Text

License Amendment Request to Extend the Completion Time for an Inoperable Low Pressure Injection Train Form 72 Hours to 7 Days; Technical Specification Change Number 2001-005
	ML023110076
Person / Time
Site:	Oconee
Issue date:	10/24/2002
From:	Mccollum W; Duke Energy Corp
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	-nr
	Download: ML023110076 (70)
	v • d • e

SDuke Duke Energy Energy. Oconee Nuclear Station 7800 Rochester Highway Seneca, SC 29672 W. R. McCollum, Jr. (864) 885-3107 OFFICE Vice President (864) 885-3564FAX October 24, 2002 U. S. Nuclear Regulatory Commission Document Control Desk Washington, D. C. 20555

Subject:

Oconee Nuclear Station, Units 1, 2, and 3 Docket Numbers 50-269, 50-270, and 50-287 License Amendment Request to Extend the Completion Time for an Inoperable Low Pressure Injection Train from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 7 days; Technical Specification Change Number 2001-005 Pursuant to 10 CFR 50.90, Duke Energy Corporation (Duke) proposes to amend the Oconee Nuclear Station (ONS) Technical Specifications (TS). This License Amendment Request (LAR) proposes to change the completion time for an inoperable train of LPI from 72-hours to 7 days.

The proposed changes to the ONS TS are based on the Babcock & Wilcox Owners Group Topical Report BAW-2295A, Revision 1, "Justification for the extension of Allowed Outage Time for Low Pressure Injection and Reactor Building Spray Systems,"

that was submitted to the NRC on October 9, 1998. The Topical Report evaluated and addressed ONS as well as the other B&W plants. In the NRC's Safety Evaluation Report, the staff evaluated and concluded that the proposed completion time increase was acceptable as long as several contingencies were satisfied. These contingencies are addressed in this submittal.

This risk informed LAR submittal provides a method for obtaining a NRC review and approval of the proposed revision to the current Technical Specification. Overall, the ONS Topical Report results showed the risk significance from extending the Completion Time for an inoperable train of Low Pressure Injection from 72-hours to 7 days was small and within the NRC's Regulatory Guide 1.174 and 1.177 acceptance criteria.

The submittal contains the following attachments: provides the retyped TS pages. provides a mark-up of the applicable TS pages. provides a risk based technical discussion of changes to the TS.

Nuclear Regulatory Commission License Amendment Request No. 2001-005 October 24, 2002 Page 2 documents the determination that the amendment contains No Significant Hazards Consideration pursuant to 10 CFR 50.92. provides the basis for the categorical exclusion form performing an Environmental assessment/Impact Statement pursuant to 10 CFR 51.22 (c) (9).

In accordance with Duke administrative procedures and the Quality Assurance Program Topical Report, this proposed change to the UFSAR has been reviewed and approved by the Plant Operations Review Committee and Nuclear Safety Review Board.

Additionally, a copy of this proposed amendment is being sent to the State of South Carolina in accordance with 10 CFR 50.91 requirements.

The four compensatory measures discussed in this LAR will be put in-place prior to implementing this revision to the TS. This is a regulatory commitment.

Duke requests that the review of this submittal be completed by June 2, 2003. Inquiries on this proposed amendment request should be directed to Stephen C. Newman of the Oconee Regulatory Compliance Group at (864) 885-4388.

Very truly yours, W. R. McCollum, Jr., V resident Oconee Nuclear Sit

I Nuclear Regulatory Commission License Amendment Request No. 2001-005 October 24, 2002 Page 3 cc: Mr. L. N. Olshan, Project Manager Office of Nuclear Reactor Regulation U. S. Nuclear Regulatory Commission Washington, D. C. 20555 Mr. L. A. Reyes, Regional Administrator U. S. Nuclear Regulatory Commission - Region II Atlanta Federal Center 61 Forsyth St., SW, Suite 23T85 Atlanta, Georgia 30303 Mr. M. C. Shannon Senior Resident Inspector Oconee Nuclear Station Mr. Virgil R. Autry, Director Division of Radioactive Waste Management Bureau of Land and Waste Management Department of Health & Environmental Control 2600 Bull Street Columbia, SC 29201

Nuclear Regulatory Commission License Amendment Request No. 2001-005 October 24, 2002 Page 4 W. R. McCollum, Jr., being duly sworn, states that he is Vice President, Oconee Nuclear Site, Duke Energy Corporation, that he is authorized on the part of said Company to sign and file with the U. S. Nuclear Regulatory Commission this revision to the Facility Operating License No. SNM-2503 and that all the statements and matters set forth herein are true and correct to the best of his knowledge.

W. R. McCollum, Jr., Vice;Pr066n Oconee Nuclear Site Subscribed and sworn to before me thisc. day of e 2002 Notary Public A* MyCommission Expires:

. I -y. -

ATTACHMENT 1 REPRINTED TECHNICAL SPECIFICATION AND BASES PAGES AND UPDATE INSTRUCTIONS Remove Pages Replace with Pages 3.5.3-1 3.5.3-1 B 3.5.2-1 B 3.5.2-1 B 3.5.2-2 B 3.5.2-2 B 3.5.2-3 B 3.5.2-3 B 3.5.2-4 B 3.5.2-4 B 3.5.2-5 B 3.5.2-5 B 3.5.2-6 B 3.5.2-6 B 3.5.2-7 B 3.5.2-7 B 3.5.2-8 B 3.5.2-8 B 3.5.2-9 B 3.5.2-9 B 3.5.2-10 B 3.5.2-10 B 3.5.2-11 B 3.5.2-11 B 3.5.2-12 B 3.5.2-12 B 3.5.2-13 B 3.5.2-13 B 3.5.2-14 B 3.5.2-14 B 3.5.3-1 B 3.5.3-1 B 3.5.3-2 B 3.5.3-2 B 3.5.3-3 B 3.5.3-3 B 3.5.3-4 B 3.5.3-4 B 3.5.3-5 B 3.5.3-5 B 3.5.3-6 B 3.5.3-6 B 3.5.3-7 B 3.5.3-7 B 3.5.3-8 B 3.5.3-8 B 3.5.3-9 B 3.5.3-9

LPI 3.5.3 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 3.5.3 Low Pressure Injection (LPI)

LCO 3.5.3 Two LPI trains shall be OPERABLE.

- ....... ........ ....... K IN

1. Only one LPI train is required to be OPERABLE in MODE 4.

2. In MODE 4, an LPI train may be considered OPERABLE during alignment, when aligned or when operating for decay heat removal (DHR) if capable of being manually realigned to the LPI mode of operation.

3. In MODES 1, 2, and 3, the LPI discharge header crossover valves shall be manually OPERABLE to open.

APPLICABILITY: MODES 1,2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One LPI train inoperable in MODE 1, 2, or 3.

A.1 Restore LPI train to OPERABLE status.

7 days I

B. One or more LPI B.1 Restore LPI discharge 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months discharge header header crossover crossover valve(s) valve(s) to OPERABLE manually inoperable to status.

open in MODE 1, 2, or3.

C. Required Action and C.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time of Condition A AND or B not met.

C.2 Be in MODE 4. 60 hours6.944444e-4 days 0.0167 hours 9.920635e-5 weeks 2.283e-5 months (continued)

OCONEE UNITS 1,2, & 3 3.5.3-1 Amendment Nos.

HPI B 3.5.2 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.2 High Pressure Injection (HPI)

BASES BACKGROUND The function of the ECCS is to provide core cooling to ensure that the reactor core is protected after any of the following accidents:

a. Loss of coolant accident (LOCA);

b. Rod ejection accident (REA);

c. Steam generator tube rupture (SGTR); and

d. Main steam line break (MSLB).

There are two phases of ECCS operation: injection and recirculation. In the injection phase, all injection is initially added to the Reactor Coolant System (RCS) via the cold legs or Core Flood Tank (CFT) lines to the reactor vessel. After the borated water storage tank (BWST) has been depleted, the recirculation phase is entered as the suction is transferred to the reactor building sump.

The HPI System consists of two independent trains, each of which splits to discharge into two RCS cold legs, so that there are a total of four HPI injection lines. Each train takes suction from the BWST, and has an automatic suction valve and discharge valve which open upon receipt of an Engineered Safeguards Protective System (ESPS) signal. The two HPI trains are designed and aligned such that they are not both susceptible to any single active failure including the failure of any power operating component to operate or any single failure of electrical equipment. The HPI System is not required to withstand passive failures.

There are three ESPS actuated HPI pumps; the discharge flow paths for two of the pumps are normally aligned to automatically support HPI train "A" and the discharge flow path for the third pump is normally aligned to automatically support HPI train "B." The discharge flow paths can be manually aligned such that each of the HPI pumps can provide flow to either train. At least one pump is normally running to provide RCS makeup and seal injection to the reactor coolant pumps. Suction header cross connect valves are normally open; cross-connecting the HPI suction OCONEE UNITS 1,2, & 3 B 3.5.2-1 Amendment Nos. I

HPI B 3.5.2 BASES BACKGROUND headers during normal operation was approved by the NRC in (continued) Reference 6. The discharge crossover valves (HP-409 and HP-41 0) are normally closed; these valves can be used to bypass the normal discharge valves and assure the ability to feed either train's injection lines via HPI pump "B." For each discharge valve and discharge crossover valve, a safety grade flow indicator is provided to enable the operator to throttle flow during an accident to assure that runout limits are not exceeded.

A suction header supplies water from the BWST or the reactor building sump (via the LPI-HPI flow path) to the HPI pumps. HPI discharges into each of the four RCS cold legs between the reactor coolant pump and the reactor vessel. There is one flow limiting orifice in each of the four injection headers that connect to the RCS cold legs. Ifa pipe break were to occur in an HPI line between the last check valve and the RCS, the orifice in the broken line would limit the HPI flow lost through the break and maximize the flow supplied to the reactor vessel via the other line supplied by the HPI header.

The HPI pumps are capable of discharging to the RCS at an RCS pressure above the opening setpoint of the pressurizer safety valves. The HPI pumps cannot take suction directly from the sump. Ifthe BWST is emptied and HPI is still needed, a cross-connect from the discharge side of the LPI pump to the suction of the HPI pumps would be opened. This is known as "piggy backing" HPI to LPI and enables continued HPI to the RCS.

The HPI System also functions to supply borated water to the reactor core following increased heat removal events, such as MSLBs.

The HPI and LPI (LCO 3.5.3, "Low Pressure Injection (LPI)") components, along with the passive CFTs and the BWST covered in LCO 3.5.1, "Core Flood Tanks (CFTs)," and LCO 3.5.4, "Borated Water Storage Tank (BWST)," provide the cooling water necessary to meet 10 CFR 50.46 (Ref. 1).

APPLICABLE The LCO helps to ensure that the following acceptance criteria for the SAFETY ANALYSES ECCS, established by 10 CFR 50.46 (Ref. 1), will be met following a LOCA;

a. Maximum fuel element cladding temperature is < 2200°F;

b. Maximum cladding oxidation is < 0.17 times the total cladding thickness before oxidation; OCONEE UNITS 1,2, & 3 B 3.5.2-2 Amendment Nos. I

HPI B 3.5.2 BASES APPLICABLE c. Maximum hydrogen generation from a zirconium water reaction is SAFETY ANALYSES

0.01 times the hypothetical amount generated if all of the metal in (continued) the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react;

d. Core is maintained in a coolable geometry; and

e. Adequate long term cooling capability is maintained.

The HPI System is credited in the small break LOCA analysis (Ref. 2).

This analysis establishes the minimum required flow and discharge head requirements at the design point for the HPI pumps, as well as the minimum required response time for their actuation. The SGTR and MSLB analyses also credit the HPI pumps, but these events are bounded by the small break LOCA analyses with respect to the performance requirements for the HPI System. The HPI System is not credited for mitigation of a large break LOCA.

During a small break LOCA, the HPI System supplies makeup water to the reactor vessel via the RCS cold legs. The HPI System is actuated upon receipt of an ESPS signal. If offsite power is available, the safeguard loads start immediately. If offsite power is not available, the Engineered Safeguards (ES) buses are connected to the Keowee Hydro Units. The time delay associated with Keowee Hydro Unit startup, HPI valve opening, and pump starting determines the time required before pumped flow is available to the core following a LOCA.

One HPI train provides sufficient flow to mitigate most small break LOCAs.

However, for cold leg breaks located on the discharge of the reactor coolant pumps, some HPI injection will be lost out the break; for this case, two HPI trains are required. Thus, three HPI pumps must be OPERABLE to ensure adequate cooling in response to the design basis RCP discharge small break LOCA. Additionally, in the event one HPI train fails to automatically actuate due to a single failure (e.g., failure of HPI pump "C" or HP-26), operator actions from the Control Room are required to cross connect the HPI discharge headers within 10 minutes in order to provide HPI flow through a second HPI train (Ref. 6).

Hydraulic separation of the HPI discharge headers is required during normal operation to maintain defense-in-depth (i.e., independence of the HPI discharge headers). Additionally, hydraulic separation of the HPI discharge headers ensures that a complete loss of HPI would not occur in the event an accident were to occur with only two of the three HPI pumps OCONEE UNITS 1,2, & 3 B 3.5.2-3 Amendment Nos. I

HPI B 3.5.2 BASES APPLICABLE OPERABLE coincident with the HPI discharge headers cross-connected.

SAFETY ANALYSES A single active failure of an HPI pump would leave only one HPI pump to (continued) mitigate the accident. The remaining HPI pump could experience runout conditions and could fail prior to operator action to throttle flow or start another pump.

Hydraulic separation on the suction side of the HPI pumps could cause a loss of redundancy. With any one of the normally open suction header cross-connect valves closed, a failure of an automatic suction valve to open during an accident could cause two pumps to lose suction. Thus, the suction header cross-connect valves must remain open.

The safety analyses show that the HPI pump(s) will deliver sufficient water for a small break LOCA and provide sufficient boron to maintain the core subcritical.

The HPI System satisfies Criterion 3 of 10 CFR 50.36 (Ref. 3).

LCO In MODES 1 and 2, and MODE 3 with RCS temperature > 350 0 F, the HPI System is required to be OPERABLE with:

a. Two HPI trains OPERABLE;

b. An additional HPI pump OPERABLE;

c. Two LPI-HPI flow paths OPERABLE;

d. Two HPI discharge crossover valves OPERABLE;

e. HPI suction headers cross-connected; and

f. HPI discharge headers separated.

The LCO establishes the minimum conditions required to ensure that the HPI System delivers sufficient water to mitigate a small break LOCA.

Additionally, individual components within the HPI trains may be called upon to mitigate the consequences of other transients and accidents.

Each HPI train includes the piping, instruments, pump, valves, and controls to ensure an OPERABLE flow path capable of taking suction from the BWST and injecting into the RCS cold legs upon an ESPS signal. For an HPI train to be OPERABLE, the associated HPI pump must be capable of OCONEE UNITS 1,2, & 3 B 3.5.2-4 Amendment Nos. I

HPI B 3.5.2 BASES LCO taking suction from the BWST through the suction header valve associated (continued) with that train upon an ESPS signal. For example:

1) if HPI pump "B" is being credited as part of HPI train "A," then it must be capable of taking suction through HP-24 upon an ESPS signal; or

2) if HPI pump "B" is being credited as part of HPI train "B," then it must be capable of taking suction through HP-25 upon an ESPS signal.

