ML031710773

Technical Specifications (Ts), Revising TS 3.5.3, Low-Pressure Injection, Condition a, to Change Completion Time from 72 Hours to 7 Days

ML031710773
Person / Time
Site:	Oconee
Issue date:	06/18/2003
From:	NRC/NRR/DLPM/LPD2
To:
References
TAC MB6667, TAC MB6668, TAC MB6669
Download: ML031710773 (24)

Text

HPI B 3.52 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.2 High Pressure Injection (HPI)

BASES BACKGROUND The function of the ECCS Is to provide core cooling to ensure that the reactor core is protected after any of the following accidents:

a. Loss of coolant accident (LOCA);

b. Rod election accident (REA);

c. Steam generator tube rupture (SGTR); and

d. Main steam ine break (MSLB).

There are two phases of ECCS operation: njection and recrculation. In the njection phase, all Injection Is InTtally added to the Reactor Coolant System (RCS) via the cold legs or Core Flood Tank (CFT) lines to the reactor vessel. After the borated water storage tank (BWST) has been depleted, the recirculation phase Is entered as the suction Is transferred to the reactor building sump.

The HPI System consists of two Independent trains, each of which splits to discharge Into two RCS cold legs, so that there are a total of four HPI InjecUon ines. Each train takes suction from the BWST, and has an automatic suction valve and discharge valve which open upon receipt of an Engineered Safeguards Protective System (ESPS) signal. The two HPI trains are designed and aligned such that they are not both suscepbble to any single active fallure Including the falure of any power operating component to operate or any single failure of electrical equipment. The HPI System Is not required to wiusand passive falures.

There are three ESPS actuated HPI pumps; the discharge flow paths for two of the pumps are norm*aly aligned to automatically support HPI train

• A and the discharge flow path for the third pump Is normally aligned to automatically support HPI train B.' The discharge flow paths can be manually aligned such that each of the HPI pumps can provide flow to either train. At least one pump Is normally running to provide RCS makeup and seal Injection to the reactor coolant pumps. SucUon header cross-connect valves are normally open; cross-connecting the HPI suction OCONEE UNITS 1 2, & 3 B3.5.2-1 Amendment Nos. 332,332, &3331

LPI 3.5.3 3.5 EMERGENCY CORE COOLING SYSTEMS (ECOS) 3.5.3 Low Pressure Injection (LPI)

LCO 3.5.3 Two LPI trains shall be OPERABLE.

--- O-NOTES--

1. Only one LPI train is required to be OPERABLE InMODE 4.

2. InMODE 4, an LPI train may be considered OPERABLE during alignment, when aligned or when operating for decay heat removal (DHR) fcapable of being manualy realigned to the lPI mode of operation.

3. In MODES 1, 2, and 3, the LPI discharge header crossover valves shall be manually OPERABLE to open.

APPUCABILITY: MODES 1,2,3, and 4.

ACTIONS .

CONDITION REQUIRED ACTION COMPLETION TIME A. One LPI train A.1 Restore LPI train to 7 days Inoperable In MODE 1, OPERABLE status. i 2, or 3.

B. One or more LPI B.1 Restore LPI discharge 72 hours3 days <br />0.429 weeks <br />0.0986 months <br /> discharge header header crossover crossover valve(s) valve(s) to OPERABLE manually inoperable to status.

open InMODE 1,2, or 3.

C. Required Action and C.1 Be In MODE 3. 12 hours0.5 days <br />0.0714 weeks <br />0.0164 months <br /> associated Completion Time of Condition A AND or B not met.

C.2 Be In MODE 4. 60 hours2.5 days <br />0.357 weeks <br />0.0822 months <br /> (continued)

OCONEE UNITS 1 2, & 3 3.5.3-1 Amendment Nos. 332,332,&333

HPI B 3.5.2 BASES BACKGROUND headers during normal operation was approved by the NRC In (continued) Reference 6. The discharge crossover valves (HP-409 and HP-410) are normally closed; these valves can be used to bypass the normal discharge valves and assure the ability to feed either train's Injection lines via HPI pump "B.! For each discharge valve and discharge crossover valve, a safety grade flow Indicator Is provided to enable the operator to throttle flow during an accident to assure that runout limits are not exceeded.

A suction header suppies water from the BWST or the reactor buDding sump (via the LPI-HPI flow path) to the HPI pumps. HPI discharges Into each of the four RCS cold legs between the reactor coolant pump and the reactor vessel. There Is one flow limiting orice In each of the four InJection headers that connect to the RCS cold legs. If a pipe break were to occur in an HPI line between the last check valve and the RCS, the orifice Inthe broken line would limit the HPI flow lost through the break and maximize the flow supplied to the reactor vessel via the other line supplied by the HPI header.

The HPI pumps are capable of discharging to the RCS at an RCS pressure above the opening setpolnt of the pressurizer safety valves. The HPI pumps cannot take suction directly from the sump. Ifthe BWST Is emptied and HPI Is still needed, a cross-connect from the discharge side of the LPI pump to the suction of the HPI pumps would be opened. This Is known as lpiggy backing HPI to LPI and enabtes continued HPI to the ROS.

The HPI System also functions to supply borated water to the reactor core following Increased heat removal events, such as MSLBs.

The HPI and lPI (LCO 3.5.3, 'Low Pressure Injection (LPI)") components, along with the passe CFrs and the BWST covered In LCO 3.5.1, Core Flood Tanks (CFTs),. and LCO 3.5.4, Borated Water Storage Tank (BWST),8 provide the cooling water necessary to meet 10 CFR 50A6 (Ref. 1).

APPUCABLE The LCO helps to ensure that the following acceptance criteria for the SAFETY ANALYSES ECCS, established by 10 CFR 50.46 (Ref. 1), will be met following a LOCA;

a. Maximum fuel element cladding temperature Is < 2200 0 F;

b. Maximum cladding oxidation Is 5 0.17 times the total cladding thickness before oxidation; OCONEE UNITS 1 2, 3 B3.5.2-2 Amendment Nos. 332,332,&33

HPI B 3.5.2 BASES APPUCABLE c. Maximum hydrogen generation from a zirconium water reaction Is SAFETY ANALYSES S 0.01 times the hypothetical amount generated If all of the metal In (contnued) the dadding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react;

d. Core Is maintained In a coolable geometry; and

e. Adequate long term cooling capability is maintained.

