ML022600499

Proposed Technical Specification Change, Provisions for Buried Fuel Oil Storage Tank Inspection Related Repair

ML022600499
Person / Time
Site:	Surry
Issue date:	09/05/2002
From:	Hartz L Virginia Electric & Power Co (VEPCO)
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
-nr, 02-561
Download: ML022600499 (29)

Text

VIRGINIA ELECTRIC AND POWER COMPANY RICHMOND, VIRGINIA 23261 September 5, 2002 U.S. Nuclear Regulatory Commission Serial No.02-561 Attention: Document Control Desk SPS-LIC/CGL RO Washington, D.C. 20555 Docket Nos.

50-280 50-281 License Nos.

DPR-32 DPR-37 Gentlemen:

VIRGINIA ELECTRIC AND POWER COMPANY SURRY POWER STATION UNITS I AND 2 PROPOSED TECHNICAL SPECIFICATION CHANGE PROVISIONS FOR BURIED FUEL OIL STORAGE TANK INSPECTION/

RELATED REPAIR Pursuant to 10 CFR 50.90, Virginia Electric and Power Company (Dominion) requests amendments, in the form of changes to the Technical Specifications to Facility Operating Licenses Numbers DPR-32 and DPR-37 for Surry Power Station Units 1 and 2, respectively. The proposed changes will add provisions to permit inspection and related repair of a buried fuel oil storage tank during plant operation. The provisions include a 7-day allowed outage time for a buried fuel oil storage tank. A plant specific risk evaluation of the 7-day allowed outage time was performed and concluded that the risk impact is acceptable, as detailed in Attachment 1. A discussion of the proposed Technical Specifications changes is provided in Attachment 1. The mark-up and proposed pages are provided in Attachments 2 and 3, respectively.

We have evaluated the proposed Technical Specifications changes and have determined that they do not involve a significant hazards consideration as defined in 10 CFR 50.92.

The basis for our determination that the changes do not involve a significant hazards consideration is provided in Attachment 4.

We have also determined that operation with the proposed changes will not result in any significant increase in the amount of effluents that may be released offsite and no significant increase in individual or cumulative occupational radiation exposure. Therefore, the proposed amendment is eligible for categorical exclusion as set forth in 10 CFR 51.22(c)(9).

Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment is needed in connection with the approval of the proposed changes.

Similar provisions are included in the North Anna Power Station Technical Specifications, which were recently converted to Improved Technical Specifications and approved by the NRC on April 5, 2002 by Amendments 231/212.

If you have any further questions or require additional information, please contact us.

Very truly yours, Leslie N. Hartz Vice President - Nuclear Engineering Attachments Commitments made in this letter: None cc:

U.S. Nuclear Regulatory Commission Region II Sam Nunn Atlanta Federal Center Suite 23T85 61 Forsyth Street, SW Atlanta, Georgia 30303 Mr. R. A. Musser NRC Senior Resident Inspector Surry Power Station Commissioner Bureau of Radiological Health 1500 East Main Street Suite 240 Richmond, VA 23218

SN: 02-561 Docket Nos.: 50-280/281

Subject:

Proposed TS Change Provisions for Buried Fuel Oil Storage Tank Inspection/

Related Repair COMMONWEALTH OF VIRGINIA

) )

COUNTY OF HENRICO

)

The foregoing document was acknowledged before me, in and for the County and Commonwealth aforesaid, today by Leslie N. Hartz, who is Vice President - Nuclear Engineering, of Virginia Electric and Power Company. She has affirmed before me that she is duly authorized to execute and file the foregoing document in behalf of that Company, and that the statements in the document are true to the best of her knowledge and belief.

Acknowledged before me this 5th day of September, 2002.

My Commission Expires: March 31, 2004.

otary Pb-i

-~,.(SEAL)?Q

Attachment I Discussion of Change Surry Power Station Units I and 2 Virginia Electric and Power Company (Dominion)

Letter Serial No.02-561 DISCUSSION OF CHANGE INTRODUCTION Pursuant to 10 CFR 50.90, Virginia Electric and Power Company (Dominion) requests a change to Technical Specification (TS) 3.16 and its associated Basis. The proposed change adds provisions to permit inspection and related repair of a buried fuel oil storage tank during plant operation. The provisions include requirements to verify the availability of onsite and offsite fuel oil sources to ensure that an adequate supply of fuel oil remains available.

The proposed change has been reviewed, and it has been judged to involve no significant hazards consideration, as defined in 10CFR50.92. Furthermore, it has been determined that the change qualifies for categorical exclusion from an environmental assessment as set forth in 10CFR51.22(c)(9).

Therefore, no environmental impact statement or environmental assessment is needed in connection with the approval of the proposed change.

BACKGROUND Surry Power Station has three emergency diesel generators (EDGs) for the two units.

Each EDG has an independent day tank (combined auxiliary wall tank and base tank).

The auxiliary wall tanks are filled by transferring fuel oil from either one of two buried, Seismic Category 1, tornado-missile-protected fuel oil storage tanks, each having a 20,000 gallon capacity.

The buried fuel oil storage tanks are gravity-fed from the 210,000 gallon above ground fuel oil storage tank. The two buried and one above ground fuel oil storage tanks are common to both units.

