 31 day period is acceptable because the fuel oil properties of interest, even if they were not within stated limits, would not have an immediate effect on EDG operation. This Surveillance ensures the availability of high quality fuel oil for the EDGs.

Fuel oil degradation during long term storage shows up as an increase in particulate, due mostly to oxidation. The presence of particulate does not mean the fuel oil will not burn properly in a diesel engine. The particulate can cause fouling of filters and fuel oil injection equipment, however, which can cause engine failure.

Particulate concentrations should be determined in accordance with ASTM D2276-83, Method A (Ref. 6).

This method involves a gravimetric determination of total particulate concentration in the fuel oil and has a limit of 10 mg/l.

It is acceptable to obtain a field sample for subsequent laboratory testing in lieu of field testing. Each tank is considered and tested separately.

The Frequency of this test takes into consideration fuel oil degradation trends that indicate that particulate concentration is unlikely to change significantly between Frequency intervals.

SR 3.8.3.3 This Surveillance ensures that, without the aid of the refill compressor, sufficient air start capacity for each EDG is available. The system design requirements were verified for a minimum of five engine start cycles without recharging. A start cycle is measured in terms of time (seconds of cranking).

One air start subsystem is (continued)

Revision 0 North Anna Units 1 and 2 B 3.8.3-7

Diesel Fuel Oil and Starting Air B 3.8.3 BASES SURVEILLANCE SR 3.8.3.3 (continued)

REQUIREMENTS R 150 psig. The pressure specified in this SR is intended to reflect the lowest value at which more than one start can be accomplished.

The 31 day Frequency takes into account the capacity, capability, redundancy, and diversity of the AC sources and other indications available in the control room, including alarms, to alert the operator to below normal air start pressure.

SR 3.8.3.4 Microbiological fouling is a major cause of fuel oil degradation. There are numerous bacteria that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive. Removal of water from the fuel storage tanks once every 92 days eliminates the necessary environment for bacterial survival. This is the most effective means of controlling microbiological fouling.

In addition, it eliminates the potential for water entrainment in the fuel oil during EDG operation. Water may come from any of several sources, including condensation, ground water, rain water, and contaminated fuel oil, and from breakdown of the fuel oil by bacteria. Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system. The Surveillance Frequencies are established by Regulatory Guide 1.137 (Ref.

2). This SR is for preventive maintenance. The presence of water does not necessarily represent failure of this SR, provided the accumulated water is removed during performance of the Surveillance.

REFERENCES

1. UFSAR, Section 9.5.4.2.

2. Regulatory Guide 1.137.

3.

ANSI N195-1976, Appendix B.

4. UFSAR, Chapter 6.

5.

UFSAR, Chapter 15.

6.

ASTM Standards: D4057-88; D975-83; D4176-86; D1552-88; D2622-82; D2276, Method A.

Revision 0 North Anna Units 1 and 2 B 3.8.3-8

Diesel Fuel Oil and Starting Air B 3.8.3 BASES REFERENCES (continued)

7.

ASTM Standards, D975, Table 1, 1974.

Revision 0 North Anna Units 1 and 2 B 3.8.3-9

Intentionally Blank

DC Sources-Operating B 3.8.4 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.4 DC Sources-Operating BASES BACKGROUND The station DC electrical power system provides the AC emergency power system with control power. It also provides both motive and control power to selected safety related equipment and preferred AC vital bus power (via inverters).

As required by Reference 1, the DC electrical power system is designed to have sufficient independence, redundancy, and testability to perform its safety functions, assuming a single failure. The DC electrical power system also conforms to the recommendations of Safety Guide 6 (Ref. 2) and IEEE-308 (Ref. 3).

The 125 VDC electrical power system consists of two independent and redundant safety related Class 1E DC electrical power subsystems (Train H and Train J). Each subsystem consists of two 125 VDC batteries, the associated battery charger(s) for each battery, and all the associated control equipment and interconnecting cabling. A spare battery charger is installed on each train and can be substituted for either of the train's chargers.

During normal operation, the 125 VDC load is powered from the battery chargers with the batteries floating on the system. In case of loss of normal power to the battery charger, the DC load is automatically powered from the station batteries.

The Train H and Train J DC electrical power subsystems provide the control power for its associated Class 1E AC power load group, 4.16 kV switchgear, and 480 V load centers. The DC electrical power subsystems also provide DC electrical power to the inverters, which in turn power the AC vital buses.

The DC power distribution system is described in more detail in Bases for LCO 3.8.9, "Distribution Systems-Operating,"

and LCO 3.8.10, "Distribution Systems-Shutdown."

Each battery has adequate storage capacity to carry the required load continuously for at least 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

(continued)

North Anna Units 1 and 2 Revi sion 0 B 3.8.4-1

DC Sources-Operating B 3.8.4 BASES1 BACKGROUND (continued)

Each 125 VDC battery is separately housed in a ventilated room apart from its charger and distribution centers. Each subsystem is located in an area separated physically and electrically from the other subsystem to ensure that a single failure in one subsystem does not cause a failure in a redundant subsystem. There is no sharing between redundant Class 1E subsystems, such as batteries, battery chargers, or distribution panels.

The criteria for sizing large lead storage batteries are defined in IEEE-485 (Ref. 5).

Each Train H and Train J DC electrical power subsystem has ample power output capacity for the steady state operation of connected loads required during normal operation, while at the same time maintaining its battery bank fully charged.

Each battery charger also has sufficient capacity to restore the battery from the design minimum charge to its fully charged state within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months while supplying normal steady state loads discussed in the UFSAR, Chapter 8 (Ref.

4).

The EDG DC electrical power system consists of the battery, battery charger, and interconnecting cabling to supply the required DC voltage to allow the associated EDG components to perform the required safety function.

For the other unit, control power for breakers and electrical power for solenoid operated valves that are needed to support operation of each required Service Water (SW) pump, Main Control Room (MCR)/Emergency Switchgear Room (ESGR)

Emergency Ventilation System (EVS) fan, Auxiliary Building central exhaust fan, and Component Cooling Water (CC) pump.

SW, MCR/ESGR EVS, Auxiliary Building central exhaust system, and CC are shared systems.

APPLICABLE SAFETY ANALYSES The initial conditions of Design Basis Accident (DBA) and transient analyses in the UFSAR, Chapter 6 (Ref. 6), and in the UFSAR, Chapter 15 (Ref. 7), assume that Engineered Safety Feature (ESF) systems are OPERABLE. The DC electrical power system provides normal and emergency DC electrical power for the emergency auxiliaries and control and switching during all MODES of operation.

(continued)

Revision 0 North Anna Units 1 and 2 B 3.8.4-2

DC Sources-Operating B 3.8.4 BASES APPLICABLE The OPERABILITY of the DC sources is consistent with the SAFETY ANALYSES initial assumptions of the accident analyses and is based (continued) upon meeting the design basis of the unit. This includes maintaining the DC sources OPERABLE during accident conditions in the event of:

a. An assumed loss of all offsite AC power or all onsite AC power; and

b. A worst case single failure.

The OPERABILITY of the EDG DC electrical power system ensures the EDG may perform its required safety function.

The DC sources satisfy Criterion 3 of 10 CFR 50.36(c) (2) (ii).

LCO The DC electrical power subsystems, each subsystem consisting of two batteries, battery charger for each battery and the corresponding control equipment and interconnecting cabling supplying power to the associated bus within the train are required to be OPERABLE to ensure the availability of the required power to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence (AO0) or a postulated DBA. Loss of any train DC electrical power subsystem does not prevent the minimum safety function from being performed (Ref.

4).

The EDG DC electrical power system consists of the battery, battery charger, and interconnecting cabling to supply the required DC voltage to allow the associated EDG components to perform the required safety function.

An OPERABLE DC electrical power subsystem requires all required batteries and respective chargers to be operating and connected to the associated DC bus(es).

Additionally, the unit's electrical sources must include DC sources from the other unit that are required to support the SW, MCR/ESGR EVS, Auxiliary Building central exhaust system, or CC safety functions. Control power for breakers and electrical power for solenoid operated valves are examples of support systems required to be OPERABLE that are needed for the operation of each required SW pump, MCR/ESGR EVS fan, (continued)

Revision 0 North Anna Units 1 and 2 B 3.8.4-3

DC Sources-Operating B 3.8.4 BASES LCO Auxiliary Building central exhaust fan, and CC pump.

SW, (continued)

MCR/ESGR EVS, Auxiliary Building central exhaust system, and CC are shared systems.

APPLICABILITY The DC electrical power sources are required to be OPERABLE in MODES 1, 2, 3, and 4 to ensure safe unit operation and to ensure that:

a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AQOs or abnormal transients; and

b. Adequate core cooling is provided, and containment integrity and other vital functions are maintained in the event of a postulated DBA.

The EDG DC system is required to be OPERABLE in MODES 1, 2, 3, and 4 to ensure the OPERABILITY of the associated EDG in accordance with LCO 3.8.1. In MODES 5 or 6, the OPERABILITY requirements of the EDG DC system are determined by the EDGs that they support in accordance with LCO 3.8.2.

The DC electrical power requirements for MODES 5 and 6 are addressed in the Bases for LCO 3.8.5, "DC Sources-Shutdown."

ACTIONS A.1 Condition A represents one train with a loss of ability to completely respond to an event, and a potential loss of ability to remain energized during normal operation.

It is, therefore, imperative that the operator's attention focus on stabilizing the unit, minimizing the potential for complete loss of DC power to the affected train. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months limit is consistent with the allowed time for an inoperable DC distribution system train.

If one of the required LCO 3.8.4.a DC electrical power subsystems is inoperable (e.g., inoperable battery, inoperable battery charger(s), or inoperable battery charger and associated inoperable battery), the remaining LCO 3.8.4.a DC electrical power subsystem has the capacity to support a safe shutdown and to mitigate an accident condition. For the Station batteries, a spare battery charger may be substituted for the normal charger without (continued)

Revi si on 0 North Anna Units 1 and 2 B 3.8.4-4

DC Sources-Operating B 3.8.4 BASES ACTIONS A.1 (continued) entry into Condition A. Since a subsequent worst case single failure would, however, result in the complete loss of the remaining 125 VDC electrical power subsystems with attendant loss of ESF functions, continued power operation should not exceed 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time is based on Regulatory Guide 1.93 (Ref. 8) and reflects a reasonable time to assess unit status as a function of the inoperable DC electrical power subsystem and, if the DC electrical power subsystem is not restored to OPERABLE status, to prepare to effect an orderly and safe unit shutdown.

B.1 and B.2 If the inoperable DC electrical power subsystem cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. The Completion Time to bring the unit to MODE 5 is consistent with the time required in Regulatory Guide 1.93 (Ref. 8).

C.1 Condition C represents the loss of the ability of the EDG DC system (e.g., inoperable battery charger or inoperable battery) to supply necessary power to the associated EDG. In this condition, the associated EDG is immediately declared inoperable and the associated Conditions or Required Actions of LCO 3.8.1 are followed.

D.1 Condition D represents the loss of one or more required LCO 3.8.4.c DC electrical power subsystem(s) needed to support the operation of required shared components on the other unit. SW, MCR/ESGR EVS, Auxiliary Building central exhaust system, and CC are shared systems. In this condition, the associated required shared components are declared inoperable immediately. The associated Conditions or Required Actions of LCO 3.7.8, "Service Water System,"

(continued)

Revision 0 North Anna Units 1 and 2 B 3.8.4-5

DC Sources-Operating B 3.8.4 BASES ACTIONS D.1 (continued)

LCO 3.7.10, "MCR/ESGR Emergency Ventilation Systems,"

LCO 3.7.12, "Emergency Core Cooling System Pump Room Exhaust Air Cleanup System," and LCO 3.7.19, "Component Cooling Water (CC)

System," are followed.

SURVEILLANCE REQUIREMENTS SR 3.8.4.1 For Station and EDG batteries, verifying battery terminal voltage while on float charge for the batteries helps to ensure the effectiveness of the charging system and the ability of the batteries to perform their intended function.

Float charge is the condition in which the charger is supplying the continuous charge required to overcome the internal losses of a battery (or battery cell) and maintain the battery (or a battery cell) in a fully charged state. The voltage requirements are based on the nominal design voltage of the battery and are consistent with the initial voltages assumed in the battery sizing calculations. The 7 day Frequency is consistent with manufacturer recommendations and IEEE-450 (Ref. 9).

SR 3.8.4.2 Visual inspection of both Station and EDG batteries to detect corrosion of the battery cells and connections, or measurement of the resistance of each intercell, interrack, intertier, and terminal connection, provides an indication of physical damage or abnormal deterioration that could potentially degrade battery performance.

The presence of visible corrosion does not necessarily represent a failure of this SR provided visible corrosion is removed during performance of SR 3.8.4.4.

The Surveillance Frequency for these inspections, which can detect conditions that can cause power losses due to resistance heating, is 92 days. This Frequency is considered acceptable based on operating experience related to detecting corrosion trends.

Revision 0 North Anna Units 1 and 2 B 3.8.4-6

DC Sources-Operating B 3.8.4 BASES SURVEILLANCE SR 3.8.4.3 REQUIREMENTS (continued)

Visual inspection of the battery cells, cell plates, and battery racks provides an indication of physical damage or abnormal deterioration that could potentially degrade battery performance. The presence of physical damage or deterioration does not necessarily represent a failure of this SR, provided an evaluation determines that the physical damage or deterioration does not affect the OPERABILITY of the battery (its ability to perform its design function).

SR 3.8.4.4 and SR 3.8.4.5 Station and EDG battery visual inspection and resistance measurements of intercell, interrack, intertier, and terminal connections provide an indication of physical damage or abnormal deterioration that could indicate degraded battery condition. The anticorrosion material is used to help ensure good electrical connections and to reduce terminal deterioration. The visual inspection for corrosion is not intended to require removal of and inspection under each terminal connection. The removal of visible corrosion is a preventive maintenance SR.

