ML023600217

Proposed Risk-Informed Technical Specifications Change Extended Inverter Allowed Outage Time

ML023600217
Person / Time
Site:	North Anna
Issue date:	12/13/2002
From:	Hartz L Virginia Electric & Power Co (VEPCO)
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
-nr, 02-758, NAPS/JHL, RG-1.174
Download: ML023600217 (31)

Text

VIRGINIA ELECTRIC AND POWER COMPANY RICHMOND, VIRGINIA 23261 December 13, 2002 U.S. Nuclear Regulatory Commission Serial No.02-758 Attention: Document Control Desk NAPS/JHL Washington, D.C. 20555 Docket Nos. 50-338/339 License Nos. NPF-4/7 Gentlemen:

VIRGINIA ELECTRIC AND POWER COMPANY NORTH ANNA POWER STATION UNITS I AND 2 PROPOSED RISK-INFORMED TECHNICAL SPECIFICATIONS CHANGE EXTENDED INVERTER ALLOWED OUTAGE TIME Pursuant to 10 CFR 50.90, Virginia Electric and Power Company (Dominion) requests an amendment to Facility Operating License Numbers NPF-4 and NPF-7 in the form of a change to the Technical Specifications for North Anna Power Station Units 1 and 2.

The proposed change revises the Completion Time of Required Action A.1 of Technical Specification 3.8.7, Inverter - Operating, from 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to 14 days for an inoperable inverter.

This Technical Specification change has been prepared in accordance with the guidance provided in Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment In Risk Informed Decisions on Plant Specific Changes to the Licensing Basis" and Regulatory Guide 1.177, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications." A discussion of the proposed change and the associated supporting risk assessment are included in Attachment 1. Attachment 2 includes the Probabilistic Risk Assessment (PRA) Peer Assessment A & B Level Findings and Observations. The Technical Specification marked-up page that reflects the proposed change and the Technical Specification page that incorporates the proposed change are provided in Attachments 3 and 4, respectively. In addition, Technical Specification Bases changes, reflecting the proposed change to the Completion Time of Required Action A.1 of Technical Specification 3.8.7, are included for information only. The Technical Specification Bases will be revised in accordance with the Technical Specification Bases Control Program, Technical Specification 5.5.13, following NRC approval of the license amendment.

The proposed changes have been reviewed and approved by the Station Nuclear Safety and Operating Committee and the Management Safety Review Committee.

In accordance with the requirements of 10 CFR 50.92, the enclosed application is judged to involve no significant hazards. In addition, the proposed change has been AQ'

determined to qualify for categorical exclusion from an environmental assessment as set forth in 10 CFR 51.22(c)(9). The basis for these determinations is included in .

NRC approval of the proposed Technical Specification changes is requested by December 15, 2003. Once approved the amendment will be implemented within 30 days. Should you have any questions or require additional information, please contact us.

Very truly yours, Leslie N. Hartz Vice President - Nuclear Engineering Commitments made is this letter: None Attachments:

1. Discussion of Change

2. PRA Peer Assessment A & B Level Findings and Observations

3. Mark-up of Technical Specifications

4. Proposed Technical Specifications cc: U.S. Nuclear Regulatory Commission Region II Sam Nunn Atlanta Federal Center 61 Forsyth Street, SW Suite 23 T85 Atlanta, Georgia 30303 Mr. M. J. Morgan NRC Senior Resident Inspector North Anna Power Station Commissioner Bureau of Radiological Health 1500 East Main Street Suite 240 Richmond, VA 23218

SN: 02-758 Docket Nos.: 50-338/339

Subject:

Proposed Risk-Informed TS Change Extended Inverter Allowed Outage Time COMMONWEALTH OF VIRGINIA )

)

COUNTY OF HENRICO )

The foregoing document was acknowledged before me, in and for the County and Commonwealth aforesaid, today by Leslie N. Hartz, who is Vice President - Nuclear Engineering, of Virginia Electric and Power Company. She has affirmed before me that she is duly authorized to execute and file the foregoing document in behalf of that Company, and that the statements in the document are true to the best of her knowledge and belief.

Acknowledged before me this 13th day of December, 2002.

My Commission Expires: March 31, 2004.

Notary Public

Attachment I Discussion of Change North Anna Power Station Units I and 2 Virginia Electric and Power Company (Dominion)

Discussion of Change 1.0 Introduction Pursuant to 10 CFR 50.90, Virginia Electric and Power Company (Dominion) requests an amendment to Facility Operating License Numbers NPF-4 and NPF-7 in the form of changes to the Technical Specifications (TS) for North Anna Power Station Units 1 and

2. The proposed change will revise the Completion Time of Required Action A.1 of TS 3.8.7, Inverters - Operating, from 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to 14 days for an inoperable inverter. The proposed change is based on a risk-informed evaluation performed in accordance with Regulatory Guides (RG) 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions On Plant-Specific Changes to the Licensing Basis", and 1.177, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications." The risk-informed evaluation concludes that the increase in annual core damage and large, early release frequencies associated with the proposed change are 8.1E-8 and 4.6E-10, respectively, which are characterized as "very small changes" by RG 1.174. The incremental conditional core damage and large, early release probabilities associated with the proposed change are 2.OE-8 and 1.1E-10, respectively, which are within the acceptance criteria in RG 1.177.

The proposed change provides greater operational flexibility for on-line repair or replacement of an inoperable inverter. The proposed change would improve instrument bus inverter availability during shutdown modes or conditions. The proposed change could also enhance equipment reliability by allowing inverter replacement to be completed in a more timely manner rather than extending the replacement over several refueling outages. This would also reduce the refueling outage duration. Additionally, the proposed change would avert an unplanned shutdown of the plant if an inverter is inoperable because it could take longer to repair or replace and test an inoperable inverter than the current 24-hour Completion Time and eliminate the administrative burden of requesting a notice of enforcement discretion from the NRC.

Use of the 14-day Completion Time will be minimized. Scheduling and performing maintenance and surveillance testing on the unit with a vital bus supplied from its voltage regulating transformer will be evaluated and controlled in accordance with 10CFR50.65(a)(4), Maintenance Rule.

TS Bases changes, reflecting the proposed changes to the Completion Time of Required Action A.1 of TS 3.8.7, are included for information only. The TS Bases will be revised in accordance with the TS Bases Control Program, TS 5.5.13 following NRC approval of the license amendment.