General industry experience has indicated that inspection of buried fuel oil storage tanks is prudent.

However, the tanks must be removed from service to facilitate inspection and related repair. The Surry TSs as currently written would require a dual unit outage in order to permit inspection and related repair of a buried fuel oil storage tank. This proposed change adds provisions to permit inspection and related repair of a buried fuel oil storage tank during plant operation, thus eliminating the burden of a dual unit outage to accomplish inspection and related repair of a buried tank. The provisions include requirements to verify the availability of onsite and offsite fuel oil sources to ensure that an adequate supply of fuel oil remains available. As detailed herein, the risk impact of the provisions has been evaluated and determined to be acceptable.

DESCRIPTION OF CHANGE The following specific revisions are proposed to permit inspection and related repair of a buried fuel oil storage tank during plant operation:

Page 1 of 12 Letter Serial No.02-561 "TS 3.16.B.1.b is being revised to clarify that the currently allowed 24-hour inoperability of one diesel fuel oil flow path does not apply when a buried fuel oil storage tank is removed from service for inspection and related repair.

This clarification is being made by revising the second sentence in TS 3.16.B.1.b to read:

"If after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, the inoperable flow path cannot be returned to service for reasons other than buried fuel oil storage tank inspection and related repair, the diesel shall be considered "inoperable."

TS 3.16.B.4 is being added to include the following new requirements for a buried tank taken out of service for inspection and related repair and states:

"4. One buried fuel oil storage tank may be inoperable for 7 days for tank inspection and related repair, provided the following actions are taken:

a. prior to removing the tank from service, verify that 50,000 gallons of replacement fuel oil is available offsite and transportation is available to deliver that volume of fuel oil within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, and

b. prior to removing the tank from service and at least once every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, verify that the remaining buried fuel oil storage tank contains

> 17,500 gallons, and

c. prior to removing the tank from service and at least once every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, verify that the above ground fuel oil storage tank contains > 50,000 gallons.

If these conditions are not satisfied or if the buried fuel oil storage tank is not returned to OPERABLE status within 7 days, both units shall be placed in HOT SHUTDOWN within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />."

"* The following discussion is being added in the TS '3.16 Basis as the second paragraph on page TS 3.16-6:

"One of the two buried fuel oil storage tanks may be inoperable to permit inspection and related repair of that buried fuel oil storage -tank. While one tank is removed from service, the remaining buried fuel oil storage tank supplies fuel oil to the EDGs of both units.

Prior to removal of one buried tank from service and while it is inoperable, verification of the volume in the remaining buried fuel oil storage tank and the above ground fuel oil storage tank is required to ensure an adequate source of fuel oil remains available onsite. In addition, verification of the offsite replacement fuel oil supply is also required.

While one buried tank is out of service, the verification of the onsite and offsite fuel oil sources continues to support full load operation of one diesel generator for seven days."

TECHNICAL ANALYSIS OF PROPOSED CHANGE FUEL OIL SYSTEM DESIGN Surry Power Station has three emergency diesel generators (EDGs) for the two units.

Each EDG has an independent day tank (combined auxiliary wall tank and base tank).

Page 2 of 12

Attachment I Letter Serial No.02-561 The auxiliary wall tanks are filled by transferring fuel oil from either one of two buried, Seismic Category 1, tornado-missile-protected fuel oil storage tanks, each having a 20,000 gallon capacity.

The buried fuel oil storage tanks are gravity-fed from the 210,000 gallon above ground fuel oil storage tank. The two buried and one above ground fuel oil storage tanks are common to both units. The buried fuel oil tanks supply the EDG ready and standby fuel oil transfer pumps. Tank 1-EE-TK-2A supplies EDG ready pumps 1-EE-P-1A, -1B, and -AC, while tank 1-EE-TK-2B supplies standby pumps 1-EE-P-1D, -AE, and -AF. Pumps 1-EE-P-1D, -AE, and -1F serve as the backup to pumps 1-EE-P-1A, -1B, and -AC, respectively.

Pumps 1-EE-P-1A-D, -1B/-IE, and

-1/C/-1F supply EDGs 1, 2, and 3, respectively.

TECHNICAL SPECIFICATIONS/ACCIDENT ANALYSES AND DEFENSE-IN-DEPTH/

SAFETY MARGIN ASSESSMENT TS 3.16.A.1 currently requires that a minimum supply of 35,000 gallons of fuel oil be available onsite. As stated in the TS 3.16 Basis, a minimum of 35,000 gallons of fuel oil is contained in the buried fuel oil storage tanks and is required for a seven day supply of fuel oil for full load operation of one EDG.

The provisions being added to permit inspection and related repair of a buried tank require verification of at least 17,500 gallons in the remaining buried tank and at least 50,000 gallons in the above ground tank; these provisions ensure an adequate source of fuel oil remains available onsite.

In addition, verification of an offsite replacement fuel oil supply of 50,000 gallons available to be delivered within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> is also required. While one buried tank is out of service, the verification of the onsite and offsite fuel oil sources continues to support full load operation of one diesel for seven days. In the event of an emergency requiring operation of the EDGs while a buried fuel oil storage tank is out of service, work on the out-of-service tank will be stopped or completed as appropriate to return the tank to service in an expeditious manner.