SR 3.8.4.6 and SR 3.8.4.7 SR 3.8.4.6 requires that each Station battery charger be capable of supplying Ž 270 amps and Ž 125 V for Ž 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

These requirements are based on the design capacity of the chargers (Ref. 4). According to Regulatory Guide 1.32 (Ref. 10), the battery charger supply is required to be based on the largest combined demands of the various steady state loads and the charging capacity to restore the battery from the design minimum charge state to the fully charged state, irrespective of the status of the unit during these demand occurrences. The minimum required amperes and duration ensures that these requirements can be satisfied.

SR 3.8.4.7 requires that each EDG battery charger be capable of supplying Ž 10 amps and 2 125 V for Ž 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . These values are based on the design requirements of the charger.

The Surveillance Frequency for SR 3.8.4.6 is acceptable, given the unit conditions required to perform the test and the other administrative controls existing to ensure adequate charger performance during these 18 month intervals. In addition, this Frequency is intended to be (continued)

Revision 0 North Anna Units 1 and 2 B 3.8.4-7

DC Sources-Operating B 3.8.4 BASES SURVEILLANCE REQUIREMENTS SR 3.8.4.6 and SR 3.8.4.7 (continued) consistent with expected fuel cycle lengths. The spare charger for the Station batteries is required to be tested to the same criteria as the normal charger if it is to be used as a substitute charger.

The Surveillance Frequency for SR 3.8.4.7 is acceptable given the EDG must not be required to be OPERABLE during the performance of the required test.

SR 3.8.4.8 A Station battery service test is a special test of battery capability, as found, to satisfy the design requirements (battery duty cycle) of the DC electrical power system. The discharge rate and test length should correspond to the design duty cycle requirements as specified in Reference 4.

The Surveillance Frequency of 18 months is consistent with the recommendations of Regulatory Guide 1.32 (Ref. 10) and Regulatory Guide 1.129 (Ref.

11), which state that the battery service test should be performed during refueling operations or at some other outage, with intervals between tests, not to exceed 18 months.

This SR is modified by three Notes. Note 1 allows the performance of a modified performance discharge test in lieu of a service test.

A modified performance discharge test is a test of the battery capacity and its ability to provide a high rate, short duration load (usually the highest rate of the duty cycle). This will confirm the battery's ability to meet the critical period of the load duty cycle, in addition to determining its percentage of rated capacity. Initial conditions for the modified performance discharge test should be identical to those specified for a service test.

It may consist of just two rates; for instance, the one minute rate published for the battery or the largest current load of the duty cycle, followed by the test rate employed for the performance test, both of which envelope the duty cycle of the service test. Since the ampere-hours removed by a one minute discharge represents a very small portion of the battery capacity, the test rate can be changed to that for the performance test without compromising the results of the (continued)

Revision 0 North Anna Units 1 and 2 B 3.8.4-8

DC Sources-Operating B 3.8.4 BASES SURVEILLANCE SR 3.8.4.8 (continued)

REQUIREMENTS performance discharge test. The battery terminal voltage for the modified performance discharge test must remain above the minimum battery terminal voltage specified in the battery service test for the duration of time equal to that of the service test.

Note 2 allows the performance discharge test in lieu of the service test once per 60 months.

The reason for Note 3 is that performing the Surveillance on the Station batteries would perturb, the electrical distribution system and challenge safety systems. This restriction from normally performing the Surveillance in MODE 1, 2, 3, or 4 is further amplified to allow portions of the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines unit safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial Surveillance, a successful partial Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of the unit shutdown and startup to determine that unit safety is maintained or enhanced when portions of the Surveillance are performed in MODE 1, 2, 3,

or 4. Risk insights or deterministic methods may be used for this assessment.

SR 3.8.4.9 A battery performance discharge test for Station and EDG batteries is a test of constant current capacity of a battery to detect any change in the capacity determined by the acceptance test. The test is intended to determine overall battery degradation due to age and usage.

A battery modified performance discharge test is described in the Bases for SR 3.8.4.8. Either the battery performance discharge test or the modified performance discharge test is acceptable for satisfying SR 3.8.4.9.

(continued)

Revision 0 North Anna Units 1 and 2 B 3.8.4-9

DC Sources-Operating B 3.8.4 BASES SURVEILLANCE SR 3.8.4.9 (continued)

REQUIREMENTS The acceptance criteria for this Surveillance are consistent with IEEE-450 (Ref. 9) and IEEE-485 (Ref. 5). These references recommend that the battery be replaced if its capacity is below 80% of the manufacturer's rating. A capacity of 80% shows that the battery rate of deterioration is increasing, even if there is ample capacity to meet the load requirements.

The Surveillance Frequency for this test is normally 60 months. If the battery shows degradation, or if the battery has reached 85% of its expected life, the Surveillance Frequency is reduced to 18 months. Degradation is indicated, according to IEEE-450 (Ref. 9), when the battery capacity drops by more than 10% relative to its capacity on the previous performance test or when it is

Ž 10% below the manufacturer's rating. The 60 month Frequency is consistent with the recommendations in IEEE-450 (Ref. 9) and the 18 month Frequency is consistent with operating experience.

This SR is modified by a Note. The reason for the Note is that performing the Surveillance would perturb the electrical distribution system and challenge safety systems for the Station batteries. This restriction from normally performing the Surveillance in MODE 1, 2, 3, or 4 is further amplified to allow portions of the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines unit safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial Surveillance, a successful partial Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of the unit shutdown and startup to determine that unit safety is maintained or enhanced when portions of the Surveillance are performed in MODE 1, 2, 3, or 4. Risk insights or deterministic methods may be used for this assessment.

Revision 0 North Anna Units 1 and 2 B 3.8.4-10

DC Sources-Operating B 3.8.4 BASES REFERENCES

1.

2.

3.

4.

5.

6.

7.

8.

9.

10.

11.

UFSAR, Chapter 3.

Safety Guide 6, March 10, 1971.

IEEE-308-1971.

UFSAR, Chapter 8.

IEEE-485-1983, June 1983.

UFSAR, Chapter 6.

UFSAR, Chapter 15.

Regulatory Guide 1.93, December 1974.

IEEE-450-1987.

Regulatory Guide 1.32, February 1977.

Regulatory Guide 1.129, December 1974.

Revision 0 North Anna Units 1 and 2 B 3.8.4-11

Intentionally Blank

DC Sources-Shutdown B 3.8.5 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.5 DC Sources-Shutdown BASES BACKGROUND APPLICABLE SAFETY ANALYSES A description of the DC sources is provided in the Bases for LCO 3.8.4, '"DC Sources-Operating."

The initial conditions of Design Basis Accident and transient analyses in the UFSAR, Chapter 6 (Ref. 1) and Chapter 15 (Ref. 2), assume that Engineered Safety Feature systems are OPERABLE.

The DC electrical power system provides normal and emergency DC electrical power for the emergency auxiliaries and control and switching during all MODES of operation. The EDG DC system provides power for the required EDG as described in LCO 3.8.2, "AC Sources-Shutdown."

The OPERABILITY of the DC subsystems is consistent with the initial assumptions of the accident analyses and the requirements for the supported systems' OPERABILITY.

The OPERABILITY of the minimum DC electrical power sources during MODES 5 and 6 and during movement of recently irradiated fuel assemblies ensures that:

a. The unit can be maintained in the shutdown or refueling condition for extended periods;

b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and

c. Adequate DC electrical power is provided to mitigate events postulated during shutdown, such as a fuel handling accident involving handling recently irradiated fuel.

Due to radioactive decay, DC electrical power is only required to mitigate fuel handling accidents involving handling recently irradiated fuel. (i.e., fuel that has occupied part of a critical reactor core within a time frame established by analysis. The term recently is defined as all irradiated fuel assemblies, until analysis is performed to determine a specific time frame.)

Revision 0 North Anna Units 1 and 2 B 3.8.5-1

DC Sources-Shutdown B 3.8.5 BASES APPLICABLE The DC sources satisfy Criterion 3 of 10 CFR SAFETY ANALYSES 50.36(c)(2)(ii).

(continued)

LCO The DC electrical power subsystem(s), each subsystem consisting of two batteries, one battery charger per battery, and the corresponding control equipment and interconnecting cabling within the train, are required to be OPERABLE to support required trains of the distribution systems required OPERABLE by LCO 3.8.10, "Distribution Systems-Shutdown." The EDG DC system, consisting of a battery, battery charger, and the corresponding control equipment and interconnection cabling for the EDG, are required to be OPERABLE to support the EDG required by LCO 3.8.2, "AC Sources-Shutdown." This ensures the availability of sufficient DC electrical power sources to operate the unit in a safe manner and to mitigate the consequences of postulated events during shutdown (e.g.,

fuel handling accidents involving handling recently irradiated fuel).

APPLICABILITY The DC electrical power sources and EDG DC system required to be OPERABLE in MODES 5 and 6, and during movement of recently irradiated fuel assemblies, provide assurance that:

a. Required features to provide adequate coolant inventory makeup are available for the recently irradiated fuel assemblies in the core;

b. Required features needed to mitigate a fuel handling accident involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within a time frame established by analysis. The term recently is defined as all irradiated fuel assemblies, until analysis is performed to determine a specific time frame.) are available;

c. Required features necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and

d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.

Revision 0 North Anna Units 1 and 2 B 3.8.5-2

DC Sources-Shutdown B 3.8.5 BASES APPLICABILITY The DC electrical power and EDG DC system requirements for (continued)

MODES 1, 2, 3, and 4 are covered in LCO 3.8.4.

ACTIONS A.1, A.2.1, A.2.2, A.2.3, and A.2.4 The train with DC power available may be capable of supporting sufficient systems to allow continuation of CORE ALTERATIONS and recently irradiated fuel movement. By allowing the option to declare required features inoperable with the associated DC power source(s) inoperable, appropriate restrictions will be implemented in accordance with the affected required features LCO ACTIONS.

In many instances, this option may involve undesired administrative efforts. Therefore, the allowance for sufficiently conservative actions is made (i.e., to suspend CORE ALTERATIONS, movement of recently irradiated fuel assemblies, and operations involving positive reactivity additions) that could result in loss of required SDM (MODE 5) or boron concentration (MODE 6). Suspending positive reactivity additions that could result in failure to meet the minimum SDM or boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than what would be required in the RCS for minimum SDM or refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. Introduction of temperature changes including temperature increases when operating with a positive MTC must also be evaluated to ensure they do not result in a loss of required SDM.

Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition. These actions minimize probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required DC electrical power subsystems and to continue this action until restoration is accomplished in order to provide the necessary DC electrical power to the unit safety systems.

The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required DC electrical power subsystems should be completed as quickly as possible in order to minimize the time during which the unit safety systems may be without sufficient power.

North Anna Units 1 and 2 Revision 0 B 3.8.5-3

DC Sources-Shutdown B 3.8.5 BASES ACTIONS B.1 (conti nued)

With the required EDG's DC system inoperable, the EDG is not OPERABLE and the applicable Conditions and Required Actions of LCO 3.8.2, "AC Sources-Shutdown," must be entered immediately.

SURVEILLANCE SR 3.8.5.1 REQUIREMENTS SR 3.8.5.1 requires performance of all Surveillances required by SR 3.8.4.1 through SR 3.8.4.9. Therefore; see the corresponding Bases for LCO 3.8.4 for a discussion of each SR.

This SR is modified by a Note. The reason for the Note is to preclude requiring the required OPERABLE DC sources or EDG DC system from being discharged below their capability to provide the required power supply or otherwise rendered inoperable during the performance of SRs. It is the intent that these SRs must still be capable of being met, but actual performance is not required.

REFERENCES

1. UFSAR, Chapter 6.

2.

UFSAR, Chapter 15.

Revision 0 North Anna Units 1 and 2 B 3.8.5-4

Battery Cell Parameters B 3.8.6 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.6 Battery Cell Parameters BASES BACKGROUND APPLICABLE SAFETY ANALYSES LCO This LCO delineates the limits on electrolyte temperature, level, float voltage, and specific gravity for the Station and EDG batteries. A discussion of these batteries and their OPERABILITY requirements is provided in the Bases for LCO 3.8.4, "DC Sources-Operating," and LCO 3.8.5, "DC Sources-Shutdown."

The initial conditions of Design Basis Accident (DBA) and transient analyses in the UFSAR, Chapter 6 (Ref. 1) and Chapter 15 (Ref. 2), assume Engineered Safety Feature systems are OPERABLE. The DC electrical power system provides normal and emergency DC electrical power for the emergency auxiliaries, and control and switching during all MODES of operation. The EDG DC electrical power system consists of the battery, battery charger, and interconnecting cabling supplying power to the associated EDG components to supply the required DC voltage to allow the EDG to perform the required safety function.

The OPERABILITY of the DC subsystems is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit. This includes maintaining at least one train of DC sources OPERABLE during accident conditions, in the event of:

a. An assumed loss of all offsite AC power or all onsite AC power; and

b. A worst case single failure.

Battery cell parameters satisfy the Criterion 3 of 10 CFR 50.36(c) (2) (ii).

Battery cell parameters must remain within acceptable limits to ensure availability of the required DC power to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence or a postulated DBA.

Electrolyte limits are conservatively established, allowing continued DC electrical system function even with Category A and B limits not met.

Revision 0 North Anna Units 1 and 2 B 3.8.6-1

Battery Cell Parameters B 3.8.6 BASES APPLICABILITY The battery cell parameters are required solely for the support of the associated DC electrical power subsystem(s) and EDG DC system(s). Therefore, the battery is only required when the DC power source is required to be OPERABLE.

Refer to the Applicability discussion in Bases for LCO 3.8.4 and LCO 3.8.5.

ACTIONS A.1, A.2, and A.3 With one or more cells in one or more batteries not within limits (i.e., Category A limits not met, Category B limits not met, or Category A and B limits not met) but within the Category C limits specified in Table 3.8.6-1 in the accompanying LCO, the battery is degraded but there is still sufficient capacity to perform the intended function.