2.0 Background The Vital AC Power System provides a highly reliable source of 120 VAC electric power for safety-related instruments and equipment. The system consists of four separate vital bus panels, each fed independently from an associated 125 VDC/120 VAC, single phase static inverter. The inverters are normally powered from the station battery

chargers via the 125 VDC system. In the event AC power to the battery chargers is lost, each inverter is automatically fed from its associated station battery without disturbing the vital bus voltage or frequency, providing an uninterruptible power source for the instrumentation and controls of the Reactor Protection System and Engineered Safety Feature Actuation System. The inverters are the preferred source of power for the AC vital buses because of the stability and reliability they provide.

The vital bus panels 1-1 and 1-111 supply 120 VAC power to safety trains A and B, respectively. All four vital bus panels 1-1, 1-11, 1-111, and 1-IV supply 120 VAC power to the safety system channels 1,11, 111, and IV, respectively. A similar configuration is applicable to Unit 2.

The 2-1 and 2-11 inverters and associated voltage regulating transformers were replaced with safety-related, Class 1E equipment during the 2002 Unit 2 refueling outage. The other vital buses contain non-safety, non-IE Class voltage regulating transformers fed from IE Class 480 VAC emergency buses to supply a nominal 120 VAC to vital bus panels in the event either panel's respective inverter fails or is undergoing maintenance.

The voltage regulating transformers are designated as seismic only from the standpoint that during a seismic event, the transformers are restrained so they will not adversely affect any other safety-related equipment in the area. The subject transformers were evaluated in accordance with EPRI NP-6041-SL Revision 1 in the North Anna Seismic Individual Plant Examination of External Events (IPEEE). The evaluation included consideration of criteria in EPRI NP-6041, Table 2-4, and a walk down and inspection by a Seismic Review Team, consisting of at least two trained Seismic Capability Engineers. The results of the walkdown and inspection were documented in Screening Evaluation Worksheets. While the EPRI seismic evaluation process is not suitable for qualifying these transformers from a design perspective, it is recognized as an acceptable means to determine the seismic intensity at which the transformers' are judged to have a high confidence (95%) of not failing from the event. The seismic margins method utilized in the North Anna seismic IPEEE screens out components having a seismic capacity (i.e., HCLPF - High Confidence of Low Probability of Failure) greater than or equal to 0.3g based on the seismic hazard for the North Anna site.

These transformers were evaluated and screened out of the analysis based on a HCLPF greater than or equal to 0.3. Therefore, reliance on these transformers for vital bus power during inverter outages is not considered a seismic risk.

During the 2002 Unit 2 refueling outage, the 2-1 and 2-11 inverters were replaced with equipment that has the capability of automatically transferring to the voltage regulating transformer on loss of power. The other Unit 1 and 2 inverters have manual bypass switches to transfer the load of vital bus panels from the inverters to the voltage regulating transformers. Upon a Loss of Offsite Power, a vital bus that is being powered by the voltage regulating transformer will de-energize for approximately 10 seconds until the associated Emergency Diesel Generator re-energizes the emergency bus. A complete loss of offsite power, which is a bounding case in the enclosed PRA analysis, would result in a shutdown of both units due to a loss of secondary plant equipment and power to the Reactor Coolant Pumps (RCPs). A partial loss of offsite power affecting emergency bus power has been a rare occurrence at North Anna and switchyard maintenance is carefully controlled by the maintenance rule planning and scheduling process. For the case of a partial loss of offsite power to an emergency bus the

following describes the major impact on plant operations. If vital bus 1-1, 1-111, 2-1, or 2 III is supplied from a voltage regulating transformer the momentary interruption in power will impact the operation of numerous trip valves, equipment controllers and indications.

For vital bus I, the major impact on the unit will be a loss of condenser vacuum and a loss of cooling water to the RCPs. When the diesel generator restores power, equipment can be realigned using operations procedures without resulting in a unit shutdown. For vital bus III, the temporary loss of power impacts the operation of numerous trip valves and causes a main feed regulating valve controller to receive a close signal. Cooling to the RCPs will be lost but can be restored. The operators will not likely be able to restore steam generator water level to the affected generator in time to prevent an automatic reactor shutdown. There is no major impact from a momentary loss of power to vital bus II or IV.

A large majority of the Reactor Protection System and Engineered Safety Feature Actuation System is de-energize to actuate. The momentary interruption in power to the vital bus will cause that channel to actuate, but the two-out-of-three and two-out-of-four logic will provide the defense in depth to prevent a safety system actuation. The Containment Depressurization Actuation (CDA) logic and the Refueling Water Storage Tank (RWST) low-level switchover to the containment sump logic will go from two-out of-four to two-out-of-three, since they are both energize to actuate. There are also some low power reactor trips that are in place during startup and shutdown, which actuate on one-out-of-two Reactor Protection System logic. With a momentary loss of power to certain vital busses (i.e., 1-1, 1-11, 2-1, and 2-11) when the plant is in low power operations, a reactor trip will occur. This additional risk due to tripping the plant at this power level is small and manageable.

The normal preventative maintenance that occurs on the inverter once every refueling outage can be performed within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The normal preventative maintenance that occurs once every six refueling outages can typically be performed within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />. All of the control cards and capacitors that control the output voltage are replaced at this time. Every time the inverter is de-energized for longer than 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, a warm-up period of approximately 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> is required to allow the voltage to stabilize within the regulating band. Sometimes when the capacitors are replaced, the regulating band may shift to the point that the voltage becomes too low or high and several capacitors may have to be replaced to bring the voltage band back to nominal. This is only discovered after the 15-hour warm-up period, which can have a major impact on the refueling outage schedule. This can also become a factor during the set-up (tuning) process of a new inverter or as a result of extensive on-line repairs on an existing inverter.

If the constant voltage transformer (CVT), which is a component of the inverter, fails and requires replacement on line, the maintenance evolution would take 5 to 7 days, which far exceeds the 24-hour Completion Time for an inoperable inverter per TS 3.8.7. Due to the age of the inverters, an inverter replacement project is being developed to replace all of the inverters. The projected time to replace each inverter is 7 to 14 days. Inverter replacement would have a major adverse impact on a refueling outage schedule even if only one inverter were scheduled for the replacement.

The 24-hour Completion Time for an inoperable inverter creates an unnecessary burden. The TS Bases for the Completion Time states, "the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> limit is based upon engineering judgement, taking into consideration the time required to repair an inverter and the additional risk to which the unit is exposed because of the inverter inoperability."

