Text

Technical Specification Bases Changes
	ML022460155
Person / Time
Site:	North Anna
Issue date:	08/20/2002
From:	Hartz L; Virginia Electric & Power Co (VEPCO)
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	02-489
	Download: ML022460155 (57)
	v • d • e

VIRGINIA ELECTRIC AND POWER COMPANY RICHMOND, VIRGINIA 23261 August 20, 2002 U.S. Nuclear Regulatory Commission Serial No.02-489 Attention: Document Control Desk ITS/GSS RO Washington, D.C. 20555 Docket Nos. 50-338 50-339 License Nos. NPF-4 NPF-7 Gentlemen:

VIRGINIA ELECTRIC AND POWER COMPANY NORTH ANNA POWER STATION UNITS 1 AND 2 TECHNICAL SPECIFICATION BASES CHANGES Pursuant to the Technical Specifications Bases Control Program, Virginia Electric and Power Company hereby submits changes to the Bases to the Technical Specifications for your information. These changes provide clarification to the various Bases sections associated with ECCS-Operating, Distribution Systems, Main Control Room/Emergency Switchgear Room Air Conditioning System, Quadrant Power Tilt Ratio, Main Control Room/Emergency Switchgear Room Bottled Air System, Fuel Building Ventilation System, Auxiliary Feedwater System, Rod Group Alignment Limits, AC Sources Operating, and Diesel Fuel Oil and Starting Air.

The Technical Specifications Bases changes have been reviewed and approved by the Station Nuclear Safety and Operating Committee. It has been determined that these changes do not require a change to the Technical Specification or license, or involve a change to the UFSAR or Bases that require NRC prior approval pursuant to 10 CFR 50.59. A summary of the changes and the affected Technical Specifications Bases pages are being provided in Attachments 1 and 2, respectively. The affected pages can be used to maintain your copy of the North Anna Bases.

If you have any further questions, please contact us.

Very truly yours, L. N. Hartz Vice President - Nuclear Engineering

Attachments

1. Summary of Changes

2. Revised Technical Specification Bases Pages Commitments made in this letter:

1. There are no commitments in this letter cc: U.S. Nuclear Regulatory Commission (w/out Attachment 2)

Region II Sam Nunn Atlanta Federal Center 61 Forsyth Street, SW Suite 23T85 Atlanta, Georgia 30303 Mr. M. J. Morgan (w/out Attachment 2)

NRC Senior Resident Inspector North Anna Power Station

ATTACHMENT 1

SUMMARY

OF CHANGES Virginia Electric and Power Company (Dominion)

North Anna Power Station Units 1 and 2

Summary of Changes Clarification of ECCS Pump Testing (Bases SR 3.5.2.4)

The purpose of the change was to clarify which required ASME testing satisfies Surveillance Requirement (SR) 3.5.2.4 and at what required frequencies. Additionally, the Bases change incorporates ASME Code requirements of the 1996 Addenda, 1995 Edition of the OM Code (Code for Operation and Maintenance of Nuclear Power Plants) which went into effect on December 15, 2001. The Bases can be construed to imply that all ECCS pump testing is performed at a test flowrate greater than or equal to that assumed in the safety analysis. This change will clarify that testing is performed at low flow conditions and the 24 month comprehensive testing is performed at flow rates greater than or equal to flows assumed in the safety analysis.

Clarification of the Methods Used to Perform Surveillances for the 480 V Buses and Load Centers (Bases SR 3.8.9.1 and 3.8.10.1)

The purpose of the change was to clarify the method used to perform the surveillances for the 480 V buses and load centers by adding the following clarification to the bases for SR 3.8.9.1 and SR 3.8.10.1: "Verification of proper voltage availability for 480 volt buses and load centers may be performed by indirect methods." The 480 volt buses and load centers are not provided with accurate instrumentation to directly verify bus voltage.

Clarification of MCR/ESGR System Operability (Bases LCO 3.7.11)

The purpose of the change was to clarify operability for the Main Control Room/Emergency Switchgear Room (MCRJESGR) Air Conditioning System (ACS). This is a normally operating system that also operates after an accident to maintain the MCR/ESGR environment within the design temperature limits. There is no Technical Specification requirement for automatic start for the MCR/ESGR ACS following an accident. The system is normally running or, if stopped, is started manually. Therefore, while at least one subsystem of MCR/ESGR ACS is normally in operation, it is not necessary for a MCR/ESGR ACS subsystem to be in operation for the subsystem to be considered operable, provided that it can be started manually. The ITS Bases do not explicitly state that the MCR/ESGR ACS is OPERABLE if it is not in operation and can be manually started. The proposed change clarifies this aspect of system operability.

Clarification of the Use of the Movable Incore Detectors to Satisfy the QPTR (Bases Background and SR 3.2.4.2)

The purpose of the change was to adequately explain the use of the movable incore detectors to measure QPTR to satisfy Surveillance Requirement 3.2.4.2. Section 1.1, "Definitions," defines Quadrant Power Tilt Ratio (QPTR) as "the ratio of the maximum upper excore detector calibrated output to the average of the upper detector calibrated outputs, or the ratio of the maximum lower excore detector calibrated output to the average of the lower detector calibrated outputs, whichever is greater." No mention is made in the definition of using the incore detectors to monitor QPTR.

Increased Number of Air Bottles in MCR/ESGR Bottled Air System (Bases LCO 3.7.13 and SR 3.7.13.2)

The purpose of the change was to correct the Bases of TS 3.7.13, "Main Control Room/Emergency Switchgear Room (MCR/ESGR) Bottled Air System," to specify the number of air bottles required for the system to be operable. The Bases currently specify 51 air bottles in each bank, which reflects the plant design. However, the recent completion of design modifications increased the number of bottles required for system operability to 69 per bank.

Clarification of Operability for FBVS Fans (Bases Background, Applicable Safety Analysis, SR 3.7.15.1)

The purpose of the change was to clarify the number of Fuel Building Ventilation System (FBVS) fans that must be operable in LCO Bases section 3.7.15 for the FBVS to be operable. The Bases for TS 3.7.15 state that the FBVS is considered operable when at least one fan is in operation. Surveillance Requirement 3.7.15.1 requires verification that the FBVS can maintain a pressure greater than or equal to 0.125 inches water gauge with respect to atmospheric pressure. Depending on the system configuration, one or two FBVS fans must be in operation in order to maintain a pressure of greater than or equal to 0.125 water gauge with respect to atmospheric pressure. The Bases are revised to state that one or two FBVS fans, as necessary to meet the SR pressure requirement, are required to be in operation for the FBVS to be operable. This is consistent with the manner in which the system is normally operated.

Clarification of Operability for AFW Pumps (Bases LCO 3.7.5)

The purpose of the change was to clarify that steam is required from at least two of the three main steam lines for the turbine-driven AFW pump to be operable. The LCO Bases for Technical Specification 3.7.5 state that an operable turbine-driven AFW pump has redundant steam supplies from each of two main steam supply paths through

MS-TV-111A and MS-TV-I11B (Unit 1), MS-TV-211A and MS-TV-211B (Unit 2), which receive steam from the three main steam lines upstream of the MSTVs. This implies that steam must be supplied from all three main steam lines for the AFW pump to be considered operable. SR 3.7.5.1 requires verification every 31 days that each AFW valve in the steam supply flow paths to the steam turbine driven pump are in the correct position. If a valve in the steam supply path from a main steam line was found to be closed, the LCO Bases would require declaring the turbine-driven AFW pump inoperable. The change will revise the Bases to state that steam from at least two of the three main steam lines is required for the turbine-driven AFW pump to be operable.

This is also consistent with the Westinghouse Steam System Design Manual.

Clarification of Rod Drop Time Testing (Bases SR 3.1.4.3)

The purpose of the change was to clarify that the rod drop timing test will be performed from 229 steps withdrawn. Surveillance Requirement 3.1.4.3 requires measuring the rod drop time from the fully withdrawn position which is not specified in the Technical Specifications. The fully withdrawn position is controlled by plant procedures and shown on the rod insertion limit curve contained in the COLR. To avoid confusing the fully withdrawn position specified on the rod insertion limit curve for each fuel cycle with the initial position for control rod drop time measurement required by SR 3.1.4.3, the Bases is being clarified to state that the testing is performed from 229 steps.

Clarification of ASTM Standards for Fuel Oil Testing (Bases SR 3.8.3.2)

The purpose of the Bases change was to specify the correct ASTM standard references and values associated with the fuel oil viscosity measurements and sulfur determination in petroleum products. The Bases for Surveillance Requirement 3.8.3.2 specifically state which tests are performed and the applicable ASTM Standards that apply for our applications.

Clarification of Operability for Fuel Oil Transfer Subsystem (Bases SR 3.8.1.6 and Background for TS 3.8.3)

The purpose of the change was to clarify the Bases for Surveillance Requirement 3.8.1.6 and Bases Background section for TS 3.8.3 that only one fuel oil transfer subsystem is required to support an operable EDG. This is consistent with the improved Technical Specification definition of operability, the system description in the UFSAR and the System Design Basis Document for the EDG System.

ATTACHMENT 2 TECHNICAL SPECIFICATION BASES CHANGES Virginia Electric and Power Company (Dominion)

North Anna Power Station Units 1 and 2

Rod Group Alignment Limits B 3.1.4 BASES SURVEILLANCE SR 3.1.4.2 REQUIREMENTS (continued) Verifying each rod is OPERABLE would require that each rod be tripped. However, in MODES 1 and 2, tripping each rod would result in radial or axial power tilts, or oscillations.

Exercising each individual rod every 92 days provides increased confidence that all rods continue to be OPERABLE without exceeding the alignment limit, even if they are not regularly tripped. Moving each rod by 10 steps will not cause radial or axial power tilts, or oscillations, to occur. The 92 day Frequency takes into consideration other information available to the operator in the control room and SR 3.1.4.1, which is performed more frequently and adds to the determination of OPERABILITY of the rods. Between required performances of SR 3.1.4.2 (determination of rod OPERABILITY by movement), if a rod(s) is discovered to be immovable, but remains trippable, the rod(s) is considered to be OPERABLE. At any time, if a rod(s) is immovable, a determination of the trippability (OPERABILITY) of the rod(s) must be made, and appropriate action taken.

