Text

Technical Specification Bases (Tsb) Change
	ML050950243
Person / Time
Site:	Oconee
Issue date:	03/23/2005
From:	Rosalyn Jones; Duke Power Co
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	Download: ML050950243 (33)
	v • d • e

_ ADuke RON A. JONES OrPowere Vice President Oconee Nuclear Site A Duke Energy Company Duke Power ONOI VP / 7800 Rochester Highway Seneca, SC 29672 864 885 3158 864 885 3564 fax March 23, 2005 U. S. Nuclear Regulatory Commission Washington, D. C. 20555 Attention: Document Control Desk

Subject:

Oconee Nuclear Station Docket Numbers 50-269, 270, and 287 Technical Specification Bases (TSB) Change Please see attached revisions to Tech Spec Bases 3.5.2 which was implemented on January 20, 2005.

Attachment 1 contains the new TSB pages and Attachment 2 contains the marked up version of the Bases pages.

If any additional information is needed, please contact Graham Davenport at 864-885-3044.

Ver tru yours, R. ones, Vice President Oc ee Nuclear Site www.dukepower.com rn

U. S. Nuclear Regulatory Commission March 23, 2005 Page 2 cc: Mr. L. N. Olshan Office of Nuclear Reactor Regulation U. S. Nuclear Regulatory Commission Washington, D. C. 20555 Mr. W. D. Travers, Regional Administrator U. S. Nuclear Regulatory Commission - Region II Atlanta Federal Center 61 Forsyth St., SW, Suite 23T85 Atlanta, Georgia 30303 Mel Shannon Senior Resident Inspector Oconee Nuclear Station Mr. Henry Porter Director Division of Radioactive Waste Management Bureau of Land and Waste Management Department of Health & Environmental Control 2600 Bull Street Columbia, SC 29201 HPI B 3.5.2 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.2 High Pressure Injection (HPI)

BASES BACKGROUND The function of the ECCS is to provide core cooling to ensure that the reactor core is protected after any of the following accidents:

a. Loss of coolant accident (LOCA);

b. Rod ejection accident (REA);

c. Steam generator tube rupture (SGTR); and

d. Main steam line break (MSLB).

There are two phases of ECCS operation: injection and recirculation. In the injection phase, all injection is initially added to the Reactor Coolant System (RCS) via the cold legs or Core Flood Tank (CFT) lines to the reactor vessel. After the borated water storage tank (BWST) has been depleted, the recirculation phase is entered as the suction is transferred to the reactor building sump.

The HPI System consists of two independent trains, each of which splits to discharge into two RCS cold legs, so that there are a total of four HPI injection lines. Each train takes suction from the BWST, and has an automatic suction valve and discharge valve which open upon receipt of an Engineered Safeguards Protective System (ESPS) signal. The two HPI trains are designed and aligned such that they are not both susceptible to any single active failure including the failure of any power operating component to operate or any single failure of electrical equipment. The HPI System is not required to withstand passive failures.

There are three ESPS actuated HPI pumps; the discharge flow paths for two of the pumps are normally aligned to automatically support HPI train "An and the discharge flow path for the third pump is normally aligned to automatically support HPI train "B." The discharge flow paths can be manually aligned such that each of the HPI pumps can provide flow to either train. At least one pump is normally running to provide RCS makeup and seal injection to the reactor coolant pumps. Suction header cross-connect valves are normally open; cross-connecting the HPI suction OCONEE UNITS 1, 2, & 3 B 3.5.2-1 BASES REVISION DATED 03/22/05 l

HPI B 3.5.2 BASES BACKGROUND headers during normal operation was approved by the NRC in (continued) Reference 6. The discharge crossover valves (HP-409 and HP-41 0) are normally closed; these valves can be used to bypass the normal discharge valves and assure the ability to feed either train's injection lines via HPI pump "B.' For each discharge valve and discharge crossover valve, a safety grade flow indicator is provided to enable the operator to throttle flow during an accident to assure that runout limits are not exceeded.

A suction header supplies water from the BWST or the reactor building sump (via the LPI-HPI flow path) to the HPI pumps. HPI discharges into each of the four RCS cold legs between the reactor coolant pump and the reactor vessel. There is one flow limiting orifice in each of the four injection headers that connect to the RCS cold legs. If a pipe break were to occur in an HPI line between the last check valve and the RCS, the orifice in the broken line would limit the HPI flow lost through the break and maximize the flow supplied to the reactor vessel via the other line supplied by the HPI header.

The HPI pumps are capable of discharging to the RCS at an RCS pressure above the opening setpoint of the pressurizer safety valves. The HPI pumps cannot take suction directly from the sump. If the BWST is emptied and HPI is still needed, a cross-connect from the discharge side of the LPI pump to the suction of the HPI pumps would be opened. This is known as "piggy backing" HPI to LPI and enables continued HPI to the RCS.

The HPI System also functions to supply borated water to the reactor core following increased heat removal events, such as MSLBs.

The HPI and LPI (LCO 3.5.3, 0Low Pressure Injection (LPI)") components, along with the passive CFTs and the BWST covered in LCO 3.5.1, "Core Flood Tanks (CFTs),' and LCO 3.5.4, "Borated Water Storage Tank (BWST),' provide the cooling water necessary to meet 10 CFR 50.46 (Ref. 1).

APPLICABLE The LCO helps to ensure that the following acceptance criteria for the SAFETY ANALYSES ECCS, established by 10 CFR 50.46 (Ref. 1), will be met following a LOCA;

a. Maximum fuel element cladding temperature is

22000 F;

b. Maximum cladding oxidation is

0.17 times the total cladding thickness before oxidation; OCONEE UNITS 1, 2, & 3 B 3.5.2-2 BASES REVISION DATED 03/22/05 l

HPI B 3.5.2 BASES APPLICABLE c. Maximum hydrogen generation from a zirconium water reaction is SAFETY ANALYSES < 0.01 times the hypothetical amount generated if all of the metal in (continued) the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react;

d. Core is maintained in a coolable geometry; and

e. Adequate long term cooling capability is maintained.

The HPI System is credited in the small break LOCA analysis (Ref. 2).

This analysis establishes the minimum required flow and discharge head requirements at the design point for the HPI pumps, as well as the minimum required response time for their actuation. The SGTR and MSLB analyses also credit the HPI pumps, but these events are bounded by the small break LOCA analyses with respect to the performance requirements for the HPI System. The HPI System is not credited for mitigation of a large break LOCA.

During a small break LOCA, the HPI System supplies makeup water to the reactor vessel via the RCS cold legs. The HPI System is actuated upon receipt of an ESPS signal. If offsite power is available, the safeguard loads start immediately. If offsite power is not available, the Engineered Safeguards (ES) buses are connected to the Keowee Hydro Units. The time delay associated with Keowee Hydro Unit startup, HPI valve opening, and pump starting determines the time required before pumped flow is available to the core following a LOCA.

One HPI train provides sufficient flow to mitigate most small break LOCAs.