Therefore, the affected battery is not required to be considered inoperable solely as a result of Category A or B limits not met and operation is permitted for a limited period.

The pilot cell electrolyte level and float voltage are required to be verified to meet the Category C limits within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months (Required Action A.1). This check will provide a quick indication of the status of the remainder of the battery cells. One hour provides time to inspect the electrolyte level and to confirm the float voltage of the pilot cells. One hour is considered a reasonable amount of time to perform the required verification.

Verification that the Category C limits are met (Required Action A.2) provides assurance that during the time needed to restore the parameters to the Category A and B limits, the battery is still capable of performing its intended function. A period of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is allowed to complete the initial verification because specific gravity measurements must be obtained for each connected cell. Taking into consideration both the time required to perform the required verification and the assurance that the battery cell parameters are not severely degraded, this time is considered reasonable. The verification is repeated at 7 day intervals until the parameters are restored to Category A or B limits. This periodic verification is consistent with the normal Frequency of pilot cell Surveillances.

(continued)

Revision 0 North Anna Units 1 and 2 B 3.8.6-2

Battery Cell Parameters B 3.8.6 BASES ACTIONS A.1, A.2, and A.3 (continued)

Continued operation is only permitted for 31 days before battery cell parameters must be restored to within Category A and B limits. With the consideration that, while battery capacity is degraded, sufficient capacity exists to perform the intended function and to allow time to fully restore the battery cell parameters to normal limits, this time is acceptable prior to declaring the battery inoperable.

B.1 With one or more batteries with one or more battery cell parameters outside the Category C limit for any connected cell, sufficient capacity to supply the maximum expected load requirement is not assured and the corresponding DC electrical power subsystem or EDG DC system must be declared inoperable. Additionally, other potentially extreme conditions, such as not completing the Required Actions of Condition A within the required Completion Time or average electrolyte temperature of representative cells falling below 60'F for the Station batteries, are also cause for immediately declaring the associated DC electrical power subsystem inoperable. Representative cells will consist of at least 10 cells.

SURVEILLANCE SR 3.8.6.1 REQUIREMENTS This SR verifies that Category A battery cell parameters are consistent with IEEE-450 (Ref. 3), which recommends regular battery inspections (at least one per month) including voltage, specific gravity, and electrolyte level of pilot cells.

SR 3.8.6.2 The quarterly inspection of specific gravity and voltage is consistent with IEEE-450 (Ref. 3).

In addition, within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of a battery discharge < 110 V or a battery overcharge > 150 V, the battery must be demonstrated to meet Category B limits. Transients, such as motor starting transients, which may momentarily cause battery voltage to drop to

110 V, do not constitute a battery discharge provided the battery terminal voltage and float current return to pre-transient values. This inspection is also (continued)

Revision 0 North Anna Units 1 and 2 B 3.8.6-3

Battery Cell Parameters B 3.8.6 BASES SURVEILLANCE SR 3.8.6.2 (continued)

REQU IREMENTS consistent with IEEE-450 (Ref.

3),

which recommends special inspections following a severe discharge or overcharge, to ensure that no significant degradation of the battery occurs as a consequence of such discharge or overcharge.

SR 3.8.6.3 This Surveillance verification that the average temperature of representative cells of the Station batteries is > 600F, is consistent with a recommendation of IEEE-450 (Ref.

3),

that states that the temperature of electrolytes in representative cells should be determined on a quarterly basis.

Lower than normal temperatures act to inhibit or reduce battery capacity. This SR ensures that the operating temperatures remain within an acceptable operating range.

This limit is based on manufacturer recommendations.

Table 3.8.6-1 This table delineates the limits on electrolyte level, float voltage, and specific gravity for three different categories. The meaning of each category is discussed below.

Category A defines the normal parameter limit for each designated pilot cell in each battery. The cells selected as pilot cells are those whose level, voltage, and electrolyte specific gravity approximate the state of charge of the entire battery.

The Category A limits specified for electrolyte level are based on manufacturer recommendations and are consistent with the guidance in IEEE-450 (Ref. 3), with the extra I inch allowance above the high water level indication for operating margin to account for temperatures and charge effects. In addition to this allowance, footnote a to Table 3.8.6-1 permits the electrolyte level to be above the specified maximum level during equalizing charge, provided it is not overflowing. These limits ensure that the plates suffer no physical damage, and that adequate electron transfer capability is maintained in the event of transient conditions. IEEE-450 (Ref.

3) recommends that electrolyte level readings should be made only after the battery has been at float charge for at least 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

(continued)

Revision 0 North Anna Units 1 and 2 B 3.8.6-4

Battery Cell Parameters B 3.8.6 BASES SURVEILLANCE Table 3.8.6-1 (continued)

REQUIREMENTS The Category A limit specified for float voltage is Ž 2.13 V per cell. This value is based on the recommendations of IEEE-450 (Ref. 3), which states that prolonged operation of cells < 2.13 V can reduce the life expectancy of cells.

The Category A limit specified for specific gravity for each pilot cell is Ž 1.200 (0.015 below the manufacturer fully charged nominal specific gravity or a battery charging current that had stabilized at a low value). This value is characteristic of a charged cell with adequate capacity.

According to IEEE-450 (Ref. 3), the specific gravity readings are based on a temperature of 77°F (25 0C).

The specific gravity readings are corrected for actual electrolyte temperature and level. For each 30F (1.670C) above 77 0F (25 0C),

1 point (0.001) is added to the reading; 1 point is subtracted for each 30F below 77 0F. The specific gravity of the electrolyte in a cell increases with a loss of water due to electrolysis or evaporation.

Category B defines the normal parameter limits for each connected cell. The term "connected cell" excludes any battery cell that may be jumpered out.

The Category B limits specified for electrolyte level and float voltage are the same as those specified for Category A and have been discussed above. The Category B limit specified for specific gravity for each connected cell is

Ž 1.195 (0.020 below the manufacturer fully charged, nominal specific gravity) with the average of all connected cells

> 1.205 (0.010 below the manufacturer fully charged, nominal specific gravity). These values are based on manufacturer's recommendations. The minimum specific gravity value required for each cell ensures that the effects of a highly charged or newly installed cell will not mask overall degradation of the battery.

Category C defines the limits for each connected cell. These values, although reduced, provide assurance that sufficient capacity exists to perform the intended function and maintain a margin of safety. When any battery parameter is outside the Category C limits, the assurance of sufficient capacity described above no longer exists, and the battery must be declared inoperable.

(continued)

Revision 0 North Anna Units 1 and 2 B 3.8.6-5

Battery Cell Parameters B 3.8.6 BASES SURVEILLANCE Table 3.8.6-1 (continued)

REQU IREMENTS The Category C limits specified for electrolyte level (above the top of the plates and not overflowing) ensure that the plates suffer no physical damage and maintain adequate electron transfer capability. The Category C limits for float voltage is based on IEEE-450 (Ref. 3), which states that a cell voltage of 2.07 V or below, under float conditions and not caused by elevated temperature of the cell, indicates internal cell problems and may require cell replacement.

The Category C limit of average specific gravity Ž 1.195 is based on manufacturer recommendations (0.020 below the manufacturer recommended fully charged, nominal specific gravity). In addition to that limit, it is required that the specific gravity for each connected cell must be no less than 0.020 below the average of all connected cells. This limit ensures that the effect of a highly charged or new cell does not mask overall degradation of the battery.

The footnotes to Table 3.8.6-1 are applicable to Category A, B, and C specific gravity. Footnote (b) to Table 3.8.6-1 requires the above mentioned correction for electrolyte level and temperature, with the exception that level correction is not required when Station battery charging current is < 2 amps on float charge. This current provides, in general, an indication of overall battery condition.

Because of specific gravity gradients that are produced during the recharging process, delays of several days may occur while waiting for the specific gravity to stabilize. A stabilized charger current is an acceptable alternative to specific gravity measurement for determining the state of charge. This phenomenon is discussed in IEEE-450 (Ref. 3).

Footnote (c) to Table 3.8.6-1 allows the float charge current to be used as an alternate to specific gravity for up to 7 days following a Station battery recharge. Within 7 days, each connected cell's specific gravity must be measured to confirm the state of charge. Following a minor battery recharge (such as equalizing charge that does not follow a deep discharge) specific gravity gradients are not significant, and confirming measurements may be made in less than 7 days.

Revision 0 North Anna Units 1 and 2 B 3.8.6-6

Battery Cell Parameters B 3.8.6 BASE REFERENCES

1. UFSAR, Chapter 6.

2.

UFSAR, Chapter 15.

3.

IEEE-450-1980.

Revision 0 North Anna Units 1 and 2 S

B 3.8.6-7

Intentionally Blank

Inverters-Operati ng B 3.8.7 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.7 Inverters-Operating BASES BACKGROUND APPLICABLE SAFETY ANALYSES The inverters are the preferred source of power for the AC vital buses because of the stability and reliability they achieve. The function of the inverter is to provide AC electrical power to the vital buses. The inverters can be powered from a battery charger or from the station battery.

The station battery provides an uninterruptible power source for the instrumentation and controls for the Reactor Trip System (RTS) and the Engineered Safety Feature Actuation System (ESFAS).

Specific details on inverters and their operating characteristics are found in the UFSAR, Chapter 8 (Ref. 1).

The initial conditions of Design Basis Accident (DBA) and transient analyses in the UFSAR, Chapter 6 (Ref. 2) and Chapter 15 (Ref. 3), assume Engineered Safety Feature systems are OPERABLE. The inverters are designed to provide the required capacity, capability, redundancy, and reliability to ensure the availability of necessary power to the RTS and ESFAS instrumentation and controls so that the fuel, Reactor Coolant System, and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution Limits; Section 3.4, Reactor Coolant System (RCS); and Section 3.6, Containment Systems.

The OPERABILITY of the inverters is consistent with the initial assumptions of the accident analyses and is based on meeting the design basis of the unit. This includes maintaining required AC vital buses OPERABLE during accident conditions in the event of:

a. An assumed loss of all offsite AC electrical power or all onsite AC electrical power; and

b. A worst case single failure.

Inverters are a part of the distribution system and, as such, satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

Revision 0 North Anna Units 1 and 2 B 3.8.7-1

Inverters-Operating B 3.8.7 BASES LCO The inverters ensure the availability of AC electrical power for the systems instrumentation required to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence (AOO) or a postulated DBA.

Maintaining the required inverters OPERABLE ensures that the redundancy incorporated into the design of the RPS and ESFAS instrumentation and controls is maintained. The four inverters (two per train) ensure an uninterruptible supply of AC electrical power to the AC vital buses even if the 4.16 kV safety buses are de-energized.

OPERABLE inverters require the associated vital bus to be powered by the inverter with output voltage within tolerances, and power input to the inverter from a 125 VDC station battery. Alternatively, power supply may be from a battery charger as long as the station battery is available as the uninterruptible power supply.

This LCO is modified by a Note that allows one inverter to be disconnected from its associated battery for

24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , if the vital bus is powered from a constant voltage transformer and all other inverters are OPERABLE.

This allows an equalizing charge to be placed on the associated battery. If the inverters were not disconnected, the resulting voltage condition might damage the inverters. These provisions minimize the loss of equipment that would occur in the event of a loss of offsite power. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months time period for the allowance minimizes the time during which a loss of offsite power could result in the loss of equipment energized from the affected AC vital bus while taking into consideration the time required to perform an equalizing charge on the battery bank.

The intent of this Note is to limit the number of inverters that may be disconnected. Only those inverters associated with the single battery undergoing an equalizing charge may be disconnected. All other inverters must be aligned to their associated batteries, regardless of the number of inverters or unit design.

Revision 0 North Anna Units 1 and 2 B 3.8.7-2

Inverters-Operating B 3.8.7 BASES APPLICABILITY The inverters are required to be OPERABLE in MODES 1, 2, 3, and 4 to ensure that:

a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AQOs or abnormal transients; and

b. Adequate core cooling is provided, and containment OPERABILITY and other vital functions are maintained in the event of a postulated DBA.

Inverter requirements for MODES 5 and 6 are covered in the Bases for LCO 3.8.8, "Inverters-Shutdown."

ACTIONS A.1 With a required inverter inoperable, its associated AC vital bus becomes inoperable until it is re-energized from its constant voltage source transformer.

For this reason a Note has been included in Condition A requiring the entry into the Conditions and Required Actions of LCO 3.8.9, "Distribution Systems-Operating." This ensures that the vital bus is re-energized within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

Required Action A.1 allows 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to fix the inoperable inverter and return it to service. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months limit is based upon engineering judgment, taking into consideration the time required to repair an inverter and the additional risk to which the unit is exposed because of the inverter inoperability. This has to be balanced against the risk of an immediate shutdown, along with the potential challenges to safety systems such a shutdown might entail. When the AC vital bus is powered from its constant voltage source, it is relying upon interruptible AC electrical power sources (offsite and onsite). The uninterruptible inverter source to the AC vital buses is the preferred source for powering instrumentation trip setpoint devices.

B.1 and B.2 If the inoperable devices or components cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at (continued)

Revision 0 North Anna Units 1 and 2 B 3.8.7-3

Inverters-Operating B 3.8.7 BASES ACTIONS B.1 and B.2 (continued) least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.8.7.1 REQUIREMENTS This Surveillance verifies that the inverters are functioning properly with all required circuit breakers closed and AC vital buses energized from the inverter. The verification of proper voltage output ensures that the required power is readily available for the instrumentation of the RTS and ESFAS connected to the AC vital buses. The 7 day Frequency takes into account the redundant capability of the inverters and other indications available in the control room that alert the operator to inverter malfunctions.

REFERENCES

1. UFSAR, Chapter 8.

2. UFSAR, Chapter 6.

3. UFSAR, Chapter 15.

Revision 0 North Anna Units 1 and 2 B 3.8.7-4

I nverters-Shutdown B 3.8.8 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.8 Inverters-Shutdown BASES BACKGROUND APPLICABLE SAFETY ANALYSES A description of the inverters is provided in the Bases for LCO 3.8.7, "Inverters-Operating."