The HPI System Is credited in the small break LOCA analysis (Ref. 2).

This analysis estabrishes the minimum requtred flow and discharge head requirements at the design point for the HPI pumps, as well as the minimum required response time for their actuation. The SGTR and MSLB analyses also credit the HPI pumps, but these events are bounded by the small break LOCA analyses with respect to the performance requirements for the HPI System. The HPI System Is not credited for mitigaffon of a large break LOCA.

During a small break LOCA, the HPI System supplies makeup water to the reactor vessel via the RCS cold legs. The HPI System Is actuated upon receipt of an ESPS signal. If offste power Is available, the safeguard loads start Immediately. If offsfte power Is not available, the Engineered Safeguards (ES) buses are connected to the Keowee Hydro Units. The time delay associated with Keowee Hydro Unit startup, HPI valve opening, and pump starting determines the time required before pumped flow s available to the core foflowing a LOCA.

One HPI train provides sufficient flow to nitigate most small break LOCAs.

However, for cold leg breaks located on the discharge of the reactor coolant pumps, some HPI injection wl be lost out the break; for this case, two HPI tralns are required. Thus, three HPI pumps must be OPERABLE to ensure adequate cooling In response to the design basis RCP discharge smal break LOCA. Additionally, In the event one HPI train fals to automaticaly actuate due to a single failure (e.g., failure of HPI pump C or HP-26), operator actions from the Control Room are required to cross-connect the HPI discharge headers ithin 10 minutes in order to provide HPI flow through a second HPI train (Ref. 6).

Hydraulic separation of the HPI discharge headers Is required during normal operation to maintain defense-in-depth (.e., Independence of the HPI discharge headers). Additionally, hydraulic separaton of the HPI discharge headers ensures that a complete loss of HPI would not ocur In the event an accident were to occur wih only two of the three HPI pumps OCONEE UNITS 1, 2 & 3 B 3.52-3 Amendment Nos.332,332,0&331

HP)

B 3.5.2 BASES APPLICABLE OPERABLE coincident with the HPI discharge headers cross-connected.

SAFETY ANALYSES A single active failure of an HPI pump would leave only one HPI pump to (continued) mitigate the accident. The remaining HPI pump could experience runout conditions and could fall prior to operator action to throttle flow or start another pump.

Hydrauic separation on the suction side of the HPI pumps could cause a loss of redundancy. With any one of the normaly open suction header cross-connect valves closed, a failure of an automatic suction valve to open durlng an accident could cause two pumps to lose suction. Thus, the suction header cross-connect valves must renain open.

The safety analyses show that the HPI pump(s) will deliver sufficient water for a small break LOCA and provide sufficent boron to maintain the core subcritical.

The HPI System satifies Criterion 3 of 10 CFR 50.36 (Ref. 3).

LCO In MODES 1 and 2, and MODE 3 with RCS temperature > 350°F, the HPI System Is required to be OPERABLE with:

a. Two HPI trains OPERABLE;

b. An adddional HPI pump OPERABLE;

c. Two LPI-HPI flow paths OPERABLE;

d. Two HPI discharge crossover valves OPERABLE;

e. HPI suction headers cross-connected; and

f. HPI discharge headers separated.

The LCO establishes the minimum conditlons required to ensure that the HPI System delivers sufficient water to mitigate a small break LOCA.

Additionally, Individual components wthin the HP1 tralns may be called upon to rmitigate the consequences of other transients and accidents.

Each HPI traln Includes the piping, Instruments, pump, valves, and controls to ensure an OPERABLE flow path capable of taldng suction from the BWST and njecting Irto the RCS cotd legs upon an ESPS signal. For an HPI train to be OPERABLE, the associated HPI pump must be capable of OCONEE UNITS 1 2, & 3 NS3.5.2-4 Amendment Nos. 332,332,&333

HPI B 3.52 BASES LCO taking suction from the BWST trough the suction header valve assoctated (continued) with that train upon an ESPS signal. For example:

1) if HPI pump "B" Is being credited as part of HPI train bA," then ft must be capable of taking suction through HP-24 upon an ESPS signal; or

2) HHPI pump "BW Is being credited as part of HPI train 1B," then it must be capable of taking suction through HP-25 upon an ESPS signal.

The safety grade flow indicator associated with the normal discharge valve Is required to be OPERABLE to support the associated HPI train's automatic OPERABIUTY.

To support HPI pump OPERABILITY, the piping, valves and controls which ensure the HPI pump can take suction from the BWST upon an ESPS signal are required to be OPERABLE.

To support HPI discharge crossover valve OPERABILIY, the safety grade flow Indicator associated with the HPI discharge crossover valve Is required to be OPERABLE.

Each LPI-HPI flow path Includes the piping, Instruments, valves and controls to ensure the capability to rranually transfer suction to the reactor buliding sump (LPI-HPI flow path). Within the LPI-HPI flow path are the lPI discharge valves to the LPI-HPI flow path (LP-15 and LP-16). The lPI discharge valves to the LPI-HPI flow path must be capable of being manually (ocaly and remotely) opened for the LPI-HPI flow path to be OPERABLE. The OPERABILTY requirements regarding the lPI System are addressed In LCO 3.5.3, 'Low Pressure Injection (LI).'

As part of the LPI-HPI flow path, the piping, instruments, valves and controls upstream of LP-1 5 and LP-1 6 are part of the LPI system and are subject to LCO 3.5.3 (Low Pressure Injection system) requirements. The piping, Instruments, valves and controls downstream of and including P-15 and LP-1 6, are part of the HPI system and are subject to LCO 3.52 (High Pressure Injection system) requirements.

During an event requirlng HPI actuation, a flow path Is provided to ensure an abundant supply of water from the BWST to the RCS via the HPI pumps and their respective discharge flow paths to each of the four cold leg injection nozzles and the reactor vessel. In the recirculation phase, this flow path Is manually transferred to take Its supply from the reactor building sump and to supply borated water to the RCS via the LPI-HPI flow path (piggy-back mode).