The safety grade flow indicator associated with the normal discharge valve is required to be OPERABLE to support the associated HPI train's automatic OPERABILITY.

To support HPI pump OPERABILITY, the piping, valves and controls which ensure the HPI pump can take suction from the BWST upon an ESPS signal are required to be OPERABLE.

To support HPI discharge crossover valve OPERABILITY, the safety grade flow indicator associated with the HPI discharge crossover valve is required to be OPERABLE.

Each LPI-HPI flow path includes the piping, instruments, valves and controls to ensure the capability to manually transfer suction to the reactor building sump (LPI-HPI flow path). Within the LPI-HPI flow path are the LPI discharge valves to the LPI-HPI flow path (LP-15 and LP-16). The LPI discharge valves to the LPI-HPI flow path must be capable of being manually (locally and remotely) opened for the LPI-HPI flow path to be OPERABLE. The OPERABILITY requirements regarding the LPI System are addressed in LCO 3.5.3, "Low Pressure Injection (LPI)."

As part of the LPI-HPI flow path, the piping, instruments, valves and controls upstream of LP-1 5 and LP-1 6 are part of the LPI system and are subject to LCO 3.5.3 (Low Pressure Injection system) requirements. The piping, instruments, valves and controls downstream of and including LP 15 and LP-1 6, are part of the HPI system and are subject to LCO 3.5.2 (High Pressure Injection system) requirements.

During an event requiring HPI actuation, a flow path is provided to ensure an abundant supply of water from the BWST to the RCS via the HPI pumps and their respective discharge flow paths to each of the four cold leg injection nozzles and the reactor vessel. In the recirculation phase, this flow path is manually transferred to take its supply from the reactor building sump and to supply borated water to the RCS via the LPI-HPI flow path (piggy-back mode).

OCONEE UNITS 1,2, & 3 B 3.5.2-5 Amendment Nos. I

HPI B 3.5.2 BASES LCO The OPERABILITY of the HPI System must be maintained to ensure that (continued) no single active failure can disable both HPI trains. Additionally, while the HPI System was not designed to cope with passive failures, the HPI trains must be maintained independent to the extent possible during normal operation. The NRC approved exception to this principle is cross connecting the HPI suction headers during normal operation (Ref. 6).

APPLICABILITY In MODES 1 and 2, and MODE 3 with RCS temperature > 3500 F, the HPI System OPERABILITY requirements for the small break LOCA are based on analysis performed at 100% RTP. The HPI pump performance is based on the small break LOCA, which establishes the pump performance curve.

Mode 2 and MODE 3 with RCS temperature > 350°F requirements are bounded by the MODE 1 analysis.

In MODE 3 with RCS temperature < 350°F and in MODE 4, the probability of an event requiring HPI actuation is significantly lessened. In this operating condition, the low probability of an event requiring HPI actuation and the LCO 3.5.3 requirements for the LPI System provide reasonable assurance that the safety injection function is preserved.

In MODES 5 and 6, unit conditions are such that the probability of an event requiring HPI injection is extremely low. Core cooling requirements in MODE 5 are addressed by LCO 3.4.7, "RCS Loops - MODE 5, Loops Filled," and LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled."

MODE 6 core cooling requirements are addressed by LCO 3.9.4, "Decay Heat Removal (DHR) and Coolant Circulation - High Water Level," and LCO 3.9.5, "Decay Heat Removal (DHR) and Coolant Circulation - Low Water Level."

ACTIONS A.1 and A.2 With one HPI pump inoperable, or one or more HPI discharge crossover valve(s) (i.e., HP-409 and HP-410) inoperable, the HPI pump and discharge crossover valve(s) must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The HPI System continues to be capable of mitigating an accident, barring a single failure. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based on NRC recommendations (Ref. 4) that are based on a risk evaluation and is a reasonable time for many repairs.

In the event HPI pump "C" becomes inoperable, Condition C must be entered as well as Condition A. Until actions are taken to align an HPI pump to HPI train "B," HPI train "B" is inoperable due to the inability to automatically provide injection in response to an ESPS signal. Additionally, in order to utilize another HPI pump to supply HPI train "B," HP-1 16 must be opened. This action results in cross-connecting the HPI discharge OCONEE UNITS 1,2, & 3 B 3.5.2-6 Amendment Nos. I

HPI B 3.5.2 BASES ACTIONS A.1 and A.2 (continued) headers; thus, Condition E must be entered. The HPI discharge headers cannot be separated in this situation, because it would require HPI pumps "A" and "B" to operate with flows less than the minimum requirements.

This Condition permits multiple components of the HPI System to be inoperable concurrently. When this occurs, other Conditions may also apply. For example, if HPI pump "C" and HP-409 are inoperable coincidentally, HPI train "B" is incapable of being automatically actuated or manually aligned from the Control Room. Thus, Required Action C.1 would apply.

B.1, B.2, B.3, and B.4 If the Required Action and associated Completion Time of Condition A is not met, THERMAL POWER of the unit must be reduced to <75% RTP within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time is reasonable, based on operating experience, to reach the required unit condition from full power conditions in an orderly manner and without challenging unit systems. This time is less restrictive than the Completion Time for Required Action C.1, because the HPI System remains capable of performing its function, barring a single failure.

Two HPI trains are required to mitigate specific small break LOCAs, if no credit for enhanced steam generator cooling is assumed in the accident analysis. However, if equipment not qualified as QA-1 (i.e., an atmospheric dump valve (ADV) flow path for a steam generator) is credited for enhanced steam generator cooling, the safety analyses have determined that the capacity of one HPI train is sufficient to mitigate a small break LOCA on the discharge of the reactor coolant pumps if reactor power is

_<75% RTP.

Required Actions B.2, B.3, and B.4 modify the HPI pump and discharge crossover valve OPERABILITY requirements to permit reduced requirements at power levels *75% RTP for an extended period of time.

Required Action B.2 provides a compensatory measure to verify by administrative means that the ADV flow path for each steam generator is OPERABLE within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . This compensatory measure provides additional assurance regarding the ability of the plant to mitigate an accident. Compliance with this requirement can be established by ensuring that the ADV flow path for each steam generator is OPERABLE in accordance with LCO 3.7.4, "Atmospheric Dump Valve (ADV) Flow Paths."

Required Actions B.3 and B.4 require that the HPI pump and discharge crossover valve(s) be restored to OPERABLE status within 30 days from initial entry into Condition A. The 30-day time period limits the time that the OCONEE UNITS 1, 2, & 3 B 3.5.2-7 Amendment Nos. I

HPI B 3.5.2 BASES ACTIONS B.1, B.2, B.3, and B.4 (continued) plant can operate while relying on non QA-1 ADVs to provide enhanced steam generator cooling to mitigate small break LOCAs. The 30-day time period is acceptable, because:

1. Without crediting an ADV flow path, the HPI System remains capable of performing the safety function, barring a single failure;

2. If credit is taken for an ADV flow path for a steam generator, the safety analysis has demonstrated that only one HPI train is required to mitigate the consequences of a small break LOCA when THERMAL POWER is <75% RTP. Thus, for this case, the HPI System would be capable of performing its safety function even with an additional single failure;

3. OPERABILITY of the ADV flow path for each steam generator is required to be confirmed by Required Action B.2 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

Additional defense-in-depth is provided, because the ADV flow path for only one steam generator is required to mitigate the small break LOCA; and

4. A risk-informed assessment (Ref. 7) concluded that operating the plant in accordance with these Required Actions is acceptable.

C.1, C.2, and C.3 If the plant is operating with THERMAL POWER > 75% RTP, two HPI pumps capable of providing flow through two HPI trains are required. One HPI train is required to provide flow automatically upon receipt of an ESPS signal, while flow through the other HPI train must be capable of being established from the Control Room within 10 minutes. Thus, if the plant is operating at > 75% RTP, and one HPI train is inoperable and incapable of being automatically actuated or manually aligned from the Control Room to provide flow post-accident, the HPI System would be incapable of performing its safety function. For this Condition, Required Action C.1 requires the power to be reduced to *75% RTP within 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months . Required Action C.1 is modified by a Note which limits its applicability to the condition defined above. The 3 hour3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months Completion Time is considered reasonable to reduce the unit from full power conditions to *75% RTP in an orderly manner and without challenging unit systems. The time frame is more restrictive than the Completion Time provided in Required Action B.1 for the same action, because the condition involves a loss of safety function.

OCONEE UNITS 1,2, & 3 B 3.5.2-8 Amendment Nos. I

HPI B 3.5.2 BASES ACTIONS C.1, C.2, and C.3 (continued)

Ifthe plant is operating with THERMAL POWER > 75% RTP and the inoperable HPI train can be automatically actuated or manually aligned to provide flow post-accident, Required Action C.3 permits 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to restore the HPI train to an OPERABLE status.

If enhanced steam generator cooling is not credited in the accident analysis, two HPI trains are required to mitigate specific small break LOCAs with THERMAL POWER <75% RTP. However, if equipment not qualified as QA-1 (i.e., an ADV flow path for a steam generator) is credited for enhanced steam generator cooling, the safety analyses have determined that the capacity of one HPI train is sufficient to mitigate a small break LOCA on the discharge of the reactor coolant pumps if THERMAL POWER is

75% RTP. In order to permit an HPI train to be inoperable regardless of the reason when THERMAL POWER is *75% RTP, Required Action C.2 provides a compensatory measure to verify by administrative means that the ADV flow path for each steam generator is OPERABLE within 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months . This Required Action is modified by a Note which states that it is only required if THERMAL POWER is < 75% RTP.

This compensatory measure provides assurance regarding the ability of the plant to mitigate an accident while in the Condition and THERMAL POWER 5 75% RTP. Compliance with this requirement can be established by ensuring that the ADV flow path for each steam generator is OPERABLE in accordance with LCO 3.7.4, "Atmospheric Dump Valve (ADV) Flow Paths."

With one HPI train inoperable, the inoperable HPI train must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This action is appropriate because:

1. With THERMAL POWER <75% RTP, the safety analysis demonstrates that only one HPI train is required to mitigate the consequences of a small break LOCA assuming credit is taken for the ADV flow path for one steam generator. The OPERABILITY of the ADV flow path for each steam generator is confirmed by Required Action C.2 within 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months . This provides additional defense-in-depth. Additionally, a risk-informed assessment (Ref. 7) concluded that operating the plant in accordance with this Required Action is acceptable.

2. With THERMAL POWER > 75% RTP, the remaining OPERABLE HPI train is capable of automatic actuation, and the inoperable train can be manually aligned by operator action to cross-connect the discharge headers of the HPI trains. This manual action was approved by the NRC in Reference 6.

OCONEE UNITS 1,2, & 3 B 3.5.2-9 Amendment Nos. I

HPI B 3.5.2 BASES ACTIONS D.1 (continued)

With the HPI suction headers not cross-connected, the HPI suction headers must be cross-connected within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The HPI System continues to be capable of mitigating an accident, barring a single failure.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based on NRC recommendations (Ref. 4) that are based on a risk evaluation and is a reasonable time for many repairs.

An argument similar to that utilized for Required Actions B.2, B.3, and B.4 could have been made for operating the HPI System with the suction headers not cross-connected for an extended period of time. However, this action was not considered prudent, due to the potential of damaging two HPI pumps in the event HP-24 or HP-25 failed to open in response to an ESPS signal while the HPI suction headers were not cross-connected.

E.1 With the HPI discharge headers cross-connected, the independence of the HPI trains is not being maintained to the extent practical (i.e., defense-in depth principle is not met). Thus, the HPI discharge headers must be hydraulically separated within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This action limits the time period that the HPI discharge headers may be cross-connected. The 72-hour allowed outage time is acceptable, because cross-connecting the HPI discharge headers in conjunction with:

1. the rest of the HPI System being OPERABLE would not result in the inability of the HPI System to perform its safety function even assuming a single active failure; and

2. an HPI pump being inoperable would not result in the inability of the HPI System to perform its safety function, barring a single failure.

However, in this condition, a single active failure of one of the two remaining OPERABLE HPI pumps could result in the remaining HPI pump failing due to runout.

F._1 With one LPI-HPI flow path inoperable, the inoperable LPI-HPI flow path must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The HPI System continues to be capable of mitigating an accident, barring a single failure.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is justified because there is a limited range of break sizes, and therefore a lower probability for a small break LOCA which would require piggy back operation.

OCONEE UNITS 1,2, & 3 B 3.5.2-10 Amendment Nos. I

HPI B 3.5.2 BASES ACTIONS G.1 and G.2 (continued)

If a Required Action and associated Completion Time of Condition B, C, D, E, or F are not met, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and the RCS temperature reduced to < 350°F within 60 hours6.944444e-4 days 0.0167 hours 9.920635e-5 weeks 2.283e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

H.1 If two HPI trains are inoperable or two LPI-HPI flow paths are inoperable, the HPI System is incapable of performing its safety function and in a condition not explicitly addressed in the Actions for ITS 3.5.2. Thus, immediate plant shutdown in accordance with LCO 3.0.3 is required.

SURVEILLANCE SR 3.5.2.1 REQUIREMENTS Verifying the correct alignment for manual and non-automatic power operated valves in the HPI flow paths provides assurance that the proper flow paths will exist for HPI operation. This SR does apply to the HPI suction header cross-connect valves, the HPI discharge cross-connect valves, the HPI discharge crossover valves, and the LPI-HPI flow path discharge valves (LP-1 5 and LP-1 6). This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, or securing. Similarly, this SR does not apply to automatic valves since automatic valves actuate to their required position upon an accident signal.

This Surveillance does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. The 31 day Frequency is appropriate because the valves are operated under administrative control. This Frequency has been shown to be acceptable through operating experience.

SR 3.5.2.2 With the exception of the HPI pump operating to provide normal makeup, the other two HPI pumps are normally in a standby, non-operating mode.

As such, the emergency injection flow path piping has the potential to develop voids and pockets of entrained gases. Venting the HPI pump casings periodically reduces the potential that such voids and pockets of OCONEE UNITS 1,2, & 3 B 3.5.2-11 Amendment Nos. I

HPI B 3.5.2 BASES SURVEILLANCE SR 3.5.2.2 (continued)

REQUIREMENTS entrained gases can adversely affect operation of the HPI System. This will also reduce the potential for water hammer, pump cavitation, and pumping of noncondensible gas (e.g., air, nitrogen, or hydrogen) into the reactor vessel following an ESPS signal. This Surveillance is modified by a Note that indicates it is not applicable to operating HPI pump(s) providing normal makeup. The 31 day Frequency takes into consideration the gradual nature of gas accumulation in the HPI piping and the existence of procedural controls governing system operation.

