ML043360342

Proposed Emergency Technical Specification Change One Time Extension of the Allowed Outage Time for Two Inoperable Auxiliary Feed Water Pumps on the Opposite Unit

ML043360342
Person / Time
Site:	Surry
Issue date:	11/30/2004
From:	Hartz L Virginia Electric & Power Co (VEPCO)
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
04-731
Download: ML043360342 (28)

Text

VIRGINIA ELECTRIC A N D POWER COMPANY RICHMOND, VIRGINIA 23261 November 30,2004 U.S. Nuclear Regulatory Commission Serial No.04-731 Attention: Document Control Desk SPS Lic/PAK RO Washington, D.C. 20555 Docket No. 50-281 License No. DPR-37 VIRGINIA ELECTRIC AND POWER COMPANY (DOMINION)

SURRY POWER STATION UNIT 2 PROPOSED EMERGENCY TECHNICAL SPECIFICATION CHANGE ONE TIME EXTENSION OF THE ALLOWED OUTAGE TIME FOR TWO INOPERABLE AUXILIARY FEED WATER PUMPS ON THE OPPOSITE UNIT Pursuant to 10 CFR 50.90 and 10 CFR 50.91 (a)(5), Dominion requests an emergency amendment of the Facility Operating License, in the form of a change to the Technical Specifications to Facility Operating License Number DPR-37 for Surry Power Station Unit 2. The proposed change will revise Technical Specification (TS) 3.6.G.1 by adding a note to allow a one-time 21-day Allowed Outage Time (AOT) for two inoperable Auxiliary Feed Water (AFW) pumps on the opposite unit. The current AOT for two inoperable AFW pumps on the opposite unit is 14 days. The 21-day AOT will allow time to repair the Unit 1 motor driven AFW pump (1-FW-P-3B). Dominion requests that the proposed change be processed as an emergency change to prevent an unnecessary plant transient and unscheduled shutdown of Surry Unit 2. Surry Unit 2 entered TS 3.6.G.1 at 1130 hours0.0131 days <br />0.314 hours <br />0.00187 weeks <br />4.29965e-4 months <br /> on November 17, 2004 when the Unit 1 36 AFW pump was removed from service to perform a scheduled maintenance package to replace the pump. During return to service testing on November 29, 2004, the pump seized causing the motor breaker to trip. Since Surry Unit 1 is currently in a refueling outage, the turbine driven AFW pump is inoperable. When the Unit 1 3B AFW pump was taken out of service for maintenance, the 14 day AOT for two inoperable AFW pumps on the opposite unit was entered for Unit 2. The Unit 2 AOT will expire on December 1, 2004 at 1 130 hours0.0015 days <br />0.0361 hours <br />2.149471e-4 weeks <br />4.9465e-5 months <br />.

The proposed change is based on a risk-informed evaluation performed in accordance with Regulatory Guides (RG) 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions On Plant-Specific Changes to the Licensing Basis, and RG 1.177, An Approach for Plant-Specific, Risk-Informed Decisionmaking:

Technical Specifications. A discussion of the proposed Technical Specifications change and the basis for the emergency Technical Specification are provided in . The marked-up and proposed Technical Specifications pages are provided in Attachments 2 and 3, respectively.

We have evaluated the proposed Technical Specifications change and have determined that it does not involve a significant hazards consideration as defined in 10 CFR 50.92.

The basis for that determination is provided in Attachment 1. We have also determined

Serial No.04-731 Docket No. 50-281 Emergency TS Change - TS 3.6.G.1 Page 2 of 4 that operation with the proposed change will not result in any significant increase in the amount of effluents that may be released offsite and no significant increase in individual or cumulative occupational radiation exposure. Therefore, the proposed amendment is eligible for categorical exclusion as set forth in 10 CFR 51.22(~)(9). Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment is needed in connection with the approval of the proposed change. The basis for that determination is also provided in Attachment 1.

To avoid an unnecessary plant shutdown, Dominion requests that ,the proposed Technical Specification change be reviewed and approved by 10:30 hours on December 1, 2004. The extended Surry Unit 2 AOT will expire upon returning the Unit 1 38A M pump to operable status or on December 8, 2004 at 1130 hoiirs, whichever occurs first. If you have any further questions or require additional information, please contact Mr. Barry Garber at (757) 365-2725.

Very truly yours, Leslie N. Hartl/

Vice President - Nuclear Engineering Attach ments

Serial No.04-731 Docket No. 50-281 Emergency TS Change - TS 3.6.G.1 Page 3 of 4 Commitments made in this letter:

1. The following compensatory measures will be taken to address Tier 2 restrictions:

+ There will be no planned maintenance on either Units Emergency Diesel Generat0rs.

+ There will be no planned maintenance on the Unit 2 AFW system.

+ There will be no planned maintenance activities on switchyardheserve station service transformers or transfer busses.

2. The following compensatory measures will be taken to provide additonal assurance that public health and safety will not be adversely affected by this request:

+ There will be no planned maintenance performed on the Unit 1 AFW system which will affect either the 3A AFW pump or AFW cross-tie capability.

+ There will be no planned maintenance on the Alternate AC Diesel Generator (AAC DG).

+ There will be no welding or hot work in the Unit 2 safeguards building.

+ There will be no planned maintenance on any other Unit 2 Engineered Safeguards Functions (ESF) components that could render them inoperable.