OCONEE UNITS 1, 2, & 3 B3.5.2-5 Amendment Nos.332,332,&333 I

HPI B 3.52 BASES LCO - The OPERABIUTY of the HPI System must be maintained to ensure that (continued) no single active faiure can disable both HPI trains. Additionally, while the HPI System was not designed to cope with passive failures, the HPI trains must be maintained Independent to the extent possible during normal operation. The NRC approved exception to this principle Is cross-connecting the HPI suction headers during normal operaton (Ref. 6).

APPUCABILIlY In MODES 1 and 2, and MODE 3 with RCS temperature > 3500 F. the HPI System OPERABILITY requirements for the small break LOCA are based on analysis performed at 100% RTP. The HPI pump performance is based on the small break LOCA, which establishes the pump performance curve.

Mode 2 and MODE 3 with RCS temperature > 350°F requirements are bounded by the MODE 1 analysis.

In MODE 3 with RCS temperature 5 350°F and In MODE 4, the probability of an event requiring HPI actuation Is signiicantly lessened. In this operating condition, the low probability of an event requiring HPI actuation and the LCO 3.5.3 requirements for the Il System provide reasonable assurance that the safety Injection function is preserved.

In MODES 5 and 6, unit conditions are such that the probabiity of an event requiring HPI InJection is extremely low. Core cooling requirements In MODE 5 are addressed by LCO 3A.7, *RCS Loops - MODE 5, Loops Filled, and LCO 3.4.8, RCS Loops - MODE 5, Loops Not Filied.'

MODE 6 core cooling requirements are addressed by LCO 3.9.4, Decay Heat Renoval (DHR) and Coolant Circulation - High Water Level," and LCO 3.9.5, Decay Heat Removal (DHR) and Coolant Circulation - Low Water Level."

ACIONS A-1 and A.2 With one HPI pump Inoperable, or one or more HPI discharge crossover valve(s) (ie., HP-409 and HP-410) Inoperable, the HPI pump and discharge crossover valve(s) must be restored to OPERABLE status within 72 hours3 days <br />0.429 weeks <br />0.0986 months <br />. The HPI System continues to be capable of mitigating an accident, barring a single failure. The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time Is based on NRC recommendations (Ref. 4) that are based on a risk evaluation and Is a reasonable time for many repairs.

In the event HPI pump C becomes inoperable, Condition C must be entered as well as Condition A. Until actions are taken to align an HPI pump to HPI train B, HPI train B' Is Inoperable due to the nability to autonatically provide Injection In response to an ESPS signal. Addtionally, In order to utlize another HPI pump to supply HPI train B,' HP-1 16 must be opened. This acthon results Incross-connecting the HPI discharge OCONEE UNITS 1, 2 & 3 B3.5.2-6 Amendment Nos.332,332,&33 I

HPI B 3.52 BASES ACTIONS A.1 and A.2 (continued) headers; thus, Condition E must be entered. The HPI discharge headers cannot be separated in this situation, because it would require HPI pumps

'AZ and i"B to operate wth flows less than the minimum requirements.

This Condition permits multiple components of the HPI System to be inoperable concurrently. When this occurs, other Conditions may also apply. For example, if HPI pump C and HP-409 are Inoperable coincidentally, HPI train B Is Incapable of belng automatically actuated or manually aligned from the Control Room. Thus, Required Action C.1 would apply.

B.. B2. B.3. and BA Ifthe Required Action and associated Completion Time of Condition A Is not met, THERMAL POWER of the unit must be reduced toS 75% RTP wfthln 12 hours0.5 days <br />0.0714 weeks <br />0.0164 months <br />. The 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Completion rne s reasonable, based on operating experience, to reach the required unit condition from full power conditions In an orderly manner and without challenging unH systems. This time is less restrictive than the Completion Tine for Required Action 0.1, because the HPI System remains capable of performing its function, barring a single failure.

Two HPI trains are required to miigate specific small break LOCAs, if no credit for enhanced steam generator cooling Is assumed In the accident analysis. However, if equipment not qualified as QA-1 (i.e., an atmospheric dump valve (ADV) flow path for a steam generator) Is credited for enhanced steam generator cooling, the safety analyses have determined that the capacity of one IPI train is sufficient to mitigate a smal break LOCA on the discharge of the reactor coolant pumps Ifreactor power Is s 76% RTP.

Required Actions B.2, B.3, and B.4 modify the HPI pump and discharge crossover valve OPERABILITY requirements to permit reduced requirements at power levels S 75% RTP for an extended period of tme.

Required Action B.2 provides a compensatory measure to verify by administrative means that the ADV flow path for each steam generator is OPERABLE within 12 hours0.5 days <br />0.0714 weeks <br />0.0164 months <br />. This compensatory measure provides additional assurance regarding the ability of the plant to mitigate an accident. Compliance widh this requirement can be established by ensuring that the ADV flow path for each steam generator Is OPERABLE In accordance with LCO 3.7.4, Atmospherlc Dump Valve (ADV) Flow Paths."

Required AcUons B.3 and B.4 require that fte HPI pump and discharge crossover valve(s) be restored to OPERABLE status withIn 30 days from initial entry Into Condition A. The 30-day time period imits the time that the OCONEE UNITS t, 2, & 3 B3.52-7 Amendment Nos.332,332,&333

HPI B 3.5.2 BASES ACTIONS B.1. B2. B.3. and B.4 (oontinued) plant can operate while relying on non QA-1 ADVs to provide enhanced steam generator cooling to mriigate small break LOCAs. The 30-day time period Is acceptable, because:

1. Wlthout crediting an ADV flow path, the HPI System remains capable of performing the safety function, barring a single failure;

2. If credit Is taken for an ADV flow path for a steam generator, the safely analysis has demonstrated that only one HPI train Is required to mitigate the consequences of a small break LOCA when THERMAL POWER Is 75% RTP. Thus, for this case, the HPI System would be capable of performing Its safety function even with an additional single failure;

3. OPERABILITY of the ADV flow path for each steam generator Is required to be confirmed by Required Action B2 withIn 12 hours0.5 days <br />0.0714 weeks <br />0.0164 months <br />.