SR 3.1.4.3 Verification of rod drop times allows the operator to determine that the maximum rod drop time permitted is consistent with the assumed rod drop time used in the safety analysis. Measuring rod drop times prior to reactor criticality, after reactor vessel head removal, ensures that the reactor internals and rod drive mechanism will not interfere with rod motion or rod drop time, and that no degradation in these systems has occurred that would adversely affect rod motion or drop time. This testing is performed with all RCPs operating and the average moderator temperature _Ž500°F to simulate a reactor trip under actual conditions. For this surveillance, a fully withdrawn position of 229 steps is used in order to provide consistent test conditions to facilitate trending. This rod position is not necessarily the same as the cycle-dependent fully withdrawn rod position specified in the COLR and will yield conservative drop times relative to the COLR position. The surveillance procedure for rod drop time uses a limit on rod drop time reduced from the value in SR 3.1.4.3 in order to ensure that the negative reactivity insertion rate used in the accident analyses bounds a reactor trip concurrent with a postulated seismic event.

(continued)

North Anna Units 1 and 2 B 3. 1.4-9 Revision 1

Rod Group Alignment Limits B 3.1.4 BASES SURVEILLANCE SR 3.1.4.3 (continued)

REQUIREMENTS This Surveillance is performed during a unit outage, due to the unit conditions needed to perform the SR and the potential for an unplanned unit transient if the Surveillance were performed with the reactor at power.

REFERENCES 1. UFSAR, Sections 3.1.6 and 3.1.22.

2. 10 CFR 50.46.

3. UFSAR, Chapter 15.

4. UFSAR, Section 15.2.3.

5. UFSAR, Section 4.3.1.5.

North Anna Units 1 and 2 B 3.1.4-10 Revision 0

QPTR B 3.2.4 B 3.2 POWER DISTRIBUTION LIMITS B 3.2.4 QUADRANT POWER TILT RATIO (QPTR)

BASES BACKGROUND The QPTR limit ensures that the gross radial power distribution remains consistent with the design values used in the safety analyses. Precise radial power distribution measurements are made during startup testing, after refueling, and periodically during power operation by using the movable incore detector system to obtain full core flux maps. Between these full core flux maps, the excore neutron detectors are used to monitor QPTR, which is a measure of changes in the radial power distribution. QPTR is defined in Section 1.1 in terms of ratios of excore detector calibrated output. However, the movable incore detector system can measure changes in the relative power of symmetrically located incore locations or changes in the incore tilt, which can be used to calculate an equivalent QPTR.

The power density at any point in the core must be limited so that the fuel design criteria are maintained. Together, LCO 3.2.3, "AXIAL FLUX DIFFERENCE (AFD)," LCO 3.2.4, and LCO 3.1.6, "Control Rod Insertion Limits," provide limits on process variables that characterize and control the three dimensional power distribution of the reactor core. Control of these variables ensures that the core operates within the fuel design criteria and that the power distribution remains within the bounds used in the safety analyses.

APPLICABLE This LCO precludes core power distributions that violate the SAFETY ANALYSES following fuel design criteria:

a. During a large break loss of coolant accident, the peak cladding temperature must not exceed 22007F (Ref. 1);

b. During a loss of forced reactor coolant flow accident, there must be at least 95% probability at the 95%

confidence level (the 95/95 departure from nucleate boiling (DNB) criterion) that the hot fuel rod in the core does not experience a DNB condition;

c. During an ejected rod accident, the energy deposition to unirradiated fuel is limited to 225 cal/gm and irradiated fuel is limited to 200 cal/gm (Ref. 2); and (continued)

North Anna Units 1 and 2 B 3.2.4-1 Revision 1

QPTR B 3.2.4 BASES APPLICABLE d. The control rods must be capable of shutting down the SAFETY ANALYSES reactor with a minimum required SDM with the highest (continued) worth control rod stuck fully withdrawn (Ref. 3).

The LCO limits on the AFD, the QPTR, the Heat Flux Hot Channel Factor (F (Z)), the Nuclear Enthalpy Rise Hot Channel Factor (FNH), and control bank insertion are established to preclude core power distributions that exceed the safety analyses limits.

The QPTR limits ensure that FNAH and F0 (Z) remain below their limiting values by preventing an undetected change in the gross radial power distribution.

In MODE 1, the FAH and FQ(Z) limits must be maintained to preclude core power distributions from exceeding design limits assumed in the safety analyses.

The QPTR satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).

LCO The QPTR limit of 1.02, at which corrective action is required, provides a margin of protection for both the DNB ratio and linear heat generation rate contributing to excessive power peaks resulting from X-Y plane power tilts.

A limiting QPTR of 1.02 can be tolerated before the margin for uncertainty in FQ(Z) and (FNH) is possibly challenged.

APPLICABILITY The QPTR limit must be maintained in MODE 1 with THERMAL POWER > 50% RTP to prevent core power distributions from exceeding the design limits.

Applicability in MODE 1

50% RTP and in other MODES is not required because there is either insufficient stored energy in the fuel or insufficient energy being transferred to the reactor coolant to require the implementation of a QPTR limit on the distribution of core power. The QPTR limit in these conditions is, therefore, not important. Note that the FNH and FQ(Z) LCOs still apply, but allow progressively higher peaking factors at 50% RTP or lower.

North Anna Units 1 and 2 B 3.2.4-2 Revision 0

QPTR B 3.2.4 BASES ACTIONS A.5 (continued) if Required Action A.5 is performed, the Required Action A.6 shall be performed. Required Action A.5 normalizes the excore detectors to restore QPTR to within limits, which restores compliance with LCO 3.2.4. Thus, Note 2 prevents exiting the Actions prior to completing flux mapping to verify peaking factors, per Required Action A.6. These notes are intended to prevent any ambiguity about the required sequence of actions.

A.6 Once the flux tilt is restored to within limits (i.e.,

Required Action A.5 is performed), it is acceptable to return to full power operation. However, as an added check that the core power distribution is consistent with the safety analysis assumptions, Required Action A.6 requires verification that Fo(Z) and FNH are within their specified limits within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of reaching equilibrium conditions at RTP. As an added precaution, if the core power does not reach equilibrium conditions at RTP within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , but is increased slowly, then the peaking factor surveillances must be performed within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months after increasing power above the limit of Required Action A.1. These Completion Times are intended to allow adequate time to increase THERMAL POWER to above the limit of Required Action A.1, while not permitting the core to remain with unconfirmed power distributions for extended periods of time.

Required Action A.6 is modified by a Note that states that the peaking factor surveillances may only be done after the excore detectors have been normalized to restore QPTR to within limits (i.e., Required Action A.5). The intent of this Note is to have the peaking factor surveillances performed at operating power levels, which can only be accomplished after the excore detectors are normalized to restore QPTR to within limits and the core returned to power.

B.1 If Required Actions A.1 through A.6 are not completed within their associated Completion Times, the unit must be brought to a MODE or condition in which the requirements do not apply. To achieve this status, THERMAL POWER must be reduced to

50% RTP within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The allowed Completion Time of (continued)

North Anna Units 1 and 2 B 3.2.4-5 Revi si on 0

QPTR B 3.2.4 BASES ACTIONS B.1 (continued) 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is reasonable, based on operating experience regarding the amount of time required to reach the reduced power level without challenging unit systems.

SURVEILLANCE SR 3.2.4.1 REQUIREMENTS SR 3.2.4.1 is modified by two Notes. Note 1 allows QPTR to be calculated with three power range channels if THERMAL POWER is

75% RTP and the input from one Power Range Neutron Flux channel is inoperable. Note 2 allows performance of SR 3.2.4.2 in lieu of SR 3.2.4.1.

This Surveillance verifies that the QPTR, as indicated by the Nuclear Instrumentation System (NIS) excore channels, is within its limits. The Frequency of 7 days takes into account other information and alarms available to the operator in the control room.

For those causes of QPT that occur quickly (e.g., a dropped rod), there typically are other indications of abnormality that prompt a verification of core power tilt.

SR 3.2.4.2 This Surveillance verifies that the QPTR, as determined using the movable incore detectors, is within its limits.

This Surveillance may be performed in lieu of SR 3.2.4.1, as provided by a SR 3.2.4.1 Note. SR 3.2.4.2 is modified by a Note, which states that it is not required until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the inputs from one or more Power Range Neutron Flux channels are inoperable and the THERMAL POWER is > 75% RTP.

Therefore, this Surveillance is only required to be performed when one or more Power Range Neutron Flux channels are inoperable, but may be performed to satisfy the routine monitoring of QPTR.

With an NIS power range channel inoperable, tilt monitoring for a portion of the reactor core becomes degraded. Large tilts are likely detected with the remaining channels, but the capability for detection of small power tilts in some quadrants is decreased. Performing SR 3.2.4.2 at a Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months provides an accurate alternative means for ensuring that any tilt remains within its limits.

(continued)

North Anna Units 1 and 2 B 3.2.4-6 Revision 1

QPTR B 3.2.4 BASES SURVEILLANCE SR 3.2.4.2 (continued)

REQUIREMENTS QPTR is determined using the movable incore detectors performing a full core incore flux map or by monitoring two sets of four thimble locations with quarter core symmetry.

The two sets of four symmetric thimbles is a set of eight unique detector locations. These locations are C-8, E-5, E-11, H-3, H-13, L-5, L-11, and N-8. The symmetric thimble flux map can be used to generate symmetric thimble tilt. This can be compared to a reference symmetric thimble tilt, taken from the most recent full core flux map used to normalize the excore detectors, to calculate QPTR. If a full core flux map is used to determine QPTR, the measured incore tilt values from the full core flux map are compared to those from the most recent full core flux map used to normalize the excore detectors. The difference between these tilt values is the QPTR for the current core conditions. Therefore, the movable incore detectors can be used to confirm that QPTR is within limits.