SR 3.5.2.3 Periodic surveillance testing of HPI pumps to detect gross degradation caused by impeller structural damage or other hydraulic component problems is required by Section XI of the ASME Code (Ref. 5). SRs are specified in the Inservice Testing Program, which encompasses Section Xl of the ASME Code.

SR 3.5.2.4 and SR 3.5.2.5 These SRs demonstrate that each automatic HPI valve actuates to the required position on an actual or simulated ESPS signal and that each HPI pump starts on receipt of an actual or simulated ESPS signal. This SR is not required for valves that are locked, sealed, or otherwise secured in position under administrative controls. The test will be considered satisfactory if control board indication verifies that all components have responded to the ESPS actuation signal properly (all appropriate ESPS actuated pump breakers have opened or closed and all ESPS actuated valves have completed their travel). The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. The 18 month Frequency is also acceptable based on consideration of the design reliability (and confirming operating experience) of the equipment. The actuation logic is tested as part of the ESPS testing, and equipment performance is monitored as part of the Inservice Testing Program.

OCONEE UNITS 1,2, & 3 B 3.5.2-12 Amendment Nos. I

HPI B 3.5.2 BASES SURVEILLANCE SR 3.5.2.6 REQUIREMENTS (continued) Periodic inspections of the reactor building sump suction inlet (for LPI-HPI flow path) ensure that it is unrestricted and stays in proper operating condition. The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage, on the need to preserve access to the location, and on the potential for an unplanned transient if the Surveillance were performed with the reactor at power. This Frequency has been found to be sufficient to detect abnormal degradation and has been confirmed by operating experience.

SR 3.5.2.7 Periodic stroke testing of the HPI discharge crossover valves (HP-409 and HP-41 0) and LPI-HPI flow path discharge valves (LP-1 5 and LP-1 6) is required to ensure that the valves can be manually cycled. The HPI discharge crossover valves must be capable of being stroked from the Control Room. The LPI-HPI flow path discharge valves must be capable of being stroked locally. This test is performed on an 18 month Frequency.

Operating experience has shown that these components usually pass the surveillance when performed at this Frequency. Therefore, the Frequency is acceptable from a reliability standpoint.

REFERENCES 1. 10 CFR 50.46.

2. UFSAR, Section 15.14.3.3.6.

3. 10 CFR 50.36.

4. NRC Memorandum to V. Stello, Jr., from R.L. Baer, "Recommended Interim Revisions to LCOs for ECCS Components," December 1, 1975.

5. ASME, Boiler and Pressure Vessel Code, Section Xl, Inservice Inspection, Article IWV-3400.

6. Letter from R. W. Reid (NRC) to W. 0. Parker, Jr. (Duke) transmitting Safety Evaluation for Oconee Nuclear Station, Units Nos. 1, 2, and 3, Modifications to the High Pressure Injection System, dated December 13, 1978.

OCONEE UNITS 1,2, & 3 B 3.5.2-13 Amendment Nos. I

HPI B 3.5.2 BASES REFERENCES 7. Letter from W. R. McCollum (Duke) to the U. S. NRC, "Proposed (continued) Amendment to the Facility Operating License Regarding the High Pressure Injection System Requirements," dated December 16, 1998.

OCONEE UNITS 1, 2, & 3 B 3.5.2-14 Amendment Nos. I

LPI B 3.5.3 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.3 Low Pressure Injection (LPI)

BASES BACKGROUND The function of the ECCS is to provide core cooling to ensure that the reactor core is protected after any of the following accidents:

a. Loss of coolant accident (LOCA);

b. Rod ejection accident (REA);

c. Steam generator tube rupture (SGTR); and

d. Main steam line break (MSLB).

There are two phases of ECCS operation: injection and recirculation. In the injection phase, all injection is initially added to the Reactor Coolant System (RCS) via the cold legs or Core Flood Tank (CFT) lines to the reactor vessel. After the borated water storage tank (BWST) has been depleted, the recirculation phase is entered as the suction is transferred to the reactor building sump.

Two redundant low pressure injection (LPI) trains are provided. The LPI trains consist of piping, valves, instruments, controls, heat exchangers, and pumps, such that water from the borated water storage tank (BWST) can be injected into the Reactor Coolant System (RCS). Safety grade flow instrumentation is required to support OPERABILITY of the LPI trains to preclude NPSH or runout problems. In MODES 1, 2 and 3, both trains of LPI must be OPERABLE. This ensures that 100% of the core cooling requirements can be provided even in the event of a single active failure.

The LPI discharge header crossover valves must be manually (locally and remotely) OPERABLE in MODE 1,2, and 3 to assure abundant, long term core cooling. Only one LPI train is required for MODE 4.

A suction header supplies water from the BWST or the reactor building sump to the LPI pumps. LPI discharges into each of the two core flood nozzles on the reactor vessel that discharge into the vessel downcomer area.

The LPI pumps are capable of discharging to the RCS at an RCS pressure of approximately 200 psia. When the BWST has been nearly emptied, the suction for the LPI pumps is manually transferred to the reactor building sump.

OCONEE UNITS 1,2, & 3 B 3.5.3-1 Amendment Nos. I

LPI B 3.5.3 BASES BACKGROUND In the long term cooling period, flow paths in the LPI System are (continued) established to preclude the possibility of boric acid in the core region reaching an unacceptably high concentration. Two gravity flow paths are available by means of a drain line from the hot leg to the Reactor Building sump which draws coolant from the top of the core, thereby inducing core circulation. The system is designed with redundant drain lines.

During a large break LOCA, RCS pressure will rapidly decrease. The LPI System is actuated upon receipt of an ESPS signal. Ifoffsite power is available, the safeguard loads start immediately. Ifoffsite power is not available, the Engineered Safeguards (ES) buses are connected to the Keowee Hydro Units. The time delay (38 seconds) associated with Keowee Hydro Unit startup and pump starting determines the time required before pumped flow is available to the core following a LOCA. Full LPI flow is not available until the LPI valve strokes full open.

The LPI and HPI (LCO 3.5.2, "High Pressure Injection (HPI)"), along with the passive CFTs and the BWST covered in LCO 3.5.1, "Core Flood Tanks (CFTs)," and LCO 3.5.4, "Borated Water Storage Tank (BWST)," provide the cooling water necessary to meet 10 CFR 50.46 (Ref. 1).

criteria for the The LCO helps to ensure that the following acceptance APPLICABLE The LCO helps to ensure that the following acceptance criteria for the SAFETY ANALYSES ECCS, established by 10 CFR 50.46 (Ref. 1), will be met following a LOCA:

a. Maximum fuel element cladding temperature is < 2200 0F;

b. Maximum cladding oxidation is <0.17 times the total cladding thickness before oxidation;

c. Maximum hydrogen generation from a zirconium water reaction is

0.01 times the hypothetical amount generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react;

d. Core is maintained in a coolable geometry; and

e. Adequate long term core cooling capability is maintained.

The LCO also helps ensure that reactor building temperature limits are met.

OCONEE UNITS 1,2, & 3 B 3.5.3-2 Amendment Nos. I

LPI B 3.5.3 BASES APPLICABLE The LPI System is assumed to provide injection in the large break LOCA SAFETY ANALYSES analysis at full power (Ref. 2). This analysis establishes a minimum (continued) required flow for the LPI pumps, as well as the minimum required response time for their actuation.

The large break LOCA event assumes a loss of offsite power and a single failure (loss of the CT-4 transformer). For analysis purposes, the loss of offsite power assumption may be conservatively inconsistent with the assumed operation of some equipment, such as reactor coolant pumps (Ref. 3). During the blowdown stage of a LOCA, the RCS depressurizes as primary coolant is ejected through the break into the reactor building. The nuclear reaction is terminated by moderator voiding during large breaks.

Following depressurization, emergency cooling water is injected into the reactor vessel core flood nozzles, then flows into the downcomer, fills the lower plenum, and refloods the core.

In the event of a Core Flood line break which results in a LOCA, with a concurrent single failure on the unaffected LPI train opposite the Core Flood break, the LPI discharge header crossover valves (LP-9 and LP-1 0) must be capable of being manually (locally and remotely) opened. The LPI cooler outlet throttle valves and LPI header isolation valves must be capable of being manually opened to provide assurance that flow can be established in a timely manner even if the capability to operate them from the control room is lost. These manual actions will allow cross-connection of the LPI pump discharge to the intact LPI/Core Flood tank header to provide abundant emergency core cooling.

The safety analyses show that an LPI train will deliver sufficient water to match decay heat boiloff rates for a large break LOCA.

In the large break LOCA analyses, full LPI is not credited until 53 seconds after actuation of the ESPS signal. This is based on a loss of offsite power and the associated time delays in Keowee Hydro Unit startup, valve opening and pump start. Further, LPI flow is not credited until RCS pressure drops below the pump's shutoff head. For a large break LOCA, HPI is not credited at all.

The LPI trains satisfy Criterion 3 of 10 CFR 50.36 (Ref. 4).

LCO In MODES 1, 2, and 3, two independent (and redundant) LPI trains are required to ensure that at least one LPI train is available, assuming a single failure in the other train. Additionally, individual components within the LPI trains may be called upon to mitigate the consequences of other transients OCONEE UNITS 1,2, & 3 B 3.5.3-3 Amendment Nos. I

LPI B 3.5.3 BASES LCO and accidents. Each LPI train includes the piping, instruments, pumps, (continued) valves, heat exchangers and controls to ensure an OPERABLE flow path capable of taking suction from the BWST upon an ES signal and the capability to manually (remotely) transfer suction to the reactor building sump. The safety grade flow indicator associated with an LPI train is required to be OPERABLE to support LPI train OPERABILITY. The safety grade flow indicator associated with LPSW flow to an LPI cooler is required to be OPERABLE to support LPI train OPERABILITY.

In MODE 4, one of the two LPI trains is required to ensure sufficient LPI flow is available to the core.

During an event requiring LPI injection, a flow path is required to provide an abundant supply of water from the BWST to the RCS, via the LPI pumps and their respective supply headers, to the reactor vessel. In the long term, this flow path may be switched to take its supply from the reactor building sump.

This LCO is modified by three Notes. Note 1 changes the LCO requirement when in MODE 4 for the number of OPERABLE trains from two to one. Note 2 allows an LPI train to be considered OPERABLE during alignment, when aligned or when operating for decay heat removal if capable of being manually (remotely) realigned to the LPI mode of operation. This provision is necessary because of the dual requirements of the components that comprise the LPI and decay heat removal modes of the LPI System. Note 3 requires the LPI discharge header crossover valves (LP-9 and LP-1 0) to be OPERABLE in MODES 1, 2, and 3.

The flow path for each train must maintain its designed independence to ensure that no single failure can disable both LPI trains. If both LPI discharge header crossover valves (LP-9 and LP-1 0) are simultaneously open then only one LPI train is considered OPERABLE.

APPLICABILITY In MODES 1, 2 and 3, the LPI train OPERABILITY requirements for the Design Basis Accident, a large break LOCA, are based on full power operation. The LPI discharge crossover valve OPERABILITY requirements for CFT line break is based on full power operation. Although reduced power would not require the same level of performance, the accident analysis does not provide for reduced cooling requirements in the lower MODES.

In MODE 4, one OPERABLE LPI train is acceptable without single failure consideration on the basis of the stable reactivity condition of the reactor and the limited core cooling requirements.

OCONEE UNITS 1, 2, & 3 B 3.5.3-4 Amendment Nos. I

LPI B 3.5.3 BASES APPLICABILITY In MODES 5 and 6, unit conditions are such that the probability of an event (continued) requiring LPI injection is extremely low. Core cooling requirements in MODE 5 are addressed by LCO 3.4.7, "RCS Loops-MODE 5, Loops Filled," and LCO 3.4.8, "RCS Loops-MODE 5, Loops Not Filled." MODE 6 core cooling requirements are addressed by LCO 3.9.4, "DHR and Coolant Circulation-High Water Level," and LCO 3.9.5, "DHR and Coolant Circulation-Low Water Level."

ACTIONS A.1 With one LPI train inoperable in MODES 1, 2 or 3, the inoperable train must be returned to OPERABLE status within 7 days. The 7 day Completion Time is based on the findings of the deterministic and probabilistic analysis in Reference 7. Reference 7 concluded that extending the Completion Time to 7 days for an inoperable LPI train improves plant operational flexibility while simultaneously reducing overall plant risk. Specifically, the risk incurred by having the LPI train unavailable for a longer time at power will be substantially offset by the benefits associated with avoiding unnecessary plant transitions and by reducing risk during shutdown operations.

B.1 With one or more LPI discharge crossover valves inoperable, the inoperable valve(s) must be returned to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based on NRC recommendations (Ref. 5) that are based on a risk evaluation and is a reasonable time for many repairs.

C.1 If the Required Action and associated Completion Time of Condition A or B are not met, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and MODE 4 within 60 hours6.944444e-4 days 0.0167 hours 9.920635e-5 weeks 2.283e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

D.1 With one required LPI train inoperable in MODE 4, the unit is not prepared to respond to an event requiring low pressure injection and may not be prepared to continue cooldown using the LPI pumps and LPI heat exchangers. The Completion Time of immediately, which would initiate OCONEE UNITS 1,2, & 3 B 3.5.3-5 Amendment Nos. I

LPI B 3.5.3 BASES ACTIONS D.1 (continued) action to restore at least one LPI train to OPERABLE status, ensures that prompt action is taken to restore the required LPI capacity. Normally, in MODE 4, reactor decay heat must be removed by a decay heat removal (DHR) loop operating with suction from the RCS. If no LPI train is OPERABLE for this function, reactor decay heat must be removed by some alternate method, such as use of the steam generator(s).

The alternate means of heat removal must continue until one of the inoperable LPI trains can be restored to operation so that continuation of decay heat removal (DHR) is provided.

With the LPI pumps (including the non ES pump) and LPI heat exchangers inoperable, it would be unwise to require the unit to go to MODE 5, where the only available heat removal system is the LPI trains operating in the DHR mode. Therefore, the appropriate action is to initiate measures to restore one LPI train and to continue the actions until the subsystem is restored to OPERABLE status.

D.2 Required Action D.2 requires that the unit be placed in MODE 5 within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . This Required Action is modified by a Note that states that the Required Action is only required to be performed if a DHR loop is OPERABLE. This Required Action provides for those circumstances where the LPI trains may be inoperable but otherwise capable of providing the necessary decay heat removal. Under this circumstance, the prudent action is to remove the unit from the Applicability of the LCO and place the unit in a stable condition in MODE 5. The Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is reasonable, based on operating experience, to reach MODE 5 in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.5.3.1 REQUIREMENTS Verifying the correct alignment for manual and non-automatic power operated valves in the LPI flow paths provides assurance that the proper flow paths will exist for LPI operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, or securing. Similarly, this SR does not apply to automatic valves since OCONEE UNITS 1,2, & 3 B 3.5.3-6 Amendment Nos. I

LPI B 3.5.3 BASES SURVEILLANCE SR 3.5.3.1 (continued)

REQUIREMENTS automatic valves actuate to their required position upon an accident signal.