Additional defense-in-depth Is provided, because the ADV flow path for only one steam generator Is required to mitigate the small break LOCA; and

4. A risk-informed assessment (Ref. 7) concluded that operating the plant In accordance with these Required Actions Is acceptable.

C.1. C.2. and C.3 If the plant Is operating with THERMAL POWER > 75% RTP, two HPI pumps capable of providing flow through two HPI trains are required. One HPI train Is required to provide flow automatically upon receipt of an ESPS signal, while flow through the other HPI train must be capable of being established from the Control Room within 10 minutes. Thus, if the plant Is operating at > 75% RTP, and one HPI train Is inoperable and Incapable of being automatically actuated or manually aligned from the Control Room to provlde flow post-accident, the HPI System would be incapable of performing its safety function. For this Condition, Required Action 0.1 requires the power to be reduced to

• 75% RTP within 3 hours0.125 days <br />0.0179 weeks <br />0.00411 months <br />. Required Action C. s modified by a Note which imits ts applicability to the condition defined above. The 3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> Completion ime Is considered reasonable to reduce the unit from full power conditions to 75% RTP In an orderly manner and without challenging unit systems. The time frame Is more restrictive than the Completion Time provided in Required Action B.1 for the same action, because the condition involves a loss of safety function.

OCONEE UNITS 1, 2 & 3 B 3.5.2-B Amendment Nos.332,332,&333 I

HPI B 3.52 BASES ACTlONS C.1. C.2. and C.3 (contnued)

If the plant Is operating with THERMAL POWER > 75%/ RTP and the Inoperable HPI train can be automatically actuated or manually aligned to provide flow post-accident, Required Action C.3 permits 72 hours3 days <br />0.429 weeks <br />0.0986 months <br /> to restore the HPI train to an OPERABLE status.

If enhanced steam generator cooling Is not credited in the accident analysis, two HPI trains are required to miigate specific small break LOCAs with THERMAL POWER 75% RTP. However, If equipment not qualified as QA-1 (i.e., an ADV flow path for a steam generator) Is credited for enhanced steam generator cooling, the safety analyses have determined that the capacty of one HPI traln Is sufficient to mitigate a small break LOCA on the discharge of the reactor coolant pumps If THERMAL POWER Is 5 75% RTP. In order to permit an HPI train to be Inoperable regardless of the reason when THERMAL POWER Is

• 75% RTP, Required Action C.2 provides a compensatory measure to verify by administrative means that the ADV flow path for each steam generator Is OPERABLE within 3 hours0.125 days <br />0.0179 weeks <br />0.00411 months <br />. This Required Action Is modified by a Note which states that It Is only required If THERMAL POWER Is S 75% RTP.

This compensatory measure provides assurance regarding the ability of the plant to mitigate an accident while In the Condition and THERMAL POWER s 75% RTP. Compiance with this requirement can be established by ensunng that the ADV flow path for each steam generator Is OPERABLE In accordance with LCO 3.7.4, Atmospheric Dump Valve (ADV) Flow Paths.

With one HPI train Inoperable, the Inoperable HPI train must be restored to OPERABLE status within 72 hours3 days <br />0.429 weeks <br />0.0986 months <br />. This action Is appropriate because:

1. With THERMAL POWER S 75% RTP, the safety analysis demonstrates that only one HPI train Is required to mitigate the consequences of a small break LOCA assuming credt Is taken for the ADV flow path for one steam generator. The OPERABILIlY of the ADV flow path for each steam generator Is confirmed by Required Acton C2 within 3 hours0.125 days <br />0.0179 weeks <br />0.00411 months <br />. This provides additional defense-in-depth. Additionally, a risk4nformed assessment (Ref. 7) concluded that operating the plant In accordance with this Required Action Is acceptable.

2. With THERMAL POWER > 75% RTP, the remaining OPERABLE HPI train Is capable of automatic actuation, and the Inoperable train can be manually aligned by operator action to cross-connect the discharge headers of the HPI tralns. This manual acton was approved by the NRC In Reference 6.

OCONEE UNITS 1, 2, & 3 B3.5.2-9 Amendment Nos.332,332,&3331

HPI B 3.5.2 BASES ACTIONS D.1 (continued)

With the HPI suctTon headers not cross-connected, the HPI suction headers must be cross-connected within 72 hours3 days <br />0.429 weeks <br />0.0986 months <br />. The HPI System continues to be capable of mitigating an accident, barring a single failure.

The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time Is based on NRC recommendations (Ref. 4) that are based on a rsk evaluatfon and Is a reasonable time for many repairs.

An argument similar to that utilized for Required Actions B2, BS, and B.4 could have been made for operating the HPI System with the suction headers not cross-onnected for an extended period of time. However, this action was not considered prudent, due to the potential of damaging two HPI pumps In the event HP-24 or HP-25 failed to open In response to an ESPS signal while the HPI suction headers were not cross-connected.

E.1 With the HPI discharge headers cross-connected, the Independence of the HPI trains Is not being maintained to the extent practical (i.e., defense-n-depth principle Is not met). Thus, the HPI discharge headers must be hydraulically separated within 72 hours3 days <br />0.429 weeks <br />0.0986 months <br />. This action limits the time period that the HPI discharge headers may be cross-connected. The 72-hour allowed outage time Is acceptable, because cross-connecting the HPI discharge headers in conjunction wh:

1. the rest of the HPI System being OPERABLE would not result In the Inability of the HPI System to perform Its safety function even assuming a single active failure; and

2. an HPI pump being Inoperable would not result In the InabTlTy of the HPI System to perform Its safety function, barring a single failure.

However, in this conditon, a single active failure of one of the two remaining OPERABLE HPI pumps could result Inthe remaining HPI pump faling due to runout F.1 With one LPI-HPI flow path Inoperable, the Inoperable LPI-HPI flow path must be restored to OPERABLE status within 72 hours3 days <br />0.429 weeks <br />0.0986 months <br />. The HPI System continues to be capable of mitigating an accident, barring a single failure.