+ Fire watches will be established in Unit 1 and 2 Main Steam Valve House and Unit 1 and 2 Emergency Switchgear Rooms.

Serial No.04-731 Docket No. 50-281 Emergency TS Change - TS 3.6.G.1 Page 4 of 4 cc: U.S. Nuclear Regulatory Commission Region II Sam Nunn Atlanta Federal Center 61 Forsyth Street, SW Suite 23T85 Atlanta, Georgia 30303 Commissioner Bureau of Radiological Health 1500 East Main Street Suite 240 Richmond, VA 23218 Mr. N. P. Garrett NRC Senior Resident Inspector Surry Power Station Mr. S. R. Monarque NRC Project Manager U. S. Nuclear Regulatory Commission One White Flint North 1 1555 Rockville Pike Mail Stop 8-H12 Rockville, MD 20852

Serial No.: 04-731 Docket No.: 50-281

Subject:

Proposed Emergency Technical Specification Change One Time Extension of the Allowed Outage Time for the Two Inoperable AFWPs on the Opposite Unit COMMONWEALTH OF VIRGINIA )

1 COUNTY OF HENRICO 1 The foregoing document was acknowledged before me, in and for the County and Commonwealth aforesaid, today by Leslie N. Hartz who is Vice President - Nuclear Engineering of Virginia Electric and Power Company. She has affirmed before me that she is duly authorized to execute and file the foregoing document in behalf of that Company, and that the statements in the document are true to the best of her knowledge and belief.

,7;v Acknowledged before me this 3 0 = day o f g o h h- ,2004.

My Commission Expires: i Notary Public (SEAL)

Serial No.04-731 Docket No. 50-281 Attachment 1 Discussion of Emergency Technical Specification Change Surry Power Station Unit 2 Virginia Electric and Power Company (Dominion)

Table of Contents

1. Introduction

2. Background

3. Need for Technical Specification Change

4. Description of Proposed Change 4.1 Technical Specification Change 4.2 Basis of Change

4.3 System Description

5. Technical Evaluation 5.1 Risk Assessment 5.2 Defense-In-Depth Assessment 5.3 Safety Margin Assessment 5.4 Dominant Accident Sequences 5.5 Summary

6. Regulatory Safety Analysis 6.1 No Significant Hazards Consideration 6.2 Environmental Assessment

7. Conclusion - Surry PRA Peer Assessment A & B Level F&O Review Summary

Discussion of Change 1.O Introduction Pursuant to 10 CFR 50.90 and 10 CFR 50.91(a)(5), Virginia Electric and Power Company (Dominion) requests an emergency amendment to Facility Operating License Number DPR-37 in the form of a change to the Technical Specifications (TS) for Surry Power Station Unit 2. The proposed change will revise Technical Specification 3.6.G.1 by adding a note to permit a one-time 21-day Allowed Outage Time (AOT) for two inoperable Auxiliary Feed Water (AFW) pumps on the opposite unit to allow time to repair the Unit 1 motor driven Auxiliary Feed Water ( A M ) pump (1-FW-P-3B). This change should be processed as an emergency change to prevent an unscheduled shutdown of Surry Unit 2. The proposed change is based on a risk-informed evaluation performed in accordance with Regulatory Guides (RG) 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions On Plant-Specific Changes to the Licensing Basis, and RG 1.I 77, An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications.

The proposed change qualifies for categorical exclusion from an environmental assessment as set forth in 10 CFR 51.22(~)(9).Therefore, no environmental impact statement or environmental assessment is needed in connection with the approval of the proposed change.

2.0 Background On November 17, 2004, at 1130 hours0.0131 days <br />0.314 hours <br />0.00187 weeks <br />4.29965e-4 months <br />, with Unit 1 in refueling shutdown and Unit 2 operating at loo%, the Unit 1 3B Auxiliary Feed Water (AFW) pump (1-FW-P-3B) was removed from service to perform a pump replacement maintenance package. TS 3.6.B.4.a requires two of the three AFW pumps in the opposite unit to be capable of being used with the opening of the cross-connect. Unit 2 entered a 14-day AOT clock in accordance with TS 3.6.G.1 for two inoperable AFW pumps on the opposite unit.

During return to service testing, the Unit 1 38 AFW pump seized causing the motor breaker to trip on B phase overload. The Unit 2 AOT will expire on December 1, 2004 at 1130 hours0.0131 days <br />0.314 hours <br />0.00187 weeks <br />4.29965e-4 months <br />.

To return the 3B AFW pump to OPERABLE status, repairs must be completed, and post-maintenance testing must be performed. Based on previous maintenance experience, the time required to perform these activities will likely exceed the 14-day AOT. Therefore, a one-time, 21-day Unit 2 AOT for TS 3.6.G.1 to allow two AFW pumps on the opposite unit to be inoperable is requested to permit the repair, testing and return to service of the Unit 1 3B AFW pump. The extended AOT will expire upon returning the Unit 1, 3B A M pump to OPERABLE status, or on December 8, 2004 at 1130 hours0.0131 days <br />0.314 hours <br />0.00187 weeks <br />4.29965e-4 months <br />, whichever occurs first. This one-time emergency change will prevent an unnecessary shutdown of Surry Unit 2.