The burden of performing on-line repair or replacement of a failed inverter is credible because the time to troubleshoot, repair/replace, warm up, and test the inverter properly will exceed the 24-hour Completion Time. Extending the Completion Time for an inoperable inverter to 14 days will:

1) Eliminate an unplanned shutdown of the plant or the administrative burden of requesting a notice of enforcement discretion.

2) Provide additional time to complete repairs when components fail with the plant in the Applicability of TS 3.8.7 (i.e., Modes I - 4).

3) Improve instrument bus inverter availability during shutdown modes or conditions.

4) Provide time to perform additional maintenance activities in Modes 1 - 4 to reduce plant down time. This also allows the inverter replacement project to be completed in a more timely manner rather than extending the replacement over several refueling outages, which should enhance overall equipment reliability. Furthermore, the proposed change reduces the length of refueling outages.

5) Provide increased time to troubleshoot and complete inverter repair/replacement in a more controlled manner, which will enhance equipment and personnel safety.

3.0 Description of Change The proposed change will revise the Completion Time of Required Action A.1 of TS 3.8.7, Inverters - Operating, from 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to 14 days for an inoperable inverter. The proposed change is based on a risk-informed analysis in accordance with Regulatory Guides 1.174 and 1.177. TS Bases changes, reflecting the proposed changes to the Completion Time of Required Action A.1 of TS 3.8.7, are included for information only.

The TS Bases will be revised in accordance with the TS Bases Control Program, TS 5.5.13 following NRC approval of the license amendment.

4.0 Technical Analysis A risk-informed evaluation of the acceptability of plant operation with one inverter inoperable for 14 days was performed in accordance with Regulatory Guides 1.174 and 1.177. The Tier 1 and Tier 2 results are provided below. Tier 3 requirements ensure that the risk impact of out-of-service equipment is evaluated prior to performing any maintenance activity and is met by the Maintenance Rule Program as required by 1 OCFR50.65(a)(4).

The North Anna WinNUPRA NOAA model was used for the calculation of inverter importance in this evaluation. This model was deemed suitable for use in this risk informed application based on the Industry Peer Certification Process review of the North Anna Probabilistic Risk Assessment (PRA) model. A review of the Industry Peer Certification Process Findings and Observations (F&Os) was performed to ensure that none of the F&Os would invalidate the results of this evaluation. Attachment 2 contains a matrix with the A and B significance level F&Os from the North Anna PRA Peer Assessment.

4.1 Method of Analysis - Tier 1: PRA Capability and Insights 4.1.1 Best Estimate Analysis First, the importances of the two safety system train (Train H and J) inverters were calculated to provide a perspective on the importance of the inverters in the overall model and determine which inverter was the most important. The importance measures calculated for each Train H and J inverter were:

"* Risk Achievement Worth (RAW)

"* Fussell-Vesely (FV)

The inverter with the highest RAW and FV importances was identified and assessed in the following calculations specified by Regulatory Guides 1.174 and 1.177:

"* Baseline Core Damage Frequency (CDF) and Large Early Release Frequency (LERF) (with nominal expected equipment unavailabilities, except the subject inverter test and maintenance unavailability is set to zero)

"* Conditional CDF and LERF with subject inverter unavailable

"* Incremental conditional core damage probability (ICCDP) = (Conditional CDF minus baseline CDF) times duration of proposed Completion Time

"* Incremental conditional large, early release probability (ICLERP) = (Conditional LERF minus baseline LERF) times duration of proposed Completion Time

"* Yearly Condition Time CDF and LERF risk (ICCDP and ICLERP times the frequency of Condition Time use per year)

In the baseline CDF and LERF calculations, the nominal test and maintenance unavailabilities were included, except for the highest importance inverter test and maintenance unavailability, which was set to zero. In the conditional CDF and LERF calculations, the basic event probabilities for inverter test and maintenance were all set to zero, except for the highest importance inverter, which was set to logical "TRUE".

All calculations used a truncation limit of 1E-12 for event tree sequence and final cutset quantification. The LERF calculation was performed by updating the basic event data file to reflect the conditional probabilities for each LERF sequence and requantifying the CDF equation file using this modified basic event data file.

4.1.2 Sensitivity Analysis Sensitivity analyses were performed to ensure that the conclusions of the analysis would not change if parameters potentially affecting the calculation results were changed to reflect the range of uncertainty in those parameters. The figures of merit from the sensitivity analyses were ICCDP/ICLERP values and total increase in CDF/LERF. The sensitivity analyses performed included:

"* Increase all human error recovery events by a factor of 10. This case addresses the following Industry Peer Certification Process F&Os listed in Attachment 2: HR 03, HR-05, HR-10 and TH-04.

"* Increase all the voltage regulating transformer failure rates by a factor of 10. This case addresses the uncertainty in the failure rates of the backup power to the vital buses.

"* Increase the loss of offsite power initiator frequency by a factor of 10. This case addresses the uncertainty in the reliability of the offsite power system and dependence of a vital bus on the emergency diesel generators via a voltage regulating transformer when its inverter is unavailable.

"* Increase the failure probability of the other available inverters to a conservative common cause beta factor of 0.05. This case addresses the potential for common cause failure of any of the other inverters when Inverter 1-1 is unavailable due to corrective maintenance. This case also addresses the uncertainty in the random failure rate of the inverters since generic industry failure rates are used for these components.

4.1.3 Tier 1 Results: PRA Capability and Insights 4.1.3.1 Best Estimate Analysis The RAW and FV importances for each of the inverters were calculated using the WinNUPRA software with a truncation limit of 1E-12 for event trees sequences and final cutset quantification. The results of the calculation are provided in Table 4-1.

This calculation demonstrates the low importance of the inverters in the baseline model. The highest importance inverter is Inverter 1-1. Inverter 1-1 is the most risk significant inverter since Vital Bus 1-1 supports more safety significant loads than any other vital bus. The combination of loads unique to Vital Bus 1-1 include: the main control board solenoid operated valve (SOY) panel Train A, component cooling trip valves for Residual Heat Removal (RHR) and Reactor Coolant Pumps (RCPs), and the Reactor Coolant System (RCS) pressure interlock for an RHR suction valves.

Table 4-1 Risk Importances of Train H and J Inverters Risk Importance Metric Inverter 1-1 Inverter 1-11 Inverter 1-111 Inverter l-IV CDF RAW 1.06 1.03 1.03 1.0 CDF FV 1.3E-5 6.9E-6 6.4E-6 <1E-7 LERF RAW 1.16 1.16 1.0 1.0 LERF FV 3.5E-5 3.5E-5 7.6E-8 <1 E-7

The risk calculations prescribed by Regulatory Guide 1.174 and 1.177 were then performed for Inverter 1-1 and the results are documented in Table 4-2.