However, for cold leg breaks located on the discharge of the reactor coolant pumps, some HPI injection will be lost out the break; for this case, two HPI trains are required. Thus, three HPI pumps must be OPERABLE to ensure adequate cooling in response to the design basis RCP discharge small break LOCA. Additionally, in the event one HPI train fails to automatically actuate due to a single failure (e.g., failure of HPI pump 'C' or HP-26), operator actions from the Control Room are required to cross-connect the HPI discharge headers within 10 minutes in order to provide HPI flow through a second HPI train (Ref. 6).

Hydraulic separation of the HPI discharge headers is required during normal operation to maintain defense-in-depth (i.e., independence of the HPI discharge headers). Additionally, hydraulic separation of the HPI discharge headers ensures that a complete loss of HPI would not occur in the event an accident were to occur with only two of the three HPI pumps OCONEE UNITS 1, 2, & 3 B 3.5.2-3 BASES REVISION DATED 03/22/05 l

HPI B 3.5.2 BASES APPLICABLE OPERABLE coincident with the HPI discharge headers cross-connected.

SAFETY ANALYSES A single active failure of an HPI pump would leave only one HPI pump to (continued) mitigate the accident. The remaining HPI pump could experience runout conditions and could fail prior to operator action to throttle flow or start another pump.

Hydraulic separation on the suction side of the HPI pumps could cause a loss of redundancy. With any one of the normally open suction header cross-connect valves closed, a failure of an automatic suction valve to open during an accident could cause two pumps to lose suction. Thus, the suction header cross-connect valves must remain open.

The safety analyses show that the HPI pump(s) will deliver sufficient water for a small break LOCA and provide sufficient boron to maintain the core subcritical.

The HPI System satisfies Criterion 3 of 10 CFR 50.36 (Ref. 3).

LCO In MODES 1 and 2, and MODE 3 with RCS temperature > 350 0F, the HPI System is required to be OPERABLE with:

a. Two HPI trains OPERABLE;

b. An additional HPI pump OPERABLE;

c. Two LPI-HPI flow paths OPERABLE;

d. Two HPI discharge crossover valves OPERABLE;

e. HPI suction headers cross-connected; and

f. HPI discharge headers separated.

The LCO establishes the minimum conditions required to ensure that the HPI System delivers sufficient water to mitigate a small break LOCA.

Additionally, individual components within the HPI trains may be called upon to mitigate the consequences of other transients and accidents.

Each HPI train includes the piping, instruments, pump, valves, and controls to ensure an OPERABLE flow path capable of taking suction from the BWST and injecting into the RCS cold legs upon an ESPS signal. For an HPI train to be OPERABLE, the associated HPI pump must be capable of OCONEE UNITS 1, 2, & 3 B 3.5.2-4 BASES REVISION DATED 03/22105 l

HPI B 3.5.2 BASES LCO taking suction from the BWST through the suction header valve associated (continued) with that train upon an ESPS signal. For example:

1) if HPI pump "B" is being credited as part of HPI train "A," then it must be capable of taking suction through HP-24 upon an ESPS signal; or

2) if HPI pump "B" is being credited as part of HPI train "B," then it must be capable of taking suction through HP-25 upon an ESPS signal.

The safety grade flow indicator associated with the normal discharge valve is required to be OPERABLE to support the associated HPI train's automatic OPERABILITY.

To support HPI pump OPERABILITY, the piping, valves and controls which ensure the HPI pump can take suction from the BWST upon an ESPS signal are required to be OPERABLE.

To support HPI discharge crossover valve OPERABILITY, the safety grade flow indicator associated with the HPI discharge crossover valve is required to be OPERABLE.

Each LPI-HPI flow path includes the piping, instruments, valves and controls to ensure the capability to manually transfer suction to the reactor building sump (LPI-HPI flow path). Within the LPI-HPI flow path are the LPI discharge valves to the LPI-HPI flow path (LP-1 5 and LP-1 6). The LPI discharge valves to the LPI-HPI flow path must be capable of being manually (locally and remotely) opened for the LPI-HPI flow path to be OPERABLE. The OPERABILITY requirements regarding the LPI System are addressed in LCO 3.5.3, *Low Pressure Injection (LPI)."

As part of the LPI-HPI flow path, the piping, instruments, valves and controls upstream of LP-1 5 and LP-1 6 are part of the LPI system and are subject to LCO 3.5.3 (Low Pressure Injection system) requirements. The piping, instruments, valves and controls downstream of and including LP-15 and LP-1 6, are part of the HPI system and are subject to LCO 3.5.2 (High Pressure Injection system) requirements.

When a LPI-HPI flow path is inoperable due to the flow path's associated LPI train being inoperable for maintenance only, LP-1 5 or LP-1 6 may also be inoperable for greater than 72-hours up to the associated LPI train's maximum allowed outage time of 7-days. For this scenario, LP-15 or LP-16 can be used as an isolation boundary, with power removed, but no physical work is allowed to be performed on either of these valves.

OCONEE UNITS 1,2, &3 B 3.5.2-5 BASES REVISION DATED 03/22/05 l

HPI B 3.5.2 BASES LCO This is allowed because with an associated LPI train inoperable, there is no (continued) water source for the LPI-HPI piggyback function. This support (LPI train) and supported (LPI-HPI piggyback) relationship is subject to the requirements of TS LCO 3.0.6.

During an event requiring HPI actuation, a flow path is provided to ensure an abundant supply of water from the BWST to the RCS via the HPI pumps and their respective discharge flow paths to each of the four cold leg injection nozzles and the reactor vessel. In the recirculation phase, this flow path is manually transferred to take its supply from the reactor building sump and to supply borated water to the RCS via the LPI-HPI flow path (piggy-back mode).

The OPERABILITY of the HPI System must be maintained to ensure that no single active failure can disable both HPI trains. Additionally, while the HPI System was not designed to cope with passive failures, the HPI trains must be maintained independent to the extent possible during normal operation. The NRC approved exception to this principle is cross-connecting the HPI suction headers during normal operation (Ref. 6).

APPLICABILITY In MODES 1 and 2, and MODE 3 with RCS temperature > 3500F, the HPI System OPERABILITY requirements for the small break LOCA are based on analysis performed at 100% RTP. The HPI pump performance is based on the small break LOCA, which establishes the pump performance curve.

Mode 2 and MODE 3 with RCS temperature > 3500 F requirements are bounded by the MODE 1 analysis.

In MODE 3 with RCS temperature < 3500 F and in MODE 4, the probability of an event requiring HPI actuation is significantly lessened. In this operating condition, the low probability of an event requiring HPI actuation and the LCO 3.5.3 requirements for the LPI System provide reasonable assurance that the safety injection function is preserved.

In MODES 5 and 6, unit conditions are such that the probability of an event requiring HPI injection is extremely low. Core cooling requirements in MODE 5 are addressed by LCO 3.4.7, ARCS Loops - MODE 5, Loops Filled," and LCO 3.4.8, 'RCS Loops - MODE 5, Loops Not Filled."

MODE 6 core cooling requirements are addressed by LCO 3.9.4, "Decay Heat Removal (DHR) and Coolant Circulation - High Water Level," and LCO 3.9.5, "Decay Heat Removal (DHR) and Coolant Circulation - Low Water Level."