This Surveillance does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. The 31 day Frequency is appropriate because the valves are operated under administrative control, and an inoperable valve position would only affect a single train. This Frequency has been shown to be acceptable through operating experience.

When in MODE 4 an LPI train may be considered OPERABLE during alignment, when aligned or when operating for decay heat removal if capable of being manually realigned to the LPI mode of operation.

Therefore, for this condition, the SR verifies that LPI is capable of being manually realigned to the LPI mode of operation.

SR 3.5.3.2 With the exception of systems in operation, the LPI pumps are normally in a standby, non-operating mode. As such, the flow path piping has the potential to develop voids and pockets of entrained gases. Venting the LPI pump casings periodically reduces the potential that such voids and pockets of entrained gases can adversely affect operation of the LPI System. This will also minimize the potential for water hammer, pump cavitation, and pumping of noncondensible gas (e.g., air, nitrogen, or hydrogen) into the reactor vessel following an ESPS signal or during shutdown cooling. This Surveillance is modified by a Note that indicates it is not applicable to operating LPI pump(s). The 31 day Frequency takes into consideration the gradual nature of gas accumulation in the LPI piping and the existence of procedural controls governing system operation.

SR 3.5.3.3 Periodic surveillance testing of LPI pumps to detect gross degradation caused by impeller structural damage or other hydraulic component problems is required by Section Xl of the ASME Code (Ref. 6). SRs are specified in the Inservice Testing Program, which encompasses Section Xl of the ASME Code.

OCONEE UNITS 1,2, & 3 B 3.5.3-7 Amendment Nos. I

LPI B 3.5.3 BASES SURVEILLANCE SR 3.5.3.4 and SR 3.5.3.5 REQUIREMENTS (continued) These SRs demonstrate that each automatic LPI valve actuates to the required position on an actual or simulated ESPS signal and that each LPI pump starts on receipt of an actual or simulated ESPS signal. This SR is not required for valves that are locked, sealed, or otherwise secured in position under administrative controls. The test will be considered satisfactory if control board indication verifies that all components have responded to the ESPS actuation signal properly (all appropriate ESPS actuated pump breakers have opened or closed and all ESPS actuated valves have completed their travel). The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. The 18 month Frequency is also acceptable based on consideration of the design reliability (and confirming operating experience) of the equipment. The actuation logic is tested as part of the ESPS testing, and equipment performance is monitored as part of the Inservice Testing Program.

SR 3.5.3.6 Periodic inspections of the reactor building sump suction inlet ensure that it is unrestricted and stays in proper operating condition. The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage, on the need to preserve access to the location, and on the potential for an unplanned transient if the Surveillance were performed with the reactor at power. This Frequency has been found to be sufficient to detect abnormal degradation and has been confirmed by operating experience.

SR 3.5.3.7 The function of the LPI discharge header crossover valves (LP-9, LP-1 0) is to open and allow a cross-connection between LPI trains. The LPI cooler outlet throttle valves (LP-1 2, LP-1 4) and LPI header isolation valves (LP-1 7, LP-1 8) must be capable of being manually opened to provide assurance that flow can be established in a timely manner even if the capability to operate them from the control room is lost. Manually cycling each valve open demonstrates the ability to fulfill this function. This test is performed on an 18 month Frequency. Operating experience has shown that these components usually pass the Surveillance when performed at the this Frequency. Therefore, the Frequency is acceptable from a reliability standpoint.

OCONEE UNITS 1,2, & 3 B 3.5.3-8 Amendment Nos. I

LPI B 3.5.3 BASES (continued)

REFERENCES 1. 10 CFR 50.46.

2. UFSAR, Section 15.14.3.3.6.

3. UFSAR, Section 15.14.3.3.5.

4. 10 CFR 50.36.

5. NRC Memorandum to V. Stello, Jr., from R.L. Baer, "Recommended Interim Revisions to LCOs for ECCS Components," December 1, 1975.

6. ASME, Boiler and Pressure Vessel Code,Section XI, Inservice Inspection, Article IWV-3400.

7. NRC Safety Evaluation of Babcok & Wilcox Owners Group (B&WOG) Topical Report BAW-2295, Revision 1, "Justification for the Extension of Allowed Outage Time for Low Pressure Injection and Reactor Building Spray systems," (TAC No. MA3807) dated June 30, 1999.

OCONEE UNITS 1, 2, & 3 B 3.5.3-9 Amendment Nos. I

ATTACHMENT 2 MARKUP OF TECHNICAL SPECIFICATION AND BASES

LPI 3.5.3 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 3.5.3 Low Pressure Injection (LPI)

LCO 3.5.3 Two LPI trains shall be OPERABLE.

NOT ES --------------------------------

1. Only one LPI train is required to be OPERABLE in MODE 4.

2. In MODE 4, an LPI train may be considered OPERABLE during alignment, when aligned or when operating for decay heat removal (DHR) if capable of being manually realigned to the LPI mode of operation.

3. In MODES 1, 2, and 3, the LPI discharge header crossover valves shall be manually OPERABLE to open.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One LPI train A.1 Restore LPI train to -2 7' e.

inoperable in MODE 1, OPERABLE status.

2, or 3.

B. One or more LPI B.1 Restore LPI discharge 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months discharge header header crossover crossover valve(s) valve(s) to OPERABLE manually inoperable to status.

open in MODE 1, 2, or 3.

C. Required Action and C.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time of Condition A AND or B not met.

C.2 Be in MODE 4. 60 hours6.944444e-4 days 0.0167 hours 9.920635e-5 weeks 2.283e-5 months (continued)

OCONEE UNITS 1,2, & 3 3.5.3-1 Amendment Nos. ""8, BOG,-&

HPI B 3.5.2 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.2 High Pressure Injection (HPI)

BASES BACKGROUND The function of the ECCS is to provide core cooling to ensure that the reactor core is protected after any of the following accidents:

a. Loss of coolant accident (LOCA);

b. Rod ejection accident (REA);

c. Steam generator tube rupture (SGTR); and

d. Main steam line break (MSLB).

There are two phases of ECCS operation: injection and recirculation. In the injection phase, all injection is initially added to the Reactor Coolant System (RCS) via the cold legs or Core Flood Tank (CFT) lines to the reactor vessel. After the borated water storage tank (BWST) has been depleted, the recirculation phase is entered as the suction is transferred to the reactor building sump.

The HPI System consists of two independent trains, each of which splits to discharge into two RCS cold legs, so that there are a total of four HPI injection lines. Each train takes suction from the BWST, and has an automatic suction valve and discharge valve which open upon receipt of an Engineered Safeguards Protective System (ESPS) signal. The two HPI trains are designed and aligned such that they are not both susceptible to any single active failure including the failure of any power operating component to operate or any single failure of electrical equipment. The HPI System is not required to withstand passive failures.

There are three ESPS actuated HPI pumps; the discharge flow paths for two of the pumps are normally aligned to automatically support HPI train "A" and the discharge flow path for the third pump is normally aligned to automatically support HPI train "B." The discharge flow paths can be manually aligned such that each of the HPI pumps can provide flow to either train. At least one pump is normally running to provide RCS makeup and seal injection to the reactor coolant pumps. Suction header cross connect valves are normally open; cross-connecting the HPI suction OCONEE UNITS 1, 2, & 3 B 3.5.2-1 -DE-C -E-W&N *,.DATEID.,9,/05, Ami-d.Pe&'Lt+ Alos .

HPI B 3.5.2 BASES BACKGROUND headers during normal operation was approved by the NRC in (continued) Reference 6. The discharge crossover valves (HP-409 and HP-41 0) are normally closed; these valves can be used to bypass the normal discharge valves and assure the ability to feed either train's injection lines via HPI pump "B." For each discharge valve and discharge crossover valve, a safety grade flow indicator is provided to enable the operator to throttle flow during an accident to assure that runout limits are not exceeded.

A suction header supplies water from the BWST or the reactor building sump (via the LPI-HPI flow path) to the HPI pumps. HPI discharges into each of the four RCS cold legs between the reactor coolant pump and the reactor vessel. There is one flow limiting orifice in each of the four injection headers that connect to the RCS cold legs. If a pipe break were to occur in an HPI line between the last check valve and the RCS, the orifice in the broken line would limit the HPI flow lost through the break and maximize the flow supplied to the reactor vessel via the other line supplied by the HPI header.

The HPI pumps are capable of discharging to the RCS at an RCS pressure above the opening setpoint of the pressurizer safety valves. The HPI pumps cannot take suction directly from the sump. Ifthe BWST is emptied and HPI is still needed, a cross-connect from the discharge side of the LPI pump to the suction of the HPI pumps would be opened. This is known as "piggy backing" HPI to LPI and enables continued HPI to the RCS.

The HPI System also functions to supply borated water to the reactor core following increased heat removal events, such as MSLBs.

The HPI and LPI (LCO 3.5.3, "Low Pressure Injection (LPI)") components, along with the passive CFTs and the BWST covered in LCO 3.5.1, "Core Flood Tanks (CFTs)," and LCO 3.5.4, "Borated Water Storage Tank (BWST)," provide the cooling water necessary to meet 10 CFR 50.46 (Ref. 1).

APPLICABLE The LCO helps to ensure that the following acceptance criteria for the SAFETY ANALYSES ECCS, established by 10 CFR 50.46 (Ref. 1), will be met following a LOCA;

a. Maximum fuel element cladding temperature is < 2200°F;

b. Maximum cladding oxidation is _0.17 times the total cladding thickness before oxidation; OCONEE UNITS 1, 2, & 3 B 3.5.2-2 BASES ,, .. ,.,,,ON DATED,0905/01

HPI B 3.5.2 BASES APPLICABLE c. Maximum hydrogen generation from a zirconium water reaction is SAFETY ANALYSES 5 0.01 times the hypothetical amount generated if all of the metal in (continued) the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react;

d. Core is maintained in a coolable geometry; and

e. Adequate long term cooling capability is maintained.

The HPI System is credited in the small break LOCA analysis (Ref. 2).

This analysis establishes the minimum required flow and discharge head requirements at the design point for the HPI pumps, as well as the minimum required response time for their actuation. The SGTR and MSLB analyses also credit the HPI pumps, but these events are bounded by the small break LOCA analyses with respect to the performance requirements for the HPI System. The HPI System is not credited for mitigation of a large break LOCA.

During a small break LOCA, the HPI System supplies makeup water to the reactor vessel via the RCS cold legs. The HPI System is actuated upon receipt of an ESPS signal. If offsite power is available, the safeguard loads start immediately. If offsite power is not available, the Engineered Safeguards (ES) buses are connected to the Keowee Hydro Units. The time delay associated with Keowee Hydro Unit startup, HPI valve opening, and pump starting determines the time required before pumped flow is available to the core following a LOCA.

One HPI train provides sufficient flow to mitigate most small break LOCAs.

However, for cold leg breaks located on the discharge of the reactor coolant pumps, some HPI injection will be lost out the break; for this case, two HPI trains are required. Thus, three HPI pumps must be OPERABLE to ensure adequate cooling in response to the design basis RCP discharge small break LOCA. Additionally, in the event one HPI train fails to automatically actuate due to a single failure (e.g., failure of HPI pump "C" or HP-26), operator actions from the Control Room are required to cross connect the HPI discharge headers within 10 minutes in order to provide HPI flow through a second HPI train (Ref. 6).

Hydraulic separation of the HPI discharge headers is required during normal operation to maintain defense-in-depth (i.e., independence of the HPI discharge headers). Additionally, hydraulic separation of the HPI discharge headers ensures that a complete loss of HPI would not occur in the event an accident were to occur with only two of the three HPI pumps OCONEE UNITS 1, 2, & 3 B 3.5.2-3 DACES. RI=,-,SIE)N DATED ,, ,.,,'

A /VOS.

HPI B 3.5.2 BASES APPLICABLE OPERABLE coincident with the HPI discharge headers cross-connected.

SAFETY ANALYSES A single active failure of an HPI pump would leave only one HPI pump to (continued) mitigate the accident. The remaining HPI pump could experience runout conditions and could fail prior to operator action to throttle flow or start another pump.

Hydraulic separation on the suction side of the HPI pumps could cause a loss of redundancy. With any one of the normally open suction header cross-connect valves closed, a failure of an automatic suction valve to open during an accident could cause two pumps to lose suction. Thus, the suction header cross-connect valves must remain open.

The safety analyses show that the HPI pump(s) will deliver sufficient water for a small break LOCA and provide sufficient boron to maintain the core subcritical.

The HPI System satisfies Criterion 3 of 10 CFR 50.36 (Ref. 3).

3500 F, In MODES 1 and 2, and MODE 3 with RCS temperature LCO In MODES 1 and 2, and MODE 3 with RCS temperature > 3500F, the HPI System is required to be OPERABLE with:

a. Two HPI trains OPERABLE;

b. An additional HPI pump OPERABLE;

c. Two LPI-HPI flow paths OPERABLE;

d. Two HPI discharge crossover valves OPERABLE;

e. HPI suction headers cross-connected; and

f. HPI discharge headers separated.

The LCO establishes the minimum conditions required to ensure that the HPI System delivers sufficient water to mitigate a small break LOCA.

Additionally, individual components within the HPI trains may be called upon to mitigate the consequences of other transients and accidents.

Each HPI train includes the piping, instruments, pump, valves, and controls to ensure an OPERABLE flow path capable of taking suction from the BWST and injecting into the RCS cold legs upon an ESPS signal. For an HPI train to be OPERABLE, the associated HPI pump must be capable of OCONEE UNITS 1,2, & 3 B 3.5.2-4 ASES.. "E' "',,.,N DATED ,.,*,.,O A14-e A'T1E-V7 4/os.

HPI B 3.5.2 BASES LCO taking suction from the BWST through the suction header valve associated (continued) with that train upon an ESPS signal. For example:

1) if HPI pump "B" is being credited as part of HPI train "A," then it must be capable of taking suction through HP-24 upon an ESPS signal; or

2) if HPI pump "B" is being credited as part of HPI train "B," then it must be capable of taking suction through HP-25 upon an ESPS signal.

~The (D safety grade flow indicator associated with the normal discharge valve M _-

-is required to be OPERABLE to support the associated HPI train's

0 *automatic 6 OPERABILITY.

E .2 0 (D E " 0 To support HPI pump OPERABILITY, the piping, valves and controls which

., - ensure the HPI pump can take suction from the BWST upon an ESPS

- -signal are required to be OPERABLE.

E E To support HPI discharge crossover valve OPERABILITY, the safety grade E flow indicator associated with the HPI discharge crossover valve is required "t: ca i to be OPERABLE.