In the baseline case, the basic event data file containing three-year average test and maintenance unavailabilities was modified as follows:

• The inverter test and maintenance failure event 1VBINV-TM-1-1 was set to a failure probability of zero.

In the conditional case, the basic event data file used in the baseline case was modified as follows:

" The inverter test and maintenance failure event 1VBINV-TM-1-1 was set to logical "failure".

" The inverter test and maintenance failure events 1VBINV-TM-1-ll, 1VBINV-TM-1 Ill, and .IVBINV-TM-1-IV were set to a failure probability of zero, since two or more inverters cannot be unavailable at the same time without requiring a unit shutdown per the technical specifications.

Table 4-2 Condition Time Risk Calculations for Inverter 1-I Calculation (for Inverter 1-1) Core Large Early Damage Release Risk Risk Baseline CDF/LERF (/yr) with inverter in service 1.083E-5 1.416E-6 Conditional CDF/LERF with inverter unavailable (/yr) 1.136E-5 1.419E-6 ICCDP/ILERP (Single Condition Time Risk) 2.OE-8 1.1E-10 Yearly Condition Time Risk (based on one 14 day 8.1E-8 4.6E-10 outage every year per inverter)

Meets RG 1.177 and RG 1.174 acceptance criteria Yes Yes The results indicate that Inverter 1-1 meets the acceptance criteria of 5E-7 for ICCDP and 5E-8 for ICLERP in Regulatory Guide 1.177, and the acceptance criteria of 1E-6 per year for CDF increases and 1E-7 per year for LERF increases in Regulatory Guide 1.174.

4.1.4 Sensitivity Analyses 4.1.4.1 Increase Probability of All Post-initiator Human Error Events by a Factor of 10 In this sensitivity case, the probability of all the post-initiator human error events was increased by a factor of 10, or to a maximum of 1.0, whichever is less. The modified events included the recovery event HEP-0AP10, which addresses realignment of a vital bus from its normal source (i.e., inverter) to its voltage regulating transformer. The baseline and conditional CDF/LERF calculations for this case using a event tree and

final cutset truncation limit of 1E-12 resulted in more than 60,000 cutsets, which exceeded the capability of the WinNUPRA software. Therefore, the event tree and final cutset truncation limit was changed to 1E-1 1 for this sensitivity, resulting in greater than 15,000 cutsets in the results. The results of this calculation are provided in Table 4-3.

Table 4-3 Condition Time Sensitivity Calculations for Inverter 1-1 Increase Probability of all Post Initiator Human Error Events by a Factor of 10 Calculation (for Inverter 1-1) Core Large Early Damage Release Risk Risk Baseline CDF/LERF (/yr) 4.141E-4 3.508E-5 Conditional CDF/LERF with inverter unavailable (/yr) 4.174E-4 3.508E-5 ICCDP/ILERP (Single Condition Time Risk) 1.3E-7 <1E-8 Yearly Condition Time Risk (based on one 14 day 5.1 E-7 <4E-8 outage every year per inverter)

Meets RG 1.177 and RG 1.174 acceptance criteria Yes Yes The results indicate that Inverter 1-1 meets the acceptance criteria of 5E-7 for ICCDP and 5E-8 for ICLERP in Regulatory Guide 1.177, and the acceptance criteria of 1E-6 per year for CDF increases and I E-7 per year for LERF increases in Regulatory Guide 1.174.

4.1.4.2 Increase All Voltage Regulating Transformer Failure Rates by a Factor of 10 In this sensitivity case, the failure rates for the voltage regulating transformer were all increased by a factor of 10 to address uncertainty in the reliability of the voltage regulating transformer. The affected basic events were 1EETFM-LP-79A, 1EETFM LP-79B, and 1EETFM-LP-80. The results of this calculation are provided in Table 4-4.

Table 4-4 Condition Time Sensitivity Calculations for Inverter 1-1 Increase All Voltage Regulating Transformer Failure Rates by a Factor of 10 Calculation (for Inverter 1-1) Core Large Early Damage Release Risk Risk Baseline CDF/LERF (/yr) 1.083E-5 1.416E-6 Conditional CDF/LERF with inverter unavailable (/yr) 1.136E-5 1.421 E-6 ICCDP/ILERP (Single Condition Time Risk) 2.0E-8 1.9E-10 Yearly Condition Time Risk (based on one 14 day 8.1E-8 7.7E-10 outage every year per inverter)

Meets RG 1.177 and RG 1.174 acceptance criteria Yes Yes

The results indicate that Inverter 1-1 meets the acceptance criteria of 5E-7 for ICCDP and 5E-8 for ICLERP in Regulatory Guide 1.177, and the acceptance criteria of 1E-6 per year for CDF increases and 1E-7 per year for LERF increases in Regulatory Guide 1.174.

4.1.4.3 Increase Loss of Offsite Power Frequency by a Factor of 10 In this sensitivity case, the frequency of the loss of offsite power initiating event was increased by a factor of 10 to address uncertainty in the reliability of the voltage regulating transformer. The voltage regulating transformer is fed from offsite power during normal operation, and from the emergency diesel generators following a loss of offsite power. The affected basic event is IE-T1. The results of this calculation are provided in Table 4-5.

Table 4-5 Condition Time Sensitivity Calculations for Inverter 1-1 Increase Loss of Offsite Power Frequency by a Factor of 10 Calculation (for Inverter 1-1) Core Large Early Damage Release Risk Risk Baseline CDF/LERF (/yr) 2.107E-5 1.504E-6 Conditional CDF/LERF with inverter unavailable (/yr) 2.635E-5 1.517E-6 ICCDP/ILERP (Single Condition Time Risk) 2.OE-7 5.OE-10 Yearly Condition Time Risk (based on one 14 day 8.1E-7 2.OE-9 outage every year per inverter)

Meets RG 1.177 and RG 1.174 acceptance criteria Yes Yes The results indicate that Inverter 1-1 meets the acceptance criteria of 5E-7 for ICCDP and 5E-8 for ICLERP in Regulatory Guide 1.177, and the acceptance criteria of 1E-6 per year for CDF increases and 1E-7 per year for LERF increases in Regulatory Guide 1.174.