OCONEE UNITS 1, 2, & 3 B 3.5.2-6 BASES REVISION DATED 03/22/05 l

HPI B 3.5.2 BASES ACTIONS A.1 and A.2 With one HPI pump inoperable, or one or more HPI discharge crossover valve(s) (i.e., HP-409 and HP-410) inoperable, the HPI pump and discharge crossover valve(s) must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The HPI System continues to be capable of mitigating an accident, barring a single failure. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based on NRC recommendations (Ref. 4) that are based on a risk evaluation and is a reasonable time for many repairs.

In the event HPI pump 'C" becomes inoperable, Condition C must be entered as well as Condition A. Until actions are taken to align an HPI pump to HPI train OB," HPI train 'B" is inoperable due to the inability to automatically provide injection in response to an ESPS signal.

This Condition permits multiple components of the HPI System to be inoperable concurrently. When this occurs, other Conditions may also apply. For example, if HPI pump TC" and HP-409 are inoperable coincidentally, HPI train "B' is incapable of being automatically actuated or manually aligned from the Control Room. Thus, Required Action C.1 would apply.

In order to utilize another HPI pump to supply HPI train "B"when HPI pump "C" is inoperable, HP-1 16 must be opened. This action results in cross-connecting the HPI discharge headers; thus, Condition E must be entered.

HP-1 15 may be closed to provide hydraulic separation provided that pump minimum flow requirements are maintained. However, two operating pumps would be required for this configuration, one to provide makeup flow and one to provide seal injection flow.

B.1. B.2, B.3. and B.4 If the Required Action and associated Completion Time of Condition A is not met, THERMAL POWER of the unit must be reduced to < 75% RTP within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time is reasonable, based on operating experience, to reach the required unit condition from full power conditions in an orderly manner and without challenging unit systems. This time is less restrictive than the Completion Time for Required Action C.1, because the HPI System remains capable of performing its function, barring a single failure.

Two HPI trains are required to mitigate specific small break LOCAs, if no credit for enhanced steam generator cooling is assumed in the accident analysis. However, if equipment not qualified as QA-1 (i.e., an atmospheric dump valve (ADV) flow path for a steam generator) is credited for OCONEE UNITS 1, 2, & 3 B 3.5.2-7 BASES REVISION DATED 03/22/05 l

HPI B 3.5.2 BASES ACTIONS B.1. B.2. B.3. and B.4 (continued) enhanced steam generator cooling, the safety analyses have determined that the capacity of one HPI train is sufficient to mitigate a small break LOCA on the discharge of the reactor coolant pumps if reactor power is c 75% RTP.

Required Actions B.2, B.3, and B.4 modify the HPI pump and discharge crossover valve OPERABILITY requirements to permit reduced requirements at power levels < 75% RTP for an extended period of time.

Required Action B.2 provides a compensatory measure to verify by administrative means that the ADV flow path for each steam generator is OPERABLE within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . This compensatory measure provides additional assurance regarding the ability of the plant to mitigate an accident. Compliance with this requirement can be established by ensuring that the ADV flow path for each steam generator is OPERABLE in accordance with LCO 3.7.4, Atmospheric Dump Valve (ADV) Flow Paths."

Required Actions B.3 and B.4 require that the HPI pump and discharge crossover valve(s) be restored to OPERABLE status within 30 days from initial entry into Condition A. The 30-day time period limits the time that the plant can operate while relying on non QA-1 ADVs to provide enhanced steam generator cooling to mitigate small break LOCAs. The 30-day time period is acceptable, because:

1. Without crediting an ADV flow path, the HPI System remains capable of performing the safety function, barring a single failure;

2. If credit is taken for an ADV flow path for a steam generator, the safety analysis has demonstrated that only one HPI train is required to mitigate the consequences of a small break LOCA when THERMAL POWER is < 75% RTP. Thus, for this case, the HPI System would be capable of performing its safety function even with an additional single failure;

3. OPERABILITY of the ADV flow path for each steam generator is required to be confirmed by Required Action B.2 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

Additional defense-in-depth is provided, because the ADV flow path for only one steam generator is required to mitigate the small break LOCA; and

4. A risk-informed assessment (Ref. 7) concluded that operating the plant in accordance with these Required Actions is acceptable.

OCONEE UNITS 1, 2, & 3 B 3.5.2-8 BASES REVISION DATED 03/22/05 l

HPI B 3.5.2 BASES ACTIONS C.1. C.2. and C.3 If the plant is operating with THERMAL POWER > 75% RTP, two HPI pumps capable of providing flow through two HPI trains are required. One HPI train is required to provide flow automatically upon receipt of an ESPS signal, while flow through the other HPI train must be capable of being established from the Control Room within 10 minutes. Thus, if the plant is operating at > 75% RTP, and one HPI train is inoperable and incapable of being automatically actuated or manually aligned from the Control Room to provide flow post-accident, the HPI System would be incapable of performing its safety function. For this Condition, Required Action C.1 requires the power to be reduced to < 75% RTP within 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months . Required Action C.1 is modified by a Note which limits its applicability to the condition defined above. The 3 hour3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months Completion Time is considered reasonable to reduce the unit from full power conditions to < 75% RTP in an orderly manner and without challenging unit systems. The time frame is more restrictive than the Completion Time provided in Required Action B.1 for the same action, because the condition involves a loss of safety function.

If the plant is operating with THERMAL POWER > 75% RTP and the inoperable HPI train can be automatically actuated or manually aligned to provide flow post-accident, Required Action C.3 permits 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to restore the HPI train to an OPERABLE status.

If enhanced steam generator cooling is not credited in the accident analysis, two HPI trains are required to mitigate specific small break LOCAs with THERMAL POWER < 75% RTP. However, if equipment not qualified as QA-1 (i.e., an ADV flow path for a steam generator) is credited for enhanced steam generator cooling, the safety analyses have determined that the capacity of one HPI train is sufficient to mitigate a small break LOCA on the discharge of the reactor coolant pumps if THERMAL POWER is < 75% RTP. In order to permit an HPI train to be inoperable regardless of the reason when THERMAL POWER is < 75% RTP, Required Action C.2 provides a compensatory measure to verify by administrative means that the ADV flow path for each steam generator is OPERABLE within 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months . This Required Action is modified by a Note which states that it is only required if THERMAL POWER is < 75% RTP.

This compensatory measure provides assurance regarding the ability of the plant to mitigate an accident while in the Condition and THERMAL POWER

< 75% RTP. Compliance with this requirement can be established by ensuring that the ADV flow path for each steam generator is OPERABLE in accordance with LCO 3.7.4, "Atmospheric Dump Valve (ADV) Flow Paths."

OCONEE UNITS 1, 2, & 3 B 3.5.2-9 BASES REVISION DATED 03/22/05 l

HPI B 3.5.2 BASES ACTIONS C.1. C.2. and C.3 (continued)

With one HPI train inoperable, the inoperable HPI train must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This action is appropriate because:

1. With THERMAL POWER < 75% RTP, the safety analysis demonstrates that only one HPI train is required to mitigate the consequences of a small break LOCA assuming credit is taken for the ADV flow path for one steam generator. The OPERABILITY of the ADV flow path for each steam generator is confirmed by Required Action C.2 within 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months . This provides additional defense-in-depth. Additionally, a risk-informed assessment (Ref. 7) concluded that operating the plant in accordance with this Required Action is acceptable.