The proposed one-time AOT change in this license amendment request has been evaluated in accordance with Regulatory Guide (RG) 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to Page 2 of 18

the Licensing Basis, and RG 1.177, An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications. The approach addresses, as documented in this report, the impact on defense-in-depth and the impact on safety margins, as well as an evaluation of the impact on risk. The risk evaluation considers the three-tiered approach as presented by the NRC in Regulatory Guide 1.I 77. Tier 1 , PRA Capability and Insights, assesses the impact of the proposed AOT changes on core damage frequency (CDF), incremental conditional core damage probability (ICCDP), large early release frequency (LERF), and incremental conditional large early release probability (ICLERP). Tier 2, Avoidance of Risk-Significant Plant Configurations, considers potential risk-significant plant operating configurations, and Tier 3, Risk-Informed Plant Configuration Control and Management, assesses emerging plant conditions. Use of the extended AOT will be minimized. Scheduling and performing maintenance and surveillance testing will be controlled in accordance with 10 CFR 50.65(a)(4),

Maintenance Rule. Although not required by the PRA analysis, compensatory measures will be established to improve defense-in-depth during the extended AOT duration.

As discussed above, the proposed one-time AOT change is based on a risk-informed evaluation performed in accordance with RG 1.174 and RG 1.177. The CDF impact and the LERF impact, as well as the ICCDP and ICLERP associated with the proposed AOT change are summarized below. These values meet the acceptance criteria in RG 1 .I 74 and RG 1 .I 77 for the proposed change.

3.0 Need for Technical Specification Change The proposed one-time change to the Surry Unit 2 AOT of Technical Specifications 3.6.G.1 is needed to avoid the unnecessary shutdown of the plant to complete Unit 1 AFW pump repair activities. The change averts known risks from complex and infrequent plant shutdown and startup evolutions. In addition, the proposed change eliminates the need for preparing, reviewing and approving a Notice of Enforcement Discretion (NOED).

4.0 Description of Proposed Change 4.1 The proposed change will revise the Technical Specifications as follows:

The following note will be added to TS 3.6.G.1:

For the Surry Unit 2 November 17, 2004 entry into TS 3.6.G.1, two of the opposite units auxiliary feedwater pumps may be inoperable for a period not to exceed 21 days.

4.2 Basis for the Technical Specification Change The proposed one-time AOT change from 14 to 21 days for two AFW pumps on the opposite unit to be inoperable to permit repair of the Unit 1 AFW pump (1-FW-P-3B) is based on a risk-informed analysis performed in accordance with RG 1.174 and RG 1,177.

Page 3 of 18

4.3 System Description The AFW System provides a source of feedwater to the secondary side of the steam generators at times when the Feedwater System is not available, thereby maintaining the heat sink capabilities of the steam generators. The system is relied upon to prevent core damage and Reactor Coolant System (RCS) overpressurization in the event of transients, such as a loss of normal feedwater or a secondary system pipe rupture, and to provide a means for plant cooldown following any plant transient.

The AFW System for each unit consists of two motor driven A M pumps, each rated for 350 gallons per minute (gpm) at 2730 feet of head, one steam driven AFW pump rated for 700 gpm at 2730 feet of head, a 110,000 gallon emergency condensate storage tank, and associated piping, headers, valves, controls, and instrumentation. Use of two motor driven AFW pumps and a steam driven AFW pump provides for diversity of power sources for the automatic actuation of the AFW supply. The AFW pumps, powered by either power source (i.e., motor driven or steam driven), provide adequate capacity to cool the RCS when required. The amount of AFW flow that is required is dependent upon the amount of decay heat being generated, the rate of cooldown desired for the RCS, and the heat being added to the RCS by operating reactor coolant pumps.

Although the flowpaths from the pumps to the steam generators include common piping, the configuration of the system provides two redundant flowpaths. The components in one flowpath are supplied by the H emergency bus, while the other is supplied by the J emergency bus. The AFW Systems for Units 1 and 2 are cross-connected to provide additional redundancy in case a single event, such as a fire or a high energy line break in the main steam valve house, disabled the AFW System on one unit.

Following a reactor trip (with the Feedwater System not available), heat removal from the RCS is accomplished by maintaining the heat sink on the secondary side of the steam generators with the AFW System and releasing steam either to the condensers through the steam dump valves or to the atmosphere through a combination of the steam generator safety valves and available atmospheric steam dump valves. The AFW System feeds water to the steam generators at a rate that both maintains adequate heat transfer and restores the steam generator levels to the narrow range level where it can be maintained and controlled. The AFW System must be capable of functioning for extended periods to either allow for restoration of normal feedwater flow or to proceed with an orderly cooldown of the unit to RCS conditions where the Residual Heat Removal System can be used for decay heat removal.

The AFW flow and stored water capacity must be sufficient to provide for removal of core decay heat, reactor coolant pump heat, and sensible heat during the plant cooldown. The core decay heat and the RCS sensible heat loads increase as a function of the operating reactor power level. The design basis accident for the AFW System, which is a loss of normal feedwater with offsite power available (the reactor coolant pumps keep operating), has acceptable results assuming an AFW flow of 500 gpm [

Reference:

UFSAR Chapter 14.2.111. This A M flow can be delivered assuming the most limiting single failure which is the loss of the steam driven AFW pump.

Page 4 of 18

5.0 Technical Analysis 5.1 Risk Assessment A risk-informed evaluation to determine the impact of the proposed change on plant risk was performed in accordance with Regulatory Guides 1.I 74 and 1.177.

The Tier 1 and Tier 2 results are discussed below. Tier 3 requirements ensure that the risk impact of out-of-service equipment is evaluated prior to performing any maintenance activity and is met by the Maintenance Rule Program as required by 10CFR50.65(a)(4).