The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time is justified because there Is a limited range of break sizes, and therefore a lower probability for a small break LOCA which would require piggy back operation.

OCONEE UNITS 1, 2, & 3 B 3.5.2-1 0 Amendment Nos.332,332,&333 I

HPI B 3.52 BASES ACTIONS G.1 and G.2 (conUnued)

If a Required Action and associated Compleon Time of Condition B, C, D, E, or F are not met, the unit must be brought to a MODE In which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 12 hours0.5 days <br />0.0714 weeks <br />0.0164 months <br /> and the RCS temperature reduced to S 350°F within 60 hours2.5 days <br />0.357 weeks <br />0.0822 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions In an orderly manner and without challenging unit systems.

H.1 Iftwo HPI tralns are Inoperable or two LPI-HPI flow paths are Inoperable, the HPI System Is Incapable of performing Its safety function and Ina condition not explicitly addressed In the Actions for ITS 3.52 Thus, Immediate plant shutdown Inaccordance with LCO 3.q.3 Is required.

SURVEILLANCE SR 3.52.1 REQUIREMENTS Verifying the correct arignment for manual and non-automatic power operated valves In the HPI flow paths provides assurance that the proper flow paths will exist for HPI operation. This SR does apply to the HPI suction header cross-connect valves, the HPI discharge cross-connect valves, the HPI discharge crossover valves, and the LPI-HPI flow path discharge valves (LP-1 5 and LP-1 6). This SR does not apply to valves that are locked, sealed, or otherwise secured Inposition, since these valves were vetified to be Inthe correct position prior to locking, sealing, or securing. Smilarly, this SR does not apply to automatic valves since automatic valves actuate to their required position upon an accident signal.

This Surveillance does not require any testing or valve manipulation; rather, It Involves verification that those valves capable of being mispositioned are In the correct position. The 31 day Frequency Is appropriate because the valves are operated under administrative control. This Frequency has been shown to be acceptable through operating experience.

SR 3.5.2.2 With the exception of the HPI pump operaUng to provide normal makeup, the other two HPI pumps are normally In a standby, non-operating mode.

As such, the emergency Injection flow path piping has the potential to develop %bidsand pockets of entrained gases. Venting the HPI pump casings perodically reduces the potental that such voids and pockets of OCONEE UNITS 1, 2 & 3 B 3.5.2-1 1 Amendment Nos. 332,332,&33

HPI B 3.5.2 BASES SURVEILLANCE SR 3.5.2.2 (continued)

REQUIREMENTS entrained gases can adversely affect operation of the HPI System. This will also reduce the potential for water hammer, pump cavitation, and pumping of noncondensible gas (e.g., air, nitrogen, or hydrogen) Into the reactor vessel following an ESPS signal. This Surveillance Is modified by a Note that Indicates It Is not applicable to operating HPI pump(s) providing nomial makeup. The 31 day Frequency takes Into consideration the gradual nature of gas accumulation In the HPI piping and the existence of procedural controls govemtng system operation.

SR 3.5.2.3 Periodic survellance testng of HPI pumps to detect gross degradation caused by Impeller structural damage or other hydraulic component problems Is required by Section Xl of the ASME Code (Ref. 5). SRs are specified In the Inservice Testing Program, which encompasses Section Xi of the ASME Code.

SR 3.5.2A and SR 3.5.2.5 These SRs demonstrate that each automatic HPI valve actuates to the required position on an actual or simulated ESPS signal and that each HPI pump starts on receipt of an actual or simulated ESPS signal. This SR Is not required for valves that are locked, sealed, or otherwise secured In position under administrative controls. The test will be considered satisfactory If control board indication verifies that an components have responded to the ESPS actuation signal properly (all appropriate ESPS actuated pump breakers have opened or closed and all ESPS actuated valves have completed their travel). The I8 month Frequency Is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned translent if the Surveillance were performed with the reactor at power. The 18 month Frequency is also acceptable based on consideration of the design reliabilty (and confirmng operating experience) of the equipment. The actuation logic Is tested as part of the ESPS testing, and equipment performance Is monitored as part of the Inservice Testing Program.

OCONEE UNITS 1 2 & 3 B 3.5.2-12 Amendment Nos.332,332,&33 I

HPI B 3.5.2 BASES SURVEILLANCE SR 3.5.2.6 REQUIREMENTS (continued) Periodic Inspections of the reactor building sump suction Inlet (for LPI-HPI flow path) ensure that I Is unrestricted and stays In proper operaUng condition. The 18 month Frequency Js based on the need to perform this Surveillance under the cbnditions that apply during a unit outage, on the need to preserve access to the location, and on the potential for an unplanned transient Ifthe Surveillance were performed with the reactor at power. This Frequency has been found to be sufficient to detect abnormal degradation and has been confirmed by operating experienoe.

SR 3.5.2.7 Periodic stroke testing of the HPI discharge crossover valves (HP-409 and HP-41 0) and LPI-HPI flow path discharge valves (LP-15 and LP-1 6) Is required to ensure that the valves can be manually cycled. The HPI discharge crossover valves must be capable of being stroked from the Control Room. The LPI-HPI flow path discharge valves must be capable of being trked locally. This test Is performed on an 18 month Frequency.

Operating experience has shown that these components usually pass the surveillance when perforned at this Frequency. Therefore, the Frequency Is acceptable from a reliablity standpoint.

REFERENCES 1. 10 CFR 50A6.

2. UFSAR, Section 15.14.3.3.6.

3. 10 CFR 50.36.

4. NRC Memorandum to V. Stello, Jr., from R.L Baer,

• Recommended Interim Revisions to LCOs for ECCS Components," December 1, 1975.

5. ASME Boiler and Pressure Vessel Code, Secton Xl, Inservice Inspection, Article IWV-3400.

6. Letter from R. W. Reid (NRC) to W. 0. Parker, Jr. (Duke) transmitting Safety Evaluation for Oconee Nuclear Station, Units Nos. 1, 2, and 3, ModificatTons to the High Pressure Injection System, dated December 13, 1978.