2. With THERMAL POWER > 75% RTP, the remaining OPERABLE HPI train is capable of automatic actuation, and the inoperable train can be manually aligned by operator action to cross-connect the discharge headers of the HPI trains. This manual action was approved by the NRC in Reference 6.

D.1 With the HPI suction headers not cross-connected, the HPI suction headers must be cross-connected within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The HPI System continues to be capable of mitigating an accident, barring a single failure.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based on NRC recommendations (Ref. 4) that are based on a risk evaluation and is a reasonable time for many repairs.

An argument similar to that utilized for Required Actions B.2, B.3, and B.4 could have been made for operating the HPI System with the suction headers not cross-connected for an extended period of time. However, this action was not considered prudent, due to the potential of damaging two HPI pumps in the event HP-24 or HP-25 failed to open in response to an ESPS signal while the HPI suction headers were not cross-connected.

E.1 With the HPI discharge headers cross-connected, the independence of the HPI trains is not being maintained to the extent practical (i.e., defense-in-depth principle is not met). Thus, the HPI discharge headers must be hydraulically separated within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This action limits the time period that the HPI discharge headers may be cross-connected. The 72-hour allowed outage time is acceptable, because cross-connecting the HPI OCONEE UNITS 1, 2, & 3 B 3.5.2-1 0 BASES REVISION DATED 03/22/05 l

HPI B 3.5.2 BASES ACTIONS E.1 (continued) discharge headers in conjunction with:

1. the rest of the HPI System being OPERABLE would not result in the inability of the HPI System to perform its safety function even assuming a single active failure; and

2. an HPI pump being inoperable would not result in the inability of the HPI System to perform its safety function, barring a single failure.

However, in this condition, a single active failure of one of the two remaining OPERABLE HPI pumps could result in the remaining HPI pump failing due to runout.

F.1 With one LPI-HPI flow path inoperable, the inoperable LPI-HPI flow path must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The HPI System continues to be capable of mitigating an accident, barring a single failure.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is justified because there is a limited range of break sizes, and therefore a lower probability for a small break LOCA which would require piggy back operation.

G.1 and G.2 If a Required Action and associated Completion Time of Condition B, C, D, E, or F are not met, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and the RCS temperature reduced to < 3500F within 60 hours6.944444e-4 days 0.0167 hours 9.920635e-5 weeks 2.283e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

H.1 If two HPI trains are inoperable or two LPI-HPI flow paths are inoperable, the HPI System is incapable of performing its safety function and in a condition not explicitly addressed in the Actions for ITS 3.5.2. Thus, immediate plant shutdown in accordance with LCO 3.0.3 is required.

OCONEE UNITS 1, 2, & 3 B 3.5.2-1 1 BASES REVISION DATED 03/22/05 l

HPI B 3.5.2 BASES SURVEILLANCE SR 3.5.2.1 REQUIREMENTS Verifying the correct alignment for manual and non-automatic power operated valves in the HPI flow paths provides assurance that the proper flow paths will exist for HPI operation. This SR does apply to the HPI suction header cross-connect valves, the HPI discharge cross-connect valves, the HPI discharge crossover valves, and the LPI-HPI flow path discharge valves (LP-1 5 and LP-1 6). This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, or securing. Similarly, this SR does not apply to automatic valves since automatic valves actuate to their required position upon an accident signal.

This Surveillance does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. The 31 day Frequency is appropriate because the valves are operated under administrative control. This Frequency has been shown to be acceptable through operating experience.

SR 3.5.2.2 With the exception of the HPI pump operating to provide normal makeup, the other two HPI pumps are normally in a standby, non-operating mode.

As such, the emergency injection flow path piping has the potential to develop voids and pockets of entrained gases. Venting the HPI pump casings periodically reduces the potential that such voids and pockets of entrained gases can adversely affect operation of the HPI System. This will also reduce the potential for water hammer, pump cavitation, and pumping of noncondensible gas (e.g., air, nitrogen, or hydrogen) into the reactor vessel following an ESPS signal. This Surveillance is modified by a Note that indicates it is not applicable to operating HPI pump(s) providing normal makeup. The 31 day Frequency takes into consideration the gradual nature of gas accumulation in the HPI piping and the existence of procedural controls governing system operation.

SR 3.5.2.3 Periodic surveillance testing of HPI pumps to detect gross degradation caused by impeller structural damage or other hydraulic component problems is required by Section Xl of the ASME Code (Ref. 5). SRs are specified in the Inservice Testing Program, which encompasses Section Xl of the ASME Code.

OCONEE UNITS 1, 2, & 3 B 3.5.2-12 BASES REVISION DATED 03/22/05 l

HPI B 3.5.2 BASES SURVEILLANCE SR 3.5.2.4 and SR 3.5.2.5 REQUIREMENTS (continued) These SRs demonstrate that each automatic HPI valve actuates to the required position on an actual or simulated ESPS signal and that each HPI pump starts on receipt of an actual or simulated ESPS signal. This SR is not required for valves that are locked, sealed, or otherwise secured in position under administrative controls. The test will be considered satisfactory if control board indication verifies that all components have responded to the ESPS actuation signal properly (all appropriate ESPS actuated pump breakers have opened or closed and all ESPS actuated valves have completed their travel). The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. The 18 month Frequency is also acceptable based on consideration of the design reliability (and confirming operating experience) of the equipment. The actuation logic is tested as part of the ESPS testing, and equipment performance is monitored as part of the Inservice Testing Program.

SR 3.5.2.6 Periodic inspections of the reactor building sump suction inlet (for LPI-HPI flow path) ensure that it is unrestricted and stays in proper operating condition. The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage, on the need to preserve access to the location, and on the potential for an unplanned transient if the Surveillance were performed with the reactor at power. This Frequency has been found to be sufficient to detect abnormal degradation and has been confirmed by operating experience.

SR 3.5.2.7 Periodic stroke testing of the HPI discharge crossover valves (HP-409 and HP-41 0) and LPI-HPI flow path discharge valves (LP-1 5 and LP-1 6) is required to ensure that the valves can be manually cycled. The HPI discharge crossover valves must be capable of being stroked from the Control Room. The LPI-HPI flow path discharge valves must be capable of being stroked locally. This test is performed on an 18 month Frequency.

Operating experience has shown that these components usually pass the surveillance when performed at this Frequency. Therefore, the Frequency is acceptable from a reliability standpoint.

OCONEE UNITS 1, 2, & 3 B 3.5.2-1 3 BASES REVISION DATED 03/22/05 l

HPI B 3.5.2 BASES REFERENCES 1. 10 CFR 50.46.

2. UFSAR, Section 15.14.3.3.6.

3. 10 CFR 50.36.

4. NRC Memorandum to V. Stello, Jr., from R.L. Baer,

'Recommended Interim Revisions to LCOs for ECCS Components," December 1, 1975.