0- D-0 E .6o E Each LPI-HPI flow path includes the piping, instruments, valves and

,- "5 =

"=controls to ensure the capability to manually transfer suction to the reactor

-J1: 0-- , W "- building sump (LPI-HPI flow path). Within the LPI-HPI flow path are the

_ LPI discharge valves to the LPI-HPI flow path (LP-15 and LP-16). The LPI

, ' (D i discharge valves to the LPI-HPI flow path must be capable of being

- " -manually (locally and remotely) opened for the LPI-HPI flow path to be 0 > C OPERABLE. The OPERABILITY requirements regarding the LPI System

-J 7 "J are addressed in LCO 3.5.3, "Low Pressure Injection (LPI)."

m ca a) - During an event requiring HPI actuation, a flow path is provided to ensure 20 E -2 an abundant supply of water from the BWST to the RCS via the HPI pumps

-J !=_1 and their respective discharge flow paths to each of the four cold leg 7 E- .

-9 injection nozzles and the reactor vessel. In the recirculation phase, this 5 _-

CB flow path is manually transferred to take its supply from the reactor building D :5.LO . sump and to supply borated water to the RCS via the LPI-HPI flow path CO EL (piggy-back mode).

The OPERABILITY of the HPI System must be maintained to ensure that no single active failure can disable both HPI trains. Additionally, while the HPI System was not designed to cope with passive failures, the HPI trains must be maintained independent to the extent possible during normal operation. The NRC approved exception to this principle is cross connecting the HPI suction headers during normal operation (Ref. 6).

OCONEE UNITS 1,2, & 3 B 3.5.2-5 -BASES REVISION DATE, OD/.....1 AM,eouVJF-AJr- I

HPI B 3.5.2 BASES (continued)

APPLICABILITY In MODES 1 and 2, and MODE 3 with RCS temperature > 3500 F, the HPI System OPERABILITY requirements for the small break LOCA are based on analysis performed at 100% RTP. The HPI pump performance is based on the small break LOCA, which establishes the pump performance curve.

Mode 2 and MODE 3 with RCS temperature > 350°F requirements are bounded by the MODE 1 analysis.

In MODE 3 with RCS temperature < 350°F and in MODE 4, the probability of an event requiring HPI actuation is significantly lessened. In this operating condition, the low probability of an event requiring HPI actuation and the LCO 3.5.3 requirements for the LPI System provide reasonable assurance that the safety injection function is preserved.

In MODES 5 and 6, unit conditions are such that the probability of an event requiring HPI injection is extremely low. Core cooling requirements in MODE 5 are addressed by LCO 3.4.7, "RCS Loops - MODE 5, Loops Filled," and LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled."

MODE 6 core cooling requirements are addressed by LCO 3.9.4, "Decay Heat Removal (DHR) and Coolant Circulation - High Water Level," and LCO 3.9.5, "Decay Heat Removal (DHR) and Coolant Circulation - Low Water Level."

ACTIONS A.1 and A.2 With one HPI pump inoperable, or one or more HPI discharge crossover valve(s) (i.e., HP-409 and HP-410) inoperable, the HPI pump and discharge crossover valve(s) must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The HPI System continues to be capable of mitigating an accident, barring a single failure. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based

-on NRC recommendations (Ref. 4) that are based on a risk evaluation and is a reasonable time for many repairs.

In the event HPI pump "C" becomes inoperable, Condition C must be entered as well as Condition A. Until actions are taken to align an HPI pump to HPI train "B," HPI train "B" is inoperable due to the inability to automatically provide injection in response to an ESPS signal. Additionally, in order to utilize another HPI pump to supply HPI train "B," HP-1 16 must be opened. This action results in cross-connecting the HPI discharge headers; thus, Condition E must be entered. The HPI discharge headers cannot be separated in this situation, because it would require HPI pumps "A" and "B" to operate with flows less than the minimum requirements.

OCONEE UNITS 1, 2, & 3 B 3.5.2-6 ,AGSE REV+IGION DATED Gfl9,'3^',

A~ie~mDmtev7 A/os.

HPI B 3.5.2 BASES ACTIONS A.1 and A.2 (continued)

This Condition permits multiple components of the HPI System to be inoperable concurrently. When this occurs, other Conditions may also apply. For example, if HPI pump "C" and HP-409 are inoperable coincidentally, HPI train "B" is incapable of being automatically actuated or manually aligned from the Control Room. Thus, Required Action C.1 would apply.

B.1, B.2, B.3, and B.4 Ifthe Required Action and associated Completion Time of Condition A is not met, THERMAL POWER of the unit must be reduced to

75% RTP within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time is reasonable, based on operating experience, to reach the required unit condition from full power conditions in an orderly manner and without challenging unit systems. This time is less restrictive than the Completion Time for Required Action C.1, because the HPI System remains capable of performing its function, barring a single failure.

Two HPI trains are required to mitigate specific small break LOCAs, if no credit for enhanced steam generator cooling is assumed in the accident analysis. However, if equipment not qualified as QA-1 (i.e., an atmospheric dump valve (ADV) flow path for a steam generator) is credited for enhanced steam generator cooling, the safety analyses have determined that the capacity of one HPI train is sufficient to mitigate a small break LOCA on the discharge of the reactor coolant pumps if reactor power is

<75% RTP.

Required Actions B.2, B.3, and B.4 modify the HPI pump and discharge crossover valve OPERABILITY requirements to permit reduced requirements at power levels *75% RTP for an extended period of time.

Required Action B.2 provides a compensatory measure to verify by administrative means that the ADV flow path for each steam generator is OPERABLE within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . This compensatory measure provides additional assurance regarding the ability of the plant to mitigate an accident. Compliance with this requirement can be established by ensuring that the ADV flow path for each steam generator is OPERABLE in accordance with LCO 3.7.4, "Atmospheric Dump Valve (ADV) Flow Paths."

Required Actions B.3 and B.4 require that the HPI pump and discharge crossover valve(s) be restored to OPERABLE status within 30 days from initial entry into Condition A. The 30-day time period limits the time that the OCONEE UNITS 1, 2, & 3 B 3.5.2-7 BASES RFEV,,SIC,N DATED 03,'5101 me~'-D Ei~A)o- NOS

HPI B 3.5.2 BASES ACTIONS B.1, B.2, B.3, and B.4 (continued) plant can operate while relying on non QA-1 ADVs to provide enhanced steam generator cooling to mitigate small break LOCAs. The 30-day time period is acceptable, because:

1. Without crediting an ADV flow path, the HPI System remains capable of performing the safety function, barring a single failure;

2. Ifcredit is taken for an ADV flow path for a steam generator, the safety analysis has demonstrated that only one HPI train is required to mitigate the consequences of a small break LOCA when THERMAL POWER is *75% RTP. Thus, for this case, the HPI System would be capable of performing its safety function even with an additional single failure;

3. OPERABILITY of the ADV flow path for each steam generator is required to be confirmed by Required Action B.2 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

Additional defense-in-depth is provided, because the ADV flow path for only one steam generator is required to mitigate the small break LOCA; and

4. A risk-informed assessment (Ref. 7) concluded that operating the plant in accordance with these Required Actions is acceptable.

C.1, C.2, and C.3 If the plant is operating with THERMAL POWER > 75% RTP, two HPI pumps capable of providing flow through two HPI trains are required. One HPI train is required to provide flow automatically upon receipt of an ESPS signal, while flow through the other HPI train must be capable of being established from the Control Room within 10 minutes. Thus, if the plant is operating at > 75% RTP, and one HPI train is inoperable and incapable of being automatically actuated or manually aligned from the Control Room to provide flow post-accident, the HPI System would be incapable of performing its safety function. For this Condition, Required Action C.1 requires the power to be reduced to *75% RTP within 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months . Required Action C.1 is modified by a Note which limits its applicability to the condition defined above. The 3 hour3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months Completion Time is considered reasonable to reduce the unit from full power conditions to *75% RTP in an orderly manner and without challenging unit systems. The time frame is more restrictive than the Completion Time provided in Required Action B.1 for the same action, because the condition involves a loss of safety function.

OCONEE UNITS 1, 2, & 3 B 3.5.2-8 -^SEA fl

,EVI*,I,* DATED 09/O""

S7wDA4 "T- A/Ns,

HPI B 3.5.2 BASES ACTIONS C.1, C.2, and C.3 (continued)

If the plant is operating with THERMAL POWER > 75% RTP and the inoperable HPI train can be automatically actuated or manually aligned to provide flow post-accident, Required Action C.3 permits 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to restore the HPI train to an OPERABLE status.

If enhanced steam generator cooling is not credited in the accident analysis, two HPI trains are required to mitigate specific small break LOCAs with THERMAL POWER < 75% RTP. However, if equipment not qualified as QA-1 (i.e., an ADV flow path for a steam generator) is credited for enhanced steam generator cooling, the safety analyses have determined that the capacity of one HPI train is sufficient to mitigate a small break LOCA on the discharge of the reactor coolant pumps if THERMAL POWER is *75% RTP. In order to permit an HPI train to be inoperable regardless of the reason when THERMAL POWER is *75% RTP, Required Action C.2 provides a compensatory measure to verify by administrative means that the ADV flow path for each steam generator is OPERABLE within 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months . This Required Action is modified by a Note which states that it is only required if THERMAL POWER is *75% RTP.

This compensatory measure provides assurance regarding the ability of the plant to mitigate an accident while in the Condition and THERMAL POWER 5 75% RTP. Compliance with this requirement can be established by ensuring that the ADV flow path for each steam generator is OPERABLE in accordance with LCO 3.7.4, "Atmospheric Dump Valve (ADV) Flow Paths."

With one HPI train inoperable, the inoperable HPI train must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This action is appropriate because:

1. With THERMAL POWER <75% RTP, the safety analysis demonstrates that only one HPI train is required to mitigate the consequences of a small break LOCA assuming credit is taken for the ADV flow path for one steam generator. The OPERABILITY of the ADV flow path for each steam generator is confirmed by Required Action C.2 within 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months . This provides additional defense-in-depth. Additionally, a risk-informed assessment (Ref. 7) concluded that operating the plant in accordance with this Required Action is acceptable.

2. With THERMAL POWER > 75% RTP, the remaining OPERABLE HPI train is capable of automatic actuation, and the inoperable train can be manually aligned by operator action to cross-connect the discharge headers of the HPI trains. This manual action was approved by the NRC in Reference 6.

OCONEE UNITS 1, 2, & 3 B 3.5.2-9 ,,,,_,.. DATED FeASE 09,05101 j4A~eA ,q-rT ANOs,

I HPI B 3.5.2 BASES ACTIONS D.1 (continued)

With the HPI suction headers not cross-connected, the HPI suction headers must be cross-connected within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The HPI System continues to be capable of mitigating an accident, barring a single failure.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based on NRC recommendations (Ref. 4) that are based on a risk evaluation and is a reasonable time for many repairs.

An argument similar to that utilized for Required Actions B.2, B.3, and B.4 could have been made for operating the HPI System with the suction headers not cross-connected for an extended period of time. However, this action was not considered prudent, due to the potential of damaging two HPI pumps in the event HP-24 or HP-25 failed to open in response to an ESPS signal while the HPI suction headers were not cross-connected.

E.1 With the HPI discharge headers cross-connected, the independence of the HPI trains is not being maintained to the extent practical (i.e., defense-in depth principle is not met). Thus, the HPI discharge headers must be hydraulically separated within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This action limits the time period that the HPI discharge headers may be cross-connected. The 72-hour allowed outage time is acceptable, because cross-connecting the HPI discharge headers in conjunction with:

1. the rest of the HPI System being OPERABLE would not result in the inability of the HPI System to perform its safety function even assuming a single active failure; and

2. an HPI pump being inoperable would not result in the inability of the HPI System to perform its safety function, barring a single failure.

However, in this condition, a single active failure of one of the two remaining OPERABLE HPI pumps could result in the remaining HPI pump failing due to runout.

F..1 With one LPI-HPI flow path inoperable, the inoperable LPI-HPI flow path must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The HPI System continues to be capable of mitigating an accident, barring a single failure.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is justified because there is a limited range of break sizes, and therefore a lower probability for a small break LOCA which would require piggy back operation.

OCONEE UNITS 1, 2, & 3 B 3.5.2-10 -BASES, ,,,fDATEDE e ,se54,4 A-'vDA4"-r AkOs,

HPI B 3.5.2 BASES ACTIONS G.1 and G.2 (continued)

If a Required Action and associated Completion Time of Condition B, C, D, E, or F are not met, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and the RCS temperature reduced to < 350°F within 60 hours6.944444e-4 days 0.0167 hours 9.920635e-5 weeks 2.283e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

H.1 If two HPI trains are inoperable or two LPI-HPI flow paths are inoperable, the HPI System is incapable of performing its safety function and in a condition not explicitly addressed in the Actions for ITS 3.5.2. Thus, immediate plant shutdown in accordance with LCO 3.0.3 is required.

SURVEILLANCE SR 3.5.2.1 REQUIREMENTS Verifying the correct alignment for manual and non-automatic power operated valves in the HPI flow paths provides assurance that the proper flow paths will exist for HPI operation. This SR does apply to the HPI suction header cross-connect valves, the HPI discharge cross-connect valves, the HPI discharge crossover valves, and the LPI-HPI flow path discharge valves (LP-1 5 and LP-1 6). This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, or securing. Similarly, this SR does not apply to automatic valves since automatic valves actuate to their required position upon an accident signal.

This Surveillance does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. The 31 day Frequency is appropriate because the valves are operated under administrative control. This Frequency has been shown to be acceptable through operating experience.

SR 3.5.2.2 With the exception of the HPI pump operating to provide normal makeup, the other two HPI pumps are normally in a standby, non-operating mode.

As such, the emergency injection flow path piping has the potential to develop voids and pockets of entrained gases. Venting the HPI pump casings periodically reduces the potential that such voids and pockets of OCONEE UNITS 1,2, & 3 B 3.5.2-11 BASE r., ' DATED .

'.,,, ,,"'0"*'Q

HPI B 3.5.2 BASES SURVEILLANCE SR 3.5.2.2 (continued)

REQUIREMENTS entrained gases can adversely affect operation of the HPI System. This will also reduce the potential for water hammer, pump cavitation, and pumping of noncondensible gas (e.g., air, nitrogen, or hydrogen) into the reactor vessel following an ESPS signal. This Surveillance is modified by a Note that indicates it is not applicable to operating HPI pump(s) providing normal makeup. The 31 day Frequency takes into consideration the gradual nature of gas accumulation in the HPI piping and the existence of procedural controls governing system operation.

SR 3.5.2.3 Periodic surveillance testing of HPI pumps to detect gross degradation caused by impeller structural damage or other hydraulic component problems is required by Section XI of the ASME Code (Ref. 5). SRs are specified in the Inservice Testing Program, which encompassesSection XI of the ASME Code.

SR 3.5.2.4 and SR 3.5.2.5 These SRs demonstrate that each automatic HPI valve actuates to the required position on an actual or simulated ESPS signal and that each HPI pump starts on receipt of an actual or simulated ESPS signal. This SR is not required for valves that are locked, sealed, or otherwise secured in position under administrative controls. The test will be considered satisfactory if control board indication verifies that all components have responded to the ESPS actuation signal properly (all appropriate ESPS actuated pump breakers have opened or closed and all ESPS actuated valves have completed their travel). The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. The 18 month Frequency is also acceptable based on consideration of the design reliability (and confirming operating experience) of the equipment. The actuation logic is tested as part of the ESPS testing, and equipment performance is monitored as part of the Inservice Testing Program.