REFERENCES 1. 10 CFR 50.46.

2. VEP-NFE-2-A, "VEPCO Evaluation of the Control Rod Ejection Transient."

3. UFSAR, Section 3.1.22.

North Anna Units 1 and 2 B 3.2.4-7 Revision 1

Intentionally Blank ECCS-Operating B 3.5.2 BASES SURVEILLANCE SR 3.5.2.3 (continued)

REQUIREMENTS void size are gradual in nature, and the system is operated in accordance with procedures to preclude growth in these voids.

To provide additional assurances that the system will function, a verification is performed every 92 days that the system is sufficiently full of water. The system is sufficiently full of water when the voids and pockets of entrained gases in the ECCS piping are small enough in size and number so as to not interfere with the proper operation of the ECCS. Verification that the ECCS piping is sufficiently full of water can be performed by venting the necessary high point ECCS vents outside containment, using NDE, or using other Engineering-justified means. Maintaining the piping from the ECCS pumps to the RCS sufficiently full of water ensures that the system will perform properly, injecting its full capacity into the RCS upon demand. This will also prevent water hammer, pump cavitation, and pumping of excess noncondensable gas (e.g., air, nitrogen, or hydrogen) into the reactor vessel following an SI signal or during shutdown cooling. The 92 day frequency takes into consideration the gradual nature of the postulated void generation mechanism.

SR 3.5.2.4 Periodic surveillance testing of ECCS pumps is required by the ASME Code. This type of testing may be accomplished by measuring the pump developed head at only one point of the pump characteristic curve. This testing is performed at low flow conditions during quarterly tests and near design flow conditions at least once every 24 months, as required by the Code. The quarterly test will detect gross degradation caused by impeller structural damage or other hydraulic component problems, but is not a good indicator of expected pump performance at high flow conditions. Both tests verify that the measured performance is within an acceptable tolerance of the original pump baseline performance.

Additionally, the 24-month comprehensive test verifies that the test flow is greater than or equal to the performance assumed in the safety analysis. Due to limitations in system design, the 24-month test is performed during refueling outages. SRs are specified in the Inservice Testing Program, (continued)

North Anna Units 1 and 2 B 3.5.2-9 Revision 1

ECCS-Operatinq B 3.5.2 BASES SURVEILLANCE SR 3.5.2.4 (continued)

REQUIREMENTS which encompasses the ASME Code. The ASME Code provides the activities and Frequencies necessary to satisfy the requirements.

SR 3.5.2.5 and SR 3.5.2.6 These Surveillances demonstrate that each automatic ECCS valve actuates to the required position on an actual or simulated SI signal and that each ECCS pump capable of starting automatically starts on receipt of an actual or simulated SI signal. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The 18 month Frequency is based on the need to perform these Surveillances under the conditions that apply during a unit outage and the potential for unplanned unit transients if the Surveillances were performed with the reactor at power.

The 18 month Frequency is also acceptable based on consideration of the design reliability (and confirming operating experience) of the equipment. The actuation logic is tested as part of ESF Actuation System testing, and equipment performance is monitored as part of the Inservice Testing Program.

SR 3.5.2.7 Proper throttle valve position is necessary for proper ECCS performance and to prevent pump runout and subsequent component damage. The Surveillance verifies each listed ECCS throttle valve is secured in the correct position. The 18 month Frequency is based on the same reasons as those stated in SR 3.5.2.5 and SR 3.5.2.6.

SR 3.5.2.8 Periodic inspections of the containment sump suction inlet ensure that it is unrestricted and stays in proper operating condition. The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and on the need to have access to the location. This Frequency has been found to be sufficient to detect abnormal degradation and is confirmed by operating experience.

North Anna Units 1 and 2 B 3.5.2-10 Revision 0

AFW System B 3.7.5 BASES APPLICABLE In addition, the minimum available AFW flow and system SAFETY ANALYSES characteristics are considerations in the analysis of a (continued) small break loss of coolant accident (LOCA).

The AFW System design is such that it can perform its function following an FWLB between the MFW isolation valves and containment, combined with a loss of offsite power following turbine trip, and a single active failure of the steam turbine driven AFW pump. In such a case, the ESFAS logic may not detect the affected steam generator if the backflow check valve to the affected MFW header worked properly. One motor driven AFW pump would deliver to the broken MFW header at maximum design flow until the problem was detected, and flow terminated by the operator.

Sufficient flow would be delivered to the intact steam generator by the redundant AFW pump.

The ESFAS automatically actuates the AFW turbine driven pump when required to ensure an adequate feedwater supply to its dedicated steam generator during loss of power. Air or motor operated valves are provided for each AFW line to control the AFW flow to each steam generator.

The AFW System satisfies the requirements of Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO This LCO provides assurance that the AFW System will perform its design safety function to mitigate the consequences of accidents that could result in overpressurization of the reactor coolant pressure boundary. Three independent AFW pumps in three diverse trains are required to be OPERABLE to ensure the availability of AFW capability for all events accompanied by a loss of offsite power and a single failure.

This is accomplished by powering two of the pumps from independent emergency buses. The third AFW pump is powered by a different means, a steam driven turbine supplied with steam from a source that is not isolated by closure of the MSTVs.

The AFW System is configured into three trains. The AFW System is considered OPERABLE when the components and flow paths required to provide redundant AFW flow to the steam generators are OPERABLE. This requires that the two motor driven AFW pumps be OPERABLE in two diverse paths, each supplying AFW to separate steam generators. The turbine driven AFW pump is required to be OPERABLE with redundant (continued)

North Anna Units 1 and 2 B 3.7.5-3 Revision 0

AFW Systefr B 3.7.5 BASES LCO steam supplies from each of two main steam supply paths (continued) through MS-TV-1I1A and MS-TV-111B (Unit 1), MS-TV-211A and MS-TV-211B (Unit 2), which receive steam from at least two of the three main steam lines upstream of the MSTVs. The piping, valves, instrumentation, and controls in the required flow paths also are required to be OPERABLE.

The LCO is modified by a Note indicating that one AFW train, which includes a motor driven pump, is required to be OPERABLE in MODE 4 when the steam generator is relied upon for heat removal. This is because of the reduced heat removal requirements and short period of time in MODE 4 during which the AFW is required and the insufficient steam available in MODE 4 to power the turbine driven AFW pump.

APPLICABILITY In MODES 1, 2, and 3, the AFW System is required to be OPERABLE in the event that it is called upon to function when the MFW is lost. In addition, the AFW System is required to supply enough makeup water to replace the steam generator secondary inventory, lost as the unit cools to MODE 4 conditions.

In MODE 4 one AFW train is required to be OPERABLE when the steam generator(s) is relied upon for heat removal.

In MODE 5 or 6, the steam generators are not normally used for heat removal, and the AFW System is not required.

ACTIONS A.1 If one of the two steam supplies, MS-TV-111A and MS-TV-111B (Unit 1), MS-TV-211A and MS-TV-211B (Unit 2), to the turbine driven AFW train is inoperable or if a turbine driven AFW pump is inoperable while in MODE 3 immediately following refueling, action must be taken to restore the affected equipment to an OPERABLE status within 7 days. The 7 day Completion Time is reasonable, based on the following reasons:

a. For the inoperability of a steam supply to the turbine driven AFW pump, the 7 day Completion Time is reasonable since there is a redundant steam supply line for the turbine driven pump.

(continued)

North Anna Units 1 and 2 B 3.7.5-4 Revision 1

MCR/ESGR ACS B 3.7.11 B 3.7 PLANT SYSTEMS B 3.7.11 Main Control Room/Emergency Switchgear Room (MCR/ESGR) Air Conditioning System (ACS)

BASES BACKGROUND The MCR/ESGR ACS provides cooling for the MCR/ESGR envelope following isolation of the MCR/ESGR envelope. The MCR/ESGR ACS also provides cooling for the MCR/ESGR envelope during routine unit operation.

The MCR/ESGR ACS consists of two independent and redundant subsystems that provide cooling of MCR/ESGR envelope air.

Each subsystem consists of two air handling units (one for the MCR and one for the ESGR), one chiller in one subsystem and two chillers in the other, valves, piping, instrumentation, and controls to provide for MCR/ESGR envelope cooling. One subsystem has one chiller, the other has two chillers, either of which can be used by that subsystem, but which are not electrically independent from each other.

The MCR/ESGR ACS is an emergency system, parts of which may also operate during normal unit operations. A single subsystem will provide the required cooling to maintain the MCR/ESGR envelope within design limits. The MCR/ESGR ACS operation in maintaining the MCR/ESGR envelope temperature is discussed in the UFSAR, Section 9.4 (Ref. 1).

APPLICABLE The design basis of the MCR/ESGR ACS is to maintain the SAFETY ANALYSES MCR/ESGR envelope temperature within limits for 30 days of continuous occupancy after a DBA.

The MCR/ESGR ACS components are arranged in redundant, safety related subsystems. During emergency operation, the MCR/ESGR ACS maintains the temperature within design limits.

A single active failure of a component of the MCR/ESGR ACS, with a loss of offsite power, does not impair the ability of the system to perform its design function. The MCR/ESGR ACS is designed in accordance with Seismic Category I requirements. The MCR/ESGR ACS is capable of removing sensible and latent heat loads from the MCR/ESGR envelope, which include consideration of equipment heat loads and personnel occupancy requirements, to ensure equipment OPERABILITY.

(continued)

North Anna Units 1 and 2 B 3.7.11-1 Revision 0

MCR/ESGR ACS B 3.7.11 BASES APPLICABLE The MCR/ESGR ACS satisfies Criterion 3 of 10 CFR SAFETY ANALYSES 50.36(c)(2)(ii).

(continued)

LCO Two independent and redundant subsystems of the MCR/ESGR ACS, providing cooling to the unit ESGR and associated portion of the MCR, are required to be OPERABLE to ensure that at least one is available, assuming a single failure disabling the other subsystem. Total system failure could result in the equipment operating temperature exceeding limits in the event of an accident.