5. ASME, Boiler and Pressure Vessel Code, Section Xl, Inservice Inspection, Article IWV-3400.

6. Letter from R. W. Reid (NRC) to W. 0. Parker, Jr. (Duke) transmitting Safety Evaluation for Oconee Nuclear Station, Units Nos. 1, 2, and 3, Modifications to the High Pressure Injection System, dated December 13,1978.

7. Letter from W. R. McCollum (Duke) to the U. S. NRC, "Proposed Amendment to the Facility Operating License Regarding the High Pressure Injection System Requirements," dated December 16, 1998.

OCONEE UNITS 1,2, &3 B 3.5.2-14 BASES REVISION DATED 03/22/05 l HPI B 3.5.2 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.2 High Pressure Injection (HPI)

BASES BACKGROUND The function of the ECCS is to provide core cooling to ensure that the reactor core is protected after any of the following accidents:

a. Loss of coolant accident (LOCA);

b. Rod ejection accident (REA);

c. Steam generator tube rupture (SGTR); and

d. Main steam line break (MSLB).

There are two phases of ECCS operation: injection and recirculation. In the injection phase, all injection is initially added to the Reactor Coolant System (RCS) via the cold legs or Core Flood Tank (CFT) lines to the reactor vessel. After the borated water storage tank (BWST) has been depleted, the recirculation phase is entered as the suction is transferred to the reactor building sump.

The HPI System consists of two independent trains, each of which splits to discharge into two RCS cold legs, so that there are a total of four HPI injection lines. Each train takes suction from the BWST, and has an automatic suction valve and discharge valve which open upon receipt of an Engineered Safeguards Protective System (ESPS) signal. The two HPI trains are designed and aligned such that they are not both susceptible to any single active failure including the failure of any power operating component to operate or any single failure of electrical equipment. The HPI System is not required to withstand passive failures.

There are three ESPS actuated HPI pumps; the discharge flow paths for two of the pumps are normally aligned to automatically support HPI train "A' and the discharge flow path for the third pump is normally aligned to automatically support HPI train "B.' The discharge flow paths can be manually aligned such that each of the HPI pumps can provide flow to either train. At least one pump is normally running to provide RCS makeup and seal injection to the reactor coolant pumps. Suction header cross-connect valves are normally open; cross-connecting the HPI suction OCONEE UNITS 1, 2, & 3 B 3.5.2-1 BASES REVISION DATED Odme&'0f0 Xc)/xcV4'

HPI B 3.5.2 BASES BACKGROUND headers during normal operation was approved by the NRC in (continued) Reference 6. The discharge crossover valves (HP-409 and HP-410) are normally closed; these valves can be used to bypass the normal discharge valves and assure the ability to feed either train's injection lines via HPI pump "B." For each discharge valve and discharge crossover valve, a safety grade flow indicator is provided to enable the operator to throttle flow during an accident to assure that runout limits are not exceeded.

A suction header supplies water from the BWST or the reactor building sump (via the LPI-HPI flow path) to the HPI pumps. HPI discharges into each of the four RCS cold legs between the reactor coolant pump and the reactor vessel. There is one flow limiting orifice in each of the four injection headers that connect to the RCS cold legs. If a pipe break were to occur in an HPI line between the last check valve and the RCS, the orifice in the broken line would limit the HPI flow lost through the break and maximize the flow supplied to the reactor vessel via the other line supplied by the HPI header.

The HPI pumps are capable of discharging to the RCS at an RCS pressure above the opening setpoint of the pressurizer safety valves. The HPI pumps cannot take suction directly from the sump. If the BWST is emptied and HPI is still needed, a cross-connect from the discharge side of the LPI pump to the suction of the HPI pumps would be opened. This is known as "piggy backing" HPI to LPI and enables continued HPI to the RCS.

The HPI System also functions to supply borated water to the reactor core following increased heat removal events, such as MSLBs.

The HPI and LPI (LCO 3.5.3, NLow Pressure Injection (LPI)") components, along with the passive CFTs and the BWST covered in LCO 3.5.1, Core Flood Tanks (CFTs)," and LCO 3.5.4, "Borated Water Storage Tank (BWST)," provide the cooling water necessary to meet 10 CFR 50.46 (Ref. 1).

APPLICABLE The LCO helps to ensure that the following acceptance criteria for the SAFETY ANALYSES ECCS, established by 10 CFR 50.46 (Ref. 1), will be met following a LOCA;

a. Maximum fuel element cladding temperature is

22000 F;

b. Maximum cladding oxidation is

0.17 times the total cladding thickness before oxidation; OCONEE UNITS 1, 2, & 3 B 3.5.2-2 BASES REVISION DATED 1,'20,0' i Xx/Kg/orS

HPI B 3.5.2 BASES APPLICABLE c. Maximum hydrogen generation from a zirconium water reaction is SAFETY ANALYSES s 0.01 times the hypothetical amount generated if all of the metal in (continued) the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react;

d. Core is maintained in a coolable geometry; and

e. Adequate long term cooling capability is maintained.

The HPI System is credited in the small break LOCA analysis (Ref. 2).

This analysis establishes the minimum required flow and discharge head requirements at the design point for the HPI pumps, as well as the minimum required response time for their actuation. The SGTR and MSLB analyses also credit the HPI pumps, but these events are bounded by the small break LOCA analyses with respect to the performance requirements for the HPI System. The HPI System is not credited for mitigation of a large break LOCA.

During a small break LOCA, the HPI System supplies makeup water to the reactor vessel via the RCS cold legs. The HPI System is actuated upon receipt of an ESPS signal. If offsite power is available, the safeguard loads start immediately. If offsite power is not available, the Engineered Safeguards (ES) buses are connected to the Keowee Hydro Units. The time delay associated with Keowee Hydro Unit startup, HPI valve opening, and pump starting determines the time required before pumped flow is available to the core following a LOCA.

One HPI train provides sufficient flow to mitigate most small break LOCAs.

However, for cold leg breaks located on the discharge of the reactor coolant pumps, some HPI injection will be lost out the break; for this case, two HPI trains are required. Thus, three HPI pumps must be OPERABLE to ensure adequate cooling in response to the design basis RCP discharge small break LOCA. Additionally, in the event one HPI train fails to automatically actuate due to a single failure (e.g., failure of HPI pump 'C" or HP-26), operator actions from the Control Room are required to cross-connect the HPI discharge headers within 10 minutes in order to provide HPI flow through a second HPI train (Ref. 6).

Hydraulic separation of the HPI discharge headers is required during normal operation to maintain defense-in-depth (i.e., independence of the HPI discharge headers). Additionally, hydraulic separation of the HPI discharge headers ensures that a complete loss of HPI would not occur in the event an accident were to occur with only two of the three HPI pumps OCONEE UNITS 1, 2, & 3 B 3.5.2-3 BASES REVISION DATED 04M'9&-.j-Y.Y/JeCeios->

HPI B 3.5.2 BASES APPLICABLE OPERABLE coincident with the HPI discharge headers cross-connected.

SAFETY ANALYSES A single active failure of an HPI pump would leave only one HPI pump to (continued) mitigate the accident. The remaining HPI pump could experience runout conditions and could fail prior to operator action to throttle flow or start another pump.