4.1.4.4 Increase Failure Probability of Other Inverters to a Common Cause Beta Factor In this sensitivity case, the failure probabilities for the other Train H and J Inverters 1-11, 1-111, and 1-IV were increased to a value of 0.05, which is the assumed common cause beta factor. This case addresses the potential for common cause failure of any of these inverters during the outage of Inverter 1-1 due to corrective maintenance. It also addresses the uncertainty in the random failure rate of the inverters. The calculation is very conservative for the random failure rate sensitivity since the inverter failure rates were not set to the common cause beta factor in the baseline case. However, the common cause sensitivity case is consistent with the methods described in Regulatory Guide 1.177 for a corrective maintenance condition of Inverter 1-1. The affected basic events were 1VBINV-LU-lI, 1VBINV-LU-III, and 1VBINV-LU-IV. The increase in failure probability from the default value of 5.817E-5 to 0.05 is a more than

800-fold increase in 'failure probability for each ihverter. As indicated in the assumptions, there is no industry experience of common cause failure of inverters and the assumed common cause value of 0.05 is very conservative. The results of this calculation are provided in Table 4-6.

Table 4-6 Condition Time Sensitivity Calculations for Inverter 1-1 Increase Failure Probability of Other Inverters to a Common Cause Beta Factor Calculation (for Inverter 1-1) Core Large Early Damage Release Risk Risk Baseline CDF/LERF (/yr) 1.083E-5 1.416E-6 Conditional CDF/LERF with inverter unavailable (/yr) 1.154E-5 1.508E-6 ICCDP/ILERP (Single Condition Time Risk) 2.7E-8 3.5E-9 Yearly Condition Time Risk (based on one 14 day 1.1E-7 1.4E-8 outage every year per inverter)

Meets RG 1.177 and RG 1.174 acceptance criteria Yes Yes The results indicate that Inverter 1-1 meets the acceptance criteria of 5E-7 for ICCDP and 5E-8 for ICLERP in Regulatory Guide 1.177, and the acceptance criteria of 1E-6 per year for CDF increases and 1E-7 per year for LERF increases in Regulatory Guide 1.174.

4.2.1 Method of Analysis - Tier 2: Avoidance of Risk-Significant Plant Configurations Reasonable assurance must be provided that risk-significant plant equipment outage configurations will not occur when an inverter is out of service consistent with the proposed technical specification change. This can be determined by comparing the basic event RAW importances from the best estimate case, where the highest importance inverter is available, to the best estimate case where the highest importance inverter is unavailable. When a component associated with a basic event RAW greater than 2 increases significantly (i.e., more than 10%), the component could potentially contribute to a Tier 2 configuration.

4.2.2 Results - Tier 2: Avoidance of Risk-Significant Plant Configurations The basic event risk achievement worth (RAW) importances from the best estimate case, where inverter 1-1 is available, were compared to the best estimate case where inverter 1-1 is unavailable. The comparison indicates that there are no single components, which are allowed to be out of service concurrent with an inverter at power per the Technical Specifications, which would result in a significant change in risk (i.e., increase in RAW greater than 10%). Therefore, there are no Tier 2 issues associated with this change.

4.3 Defense In-Depth Assessment During the 2002 Unit 2 refueling outage, the 2-1 and 2-11 inverters were replaced with equipment that has the capability of automatically transferring to the voltage regulating transformer on loss of power. The other Unit 1 and 2 inverters have manual bypass switches to transfer the load of vital bus panels from the inverters to the voltage regulating transformers. Upon a Loss of Offsite Power, a vital bus that is being powered by the voltage regulating transformer will de-energize for approximately 10 seconds until the associated Emergency Diesel Generator re energizes the emergency bus. A complete loss of offsite power, which is a bounding case in the enclosed PRA analysis, would result in a shutdown of both units due to a loss of secondary plant equipment and power to the Reactor Coolant Pumps (RCPs). A partial loss of offsite power affecting emergency bus power has been a rare occurrence at North Anna and switchyard maintenance is carefully controlled by the maintenance rule planning and scheduling process. For the case of a partial loss of offsite power to an emergency bus the following describes the major impact on plant operations. If vital bus 1-1, 1-111, 2-1, or 2-111 is supplied from a voltage regulating transformer the momentary interruption in power will impact the operation of numerous trip valves, equipment controllers and indications. For vital bus I, the major impact on the unit will be a loss of condenser vacuum and a loss of cooling water to the RCPs. When the diesel generator restores power, equipment can be realigned using operations procedures without resulting in a unit shutdown. For vital bus III, the temporary loss of power impacts the operation of numerous trip valves and causes a main feed regulating valve controller to receive a close signal. Cooling to the RCPs will be lost but can be restored. The operators will not likely be able to restore steam generator water level to the affected generator in time to prevent an automatic reactor shutdown. For vital bus II and IV, the temporary loss of power impacts the operation of numerous trip valves and causes the affected buses main feed regulating valve controller to receive a close signal with the result being similar to vital bus 11.

A large majority of the Reactor Protection System and Engineered Safety Feature Actuation System is de-energize to actuate. The momentary interruption in power to the vital bus will cause that channel to actuate, but the two-out-of-three and two-out of-four logic will provide the defense in depth to prevent a safety system actuation.

The Containment Depressurization Actuation (CDA) logic and the Refueling Water Storage Tank (RWST) low-level switchover to the containment sump logic will go from two-out-of-four to two-out-of-three, since they are both energize to actuate.

There are also some low power reactor trips that are in place during startup and shutdown, which actuate on one-out-of-two Reactor Protection System logic. With a momentary loss of power to certain vital busses (i.e., 1-1, 1-11, 2-1, and 2-11) when the plant is in low power operations a reactor trip will occur. This additional risk due to tripping the plant at this power level is small and manageable.

In accordance with 10 CFR 50, Appendix A, General Design Criterion (GDC) 17, the vital power system has sufficient capacity to supply vital equipment necessary for safe operation and shutdown of the reactor while maintaining the acceptable fuel design limits and containment integrity. Single failure of the vital bus is within the

design basis of the plant. Since the applicable inverter is in an action statement, no additional failures have to be assumed on the other three inverters in this deterministic assessment. The individual components are protected and separated from each other to reduce the probability of simultaneous malfunction during a design basis accident or a loss of offsite power.

In accordance with Safety Guide 6, the vital power system is separated into redundant and independent components so that loss of one component will not jeopardize the safety functions performed by the other components.

The increase in the Condition Time for an inverter will not alter assumptions relative to the causes or mitigation of an accident or transient event. Therefore, the increase in the Completion Time will not involve a significant increase in the probability or consequences of an accident previously evaluated. The proposed change will not physically alter the plant.