The MCR/ESGR ACS is considered to be OPERABLE when the individual components necessary to cool the MCR/ESGR envelope air are OPERABLE in both required subsystems. Each subsystem consists of two air handling units (one for the MCR and one for the ESGR), one chiller, valves, piping, instrumentation and controls. The two subsystems provide air temperature cooling to the portion of the MCR/ESGR envelope associated with the unit. In addition, an OPERABLE MCR/ESGR ACS must be capable of maintaining air circulation. An MCR/ESGR ACS subsystem does not have to be in operation to be considered OPERABLE. The MCR/ESGR ACS is considered OPERABLE when it is capable of being started by manual actions within 10 minutes. The time of 10 minutes is based on the time required to start the system manually following required testing.

APPLICABILITY In MODES 1, 2, 3, and 4, and during movement of recently irradiated fuel assemblies, the MCR/ESGR ACS must be OPERABLE to ensure that the MCR/ESGR envelope temperature will not exceed equipment operational requirements following isolation of the MCR/ESGR envelope. The MCR/ESGR ACS is only required to be OPERABLE during fuel handling involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within a time frame established by analysis. The term recently is defined as all irradiated fuel assemblies, until analysis is performed to determine a specific time), due to radioactive decay.

North Anna Units 1 and 2 B 3. 7. 11-2 Revision 1

MCR/ESGR Bottled Air System B 3.7.13 BASES LCO The MCR/ESGR bottled air system is considered OPERABLE when (continued) the individual components necessary to limit operator exposure are OPERABLE in the three required trains of the MCR/ESGR bottled air system.

A MCR/ESGR bottled air system train is OPERABLE when:

a. One OPERABLE bottled air bank of 69 bottles is in service;

b. A flow path, including associated valves and piping, is OPERABLE; and

c. The common exhaust header is OPERABLE.

The MCR/ESGR bottled air system trains are shared by Unit 1 and Unit 2.

In addition, the MCR/ESGR boundary must be maintained, including the integrity of the walls, floors, ceilings, ductwork, and access doors.

The LCO is modified by a Note allowing the MCR/ESGR boundary to be opened intermittently under administrative controls.

For entry and exit through doors the administrative control of the opening is performed by the person(s) entering or exiting the area. For other openings, these controls consist of stationing a dedicated individual at the opening who is in continuous communication with the control room. This individual will have a method to rapidly close the opening when a need for MCR/ESGR isolation is indicated.

APPLICABILITY In MODES 1, 2, 3, and 4, and during movement of recently irradiated fuel assemblies, MCR/ESGR bottled air system must be OPERABLE to control operator exposure during and following a DBA.

During movement of recently irradiated fuel assemblies, the MCR/ESGR bottled air system must be OPERABLE to respond to the release from a fuel handling accident involving handling recently irradiated fuel. The MCR/ESGR bottled air system is only required to be OPERABLE during fuel handling involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within a time frame established by analysis. The term recently is defined as all irradiated fuel assemblies, until analysis is performed to determine a specific time), due to radioactive decay.

North Anna Units 1 and 2 B 3.7. 13-3 Revision 1

MCR/ESGR Bottled Air System B 3.7.13 BASES ACTIONS A.1 When one required MCR/ESGR bottled air system train is inoperable, action must be taken to restore OPERABLE status within 7 days. In this Condition, the remaining required OPERABLE MCR/ESGR bottled air system trains are adequate to perform the MCR/ESGR envelope protection function. However, the overall reliability is reduced because a single failure in one of the remaining required OPERABLE trains could result in loss of MCR/ESGR bottled air system function. The 7 day Completion Time is based on the low probability of a DBA occurring during this time period, and ability of the remaining trains to provide the required capability.

B.1 If the MCR/ESGR boundary is inoperable in MODE 1, 2, 3, or 4, the MCR/ESGR bottled air system cannot perform its intended function. Actions must be taken to restore an OPERABLE MCR/ESGR boundary within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . During the period that the MCR/ESGR boundary is inoperable, appropriate compensatory measures (consistent with the intent of GDC 19) should be utilized to protect control room operators from potential hazards such as radioactive contamination.

Preplanned measures should be available to address these concerns for intentional and unintentional entry into the condition. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is reasonable based on the low probability of a DBA occurring during this time period, and the use of compensatory measures. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is a typically reasonable time to diagnose, plan, and possibly repair, and test most problems with the MCR/ESGR boundary.

C.1 When two or more required trains of the MCR/ESGR bottled air system are inoperable in MODE 1, 2, 3, or 4 for reasons other than an inoperable MCR/ESGR boundary (i.e., Condition B),

action must be taken to restore at least two of the required MCR/ESGR bottled air system trains to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . During the period that two or more required trains of the MCR/ESGR bottled air system are inoperable, appropriate compensatory measures (consistent with the intent of GDC 19) should be utilized to protect control room operators from potential hazards such as radioactive contamination. Preplanned measures should be available to address these concerns for intentional and unintentional (continued)

North Anna Units 1 and 2 B 3.7.13-4 Revision 0

MCR/ESGR Bottled Air System B 3.7.13 BASES ACTIONS C.1 (continued) entry into the condition. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is reasonable based on the low probability of a DBA occurring during this time period, and the use of compensatory measures. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is a typically reasonable time to diagnose, plan, restore, and possibly repair, and test most problems with the MCR/ESGR bottled air system, such as repressurizing the system after an inadvertent actuation.

D.1 and D.2 In MODE 1, 2, 3, or 4, if the inoperable required MCR/ESGR bottled air system trains or the inoperable MCR/ESGR boundary cannot be restored to OPERABLE status within the required Completion Time, the unit must be placed in a MODE that minimizes accident risk. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

E.1 and E.2 During movement of recently irradiated fuel assemblies, if the required inoperable MCR/ESGR bottled air system train cannot be restored to OPERABLE status within the required Completion Time or two or more required MCR/ESGR bottled air system trains are inoperable, action must be taken to immediately suspend activities that could result in a release of radioactivity that might require isolation of the MCR/ESGR envelope. This places the unit in a condition that minimizes risk. This does not preclude the movement of fuel to a safe position.

SURVEILLANCE SR 3.7.13.1 REQUIREMENTS This SR verifies that each required MCR/ESGR bottled air bank is at the proper pressure. This ensures that when combined with the required number of OPERABLE air bottles, the minimum required air flow will be maintained to ensure the required MCR/ESGR envelope pressurization for approximately 60 minutes when the MCR/ESGR bottled air system is actuated. The 31 day Frequency is based on engineering judgement.

North Anna Units 1 and 2 B 3.7.13-5 Revision 0

MCR/ESGR Bottled Air System B 3.7.13 BASES SURVEILLANCE SR 3.7.13.2 REQUIREMENTS (continued) This SR verifies that the proper number of MCR/ESGR air bottles are in service, with one bank of 69 air bottles in each required train. This SR requires verification that each bottled air bank manual valve not locked, sealed, or otherwise secured and required to be open during accident conditions is open. This SR helps to ensure that the bottled air banks required to be OPERABLE to pressurize the MCR/ESGR boundary are in service. The 31 day Frequency is based on engineering judgment and was chosen to provide added assurance of the correct positions. This SR does not apply to valves that are locked, sealed, or otherwise secured in the open position, since these were verified to be in the correct position prior to locking, sealing, or securing.

SR 3.7.13.3 This SR verifies that each required MCR/ESGR bottled air system train actuates by verifying the flow path is opened and that the normal air supply to and exhaust from the MCR/ESGR envelope is isolated on an actual or simulated actuation signal. The Frequency of 18 months is consistent with performing this test on a refueling interval basis.

SR 3.7.13.4 This SR verifies, by pressurizing the MCR/ESGR envelope, the integrity of the MCR/ESGR envelope, and the assumed inleakage rates of the potentially contaminated air. The MCR/ESGR envelope positive pressure, with respect to potentially contaminated adjacent areas, is periodically tested to verify proper functioning of the MCR/ESGR bottled air system. During the emergency mode of operation, the MCR/ESGR bottled air system is designed to pressurize the MCR/ESGR envelope to Ž 0.05 inches water gauge positive pressure with respect to adjacent areas in order to prevent unfiltered inleakage. The MCR/ESGR bottled air system is designed to maintain this positive pressure with two trains for at least 60 minutes at a makeup flow rate of Ž 340 cfm.

Testing two trains at a time at the Frequency of 18 months on a STAGGERED TEST BASIS is consistent with the guidance provided in NUREG-0800 (Ref. 3).

North Anna Units I and 2 B 3.7.13-6 Revision I

FBVS B 3.7.15 B 3.7 PLANT SYSTEMS B 3.7.15 Fuel Building Ventilation System (FBVS)

BASES BACKGROUND The FBVS discharges airborne radioactive particulates from the area of the fuel pool following a fuel handling accident.

The FBVS, in conjunction with other normally operating systems, also provides environmental control of temperature and humidity in the fuel pool area.

The FBVS consists of ductwork, valves and dampers, instrumentation, and two fans. I The FBVS, which may also be operated during normal pl ant operations, discharges air from the fuel building.

The FBVS is discussed in the UFSAR, Sections 9.4.5 and 15.4.5 (Refs. 1 and 2, respectively) because it may be used for normal, as well as post accident functions.

APPLICABLE The FBVS design basis is established by the consequences of SAFETY ANALYSES the limiting Design Basis Accident (DBA), which is a fuel handling accident involving handling recently irradiated fuel. The analysis of the fuel handling accident, given in Reference 2, assumes that all fuel rods in an assembly are damaged. The DBA analysis of the fuel handling accident assumes that the FBVS is functional with at least one fan I operating. The amount of fission products available for release from the fuel building is determined for a fuel handling accident. Due to radioactive decay, FBVS is only required to be OPERABLE during fuel handling accidents involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within a time frame established by analysis. The term recently is defined as all irradiated fuel assemblies, until analysis is performed to determine a specific time). These assumptions and the analysis follow the guidance provided in Regulatory Guide 1.25 (Ref. 3).