The initial conditions of Design Basis Accident (DBA) and transient analyses in the UFSAR, Chapter 6 (Ref. 1) and Chapter 15 (Ref. 2), assume Engineered Safety Feature systems are OPERABLE.

The DC to AC inverters are designed to provide the required capacity, capability, redundancy, and reliability to ensure the availability of necessary power to the Reactor Trip System and Engineered Safety Features Actuation System instrumentation and controls so that the fuel, Reactor Coolant System, and containment design limits are not exceeded.

The OPERABILITY of the inverters is consistent with the initial assumptions of the accident analyses and the requirements for the supported systems' OPERABILITY.

The OPERABILITY of the minimum inverters to each AC vital bus during MODES 5 and 6 ensures that:

a. The unit can be maintained in the shutdown or refueling condition for extended periods;

b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and

c. Adequate power is available to mitigate events postulated during shutdown, such as a fuel handling accident involving handling recently irradiated fuel. Due to radioactive decay, the inverter(s) are only required to mitigate fuel handling accidents involving handling recently irradiated fuel. (i.e., fuel that has occupied part of a critical core within a time frame established by analysis. The term recently is defined as all irradiated fuel assemblies, until analysis is performed to determine a specific time frame.)

Revision 0 North Anna Units 1 and 2 B 3.8.8-1

Inverters-Shutdown B 3.8.8 BASES APPLICABLE The inverters were previously identified as part of the SAFETY ANALYSES distribution system and, as such, satisfy Criterion 3 of (continued) 10 CFR 50.36(c)(2)(ii).

LCO The required inverter(s) ensure the availability of electrical power for the instrumentation for systems required to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence or a postulated DBA. The battery powered inverters provide uninterruptible supply of AC electrical power to the AC vital buses even if the 4.16 kV safety buses are de-energized. OPERABILITY of the inverters requires that the AC vital bus be powered by the inverter. This ensures the availability of sufficient inverter power sources to operate the unit in a safe manner and to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents involving handling recently irradiated fuel).

APPLICABILITY The inverters required to be OPERABLE in MODES 5 and 6 and during movement of recently irradiated fuel assemblies provide assurance that:

a. Systems to provide adequate coolant inventory makeup are available for the irradiated fuel in the core;

b. Systems needed to mitigate a fuel handling accident involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical core within a time frame established by analysis. The term recently is defined as all irradiated fuel assemblies, until analysis is performed to determine a specific time frame.) are available;

c. Systems necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and

d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.

Inverter requirements for MODES 1, 2, 3, and 4 are covered in LCO 3.8.7.

Revi si on 0 North Anna Units 1 and 2 B 3.8.8-2

Inverters-Shutdown B 3.8.8 BASES ACTIONS A.1, A.2.1, A.2.2, A.2.3, and A.2.4 The required OPERABLE Inverters are capable of supporting sufficient required features to allow continuation of CORE ALTERATIONS, recently irradiated fuel movement, and operations with a potential for positive reactivity additions. By the allowance of the option to declare required features inoperable with the associated inverter(s) inoperable, appropriate restrictions will be implemented in accordance with the affected required features LCOs' Required Actions. In many instances, this option may involve undesired administrative efforts. Therefore, the allowance for sufficiently conservative actions is made (i.e., to suspend CORE ALTERATIONS, movement of recently irradiated fuel assemblies, and operations involving positive reactivity additions) that could result in loss of required SDM (MODE 5) or boron concentration (MODE 6). Suspending positive reactivity additions that could result in failure to meet the minimum SDM or boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than what would be required in the RCS for minimum SDM or refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. Introduction of temperature changes including temperature increases when operating with a positive MTC must also be evaluated to ensure they do not result in a loss of required SDM.

Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition. These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required inverters and to continue this action until restoration is accomplished in order to provide the necessary inverter power to the unit safety systems.

The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required inverters should be completed as quickly as possible in order to minimize the time the unit safety systems may be without power or powered from a constant voltage source transformer.

Revision 0 North Anna Units 1 and 2 B 3.8.8-3

I nverters-Shutdown B 3.8.8 BASES SURVEILLANCE REQUIREMENTS SR 3.8.8.1 This Surveillance verifies that the inverters are functioning properly with all required circuit breakers closed and AC vital buses energized from the inverter. The verification of proper voltage output ensures that the required power is readily available for the instrumentation connected to the AC vital buses. The 7 day Frequency takes into account the redundant capability of the inverters and other indications available in the control room that alert the operator to inverter malfunctions.

REFERENCES

1. UFSAR, Chapter 6.

2.

UFSAR, Chapter 15.

Revision 0 North Anna Units 1 and 2 B 3.8.8-4

Distribution Systems-Operating B 3.8.9 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.9 Distribution Systems-Operating BASES BACKGROUND The onsite Class 1E AC, DC, and AC vital bus electrical power distribution systems are divided by train into two redundant and independent AC, DC, and AC vital bus electrical power distribution subsystems.

The AC 6lectrical power subsystem for each train consists of a primary Engineered Safety Feature (ESF) 4.16 kV bus and secondary 480 V buses and load centers. Each 4.16 kV ESF bus has at least one separate and independent offsite source of power as well as a dedicated onsite emergency diesel generator (EDG) source. Unit 1 has a normal offsite source and an alternate offsite source. Transfer to the alternate offsite source is a manual operation. Unit 2 has a normal offsite source, and no alternate source. In the event of a loss of offsite power, the EDGs for the affected buses will start and load. The EDGs for Unit 1 will continue to run until (a) the safety bus is transferred to the alternate offsite source, or (b) the normal offsite source is restored. The Unit 2 EDGs will continue to run until the normal offside source is restored. If offsite sources are unavailable, the onsite EDG supplies power to the 4.16 kV ESF bus. Control power for the 4.16 kV breakers is supplied from the Class 1E batteries. Additional description of this system may be found in the Bases for LCO 3.8.1, "AC Sources-Operating," and the Bases for LCO 3.8.4, "DC Sources-Operating."

The secondary AC electrical power distribution subsystem for each train includes the safety related buses and load centers shown in Table B 3.8.9-1.

The 120 VAC vital buses are arranged in two load groups per train and are normally powered from the inverters. The alternate power supply for the vital buses are constant voltage source transformers powered from the same train as the associated inverter, and its use is governed by LCO 3.8.7, "Inverters-Operating." Each constant voltage source transformer is powered from a Class 1E AC bus.

There are two independent 125 VDC electrical power distribution subsystems for each train.

(continued)

Revision 0 North Anna Units 1 and 2 B 3.8.9-1

Distribution Systems-Operating B 3.8.9 BASES BACKGROUND (continued)

For the other unit, one AC and DC bus on that unit is needed to support operation of each required Service Water (SW) pump, Main Control Room (MCR)/Emergency Switchgear Room (ESGR) Emergency Ventilation System (EVS) fan, Auxiliary Building central exhaust fan, and Component Cooling Water (CC) pump.

SW, MCR/ESGR EVS, Auxiliary Building central exhaust system, and CC are shared systems.

The list of all required distribution buses is presented in Table B 3.8.9-1.

APPLICABLE SAFETY ANALYSES LCO The initial conditions of Design Basis Accident (DBA) and transient analyses in the UFSAR, Chapter 6 (Ref. 1), and in the UFSAR, Chapter 15 (Ref. 2), assume ESF systems are OPERABLE. The AC, DC, and AC vital bus electrical power distribution systems are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor Coolant System, and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution Limits; Section 3.4, Reactor Coolant System (RCS); and Section 3.6, Containment Systems.

The OPERABILITY of the AC, DC, and AC vital bus electrical power distribution systems is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit. This includes maintaining power distribution systems OPERABLE during accident conditions in the event of:

a. An assumed loss of all offsite power or all onsite AC electrical power; and

b. A worst case single failure.

The distribution systems satisfy Criterion 3 of 10 CFR 50.36(c) (2) (ii).

The required power distribution subsystems listed in Table B 3.8.9-1 ensure the availability of AC, DC, and AC vital bus electrical power for the systems required to shut down the reactor and maintain it in a safe condition after an (continued)

Revision 0 North Anna Units 1 and 2 B 3.8.9-2

Distribution Systems-Operating B 3.8.9 BASES LCO anticipated operational occurrence (AO0) or a postulated (continued)

DBA. The AC, DC, and AC vital bus electrical power distribution subsystems are required to be OPERABLE.

Maintaining the Train H and Train J AC, DC, and AC vital bus electrical power distribution subsystems OPERABLE ensures that the redundancy incorporated into the design of ESF is not defeated. Therefore, a single failure within any system or within the electrical power distribution subsystems will not prevent safe shutdown of the reactor.

OPERABLE AC electrical power distribution subsystems require the associated buses and load centers to be energized to their proper voltages. OPERABLE DC electrical power distribution subsystems require the associated buses to be energized to their proper voltage from either the associated battery or charger. OPERABLE vital bus electrical power distribution subsystems require the associated buses to be energized to their proper voltage from the associated inverter via inverted DC voltage, or constant voltage transformer.

In addition, tie breakers between redundant safety related AC, DC, and AC vital bus power distribution subsystems, if they exist, must be open. This prevents any electrical malfunction in any power distribution subsystem from propagating to the redundant subsystem, that could cause the failure of a redundant subsystem and a loss of essential safety function(s).

If any tie breakers are closed, the affected redundant electrical power distribution subsystems are considered inoperable. This applies to the onsite, safety related redundant electrical power distribution subsystems. It does not, however, preclude redundant Class 1E 4.16 kV buses from being powered from the same offsite circuit.

APPLICABILITY The electrical power distribution subsystems are required to be OPERABLE in MODES 1, 2, 3, and 4 to ensure that:

a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients; and

b. Adequate core cooling is provided, and containment OPERABILITY and other vital functions are maintained in the event of a postulated DBA.

(continued)

Revision 0 North Anna Units 1 and 2 B 3.8.9-3

Distribution Systems-Operating B 3.8.9 BASES APPLICABILITY Electrical power distribution subsystem requirements for (continued)

MODES 5 and 6 are covered in the Bases for LCO 3.8.10, "Distribution Systems-Shutdown."

ACTIONS A.1 With one or more LCO 3.8.9.a AC electrical power distribution subsystem(s) inoperable, the minimum safety functions can still be accomplished, assuming no single failure, as long as one set of redundant required equipment (AC buses and load centers) supporting each safety function remains energized to their proper voltages. Redundant required equipment is listed in Table B 3.8.9-1. The overall reliability is reduced, however, because a single failure in the remaining power distribution subsystems could result in the minimum required ESF functions not being supported.

Therefore, the required AC buses and load centers must be restored to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months .

Condition A worst scenario is one train without AC power (i.e., no offsite power to the train and the associated EDG inoperable).

In this Condition, the unit is more vulnerable to a complete loss of AC power. It is, therefore, imperative that the unit operator's attention be focused on minimizing the potential for loss of power to the remaining train by stabilizing the unit, and on restoring power to the affected train. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months time limit before requiring a unit shutdown in this Condition is acceptable because of:

a. The potential for decreased safety if the unit operator's attention is diverted from the evaluations and actions necessary to restore power to the affected train, to the actions associated with taking the unit to shutdown within this time limit; and

b. The potential for an event in conjunction with a single failure of a redundant component in the train with AC power.

The second Completion Time for Required Action A.1 establishes a limit on the maximum time allowed for any combination of required distribution subsystems to be inoperable during any single contiguous occurrence of failing to meet the LCO. If Condition A is entered while, for instance, a DC bus is inoperable and subsequently restored OPERABLE, the LCO may already have been not met for up to (continued)

Revision 0 North Anna Units 1 and 2 B 3.8.9-4

Distribution Systems-Operating B 3.8.9 BASES ACTIONS A.1 (continued) 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . This could lead to a total of 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months , since initial failure of the LCO, to restore the AC distribution system. At this time, a DC circuit could again become inoperable, and AC distribution restored OPERABLE. This could continue indefinitely.

The Completion Time allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."

This will result in establishing the "time zero" at the time the LCO was initially not met, instead of the time Condition A was entered. The 16 hour1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months Completion Time is an acceptable limitation on this potential to fail to meet the LCO indefinitely.

Required Action A.1 is modified by a Note that requires the applicable Conditions and Required Actions of LCO 3.8.4, "DC Sources-Operating," to be entered for DC train(s) made inoperable power distribution subsystem(s). This is an exception to LCO 3.0.6 and ensures the proper actions are taken for these components. Inoperability of a distribution system can result in loss of charging power to batteries and eventual loss of DC power. This Note ensures that appropriate attention is given to restoring charging power to batteries, if necessary, after loss of distribution systems.

B.1 With one or more LCO 3.8.9.a AC vital buses inoperable and a loss of function has not yet occurred, the remaining OPERABLE AC vital buses are capable of supporting the minimum safety functions necessary to shut down the unit and maintain it in the safe shutdown condition. Overall reliability is reduced, however, since an additional single failure could result in the minimum required ESF functions not being supported. Therefore, the required AC vital bus must be restored to OPERABLE status within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months by powering the bus from the associated inverter via inverted DC, or constant voltage transformer.

Condition B represents one or more AC vital buses without power; potentially both the DC source and the associated AC source are nonfunctioning. In this situation, the unit is significantly more vulnerable to a complete loss of all noninterruptible power. It is, therefore, imperative that (continued)

Revision 0 North Anna Units 1 and 2 B 3.8.9-5

Distribution Systems-Operating B 3.8.9 BASES ACTIONS B.1 (continued) the operator's attention focus on stabilizing the unit, minimizing the potential for loss of power to the remaining vital buses and restoring power to the affected vital bus.