The inverters are currently in the 10CFR50.65(a)(2) maintenance rule category (i.e.,

the inverters are meeting established performance goals). Performance of inverter on-line maintenance is not anticipated to result in exceeding the current established maintenance rule criteria for the inverters. In addition, scheduling and performing maintenance and surveillance testing on the unit with a vital bus supplied from its voltage regulating transformer will continue to be evaluated and controlled in accordance with 10CFR50.65(a)(4).

4.4 Safety Margin Assessment Voltage regulating transformers fed from the 480 VAC emergency buses are provided to supply a nominal 120 VAC to vital bus panels in the event either panel's respective inverter fails or is undergoing maintenance. Having the voltage regulating transformer powering a single vital AC bus is allowed by the Technical Specification until power through the inverter can be restored to the bus. Powering equipment from the voltage regulating transformer is within the normal design and operation of the plant. In addition, the instrumentation and control equipment powered by the voltage regulating transformer will be available following a Loss of Offsite Power. A vital bus that is being powered by the voltage regulating transformer will lose power upon a Loss of Offsite Power until the Emergency Diesel Generator re-energizes the load on the emergency bus. In the event of a failure to re-energize the emergency bus or of a voltage regulating transformer, the most significant impact is the failure of one train of ESF equipment to actuate. In this condition, the redundant train of ESF equipment will automatically actuate to mitigate the accident, and the affected unit would remain within the bounds of the accident analyses. Since the probability of these events occurring simultaneously during a planned maintenance activity is low, there is minimal safety impact due to the proposed extended Completion Time.

4.5 Summary The risk evaluation supports the extension of the Train H and J inverter Technical Specification Completion Time from 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to 14 days. The increase in annual

core damage frequencies and large, early release frequencies associated with the proposed change to the Technical Specification Completion Time are 8.1E-8 and 4.6E-10, respectively, which are characterized as "very small changes" by Regulatory Guide 1.174. The incremental conditional core damage and large, early release probabilities associated with the proposed Technical Specification allowed outage time change are less than 2.OE-8 and 1.1E-10, respectively, which are within the acceptance criteria in Regulatory Guide 1.177.

The sensitivity calculations confirm that the criteria in Regulatory Guides 1.174 and 1.177 are met when considering the uncertainty in key attributes of the model impacting the importance of the inverters.

The evaluation did not identify any configurations that could occur during outage of an inverter that would require Tier 2 restrictions per Regulatory Guide 1.177.

A deterministic assessment also supports the proposed Technical Specification Completion Time change from 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to 14 days.

5.0 Regulatory Safety Analysis 5.1 No Significant Hazards Consideration Dominion has evaluated whether or not a significant hazards consideration is involved with the proposed changes by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of amendment," as discussed below:

1. Does the proposed license amendment involve a significant increase in the probability or consequences of an accident previously evaluated?

The proposed change to TS 3.8.7, Inverters - Operating, to allow the Completion Time for an inoperable inverter to be extended from 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to 14 days, does not alter any plant equipment or operating practices in such a manner that the probability of an accident is increased. The proposed change will not alter assumptions relative to the mitigation of an accident or transient event.

An evaluation was performed to determine the risk significance of the proposed change. The risk evaluation concludes that the increase in annual core damage and large, early release frequencies associated with the proposed change are 8.1E-8 and 4.6E-10, respectively, which are characterized as "very small changes" by RG 1.174. The incremental conditional core damage and large, early release probabilities associated with the proposed change are 2.OE-8 and 1.1E-10, respectively, which are within the acceptance criteria in RG 1.177.

Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed license amendment create the possibility of a new or different kind of accident from any accident previously evaluated?

The proposed change does not involve a physical alteration of the plant (no new or different type of equipment will be installed) or a change in the methods governing normal plant operation. Therefore, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed amendment involve a significant reduction in a margin of safety?

The proposed change to TS 3.8.7, Inverters - Operating, allowing an extended Completion Time for an inoperable inverter has been evaluated for its affect on plant safety. The risk-informed evaluation concludes that the increase in annual core damage and large, early release frequencies associated with the proposed change are 8.1E-8 and 4.6E-10, respectively, which are characterized as "very small changes" by RG 1.174. The incremental conditional core damage and large, early release probabilities associated with the proposed change are 2.OE-8 and 1.1E-10, respectively, which are within the acceptance criteria in RG 1.177.

Therefore, the proposed change does not involve a significant reduction in the margin of safety.

Based on the above, Dominion concludes that the proposed change present no significant hazards consideration under the standards set forth in 10 CFR 50.92(c),

and, accordingly, a finding of "no significant hazards consideration" is justified.

6.0 Environmental Assessment This amendment request meets the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9) as follows:

(i) The amendment involves no significant hazards consideration.

As described above, the proposed change involves no significant hazards consideration.

(ii) There is no significant change in the types or significant increase in the amounts of any effluents that may be released offsite.

The proposed change does not involve the installation of any new equipment, or the modification of any equipment that may affect the types or amounts of effluents that may be released offsite. Therefore, there is no significant change in the types or significant increase in the amounts of any effluents that may be released offsite.

(iii) There is no significant increase in individual or cumulative occupation radiation exposure.

The proposed change does not involve plant physical changes, or introduce any new mode of plant operation. Therefore, there is no significant increase in individual or cumulative occupational radiation exposure.

Based on the above, Dominion concludes that the proposed changes meet the criteria specified in 10 CFR 51.22 for a categorical exclusion from the requirements of 10 CFR 51.22 relative to requiring a specific environmental assessment by the Commission.

7.0 Conclusion The proposed change extends the Completion Time of Required Action A.1 of TS 3.8.7, Inverters - Operating, from 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to 14 days for an inoperable inverter. The risk informed evaluation provided above supports the conclusion that the change is acceptable. The proposed change will provide greater flexibility for repair or replacement of an inoperable inverter without having to shut down the plant because the action takes longer than the current 24-hour Completion Time. The proposed change improves instrument bus inverter availability during shutdown modes or conditions. The proposed change should also enhance equipment reliability by allowing inverter replacement to be completed in a more timely manner on-line rather than extending the replacements over several refueling outages. This change should also reduce the impact on refueling outage duration. Additionally, the proposed change would eliminate the administrative burden of requesting a notice of enforcement discretion.

The Station Nuclear Safety and Operating Committee (SNSOC) and the Management Safety Review Committee (MSRC) have reviewed this proposed change to the Technical Specifications and have concluded that it does not involve a significant hazards consideration and will not endanger the health and safety of the public.