OCONEE UNITS 1, 2, & 3 B 3.5.2-12 SASES REVII*" N DATE-D ,*,9'i/

A-wa.*1DWT- Ab&-.

HPI B 3.5.2 BASES SURVEILLANCE SR 3.5.2.6 REQUIREMENTS (continued) Periodic inspections of the reactor building sump suction inlet (for LPI-HPI flow path) ensure that it is unrestricted and stays in proper operating condition. The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage, on the need to preserve access to the location, and on the potential for an unplanned transient if the Surveillance were performed with the reactor at power. This Frequency has been found to be sufficient to detect abnormal degradation and has been confirmed by operating experience.

SR 3.5.2.7 Periodic stroke testing of the HPI discharge crossover valves (HP-409 and HP-410) and LPI-HPI flow path discharge valves (LP-15 and LP-16) is required to ensure that the valves can be manually cycled. The HPI discharge crossover valves must be capable of being stroked from the Control Room. The LPI-HPI flow path discharge valves must be capable of being stroked locally. This test is performed on an 18 month Frequency.

Operating experience has shown that these components usually pass the surveillance when performed at this Frequency. Therefore, the Frequency is acceptable from a reliability standpoint.

REFERENCES 1. 10 CFR 50.46.

2. UFSAR, Section 15.14.3.3.6.

3. 10 CFR 50.36.

4. NRC Memorandum to V. Stello, Jr., from R.L. Baer, "Recommended Interim Revisions to LCOs for ECCS Components," December 1, 1975.

5. ASME, Boiler and Pressure Vessel Code, Section Xl, Inservice Inspection, Article IWV-3400.

6. Letter from R. W. Reid (NRC) to W. 0. Parker, Jr. (Duke) transmitting Safety Evaluation for Oconee Nuclear Station, Units Nos. 1, 2, and 3, Modifications to the High Pressure Injection System, dated December 13, 1978.

OCONEE UNITS 1,2, & 3 B 3.5.2-13 tr44 eiDM- W-T 'KOK .

HPI B 3.5.2 BASES REFERENCES 7. Letter from W. R. McCollum (Duke) to the U. S. NRC, "Proposed (continued) Amendment to the Facility Operating License Regarding the High Pressure Injection System Requirements," dated December 16, 1998.

OCONEE UNITS 1, 2, & 3 B 3.5.2-14 - ASSS RE"IsCON DATED B.. CS/O1 A-4,-DeJJF NOS

LPI B 3.5.3 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.3 Low Pressure Injection (LPI)

BASES BACKGROUND The function of the ECCS is to provide core cooling to ensure that the reactor core is protected after any of the following accidents:

a. Loss of coolant accident (LOCA);

b. Rod ejection accident (REA);

c. Steam generator tube rupture (SGTR); and

d. Main steam line break (MSLB).

There are two phases of ECCS operation: injection and recirculation. In the injection phase, all injection is initially added to the Reactor Coolant System (RCS) via the cold legs or Core Flood Tank (CFT) lines to the reactor vessel. After the borated water storage tank (BWST) has been depleted, the recirculation phase is entered as the suction is transferred to the reactor building sump.

Two redundant low pressure injection (LPI) trains are provided. The LPI trains consist of piping, valves, instruments, controls, heat exchangers, and pumps, such that water from the borated water storage tank (BWST) can be injected into the Reactor Coolant System (RCS). Safety grade flow instrumentation is required to support OPERABILITY of the LPI trains to preclude NPSH or runout problems. In MODES 1, 2 and 3, both trains of LPI must be OPERABLE. This ensures that 100% of the core cooling requirements can be provided even in the event of a single active failure.

The LPI discharge header crossover valves must be manually (locally and remotely) OPERABLE in MODE 1, 2, and 3 to assure abundant, long term core cooling. Only one LPI train is required for MODE 4.

A suction header supplies water from the BWST or the reactor building sump to the LPI pumps. LPI discharges into each of the two core flood nozzles on the reactor vessel that discharge into the vessel downcomer area.

The LPI pumps are capable of discharging to the RCS at an RCS pressure of approximately 200 psia. When the BWST has been nearly emptied, the suction for the LPI pumps is manually transferred to the reactor building sump.

OCONEE UNITS 1, 2, & 3 B 3.5.3-1 Q.ASES REVISON DATED 09A05.1%

ArA.oU-IKEiJ*'fJT NO'S.

LPI B 3.5.3 BASES BACKGROUND In the long term cooling period, flow paths in the LPI System are (continued) established to preclude the possibility of boric acid in the core region reaching an unacceptably high concentration. Two gravity flow paths are available by means of a drain line from the hot leg to the Reactor Building sump which draws coolant from the top of the core, thereby inducing core circulation. The system is designed with redundant drain lines.

During a large break LOCA, RCS pressure will rapidly decrease. The LPI System is actuated upon receipt of an ESPS signal. If offsite power is available, the safeguard loads start immediately. Ifoffsite power is not available, the Engineered Safeguards (ES) buses are connected to the Keowee Hydro Units. The time delay (38 seconds) associated with Keowee Hydro Unit startup and pump starting determines the time required before pumped flow is available to the core following a LOCA. Full LPI flow is not available until the LPI valve strokes full open.

The LPI and HPI (LCO 3.5.2, "High Pressure Injection (HPI)"), along with the passive CFTs and the BWST covered in LCO 3.5.1, "Core Flood Tanks (CFTs)," and LCO 3.5.4, "Borated Water Storage Tank (BWST)," provide the cooling water necessary to meet 10 CFR 50.46 (Ref. 1).

criteria for the The LCO helps to ensure that the following acceptance APPLICABLE The LCO helps to ensure that the following acceptance criteria for the SAFETY ANALYSES ECCS, established by 10 CFR 50.46 (Ref. 1), will be met following a LOCA:

a. Maximum fuel element cladding temperature is < 2200°F;

b. Maximum cladding oxidation is *0.17 times the total cladding thickness before oxidation;

c. Maximum hydrogen generation from a zirconium water reaction is

< 0.01 times the hypothetical amount generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react;

d. Core is maintained in a coolable geometry; and

e. Adequate long term core cooling capability is maintained.

The LCO also helps ensure that reactor building temperature limits are met.

OCONEE UNITS 1,2, & 3 B 3.5.3-2 - BA ES IRE-EVE,10N D)ATE-D 09,Of ,

,A&A49Zbkte"- Alos.

LPI B 3.5.3 BASES APPLICABLE The LPI System is assumed to provide injection in the large break LOCA SAFETY ANALYSES analysis at full power (Ref. 2). This analysis establishes a minimum (continued) required flow for the LPI pumps, as well as the minimum required response time for their actuation.

The large break LOCA event assumes a loss of offsite power and a single failure (loss of the CT-4 transformer). For analysis purposes, the loss of offsite power assumption may be conservatively inconsistent with the assumed operation of some equipment, such as reactor coolant pumps (Ref. 3). During the blowdown stage of a LOCA, the RCS depressurizes as primary coolant is ejected through the break into the reactor building. The nuclear reaction is terminated by moderator voiding during large breaks.

Following depressurization, emergency cooling water is injected into the reactor vessel core flood nozzles, then flows into the downcomer, fills the lower plenum, and refloods the core.

In the event of a Core Flood line break which results in a LOCA, with a concurrent single failure on the unaffected LPI train opposite the Core Flood break, the LPI discharge header crossover valves (LP-9 and LP-1 0) must be capable of being manually (locally and remotely) opened. The LPI cooler outlet throttle valves and LPI header isolation valves must be capable of being manually opened to provide assurance that flow can be established in a timely manner even if the capability to operate them from the control room is lost. These manual actions will allow cross-connection of the LPI pump discharge to the intact LPI/Core Flood tank header to provide abundant emergency core cooling.

The safety analyses show that an LPI train will deliver sufficient water to match decay heat boiloff rates for a large break LOCA.

In the large break LOCA analyses, full LPI is not credited until 53 seconds after actuation of the ESPS signal. This is based on a loss of offsite power and the associated time delays in Keowee Hydro Unit startup, valve opening and pump start. Further, LPI flow is not credited until RCS pressure drops below the pump's shutoff head. For a large break LOCA, HPI is not credited at all.

The LPI trains satisfy Criterion 3 of 10 CFR 50.36 (Ref. 4).

LCO In MODES 1, 2, and 3, two independent (and redundant) LPI trains are required to ensure that at least one LPI train is available, assuming a single failure in the other train. Additionally, individual components within the LPI trains may be called upon to mitigate the consequences of other transients OCONEE UNITS 1, 2, & 3 B 3.5.3-3 O3ASES ,'EVI8',HN DATED,",8,O,,O A4f,*JA,1"-ieAI AItS.

LPI B 3.5.3 BASES LCO and accidents. Each LPI train includes the piping, instruments, pumps, (continued) valves, heat exchangers and controls to ensure an OPERABLE flow path capable of taking suction from the BWST upon an ES signal and the capability to manually (remotely) transfer suction to the reactor building sump. The safety grade flow indicator associated with an LPI train is required to be OPERABLE to support LPI train OPERABILITY. The safety grade flow indicator associated with LPSW flow to an LPI cooler is required to be OPERABLE to support LPI train OPERABILITY.

In MODE 4, one of the two LPI trains is required to ensure sufficient LPI flow is available to the core.

During an event requiring LPI injection, a flow path is required to provide an abundant supply of water from the BWST to the RCS, via the LPI pumps and their respective supply headers, to the reactor vessel. In the long term, this flow path may be switched to take its supply from the reactor building sump.

This LCO is modified by three Notes. Note 1 changes the LCO requirement when in MODE 4 for the number of OPERABLE trains from two to one. Note 2 allows an LPI train to be considered OPERABLE during alignment, when aligned or when operating for decay heat removal if capable of being manually (remotely) realigned to the LPI mode of operation. This provision is necessary because of the dual requirements of the components that comprise the LPI and decay heat removal modes of the LPI System. Note 3 requires the LPI discharge header crossover valves (LP-9 and LP-1 0) to be OPERABLE in MODES 1, 2, and 3.

The flow path for each train must maintain its designed independence to ensure that no single failure can disable both LPI trains. If both LPI discharge header crossover valves (LP-9 and LP-1 0) are simultaneously open then only one LPI train is considered OPERABLE.

APPLICABILITY In MODES 1, 2 and 3, the LPI train OPERABILITY requirements for the Design Basis Accident, a large break LOCA, are based on full power operation. The LPI discharge crossover valve OPERABILITY requirements for CFT line break is based on full power operation. Although reduced power would not require the same level of performance, the accident analysis does not provide for reduced cooling requirements in the lower MODES.

In MODE 4, one OPERABLE LPI train is acceptable without single failure consideration on the basis of the stable reactivity condition of the reactor and the limited core cooling requirements.

OCONEE UNITS 1,2, & 3 B 3.5.3-4 BASES REVISION DATED -,105/01 AMYU4MEJJT NOs.

LPI B 3.5.3 BASES APPLICABILITY In MODES 5 and 6, unit conditions are such that the probability of an event (continued) requiring LPI injection is extremely low. Core cooling requirements in MODE 5 are addressed by LCO 3.4.7, "RCS Loops-MODE 5, Loops Filled," and LCO 3.4.8, "RCS Loops-MODE 5, Loops Not Filled." MODE 6 core cooling requirements are addressed by LCO 3.9.4, "DHR and Coolant Circulation-High Water Level," and LCO 3.9.5, "DHR and Coolant Circulation-Low Water Level."

ACTIONS A.1 With one LPI train inoperable in MODES 1, 2 or 3, " inoperable train must be returned to OPERABLE status within 7 . The 72-he4u ,G.

Completion Time i b d ,n NRC ........ daticn3 (f"f 5) that ar raliability analyeis has sho'wn the' Fisk e! haYing ono L-P train inepcrable to borb cu#8eieiotly low to juesify oontinud oporation for 72hcr3 B.1 With one or more LPI discharge crossover valves inoperable, the inoperable valve(s) must be returned to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based on NRC recommendations (Ref. 5) that are based on a risk evaluation and is a reasonable time for many repairs.

C.1 If the Required Action and associated Completion Time of Condition A or B are not met, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and MODE 4 within 60 hours6.944444e-4 days 0.0167 hours 9.920635e-5 weeks 2.283e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

D.1 With one required LPI train inoperable in MODE 4, the unit is not prepared to respond to an event requiring low pressure injection and may not be prepared to continue cooldown using the LPI pumps and LPI heat exchangers. The Completion Time of immediately, which would initiate OCONEE UNITS 1,2, & 3 B 3.5.3-5 -DASEC flE-VI,.fEN DATED" ,.,9, AA4E)t & a r M's .

LPI B 3.5.3 BASES ACTIONS D.1 (continued) action to restore at least one LPI train to OPERABLE status, ensures that prompt action is taken to restore the required LPI capacity. Normally, in MODE 4, reactor decay heat must be removed by a decay heat removal (DHR) loop operating with suction from the RCS. If no LPI train is OPERABLE for this function, reactor decay heat must be removed by some alternate method, such as use of the steam generator(s).

The alternate means of heat removal must continue until one of the inoperable LPI trains can be restored to operation so that continuation of decay heat removal (DHR) is provided.

With the LPI pumps (including the non ES pump) and LPI heat exchangers inoperable, it would be unwise to require the unit to go to MODE 5, where the only available heat removal system is the LPI trains operating in the DHR mode. Therefore, the appropriate action is to initiate measures to restore one LPI train and to continue the actions until the subsystem is restored to OPERABLE status.

D.2 Required Action D.2 requires that the unit be placed in MODE 5 within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . This Required Action is modified by a Note that states that the Required Action is only required to be performed if a DHR loop is OPERABLE. This Required Action provides for those circumstances where the LPI trains may be inoperable but otherwise capable of providing the necessary decay heat removal. Under this circumstance, the prudent action is to remove the unit from the Applicability of the LCO and place the unit in a stable condition in MODE 5. The Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is reasonable, based on operating experience, to reach MODE 5 in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.5.3.1 REQUIREMENTS Verifying the correct alignment for manual and non-automatic power operated valves in the LPI flow paths provides assurance that the proper flow paths will exist for LPI operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, or securing. Similarly, this SR does not apply to automatic valves since OCONEE UNITS 1, 2, & 3 B 3.5.3-6 BASES f*-,,,-,,,N DATED . .,,,-,,4 AME tEW NOS.

LPI B 3.5.3 BASES SURVEILLANCE SR 3.5.3.1 (continued)

REQUIREMENTS automatic valves actuate to their required position upon an accident signal.

This Surveillance does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. The 31 day Frequency is appropriate because the valves are operated under administrative control, and an inoperable valve position would only affect a single train. This Frequency has been shown to be acceptable through operating experience.

When in MODE 4 an LPI train may be considered OPERABLE during alignment, when aligned or when operating for decay heat removal if capable of being manually realigned to the LPI mode of operation.