OCONEE UNITS 1, 2, & 3 B 3.5.2-1 3 Amendment Nos. 332,332,&33 I

HPI B 3.5.2 BASES REFERENCES 7. Letter from W. R. McCollum (Duke) to the U. S. NRC, Proposed (continued) Amendment to the Facility Operating Ucense Regarding the High Pressure Injection System Requirements," dated December 16, 1998.

OCONEE UNITS 1, 2, & 3 B3.52-14 Amendment Nos. 332,332,& 333 I

LPI B 3.5.3 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.53 Low Pressure Inection (LPI)

BASES BACKGROUND The function of the ECCS Is to provide core oooling to ensure that the reactor core Ts protected after any of the following accidents:

a. Loss of coolant accident (LOCA);

b. Rod election accident (REA);

c. Steam generator tube rupture (SGTR); and

d. Main steam line break (MSLB).

There are two phases of ECCS operation: Injection and recirculation. In the nlection phase, all Injecton Is Initially added to the Reactor Coolant System (RCS) via the cold legs or Core Flood Tank (CFT) lines to the reactor vessel. After the borated water storage tank (BWST) has been depleted, the recirculation phase Is entered as the suction Is transferred to the reactor building sump.

Two redundant low pressure Injection (LPI) trains are proided. The LPI trains consist of piping, valves, Instruments, controls, heat exchangers, and pumps, such that water from the borated water storage tank (BWST) can be Injected Into the Reactor Coolant System (RCS). Safety grade flow Instrumentation Is required to support OPERABILITY of the LPI trains to preclude NPSH or runout problems. In MODES 1,2 and 3, both trains of lPI must be OPERABLE. This ensures that 100% of the core cooling requirements can be provided even In the event of a single active failure.

The LPI discharge header crossover valves must be manually (locally and remotely) OPERABLE In MODE 1, 2, and 3 to assure abundant, long term core cooling. Only one lPI traIn Is required for MODE 4.

A suction header supplies water from the BWST or the reactor building sump to the LPI pumps. LPI discharges into each of the two core flood nozzles on the reactor vessel that discharge Into the vessel downcomer area.

The LPI pumps are capable of discharging to the RCS at an RCS pressure of approximately 200 psia. When the BWST has been nearly emptied, the suction for the lPI pumps Is manually transferred to the reactor building sump.

OCONEE UNITS 1, 2, & 3 B 3.5.3-1 Amendment Nos. 332,332,& 333

LPI B 3.5.3 BASES BACKGROUND In the long term cooling perod, flow paths In the lPI System are (continued) established to preclude the possibility of boric acid In the core region reaching an unacceptably high concentration. Two gravity flow paths are available by means of a drain line from the hot leg to the Reactor Building sump which draws coolant from the top of the core, thereby nducing core circulation. The system Is designed wlth redundant drain ines.

During a large break LOCA, RCS pressure will rapidly decrease. The LPI System Is actuated upon receipt of an ESPS signal. Ifoffsite power Is available, the safeguard loads start Immediately. Ifoffslte power Is not available, the Engineered Safeguards (ES) buses are connected to the Keowee Hydro UnIts. The time delay (38 seoonds) associated wih Keowee Hydro Unit startup and pump starting determtnes the time reqtured before pumped flow Is available to the core following a LOCA. Full LPI flow is not available unUtI the LPI valve strokes full open.

The lPI and HPI (LCO 3.52, *High Pressure Inlection (HPI)'), along with the passive CFTs and the BWST covered In LCO 3.5.1, Core Flood Tanks (CFTs)," and LCO 3.5.4, Borated Water Storage Tank (BWST)," provide the cooling water necessary to meet 10 CFR 50.46 (Ref. 1).

APPLICABLE The LCO helps to ensure that the following acceptance criteria for the SAFETY ANALYSES ECCS, established by 10 CFR 50.46 (Ref. 1), will be met following a LOCA

a. Maximum fuel element cladding temperature Is s 2200°F;

b. Maximum cladding oxidation Is S 0.17 times the total cladding thickness before oxidation;

c. Maximum hydrogen generation from a zirconium water reaction Is s 0.01 times the hypothetical amount generated Hall of the metal In the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react;

d. Core Is maintained In a coolable geometry; and

e. Adequate long terrn core cooing capability Is maintalned.

The LCO also helps ensure that reactor building temperature limits are met.

OCONEE UNITS 1, 2, & 3 B 3.5.3-2 Amendment Nos. 332,332,& 333 I

LPI B 3.5.3 BASES APPLICABLE The LPI System Is assumed to provide njection in the large break LOCA SAFETY ANALYSES analysis at ful power (Ref. 2). This analysis establishes a minimum (cortinued) required flow for the LPI pumps, as well as the minimum required response time for their actuation.

The large break LOCA event assumes a loss of offsite power and a single failure (loss of the CT-4 transforner). For analysis purposes, the loss of offsEte power assumption may be conservatively inconsistent with the assumed operation of some equipment, such as reactor coolant pumps (Ref. 3). During the blowdown stage of a LOCA, the RCS depressurizes as pr7mary coolant s ejected through the break into the reactor building. The nuclear reaction Is terrnated by moderator voiding dufing large breaks.

Following depressufization, emergency oooling water Is Injected Into the reactor vessel core flood nozzles, then flows into the downcomer, fills the lower plenum, and refloods the core.

In the event of a Core Flood line break which results In a LOCA, with a concurrent single failure on the unaffected iPI train opposite the Core Flood break, the LPI discharge header crossover valves (LP-9 and LP-1 0) must be capable of being manually (locally and remotely) opened. The LPI cooler outlet throttle valves and LPI header Isolaton valves must be capable of being manually opened to provide assurance that flow can be established in a timely manner even f the capability to operate them from the control room is lost. These manual actions will allow cross-connection of the LPI pump discharge to the intact LPI/Core Flood tank header to provide abundant emergency core cooling.

The safety analyses show that an Il train will deliver sufficient water to match decay heat boloff rates for a large break LOCA.

In the large break LOCA analyses, full LPI Is not credited until 63 seconds after actuation of the ESPS signal. This Is based on a loss of offslte power and the associated time delays In Keowee Hydro Unit startup, valve opening and pump start. Further, LPI flow Is not credited until ROS pressure drops below the pumps shutoff head. For a large break LOCA, HPI Is not credited at all.