This 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months limit is more conservative than Completion Times allowed for the vast majority of components that are without adequate vital AC power. Taking exception to LCO 3.0.2 for components without adequate vital AC power, that would have the Required Action Completion Times shorter than 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months if declared inoperable, is acceptable because of:

a. The potential for decreased safety by requiring a change in unit conditions (i.e., requiring a shutdown) and not allowing stable operations to continue;

b. The potential for decreased safety by requiring entry into numerous applicable Conditions and Required Actions for components without adequate vital AC power and not providing sufficient time for the operators to perform the necessary evaluations and actions for restoring power to the affected train; and

c. The potential for an event in conjunction with a single failure of a redundant component.

The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time takes into account the importance to safety of restoring the AC vital bus to OPERABLE status, the redundant capability afforded by the other OPERABLE vital buses, and the low probability of a DBA occurring during this period.

The second Completion Time for Required Action B.1 establishes a limit on the maximum allowed for any combination of required distribution subsystems to be inoperable during any single contiguous occurrence of failing to meet the LCO. If Condition B is entered while, for instance, an AC bus is inoperable and subsequently returned OPERABLE, the LCO may already have been not met for up to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . This could lead to a total of 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months , since initial failure of the LCO, to restore the vital bus distribution system. At this time, an AC train could again become inoperable, and vital bus distribution restored OPERABLE.

This could continue indefinitely.

(continued)

Revision 0 North Anna Units 1 and 2 B 3.8.9-6

Distribution Systems-Operating B 3.8.9 BASES ACTIONS B.1 (continued)

This Completion Time allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."

This will result in establishing the "time zero" at the time the LCO was initially not met, instead of the time Condition B was entered. The 16 hour1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months Completion Time is an acceptable limitation on this potential to fail to meet the LCO indefinitely.

C.1 With one or more LCO 3.8.9.a DC buses inoperable and a loss of function has not yet occurred, the remaining DC electrical power distribution subsystems are capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in.a safe shutdown condition, assuming no single failure. The overall reliability is reduced, however, because a single failure in the remaining DC electrical power distribution subsystem could result in the minimum required ESF functions not being supported. Therefore, the DC bus(es) must be restored to OPERABLE status within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months by powering the bus(es) from the associated battery or charger.

Condition C represents one or more DC buses without adequate DC power; potentially both with the battery significantly degraded and the associated charger nonfunctioning. In this situation, the unit is significantly more vulnerable to a complete loss of all DC power. It is, therefore, imperative that the operator's attention focus on stabilizing the unit, minimizing the potential for loss of power to the remaining trains and restoring power to the affected train.

This 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months limit is more conservative than Completion Times allowed for the vast majority of components that would be without power. Taking exception to LCO 3.0.2 for components without adequate DC power, which would have Required Action Completion Times shorter than 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , is acceptable because of:

a. The potential for decreased safety by requiring a change in unit conditions (i.e., requiring a shutdown) while allowing stable operations to continue; (continued)

Revision 0 North Anna Units 1 and 2 B 3.8.9-7

Distribution Systems-Operating B 3.8.9 BASES ACTIONS C.1 (continued)

b. The potential for decreased safety by requiring entry into numerous applicable Conditions and Required Actions for components without DC power and not providing sufficient time for the operators to perform the necessary evaluations and actions for restoring power to the affected train; and

c. The potential for an event in conjunction with a single failure of'a redundant component.

The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time for DC buses is consistent with Regulatory Guide 1.93 (Ref. 3).

The second Completion Time for Required Action C.1 establishes a limit on the maximum time allowed for any combination of required distribution subsystems to be inoperable during any single contiguous occurrence of failing to meet the LCO. If Condition C is entered while, for instance, an AC bus is inoperable and subsequently returned OPERABLE, the LCO may already have been not met for up to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . This could lead to a total of 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months , since initial failure of the LCO, to restore the DC distribution system. At this time, an AC train could again become inoperable, and DC distribution restored OPERABLE.

This could continue indefinitely.

This Completion Time allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."

This will result in establishing the "time zero" at the time the LCO was initially not met, instead of the time Condition C was entered. The 16 hour1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months Completion Time is an acceptable limitation on this potential to fail to meet the LCO indefinitely.

D.1 With one or more required LCO 3.8.9.b AC electrical power distribution subsystem(s) inoperable, the shared component(s) on the other unit is not capable of operating.

In this condition, the associated shared component is declared inoperable immediately.

SW, MCR/ESGR EVS, Auxiliary Building central exhaust system, and CC are shared systems.

The associated Conditiohs or Required Actions of LCO 3.7.8, "Service Water System," LCO 3.7.10, "MCR/ESGR Emergency (continued)

Revision 0 North Anna Units 1 and 2 B 3.8.9-8

Distribution Systems-Operating B 3.8.9 BASES ACTIONS D.1 (continued)

Ventilation System," LCO 3.7.12, "Emergency Core Cooling System Pump Room Exhaust Air Cleanup System," and LCO 3.7.19, "Component Cooling Water (CC)

System," are followed.

E.1 With one or more required LCO 3.8.9.b DC electrical power distribution subsystem(s) inoperable, the shared component(s) on the other unit is not capable of operating.

In this condition, the associated shared component is declared inoperable immediately. SW, MCR/ESGR EVS, Auxiliary Building central exhaust system, and CC are shared systems.

The associated Conditions or Required Actions of LCO 3.7.8, 3.7.10, 3.7.12, and 3.7.19 are followed.

F.1 and F.2 If the inoperable LCO 3.8.9.a distribution subsystem cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

G.1 Condition G corresponds to a level of degradation in the electrical power distribution system that causes a required safety function to be lost. When more than one inoperable LCO 3.8.9.a electrical power distribution subsystem results in the loss of a required function, the unit is in a condition outside the accident analysis. Therefore, no additional time is justified for continued operation.

LCO 3.0.3 must be entered immediately to commence a controlled shutdown.

Revision 0 North Anna Units 1 and 2 B 3.8.9-9

Di stri buti on Systems-Operating B 3.8.9 BASES SURVEILLANCE REQUIREMENTS SR 3.8.9.1 This Surveillance verifies that the required AC, DC, and AC vital bus electrical power distribution systems are functioning properly, with the correct circuit breaker alignment. The correct breaker alignment ensures the appropriate separation and independence of the electrical divisions is maintained, and the appropriate voltage is available to each required bus. The verification of proper voltage availability on the buses ensures that the required voltage is readily available for motive as well as control functions for critical system loads connected to these buses. The 7 day Frequency takes into account the redundant capability of the AC, DC, and AC vital bus electrical power distribution subsystems, and other indications available in the control room that alert the operator to subsystem mal functions.

REFERENCES

1. UFSAR, Chapter 6.

2.

UFSAR, Chapter 15.

3. Regulatory Guide 1.93, December 1974.

Revision 0 North Anna Units 1 and 2 B 3.8.9-10

Di stri buti on Systems-Operating B 3.8.9 Table B 3.8.9-1 (page 1 of 1)

AC and DC Electrical Power Distribution Systems TRAIN H*

TRAIN J*

TYPE VOLTAGE Unit 1 Unit 2 Unit 1 Unit 2 AC emergency 4160 V ESF Bus ESF Bus buses 1H 2H 1J 2J 480 V Load Centers Load Centers 1H 2H IJ 2J 1H1 2H1 1ii 2J1 DC buses 125 V Bus 1-1 2-1 Bus 1-111 2-111 Bus 1-11 2-11 Bus 1-IV 2-IV AC vital 120 V Bus 1-1 2-1 Bus 1-3 2-3 buses Bus 1-2 2-2 Bus 1-4 2-4

Each train subsystem.

of the AC and DC electrical power distribution systems is a Revision 0 North Anna Units 1 and 2 B 3.8.9-11

Intentionally Blank

Di stri buti on Systems-Shutdown B 3.8.10 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.10 Distribution Systems-Shutdown BASES BACKGROUND APPLICABLE SAFETY ANALYSES A description of the AC, DC, and AC vital bus electrical power distribution systems is provided in the Bases for LCO 3.8.9, "Distribution Systems-Operating."

The initial conditions of Design Basis Accident and transient analyses in the UFSAR, Chapter 6 (Ref. 1) and Chapter 15 (Ref. 2), assume Engineered Safety Feature (ESF) systems are OPERABLE. The AC, DC, and AC vital bus electrical power distribution systems are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor Coolant System, and containment design limits are not exceeded.

The OPERABILITY of the AC, DC, and AC vital bus electrical power distribution system is consistent with the initial assumptions of the accident analyses and the requirements for the supported systems' OPERABILITY.

The OPERABILITY of the minimum AC, DC, and AC vital bus electrical power distribution subsystems during MODES 5 and 6, and during movement of recently irradiated fuel assemblies ensures that:

a. The unit can be maintained in the shutdown or refueling condition for extended periods;

b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and

c. Adequate power is provided to mitigate events postulated during shutdown, such as a fuel handling accident involving handling recently irradiated fuel. Due to radioactive decay, the AC and DC electrical power is only required to mitigate fuel handling accidents involving handling recently irradiated fuel. (i.e., fuel that has occupied part of a critical core within a time frame established by analysis. The term recently is defined as all irradiated fuel assemblies, until analysis is performed to determine a specific time frame.)

Revision 0 North Anna Units 1 and 2 B 3.8. 10-1

Distribution Systems-Shutdown B 3.8.10 BASES APPLICABLE The AC and DC electrical power distribution systems satisfy SAFETY ANALYSES Criterion 3 of 10 CFR 50.36(c)(2)(ii).

(continued)

LCO Various combinations of subsystems, equipment, and components are required OPERABLE by other LCOs, depending on the specific unit condition. Implicit in those requirements is the required OPERABILITY of necessary support required features. This LCO explicitly requires energization of the portions of the electrical distribution system necessary to support OPERABILITY of required systems, equipment, and components-all specifically addressed in each LCO and implicitly required via the definition of OPERABILITY.

Maintaining these portions of the distribution system energized ensures the availability of sufficient power to operate the unit in a safe manner to mitigate the consequences of postulated events during shutdown (e.g.,

fuel handling accidents involving handling recently irradiated fuel).

APPLICABILITY The AC and DC electrical power distribution subsystems required to be OPERABLE in MODES 5 and 6, and during movement of recently irradiated fuel assemblies, provide assurance that:

a. Systems to provide adequate coolant inventory makeup are available for the irradiated fuel in the core;

b. Systems needed to mitigate a fuel handling accident involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical core within a time frame established by analysis. The term recently is defined as all irradiated fuel assemblies, until analysis is performed to determine a specific time frame.) are available;

c. Systems necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and

d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition and refueling condition.

Revision 0 North Anna Units 1 and 2 B 3.8.10-2

Distribution Systems-Shutdown B 3.8.10 BASES APPLICABILITY The AC, DC, and AC vital bus electrical power distribution (continued) subsystems requirements for MODES 1, 2, 3, and 4 are covered in LCO 3.8.9.

ACTIONS A.1, A.2.1, A.2.2, A.2.3, A.2.4, and A.2.5 Although redundant required features may require redundant trains of electrical power distribution subsystems to be OPERABLE, one OPERABLE distribution subsystem train may be capable of supporting sufficient required features to allow continuation of CORE ALTERATIONS and recently irradiated fuel movement. By allowing the option to declare required features associated with an inoperable distribution subsystem inoperable, appropriate restrictions are implemented in accordance with the affected distribution subsystem LCO's Required Actions. In many instances, this option may involve undesired administrative efforts.

Therefore, the allowance for sufficiently conservative actions is made (i.e., to suspend CORE ALTERATIONS, movement of recently irradiated fuel assemblies, and operations involving positive reactivity additions) that could result in loss of required SDM (MODE

5) or boron concentration (MODE 6). Suspending positive reactivity additions that could result in failure to meet the minimum SDM or boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than what would be required in the RCS for minimum SDM or refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. Introduction of temperature changes including temperature increases when operating with a positive MTC must also be evaluated to ensure they do not result in a loss of required SDM.

Suspension of these activities does not preclude completion of actions to establish a safe conservative condition. These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required AC and DC electrical power distribution subsystems and to continue this action until restoration is accomplished in order to provide the necessary power to the unit safety systems.

(continued)

North Anna Units 1 and 2 Revision 0 B 3.8.10-3

Distribution Systems-Shutdown B 3.8.10 BASES A.1, A.2.1, A.2.2, A.2.3, A.2.4, and A.2.5 (continued)

Notwithstanding performance of the above conservative Required Actions, a required residual heat removal (RHR) subsystem may be inoperable. In this case, Required Actions A.2.1 through A.2.4 do not adequately address the concerns relating to coolant circulation and heat removal.

Pursuant to LCO 3.0.6, the'RHR ACTIONS would not be entered.

Therefore, Required Action A.2.5 is provided to direct declaring RHR inoperable, which results in taking the appropriate RHR actions.

The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required distribution subsystems should be completed as quickly as possible in order to minimize the time the unit safety systems may be without power.

SURVEILLANCE REQUIREMENTS SR 3.8.10.1 This Surveillance verifies that the required AC, DC, and AC vital bus electrical power distribution subsystems are functioning properly, with all the buses energized. The verification of proper voltage availability on the buses ensures that the required power is readily available for motive as well as control functions for critical system loads connected to these buses. The 7 day Frequency takes into account the capability of the electrical power distribution subsystems, and other indications available in the control room that alert the operator to subsystem malfunctions.

REFERENCES

1. UFSAR, Chapter 6.

2. UFSAR, Chapter 15.

Revision 0 North Anna Units 1 and 2 ACTIONS B 3.8.10-4

Boron Concentration B 3.9.1 B 3.9 REFUELING OPERATIONS B 3.9.1 Boron Concentration BASES BACKGROUND The limit on the boron concentrations of the Reactor Coolant System (RCS),

the refueling canal, and the refueling cavity during refueling ensures that the reactor remains subcritical during MODE 6. Refueling boron concentration is the soluble boron concentration in the coolant in each of these volumes having direct access to the reactor core during refueling.