Hydraulic separation on the suction side of the HPI pumps could cause a loss of redundancy. With any one of the normally open suction header cross-connect valves closed, a failure of an automatic suction valve to open during an accident could cause two pumps to lose suction. Thus, the suction header cross-connect valves must remain open.

The safety analyses show that the HPI pump(s) will deliver sufficient water for a small break LOCA and provide sufficient boron to maintain the core subcritical.

The HPI System satisfies Criterion 3 of 10 CFR 50.36 (Ref. 3).

LCO In MODES 1 and 2, and MODE 3 with RCS temperature > 3500F, the HPI System is required to be OPERABLE with:

a. Two HPI trains OPERABLE;

b. An additional HPI pump OPERABLE;

c. Two LPI-HPI flow paths OPERABLE;

d. Two HPI discharge crossover valves OPERABLE;

e. HPI suction headers cross-connected; and

f. HPI discharge headers separated.

The LCO establishes the minimum conditions required to ensure that the HPI System delivers sufficient water to mitigate a small break LOCA.

Additionally, individual components within the HPI trains may be called upon to mitigate the consequences of other transients and accidents.

Each HPI train includes the piping, instruments, pump, valves, and controls to ensure an OPERABLE flow path capable of taking suction from the BWST and injecting into the RCS cold legs upon an ESPS signal. For an HPI train to be OPERABLE, the associated HPI pump must be capable of OCONEE UNITS 1, 2, & 3 B 3.5.2-4 BASES REVISION DATED 4012808 l

HPI B 3.5.2 BASES LCO taking suction from the BWST through the suction header valve associated (continued) with that train upon an ESPS signal. For example:

1) if HPI pump "B" is being credited as part of HPI train "A," then it must be capable of taking suction through HP-24 upon an ESPS signal; or

2) if HPI pump 'B" is being credited as part of HPI train "B," then it must be capable of taking suction through HP-25 upon an ESPS signal.

The safety grade flow indicator associated with the normal discharge valve is required to be OPERABLE to support the associated HPI train's automatic OPERABILITY.

To support HPI pump OPERABILITY, the piping, valves and controls which ensure the HPI pump can take suction from the BWST upon an ESPS signal are required to be OPERABLE.

To support HPI discharge crossover valve OPERABILITY, the safety grade flow indicator associated with the HPI discharge crossover valve is required to be OPERABLE.

Each LPI-HPI flow path includes the piping, instruments, valves and controls to ensure the capability to manually transfer suction to the reactor building sump (LPI-HPI flow path). Within the LPI-HPI flow path are the LPI discharge valves to the LPI-HPI flow path (LP-1 5 and LP-1 6). The LPI discharge valves to the LPI-HPI flow path must be capable of being manually (locally and remotely) opened for the LPI-HPI flow path to be OPERABLE. The OPERABILITY requirements regarding the LPI System are addressed in LCO 3.5.3, "Low Pressure Injection (LPI)."

As part of the LPI-HPI flow path, the piping, instruments, valves and controls upstream of LP-1 5 and LP-1 6 are part of the LPI system and are subject to LCO 3.5.3 (Low Pressure Injection system) requirements. The piping, instruments, valves and controls downstream of and including LP-15 and LP-1 6, are part of the HPI system and are subject to LCO 3.5.2 (High Pressure Injection system) requirements.

During an event requiring HPI actuation, a flow path is provided to ensure an abundant supply of water from the BWST to the RCS via the HPI pumps and their respective discharge flow paths to each of the four cold leg injection nozzles and the reactor vessel. In the recirculation phase, this flow path is manually transferred to take its supply from the reactor building sump and to supply borated water to the RCS via the LPI-HPI flow path (piggy-back mode).

OCONEE UNITS 1,2, & 3 B 3.5.2-5 BASES REVISION DATEDO449.-1-l AXK/O"r

HPI B 3.5.2 BASES LCO The OPERABILITY of the HPI System must be maintained to ensure that (continued) no single active failure can disable both HPI trains. Additionally, while the HPI System was not designed to cope with passive failures, the HPI trains must be maintained independent to the extent possible during normal operation. The NRC approved exception to this principle is cross-connecting the HPI suction headers during normal operation (Ref. 6).

APPLICABILITY In MODES 1 and 2, and MODE 3 with RCS temperature > 350 0F, the HPI System OPERABILITY requirements for the small break LOCA are based on analysis performed at 100% RTP. The HPI pump performance is based on the small break LOCA, which establishes the pump performance curve.

Mode 2 and MODE 3 with RCS temperature > 3500 F requirements are bounded by the MODE 1 analysis.

In MODE 3 with RCS temperature < 3500 F and in MODE 4, the probability of an event requiring HPI actuation is significantly lessened. In this operating condition, the low probability of an event requiring HPI actuation and the LCO 3.5.3 requirements for the LPI System provide reasonable assurance that the safety injection function is preserved.

In MODES 5 and 6, unit conditions are such that the probability of an event requiring HPI injection is extremely low. Core cooling requirements in MODE 5 are addressed by LCO 3.4.7, "RCS Loops - MODE 5, Loops Filled," and LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled."

MODE 6 core cooling requirements are addressed by LCO 3.9.4, "Decay Heat Removal (DHR) and Coolant Circulation - High Water Level," and LCO 3.9.5, "Decay Heat Removal (DHR) and Coolant Circulation - Low Water Level."

ACTIONS A.1 and A.2 With one HPI pump inoperable, or one or more HPI discharge crossover valve(s) (i.e., HP-409 and HP-410) inoperable, the HPI pump and discharge crossover valve(s) must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The HPI System continues to be capable of mitigating an accident, barring a single failure. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based on NRC recommendations (Ref. 4) that are based on a risk evaluation and is a reasonable time for many repairs.

In the event HPI pump NC" becomes inoperable, Condition C must be entered as well as Condition A. Until actions are taken to align an HPI pump to HPI train NB," HPI train "B" is inoperable due to the inability to automatically provide injection in response to an ESPS signal.

OCONEE UNITS 1, 2, & 3 B 3.5.2-6 BASES REVISION DATED4449065 l-Ay-/X#V/6W

HPI B 3.5.2 BASES ACTIONS A.1 and A.2 (continued)

This Condition permits multiple components of the HPI System to be inoperable concurrently. When this occurs, other Conditions may also apply. For example, if HPI pump "C" and HP-409 are inoperable coincidentally, HPI train "B" is incapable of being automatically actuated or manually aligned from the Control Room. Thus, Required Action C.1 would apply.

In order to utilize another HPI pump to supply HPI train 'B" when HPI pump "C" is inoperable, HP-1 16 must be opened. This action results in cross-connecting the HPI discharge headers; thus, Condition E must be entered.

HP-1 15 may be closed to provide hydraulic separation provided that pum minimum flow requirements are maintained. However, two operating pumps would be required for this configuration, one to provide makeup flow and one to provide seal injection flow.