The Surry WinNUPRA S03A model was used for the calculational results. This model was deemed suitable for use in this risk-informed application since it models the as-built and as-operated plant. The model has undergone a PRA Industry Peer review. A review of the Peer Review Findings and Observations (F&Os) was performed to ensure that none of the F&Os would invalidate the results of this evaluation. Enclosure 1 contains a matrix with the B significance level F&Os from the Surry PRA Peer Review. There were no A significance level F&Os for Surry.

5.1.I Method of Analysis and Results- Tier 1:PRA Capability and Insights The method of analysis and results for the proposed Allowed Outage Time change is discussed below.

In Tier 1, the impact of the Allowed Outage Time change of core damage frequency (CDF), incremental conditional core damage probability (ICCDP), large early release frequency (LERF), and incremental conditional large early release probability (ICLERP) is determined.

ICCDP = [(conditional CDF with the subject equipment out of service) - (baseline CDF with nominal expected equipment unavailabilities)]X (duration of single allowed outage time (AOT) under consideration)

ICLERP = [( conditional LERF with the subject equipment out of service) - (baseline LERF with nominal expected equipment unavailabilities)] X (duration of single AOT under consideration)

Without elevated common With elevated common cause cause ICCDP 2.6E-07 2.2 E-06 ICLERP 5.4E-09 9.7E-08 These results without common cause vulnerability are below the RG 1.177 single event limits of 5E-07 for ICCDP and 5E-08 for ICLERP.

Page 5 of 18

This analysis assumed that there is no increased common cause vulnerability. This assumption is based upon the Surry System Engineering evaluation that found the I-FW-P-3B inoperability to be due to infant mortality, as the pump had just been replaced and was undergoing post-maintenancetesting prior to its failure.

All of the other AFW pumps have successfully passed their most recent periodic tests.

Four out of five other AFW pumps have been replaced with new pumps with stainless steel rotating assemblies. These pumps were all tested satisfactorily following replacement with no anomalies identified. In addition, the pumps had improved performance. Quarterly testing has been performed on these pumps with no problems experienced. Plant transients (Unit trips) have resulted in the pumps automatically starting and supplying AFW to the Steam Generators. Therefore, no evidence exists to support that a common mode failure exists within the AFWPs that have had the new stainless steel rotating assembly installed.

The ICCDP and ICLERP evaluation did not credit the remaining Unit 1 A M pump I-FW-P-3A.

The risk achievement worth of the Unit 1 AFW pump (I-FW-P-3B), in terms of Unit 2 core damage risk, is 1.01 from the Maintenance Rule Risk Ranking.

In addition, the average annual increase in core damage and large early release frequencies for this one-time AOT change are 2.6E-07 and 5.4E-09 per year. These increases in risk are characterized as very small in accordance with RG 1 .I 74.

The results of the risk evaluations without common cause vulnerability associated with the proposed AOT change meet the acceptance criteria in RG 1.174 and RG 1.I 77.

5.1.2 Tier 2: Avoidance of Risk-Significant Plant Configurations For the Tier 2 evaluation, the basic event Risk Achievement Worth (RAW) importance data from the average annual maintenance base case, where the AFW cross-connect is available, were compared with the RAWs with the AFW cross-connect unavailable. The following components associated RAWs greater than 2.0 and an increase in RAW greater than 10% were candidate configurations for Tier 2 restrictions:

Unit 2 AFW pumps Unit 2 Emergency Diesel Generators Reserve Station Service Transformers and Transfer buses Based on this evaluation, planned maintenance on the preceding components will be administratively prohibited during the one-time Technical Specification change.

Page 6 of 18

5.1.3. Tier 3: Risk-Informed Plant Configuration Control and Management Surry Power Station's program for complying with 10 CFR 50.65(a)(4) fully satisfies the guidance in Regulatory Guide 1.I77 for Tier 3 Risk-Informed Configuration Risk Management. The Surry 10 CFR 50.65(a)(4) program performs full model PRA analyses of all planned maintenance configurations at power in advance using the SCIENTECH Safety Monitor. The PRA model in the SCIENTECH Safety Monitor is a comprehensive, component level, core damage and large early release model. The Surry Regulatory Guide 1.I 77 Tier 3 Risk-Informed Configuration Management Program has been previously evaluated by the NRC in its review and approval of the following permanent amendments: 1) RPS/ESFAS analog instrument surveillance interval extension (Amendment Nos. 228 and 228), 2) 14-day allowed outage time for the pressurizer PORV accumulators (Amendment Nos. 231 and 231), 3) Containment Type A Surveillance Test Interval (Amendment No. 233), 4) Underground Fuel Oil Storage Tanks (Amendment Nos.

236 and 235) and 5) 7-day ECCS one-time AOT extension. Configurations that approach or exceed the NUMARC 93-01 risk limits (a 1.OE-06 cumulative increase in core damage probability) are avoided or addressed by compensatory measures per procedure.

Historically, Surry rarely approaches this limit. Emergent configurations are identified and analyzed by the on-shift staff for prompt determination of whether risk management actions are needed. The configuration analysis and risk management processes are fully proceduralized in compliance with the requirements of 10 CFR 50.65(a)(4).