The soluble boron concentration offsets the core reactivity and is measured by chemical analysis of a representative sample of the coolant in each of the volumes. The refueling boron concentration limit is specified in the COLR. Plant procedures ensure the specified boron concentration in order to maintain an overall core reactivity of keff

0.95 during fuel handling, with control rods and fuel assemblies assumed to be in the most adverse configuration (least negative reactivity) allowed by plant procedures.

GDC 26 requires that two independent reactivity control systems of different design principles be provided (Ref. 1).

One of these systems must be capable of holding the reactor core subcritical under cold conditions. The Chemical and Volume Control System (CVCS) is the system capable of maintaining the reactor subcritical in cold conditions by maintaining the boron concentration.

The reactor is brought to shutdown conditions before beginning operations to open the reactor vessel for refueling. After the RCS is cooled and depressurized and the vessel head is unbolted, the head is slowly removed to form the refueling cavity. The refueling canal and the refueling cavity are then flooded with borated water from the Refueling Water Storage Tank through the open reactor vessel by gravity feeding or by the use of the Low Head Safety Injection System pumps.

The pumping action of the Residual Heat Removal (RHR) System in the RCS and the natural circulation due to thermal driving heads in the reactor vessel and refueling cavity mix the added concentrated boric acid with the water in the refueling canal. The RHR System is in operation during (continued)

S...

A.

a 1

9 R

ii Revision 0 northl m-nlrl Unl ! LZ aIu

Boron Concentration B 3.9.1 BASES BACKGROUND (continued)

APPLICABLE SAFETY ANALYSES LCO refueling (see LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation-High Water Level," and LCO 3.9.6, "Residual Heat Removal (RHR) and Coolant Circulation-Low Water Level") to provide forced circulation in the RCS and assist in maintaining the boron concentrations in the RCS, the refueling canal, and the refueling cavity above the COLR limit.

During refueling operations, the reactivity condition of the core is established to protect against inadvertent positive reactivity addition and is conservative for MODE 6. The boron concentration limit specified in the COLR is based on the core reactivity at the beginning of each fuel cycle (the end of refueling) and includes an uncertainty allowance.

The required boron concentration and the plant refueling procedures that verify the correct fuel loading plan (including full core mapping) ensure that the keff of the core will remain

0.95 during the refueling operation.

Hence, at least a 5% Ak/k margin of safety is established during refueling.

During refueling, the water volume in the spent fuel pool, the transfer canal, the refueling canal, the refueling cavity, and the reactor vessel form a single mass. As a result, the soluble boron concentration is relatively the same in each of these volumes.

The RCS boron concentration satisfies Criterion 2 of 10 CFR 50.36(c) (2) (ii).

The LCO requires that a minimum boron concentration be maintained in the RCS, the refueling canal, and the refueling cavity while in MODE 6. The boron concentration limit specified in the COLR ensures that a core keff of

0.95 is maintained during fuel handling operations.

Violation of the LCO could lead to an inadvertent criticality during MODE 6.

APPLICABILITY This LCO is applicable in MODE 6 to ensure that the fuel in the reactor vessel will remain subcritical. The required boron concentration ensures a keff 5 0.95. Above MODE 6, (continued)

Revision 0 North Anna Units 1 and 2 B 3.9.1-2

Boron Concentration B 3.9.1 BASES APPLICABILITY LCO 3.1.1, "SHUTDOWN MARGIN (SDM)"

ensures that an adequate (continued) amount of negative reactivity is available to shut down the reactor and maintain it subcritical.

The applicability is modified by a Note. The Note states that the limits on boron concentration are only applicable to the refueling canal and refueling cavity when those volumes are connected to the RCS. When the refueling canal and refueling cavity are isolated from the RCS, no potential path for boron dilution exists.

ACTIONS A.1 and A.2 Continuation of CORE ALTERATIONS or positive reactivity additions (including actions to reduce boron concentration) is contingent upon maintaining the unit in compliance with the LCO.

If the boron concentration of any coolant volume in the RCS, the refueling canal, or the refueling cavity is less than its limit, all operations involving CORE ALTERATIONS or positive reactivity additions must be suspended immediately.

Suspension of CORE ALTERATIONS and positive reactivity additions shall not preclude moving a component to a safe position. Operations that individually add limited positive reactivity (e.g., temperature fluctuations from inventory addition or temperature control fluctuations), but when combined with all other operations affecting core reactivity (e.g., intentional boration) result in overall net negative reactivity addition, are not precluded by this action.

A.3 In addition to immediately suspending CORE ALTERATIONS and positive reactivity additions, boration to restore the concentration must be initiated immediately.

In determining the required combination of boration flow rate and concentration, no unique Design Basis Event must be satisfied. The only requirement is to restore the boron concentration to its required value as soon as possible. In order to raise the boron concentration as soon as possible, the operator should begin boration with the best source available for unit conditions.

(continued)

Revision 0 North Anna Units 1 and 2 B 3.9.1-3

Boron Concentration B 3.9.1 BASES ACTIONS A.3 (continued)

Once actions have been initiated, they must be continued until the boron concentration is restored. The restoration time depends on the amount of boron that must be injected to reach the required concentration.

SURVEILLANCE REQUIREMENTS REFERENCES SR 3.9.1.1 This SR ensures that the coolant boron concentration in the RCS, and connected portions of the refueling canal and the refueling cavity, is within the COLR limits. The boron concentration of the coolant in each required volume is determined periodically by chemical analysis. Prior to re-connecting portions of the refueling canal or the refueling cavity to the RCS, this SR must be met per SR 3.0.1. If any dilution activity has occurred while the cavity or canal were disconnected from the RCS, this SR ensures the correct boron concentration prior to communication with the RCS.

A minimum Frequency of once every 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is a reasonable amount of time to verify the boron concentration of representative samples. The Frequency is based on operating experience, which has shown 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to be adequate.

1. UFSAR, Section 3.1.22.

Revision 0 North Anna Units I and 2 B 3.9.1-4

Primary Grade Water Flow Path Isolation Valves-MODE 6 B 3.9.2 B 3.9 REFUELING OPERATIONS B 3.9.2 Primary Grade Water Flow Path Isolation Valves-MODE 6 BASES BACKGROUND APPLICABLE SAFETY ANALYSES LCO During MODE 6 operations, the isolation valves for primary grade water flow paths that are connected to the Reactor Coolant System (RCS) must be closed to prevent unplanned boron dilution of the reactor coolant. The isolation valves must be locked, sealed or otherwise secured in the closed position.

The Chemical and Volume Control System is capable of supplying borated and unborated water to the RCS through various flow paths. Since a positive reactivity addition made by uncontrolled reduction of the boron concentration is inappropriate during MODE 6, isolation of all primary grade water flow paths prevents an unplanned boron dilution.

The possibility of an inadvertent boron dilution event (Ref. 1) occurring during MODE 6 refueling operations is precluded by adherence to this LCO, which requires that primary grade water flow paths be isolated. Closing the required valves during refueling operations prevents the flow of unborated water to the filled portion of the RCS. The valves are used to isolate primary grade water flow paths.

These valves have the potential to indirectly allow dilution of the RCS boron concentration in MODE 6. By isolating primary grade water flow paths, a safety analysis for an uncontrolled boron dilution accident is not required for MODE 6.

The RCS boron concentration satisfies Criterion 2 of 10 CFR 50.36(c) (2) (ii).

This LCO requires that flow paths to the RCS from primary grade water sources be isolated to prevent unplanned boron dilution during MODE 6 and thus avoid a reduction in SDM.

For Unit 1, primary grade water flow paths may be isolated from the RCS by closing valve 1-CH-217 or 1-CH-220, 1-CH-241, FCV-1114B and FCV-1113B. For Unit 2, primary grade water flow paths may be isolated from the RCS by closing valve 2-CH-140, or 2-CH-160, 2-CH-156, FCV-2114B, and FCV-2113B.

(continued)

Revision 0 North Anna Units 1 and 2 B 3.9.2-1

Primary Grade Water Flow Path Isolation Valves-MODE 6 B 3.9.2 BASES LCO The LCO is modified by a Note which allows the primary grade (continued) water flow path isolation valves to be opened under administrative control for planned boron dilution or makeup activities.

APPLICABILITY In MODE 6, this LCO is applicable to prevent an inadvertent boron dilution event by ensuring isolation of primary grade water flow paths to the RCS.

In MODES 3, 4-, and 5, LCO 3.1.8, Primary Grade Water Flow Path Isolation Valves, requires the primary grade water flow paths to the RCS to be isolated to prevent an inadvertent boron dilution.

In MODES 1 and 2, the boron dilution accident was' analyzed and was found to be capable of being mitigated.

A.1 Continuation of CORE ALTERATIONS is contingent upon maintaining the unit in compliance with this LCO. With any valve used to isolate primary grade water flow paths not locked, sealed or otherwise secured in the closed position, all operations involving CORE ALTERATIONS must be suspended immediately. The Completion Time of "immediately" for performance of Required Action A.1 shall not preclude completion of movement of a component to a safe position.

Condition A has been modified by a Note to require that Required Action A.3 be completed whenever Condition A is entered.

A.2 Preventing inadvertent dilution of the reactor coolant boron concentration is dependent on maintaining the primary grade water flow path isolation valves secured closed. Locking, sealing, or securing the valves in the closed position ensures that the valves cannot be inadvertently opened. The Completion Time of 15 minutes provides sufficient time to close, lock, seal, or otherwise secure the flow path isolation valve.

Revision 0 North Anna Units 1 and 2 ACTIONS B 3.9.2-2

Primary Grade Water Flow Path Isolation Valves-MODE 6 B 3.9.2 BASES ACTIONS A.3 (conti nued)

Due to the potential of having diluted the boron concentration of the reactor coolant, SR 3.9.1.1 (verification of boron concentration) must be performed to demonstrate that the required boron concentration exists.

The Completion Time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is sufficient to obtain and analyze a reactor coolant sample for boron concentration.

SURVEILLANCE SR 3.9.2.1 REQUIREMENTS These valves are to be locked, sealed, or otherwise secured closed to isolate possible dilutionpaths. The likelihood of a significant reduction in the boron concentration during MODE 6 operations is remote due to the large mass of borated water in the refueling cavity and the fact that the primary grade water flow paths are isolated, precluding a dilution.

The boron concentration is checked every 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months during MODE 6 under SR 3.9.1.1. The Frequency is based on verifying that the isolation valves are locked, sealed, or otherwise secured within 15 minutes following a boron dilution or makeup activity. This Frequency is based on engineering judgment and is considered reasonable in view of other administrative controls that will ensure that the valve opening is an unlikely possibility.

REFERENCES

1. UFSAR, Section 15.2.4.

Revision 0 North Anna Units 1 and 2 B 3.9.2-3

Intentionally Blank

Nuclear Instrumentation B 3.9.3 B 3.9 REFUELING OPERATIONS B 3.9.3 Nuclear Instrumentation BASES BACKGROUND APPLICABLE SAFETY ANALYSES LCO The source range neutron flux monitors are used during refueling operations to monitor the core reactivity condition. The installed source range neutron flux monitors are part of the Nuclear Instrumentation System (NIS).

These detectors are located external to the reactor vessel and detect neutrons leaking from the core.

The installed source range neutron flux monitors are BF3 detectors operating in the proportional region of the gas filled detector characteristic curve. The detectors monitor the neutron flux in counts per second. The instrument range covers six decades of neutron flux (1E+6 cps). The detectors also provide continuous visual indication and an audible alarm in the control room to alert operators to a possible dilution accident. The NIS is designed in accordance with the criteria presented in Reference 1.

Two OPERABLE source range neutron flux monitors are required to provide a signal to alert the operator to unexpected changes in core reactivity such as with a boron dilution accident (Ref. 2) or an improperly loaded fuel assembly. The need for a safety analysis for an uncontrolled boron dilution accident is eliminated by isolating all unborated water sources as required by LCO 3.9.2, "Primary Grade Water Flow Path Isolation Valves-MODE 6."

The source range neutron flux monitors satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

This LCO requires that two source range neutron flux monitors be OPERABLE to ensure that redundant monitoring capability is available to detect changes in core reactivity.

Revision 0 North Anna Units 1 and 2 B 3.9.3-1

Nuclear Instrumentation B 3.9.3 BASES APPLICABILITY In MODE 6, the source range neutron flux monitors must be OPERABLE to determine changes in core reactivity. There are no other direct means available to check core reactivity levels. In MODES 2, 3, 4, and 5, these same installed source range detectors and circuitry are also required to be OPERABLE by LCO 3.3.1, "Reactor Trip System (RTS)

Instrumentation."

ACTIONS A.1 and A.2 With only one source range neutron flux monitor OPERABLE, redundancy has been lost. Since these instruments are the only direct means of monitoring core reactivity conditions, CORE ALTERATIONS and introduction of coolant into the RCS with boron concentration less than required to meet the minimum boron concentration of LCO 3.9.1 must be suspended immediately. Suspending positive reactivity additions that could result in failure to meet the minimum boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than that what would be required in the RCS for minimum refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operations. Performance of Required Action A.1 shall not preclude completion of movement of a component to a safe position.

B.A With no source range neutron flux monitor OPERABLE, action to restore a monitor to OPERABLE status shall be initiated immediately. Once initiated, action shall be continued until a source range neutron flux monitor is restored to OPERABLE status.

B.2 With no source range neutron flux monitor OPERABLE, there are no direct means of detecting changes in core reactivity.

However, since CORE ALTERATIONS and positive reactivity additions are not to be made, the core reactivity condition is stabilized until the source range neutron flux monitors are OPERABLE.

This stabilized condition is determined by performing SR 3.9.1.1 to ensure that the required boron concentration exists.

(continued)

Revision 0 North Anna Units 1 and 2 B 3.9.3-2

Nuclear Instrumentation B 3.9.3 BASES ACTIONS B.2 (continued)

The Completion Time of once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is sufficient to obtain and analyze a reactor coolant sample for boron concentration and ensures that unplanned changes in boron concentration would be identified. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is reasonable, considering the low probability of a change in core reactivity during this time period.