The lPI trains satisfy Criterion 3 of 10 CFR 50.36 (Ref. 4).

LCO In MODES 1, 2, and 3, two Independent (and redundant) LPI trains are required to ensure that at least one lPI train is available, assuming a single failure Inthe other train. Additionally, ndividual components within the lPI trains may be called upon to mfigate the consequences of other transients OCONEE UNITS 1, 2, & 3 B 3.5.3-3 Amendment Nos. 332,332, & 333 I

LPI B 3.5.3 BASES LCO and accidents. Each Li train includes the piping, instruments, pumps, (continued) valves, heat exchangers and controls to ensure an OPERABLE flow path capable of taking suction from the BWST upon an ES signal and the capability to manualy (remotely) transfer suction to the reactor building sump. The safety grade flow Indicator associated with an LPI train s required to be OPERABLE to support LPI train OPERABILiTY. The safety grade flow Indicator associated with LPSW flow to an LPI cooler Is required to be OPERABLE to support LPI train OPERABILTY.

In MODE 4, one of the two lPI trains Is required to ensure sufficient LPI flow Is available to the core.

During an event requinng LPI Injection, a flow path Is required to provide an abundant supply of water from the BWST to the RCS, via the lPI pumps and their respective supply headers, to the reactor vessel. In the long term, this flow path may be switched to take its supply from the reactor building sump.

This LCO Is modified by three Notes. Note I changes the LCO requirement when In MODE 4 for the number of OPERABLE trains from two to one. Note 2 allows an LPI train to be considered OPERABLE during alignment, when aligned or when operating for decay heat removal if capable of being manually (remotely) realigned to the LPI mode of operation. This provislon Is necessary because of the dual requirements of the components that comprise the LI and decay heat removal modes of the lPI System. Note 3 requires the lPI discharge header crossover valves (LP-9 and LP-1 0) to be OPERABLE In MODES 1, 2, and 3.

The flow path for each train must maintain Its designed Independence to ensure that no single failure can disable both LI trains. If both LPI discharge header crossover valves (LP-9 and LP-1 0) are simultaneously open then only one LPI traln Is considered OPERABLE.

APPUCABILITY In MODES 1, 2 and 3, the LPI train OPERABILIY requirements for the Design Basis Accident, a large break LOCA, are based on full power operation. The lPI discharge crossover valve OPERABIUTY requirements for CFT line break Is based on full power operation. Although reduced power would not require the same level of performance, the accident analysis does not provide for reduced cooling requirements In the lower MODES.

In MODE 4, one OPERABLE LPI train Is acceptable without single fallure consideration on the basis of the stable reactivity condition of the reactor and the limied core cooling requirements.

OCONEE UNITS 1 2 & 3 B 3.5.3-4 Amendment Nos. 332,332, & 333

LPI B 3.53 BASES APPLICABILITY In MODES 5 and 6, unit conditions are such that the probability of an event (continued) requiring LPI njection Is extremely low. Core cooling requirements In MODE 5 are addressed by LCO 3.4.7, RCS Loops-MODE 5, Loops Filled,' and LCO 3.4.8, RCS Loops-MODE 5, Loops Not Filled." MODE 6 core cooling requirements are addressed by LCO 3.9.4, DHR and Coolant Circulation-High Water Level,' and LCO 3.9.5, 'DHR and Coolant Circulation-Low Water Level."

ACTIONS A.

With one LPI train Inoperable InMODES 1, 2 or 3, the Inoperable train must be retumed to OPERABLE status within 7 days. The 7 day Completion Time Is based on the findings of the deterministic and probabilistic analysis In Reference 7. Reference 7 concluded that extending the Completion Time to 7 days for an Inoperable lPI train Improves plant operational flexibility while simultaneously reducing overall plant risk. Specifically, the isk Incurred by having the PI train unavailable for a longer time at power will be substantially offset by the benefits associated with avolding unnecessary plant transitions and by reducing risk during shutdown operations.

B.1 With one or more LPl discharge crossover valves Inoperable, the Inoperable valve(s) must be retumed to OPERABLE status within 72 hours3 days <br />0.429 weeks <br />0.0986 months <br />.

The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time Is based on NRC recommendations (Ref. 5) that are based on a risk evaluation and Is a reasonable time for many repairs.

C-1 If the Required Action and associated Completion Time of Condition A or B are not met, the unit must be brought to a MODE In which the LCO does not apply. To achleve this status, the unit must be brought to at least MODE 3 wfthin 12 hours0.5 days <br />0.0714 weeks <br />0.0164 months <br /> and MODE 4 within 60 hours2.5 days <br />0.357 weeks <br />0.0822 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from fun power conditions n an orderly manner and without challenging unit systems.

With one required LPI traIn Inoperable In MODE 4, the unit Is not prepared to respond to an event requirng low pressure njection and nay not be prepared to continue cooldown using the LPI pumps and LPI heat exchangers. The Completion Time of mmediately, which would initiate OCONEE UNITS 1, 2, & 3 B 3.5.3-5 Amendment Nos. 332,332, & 333

LPI B 3.5.3 BASES ACTIONS D.1 (continued) action to restore at least one LPI train to OPERABLE status, ensures that prompt action Is taken to restore the required iLPI capacKy. Normally, In MODE 4, reactor decay heat must be removed by a decay heat removal (DHR) loop operatng wlth suction from the RCS. if no LPI train Is OPERABLE for this function, reactor decay heat must be removed by some altemate method, such as use of the steam generator(s).

The altemate means of heat removal must continue until one of the Inoperable LPI trains can be restored to operation so that continuation of decay heat removal (DHR) Is provided.

With the lPI pumps (including the non ES pump) and LPI heat exchangers Inoperable, it would be unwise to require the unit to go to MODE 5, where the only available heat removal system Is the lPI tralns operating Inthe DHR node. Therefore, the appropriate action Is to initiate measures to restore one LPI traln and to continue the actions until the subsystem Is restored to OPERABLE status.