As stated in UFSAR Section 8.5, Emergency Power System, the EDGs are installed to provide an emergency source of power to vital equipment when a normal power source is not available. The accident analysis in UFSAR Section 14.2.12, Loss of Alternating Current Power to the Station Auxiliaries, includes starting of the EDGs on a loss of voltage on the emergency 4160 volt buses to supply vital loads. The Surry accident analyses are not affected by this proposed TS change. The proposed TS change does not impact the availability of the EDGs to perform their required function of auto-starting and load sequencing during an EDG demand event.

PLANT SPECIFIC RISK EVALUATION OF THE PROVISIONS TO PERMIT INSPECTION AND RELATED REPAIR OF A BURIED FUEL OIL STORAGE TANK The proposed change adds provisions to the TSs to permit inspection and related repair of a buried fuel oil storage tank during plant operation.

These provisions include a 7 day allowed outage time (AOT) for a buried fuel oil storage tank. A risk evaluation of the 7 day AOT was performed in accordance with Regulatory Guides 1.174 and 1.177.

The Tier 1 and 2 results are provided below. Tier 3 requirements ensure that the risk impact of out-of-service equipment is evaluated prior to performing any maintenance Page 3 of 12

Attachment I Letter Serial No.02-561 activity. The Tier 3 results are not provided and are controlled in accordance with the Maintenance Rule Program as required by 10CFR50.65(a)(4).

TIER 1: PRA CAPABILITI A'D INSIGHTS DISCUSSION Tier 1 Best Estimate Analysis Discussion The importances of 1-EE-TK-2A and 2B were calculated to provide a perspective on their contribution to the overall model and determine which tank was the most risk significant.

The importance measures calculated for each tank were:

"* Risk Achievement Worth (RAW)

"* Fussell-Vesely (FV)

The tank with the highest RAW and FV importances was identified and assessed in the following calculations specified by Regulatory Guides 1.174 and 1.177:

"* Baseline core damage frequency (CDF) and large early release frequency (LERF)

(with nominal expected equipment unavailabilities, except the subject tank test and maintenance unavailability is set to zero)

"* Conditional CDF and LERF with subject tank unavailable

"* Incremental conditional core damage probability (ICCDP) = (Conditional CDF minus baseline CDF) times duration of proposed AOT

"* Incremental conditional large early release probability (ICLERP) = (Conditional LERF minus baseline LERF) times duration of proposed AOT

"* Yearly AOT CDF and LERF risk (ICCDP and ICLERP times the frequency of AOT use per year)

The findings and observations of the industry peer certification process were reviewed for applicability to this proposed TS change. Most were identified as not applicable; the remaining items were addressed by specific sensitivity calculations summarized in Tables 3, 4, and 5.

Common cause faults of the storage tanks are explicitly addressed in the Table 6 discussion. Common cause faults of the fuel oil transfer pumps were added to the fault trees to ensure that their effect was properly accounted for.

In the baseline CDF and LERF calculations, the nominal test and maintenance tank unavailabilities were set to zero (logical success). This choice conservatively maximizes the risk increase calculation. In the conditional CDF and LERF calculations, the test and maintenance term for the limiting tank was set to logical failure (1.0), and the term for the other tank was set to logical success (zero).

The sensitivity calculations also used truncations smaller than the nominal value of 1E-10 to ensure that subtle effects, which might be amplified by the proposed TS change, would not be missed.

Page 4 of 12 Letter Serial No.02-561 The LERF calculation was performed by updating the basic event data file to reflect the conditional probabilities for each LERF sequence and requantifying the CDF equation file using this modified basic event data file.

Tier 1 Sensitivity Analysis Discussion Sensitivity analyses were performed to ensure that the conclusions of the analysis would not change if parameters potentially affecting the calculation results were changed to reflect the range of uncertainty in those parameters. The figures of merit from the sensitivity analyses were ICCDP/ICLERP values and total increase in CDF/LERF. The sensitivity analyses performed included:

"* All human error recovery events were increased by a factor of 10.

This case addresses findings and observations from the industry peer certification process.

"* The Fuel Oil Transfer Pump (FOTP) failure rates were increased by a factor of 10.

This case addresses the uncertainty in the failure rates of the pumps that draw from the in-service tank.

"* The Loss of Offsite Power initiator frequency was increased by a factor of 10. This case addresses the uncertainty in the reliability of the offsite power system when a tank is unavailable.

Tier 1 Corrective Maintenance Calculation Discussion An additional calculation was performed to evaluate the scenario in which one tank is removed from service for corrective maintenance. In this case, the remaining tank may be at an increased risk of a common cause failure via the same mechanism that disabled the first tank. In this case, the second tank's maintenance unavailability term will be set to an appropriate beta factor to reflect the potential common cause failure mode.

TIER 2: AVOIDANCE OF RISK-SIGNIFICANT PLANT CONFIGURATIONS DISCUSSION Reasonable assurance must be provided that risk-significant plant equipment outage configurations will not occur when a tank is out of service consistent with the proposed TS change. This can be determined by comparing the basic event RAW importances from the best estimate case, where tank 2B is available, to the best estimate case where 2B is unavailable. When a component associated with a basic event RAW greater than 2.0 increases significantly (i.e., more than 10%), the component could potentially contribute to a Tier 2 configuration.