SURVEILLANCE SR 3.9.3.1 REQUIREMENTS SR 3.9.3.1 is the performance of a CHANNEL CHECK, which is a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that the two indication channels should be consistent with core conditions. Changes in fuel loading and core geometry can result in significant differences between source range channels, but each channel should be consistent with its local conditions.

The Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is consistent with the CHANNEL CHECK Frequency specified similarly for the same instruments in LCO 3.3.1.

SR 3.9.3.2 SR 3.9.3.2 is the performance of a CHANNEL CALIBRATION every 18 months. This SR is modified by a Note stating that neutron detectors are excluded from the CHANNEL CALIBRATION.

The CHANNEL CALIBRATION for the source range neutron flux monitors consists of obtaining the detector plateau or preamp discriminator curves, evaluating those curves, and comparing the curves to the manufacturer's data. The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage. Operating experience has shown these components usually pass the Surveillance when performed at the 18 month Frequency.

REFERENCES

1. UFSAR, Chapter 3.

2.

UFSAR, Chapter 15.

Revision 0 North Anna Units 1 and 2 B 3.9.3-3

Intentionally Blank

Containment Penetrations B 3.9.4 B 3.9 REFUELING OPERATIONS B 3.9.4 Containment Penetrations BASES BACKGROUND During movement of recently irradiated fuel assemblies within containment, a release of fission product radioactivity within containment will be restricted from escaping to the environment when the LCO requirements are met. In MODES 1, 2, 3, and 4, this is accomplished by maintaining containment OPERABLE as described in LCO 3.6.1, "Containment." In MODE 6, the potential for containment pressurization as a result of an accident is not likely; therefore, requirements to isolate the containment from the outside atmosphere can be less stringent. The LCO requirements are referred to as "containment closure" rather than "containment OPERABILITY." Containment closure means that all potential escape paths are closed or capable of being closed. Since there is no potential for containment pressurization, the Appendix J leakage criteria and tests are not required.

The containment serves to contain fission product radioactivity that may be released from the reactor core following an accident, such that offsite radiation exposures are maintained well within the requirements of 10 CFR 100.

Additionally, the containment provides radiation shielding from the fission products that may be present in the containment atmosphere following accident conditions.

The containment equipment hatch, which is part of the containment pressure boundary, provides a means for moving large equipment and components into and out of containment.

During movement of recently irradiated fuel assemblies within containment, the equipment hatch must be held in place by at least four bolts. Good engineering practice dictates that the bolts required by this LCO be approximately equally spaced.

The containment air locks, which are also part of the containment pressure boundary, provide a means for personnel access during MODES 1, 2, 3, and 4 unit operation in accordance with LCO 3.6.2, "Containment Air Locks." One of the containment air locks is an integral part of the containment equipment hatch. During refueling the air lock that is part of the containment equipment hatch is typically (continued)

North Anna Units 1 and 2 Revision 0 B 3.9.4-1

Containment Penetrations B 3.9.4 BASES BACKGROUND (continued) replaced by a temporary hatch plate. While the temporary hatch plate is installed, there is only one air lock by which to enter containment. The LCO only applies to containment air locks that are installed. Each air lock has a door at both ends. The doors are normally interlocked to prevent simultaneous opening when containment OPERABILITY is required. During periods of unit shutdown when containment closure is not required, the door interlock mechanism may be disabled, allowing both doors of an air lock to remain open for extended periods when frequent containment entry is necessary. During movement of recently irradiated fuel assemblies within containment, containment closure is required; therefore, the door interlock mechanism may remain disabled, but one air lock door must always remain capable of being closed.

The requirements for containment penetration closure ensure that a release of fission product radioactivity within containment will be restricted to within regulatory limits.

The Containment Purge and Exhaust System includes a 36 inch purge penetration and a 36 inch exhaust penetration. During MODES 1, 2, 3, and 4, the two valves in each of the purge and exhaust flow paths are secured in the closed position. The Containment Purge and Exhaust System is not subject to a Specification in MODE 5.

In MODE 6, large air exchanges are necessary to conduct refueling operations. The 36 inch purge system is used for this purpose.

The containment penetrations that provide direct access from containment atmosphere to outside atmosphere must be isolated on at least one side. Isolation may be achieved by an OPERABLE automatic isolation valve, or by a manual isolation valve, blind flange, or equivalent. Equivalent isolation methods must be approved and may include use of a material that can provide a temporary, atmospheric pressure, ventilation barrier for the other containment penetrations during recently irradiated fuel movements.

APPLICABLE During movement of irradiated fuel assemblies within SAFETY ANALYSES containment, the most severe radiological consequences result from a fuel handling accident involving handling recently irradiated fuel. The fuel handling accident is a postulated event that involves damage to irradiated fuel (continued)

Revision 0 North Anna Units 1 and 2 B 3.9.4-2

Containment Penetrations B 3.9.4 BASES APPLICABLE SAFETY ANALYSES (continued)

(Ref. 1). Fuel handling accidents, analyzed in Reference 2, involve dropping a single irradiated fuel assembly and handling tool. The requirements of LCO 3.9.7, "Refueling Cavity Water Level," in conjunction with a minimum decay time of 100 hours0.00116 days 0.0278 hours 1.653439e-4 weeks 3.805e-5 months prior to movement of recently irradiated fuel with containment closure capability or movement of fuel that has not been recently irradiated without containment closure capability ensures that the release of fission product radioactivity, subsequent to a fuel handling accident, results in doses that are well within the guideline values specified in 10 CFR 100. Standard Review Plan, Section 15.7.4, Rev.

1 (Ref. 2), defines "well within" 10 CFR 100 to be 25% or less of the 10 CFR 100 values. The acceptance limits for offsite radiation exposure will be 25%

of 10 CFR 100 values or the NRC staff approved licensing basis (e.g., a specified fraction of 10 CFR 100 limits).

Containment penetrations satisfy Criterion 3 of 10 CFR 50.36(c) (2) (ii).

This LCO limits the consequences of a fuel handling accident involving handling recently irradiated fuel in containment by limiting the potential escape paths for fission product radioactivity released within containment. The LCO requires any penetration providing direct access from the containment atmosphere to the outside atmosphere to be closed except for the OPERABLE containment purge and exhaust penetrations and containment personnel air locks. For the OPERABLE containment purge and exhaust penetrations, this LCO ensures that these penetrations are isolable by a containment purge and exhaust isolation valve.

The LCO is modified by a Note allowing penetration flow paths with direct access from the containment atmosphere to the outside atmosphere to be unisolated under administrative controls. Administrative controls ensure that 1) appropriate personnel are aware of the open status of the penetration flow path during movement of recently irradiated fuel assemblies within containment, and 2) specified individuals are designated and readily available to isolate the flow path in the event of a fuel handling accident.

The containment personnel air lock doors may be open during movement of recently irradiated fuel in the containment provided that one door is capable of being closed in the event of a fuel handling accident. Should a fuel handling (continued)

North Anna Units 1 and 2 LCO Revision 0 B 3.9.4-3

Containment Penetrations B 3.9.4 BASES LCO accident occur inside containment, one personnel air lock (continued) door will be closed following an evacuation of the containment.

APPLICABILITY The containment penetration requirements are applicable during movement of recently irradiated fuel assemblies within containment because this is when there is a potential for the limiting fuel handling accident. In MODES 1, 2, 3, and 4, containment penetration requirements are addressed by LCO 3.6.1. In MODES 5 and 6, when movement of irradiated fuel assemblies within containment is not being conducted, the potential for a fuel handling accident does not exist.

Additionally, due to radioactive decay, a fuel handling accident involving handling recently irradiated fuel (i.e.,

fuel that has occupied part of a critical reactor core within a time frame established by analysis. The term recently is defined as all irradiated fuel assemblies, until analysis is performed to determine a specific time.) will result in doses that are well within the guideline values specified in 10 CFR 100 even without containment closure capability.

Therefore, under these conditions no requirements are placed on containment penetration status.

ACTIONS A.1 If the containment equipment hatch, air locks, or any containment penetration that provides direct access from the containment atmosphere to the outside atmosphere is not in the required status, including the Containment Purge and Exhaust Isolation System not capable of manual actuation when the purge and exhaust valves are open, the unit must be placed in a condition where the isolation function is not needed. This is accomplished by immediately suspending movement of recently irradiated fuel assemblies within containment. Performance of these actions shall not preclude completion of movement of a component to a safe position.

SURVEILLANCE SR 3.9.4.1 REQUIREMENTS This Surveillance demonstrates that each of the containment penetrations required to be in its closed position is in that position. The Surveillance on the open purge and exhaust valves will demonstrate that the valves are not blocked from (continued)

Revision 0 North Anna Units 1 and 2 B 3.9.4-4

Containment Penetrations B 3.9.4 BASES SURVEILLANCE SR 3.9.4.1 (continued)

REQUI REMENTS closing. Also the Surveillance will demonstrate that each valve operator has motive power, which will ensure that each valve is capable of being manually closed.

The Surveillance is performed every 7 days during movement of recently irradiated fuel assemblies within containment.

The Surveillance interval is selected to be commensurate with the normal duration of time to complete fuel handling operations. A surveillance before the start of refueling operations will provide two or three surveillance verifications during the applicable period for this LCO. As such, this Surveillance ensures that a postulated fuel handling accident involving handling recently irradiated fuel that releases fission product radioactivity within the containment will not result in a release of significant fission product radioactivity to the environment in excess of those recommended by Standard Review Plan 15.7.4 (Ref.

2).

SR 3.9.4.2 This Surveillance demonstrates that each containment purge and exhaust valve actuates to its isolation position on manual initiation. The 18 month Frequency maintains consistency with other similar valve testing requirements.

This Surveillance performed during MODE 6 will ensure that the valves are capable of being closed after a postulated fuel handling accident involving handling recently irradiated fuel to limit a release of fission product radioactivity from the containment. The SR is modified by a Note stating that this Surveillance is not required to be met for valves in isolated penetrations. The LCO provides the option to close penetrations in lieu of requiring manual initiation capability.

REFERENCES

1. UFSAR, Section 15.4.7.

2. NUREG-0800, Rev. 2, July 1981.

Revision 0 North Anna Units 1 and 2 B 3.9.4-5

Intentionally Blank

RHR and Coolant Circulation-High Water Level B 3.9.5 B 3.9 REFUELING OPERATIONS B 3.9.5 Residual Heat Removal (RHR) and Coolant Circulation-High Water Level BASES BACKGROUND APPLICABLE SAFETY ANALYSES The purpose of the RHR System in MODE 6 is to remove decay heat and sensible heat from the Reactor Coolant System (RCS) to provide mixing of borated coolant and to prevent boron stratification (Ref.

1). Heat is removed from the RCS by circulating reactor coolant through the RHR heat exchanger(s), where the heat is transferred to the Component Cooling Water System. The coolant is then returned to the RCS via the RCS cold leg(s). Operation of the RHR System for normal cooldown or decay heat removal is manually accomplished from the control room. The heat removal rate is adjusted by controlling the flow of reactor coolant through the RHR heat exchanger(s) and the bypass. Mixing of the reactor coolant is maintained by this continuous circulation of reactor coolant through the RHR System.

If the reactor coolant temperature is not maintained below 2000F, boiling of the reactor coolant could result. This could lead to a loss of coolant in the reactor vessel.

Additionally, boiling of the reactor coolant could lead to a reduction in boron concentration in the coolant due to boron plating out on components near the areas of the boiling activity. The loss of reactor coolant and the reduction of boron concentration in the reactor coolant would eventually challenge the integrity of the fuel cladding, which is a fission product barrier. One train of the RHR System is required to be operational in MODE 6, with the water level

Ž 23 ft above the top of the reactor vessel flange, to prevent this challenge. The LCO does permit removal of the RHR loop from operation for short durations, under the condition that the boron concentration is not diluted. This conditional removal from operation of the RHR loop does not result in a challenge to the fission product barrier.

The RHR System satisfies Criterion 4 of 10 CFR 50.36(c) (2) (ii).

LCO Only one RHR loop is required for decay heat removal in MODE 6, with the water level Ž 23 ft above the top of the reactor vessel flange. Only one RHR loop is required to be (continued)

Revision 0 North Anna Units 1 and 2 B 3.9.5-1

RHR and Coolant Circulation-High Water Level B 3.9.5

.BASES LCO (continued)

APPLICABILITY OPERABLE, because the volume of water above the reactor vessel flange provides backup decay heat removal capability.

At least one RHR loop must be OPERABLE and in operation to provide:

a. Removal of decay heat;

b.

Mixing of borated coolant to minimize the possibility of criticality; and

c. Indication' of reactor coolant temperature.

An OPERABLE RHR loop includes an RHR pump, a heat exchanger, valves, piping, instruments, and controls to ensure an OPERABLE flow path and to determine the RHR discharge temperature. The flow path starts in one of the RCS hot legs and is returned to at least one of the RCS cold legs.

The LCO is modified by a Note that allows the required operating RHR loop to be removed from operation for up to 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months per 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months period, provided no operations are permitted that would dilute the RCS boron concentration by introduction of coolant into the RCS with boron concentration less than required to meet the minimum boron concentration of LCO 3.9.1. Boron concentration reduction with coolant at boron concentrations less than required to assure the RCS boron concentration is maintained is prohibited because uniform concentration distribution cannot be ensured without forced circulation. This permits operations such as core mapping or alterations in the vicinity of the reactor vessel hot leg nozzles and RCS to RHR isolation valve testing. During this 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months period, decay heat is removed by natural convection to the large mass of water in the refueling cavity.

One RHR loop must be OPERABLE and in operation in MODE 6, with the water level Ž 23 ft above the top of the reactor vessel flange, to provide decay heat removal.

The 23 ft water level was selected because it corresponds to the 23 ft requirement established for fuel movement in LCO 3.9.7, "Refueling Cavity Water Level." Requirements for the RHR System in other MODES are covered by LCOs in Section 3.4, Reactor Coolant System (RCS).