D.2 RequTred Action D.2 requires that the unit be placed in MODE 5 within 24 hours1 days <br />0.143 weeks <br />0.0329 months <br />. This Required Action Is modified by a Note that states that the Required Action Is only required to be performed if a DHR loop Is OPERABLE. This Required Action provides for those circumstances where the lPI trains may be Inoperable but otherwise capable of providing the necessary decay heat removal. Under this circumstance, the prudent action Is to remove the unit from the Applicability of the LCO and place the unit in a stable condition In MODE 5. The Completion Time of 24 hours1 days <br />0.143 weeks <br />0.0329 months <br /> Is reasonable, based on operating experience, to reach MODE 5 Inan orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.5.3.1 REQUIREMENTS Verifying the correct aignment for rmanual and non-automatic power operated valves In the LPI flow paths provides assurance that the proper low paths will exist for LPI operation. Thlis SR does not apply to valves that are locked, sealed, or otherwise secured In positon, since these valves were verified to be Inthe correct position prior to locking, sealing, or securing. Similarly, this SR does not apply to automatic valves since OCONEE UNITS 1, 2, & 3 B 3.5.3-6 Amendment Nos. 332,332, & 333

LPI B 3.5.3 BASES SURVEILLANCE SR 3.5.3.1 (continued)

REQUIREMENTS automatic valves actuate to their required position upon an accident signal.

This Surveillance does not require any testing or valve manipulation; rather, It involves verification that those valves capable of being mlsposEtioned are Inthe correct position. The 31 day Frequency Is appropriate because the valves are operated under administrative control, and an Inoperable valve position would only affect a single train. This Frequency has been shown to be acceptable through operating experienoe.

When InMODE 4 an LPI train may be considered OPERABLE during alignment, when aligned or when operating for decay heat removal H capable of being manuafly realigned to the LPI mode of operation.

Therefore, for this condition, the SR verifies that Il Is capable of being manually realigned to the LPI mode of operation.

SR 3.5.3.2 With the exception of systems Inoperation, the LPI pumps are normally In a standby, non-operating mode. As such, the flow path piping has the potential to develop voids and pockets of entrained gases. Venting the PI pump casings periodically reduces the potential that such voids and pockets of entrained gases can adversely affect operation of the LPI System. This will also minimlze the potential for water hammer, pump cavitation, and pumping of noncondensible gas (e.g., air, nitrogen, or hydrogen) Into the reactor vessel following an ESPS signal or during shutdown cooling. This Surveillance Is modiied by a Note that Indicates t is not applicable to operating LPI pump(s). The 31 day Frequency takes Into consideration the gradual nature of gas accumulation Inthe lPI piping and the existence of procedural controls goveming system operation.

SR 3.5.3.3 Periodic surveillance testing of LPI pumps to detect gross degradation caused by Impeller structural damage or other hydraulic component problems Is required by Sectfon Xi of the ASME Code (Ref. 6). SRs are specified Inthe Inservice Testing Program, which encompasses Section Xl of the ASME Code.

OCONEE UNITS 1, 2, & 3 B 3.5.3-7 Aendment Nos. 332,332, & 333

LPI B 3.5.3 BASES SURVEILLANCE SR 3.5.3.4 and SR 3.5.3.5 REQUIREMENTS (continued) These SRs demonstrate that each automatic lPI valve actuates to the required position on an actual or simulated ESPS signal and that each LPI pump starts on receipt of an actual or simulated ESPS signal. This SR Is not required for valves that are locked, sealed, or otheiMse secured n position under administrative controls. The test will be considered satisfactory f control board indication verifies that all components have responded to the ESPS actuation signal properly (all appropriate ESPS actuated pump breakers have opened or closed and all ESPS actuated valves have completed their travel). The 18 month Frequency Is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient Tf the Surveillance were performed with the reactor at power. The 18 month Frequency Is also acceptable based on consideraton of the design reliability (and confirming operating experience) of the equipment. The actuation logic Is tested as part of the ESPS testing, and equipment performance Is monitored as part of the Inservice Testing Program.

SR 3.5.3.6 Periodic Inspections of the reactor buliding sump suction Inlet ensure that it Is unrestricted and stays In proper operating condition. The 18 month Frequency Is based on the need to perform this Surveillance under the conditions that apply during a unit outage, on the need to preserve access to the location, and on the potential for an unplanned transient f the Surveillance were performed with the reactor at power. This Frequency has been found to be sufficlent to detect abnormal degradation and has been confirmed by operating experience.

SR 3.5.3.7 The function of the lPI discharge header crossover valves (LP-9, LP-1 0) Is to open and allow a cross-connection between LPI trains. The LPI oooler ouUet throttle valves (LP-12, LP-14) and LPI header Isolation valves (LP-17, LP-18) must be capable of being manually opened to provide assurance that flow can be established In a timely manner even Ifthe capability to operate them from the control room Is lost. Manually cycling each valve open demonstrates the ability to fulfill this function. This test Is performed on an 18 month Frequency. Operating experience has shown that these components usuafly pass the Surveillance when performed at the this Frequency. Therefore, the Frequency Is acceptable from a reliability standpoint.

OCONEE UNITS 1, 2, & 3 B 3.."

Amendment Nos. 332,332,&33

LPI B 3.5.3 BASES (continued)

REFERENCES 1. 10 CFR 50.46.

2. UFSAR, Section 15.14.3.3.6.

3. UFSAR, Section 15.14.3.3.5.

4. 10 CFR 50.36.

5. NRC Memorandum to V. Stello, Jr., from R.L Baer,

'Recommended Intefim Revisions to LCOs for ECCS Components," December 1, 1975.

6. ASME, Boiler and Pressure Vessel Code, Section Xl, Inservice Inspecton, Article IWV-3400.

7. NRC Safety Evaluation of Babook & Wilcox Owners Group (B&WOG) Topical Report BAW-2295, Revision 1, Justification for the Extenslon of Allowed Outage Time for Low Pressure Injection and Reactor Building Spray systems, (TAC No. MA3807) dated June 30, 1999.

OCONEE UNITS 1, 2, & 3 B 3.5.3-9 Amendment Nos.332,332,& 333 I