The AFW system is included in the 10 CFR 50.65(a)(4) scope and removal from service is monitored, analyzed and managed using the Safety Monitor tool. In addition, possible loss of offsite power hazards (grid loading/stability, switchyard or other electrical maintenance, external events such as severe weather) are all included in the Safety Monitor model and are explicitly accounted for in the (a)(4) program. When configuration risk approaches the (a)(4) risk limits, plant procedures direct the implementation of risk management actions in compliance with the regulations. If the configuration is planned, these steps must be taken in advance.

Individually, most fluid system components do not approach the required risk management thresholds of the (a)(4) regulation. While combinations of unavailable equipment and/or evolutions, may approach the limits and even require risk management actions, the risks arising from these configurations will be managed in accordance with station procedures.

5.1.4 External Events The internal events analysis used for the quantification of the risk impact of the proposed Allowed Outage Time change includes internal initiating events and internal flooding.

Qualitative assessments were performed for the risk impact of the proposed Allowed Outage Time change on seismic, fire, floods and other external events evaluated in the Individual Plant Examination of External Events (IPEEE). The external event analyses have not been updated since completion of the IPEEE, and portions of these analyses were deterministic.

A seismic PRA analysis was prepared and reported in the IPEEE. The dominant failures involved Turbine Building collapse or failure of components in the Turbine Building leading Page 7 of 18

to a loss of ultimate heat sink. These components are completely independent of the Auxiliary Feedwater system and therefore would not impact the analysis presented above.

The internal fire analysis in the IPEEE used the EPRI FIVE methodology with quantification of the unscreened fire areas. The core damage frequency from internal fires reported in the IPEEE was 6.3E-06 per year, which is a small fraction of the reported internal events core damage frequency.

The other events, including high winds, floods, transportation and aircraft accidents analyses used a screening methodology with quantification of potentially significant events. The only aspect of the other events quantified was the aircraft accident analysis.

The aircraft accident analysis resulted in core damage frequency of 1.1E-07 per year, which is a very small fraction of the reported internal events core damage frequency.

The following Table provides a summary of the qualitative assessments of the external event analyses for the requested AOT change.

External Event Assessment Allowed Outage Time Change I Qualitative Assessment

- External Event Analysis Internal Fire The AFW system cross-tie was not associated with any vulnerabilities or unique significance in fire events.

Seismic The AFW system cross-tie is seismically qualified and was not associated with any vulnerabilities or unique significance in seismic events.

High Winds, Floods, The AFW system cross-tie was not associated with

~ Transportation and Nearby any vulnerabilities or unique significance in these Facility Accidents events.

Page 8 of 18

5.1.5 Cumulative CDF and LERF Impact The previously approved and proposed risk-informed changes at Surry with their associated estimated increase in core damage risk are provided below.

Surry Risk-Informed Change Estimated Estimated increase in CDF increase in LERF per year per year 1E-07 1E-08*

engineered safety features actuation system analog channel surveillance test internal extensions from monthly to quarterly and allowed outage time extensions' 14 day allowed outage time for the PORV 5E-07 9E-08 nitrogen accumulators Containment Type A Surveillance Test N/A 5E-08 Inte rval Underground Fuel Oil Storage Tanks 2E-08 2E-10 7 day emergency core cooling system allowed outage time extension (one-time only usage)

Proposed 21-day AFW cross-tie allowed 2.6E-07 5.4E-09 outage time extension (assuming only one 21 day entry)

Cumulative Total <1 E-06 <I .6E-07 containment failure

• • This one-time-only package was approved but never used.

The cumulative estimated increases in risk associated with all the approved and proposed risk-informed changes is c1 E-06 per year for CDF and <I .6E-07 per year for LERF. These increases in risk are considered acceptably small per Regulatory Guide 1.I 74.

5.1.6 PRA Model The PRA model utilized for the evaluation of the Allowed Outage Time change is applicable to both Units 1 and 2, and the model reflects the as-built, as-operated plant.

Furthermore, a program exists to periodically update the internal events PRA model in accordance with the Industry Peer Review guidance in NEI 00-02. Enclosure 1 provides a summary of the Findings and Observations from the Surry industry peer reviews and how this application is impacted by those peer review comments.

Page 9 of 18

5.2 Defense-In-Depth Assessment The proposed change to the AOT for two inoperable ARN pumps on the opposite unit maintains the system redundancy, independence, and diversity commensurate with the expected challenges to system operation. The opposite train of emergency power and the associated engineered safety equipment remain operable to mitigate the consequences of any previously analyzed accident. In addition to the Technical Specifications, the Work Management Program, and Maintenance Rule (a)(4) Program provide for controls and assessments to preclude the possibility of simultaneous outages of redundant trains and to ensure system reliability. The proposed increase in the AOT for two inoperable ARN pumps on the opposite unit will not alter the assumptions relative to the causes or mitigation of an accident.

The proposed change needs to meet the defense-in-depth principle consisting of a number of elements. These elements and the impact of the proposed change on each of these elements are as follows:

A reasonable balance among prevention of core damage, prevention of containment failure, and consequence mitigation is preserved.

The proposed Allowed Outage Time change has only a small calculated impact on CDF and LERF. The change does not degrade core damage prevention and compensate with improved containment integrity nor do these changes degrade containment integrity and compensate with improved core damage prevention. The balance between prevention of core damage and prevention of containment failure is maintained. Consequence mitigation remains unaffected by the proposed changes.

Furthermore, no new accident or transients are introduced with the requested change and the likelihood of accidents or transients is not impacted.