Therefore, for this condition, the SR verifies that LPI is capable of being manually realigned to the LPI mode of operation.

SR 3.5.3.2 With the exception of systems in operation, the LPI pumps are normally in a standby, non-operating mode. As such, the flow path piping has the potential to develop voids and pockets of entrained gases. Venting the LPI pump casings periodically reduces the potential that such voids and pockets of entrained gases can adversely affect operation of the LPI System. This will also minimize the potential for water hammer, pump cavitation, and pumping of noncondensible gas (e.g., air, nitrogen, or hydrogen) into the reactor vessel following an ESPS signal or during shutdown cooling. This Surveillance is modified by a Note that indicates it is not applicable to operating LPI pump(s). The 31 day Frequency takes into consideration the gradual nature of gas accumulation in the LPI piping and the existence of procedural controls governing system operation.

SR 3.5.3.3 Periodic surveillance testing of LPI pumps to detect gross degradation caused by impeller structural damage or other hydraulic component problems is required by Section XI of the ASME Code (Ref. 6). SRs are specified in the Inservice Testing Program, which encompassesSection XI of the ASME Code.

OCONEE UNITS 1,2, & 3 B 3.5.3-7 A.C.S RE'lC',O'N DATED 09/05,01 mvit~mew-F Nos .

LPI B 3.5.3 BASES SURVEILLANCE SR 3.5.3.4 and SR 3.5.3.5 REQUIREMENTS (continued) These SRs demonstrate that each automatic LPI valve actuates to the required position on an actual or simulated ESPS signal and that each LPI pump starts on receipt of an actual or simulated ESPS signal. This SR is not required for valves that are locked, sealed, or otherwise secured in position under administrative controls. The test will be considered satisfactory if control board indication verifies that all components have responded to the ESPS actuation signal properly (all appropriate ESPS actuated pump breakers have opened or closed and all ESPS actuated valves have completed their travel). The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. The 18 month Frequency is also acceptable based on consideration of the design reliability (and confirming operating experience) of the equipment. The actuation logic is tested as part of the ESPS testing, and equipment performance is monitored as part of the Inservice Testing Program.

SR 3.5.3.6 Periodic inspections of the reactor building sump suction inlet ensure that it is unrestricted and stays in proper operating condition. The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage, on the need to preserve access to the location, and on the potential for an unplanned transient if the Surveillance were performed with the reactor at power. This Frequency has been found to be sufficient to detect abnormal degradation and has been confirmed by operating experience.

SR 3.5.3.7 The function of the LPI discharge header crossover valves (LP-9, LP-1 0) is to open and allow a cross-connection between LPI trains. The LPI cooler outlet throttle valves (LP-12, LP-14) and LPI header isolation valves (LP-17, LP-1 8) must be capable of being manually opened to provide assurance that flow can be established in a timely manner even if the capability to operate them from the control room is lost. Manually cycling each valve open demonstrates the ability to fulfill this function. This test is performed on an 18 month Frequency. Operating experience has shown that these components usually pass the Surveillance when performed at the this Frequency. Therefore, the Frequency is acceptable from a reliability standpoint.

OCONEE UNITS 1, 2, & 3 B 3.5.3-8 BASES REVISI ON B.AT- D O 106!05'014 Pr4JM TW.t

LPI B3.5.3 BASES (continued)

REFERENCES 1. 10 CFR 50.46.

2. UFSAR, Section 15.14.3.3.6.

3. UFSAR, Section 15.14.3.3.5.

4. 10 CFR 50.36.

5. NRC Memorandum to V. Stello, Jr., from R.L. Baer, "Recommended Interim Revisions to LCOs for ECCS Components," December 1, 1975.

6. ASME, Boiler and Pressure Vessel Code,Section XI, Inservice Inspection, Article IWV-3400.

7. NRC Safety Evaluation of Babook &Wilcox Owners Group (B&WOG) Topical Report BAW-2295, Revision 1, "Justification for the Extension of Allowed Outage Time for Low Pressure Injection and Reactor Building Spray systems," (TAC No. MA3807) dated J-une 3-0 , 1.999.

OCONEE UNITS 1,2, & 3 B 3.5.3-9 BA-ES, ,,,,,, DATED 9 ,f/0'.1 Am ep Dm euu -r Me9s.

ATTACHMENT 3 TECHNICAL JUSTIFICATION

Nuclear Regulatory Commission License Amendment Request No. 2001-005 Technical Justification October 24, 2002 Page 2 OVERVIEW AND DESCRIPTION OF CHANGES This License Amendment Request (LAR) proposes a change to the Condition "A" Completion Time given in the Oconee Nuclear Station (ONS) Technical Specifications (TS) Limiting Condition for Operation (LCO) 3.5.3, titled "Emergency Core Cooling Systems (ECCS), Low Pressure Injection 1 ." Presently, the Condition "A" Completion Time requires that one inoperable Low Pressure Injection (LPI) System train be restored to operable status within 72-hours. This LAR proposes revising this particular Completion Time from 72-hours to 7 days. The proposed change is also consistent with the guidance given in Technical Specification Task Force Change Traveler (TSTF 430), "AOT Extension to 7 days for LPI and Containment spray (BAW-2295-A, Rev. 1),"

presently awaiting final NRC approval.

By association, TS 3.5.2, ("Emergency Core Cooling Systems (ECCS), "High Pressure Injection") Condition "F' also requires a 72-hour Completion Time due to the LPI-HPI "piggyback" function. There is no change proposed to TS 3.5.2, Condition "F" since it was stated in the Topical that it was not the intent of the report to propose a similar Completion Time extension for the HPI system. Specifically, as stated in the Topical, "An extension of the AOT for HPI is not requestedat this time. While some plants' Technical Specifications have the AOT for the inoperableLPI train specified separately, otherplants' Technical Specificationsspecify a single AOT for one inoperable 'EGGS' train (i.e., combining LPI with HPI). Therefore, in the latter case, the LPI AOT will be split out from the EGGS AOT, that is, using the proposed seven-day AOT for LPI and retaining the current (e.g., 72-hour)AOT for an inoperableHPI train."

The unavailability of an LPI-HPI [piggyback] flow path due solely to an inoperable LPI train has been evaluated by the NRC in the topical report and the risk associated with this action has been determined to be acceptable for up to 7-days. As stated in the NRC SER for the topical, "The seven-day AOT will apply when the LPI (DHR) train is the only reason for the inoperabilityof the HP! train."

Also noteworthy is that for piggyback operation, TS 3.0.6 does not require entry into a supported system's Condition if the supporting system's Condition and Required Actions have been entered. Oconee Operators have been trained to track Technical Specification and Selected Licensee Commitments (SLCs) Completion Times using the Technical Specification Action Item Log (TSAIL) computer application. Depending on the TS Condition entered, TSAIL will automatically track the Condition requirements in addition to any TS 3.0.6 supported systems. In this instance, if a train of LPI is 1 Duke Power Company, Oconee Nuclear Station, Units 1, 2, and 3, Renewed Operating Licenses DPR-38, DPR-47, and DPR-55, "Appendix A, Technical Specifications," through Amendment 326/326/327, September 2002.

Nuclear Regulatory Commission License Amendment Request No. 2001-005 Technical Justification October 24, 2002 Page 3 inoperable, TSAIL will note the entry into the TS Condition (3.5.3 - Condition "A") and will simultaneously track its supported systems, i.e., TS 3.5.2 Condition "F" for piggyback operation.

With regards to the two LPI crossover valves, TS 3.5.3 Condition "B" requires that an inoperable crossover valve be restored within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The function of the LPI crossover valves is to provide flow to either LPI header following a core flood line break.

This function is dependent on both LPI trains being available and although an inoperable train of LPI would prevent these valves from performing their crossover function, it would not result in these valves themselves being inoperable and thus having to enter Condition "B." The TS 3.5.3 Condition "B" 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time requirement will not be changed to coincide with the LPI 7 day Completion Time request because the original Oconee risk analysis submitted in the topical, as reviewed and approved by the NRC, did not address the crossover function.

At times, one train of Reactor Building Spray (RBS) is impacted by LPI maintenance because of the common suction piping. However, the Oconee TS 3.6.5 Containment Systems- Reactor Building Spray and Cooling System, Condition "A", for one train of inoperable Reactor Building Spray, already contains a 7-day Completion Time.

Additionally, Condition "C" of TS 3.6.5 describes the condition of one Reactor Building Spray train and one Reactor Building Cooling Train inoperable with a 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time to restore one train to OPERABLE status. Condition "C" is outside the scope of the Topical Report for Oconee and its Completion Time is not being changed with this request.

DESCRIPTION OF CHANGE The following change is being proposed for NRC approval:

The Technical Specification 3.5.3, Condition "A" Completion Time will be changed from 72-hours to 7 days.

In association with this change request, the TS 3.5.3 Condition "A" BASES will be revised to reflect the proposed increase in the Completion Time. The current BASES states:

"With one LPI train inoperable in MODES 1, 2, or 3, the inoperable train must be returned to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based on NRC recommendations (Ref. 5) that are based on a risk evaluation and is a reasonable time for many repairs. This reliability analysis has shown the risk of having one LPI train inoperable to be sufficiently low to justify continued operation for 72

Nuclear Regulatory Commission License Amendment Request No. 2001-005 Technical Justification October 24, 2002 Page 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ."

The TS 3.5.3 Condition "A"BASES will be revised, as follows, with an additional reference added at the end of the BASES section:

"With one LPI train inoperable in MODES 1, 2, or 3, the inoperable train must be returned to OPERABLE status within 7 days. The 7 day Completion Time is based on the findings of the deterministic and probabilistic analysis in Reference 7. Reference 7 concluded that extending the Completion Time to 7 days for an inoperable LPI train improves plant operational flexibility while simultaneously reducing overall plant risk.

Specifically, the risk incurred by having the LPI train unavailable for a longer time at power will be substantially offset by the benefits associated with avoiding unnecessary plant transitions and by reducing risk during shutdown operations."

In addition, the TS 3.5.2 (High Pressure Injection) LCO BASES section will be revised for clarification purposes. Although both the LPI and HPI systems each have an individual Condition and required actions to take for an inoperable train (TS 3.5.3, Condition "A" and TS 3.5.2, Condition "C" respectively), in certain scenarios, the LPI system is credited with supplying emergency sump water to the HPI system for long term core cooling, i.e., "piggybacking." Clarification to the existing BASES is needed to better define the LPI-HPI interface boundary description.

The current TS 3.5.2 LCO BASES description states:

"Each LPI-HPI flow path includes the piping, instruments, valves and controls to ensure the capability to manually transfer suction to the reactor building sump (LPI-HPI flow path). Within the LPI-HPI flow path are the LPI discharge valves to the LPI-HPI flow path (LP-1 5 and LP-1 6). The LPI discharge valves to the LPI-HPI flow path must be capable of being manually (locally or remotely) opened for the LPI-HPI flow path to be OPERABLE. The OPERABILITY requirements regarding the LPI System are addressed in LCO 3.5.3, 'Low Pressure Injection (LPI)."'

The new description will read:

"Each LPI-HPI flow path includes the piping, instruments, valves and controls to ensure the capability to manually transfer suction to the reactor building sump (LPI-HPI flow path). Within the LPI-HPI flow path are the LPI discharge valves to the LPI-HPI flow path (LP-1 5 and LP-1 6). The LPI discharge valves to the LPI-HPI flow path must be capable of being manually (locally or remotely) opened for the LPI-HPI flow path to be OPERABLE. The OPERABILITY requirements regarding the LPI System are addressed in LCO 3.5.3, 'Low Pressure Injection (LPI).'

Nuclear Regulatory Commission License Amendment Request No. 2001-005 Technical Justification October 24, 2002 Page 5 As part of the LPI-HPI flow path, the piping, instruments, valves and controls upstream of LP-1 5 and LP-1 6 are part of the LPI system and are subject to LCO 3.5.3 (Low Pressure Injection system) requirements. The piping, instruments, valves and controls downstream of and including LP-1 5 and LP-1 6, are part of the HPI system and are subject to LCO 3.5.2 (High Pressure Injection system) requirements."

BASES FOR THE PROPOSED CHANGE The Framatome Technologies Topical Report BAW-2295A, Revision 1 (Hereafter noted as 'Topical Report"), provides the technical basis for the proposed changes to ONS Technical Specification (TS) 3.5.3 Emergency Core Cooling Systems (ECCS)- Low Pressure Injection (LPI), Condition "A." The Topical Report provides the deterministic evaluation and risk assessment to support the increase in the TS Completion Time, for one inoperable LPI train, from 72-hours to 7-days.

The proposed change will permit meaningful LPI System train maintenance to be performed with the unit at power and should result in an increase in the reliability of the LPI system components. The Topical Report used a plant specific Probabilistic Risk Assessment (PRA) to assess the risk impact of increased LPI System unavailability. The NRC staff evaluated this Topical Report and found the proposed increase in the LPI Completion Time acceptable in its Safety Evaluation 2 .

EFFECTS ON SAFETY Deterministic Evaluation The deterministic evaluation in the Topical Report consisted of a review of plant systems and safety functions impacted by entry into the LPI and RBS TS Completion Times. The affected LPI or RBS safety functions were quantitatively and qualitatively assessed. It was determined that no new accidents or transients would be introduced by the proposed changes.

No physical changes are being made to the LPI system, the LPI-HPI piggyback function, or LPI discharge header crossover valves. The function and operation of the LPI and HPI systems and the crossover valves will remain the same as described in the Oconee Nuclear Station Updated Final Safety Analysis Report (ONS UFSAR) 3.

2 Letter, NRC to Framatome Technologies,

Subject:

"Acceptance for Referencing of Ucensing Topical Report BAW 2295, Revision 1, Justification for Extension of Allowed Outage Time for Low-Pressure Injection and Reactor Building Spray systems," July 1999.

3 Duke Power Company, Oconee Nuclear Station, "Updated Final Safety Analysis Report (UFSAR)," through

Nuclear Regulatory Commission License Amendment Request No. 2001-005 Technical Justification October 24, 2002 Page 6 The impact on the proposed changes on the safety margins was also considered.

Extending the LPI Completion Time to 7-days for one inoperable train does not impact any assumptions or inputs in the UFSAR. The NRC found the deterministic evaluation acceptable.

Probabilistic Risk Assessment The probabilistic risk assessment used in the Topical Report to assess the impact of the proposed change is based upon similar measures defined in Regulatory Guides (RG) 1.1744 and RG 1.1775.

The risk impacts of the proposed change were calculated and compared against the acceptability guidelines as stated in the RGs. The Oconee base core damage frequency (CDF) from internal events is 2.61 E-05/yr. The overall CDF for the proposed change was 2.63E-05/yr for maintenance using the expected mean duration, and 2.64E-05/yr using the full 7-days duration. This resulted in a delta CDF (ACDF) for the proposed change of 2E-07/yr and 3E-07/yr respectively. In sensitivity analyses, the incremental or increase in CDF did not change appreciably when external events were included.