B.1. 1.2. B.3. and B.4 If the Required Action and associated Completion Time of Condition A is not met, THERMAL POWER of the unit must be reduced to

75% RTP within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time is reasonable, based on operating experience, to reach the required unit condition from full power conditions in an orderly manner and without challenging unit systems. This time is less restrictive than the Completion Time for Required Action C.1, because the HPI System remains capable of performing its function, barring a single failure.

Two HPI trains are required to mitigate specific small break LOCAs, if no credit for enhanced steam generator cooling is assumed in the accident analysis. However, if equipment not qualified as QA-1 (i.e., an atmospheric dump valve (ADV) flow path for a steam generator) is credited for enhanced steam generator cooling, the safety analyses have determined that the capacity of one HPI train is sufficient to mitigate a small break LOCA on the discharge of the reactor coolant pumps if reactor power is

75% RTP.

Required Actions B.2, B.3, and B.4 modify the HPI pump and discharge crossover valve OPERABILITY requirements to permit reduced requirements at power levels

75% RTP for an extended period of time.

Required Action B.2 provides a compensatory measure to verify by administrative means that the ADV flow path for each steam generator is OPERABLE within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . This compensatory measure provides additional assurance regarding the ability of the plant to mitigate an accident. Compliance with this requirement can be established by ensuring OCONEE UNITS 1, 2, & 3 B 3.5.2-7 BASES REVISION DATED e01:0.'055-t

HPI B 3.5.2 BASES ACTIONS B.1, B.2, B.3. and B.4 (continued) that the ADV flow path for each steam generator is OPERABLE in accordance with LCO 3.7.4, "Atmospheric Dump Valve (ADV) Flow Paths."

Required Actions B.3 and B.4 require that the HPI pump and discharge crossover valve(s) be restored to OPERABLE status within 30 days from initial entry into Condition A. The 30-day time period limits the time that the plant can operate while relying on non QA-1 ADVs to provide enhanced steam generator cooling to mitigate small break LOCAs. The 30-day time period is acceptable, because:

1. Without crediting an ADV flow path, the HPI System remains capable of performing the safety function, barring a single failure;

2. If credit is taken for an ADV flow path for a steam generator, the safety analysis has demonstrated that only one HPI train is required to mitigate the consequences of a small break LOCA when THERMAL POWER is < 75% RTP. Thus, for this case, the HPI System would be capable of performing its safety function even with an additional single failure;

3. OPERABILITY of the ADV flow path for each steam generator is required to be confirmed by Required Action B.2 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

Additional defense-in-depth is provided, because the ADV flow path for only one steam generator is required to mitigate the small break LOCA; and

4. A risk-informed assessment (Ref. 7) concluded that operating the plant in accordance with these Required Actions is acceptable.

C.1. C.2. and C.3 If the plant is operating with THERMAL POWER > 75% RTP, two HPI pumps capable of providing flow through two HPI trains are required. One HPI train is required to provide flow automatically upon receipt of an ESPS signal, while flow through the other HPI train must be capable of being established from the Control Room within 10 minutes. Thus, if the plant is operating at > 75% RTP, and one HPI train is inoperable and incapable of being automatically actuated or manually aligned from the Control Room to provide flow post-accident, the HPI System would be incapable of performing its safety function. For this Condition, Required Action C.1 requires the power to be reduced to < 75% RTP within 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months . Required Action C.1 is modified by a Note which limits its applicability to the condition defined above. The 3 hour3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months Completion Time is considered reasonable to OCONEE UNITS 1, 2, & 3 B 3.5.2-8 BASES REVISION DATED 0e4,1'01el-4--

x)C/viej/tos

HPI B 3.5.2 BASES ACTIONS C.1. C.2. and C.3 (continued) reduce the unit from full power conditions to

75% RTP in an orderly manner and without challenging unit systems. The time frame is more restrictive than the Completion Time provided in Required Action B.1 for the same action, because the condition involves a loss of safety function.

If the plant is operating with THERMAL POWER > 75% RTP and the inoperable HPI train can be automatically actuated or manually aligned to provide flow post-accident, Required Action C.3 permits 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to restore the HPI train to an OPERABLE status.

If enhanced steam generator cooling is not credited in the accident analysis, two HPI trains are required to mitigate specific small break LOCAs with THERMAL POWER < 75% RTP. However, if equipment not qualified as QA-1 (i.e., an ADV flow path for a steam generator) is credited for enhanced steam generator cooling, the safety analyses have determined that the capacity of one HPI train is sufficient to mitigate a small break LOCA on the discharge of the reactor coolant pumps if THERMAL POWER is < 75% RTP. In order to permit an HPI train to be inoperable regardless of the reason when THERMAL POWER is < 75% RTP, Required Action C.2 provides a compensatory measure to verify by administrative means that the ADV flow path for each steam generator is OPERABLE within 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months . This Required Action is modified by a Note which states that i is only required if THERMAL POWER is < 75% RTP.

This compensatory measure provides assurance regarding the ability of the plant to mitigate an accident while in the Condition and THERMAL POWER

< 75% RTP. Compliance with this requirement can be established by ensuring that the ADV flow path for each steam generator is OPERABLE in accordance with LCO 3.7.4, "Atmospheric Dump Valve (ADV) Flow Paths."

With one HPI train inoperable, the inoperable HPI train must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This action is appropriate because:

1. With THERMAL POWER < 75% RTP, the safety analysis demonstrates that only one HPI train is required to mitigate the consequences of a small break LOCA assuming credit is taken for the ADV flow path for one steam generator. The OPERABILITY of the ADV flow path for each steam generator is confirmed by Required Action C.2 within 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months . This provides additional defense-in-depth. Additionally, a risk-informed assessment (Ref. 7) concluded that operating the plant in accordance with this Required Action is acceptable.

2. With THERMAL POWER > 75% RTP, the remaining OPERABLE HPI train is capable of automatic actuation, and the inoperable train OCONEE UNITS 1, 2, & 3 B 3.5.2-9 BASES REVISION DATEDe4'_e&'Q6 l4

HPI B 3.5.2 BASES ACTIONS C.1. C.2. and C.3 (continued) can be manually aligned by operator action to cross-connect the discharge headers of the HPI trains. This manual action was approved by the NRC in Reference 6.

D.1 With the HPI suction headers not cross-connected, the HPI suction headers must be cross-connected within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The HPI System continues to be capable of mitigating an accident, barring a single failure.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based on NRC recommendations (Ref. 4) that are based on a risk evaluation and is a reasonable time for many repairs.

An argument similar to that utilized for Required Actions B.2, B.3, and B.4 could have been made for operating the HPI System with the suction headers not cross-connected for an extended period of time. However, this action was not considered prudent, due to the potential of damaging two HPI pumps in the event HP-24 or HP-25 failed to open in response to an ESPS signal while the HPI suction headers were not cross-connected.

E.1 With the HPI discharge headers cross-connected, the independence of the HPI trains is not being maintained to the extent practical (i.e., defense-in-depth principle is not met). Thus, the HPI discharge headers must be hydraulically separated within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This action limits the time period that the HPI discharge headers may be cross-connected. The 72-hour allowed outage time is acceptable, because cross-connecting the HPI discharge headers in conjunction with:

1. the rest of the HPI System being OPERABLE would not result in the inability of the HPI System to perform its safety function even assuming a single active failure; and

2. an HPI pump being inoperable would not result in the inability of the HPI System to perform its safety function, barring a single failure.