Over-reliance on programmatic activities to compensate for weaknesses in plant design.

Safety systems will still function in the same manner with the same reliability. In addition to the restrictions identified by the Tier 2 analysis above, as additional defense-in-depth, the following compensatory measures will be taken to provide additional assurance that public health and safety will not adversely affected by this request.

4 There will be no planned maintenance on either Units Emergency Diesel Generat0rs.

4 There will be no planned maintenance performed on the Unit 1 AFW system which will affect either the 3A AFW pump or AFW cross-tie capability.

4 There will be no planned maintenance on the Alternate AC Diesel Generator (AAC DG).

Page 10 of 18

+ There will be no welding or hot work in the Unit 2 safeguards building

+ There will be no planned maintenance on any other Unit 2 Engineered Safeguards Functions (ESF) components that could render them inoperable.

+ Fire watches will be established in Unit 1 and 2 Main Steam Valve House and Unit 1 and 2 Emergency Switchgear Rooms System redundancy, independence, and diversity are maintained commensurate with the expected frequency and consequences of challenges to the system.

There is no impact on the redundancy, independence, or diversity of the Unit 2 AFW System or on the ability of the plant to respond to events with diverse systems. The AFW System is a diverse and redundant system and will remain so.

Defenses against potential common cause failures are maintained and the potential for introduction of new common cause failure mechanisms is assessed.

Defenses against common cause failures are maintained. The AOT extension requested is not sufficiently long to expect new common cause failure mechanisms to arise. In addition, the operating environment for these components remains the same so, again, new common cause failures modes are not expected. In addition, backup systems are not impacted by this change and no new common cause links between the primary and backup systems are introduced. Therefore, no new potential common cause failure mechanisms have been introduced by the proposed change.

Independence of barriers is not degraded.

The barriers protecting the public and the independence of these barriers are maintained. Multiple systems will not be taken out of service simultaneously that could lead to degradation of these barriers and an increase in risk to the public. In addition, the extended AOT does not provide a mechanism that degrades the independence of the barriers, fuel cladding, reactor coolant system, and containment.

Defenses against human errors are maintained.

No new operator actions related to the one-time AOT extension are required to maintain plant safety. No new operating, maintenance, or test procedures have been introduced due to the change. Administrative controls have been implemented to reflect the compensatory measures that are being established. The increase in the AOT will relieve the time pressure to complete troubleshooting, test and repair activities which should facilitate improved operator and maintenance personnel performance resulting in reduced system re-alignment and re-assembly errors.

It is concluded that defense-in-depthwas not impacted by the proposed changes.

Page 11 of 18

5.3 Safety Margin Assessment The overall margin of safety is not decreased due to the increased AOT for two inoperable AFW pumps on the opposite unit since the system design and operation are not altered by the proposed increase in AOT.

The safety analysis acceptance criteria stated in the Updated Final Safety Analysis Report (UFSAR) are not impacted by the change. Redundancy and diversity of the AFW System will be maintained. The proposed change will not allow plant operation in a configuration outside the design basis. The AFW requirements credited in the accident analysis will remain the same. It was concluded that safety margins were not impacted by the proposed changes.

5.4 Dominant Accident Sequences The dominant accident sequences involving failure of the AFW cross-tie function were reviewed. The results are as follows.

The top sequence is a catastrophic turbine building flood. There is no AFW dependence in this sequence.

The second sequence is a 4160 VAC bus failure, accompanied by steam-driven AFW pump faults and an operator error contribution due to feedwater recovery failure.

There are no other sequences contributing more than 3% to the overall CDF.

5.5 Summary The proposed AOT change is based on a risk-informed evaluation performed in accordance with RG 1.I74 and RG 1.177. The ICCDP without potential common cause vulnerability is 2.6 E-07. The ICLERP without potential common cause vulnerability is 5.4E-09. These results are well below the RG 1.I 74 limits of 1E-06 for ICCDP and 1E-07 for ICLERP. They are also below the RG 1.177 single event limits of 5E-07 for ICCDP and 5E-08 for ICLERP. The defense-in-depth and safety margin is not impacted by the proposed changes.

6.0 Regulatory Safety Analysis 6.1 No Significant Hazards Consideration The proposed change will provide a one-time revision to the Surry Unit 2 AOT of TS 3.6.G.1 to allow two inoperable AFW pumps on the opposite unit for 21 days. The extended AOT will permit repair of the Unit 1 3B motor driven AFW pump. The proposed change is based on a risk-informed evaluation performed in accordance with Regulatory Guides (RG) 1.174, An Approach for Using Probabilistic Risk Assessment Page 12 of 18

in Risk-Informed Decisions On Plant-Specific Changes to the Licensing Basis, and RG 1.I 77, An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications. Dominion has evaluated whether or not a significant hazards consideration is involved with the proposed changes by focusing on the three standards set forth in 10 CFR 50.92, Issuance of Amendment, as discussed below:

1. Does the proposed license amendment involve a significant increase in the probability or consequences of an accident previously evaluated?

The proposed change does not alter any plant equipment or operating practices in such a manner that the probability of an accident is increased. The proposed changes will not alter assumptions relative to the mitigation of an accident or transient event.

The ICCDP without potential common cause vulnerability is 2.6E-07. The ICLERP without potential common cause vulnerability is 5.4E-09. These results are well below the RG 1.I 74 limits of 1 E-06 for ICCDP and 1E-07 for ICLERP. They are also below the RG 1.I77 single event limits of 5.E-07 for ICCDP and 5E-08 for ICLERP.

Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed license amendment create the possibility of a new or different kind of accident from any accident previously evaluated?

The proposed change does not involve a physical alteration of the plant (no new or different type of equipment will be installed) or a change in the methods governing normal plant operation. Therefore, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed amendment involve a significant reduction in a margin of safety?

The impact on safety margins is discussed in section 5.3 of this license amendment request. The systems design and operation are not affected by the proposed changes. The safety analysis acceptance criteria are not altered by the proposed changes.

Therefore, the proposed change does not involve a significant reduction in the margin of safety.

Based on the above, Dominion concludes that the proposed change presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and, accordingly, a finding of no significant hazards consideration is justified.

Page 13 of 18

6.2 Environmental Assessment This amendment request meets the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(~)(9)as follows:

(i) The amendment involves no significant hazards consideration.

As described above, the proposed change involves no significant hazards consideration.

(ii) There is no significant change in the types or significant increase in the amounts of any effluents that may be released offsite.

The proposed change does not involve the installation of any new equipment, or the modification of any equipment that may affect the types or amounts of effluents that may be released offsite. Therefore, there is no significant change in the types or significant increase in the amounts of any effluents that may be released offsite.

(iii) There is no significant increase in individual or cumulative occupation radiation exposure.

The proposed change does not involve plant physical changes, or introduce any new mode of plant operation. Therefore, there is no significant increase in individual or cumulative occupational radiation exposure.

Based on the above, Dominion concludes that the proposed change meets the criteria specified in 10 CFR 51.22 for a categorical exclusion from the requirements of 10 CFR 51.22 relative to requiring a specific environmental assessment by the Commission.

7.0 Conclusion The proposed change will allow a one-time revision to the Surry Unit 2 AOT for TS 3.6.G.1 to allow two inoperable AFW pumps on the opposite unit for 21 days. The extended AOT will permit the repair, testing and return to service of the Unit 1 38 AFW pump. The risk-informed evaluation concludes that the increase in annual core damage and large early release frequencies associated with the proposed change are characterized as very small changes by RG 1.174. The incremental conditional core damage and large and early release probabilities associated with the proposed change are each within the acceptance criteria in RG 1.177. The proposed change will allow repair of the Unit 1 3B AFW pump without having to shut down Unit 2 since activities will take longer than the current AOT. In addition, the proposed extended AOT would eliminate the administrative burden of requesting a notice of enforcement discretion for performing pump repair activities.

The Station Nuclear Safety and Operating Committee and the Management Safety Review Committee have reviewed the proposed change to the Technical Specifications Page 14 of 18

and have concluded that it does not involve a significant hazard consideration and will not endanger the health and safety of the public.

Page 15 of 18

Enclosure 1 Surrv PRA Peer Assessment B Level F&O Review Summary The following matrix contains the B significance level F&Os from the Surry PRA Peer Assessment Element FIO Level of Description Impact on Application Significance AS - Accident AS-2 B No process is in place to identify and incorporate plant None. Although a formal process was not seen Sequence Dev changes into the PRA model. by the Certification team, the SOA and S03a updates did review plant changes since the previous update.

AS-8 B The RCP Seal LOCA model does not include a None: This was included in a previous update.

contribution from early seal failure DA - Data Analysis DA-6 B The models for the EDGs do not consider common None. This was included in a previous update.

cause miscalibrationof instrument channels DA-8 B The approach used for defining CCF terms, by adding None. This was included in a previous update.

fail to start and fail to run data variables can lead to conservative or non-conservative results.

I DA-9 I The beta factor used for CCF of valve plugging may be None. This was fixed in a previous update.

too conservative.

1 DE - Dependency

~

I DE-3

~

I I The methods used to determine CCF groups is None. Addressed by a previous update.

simplistic, and other CCF terms should be considered.

HR - Human HR-2 6 The Surry IPE did not include human errors related to None. Potentially risk significant calibration Reliability instrument miscalibration, or CCF due to miscalibration errors will only occur in the RPS and ESFAS svstems.

I HR-4 I HEPs in post-IPE updates were not well documented, None: Addressed by a previous update.

and need to be evaluated in detail.

~

HR-5 B The evaluation of dependencies between operator None: The HEP sensitivity case adequate actions focused too much on time between actions and addresses this observation.

not enough on different clues being present and additional crews evaluating the situation.

Page 16 of 18

Description Impact on Application IE - Initiating Events 1 IE-3 l B Initiating Event frequencies have not been updated None: Addressed by a previous update.

since the IPE.

IE-4 B The Surry charging line connection to the RCS needs None - not related to AFW cross-tie portion of to be evaluated for a potential failure mechanism that a the PRA model.

small break LOCA event at Oconee.

IE-5 B The Surry ISLOCA analysis needs to be reviewed for None - not related to AFW cross-tie portion of the potential pathway from a leak in the RCP thermal the PRA model.

barrier heat exchanger and a failure to isolate the CCW lines to the heat exchanger IE-8 B The potential for an initiating event due to None - not related to AFW cross-tie portion of failure/cloaaina of the screen wash svstem the PRA model.

Need to ensure that the effects of increased core None - not related to AFW cross-tie portion of power (upgrade to 2586 MWt since the IPE) have been the PRA model.

properly accounted for in the PRA analysis L2, Containment L2-2 B The Level 2 analysis needs to be updated to consider None: Current LERF model is conservative.