Attachment 2 PRA Peer Assessment A & B Level Findings and Observations North Anna Power Station Units I and 2 Virginia Electric and Power Company (Dominion)

Page 1 North Anna PRA Peer Assessment A & B Level F&O Review Summary The following matrix contains the A and B significance level F&O's from the North Anna PRA Peer Assessment Element 1F/0 Level of Description Impact on Application Significance AS - Accident AS-01/ B Containment vulnerability following LOCAs is overly None: Addressed by recent update.

Sequence Dev AS-10 conservative (i.e., core damage assumed if containment integrity lost)

AS-02 B LOCA event trees do not have a loss of emergency None: 120 VAC vital buses do not support emergency switchgear cooling (HVAC) top event switchgear room cooling function AS-06 B Expand dependency matrix to plant dependencies for IE's None: Modeling of dependencies for 120 VAC are and systems detailed and well documented.

AS-08 B Address items for ATWS model None: 120 VAC does not impact ATWS response.

AS-09 B Enhance documentation of accident sequence development to None: Documentation issue; does not impact 120 better characterize the interface with IE's and EOP's VAC modeling.

AS-12/ B Switch to use a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time instead of 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. None: Applies only to emergency diesel generator DA-15 mission time. Loss of offsite power sensitivity calculation bounds the impact of this observation.

DA -Data Analysis DA-04 B Justify using data collection dates of 1/1/97 - 12/31/1999 None: Use of different data collection periods for reliability and unavailability data has minimal impact on the results. The plant specific data collection periods are recent enough to ensure the data matches the current plant operation and design.

DA-08 B Provide appropriate documentation of equipment boundary None: This observation is limited to documentation and population definition for data and CCF update issues associated with equipment boundaries. No errors were discovered in the data analysis related to equipment boundaries.

DA-09 B Complete plant specific data update. None: Addressed by recent update.

DA-12 B Provide additional CCF's for support systems. None: Potentially risk significant CCFs were incorporated in the recent update. The CCF sensitivity case adequate addresses this observation.

Page 2 North Anna PRA Peer Assessment A & B Level F&O Review Summary The following matrix contains the A and B significance level F&O's from the North Anna PRA Peer Assessment Element F1IO Level of Description Impact on Application Significance DA-13 B Re-evaluate CCF screening criteria. None: Potentially risk significant CCFs were incorporated in the recent update. The CCF sensitivity case adequate addresses this observation.

DE - Dependency DE-O11 B Minimum volume in the aux bldg internal flooding analysis None: 120 VAC vital buses are not important in appears inconsistent, flooding model results.

DE-02 DE-03 B Screening out of turbine bldg for flooding doesn't make None: 120 VAC vital buses are not important in sense. flooding model results.

DE-04 B Unit 2 CH & CC crosstie was not included in the flood None: 120 VAC vital buses are not important in analysis. flooding model results.

HR - Human HR-01 A results. REP dependencies and provide documentation Review of None: Addressed by recent update.

Reliability HR-02 A Review REC screening values and verify appropriateness of None: Addressed by recent update.

leaving them at 0.1.

HR-03 B The BRA approach provides a thorough analysis of time but None: The HEP sensitivity case adequate addresses there is little or no evidence of other performance shaping this observation.

factors.

HR-05 B No evidence that the current -RA, including non-updated None: The HEP sensitivity case adequate addresses and updated HEPs, has been reviewed recently by operations this observation.

and/or training personnel.

HR-06/ B Improve the guidance for HRA. None: Documentation issue. No technical issues identified which would impact importance of 120 BR-Il VAC vital buses.

HR-08 B Review event trees to identify human actions that need to be None: Documentation issue. No technical issues modeled. identified which would impact importance of 120 VAC vital buses.

HR-09 B No systematic review of indications performed or None: Documentation issue. No technical issues documented for HEPs. identified which would impact importance of 120 VAC vital buses.

Page 3 North Anna PRA Peer Assessment A & B Level F&O Review Summary The following matrix contains the A and B significance level F&O's from the North Anna PRA Peer Assessment Element FIO Level of Description Impact on Application Significance HR-10 B Treatment of operator actions for dual unit system support is None: The HEP sensitivity case adequate addresses questionable in some cases. this observation.

L1 - Initiating Events IE-04 B Include loss of IA as a specific IE. None: There are no dependencies between 120 VAC vital buses.

IE-07 B Either include additional IE's (MSLB, FWLB, RCS PORV, None: Addressed by recent update.

SRV) in the model or provide rationale for not including.

L2, Cont Perf Analysis L2-02 B Update LERF early Cont failure model None: Current LERF model is conservative.

L2-03 B Update LERF PRA to include EOP & SAMG actions None: Current LERF model is conservative.

L2-04 B Provide LERF definition and consistent LERF assignment None: Current LERF model is conservative. The significance of the observation is mitigated by the reasonableness of the assignments using NUREG/CR 6595 and the WOG LERF definitions.

L2-06 B No LERF documentation None: Documentation issue. Surry documentation was used as surrogate and is applicable to NAPS.

L2-09 B All SGTR sequences should not result in LERF None: Current LERF model is conservative.

L2-10 B Revise bypass screening criteria None: 120 VAC vital buses do not impact interfacing system LOCA analysis.

MU, Maint & Update MU-01 B Provide enough time & resources to improve Independent None: Addressed during recent update.

Review quality MU-02 B Several AFW components risk significant at other plants are None: The AFW components impacted by the not in final cut set observation are not supported by the 120 VAC vital buses.

Page 4 North Anna PRA Peer Assessment A & B Level F&O Review Summary The following matrix contains the A and B significance level F&O's from the North Anna PRA Peer Assessment Element F/0 Level of Description Impact on Application Significance MU-04 B Maintenance and update procedures may not be sufficient or None: Observation did not identify any specific areas adequate of the maintenance or update procedures which were inadequate. The observation was based on the large number of other F&O's, which has subsequently been determined to be unrelated to the maintenance and update procedures.

QU, Quantification QU-02 B Key limitations missing from quantification documentation .None: Generic data observation addressed during recent model update.

QU-03 B PORV logic gate errors in FB I None: Subsequent review of the feed and bleed fault tree indicates that the existing logic is correct. No change is required.

QU-04 A Concern with 3d highest cut set None: The numerous observations have either a minimal impact of risk or result in an over-estimation of the risk.

QU-07 B Evaluate manual recovery of MS PORVs in SGTR None: Minor conservatism in the model due to not modeling recovery.

SY, Systems Analysis SY-01 B Fails to Run CCF mission time is not applied correctly None: Addressed by recent update.