TIER 1: PRA CAPABILITY AND INSIGHTS RESULTS Tier 1 Best Estimate Analysis Results The RAW and FV importances for each of the tanks were calculated for the baseline model. The results of calculation SOAAC300 are provided in Table 1. This calculation demonstrates the low importance of the tanks in the baseline model.

Page 5 of 12 Letter Serial No.02-561 Table I Risk Importances of I-EE-TK-2A/-2B Risk Importance 2A 2B Metric CDF RAW 1.00 1.01 CDF FV 3.80E-5 1.83E-4 LERF RAW 1.00 1.00 LERF FV 1.14E-5 3.64E-5 The 2B tank is most limiting.

The risk calculations prescribed by Regulatory Guides 1.174 and 1.177 were then performed for 1-EE-TK-2B and the results are documented in Table 2.

The instantaneous risk increases for CDF and LERF will be integrated over seven days, and normalized to 365 days per year, to quantify the risk impact of entry into a single AOT. These integrals will be compared to the Regulatory Guide 1.177 limits of 5E-7 for the Incremental Conditional Core Damage Probability (ICCDP), and 5E-8 for the Incremental Conditional Large Early Release Probability (ICLERP) for classification as "small."

The single AOT risk will be doubled, to allow for a theoretical maximum of one AOT per tank per year, for comparison to the Regulatory Guide 1.174 limits of 1E-6 for CDF and 1 E-7 LERF for classification as "very small."

These numbers are the minimum risk classifications for each of the Regulatory Guides.

Table 2 AOT Preventive Maintenance Calculations for 1-EE-TK-2B Core Large Early Damage Release Risk Risk Case SOAAC301 - Baseline 2.969E-5/yr 8.361 E-7/yr 1 EETNK-TM-EETK2A set to logical success (0.0) 1 EETNK-TM-EETK2B set to logical success (0.0)

Case SOAAC302 - Tank 2B unavailable 3.020E-5/yr 8.404E-7/yr I EETNK-TM-EETK2A set to logical success (0.0) 1 EETNK-TM-EETK2B set to logical failure (1.0)

Single AOT risk (based on one 7-day outage every 9.8E-9 8.2E-1 1 year)

RG 1.177 Classification "Small" "Small" Yearly AOT Risk (based on one 7-day outage every 2.OE-8 1.6E-10 year per tank)

RG 1.174 Classification "Very Small" "Very Small" The 1-EE-TK-2N-2B proposed TS change easily meets the Regulatory Guide 1.177 criteria for classification as "small" and the Regulatory Guide 1.174 criteria for classification as "very small."

Page 6 of 12 Letter Serial No.02-561 Tier I Sensitivity Analyses Results Probability of All Post-initiator Human Error Events Increased by a Factor of 10:

In this sensitivity case, the probability of all the post-initiator human error events was increased by a factor of 10, or to a maximum of 1.0, whichever is less. The results of this calculation are provided in Table 3.

Table 3 AOT Preventive Maintenance Calculations for 1-EE-TK-2B Post Initiator Human Error Event Probabilities Increased by a Factor of 10 Core Large Early Damage Release Risk Risk Case SOAAC311 - Baseline 1.288E-3/yr 3.902E-5/yr 1EETNK-TM-EETK2A set to zero (maximizes risk increase) 1EETNK-TM-EETK2B set to zero (maximizes risk increase)

Case SOAAC312 - Tank 2B unavailable 1.297E-3/yr 3.911 E-5/yr 1 EETNK-TM-EETK2A set to logical success (0.0) 1 EETNK-TM-EETK2B set to logical failure (1.0)

Single AOT risk (based on one 7-day outage every 1.7E-7 1.7E-9 year)

RG 1.177 Classification "Small" "Small" Yearly AOT Risk (based on one 7-day outage every 3.5E-7 3.5E-9 year per tank)

RG 1.174 Classification "Very Small" "Very Small" The 1-EE-TK-2A/-2B proposed TS change criteria for classification as "small" and classification as "very small."

easily meets the Regulatory Guide 1.177 the Regulatory Guide 1.174 criteria for Page 7 of 12

Attachment I Letter Serial No.02-561 All FOTP Failure Rates Increased by a Factor of 10:

In this sensitivity case, the failure rates for the FOTPs were all increased by a factor of 10 to address uncertainty in their reliability.

The affected basic events were 1 EEPSB-FS-1 EEPIA(C)(E). The nominal values of the start failure terms for these pumps exceeded the run failure terms by approximately an order of magnitude, so only the former were increased. The results of this calculation are provided in Table 4.

Table 4 AOT Preventive Maintenance Calculations for 1-EE-TK-2B FOTP Failure Rates Increased by a Factor of 10 Case SOAAC321 - Baseline 1EETNK-TM-EETK2A set to zero (maximizes risk increase) 1 EETNK-TM-EETK2B set to zero (maximizes risk increase) 1EEPSB-FS-1EEP1A/B/C/D/E/F = 1.469e-002 (10x nominal value)

Case SOAAC322 - Tank 2B unavailable 1 EETNK-TM-EETK2A set to logical success (0.0) 1 EETNK-TM-EETK2B set to logical failure (1.0) 1EEPSB-FS-1EEPNA/B/C/D/E/F = 1.469e-002 (10x nominal value)

Core Damage Risk t

--.