Performance the effects of the SAMGs.

Analvsis 1 MU-2 I

~~

MU, Maint & Update B The PRA model needs to be evaluated for effects of None - not related to AFW cross-tie portion of the power upgrade. the PRA model.

MU-3 B The requirements for review of operating experience, None. Although a formal process was not seen plant procedures and plant-controlled documents in by the Certification team, the SOA and S03a support of a PSA update are not detailed in the PSA updates did review plant changes since the guidance documents. previous update.

MU-4 B Activities to evaluate the effects on the PSA of changes None: Addressed by a previous update.

to equipment failure rates, initiator frequencies, and human error probabilities are minimal, and should be reevaluated each major PSA update.

SY, Systems AnaIysis I sy-2 I B The program does not appear to have a formal None: The plant design changes were reviewed requirement for incorporating based on plant design in a previous update. The programmatic issue changes. does not affect this analysis file.

SY-4 B The RPS model does not properly identify the required None: Addressed by a previous update.

support systems.

Page 17 of 18

1 Element Level of Description Impact on Application The RPS logic model is incorrect. The fault tree None: Addressed by a previous update.

indicates that success of either logic train allows challenge to both reactor trip breakers. Actual design is logic train A send signal to RTA and logic train B sends signal to RTB.

SY-11 B The system notebook for HHSl does not discuss Unit None - not related to AFW cross-tie portion of W n i t 2 differences, and the dependency table was not the PRA model.

up to date.

TH, Thermal TH-2 B The presentation of assumptions related to room None: From the F&O itself, the assumptions Hydraulic Analysis cooling of systems other than ESGR and the Aux Bldg appear valid, but simply were not well Ventilation System is not well documented, although it documented in the documents reviewed by the appears that they were adequately addressed in the Cert Team. In any case, such differences would modeling process. not affect the delta CDF/LERF within this I

analysis file.

Page 18 of 18

Serial No.04-731 Docket No. 50-281 Attachment 2 Mark-up of Unit 2 Technical Specifications Change Surry Power Station Unit 2 Virginia Electric and Power Company (Dominion)

TS 3.6-3 ;P

7. One of the two physically independent circuits from the offsite transmission network energizing the opposite units emergency buses.

C. Prior to reactor power exceeding l09by the steam driven auxiliary feedwater pump shall be OPERABLE.

D. System piping, valves, and control board indication required for operation of the components enumerated in Specifications 3.6.B and 3.6.C shall be OPERABLE 0 (automatic initiation instrumentation associated with the opposite units auxiliary feedwater pumps need not be OPERABLE).

E. The specific activity of the secondary coolant system shall be 5 0.10 pCi/cc DOSE EQUIVALENT 1-1 3 1. If the specific activity of the secondary coolant system exceeds 0.10 pCi/cc D0,SE EQUIVALENT 1-131, the reactor shall be shut down and cooled to 500°F or less within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> after detection and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

F. With one auxiliary feedwater pump inoperable, restore at least three auxiliary feedwater pumps (two motor driven feedwater pumps and one steam driven feedwater pump) to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or be in HOT SHUTDOWN within the $

following 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

G. The requirements of Specifications 3.6.B and 3.6.D above concerning the opposite $

units auxiliary feedwater pumps; associated piping, valves, and control board indication: and the protected condensate storage tank may be modified to allow the following components to be inoperable, provided immediate attention is directed to making repairs.

1. One train of the opposite units piping, valves, and control board indications or two of the opposite units auxiliary feedwater pumps may be inoperable for a period not to exceed 14 days.

Serial No.04-731 Docket No. 50-281 Attachment 3 Proposed Unit 2 Technical Specifications Change Surry Power Station Unit 2 Virginia Electric and Power Company (Dominion)

TS 3.6-3

7. One of the two physically independent circuits from the offsite transmission network energizing the opposite units emergency buses.

C. Prior to reactor power exceeding lo%, the steam driven auxiliary feedwater pump shall be OPERABLE.

D. System piping, valves, and control board indication required for operation of the components enumerated in Specifications 3.6.B and 3.6.C shall be OPERABLE (automatic initiation instrumentation associated with the opposite units auxiliary feedwater pumps need not be OPERABLE).

E. The specific activity of the secondary coolant system shall be 50.10 yCi/cc DOSE EQUIVALENT 1-131. If the specific activity of the secondary coolant system exceeds 0.10 yCi/cc DOSE EQUIVALENT 1-131, the reactor shall be shut down and cooled to 500°F or less within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> after detection and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

F. With one auxiliary feedwater pump inoperable, restore at least three auxiliary feedwater pumps (two motor driven feedwater pumps and one steam driven feedwater pump) to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or be in HOT SHUTDOWN within the following 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

G. The requirements of Specifications 3.6.B and 3.6.D above concerning the opposite units auxiliary feedwater pumps; associated piping, valves, and control board indication; and the protected condensate storage tank may be modified to allow the following components to be inoperable, provided immediate attention is directed to making repairs.

1. One train of the opposite units piping, valves, and control board indications or two of the opposite units auxiliary feedwater pumps may be inoperable for a period not to exceed 14 days*.

• For the Surry Unit 2 November 17,2004 entry into TS 3.6.G.1, two of the opposite units auxiliary feedwater pumps may be inoperable for a period not to exceed 21 days.

Amendment Nos.