The fuel handling accident analysis for the fuel building assumes all of the radioactive material available for release is discharged from the fuel building by the FBVS.

The FBVS satisfies Criterion 3 of the 10 CFR 50.36(c) (2) (ii).

North Anna Units 1 and 2 B 3.7.15-1 Revision 1

FBVS B 3.7.15 BASES LCO The FBVS is required to be OPERABLE and in operation. Total system failure could result in the atmospheric release from the fuel building exceeding the 10 CFR 50, Appendix A, GDC 19 (Ref. 4) limits in the event of a fuel handling accident involving handling recently irradiated fuel.

The FBVS is considered OPERABLE when the individual components are OPERABLE. The FBVS is considered OPERABLE when at least one fan is OPERABLE and in operation, the associated FBVS ductwork, valves, and dampers are OPERABLE, and air circulation can be maintained. In addition, an OPERABLE FBVS must maintain a pressure in the fuel building pressure envelope * -0.125 inches water gauge with respect to atmospheric pressure.

The LCO is modified by a Note allowing the fuel building boundary to be opened intermittently under administrative controls. For entry and exit through doors the administrative control of the opening is performed by the person(s) entering or exiting the area. For other openings, these controls consist of stationing a dedicated individual at the opening who is in continuous communication with the control room. This individual will have a method to rapidly close the opening when a need for fuel building isolation is indicated.

APPLICABILITY During movement of recently irradiated fuel in the fuel handling area, the FBVS is required to be OPERABLE to alleviate the consequences of a fuel handling accident.

ACTIONS LCO 3.0.3 is not applicable while in MODE 5 or 6. However, since irradiated fuel assembly movement can occur in MODE 1, 2, 3, or 4, the ACTIONS have been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 5 or 6, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1, 2, 3, or 4, the fuel movement is independent of reactor operations. Entering LCO 3.0.3 while in MODE 1, 2, 3, or 4, would require the unit to be shutdown unnecessarily.

North Anna Units 1 and 2 B 3.7.15-2 Revision I

FBVS B 3.7.15 BASES ACTIONS A.1 (continued)

When the FBVS is inoperable or not in operation during movement of recently irradiated fuel assemblies in the fuel building, action must be taken to place the unit in a condition in which the LCO does not apply. Action must be taken immediately to suspend movement of recently irradiated fuel assemblies in the fuel building. This does not preclude the movement of fuel to a safe position.

SURVEILLANCE SR 3.7.15.1 REQUIREMENTS This SR verifies the integrity of the fuel building pressure envelope. The ability of the fuel building to maintain negative pressure with respect to potentially uncontaminated adjacent areas is periodically tested to verify proper function of the FBVS. The FBVS is designed to maintain a slight negative pressure in the fuel building, to prevent unfiltered LEAKAGE. The FBVS is designed to maintain a

-0.125 inches water gauge with respect to atmospheric pressure. The Frequency of 18 months is consistent with the guidance provided in NUREG-0800, Section 6.5.1 (Ref. 5).

REFERENCES 1. UFSAR, Section 9.4.5.

2. UFSAR, Section 15.4.5.

3. Regulatory Guide 1.25.

4. 10 CFR 50, Appendix A, GDC-19.

5. NUREG-0800, Section 6.5.1, Rev. 2, July 1981.

North Anna Units 1 and 2 B 3.7. 15-3 Revision 1

Intentionally Blank AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.4 REQUIREMENTS (continued) This SR provides verification that the level of fuel oil in the day tank is at or above the level which is required. The level is expressed as an equivalent volume in gallons, and is selected to ensure adequate fuel oil for a minimum of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months of EDG operation at full load plus 10%.

The 31 day Frequency is adequate to assure that a sufficient supply of fuel oil is available, since low level alarms are provided and operators would be aware of any large uses of fuel oil during this period.

SR 3.8.1.5 Microbiological fouling is a major cause of fuel oil degradation. There are numerous bacteria that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive. Removal of water from the fuel oil day tanks once every 92 days eliminates the necessary environment for bacterial survival. This is the most effective means of controlling microbiological fouling.

In addition, it eliminates the potential for water entrainment in the fuel oil during EDG operation. Water may come from any of several sources, including condensation, ground water, rain water, contaminated fuel oil, and breakdown of the fuel oil by bacteria. Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system. The Surveillance Frequencies are consistent with the recommendations of Regulatory Guide 1.137 (Ref. 9). This SR is for preventative maintenance. The presence of water does not necessarily represent failure of this SR, provided the accumulated water is removed during the performance of this Surveillance.

SR 3.8.1.6 This Surveillance demonstrates that each required fuel oil transfer pump operates and transfers fuel oil from its associated storage tank to its associated day tank. This is required to support continuous operation of standby power sources. This Surveillance provides assurance that the fuel oil transfer pump is OPERABLE, the fuel oil piping system is intact, the fuel delivery piping is not obstructed, and the (continued)

North Anna Units 1 and 2 B 3.8.1-23 Revision 1

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.6 (continued)

REQUIREMENTS controls and control systems for fuel transfer systems are OPERABLE. Only one fuel oil transfer subsystem is required to support an OPERABLE EDG.

The 92 day Frequency corresponds to the testing requirements of pumps as contained in the ASME Code (Ref. 10). The fuel oil transfer system is such that the pumps must be started manually in order to maintain an adequate volume of fuel in the day tank during or following EDG testing, and a 92 day Frequency is appropriate.

SR 3.8.1.7 See SR 3.8.1.2.

SR 3.8.1.8 Transfer of each 4.16 kV ESF bus power supply from the normal offsite circuit to the alternate offsite circuit demonstrates the OPERABILITY of the alternate circuit distribution network to power the shutdown loads for Unit 1 only. The 18 month Frequency of the Surveillance is based on engineering judgment, taking into consideration the unit conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

Operating experience has shown that these components usually pass the SR when performed at the 18 month Frequency.

Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

This SR is modified by two Notes. Note 1 states that the SR is applicable to Unit 1 only. The SR is not applicable to Unit 2 because it does not have an alternate offsite feed for the emergency buses. The reason for Note 2 is that, during operation with the reactor critical, performance of this SR could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, unit safety systems. This restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines unit (continued)

North Anna Units 1 and 2 B 3.8.1-24 Revision 1

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.8 (continued)

REQUIREMENTS safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed Surveillance, a successful Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a unit shutdown and startup to determine that unit safety is maintained or enhanced when the Surveillance is performed in MODE 1 or 2.

Risk insights or deterministic methods may be used for this assessment.

SR 3.8.1.9 Each EDG is provided with an engine overspeed trip to prevent damage to the engine. Recovery from the transient caused by the loss of a large load could cause diesel engine overspeed, which, if excessive, might result in a trip of the engine.

This Surveillance demonstrates the EDG load response characteristics and capability to reject the largest single load without exceeding predetermined voltage and frequency and while maintaining a specified margin to the overspeed trip. For this unit, the single load for each EDG is 610 kW.

This Surveillance may be accomplished by:

a. Tripping the EDG output breaker with the EDG carrying greater than or equal to its associated single largest post-accident load while paralleled to offsite power, or while solely supplying the bus; or

b. Tripping its associated single largest post-accident load with the EDG solely supplying the bus.

As required by IEEE-308 (Ref. 11), the load rejection test is acceptable if the increase in diesel speed does not exceed 75% of the difference between synchronous speed and the overspeed trip setpoint, or 15% above synchronous speed, whichever is lower.

The time, voltage, and frequency tolerances specified in this SR are derived from Safety Guide 9 (Ref. 3) recommendations for response during load sequence intervals.

(continued)

North Anna Units 1 and 2 B 3.8.1-25 Revision 1

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.9 (continued)

REQUIREMENTS The 3 seconds specified is equal to 60% of a typical 5 second load sequence interval associated with sequencing of the largest load. The voltage and frequency specified are consistent with the design range of the equipment powered by the EDG. SR 3.8.1.9.a corresponds to the maximum frequency excursion, while SR 3.8.1.9.b and SR 3.8.1.9.c are steady state voltage and frequency values to which the system must recover following load rejection. The 18 month Frequency is consistent with the recommendation of Regulatory Guide 1.108 (Ref. 8).

This SR is modified by a Note. The Note ensures that the EDG is tested under load conditions that are as close to design basis conditions as possible. When synchronized with offsite power, testing should be performed at a power factor of

0.9. This power factor is representative of the actual inductive loading an EDG would see under design basis accident conditions. Under certain conditions, however, the Note allows the surveillance to be conducted at a power factor other than

0.9. These conditions occur when grid voltage is high, and the additional field excitation needed to get the power factor to

0.9 results in voltages on the emergency busses that are too high. Under these conditions, the power factor should be maintained as close as practicable to 0.9 while still maintaining acceptable voltage limits on the emergency busses. In other circumstances, the grid voltage may be such that the EDG excitation levels needed to obtain a power factor of 0.9 may not cause unacceptable voltages on the emergency busses, but the excitation levels are in excess of those recommended for the EDG. In such cases, the power factor shall be maintained as close as practicable to 0.9 without exceeding the EDG excitation limits.

SR 3.8.1.10 Consistent with the recommendations of Regulatory Guide 1.108 (Ref. 8), paragraph 2.a.(1), this Surveillance demonstrates the as designed operation of the standby power sources during loss of the offsite source. This test verifies all actions encountered from the loss of offsite power, including shedding of the nonessential loads and energization of the emergency buses and respective loads (continued)

North Anna Units 1 and 2 B 3.8. 1-26 Revi si on 1

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.10 (continued)

REQUIREMENTS from the EDG. It further demonstrates the capability of the EDG to automatically achieve the required voltage and frequency within the specified time.

The EDG autostart time of 10 seconds is derived from requirements of the accident analysis to respond to a design basis large break LOCA. The Surveillance should be continued for a minimum of 5 minutes in order to demonstrate that all starting transients have decayed and stability is achieved.