2.97U0_-b/yr Large Early Release Risk 8.362L-7/yr The l-EE-TK-2A/-2B proposed TS change easily meets the Regulatory Guide 1.177 criteria for classification as "small" and the Regulatory Guide 1.174 criteria for classification as "very small."

Page 8 of 12 Letter Serial No.02-561 Loss of Offsite Power Freqiency Increased by a Factor of 10:

In this sensitivity case, the frequency of the loss of offsite power initiating event was increased by a factor of 10 to address uncertainty in the reliability of the EDG support systems. The affected basic event is IE-TI. The results of this calculation are provided in Table 5.

Table 5 AOT Preventive Maintenance Calculations for 1-EE-TK-2B I OOP Frnmniinrv Increa-sed bv a Factor of 10 Core Large Early Damage Release Risk Risk Case SOAAC331 - Baseline 3.707E-5/yr 8.870E-7/yr 1EETNK-TM-EETK2A set to zero (maximizes risk increase) 1EETNK-TM-EETK2B set to zero (maximizes risk increase)

Case SOAAC332 -Tank 2B unavailable 4.188E-5/yr 9.195E-7/yr 1 EETNK-TM-EETK2A set to logical success (0.0) 1 EETNK-TM-EETK2B set to logical failure (1.0)

Single AOT risk (based on one 7-day outage every 9.2E-8 6.2E-10 year)

RG 1.177 Classification "Small" "Small" Yearly AOT Risk (based on one 7-day outage every 1.8E-7 T1.2E-9 year per tank)

RG 1.174 Classification "Very Small" "Very Small" The 1-EE-TK-2A/2B proposed TS change easily meets the Regulatory Guide 1.177 criteria for classification as "small" and the Regulatory Guide 1.174 criteria for classification as "very small."

Tier 1 Corrective Maintenance Calculation Results Consistent with Regulatory Guide 1.177, an additional case was run with the 2A tank failure rate equal to an appropriate common cause beta factor for the tanks. A specific factor is not listed for these tanks in NUREG/CR-5497; however, a conservatively large value of 0.047 may be used from NUREG/CR-5485, Table 5-11 for a population of two redundant components.

This calculation addresses the situation in which one tank is removed from service for corrective maintenance, and the remaining in-service tank may be at increased risk of a common cause failure. The results of this calculation are provided in Table 6.

Page 9 of 12 Letter Serial No.02-561 Core Large Early Damage Risk Release Risk Case SOAAC301 - Baseline 2.969E-5/yr 8.361 E-7/yr 1 EETNK-TM-EETK2A set to zero (maximizes risk increase) 1 EETNK-TM-EETK2B set to zero (maximizes risk increase)

Case SOAAC342 - Tank 2B unavailable 3.020E-5/yr 8.404E-7/yr 1 EETNK-TM-EETK2A set to 0.047 1 EETNK-TM-EETK2B set to logical failure (1.0)

Single AOT risk (based on one 7-day outage every 9.8E-9 8.2E-1 1 year)

RG 1.177 Classification "Small" "Small" Yearly AOT Risk (based on one 7-day outage every 2.OE-8 1.6E-1 0 year per tank)

RG 1.174 Classification I'Very Small"

" Very Small" The 1-EE-TK-2N-2B proposed TS change easily meets the Regulatory Guide 1.177 criteria for classification as "small" and the Regulatory Guide 1.174 criteria for classification as "very small."

TIER 2: AVOIDANCE OF RISK-SIGNIFICANT PLANT CONFIGURATIONS RESULTS The basic event RAW importances from the best estimate case, where 1-EE-TK-2B is available, were compared to the best estimate case where 1-EE-TK-2B is unavailable.

There are no single components, which are allowed to be out of service concurrent with a tank at power in accordance with the TSs, that would result in a significant change in risk (i.e., increase in RAW greater than 10%). Therefore, there are no Tier 2 issues associated with this change.

RISK EVALUATION

SUMMARY

The risk evaluation supports a 1-EE-TK-2A/-2B TS allowed outage time of 7 days. The increase in annual core damage and large early release frequencies associated with the proposed change in the TS allowed outage time are characterized as "very small changes" by Regulatory Guide 1.174. The incremental conditional core damage and large early release probabilities associated with the proposed TS allowed outage time change are within the acceptance criteria in Regulatory Guide 1.177.

Page 10 of 12 Table 6 AOT Corrective Maintenance Calculations for 1-EE-TK-2B Letter Serial No.02-561 ENVIRONMENTAL ASSESSMENT This TS change request meets the eligibility criteria for categorical exclusion set forth in 10CFR51.22(c)(9) as follows:

(i)

The change involves no significant hazards consideration.

As described above, the proposed change involves no significant hazards consideration.

(ii)

There is no significant change in the types or significant increase in the amounts of any effluents that may be released offsite.

The proposed change does not involve the installation of any new equipment or the modification of any equipment that could affect the types or amounts of effluents that may be released offsite. Therefore, there is no significant change in the types or significant increase in the amounts of any effluents that may be released offsite.