The Oconee base large early release frequency (LERF) from internal events is 1.070E 07/yr. The overall LERF for the proposed change was 1.072E-07/yr for maintenance using the expected mean duration, and 1.074E-07/yr using the full 7-days duration.

This resulted in a delta LERF (ALERF) for the proposed change of 2.OE-1 0/yr and 4.OE 10/yr respectively. In sensitivity analyses, the incremental or increase in LERF did not change appreciably when external events were included.

The calculated value of incremental conditional core damage probability (ICCDP) for the proposed change was 3.4E-07. The calculated value of incremental conditional large early release probability (ICLERP) for the proposed change was 4.4E-1 0. These values are considered small for a single TS Completion Time change when compared against the 5.OE-07 and 5.OE-08 RG 1.177 guideline values. The NRC SER 6 found the ICCDP values acceptable due to the following compensatory measures that lower the Revision 11, December 2001.

4NRC Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Current Licensing Basis," July 1998.

5 NRC Regulatory Guide 1.177, "An Approach for Plant-Specific, Risk-Informed Decision-making: Technical Specifications," August 1998.

6 Letter, NRC to Framatome Technologies,

Subject:

"Acceptance for Referencing of Licensing Topical Report BAW 2295, Revision 1, Justification for Extension of Allowed Outage Time for Low-Pressure Injection and Reactor Building Spray systems," July 1999.

Nuclear Regulatory Commission License Amendment Request No. 2001-005 Technical Justification October 24, 2002 Page 7 risk impacts:

"* Avoiding simultaneous outages of additional risk-significant components during the Completion Time of the LPI and RBS system trains. These components whose simultaneous outages are to be avoided, in addition to current TS requirements, include both Auxiliary Feedwater System (EWF) trains, both High Pressure Injection (HPI) trains (for reasons other than inoperable due to the associated LPI train), all three reactor building cooling (RBCU) trains, and their power supplies.

"* Defining specific criteria for scheduling only those preventive maintenance activities that can be completed within the 7 day Completion Time.

"* Assuring that the frequency of entry into the Condition and the average maintenance duration per year remain within the assumed values in the Topical Report.

"* Taking measures to assure that when maintaining the LPI and RBS trains, both are not made unavailable unless it is necessary.

Note: These four (4) compensatory measures will be put in-place prior to implementing the revision to the TS.

PRA Quality PRA Updates Duke's Severe Accident Analysis Group (SAAG) periodically evaluates changes to the plant with respect to the assumptions and modeling in the Oconee PRA. The original 1984 Oconee NSAC-60 PRA7 was a Level 3 PRA with internal and external events sponsored by the Electric Power Research Institute (EPRI) and Duke. The NRC contractor, Brookhaven National Laboratory (BNL), reviewed NSAC-60 and published its findings in NUREG/CR-4374 Vol. 1-38. In 1990, a large-scale review and update of the PRA resulted in the Individual Plant Examination Report (IPE) submitted to the NRC as part of Generic Letter 88-20 response 9 . The NRC reviewed the IPE submittal and documented its review in a NRC Evaluationl°.

"7.AProbabilistic Risk Assessment of Oconee Unit 3," NSAC-60, June 1984.

8 NUREG/CR-4374, Vol. 1-3, "A Review of the Oconee-3 Probabilistic Risk Assessment," Brookhaven National Laboratory, March 1986.

"9Oconee Nuclear Station Unit s 1, 2, and 3, IPE Submittal ReportDuke Power Company, November 30, 1990.

10 NRC Letter to Duke Power Company, "Examination of the Oconee, Units 1,2 and 3 Individual Plant examination for examination (IPE) - Internal Events Submittal," April 1, 1993.

Nuclear Regulatory Commission License Amendment Request No. 2001-005 Technical Justification October 24, 2002 Page 8 In 1995, Oconee initiated Revision 2 of the 1990 IPE and provided the results to the NRC in 199711. Currently, Revision 3 of the Oconee PRA is underway. This update, which is a comprehensive revision to the PRA models and associated documentation, is expected to be completed at the end of 2002. The objectives of this update are as follows:

"* To ensure the models comprising the PRA accurately reflect the current plant, including its physical configurations, operating procedures, maintenance practices, etc.

"* To review recent operating experience with respect to updating the frequency of plant transients, failure rates, and maintenance unavailability data.

"* To correct items identified as errors and implement PRA enhancements as needed.

"* To address weaknesses identified in the recent Oconee PRA Peer Review.

"* To utilize updated Common Cause Analysis data and Human Reliability Analysis data.

PRA maintenance encompasses the identification and evaluation of new information into the PRA and typically involves minor modifications to the plant model. PRA maintenance and updates, as well as guidance for developing PRA data and evaluation of plant modifications, are governed by Workplace Procedures. In January 2001, an enhanced configuration control process was implemented to more effectively track, evaluate, and implement PRA changes to better ensure the PRA reflects the as-built, as-operated plant.

A review of the changes being made to the Revision 3 LPI PRA model indicated that the results of the analysis, as documented in the Topical Report remain valid.

Peer Review Process Between May 7-11, 2001, Oconee participated in the B&W Owners Group (B&WOG)

PRA Certification Program. This review followed a process that was originally developed and used by the Boiling Water Reactor Owners Group (BWROG) and subsequently broadened to be an industry-applicable process through the Nuclear Energy Institute Risk Applications Task Force. The resulting industry document, NEI 00-022 , describes the overall PRA peer review process. The Certification/Peer Review process is also linked to the ASME PRA Standard13 .

"I "Probabilistic Risk Assessment Individual Plant Examination," Oconee Nuclear Site letter to NRC, February 13, 1997.

12 NEI-00-02, "Industry PRA Peer Review Process," Nuclear Energy Institute, January 2000.

"13"Standard For Probabilistic Risk Assessment for Nuclear Power Plant Applications," ASME RA-S-2002, 4/2002.

Nuclear Regulatory Commission License Amendment Request No. 2001-005 Technical Justification October 24, 2002 Page 9 The objective of the PRA Peer Review process is to provide a method for establishing the technical quality and adequacy of a PRA for a range of potential risk-informed plant applications for which the PRA may be used. The PRA Peer Review process employs a team of PRA and system analysts who possess significant expertise in PRA development and PRA applications. The team uses checklists to evaluate the scope, comprehensiveness, completeness and fidelity of the PRA being reviewed. One of the key parts of the review is an assessment of the maintenance and update process to ensure the PRA reflects the as-built plant.

The review team for the Oconee PRA Peer Review consisted of six members. Three of the members were PRA personnel from other utilities. The remaining three were industry consultants. Reviewer independence was maintained by assuring that none of the six individuals had any involvement in the development of the Oconee PRA or IPE.

The Peer Review team noted that the Oconee PRA had a strong foundation laid in NSAC-60 and the IPE and that the full scope Level 3 PRA with external events should support a wide range of applications. A summary of some of the Oconee PRA strengths and areas for enhancement from the peer review are as follows:

Strengths

"* Results summary and insights

"* Uncertainty/sensitivity analysis

"* Time dependent RCP seal LOCA/SBO treatment

"* Delineation of small LOCA contributors

"* Bayes' update of failure data validated

"* Detailed analysis of hydroelectric plant

"* Strong maintenance and update process

"* Thorough system notebooks with good detail, separate quantification, clear boundaries, and tie to service experience Areas for Enhancement

"* Improved basis for identifying and screening support system initiators

"* Enhanced documentation of dependencies

"* Enhanced guidance and documentation for event sequence quantification

"* Enhanced completeness and accountability of common cause failures

"* Enhanced treatment of dependencies and time basis for human reliability

"* Improved justification for assumptions and calculations impacting LERF

"* Enhanced documentation of screening of containment isolation and bypass pathways

Nuclear Regulatory Commission License Amendment Request No. 2001-005 Technical Justification October 24, 2002 Page 10 w Enhanced documentation of standby test intervals The significance levels of the B&WOG Peer Review Certification process have the following definitions:

A. Extremely important and necessary to address to ensure the technical adequacy of the PRA, the quality of the PRA, or the quality of the PRA update process.

B. Important and necessary to address but may be deferred until the next PRA update.

The Oconee PRA received 4 "A" and 35 "B" fact and observation findings during its peer review. All four of the "A" findings have been addressed and are being incorporated into Oconee PRA Rev. 3 update that is nearing completion. Many of the "B" findings have been incorporated as well.

PRA Quality Assurance Methods Approved workplace procedures address the quality assurance of the PRA. One way the quality assurance of the Oconee PRA is ensured is by maintaining a set of system notebooks on each of the PRA systems. Each system PRA analyst is responsible for updating a specific system model. This update consists of a comprehensive review of the system including drawings and plant modifications made since the last update as well as implementation of any PRA change notices that may exist on the system. The analyst's primary focal point is with the system engineer at the site. The system engineer provides information for the update as needed. The analyst will review the PRA model with the system engineer and as necessary, conduct a system walkdown with the system engineer. This interaction is documented in a memorandum.

The system notebooks contain, but are not limited to, documentation on system design, testing and maintenance practices, success criteria, assumptions, descriptions of the reliability data, as well as the results of the quantification. The system notebooks are reviewed and signed off by a second independent person and are approved by the manager of the group.

When any change to the PRA is identified, the same three-signature process of identification, review, and approval is utilized to ensure that the change is valid and that it receives the proper priority.

Nuclear Regulatory Commission License Amendment Request No. 2001-005 Technical Justification October 24, 2002 Page 11 Maintenance Rule Configuration Control 10 CFR 50.65 (a)(4), RG 1.18214, and NUMARC 93-0115 require that prior to performing maintenance activities, risk assessments shall be performed to assess and manage the increase in risk that may result from proposed maintenance activities. These requirements are applicable for all plant modes. NUMARC 91-0616 requires utilities to assess and manage the risks that occur during the performance of outages.

Duke has several Work Process Manual procedures and Nuclear System Directives that are in place at the Oconee Nuclear Station to ensure the requirements of the Maintenance Rule are implemented. The key documents are as follows:

"* Nuclear System Directive 415, "Operational Risk Management (Modes 1-3) per 10 CFR 50.65 (a.4)," Revision 1, April 2002.

"* Nuclear System Directive 403, "Shutdown Risk Management (Modes 4, 5, 6, and No-Mode) per 10 CFR 50.65 (a.4)," Revision 10, September 2002.

"* Work Process Manual, WPM-609, "Innage Risk Assessment Utilizing ORAM SENTINEL," Revision 6, July 2002.

"* Work Process Manual, WPM-608, "Outage Risk Assessment Utilizing ORAM SENTINEL," Revision 6, July 2002.

The documents listed above are used to address the Maintenance Rule requirement and the on-line (and off-line) Maintenance Policy requirement to control the safety impact of combinations of equipment removed from service. More specifically, the Nuclear System Directives address the process, define the program, and state individual group responsibilities to ensure compliance with the Maintenance Rule.

The Work Process Manual procedures provide a consistent process for utilizing the computerized software assessment tool, ORAM-SENTINEL, which manages the risk associated with equipment inoperability. ORAM-SENTINEL is a Windows-based computer program designed by the Electric Power Research Institute as a tool for plant 14 NRC Regulatory Guide 1.182, "Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants," May 2000.

15 NUMARC 93-01, "Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants,"

March 2000.

16 NUMARC 91-06, "Guidelines for Industry Actions to Assess Shutdown Management," December 1991.

Nuclear Regulatory Commission License Amendment Request No. 2001-005 Technical Justification October 24, 2002 Page 12 personnel to use to analyze and manage the risk associated with all risk significant work activities including assessment of combinations of equipment removed from service. It is independent of the requirements of Technical Specifications and Selected Licensee Commitments.

The ORAM-SENTINEL models for Oconee are based on a "blended" approach of probabilistic (the full Oconee Revision 2 PRA model is utilized) and traditional deterministic approaches. The results of the risk assessment include a prioritized listing of equipment to return to service, a prioritized listing of equipment to remain in service, and potential contingency considerations.

ATTACHMENT 4 NO SIGNIFICANT HAZARDS CONSIDERATION

Nuclear Regulatory Commission License Amendment Request No. 2001-005 No Significant Hazards Consideration October 24, 2002 Page 2 Pursuant to 10 CFR 50.91, Duke Energy Corporation (Duke) has made the determination that this amendment request involves a No Significant Hazards Consideration by applying the standards established by the NRC regulations in 10 CFR 50.92. This ensures that operation of the facility in accordance with the proposed amendment would not:

1. Involve a significant increase in the probability or consequences of an accident previously evaluated, since, as demonstrated in the Babcock and Wilcox Owners Group's Topical Report BAW-2295A, Revision 1, "Justification for Extension of Allowed Outage Time for Low Pressure Injection and Reactor Building Spray Systems," no accident initiators, conditions, or assumptions are affected by the proposed changes.

The proposed changes to the TS 3.5.3 LCO and TS 3.5.2 and TS 3.5.3 Bases reflect the rationale for the associated Completion Time change and do not affect the probability or consequences of an accident. In addition, the proposed changes do not alter the source term, containment isolation, or allowable radiological releases.

2. Create the possibility of a new or different kind of accident from any previously evaluated because no new failure mode or transient is introduced since the proposed changes do not involve a plant modification (no new or different type of equipment will be installed) or allow operation of any plant systems, structures, or components in a manner not addressed in the ONS design basis accident analysis.

3. Involve a significant reduction in the margin of safety because extending the LPI Completion Time to 7 days for one inoperable train does not impact any assumptions or inputs in the ONS UFSAR. The proposed changes will permit meaningful LPI System train maintenance to be performed with the unit at power and should result in an increase in the reliability of the LPI system components. The changes have been evaluated by the NRC and determined to be safe from a risk perspective.

L ATTACHMENT 5 ENVIRONMENTAL IMPACT ANALYSIS

Nuclear Regulatory Commission License Amendment Request No. 2001-005 Environmental Impact Analysis October 24, 2002 Page 2 Pursuant to 10 CFR 51.22(b), an evaluation of the license amendment request (LAR) has been performed to determine whether or not it meets the criteria for categorical exclusion set forth in 10 CFR 51.22(c)9 of the regulations. The proposed changes outlined in this LAR do not involve:

1. A significant hazards consideration.

This conclusion is supported by the determination of no significant hazards contained in Attachment 4.

2. A significant change in the types or significant increase in the amounts of any effluents that may be released offsite.

This LAR does not make physical changes to the plant. The plant will continue to operate as before. Therefore, this LAR will not change the types or amounts of any effluents that may be released offsite.

3. A significant increase in the individual or cumulative occupational radiation exposure.

This LAR does not make physical changes to the plant. The plant will continue to operate as before. Therefore, this LAR will not increase the individual or cumulative occupational radiation exposure.

Accordingly, the proposed changes meet the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22 (c)(9). Therefore, pursuant to 10 CFR 51.22(b), an environmental impact assessment of the proposed changes is not required.

ML023110076

Contents

Text

Subject:

Subject:

Subject:

Navigation menu

ML023110076

Text

Subject:

Subject:

Subject:

Navigation menu

Search