The requirement to verify the connection and power supply of permanent and autoconnected loads is intended to satisfactorily show the relationship of these loads to the EDG loading logic. In certain circumstances, many of these loads cannot actually be connected or loaded without undue hardship or potential for undesired operation. For instance, Emergency Core Cooling Systems (ECCS) injection valves are not desired to be stroked open, or high pressure injection systems are not capable of being operated at full flow, and not desired to be realigned to the ECCS mode of operation. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the EDG systems to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

The Frequency of 18 months is consistent with the recommendations of Regulatory Guide 1.108 (Ref. 8),

paragraph 2.a.(1), takes into consideration unit conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

This SR is modified by two Notes. The reason for Note 1 is to minimize wear and tear on the EDGs during testing. For the purpose of this testing, the EDGs must be started from standby conditions, that is, with the engine coolant and oil continuously circulated, as required, and temperature maintained consistent with manufacturer recommendations. The reason for Note 2 is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. This restriction from normally performing the Surveillance in MODE 1, 2, 3, or 4 is further amplified to allow portions of the Surveillance to be performed for the (continued)

North Anna Units 1 and 2 B 3.8.1-27 Revi si on 1

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.10 (continued)

REQUIREMENTS purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines unit safety is maintained or enhanced.

This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial Surveillance, a successful partial Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of the unit shutdown and startup to determine that unit safety is maintained or enhanced when portions of the Surveillance are performed in MODE 1, 2, 3, or 4. Risk insights or deterministic methods may be used for this assessment.

SR 3.8.1.11 This Surveillance demonstrates that the EDG automatically starts and achieves the required voltage and frequency within the specified time (10 seconds) from the design basis actuation signal (LOCA signal) and operates for Ž 5 minutes.

The 5 minute period provides sufficient time to demonstrate stability. SR 3.8.1.1i.d and SR 3.8.1.1i.e ensure that permanently connected loads and emergency loads are energized from the offsite electrical power system on an ESF signal without loss of offsite power.

The requirement to verify the connection of permanent and autoconnected loads is intended to satisfactorily show the relationship of these loads to the EDG loading logic. In certain circumstances, many of these loads cannot actually be connected or loaded without undue hardship or potential for undesired operation. For instance, ECCS injection valves are not desired to be stroked open, or high pressure injection systems are not capable of being operated at full flow. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the EDG system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

(continued)

North Anna Units 1 and 2 B 3.8.1-28 Revision 1

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.11 (continued)

REQUIREMENTS The Frequency of 18 months takes into consideration unit conditions required to perform the Surveillance and is intended to be consistent with the expected fuel cycle lengths. Operating experience has shown that these components usually pass the SR when performed at the 18 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

This SR is modified by two Notes. The reason for Note 1 is to minimize wear and tear on the EDGs during testing. For the purpose of this testing, the EDGs must be started from standby conditions, that is, with the engine coolant and oil continuously circulated and temperature maintained consistent with manufacturer recommendations. The reason for Note 2 is that during operation with the reactor critical, performance of this Surveillance could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, unit safety systems. This restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow portions of the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines unit safety is maintained or enhanced.

This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial Surveillance, a successful partial Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of the unit shutdown and startup to determine that unit safety is maintained or enhanced when portions of the Surveillance are performed in MODE 1 or 2.

Risk insights or deterministic methods may be used for this assessment.

SR 3.8.1.12 This Surveillance demonstrates that EDG noncritical protective functions (e.g., high jacket water temperature) are bypassed on actual or simulated signals from an ESF actuation, a loss of voltage, or a loss of voltage signal (continued)

North Anna Units 1 and 2 B 3.8. 1-29 Revi si on 1

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.12 (continued)

REQUIREMENTS concurrent with an ESF actuation test signal, and critical protective functions (engine overspeed and generator differential current) trip the EDG to avert substantial damage to the EDG unit. The noncritical trips are bypassed during DBAs and provide an alarm on an abnormal engine condition. This alarm provides the operator with sufficient time to react appropriately. The EDG availability to mitigate the DBA is more critical than protecting the engine against minor problems that are not immediately detrimental to emergency operation of the EDG.

The 18 month Frequency is based on engineering judgment, taking into consideration unit conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the SR when performed at the 18 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

This SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required EDG from service. This restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines unit safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed Surveillance, a successful Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a unit shutdown and startup to determine that unit safety is maintained or enhanced when the Surveillance is performed in MODE 1 or 2. Risk insights or deterministic methods may be used for this assessment.

North Anna Units 1 and 2 B 3.8. 1-30 Revi si on 1

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.13 REQUIREMENTS (continued) Regulatory Guide 1.108 (Ref. 8), paragraph 2.a.(3), provides an acceptable method to demonstrate once per 18 months that the EDGs can start and run continuously at full load capability for an interval of not less than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , 2 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months of which is at a load equivalent from 105% to 110%

of the continuous duty rating and the remainder of the time at a load equivalent from 90% to 100% of the continuous duty rating of the EDG. The EDG starts for this Surveillance can be performed either from standby or hot conditions. The provisions for prelubricating and warmup, discussed in SR 3.8.1.2, and for gradual loading, discussed in SR 3.8.1.3, are applicable to this SR.

The load band is provided to avoid routine overloading of the EDG. Routine overloading may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain EDG OPERABILITY.

The 18 month Frequency is consistent with the recommendations of Regulatory Guide 1.108 (Ref. 8),

paragraph 2.a.(3), takes into consideration unit conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

This Surveillance is modified by three Notes. Note 1 states that momentary transients due to changing bus loads do not invalidate this test. Similarly, momentary power factor transients above the power factor limit will not invalidate the test. The reason for Note 2 is that during operation with the reactor critical, performance of this Surveillance could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, unit safety systems. This restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines unit safety is maintained or enhanced.

This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed Surveillance, a successful Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the Surveillance; as well as (continued)

North Anna Units 1 and 2 B 3.8.1-31 Revi si on 1

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.13 (continued)

REQUIREMENTS the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a unit shutdown and startup to determine that unit safety is maintained or enhanced when the Surveillance is performed in MODE 1 or 2. Risk insights or deterministic methods may be used for this assessment. Note 3 ensures that the EDG is tested under load conditions that are as close to design basis conditions as possible. When synchronized with offsite power, testing should be performed at a power factor of

0.9. This power factor is representative of the actual inductive loading an EDG would see under design basis accident conditions. Under certain conditions, however, Note 3 allows the surveillance to be conducted at a power factor other than

0.9. These conditions occur when grid voltage is high, and the additional field excitation needed to get the power factor to

0.9 results in voltages on the emergency busses that are too high. Under these conditions, the power factor should be maintained as close as practicable to 0.9 while still maintaining acceptable voltage limits on the emergency busses. In other circumstances, the grid voltage may be such that the EDG excitation levels needed to obtain a power factor of 0.9 may not cause unacceptable voltages on the emergency busses, but the excitation levels are in excess of those recommended for the EDG. In such cases, the power factor shall be maintained as close as practicable to 0.9 without exceeding the EDG excitation limits.

SR 3.8.1.14 This Surveillance demonstrates that the diesel engine can restart from a hot condition, such as subsequent to shutdown from normal Surveillances, and achieve the required voltage and frequency within 10 seconds. The 10 second time is derived from the requirements of the accident analysis to respond to a design basis large break LOCA. The 18 month Frequency is consistent with the recommendations of Regulatory Guide 1.108 (Ref. 8), paragraph 2.a.(5).

This SR is modified by two Notes. Note 1 ensures that the test is performed with the diesel sufficiently hot. The load band is provided to avoid routine overloading of the EDG.

Routine overloads may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain EDG OPERABILITY. The requirement that the (continued)

North Anna Units 1 and 2 B 3.8. 1-32 Revision I

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.14 (continued)

REQUIREMENTS diesel has operated for at least 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months at full load conditions, or after operating temperatures reach a stabilized state, prior to performance of this Surveillance is based on manufacturer recommendations for achieving hot conditions. Momentary transients due to changing bus loads do not invalidate this test. Note 2 allows all EDG starts to be preceded by an engine prelube period to minimize wear and tear on the diesel during testing.

SR 3.8.1.15 Consistent with the recommendations of Regulatory Guide 1.108 (Ref. 8), paragraph 2.a.(6), this Surveillance ensures that the manual synchronization and load transfer from the EDG to the offsite source can be made and the EDG can be returned to ready to load status when offsite power is restored. It also ensures that the autostart logic is reset to allow the EDG to reload if a subsequent loss of offsite power occurs. The EDG is considered to be in ready to load status when the EDG is at rated speed and voltage, the output breaker is open and can receive an autoclose signal on bus undervoltage, and the load sequencing timing relays are reset. EDG loading of the emergency bus is limited to normal energized loads.

The Frequency of 18 months is consistent with the recommendations of Regulatory Guide 1.108 (Ref. 8),

paragraph 2.a.(6), and takes into consideration unit conditions required to perform the Surveillance.

This SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. This restriction from normally performing the Surveillance in MODE 1, 2, 3, or 4 is further amplified to allow the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines unit safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed Surveillance, a successful Surveillance, and a perturbation (continued)

North Anna Units 1 and 2 B 3.8. 1-33 Revi si on 1

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.15 (continued)

REQUIREMENTS of the offsite or onsite system when they are tied together or operated independently for the Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a unit shutdown and startup to determine that unit safety is maintained or enhanced when the Surveillance is performed in MODE 1, 2, 3, or 4. Risk insights or deterministic methods may be used for this assessment.

SR 3.8.1.16 Under accident conditions, with a loss of offsite power, safety injection, containment spray, or recirculation spray, loads are sequentially connected to the bus by the automatic load sequencing timing relays. The sequencing timing relays control the permissive and starting signals to motor breakers to prevent overloading of the EDGs due to high motor starting currents. The load sequence time interval tolerances, listed in the Technical Requirements Manual (Ref. 12), ensure that sufficient time exists for the EDG to restore frequency and voltage prior to applying the next load and that safety analysis assumptions regarding ESF equipment time delays are not violated. Reference 2 provides a summary of the automatic loading of ESF buses.