(iii)

There is no significant increase in individual or cumulative occupational radiation exposure.

The proposed change does not involve a physical change to the plant or modify any equipment that could affect occupational radiation exposure. Therefore, there is no significant increase in individual or cumulative occupational radiation exposure.

Based on this assessment, Dominion concludes that the proposed TS change meets the criteria specified in 10CFR51.22 for a categorical exclusion from the requirements of 10CFR 51.22 relative to requiring a specific environmental assessment by the Commission.

CONCLUSION The proposed TS change adds provisions to permit inspection and related repair of a buried fuel oil storage tank during plant operation. The provisions include requirements to verify the availability of onsite and offsite fuel oil sources to ensure that an adequate supply of fuel oil remains available.

The proposed TS change does not alter the assumptions of the accident analyses or the TS Basis. This change does not impact the availability of the EDGs to perform their required function, which is to provide an emergency source of power to vital equipment when a normal power source is not available. As such, no question of safety exists.

In addition, the risk impact of the provisions has been evaluated and determined to be acceptable. Upon NRC approval of this TS change request, the Updated Final Safety Analysis Report will be revised to reflect the provisions to permit inspection and related repair of a buried fuel oil storage tank during plant operation.

Page 11 of 12 Letter Serial No.02-561 This proposed change to TS 3.16 and its Basis have been reviewed by the Station Nuclear Safety and Operating Committee (SNSOC) and the Management Safety Review Committee (MSRC), and it has been concluded that the proposed change is judged to not involve a significant hazards consideration and will not endanger the health and safety of the public.

Page 12 of 12 Mark-up of Technical Specifications Changes Surry Power Station Units I and 2 Virginia Electric and Power Company (Dominion)

TS 3.16-2

4. Two physically independent circuits from the offsite transmission network to energize the 4,160V and 480V emergency buses. One of these sources must be immediately available (i.e. primary source) and the other must be capable of being made available within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> (i.e. dependable alternate source).

5. Two OPERABLE flow paths for providing fuel to each diesel generator.

6. Two station batteries, two chargers, and the DC distribution systems OPERABLE.

7. Emergency diesel generator battery, charger and the DC control circuitry OPERABLE for the unit diesel generator and for the shared back-up diesel generator.

B. During power operation or the return to power from HOT SHUTDOWN, the requirements of specification 3.16-A may be modified by one of the following:

l.a.

With either unit's dedicated diesel generator or shared backup diesel generator unavailable or inoperable:

1.

Verify the operability of two physically independent offsite AC circuits within one hour and at least once per eight hours thereafter.

2.

If the diesel generator became inoperable due to any cause other than preplanned preventive maintenance or testing, demonstrate the operability of the remaining OPERABLE diesel generator daily. For the purpose of operability testing, the second diesel generator may be inoperable for a total of two hours per test provided the two offsite AC circuits have been verified OPERABLE prior to testing.

3.

If this diesel generator is not returned to an OPERABLE status within days, the reactor shall be brought to HOT SHUTDOWN within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

i.b.

One diesel fuel oil flow path may be "inoperable" for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> provided the other flow path is proven OPERABLE. If after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, the inoperable flow path cannot be returned to service the diesel shall be considered "inoperable."'

When the emergency diesel gener tor battery, charger or DC control circuitry is inoperable, the diesel shall be co sidered "inoperable."

%Amendment Nos. -20 and-224-

TS 3.16-3 44)7--99

2. If a primary source is not available, the unit may be operated for seven (7) days provided the dependable alternate source can be OPERABLE within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. If specification A-4 is not satisfied within seven (7) days, the unit shall be brought to COLD SHUTDOWN.

3. One battery may be inoperable for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> provided the other battery and battery chargers remain OPERABLE with one battery charger carrying the DC load of the failed battery's supply system. If the battery is not returned to OPERABLE status within the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> period, the reactor shall be placed in HOT SHUTDOWN. If the battery is not restored to OPERABLE status within an additional 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, the reactor shall be placed in COLD SHUTDOWN.

C:Ser A-I~c._ 4

.%I C. The continuous running electrical load supplied by an emergency diesel generator shall be limited to 2750 KW.

Basis The Emergency Power System is an on-site, independent, automatically starting power source. It supplies power to vital unit auixiliaries if a normal power source is not available. The Emergency Power System consists of three diesel generators for two units. One generator is used exclusively for Unit 1, the second generator for Unit 2, and the third generator functions as a backup for either Unit 1 or 2. The diesel generators have a cumulative 2,000 hour0 days <br />0 hours <br />0 weeks <br />0 months <br /> rating of 2750 KW. The actual loads using conservative Amendment Nos. 22. and-22ft-

INSERT AS TS 3.16.B.4:

4. One buried fuel oil storage tank may be inoperable for 7 days for tank inspection and related repair, provided the following actions are taken:

a. prior to removing the tank from service, verify that 50,000 gallons of replacement fuel oil is available offsite and transportation is available to deliver that volume of fuel oil within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, and

b. prior to removing the tank from service and at least once every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, verify that the remaining buried fuel oil storage tank contains > 17,500 gallons, and

c. prior to removing the tank from service and at least once every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, verify that the above ground fuel oil storage tank contains > 50,000 gallons.