However, in this condition, a single active failure of one of the two remaining OPERABLE HPI pumps could result in the remaining HPI pump failing due to runout.

OCONEE UNITS 1, 2, & 3 B 3.5.2-10 BASES REVISION DATED 4-

-xle/yl/er

HPI B 3.5.2 BASES ACTIONS F.1 (continued)

With one LPI-HPI flow path inoperable, the inoperable LPI-HPI flow path must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The HPI System continues to be capable of mitigating an accident, barring a single failure.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is justified because there is a limited range of break sizes, and therefore a lower probability for a small break LOCA which would require piggy back operation.

G.1 and G.2 If a Required Action and associated Completion Time of Condition B, C, D, E, or F are not met, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and the RCS temperature reduced to c 3500F within 60 hours6.944444e-4 days 0.0167 hours 9.920635e-5 weeks 2.283e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

H.1 If two HPI trains are inoperable or two LPI-HPI flow paths are inoperable, the HPI System is incapable of performing its safety function and in a condition not explicitly addressed in the Actions for ITS 3.5.2. Thus, immediate plant shutdown in accordance with LCO 3.0.3 is required.

SURVEILLANCE SR 3.5.2.1 REQUIREMENTS Verifying the correct alignment for manual and non-automatic power operated valves in the HPI flow paths provides assurance that the proper flow paths will exist for HPI operation. This SR does apply to the HPI suction header cross-connect valves, the HPI discharge cross-connect valves, the HPI discharge crossover valves, and the LPI-HPI flow path discharge valves (LP-1 5 and LP-1 6). This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, or securing. Similarly, this SR does not apply to automatic valves since automatic valves actuate to their required position upon an accident signal.

This Surveillance does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. The 31 day Frequency is appropriate because the valves are operated under administrative control. This Frequency has been shown to be acceptable through operating experience.

OCONEE UNITS 1, 2, & 3 B 3.5.2-11 BASES REVISION DATED441e,'@ l Xili/i/OS

HPI B 3.5.2 BASES SURVEILLANCE SR 3.5.2.2 REQUIREMENTS (continued) With the exception of the HPI pump operating to provide normal makeup, the other two HPI pumps are normally in a standby, non-operating mode.

As such, the emergency injection flow path piping has the potential to develop voids and pockets of entrained gases. Venting the HPI pump casings periodically reduces the potential that such voids and pockets of entrained gases can adversely affect operation of the HPI System. This will also reduce the potential for water hammer, pump cavitation, and pumping of noncondensible gas (e.g., air, nitrogen, or hydrogen) into the reactor vessel following an ESPS signal. This Surveillance is modified by a Note that indicates it is not applicable to operating HPI pump(s) providing normal makeup. The 31 day Frequency takes into consideration the gradual nature of gas accumulation in the HPI piping and the existence of procedural controls governing system operation.

SR 3.5.2.3 Periodic surveillance testing of HPI pumps to detect gross degradation caused by impeller structural damage or other hydraulic component problems is required by Section Xl of the ASME Code (Ref. 5). SRs are specified in the Inservice Testing Program, which encompasses Section Xl of the ASME Code.

SR 3.5.2.4 and SR 3.5.2.5 These SRs demonstrate that each automatic HPI valve actuates to the required position on an actual or simulated ESPS signal and that each HPI pump starts on receipt of an actual or simulated ESPS signal. This SR is not required for valves that are locked, sealed, or otherwise secured in position under administrative controls. The test will be considered satisfactory if control board indication verifies that all components have responded to the ESPS actuation signal properly (all appropriate ESPS actuated pump breakers have opened or closed and all ESPS actuated valves have completed their travel). The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. The 18 month Frequency is also acceptable based on consideration of the design reliability (and confirming operating experience) of the equipment. The actuation logic is tested as part of the ESPS testing, and equipment performance is monitored as part of the Inservice Testing Program.

OCONEE UNITS 1, 2, & 3 B 3.5.2-12 BASES REVISION DATED01/40,'06 l--I xK&IC/tor

HPI B 3.5.2 BASES SURVEILLANCE SR 3.5.2.6 REQUIREMENTS (continued) Periodic inspections of the reactor building sump suction inlet (for LPI-HPI flow path) ensure that it is unrestricted and stays in proper operating condition. The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage, on the need to preserve access to the location, and on the potential for an unplanned transient if the Surveillance were performed with the reactor at power. This Frequency has been found to be sufficient to detect abnormal degradation and has been confirmed by operating experience.

SR 3.5.2.7 Periodic stroke testing of the HPI discharge crossover valves (HP-409 and HP-410) and LPI-HPI flow path discharge valves (LP-15 and LP-16) is required to ensure that the valves can be manually cycled. The HPI discharge crossover valves must be capable of being stroked from the Control Room. The LPI-HPI flow path discharge valves must be capable of being stroked locally. This test is performed on an 18 month Frequency.

Operating experience has shown that these components usually pass the surveillance when performed at this Frequency. Therefore, the Frequency is acceptable from a reliability standpoint.

REFERENCES 1. 10 CFR 50.46.

2. UFSAR, Section 15.14.3.3.6.

3. 10 CFR 50.36.

4. NRC Memorandum to V. Stello, Jr., from R.L. Baer, "Recommended Interim Revisions to LCOs for ECCS Components," December 1,1975.

5. ASME, Boiler and Pressure Vessel Code, Section Xl, Inservice Inspection, Article IWV-3400.

6. Letter from R. W. Reid (NRC) to W. 0. Parker, Jr. (Duke) transmitting Safety Evaluation for Oconee Nuclear Station, Units Nos. 1, 2, and 3, Modifications to the High Pressure Injection System, dated December 13,1978.

OCONEE UNITS 1,2, &3 B 3.5.2-13 BASES REVISION DATED e£004,'W5-j -.

Y.)(Imel/Cm-

HPI B 3.5.2 BASES REFERENCES 7. Letter from W. R. McCollum (Duke) to the U. S. NRC, "Proposed (continued) Amendment to the Facility Operating License Regarding the High Pressure Injection System Requirements," dated December 16, 1998.

OCONEE UNITS 1, 2, & 3 B 3.5.2-14 BASES REVISION DATED 11'0/0 l Ax,/k)(Or-

When a LPI-HPI flow path is inoperable due to the flow path's associated LPI train being inoperable for maintenance only, LP-1 5 or LP-1 6 may also be inoperable for greater than 72-hours up to the associated LPI train's maximum allowed outage time of 7-days. For this scenario, LP-1 5 or LP-1 6 can be used as an isolation boundary, with power removed, but no physical work is allowed to be performed on either of these valves.

This is allowed because with an associated LPI train inoperable, there is no water source for the LPI-HPI piggyback function. This support (LPI train) and supported (LPI-HPI piggyback) relationship is subject to the requirements of TS LCO 3.0.6.

lts£FI@)

ML050950243

Text

Subject:

Navigation menu

Search