The Frequency of 18 months is consistent with the recommendations of Regulatory Guide 1.108 (Ref. 8),

paragraph 2.a.(2), takes into consideration unit conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

This SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. This restriction from normally performing the Surveillance in MODE 1, 2, 3, or 4 is further amplified to allow the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines unit safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed (continued)

North Anna Units 1 and 2 B 3.8.1-34 Revision 1

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.16 (continued)

REQUIREMENTS Surveillance, a successful Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a unit shutdown and startup to determine that unit safety is maintained or enhanced when the Surveillance is performed in MODE 1, 2, 3, or 4. Risk insights or deterministic methods may be used for this assessment.

SR 3.8.1.17 In the event of a DBA coincident with a loss of offsite power, the EDGs are required to supply the necessary power to ESF systems so that the fuel, RCS, and containment design limits are not exceeded.

This Surveillance demonstrates the EDG operation, as discussed in the Bases for SR 3.8.1.10, during a loss of offsite power actuation test signal in conjunction with an ESF actuation signal. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the EDG system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

The Frequency of 18 months takes into consideration unit conditions required to perform the Surveillance and is intended to be consistent with an expected fuel cycle length of 18 months.

This SR is modified by two Notes. The reason for Note 1 is to minimize wear and tear on the EDGs during testing. For the purpose of this testing, the EDGs must be started from standby conditions, that is, with the engine coolant and oil continuously circulated and temperature maintained consistent with manufacturer recommendations for EDGs. The reason for Note 2 is that the performance of the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. This restriction from normally performing the Surveillance in MODE 1, 2, 3, or 4 is further amplified to allow portions of the Surveillance to be performed for the purpose of reestablishing OPERABILITY (continued)

North Anna Units 1 and 2 B 3.8.1-35 Revi si on 1

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.17 (continued)

REQUIREMENTS (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines unit safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial Surveillance, a successful partial Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of the unit shutdown and startup to determine that unit safety is maintained or enhanced when portions of the Surveillance are performed in MODE 1, 2, 3, or 4. Risk insights or deterministic methods may be used for this assessment.

SR 3.8.1.18 This Surveillance demonstrates that the EDG starting independence has not been compromised. Also, this Surveillance demonstrates that each engine can achieve proper speed within the specified time when the EDGs are started simultaneously.

The 10 year Frequency is consistent with the recommendations of Regulatory Guide 1.108 (Ref. 8).

This SR is modified by a Note. The reason for the Note is to minimize wear on the EDG during testing. For the purpose of this testing, the EDGs must be started from standby conditions, that is, with the engine coolant and oil continuously circulated and temperature maintained consistent with manufacturer recommendations.

REFERENCES 1. UFSAR, Chapter 3.

2. UFSAR, Chapter 8.

3. Safety Guide 9, March 1971.

4. UFSAR, Chapter 6.

5. UFSAR, Chapter 15.

North Anna Units 1 and 2 B 3.8. 1-36 Revi si on 1

AC Sources-Operating B 3.8.1 BASES REFERENCES 6. Regulatory Guide 1.93, Rev. 0, December 1974.

(continued)

7. Generic Letter 84-15, "Proposed Staff Actions to Improve and Maintain Diesel Generator Reliability,"

July 2, 1984.

8. Regulatory Guide 1.108, Rev. 1, August 1977.

9. Regulatory Guide 1.137, Rev. 1, October 1979.

10. ASME Code for Operation and Maintenance of Nuclear Power Plants.

11. IEEE Standard 308-1971.

12. Technical Requirements Manual.

North Anna Units 1 and 2 B 3.8. 1-37 Revi si on I

Intentionally Blank Diesel Fuel Oil and Starting Air B 3.8.3 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.3 Diesel Fuel Oil and Starting Air BASES BACKGROUND The fuel oil storage system has sufficient capacity to operate two EDGs for a period of 7 days with each supplying the maximum post loss of coolant accident load demand discussed in the UFSAR, Section 9.5.4.2 (Ref. 1). This onsite fuel oil capacity is sufficient to operate the EDGs for longer than the time to replenish the onsite supply from outside sources.

The fuel oil storage system consists of two underground tanks. Fuel oil is transferred from an underground tank to each EDG day tank by a lead fuel oil transfer pump. An additional underground tank and fuel oil transfer pump is associated with each EDG day tank to provide a redundant subsystem. Independent level switches on the day tank operate the lead and backup fuel oil transfer subsystems.

Only one fuel oil transfer subsystem is required for the EDG to be considered OPERABLE. All outside tanks, pumps, and I piping are located underground or in a missile protected area.

For proper operation of the standby EDGs, it is necessary to ensure the proper quality of the fuel oil. Regulatory Guide 1.137 (Ref. 2) addresses the recommended fuel oil practices as supplemented by ANSI N195 (Ref. 3). The fuel oil properties governed by these SRs are the water and sediment content, the kinematic viscosity, specific gravity (or API gravity), and impurity level.

Each EDG has an air start system that contains two separate and independent subsystems. Normally, each subsystem is aligned to provide starting air to the associated EDG. Each subsystem consists of a receiver and a compressor. Only one air start subsystem is required for the EDG to be considered OPERABLE.

APPLICABLE The initial conditions of Design Basis Accident (DBA) and SAFETY ANALYSES transient analyses in the UFSAR, Chapter 6 (Ref. 4), and in the UFSAR, Chapter 15 (Ref. 5), assume Engineered Safety Feature (ESF) systems are OPERABLE. The EDGs are designed to provide sufficient capacity, capability, redundancy, and (continued)

North Anna Units 1 and 2 B 3.8.3-1 Revision 1

Diesel Fuel Oil and Starting Air B 3.8.3 BASES APPLICABLE reliability to ensure the availability of necessary power to SAFETY ANALYSES ESF systems so that fuel, Reactor Coolant System and (continued) containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution Limits; Section 3.4, Reactor Coolant System (RCS); and Section 3.6, Containment Systems.

The DBA and transient analyses assume the operation of one EDG associated with the unit on which an accident is postulated to occur and the operation of one EDG on the unit which is unaffected by the accident to support shared systems. LCO 3.8.1 requires two EDGs to be OPERABLE and one EDG from the other unit to be OPERABLE. However, only sufficient fuel oil to operate one EDG and one EDG on the other unit is required to satisfy the assumptions of the DBA and transient analysis and to support EDG OPERABILITY.

Since diesel fuel oil and the air start subsystem support the operation of the standby AC power sources, they satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO Stored diesel fuel oil is required to have sufficient supply for 7 days of full load operation for two EDGs. It is also required to meet specific standards for quality. This requirement, in conjunction with an ability to obtain replacement supplies within 2 days, supports the availability of EDGs required to shut down the reactor and to maintain it in a safe condition for an anticipated operational occurrence (AOO) or a postulated DBA with loss of offsite power. EDG day tank fuel requirements, as well as transfer capability from the storage tank to the day tank, are addressed in LCO 3.8.1, "AC Sources-Operating," and LCO 3.8.2, "AC Sources-Shutdown."

One air start subsystem is required to ensure EDG OPERABILITY. The required starting air subsystem receiver is required to have a minimum of 175 psig to provide the EDG with more than one start attempt without recharging the air start receivers.

APPLICABILITY The AC sources (LCO 3.8.1 and LCO 3.8.2) are required to ensure the availability of the required power to shut down the reactor and maintain it in a safe shutdown condition after an AO0 or a postulated DBA. Since stored diesel fuel oil and the starting air subsystem support LCO 3.8.1 and (continued)

North Anna Units 1 and 2 B 3.8.3-2 Revision I

Diesel Fuel Oil and Starting Air B 3.8.3 BASES ACTIONS C.1 (continued)

Completion Time allows for further evaluation, resampling and re-analysis of the EDG fuel oil stored in the below ground tanks.

D.1 With the new fuel oil properties defined in the Bases for SR 3.8.3.2 not within the required limits, a period of 30 days is allowed for restoring the stored fuel oil properties. This period provides sufficient time to test the stored fuel oil to determine that the new fuel oil, when mixed with previously stored fuel oil, remains acceptable, or to restore the stored fuel oil properties. This restoration may involve feed and bleed procedures, filtering, or combinations of these procedures. Even if an EDG start and load was required during this time interval and the fuel oil properties were outside limits, there is a high likelihood that the EDG would still be capable of performing its intended function.

E.1 With the one required starting air receiver pressure

< 175 psig, sufficient capacity for several EDG start attempts does not exist. However, as long as the receiver pressure is > 150 psig, there is adequate capacity for at least one start attempt, and the EDG can be considered OPERABLE while the air receiver pressure is restored to the required limit. A period of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is considered sufficient to complete restoration to the required pressure prior to declaring the EDG inoperable. This period is acceptable based on the remaining air start capacity, the fact that most EDG starts are accomplished on the first attempt, and the low probability of an event during this brief period.

F.1 With a Required Action and associated Completion Time not met, or one or more EDG's fuel oil or the required starting air subsystem not within limits for reasons other than addressed by Conditions A through E, the associated EDG(s) may be incapable of performing its intended function and must be immediately declared inoperable. Only one starting air subsystem is required.

North Anna Units 1 and 2 B 3.8.3-5 Revision 0

Diesel Fuel Oil and Starting Air B 3.8.3 BASES SURVEILLANCE SR 3.8.3.1 REQUIREMENTS This SR provides verification that there is an adequate inventory of fuel oil in the storage tanks to support two EDGs' operation for 7 days at full load. The 7 day period is sufficient time to place the unit in a safe shutdown condition and to bring in replenishment fuel from an offsite location.

The 31 day Frequency is adequate to ensure that a sufficient supply of fuel oil is available, since low level alarms are provided and unit operators would be aware of any large uses of fuel oil during this period.