If these conditions are not satisfied or the buried fuel oil storage tank is not returned to OPERABLE status within 7 days, both units shall be placed in HOT SHUTDOWN within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

TS 3.16-6 The day tanks are filled by transferring fuel from any one of two buried tornado missile protected fuel oil storage tanks, each of 20,000 gal capacity. Two of 100 percent capacity fuel oil transfer pumps per diesel generator are powered from the emergency buses to assure that an operating diesel generator has a continuous supply of fuel. The buried fuel oil storage tanks contain a seven (7) day supply of fuel, 35,000 gal minimum. for the full load operation of one diesel generator; in addition, there is an above ground fuel oil storage tank on-site with a capacity of 210,000 gal which is used for transferring fuel to the buried tanks.

S Ci S aZ-r A-A-

Lý'A

,CeAPý a oss o norm power is not acco paie ant accident, the safeguards equipment will not be required. Under this condition the following additional auxiliary equipment may be operated from each emergency bus:

A. One component cooling pump B. One residual heat removal pump C. One motor-driven auxiliary steam generator feedwater pump The emergency buses in each unit are capable of being interconnected under strict administrative procedures so that the equipment which would normally be operated by one of the diesels could be operated by the other diesel, if required.

The electrical power requirements and the emergency power testing requirements for the auxiliary feedwater cross-connect are contained in TS 3.6.B.4.c and TS 4.6 respectively.

Amendment Nos. 220And-222-

INSERT AS SECOND PARAGRAPH IN BASIS ON PAGE TS 3.16-6:

One of the two buried fuel oil storage tanks may be inoperable to permit inspection and related repair of that buried fuel oil storage tank. While one tank is removed from service, the remaining buried fuel oil storage tank supplies fuel oil to the EDGs of both units.

Prior to removal of one buried tank from service and while it is inoperable, verification of the volume in the remaining buried fuel oil storage tank and the above ground fuel oil storage tank is required to ensure an adequate source of fuel oil remains available onsite. In addition, verification of the offsite replacement fuel oil supply is also required. While one buried tank is out of service, the verification of the onsite and offsite fuel oil sources continues to support full load operation of one diesel generator for seven days.

Proposed Technical Specifications Changes Surry Power Station Units 1 and 2 Virginia Electric and Power Company (Dominion)

TABULATION OF CHANGES License No. DPR-32 1 Docket No. 50-280 License No. DPR-37 I Docket No. 50-281 Summary of Changes:

The proposed changes to the Surry Power Station Technical Specifications are being made to add provisions to permit inspection and related repair of a buried fuel oil storage tank during plant operation.

DATED 06-07-99 06-07-99 06-07-99 SUBSTITUTE TS 3.16-2 "TS 3.16-3 "TS 3.16-6 DELETE TS 3.16-2 TS 3.16-3 TS 3.16-6

TS 3.16-2

4. Two physically independent circuits from the offsite transmission network to energize the 4,160V and 480V emergency buses. One of these sources must be immediately available (i.e. primary source) and the other must be capable of being made available within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> (i.e. dependable alternate source).

5. Two OPERABLE flow paths for providing fuel to each diesel generator.

6. Two station batteries, two chargers, and the DC distribution systems OPERABLE.

7. Emergency diesel generator battery, charger and the DC control circuitry OPERABLE for the unit diesel generator and for the shared back-up diesel generator.

B. During power operation or the return to power from HOT SHUTDOWN, the requirements of specification 3.16-A may be modified by one of the following:

L.a.

With either unit's dedicated diesel generator or shared backup diesel generator unavailable or inoperable:

1.

Verify the operability of two physically independent offsite AC circuits within one hour and at least once per eight hours thereafter.

2.

If the diesel generator became inoperable due to any cause other than preplanned preventive maintenance or testing, demonstrate the operability of the remaining OPERABLE diesel generator daily. For the purpose of operability testing, the second diesel generator may be inoperable for a total of two hours per test provided the two offsite AC circuits have been verified OPERABLE prior to testing.

3.

If this diesel generator is not returned to an OPERABLE status within 7 days, the reactor shall be brought to HOT SHUTDOWN within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

1.b.

One diesel fuel oil flow path may be "inoperable" for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> provided the other flow path is proven OPERABLE. If after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, the inoperable flow path cannot be returned to service for reasons other than buried fuel oil storage tank inspection and related repair, the diesel shall be considered "inoperable."

When the emergency diesel generator battery, charger or DC control circuitry is inoperable, the diesel shall be considered "inoperable."

Amendment Nos.

TS 3.16-3

2. If a primary source is not available, the unit may be operated for seven (7) days provided the dependable alternate source can be OPERABLE within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. If specification A-4 is not satisfied within seven (7) days, the unit shall be brought to COLD SHUTDOWN.

3. One battery may be inoperable for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> provided the other battery and battery chargers remain OPERABLE with one battery charger carrying the DC load of the failed battery's supply system. If the battery is not returned to OPERABLE status within the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> period, the reactor shall be placed in HOT SHUTDOWN. If the battery is not restored to OPERABLE status within an additional 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, the reactor shall be placed in COLD SHUTDOWN.