RHR loop requirements in MODE 6 with the water level < 23 ft are located in LCO 3.9.6, "Residual Heat Removal (RHR) and Coolant Circulation-Low Water Level."

Revision 0 North Anna Units 1 and 2 B 3.9.5-2

RHR and Coolant Circulation-High Water Level B 3.9.5 BASES ACTIONS RHR loop requirements are met by having one RHR loop OPERABLE and in operation, except as permitted in the Note to the LCO.

A.1 If RHR loop requirements are not met, there will be no forced circulation to provide mixing to establish uniform boron concentrations. Suspending positive reactivity additions that could result in failure to meet the minimum boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than what would be required in the RCS for minimum refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation.

A.2 If RHR loop requirements are not met, actions shall be taken immediately to suspend loading of irradiated fuel assemblies in the core. With no forced circulation cooling, decay heat removal from the core occurs by natural convection to the heat sink provided by the water above the core. A minimum refueling water level of 23 ft above the reactor vessel flange provides an adequate available heat sink. Suspending any operation that would increase decay heat load, such as loading a fuel assembly, is a prudent action under this condition.

A.3 If RHR loop requirements are not met, actions shall be initiated and continued in order to satisfy RHR loop requirements. With the unit in MODE 6 and the refueling water level Ž 23 ft above the top of the reactor vessel flange, corrective actions shall be initiated immediately.

A.4, A.5, A.6.1, and A.6.2 If LCO 3.9.5 is not met, the following actions must be taken:

a. the equipment hatch or equipment hatch cover must be closed and secured with at least four bolts;

b. one door in each installed air lock must be closed; and (continued)

North Anna Units 1 and 2 Revision 0 B 3.9.5-3

RHR and Coolant Circulation-High Water Level B 3.9.5 BASES ACTIONS A.4, A.5, A.6.1, and A.6.2 (continued)

c. each penetration providing direct access from the containment atmosphere to the outside atmosphere must be either closed by a manual or automatic isolation valve, blind flange, or equivalent, or verified to be capable of being closed by an OPERABLE Containment Purge and Exhaust Isolation system.

With RHR loop requirements not met, the potential exists for the coolant to boil and release radioactive gas to the containment atmosphere. Performing the actions described above ensures that all containment penetrations are either closed or can be closed so that the dose limits are not exceeded.

The Completion Time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months allows fixing of most RHR problems and is reasonable, based on the low probability of the coolant boiling in that time.

SURVEILLANCE SR 3.9.5.1 REQU IREMENTS This Surveillance demonstrates that the RHR loop is in operation and circulating reactor coolant. The flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability and to prevent thermal and boron stratification in the core. The Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is sufficient, considering the flow, temperature, pump control, and alarm indications available to the operator in the control room for monitoring the RHR System.

REFERENCES

1. UFSAR, Section 5.5.4.

Revision 0 North Anna Units 1 and 2 B 3.9.5-4

RHR and Coolant Circulation-Low Water Level B 3.9.6 B 3.9 REFUELING OPERATIONS B 3.9.6 Residual Heat Removal (RHR) and Coolant Circulation-Low Water Level BASES BACKGROUND APPLICABLE SAFETY ANALYSES The purpose of the RHR System in MODE 6 is to remove decay heat and sensible heat from the Reactor Coolant System (RCS) to provide mixing of borated coolant, and to prevent boron stratification (Ref. 1). Heat is removed from the RCS by circulating reactor coolant through the RHR heat exchangers where the heat is transferred to the Component Cooling Water System. The coolant is then returned to the RCS via the RCS cold leg(s). Operation of the RHR System for normal cooldown decay heat removal is manually accomplished from the control room. The heat removal rate is adjusted by controlling the flow of reactor coolant through the RHR heat exchanger(s) and the bypass lines. Mixing of the reactor coolant is maintained by this continuous circulation of reactor coolant through the RHR System.

If the reactor coolant temperature is not maintained below 2000F, boiling of the reactor coolant could result. This could lead to a loss of coolant in the reactor vessel.

Additionally, boiling of the reactor coolant could lead to a reduction in boron concentration in the coolant due to the boron plating out on components near the areas of the boiling activity. The loss of reactor coolant and the reduction of boron concentration in the reactor coolant will eventually challenge the integrity of the fuel cladding, which is a fission product barrier. Two trains of the RHR System are required to be OPERABLE, and one train in operation, in order to prevent this challenge.

The RHR System satisfies Criterion 4 of 10 CFR 50.36(c) (2) (ii).

LCO In MODE 6, with the water level < 23 ft above the top of the reactor vessel flange, both RHR loops must be OPERABLE.

Additionally, one loop of RHR must be in operation in order to provide:

a. Removal of decay heat; (continued)

North Anna Units 1 and 2 Revision 0 B 3.9.6-1

RHR and Coolant Circulation-Low Water Level B 3.9.6 BASES LCO (continued)

APPLICABILITY

b. Mixing of borated coolant to minimize the possibility of criticality; and

c. Indication of reactor coolant temperature.

This LCO is modified by two Notes. Note 1 permits the RHR pumps to be removed from operation for

15 minutes when switching from one train to another. The circumstances for stopping both RHR pumps are to be limited to situations when the outage time is short and the core outlet temperature is maintained > lOF below saturation temperature. The Note prohibits boron dilution or draining operations when RHR forced flow is stopped. Note 2 allows one-RHR loop to be inoperable for a period of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months provided the other loop is OPERABLE and in operation. Prior to declaring the loop inoperable, consideration should be given to the existing unit configuration. This consideration should include that the core time to boil is short, there is no draining operation to further reduce RCS water level and that the capability exists to inject borated water into the reactor vessel. This permits surveillance tests to be performed on the inoperable loop during a time when these tests are safe and possible.

An OPERABLE RHR loop consists of an RHR pump, a heat exchanger, valves, piping, instruments and controls to ensure an OPERABLE flow path and to determine the RHR discharge temperature. The flow path starts in one of the RCS hot legs and is returned to at least one of the RCS cold legs.

Two RHR loops are required to be OPERABLE, and one RHR loop must be in operation in MODE 6, with the water level < 23 ft above the top of the reactor vessel flange, to provide decay heat removal. Requirements for the RHR System in other MODES are covered by LCOs in Section 3.4, Reactor Coolant System (RCS).

RHR loop requirements in MODE 6 with the water level

Ž 23 ft are located in LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation-High Water Level."

ACTIONS A.1 and A.2 If less than the required number of RHR loops are OPERABLE, action shall be immediately initiated and continued until the RHR loop is restored to OPERABLE status and to operation (continued)

Revision 0 North Anna Units 1 and 2 B 3.9.6-2

RHR and Coolant Circulation-Low Water Level B 3.9.6 BASES ACTIONS A.1 and A.2 (continued) or until Ž 23 ft of water level is established above the reactor vessel flange. When the water level is Ž 23 ft above the reactor vessel flange, the Applicability changes to that of LCO 3.9.5, and only one RHR loop is required to be OPERABLE and in operation. An immediate Completion Time is necessary for an operator to initiate corrective actions.

B.1 If no RHR loop is in operation, there will be no forced circulation to provide mixing to establish uniform boron concentrations. Reduced boron concentrations cannot occur by the addition of water with a lower boron concentration than that contained in the RCS, because all of the unborated water sources are isolated.

B.2 If no RHR loop is in operation, actions shall be initiated immediately, and continued, to restore one RHR loop to operation. Since the unit is in Conditions A and B concurrently, the restoration of two OPERABLE RHR loops and one operating RHR loop should be accomplished expeditiously.

B.3, B.4, B.5.1, and B.5.2 If no RHR is in operation, the following actions must be taken:

a. the equipment hatch or equipment hatch cover must be closed and secured with at least four bolts;

b. one door in each installed air lock must be closed; and

c. each penetration providing direct access from the containment atmosphere to the outside atmosphere must be either closed by a manual or automatic isolation valve, blind flange, or equivalent, or verified to be capable of being closed by an OPERABLE Containment Purge and Exhaust Isolation system.

With RHR loop requirements not met, the potential exists for the coolant to boil and release radioactive gas to the containment atmosphere. Performing the actions described (continued)

Revision 0 North Anna Units 1 and 2 B 3.9.6-3

RHR and Coolant Circulation-Low Water Level B 3.9.6 BASES ACTIONS B.3, B.4, B.5.1, and B.5.2 (continued) above ensures that all containment penetrations are either closed or can be closed so that the dose limits are not exceeded.

The Completion Time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months allows fixing of most RHR problems and is reasonable, based on the low probability of the coolant boiling in that time.

SURVEILLANCE SR 3.9.6.1 REQUIREMENTS This Surveillance demonstrates that one RHR loop is in operation and circulating reactor coolant. The flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability and to prevent thermal and boron stratification in the core. In addition, during operation of the RHR loop with the water level lowered to the level of the reactor vessel nozzles, the RHR pump net positive suction head requirements must be met. The Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is sufficient, considering the flow, temperature, pump control, and alarm indications available to the operator for monitoring the RHR System in the control room.

SR 3.9.6.2 Verification that the required pump is OPERABLE ensures that an additional RCS or RHR pump can be placed in operation, if needed, to maintain decay heat removal and reactor coolant circulation. Verification is performed by verifying proper breaker alignment and power available to the required pump.

The Frequency of 7 days is considered reasonable in view of other administrative controls available and has been shown to be acceptable by operating experience.

The SR is modified by a Note that states the SR is not required to be performed until 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after a required pump is not in operation.

REFERENCES

1. UFSAR, Section 5.5.4.

Revision 0 North Anna Units 1 and 2 B 3.9.6-4

Refueling Cavity Water Level B 3.9.7 B 3.9 REFUELING OPERATIONS B 3.9.7 Refueling Cavity Water Level BASES BACKGROUND APPLICABLE SAFETY ANALYSES LCO The movement of irradiated fuel assemblies within containment requires a minimum water level of 23 ft above the top of the reactor vessel flange. During refueling, this maintains sufficient water level in the containment, refueling canal, fuel transfer canal, refueling cavity, and spent fuel pool. Sufficient water is necessary to retain iodine fission product activity in the water in the event of a fuel handling accident (Refs. 1 and 2). Sufficient iodine activity would be retained to limit offsite doses from the accident to well below 10 CFR 100 limits.

During movement of irradiated fuel assemblies, the water level in the refueling canal and the refueling cavity is an initial condition design parameter in the analysis of a fuel handling accident in containment, as postulated by Regulatory Guide 1.25 (Ref. 1). A minimum water level of 23 ft (Regulatory Position C.1.c of Ref. 1) allows a decontamination factor of 100 (Regulatory Position C.1.g of Ref. 1) to be used in the accident analysis for iodine. This relates to the assumption that 99% of the total iodine released from the pellet to cladding gap of all the dropped fuel assembly rods is retained by the refueling cavity water. The fuel pellet to cladding gap is assumed to contain 10% of the total fuel rod iodine inventory (Ref. 1).

The fuel handling accident analysis inside containment is described in Reference 2. With a minimum water level of 23 ft, the analysis and test programs demonstrate that the iodine release due to a postulated fuel handling accident is adequately captured by the water and offsite doses are maintained within allowable limits (Ref. 3).

Refueling cavity water level satisfies Criterion 2 of 10 CFR 50.36(c) (2) (ii).

A minimum refueling cavity water level of 23 ft above the reactor vessel flange is required to ensure that the radiological consequences of a postulated fuel handling accident inside containment are within acceptable limits.

North Anna Units 1 and 2 Revision 0 B 3.9.7-1

Refueling Cavity Water Level B 3.9.7 BASES APPLICABILITY LCO 3.9.7 is applicable when moving irradiated fuel assemblies within containment. The LCO minimizes the possibility of a fuel handling accident in containment that is beyond the assumptions of the safety analysis. If irradiated fuel assemblies are not present in containment, there can be no significant radioactivity release as a result of a postulated fuel handling accident. Requirements for fuel handling accidents in the spent fuel pool are covered by LCO 3.7.16, "Fuel Storage Pool Water Level."

ACTIONS A.1 With a water level of < 23 ft above the top of the reactor vessel flange, all operations involving movement of irradiated fuel assemblies within the containment shall be suspended immediately to ensure that a fuel handling accident cannot occur.

The suspension of fuel movement shall not preclude completion of movement of a component to a safe position.

SURVEILLANCE SR 3.9.7.1 REQUIREMENTS Verification of a minimum water level of 23 ft above the top of the reactor vessel flange ensures that the design basis for the analysis of the postulated fuel handling accident during refueling operations is met. Water at the required level above the top of the reactor vessel flange limits the consequences of damaged fuel rods that are postulated to result from a fuel handling accident inside containment (Ref. 2).

The Frequency of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is based on engineering judgment and is considered adequate in view of the large volume of water and the normal procedural controls of valve positions, which make significant unplanned level changes unlikely.

REFERENCES

1. Regulatory Guide 1.25, March 23, 1972.

2. UFSAR, Section 15.4.7.

3.

10 CFR 100.10.

Revision 0 North Anna Units 1 and 2 B 3.9.7-2

v t e Letter Sequence Other
TAC:MB0799, Nis Power Range Channel Daily SR TS Change to Address LOW Power Decalibration, Revise Containment Requirements During Handling Irradiated Fuel and Core Alterations (Approved, Closed) TAC:MB0800, Nis Power Range Channel Daily SR TS Change to Address LOW Power Decalibration, Revise Containment Requirements During Handling Irradiated Fuel and Core Alterations (Approved, Closed)
Initiation Request, Request, Request, Request Acceptance... Administration Questions Answers Results Approval Other: ML020650715, ML020840253, ML021220053, ML021220061, ML021220067, ML021220088, ML021220108, ML021220166, ML021220192, ML021220214, ML021220221, ML021220224, ML021220254, ML021550518
MONTHYEAR2002-02-20 [Table View]

ML021220221

Text

Navigation menu

Search