SR 3.8.3.2 The tests listed below are a means of determining whether new fuel oil is of the appropriate grade and has not been contaminated with substances that would have an immediate, detrimental impact on diesel engine combustion. If results from these tests are within acceptable limits, the fuel oil may be added to the storage tanks without concern for contaminating the entire volume of fuel oil in the storage tanks. These tests are to be conducted prior to adding the new fuel to the storage tank(s), but in no case is the time between receipt of new fuel and conducting the tests to exceed 31 days. The tests, limits, and applicable ASTM Standards are as follows:

a. Sample the new fuel oil in accordance with ASTM D4057-88 (Ref. 6);

b. Verify in accordance with the tests specified in ASTM D975-89 (Ref. 6) that the sample has an absolute specific gravity at 60/60OF of Ž 0.83 and

0.89 or an API gravity at 60°F of Ž 270 and

390, a kinematic viscosity at 400 C of Ž 1.9 centistokes and

4.1 centistokes, and a flash point of Ž 125°F; and

c. Verify that the new fuel oil is checked for water and sediment in accordance with the Diesel Fuel Oil Testing Program.

(continued)

North Anna Units 1 and 2 B 3.8.3-6 Revision I

Diesel Fuel Oil and Starting Air B 3.8.3 BASES SURVEILLANCE SR 3.8.3.2 (continued)

REQUIREMENTS Failure to meet any of the above limits is cause for rejecting the new fuel oil, but does not represent a failure to meet the LCO concern since the fuel oil is not added to the storage tanks.

Within 31 days following the initial new fuel oil sample, the fuel oil is analyzed to establish that the other properties specified in Table 1 of ASTM D975-89 (Ref. 7) are met for new fuel oil when tested in accordance with ASTM D975-89 (Ref. 6), except that the analysis for sulfur may be performed in accordance with ASTM D4294-98 (Ref. 6),

ASTM D1552-88 (Ref. 6) or ASTM D2622-82 (Ref. 6). The 31 day period is acceptable because the fuel oil properties of interest, even if they were not within stated limits, would not have an immediate effect on EDG operation. This Surveillance ensures the availability of high quality fuel oil for the EDGs.

Fuel oil degradation during long term storage shows up as an increase in particulate, due mostly to oxidation. The presence of particulate does not mean the fuel oil will not burn properly in a diesel engine. The particulate can cause fouling of filters and fuel oil injection equipment, however, which can cause engine failure.

Particulate concentrations should be determined in accordance with ASTM D2276-83, Method A (Ref. 6). This method involves a gravimetric determination of total particulate concentration in the fuel oil and has a limit of 10 mg/l. It is acceptable to obtain a field sample for subsequent laboratory testing in lieu of field testing. Each tank is considered and tested separately.

The Frequency of this test takes into consideration fuel oil degradation trends that indicate that particulate concentration is unlikely to change significantly between Frequency intervals.

SR 3.8.3.3 This Surveillance ensures that, without the aid of the refill compressor, sufficient air start capacity for each EDG is available. The system design requirements were verified for a minimum of five engine start cycles without recharging. A start cycle is measured in terms of time (continued)

North Anna Units 1 and 2 B 3.8.3-7 Revision 1

Diesel Fuel Oil and Starting Air B 3.8.3 BASES SURVEILLANCE SR 3.8.3.3 (continued)

REQUIREMENTS (seconds of cranking). One air start subsystem is

Ž 150 psig. The pressure specified in this SR is intended to reflect the lowest value at which more than one start can be accomplished.

The 31 day Frequency takes into account the capacity, capability, redundancy, and diversity of the AC sources and other indications available in the control room, including alarms, to alert the operator to below normal air start pressure.

SR 3.8.3.4 Microbiological fouling is a major cause of fuel oil degradation. There are numerous bacteria that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive. Removal of water from the fuel storage tanks once every 92 days eliminates the necessary environment for bacterial survival. This is the most effective means of controlling microbiological fouling.

In addition, it eliminates the potential for water entrainment in the fuel oil during EDG operation. Water may come from any of several sources, including condensation, ground water, rain water, and contaminated fuel oil, and from breakdown of the fuel oil by bacteria. Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system. The Surveillance Frequencies are established by Regulatory Guide 1.137 (Ref. 2). This SR is for preventive maintenance. The presence of water does not necessarily represent failure of this SR, provided the accumulated water is removed during performance of the Surveillance.

REFERENCES 1. UFSAR, Section 9.5.4.2.

2. Regulatory Guide 1.137.

3. ANSI N195-1976, Appendix B.

4. UFSAR, Chapter 6.

5. UFSAR, Chapter 15.

North Anna Units 1 and 2 B 3.8.3-8 Revision 0

Diesel Fuel Oil and Starting Air B 3.8.3 BASES REFERENCES 6. ASTM Standards: D4057-88; D975-89; D4176-86; D1552-88; (continued) D2622-82; D2276, Method A; D4294-98.

7. ASTM Standards, D975, Table 1, 1989.

North Anna Units 1 and 2 B 3.8.3-9 Revision 1

Intentionally Blank Distribution Systems-Operating B 3.8.9 BASES ACTIONS D.1 (continued)

Ventilation System," LCO 3.7.12, "Emergency Core Cooling System Pump Room Exhaust Air Cleanup System," and LCO 3.7.19, "Component Cooling Water (CC) System," are followed.

E.1 With one or more required LCO 3.8.9.b DC electrical power distribution subsystem(s) inoperable, the shared component(s) on the other unit is not capable of operating.

In this condition, the associated shared component is declared inoperable immediately. SW, MCR/ESGR EVS, Auxiliary Building central exhaust system, and CC are shared systems.

The associated Conditions or Required Actions of LCO 3.7.8, 3.7.10, 3.7.12, and 3.7.19 are followed.

F.1 and F.2 If the inoperable LCO 3.8.9.a distribution subsystem cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

G.1 Condition G corresponds to a level of degradation in the electrical power distribution system that causes a required safety function to be lost. When more than one inoperable LCO 3.8.9.a electrical power distribution subsystem results in the loss of a required function, the unit is in a condition outside the accident analysis. Therefore, no additional time is justified for continued operation.

LCO 3.0.3 must be entered immediately to commence a controlled shutdown.

North Anna Units 1 and 2 B 3.8.9-9 Revision 0

Distribution Systems-Operating B 3.8.9 BASES SURVEILLANCE SR 3.8.9.1 REQUIREMENTS This Surveillance verifies that the required AC, DC, and AC vital bus electrical power distribution systems are functioning properly, with the correct circuit breaker alignment. The correct breaker alignment ensures the appropriate separation and independence of the electrical divisions is maintained, and the appropriate voltage is available to each required bus. The verification of proper voltage availability on the buses ensures that the required voltage is readily available for motive as well as control functions for critical system loads connected to these buses. Verification of proper voltage availability for 480 volt buses and load centers may be performed by indirect methods. The 7 day Frequency takes into account the redundant capability of the AC, DC, and AC vital bus electrical power distribution subsystems, and other indications available in the control room that alert the operator to subsystem malfunctions.

REFERENCES 1. UFSAR, Chapter 6.

2. UFSAR, Chapter 15.

3. Regulatory Guide 1.93, December 1974.

North Anna Units 1 and 2 B 3.8.9-10 Revision I

Distribution Systems-Shutdown B 3.8.10 BASES APPLICABILITY The AC, DC, and AC vital bus electrical power distribution (continued) subsystems requirements for MODES 1, 2, 3, and 4 are covered in LCO 3.8.9.

ACTIONS A.1, A.2.1, A.2.2, A.2.3, A.2.4, and A.2.5 Although redundant required features may require redundant trains of electrical power distribution subsystems to be OPERABLE, one OPERABLE distribution subsystem train may be capable of supporting sufficient required features to allow continuation of CORE ALTERATIONS and recently irradiated fuel movement. By allowing the option to declare required features associated with an inoperable distribution subsystem inoperable, appropriate restrictions are implemented in accordance with the affected distribution subsystem LCO's Required Actions. In many instances, this option may involve undesired administrative efforts.

Therefore, the allowance for sufficiently conservative actions is made (i.e., to suspend CORE ALTERATIONS, movement of recently irradiated fuel assemblies, and operations involving positive reactivity additions) that could result in loss of required SDM (MODE 5) or boron concentration (MODE 6). Suspending positive reactivity additions that could result in failure to meet the minimum SDM or boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than what would be required in the RCS for minimum SDM or refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. Introduction of temperature changes including temperature increases when operating with a positive MTC must also be evaluated to ensure they do not result in a loss of required SDM.

Suspension of these activities does not preclude completion of actions to establish a safe conservative condition. These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required AC and DC electrical power distribution subsystems and to continue this action until restoration is accomplished in order to provide the necessary power to the unit safety systems.

(continued)

North Anna Units 1 and 2 B 3.8.10-3 Revision 0

Distribution Systems-Shutdown B 3.8.10 BASES ACTIONS A.1, A.2.1, A.2.2, A.2.3, A.2.4, and A.2.5 (continued)

Notwithstanding performance of the above conservative Required Actions, a required residual heat removal (RHR) subsystem may be inoperable. In this case, Required Actions A.2.1 through A.2.4 do not adequately address the concerns relating to coolant circulation and heat removal. Pursuant to LCO 3.0.6, the RHR ACTIONS would not be entered.

Therefore, Required Action A.2.5 is provided to direct declaring RHR inoperable, which results in taking the appropriate RHR actions.

The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required distribution subsystems should be completed as quickly as possible in order to minimize the time the unit safety systems may be without power.

SURVEILLANCE SR 3.8.10.1 REQUIREMENTS This Surveillance verifies that the required AC, DC, and AC vital bus electrical power distribution subsystems are functioning properly, with all the buses energized. The verification of proper voltage availability on the buses ensures that the required power is readily available for motive as well as control functions for critical system loads connected to these buses. Verification of proper voltage availability for 480 volt buses and load centers may be performed by indirect methods. The 7 day Frequency takes into account the capability of the electrical power distribution subsystems, and other indications available in the control room that alert the operator to subsystem malfunctions.

REFERENCES 1. UFSAR, Chapter 6.

2. UFSAR, Chapter 15.

North Anna Units 1 and 2 B 3.8. 10-4 Revision 1

ML022460155

Text

SUMMARY

Navigation menu

Search