4. One buried fuel oil storage tank may be inoperable for 7 days for tank inspection and related repair, provided the following actions are taken:

a.

prior to removing the tank from service, verify that 50,000 gallons of replacement fuel oil is available offsite and transportation is available to deliver that volume of fuel oil within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, and

b.

prior to removing the tank from service and at least once every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, verify that the remaining buried fuel oil storage tank contains > 17,500 gallons, and

c.

prior to removing the tank from service and at least once every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, verify that the above ground fuel oil storage tank contains > 50,000 gallons.

If these conditions are not satisfied or if the buried fuel oil storage tank is not returned to OPERABLE status within 7 days, both units shall be placed in HOT SHUTDOWN within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

C. The continuous running electrical load supplied by an emergency diesel generator shall be limited to 2750 KW.

Basis The Emergency Power System is an on-site, independent, automatically starting power source. It supplies power to vital unit auxiliaries if a normal power source is not available. The Emergency Power System consists of three diesel generators for two units. One generator is used exclusively for Unit 1, the second generator for Unit 2, and the third generator functions as a backup for either Unit 1 or 2. The diesel generators have a cumulative 2,000 hour0 days <br />0 hours <br />0 weeks <br />0 months <br /> rating of 2750 KW. The actual loads using conservative Amendment Nos.

TS 3.16-6 The day tanks are filled by transferring fuel from any one of two buried tornado missile protected fuel oil storage tanks, each of 20,000 gal capacity. Two of 100 percent capacity fuel oil transfer pumps per diesel generator are powered from the emergency buses to assure that an operating diesel generator has a continuous supply of fuel. The buried fuel oil storage tanks contain a seven (7) day supply of fuel, 35,000 gal minimum, for the full load operation of one diesel generator; in addition, there is an above ground fuel oil storage tank on-site with a capacity of 210,000 gal which is used for transferring fuel to the buried tanks.

One of the two buried fuel oil storage tanks may be inoperable to permit inspection and related repair of that buried fuel oil storage tank. While one tank is removed from service, the remaining buried fuel oil storage tank supplies fuel oil to the EDGs of both units. Prior to removal of one buried tank from service and while it is inoperable, verification of the volume in the remaining buried fuel oil storage tank and the above ground fuel oil storage tank is required to ensure an adequate source of fuel oil remains available onsite. In addition, verification of the offsite replacement fuel oil supply is also required. While one buried tank is out of service, the verification of the onsite and offsite fuel oil sources continues to support full load operation of one diesel generator for seven days.

If a loss of normal power is not accompanied by a loss-of-coolant accident, the safeguards equipment will not be required. Under this condition the following additional auxiliary equipment may be operated from each emergency bus:

A. One component cooling pump B. One residual heat removal pump C. One motor-driven auxiliary steam generator feedwater pump The emergency buses in each unit are capable of being interconnected under strict administrative procedures so that the equipment which would normally be operated by one of the diesels could be operated by the other diesel, if required.

The electrical power requirements and the emergency power testing requirements for the auxiliary feedwater cross-connect are contained in TS 3.6.B.4.c and TS 4.6 respectively.

Amendment Nos.

Evaluation of Significant Hazards Consideration Surry Power Station Units I and 2 Virginia Electric and Power Company (Dominion)

Letter Serial No.02-561 EVALUATION OF SIGNIFICANT HAZARDS CONSIDERATION The proposed change adds provisions to permit inspection and related repair of a buried fuel oil storage tank during plant operation. The provisions include requirements to verify the availability of onsite and offsite fuel oil sources to ensure that an adequate supply of fuel oil remains available.

In accordance with the requirements of 10CFR50.92, the proposed TS change request is judged to involve no significant hazards consideration based upon the following information:

1. Does the proposed license amendment involve a significant increase in the probability or consequences of an accident previously evaluated?

This proposed TS change does not alter the assumptions of the accident analyses or the TS Basis. The inclusion of provisions to permit inspection and related repair of a buried fuel oil storage tank during plant operation does not impact the availability of the EDGs to perform their required function, which is to provide an emergency source of power to vital equipment when a normal power source is not available. Furthermore, while a buried tank is out of service, the proposed change includes requirements to verify the availability of onsite and offsite fuel oil sources to ensure that an adequate supply of fuel oil remains available.

Therefore, the proposed change does not result in a significant increase in either the probability or consequences of an accident previously evaluated.

2. Does the proposed license amendment create the possibility of a new or different kind of accident from any accident previously evaluated?

This proposed TS change does not involve a physical change to the plant, nor does it alter the assumptions of the accident analyses. Inclusion of provisions to permit inspection and related repair of a buried fuel oil storage tank does not introduce any new failure modes. Therefore, the proposed change does not create the possibility of a new or different kind of accident from those previously evaluated.

3. Does the proposed amendment involve a significant reduction in a margin of safety?

This proposed TS change alters the method of operation of the Fuel Oil System.

However, the availability of the EDGs to perform their required function is not impacted, and the assumptions of the accident analyses are not altered.

Furthermore, a plant specific risk evaluation of the acceptability of the provisions was performed. The risk evaluation' concluded that the risk impact is acceptable (i.e., is characterized as "very small" by Regulatory Guide 1.174 criteria and is within the acceptance criteria of Regulatory Guide 1.177). Therefore, the proposed change does not significantly reduce the margin of safety.

Page 1 of I