SY-02 B AFW pump automatic actuation failure w/manual restart not None: Failure to include manual start of AFW pumps modeled (upon failure of automatic actuation) is a conservatism.

SY-09 B HHSI pump restart is not modeled following LOSP None: Failure of a pump to restart after a LOSP is a small contributor and does not impact the importance of the 120 VAC vital buses.

SY-12 B Replacement Steam Generators not evaluated None: There is no dependence between the 120 vital buses and the steam generators.

SY-14 B Incorporate flood scenarios into internal events model None: There is no dependence between the 120 vital buses and the flooding model.

Page 5 North Anna PRA Peer Assessment A & B Level F&O Review Summary The following matrix contains the A and B significance level F&O's from the North Anna PRA Peer Assessment Element F/O Level of Description Impact on Application Significance SY-15 B CCF models missing for CH-MOV-1 I IB/D and C/E None: This F&O appears to be incorrect. There are CCFs for these MOVs in the FB4 ftree.

SY-19 B SG PORV capability wlo IA needs additional manual None: SG PORVs are not dependent on 120 VAC recovery past 5 cycles vital buses after loss of instrument air.

TH, Thermal TH-04 B MAAP3B not sufficiently detailed to evaluate peak clad None: The HEP sensitivity case adequate addresses Hydraulic Analysis temperature success criteria this observation.

TH-09 B Uncertain about SBO evaluation of SG overfill on TDAFW None: The 120 VAC vital buses do not impact a I pump at 10.4 hrs steam generator overfill event.

Attachment 3 "Mark-up of Technical Specifications Change North Anna Power Station Units I and 2 Virginia Electric and Power Company (Dominion)

Inverters-Operating 3.8.7 3.8 ELECTRICAL POWER SYSTEMS 3.8.7 Inverters-Operating LCO 3.8.7 The Train H and Train J inverters shall be OPERABLE.

- - - - - - - - ------- NOTE -----------

One inverter may be disconnected from its associated DC bus for

• 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to perform an equalizing charge on its associated battery, provided:

a. The associated AC vital bus is energized from its constant voltage source transformer; and

b. All other AC vital buses are energized from their associated OPERABLE inverters.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One inverter A.1 ----------NOTE-----

inoperable. Enter applicable Conditions and Required Actions of LCO 3.8.9, "Di stri buti on Systems-Operati ng" with any vital bus de-energized.

Restore inverter to OPERABLE status.

-er-- 1I I B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> associated Completion Time not met. AND B.2 Be in MODE 5. 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> North Anna Units 1 and 2 3.8.7-1 Amendments 231/212

Inverters-Operating B 3.8.7 BASES APPLICABILITY The inverters are required to be OPERABLE in MODES 1, 2, 3, and 4 to ensure that:

a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients; and

b. Adequate core cooling is provided, and containment OPERABILITY and other vital functions are maintained in the event of a postulated DBA.

Inverter requirements for MODES 5 and 6 are covered in the Bases for LCO 3.8.8, "Inverters-Shutdown."

ACTIONS A.1 With a required inverter inoperable, its associated AC vital bus becomes inoperable until it is re-energized from its constant voltage source transformer.

For this reason a Note has been included in Condition A requiring the entry into the Conditions and Required Actions of LCO 3.8.9, "Distribution Systems-Operating." This ensures that the vital bus is re-energized within 2 hourp.

Required Action A.1 allows i%--e. to fix the inoperable inverter and return it to service. The limit is based ris1k .__*,. '.. taking into consideration the e.if time required to repair an inverter and the additional risk to which the unit is exposed because of the inverter inoperability. This has to be balanced against the risk of an immediate shutdown, along with the potential challenges to safety systems such a shutdown might entail. When the AC vital bus is powered from its constant voltage source, it is relying upon interruptible AC electrical power sources (offsite and onsite). The uninterruptible inverter source to the AC vital buses is the preferred source for powering instrumentation trip setpoint devices.

B.1 and B.2 If the inoperable devices or components cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at (continued)

North Anna Units 1 and 2 B 3.8.7-3 Revision 0

Attachment 4 Proposed Technical Specifications Changes North Anna Power Station Units I and 2 Virginia Electric and Power Company (Dominion)

Inverters-Operating 3.8.7 3.8 ELECTRICAL POWER SYSTEMS 3.8.7 Inverters-Opeiating LCO 3.8.7 The Train H and Train J inverters shall be OPERABLE.

- - - - - - - - ------- NOTE -----------

One inverter may be disconnected from its associated DC bus for

• 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to perform an equalizing charge on its associated battery, provided:

a. The associated AC vital bus is energized from its constant voltage source transformer; and

b. All other AC vital buses are energized from their associated OPERABLE inverters.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One inverter A.1 --------- NOTE-----

inoperable. Enter applicable Conditions and Required Actions of LCO 3.8.9, "Distribution Systems-Operating" with any vital bus de-energized.

Restore inverter to 14 days I OPERABLE status.

B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> associated Completion Time not met. AND B.2 Be in MODE 5. 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> North Anna Units 1 and 2 3.8.7-1

Inverters-Operating B 3.8.7 BASES APPLICABILITY The inverters are required to be OPERABLE in MODES 1, 2, 3, and 4 to ensure that:

a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients; and

b. Adequate core cooling is provided, and containment OPERABILITY and other vital functions are maintained in the event of a postulated DBA.

Inverter requirements for MODES 5 and 6 are covered in the Bases for LCO 3.8.8, "Inverters-Shutdown."

ACTIONS A.1 With a required inverter inoperable, its associated AC vital bus becomes inoperable until it is re-energized from its constant voltage source transformer.

For this reason a Note has been included in Condition A requiring the entry into the Conditions and Required Actions of LCO 3.8.9, "Distribution Systems-Operating." This ensures that the vital bus is re-energized within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

Required Action A.1 allows 14 days to fix the inoperable inverter and return it to service. The 14 day limit is based upon a ris.k evaluation, taking into consideration the time required to repair an inverter and the additional risk to which the unit is exposed because of the inverter inoperability. This has to be balanced against the risk of an immediate shutdown, along with the potential challenges to safety systems such a shutdown might entail. When the AC vital bus is powered from its constant voltage source, it is relying upon interruptible AC electrical power sources (offsite and onsite). The uninterruptible inverter source to the AC vital buses is the preferred source for powering instrumentation trip setpoint devices.

B.1 and B.2 If the inoperable devices or components cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at (continued)

North Anna Units 1 and 2 B 3.8.7-3