ML070650524

Proposed Technical Specifications Change Temporary 45-Day and 14-Day Allowed Outage Times to Replace Main Control Room and Emergency Switchgear Room Air Conditioning System Chilled Water Piping

ML070650524
Person / Time
Site:	Surry
Issue date:	02/26/2007
From:	Gerald Bichof Virginia Electric & Power Co (VEPCO)
To:	Document Control Desk, NRC/NRR/ADRO
References
07-0109
Download: ML070650524 (125)

Text

VIRGINIA ELECTRIC AND POWER COMPANY RICHMOND, VIRGINIA 23261 February 26, 2007 U.S. Nuclear Regulatory Commission Serial No. 07-0109 Attention: Document Control Desk SPS-LIC/CGL RO Washington, D.C. 20555 Docket Nos. 50-280 50-281 License Nos. DPR-32 DPR-37 VIRGINIA ELECTRIC AND POWER COMPANY SURRY POWER STATION UNITS I AND 2 PROPOSED TECHNICAL SPECIFICATIONS CHANGE TEMPORARY 45-DAY AND 14-DAY ALLOWED OUTAGE TIMES TO REPLACE MAIN CONTROL ROOM AND EMERGENCY SWITCHGEAR ROOM AIR CONDITIONING SYSTEM CHILLED WATER PIPING Pursuant to 10 CFR 50.90, Virginia Electric and Power Company (Dominion) requests amendments, in the form of changes to the Technical Specifications (TS) to Facility Operating License Numbers DPR-32 and DPR-37 for Surry Power Station Units 1 and 2, respectively. The proposed change permits the use of temporary 45-day and 14-day allowed outage times (ACTs) to permit replacement of Main Control Room (MCR) and Emergency Switchgear Room (ESGR) Air Conditioning System (ACS) chilled water piping. Replacement of the piping is necessary because the exterior surface of the piping is exhibiting general corrosion.

Four temporary AOT entries are required to accommodate replacement of 1) the chilled water loop C piping in the ESGR and the MCR (45-day ACT), 2) the chilled water loop A piping in the ESGR and the MCR (45-day ACT), 3) the chilled water piping in the Mechanical Equipment Room #3 (MER-3) associated with chiller 1-VS-E-4A (14-day ACT), and 4) the chilled water piping in MER-3 associated with chiller 1-VS-E-4C (14-day ACT). A probabilistic risk analysis (PRA) has been performed to support the 45-day and 14-day ACTs and demonstrates that the risk associated with the proposed TS change is acceptably small. A related TS 3.23 Basis change reflecting the proposed change is included for the NRC's information.

A discussion of the proposed TS change and the supporting PRA is provided in . The marked-up and proposed TS pages reflecting the proposed change are provided in Attachments 2 and 3, respectively. Attachment 4 presents the chilled water system piping replacement plan. A summary of the Surry internal events PRA and the Westinghouse Owners Group PRA peer review fact and observation forms are provided in Attachments 5 and 6, respectively.

7400/

Serial No. 07-0109 Docket Nos. 50-280, 50-281 Page 2 of 4 We have evaluated the proposed TS change and have determined that it does not involve a significant hazards consideration as defined in 10 CFR 50.92, and the basis for that determination is included in Attachment 1. We have also determined that operation with the proposed change will not result in any significant increase in the amount of effluents that may be released offsite and no significant increase in individual or cumulative occupational radiation exposure. Therefore, the proposed amendment is eligible for categorical exclusion as set forth in 10 CFR 51.22(c)(9). Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment is needed in connection with the approval of the proposed change. The basis for our determination that the change does not involve any significant increase in effluents or radiation exposure is also included in Attachment 1. The proposed changes have been reviewed and approved by the Station Nuclear Safety and Operating Committee.

Approval of this proposed TS change is requested by October 31, 2007 to support the planned entry into the first temporary 45-day AOT early in 2008.

If you have any questions or require additional information, please contact Mr. Gary D. Miller at (804) 273-2771.

Very truly yours, Gerald T. Bischof Vice President - Nuclear Engineering Attachments:

1. Discussion of Change

2. Marked-up Technical Specifications Pages

3. Proposed Technical Specifications Pages

4. Chilled Water System Piping Replacement Plan

5. Summary of Surry Power Station Internal Events Probabilistic Risk Assessment

6. Westinghouse Owners Group PRA Peer Review Fact and Observation Forms Commitments made in this letter:

1. Implementation of equipment unavailability restrictions in Attachment 1.

2. Condition assessment of samples of the piping removed in Phases 1,111, and IV of the replacement plan, discussed in Attachment 4.

3. Implementation of planned compensatory actions in Attachment 4.

Serial No. 07-0109 Docket Nos. 50-280, 50-281 Page 3 of 4 cc: U.S. Nuclear Regulatory Commission Region II Sam Nunn Atlanta Federal Center 61 Forsyth Street, SW Suite 23 T85 Atlanta, Georgia 30303 Mr. N. P. Garrett NRC Senior Resident Inspector Surry Power Station Commissioner Bureau of Radiological Health 1500 East Main Street Suite 240 Richmond, Virginia 23218 Mr. S. P. Lingam NRC Project Manager U. S. Nuclear Regulatory Commission One White Flint North 11555 Rockville Pike Mail Stop 8G9A Rockville, Maryland 20852 Mr. L. N. Olshan NRC Project Manager U. S. Nuclear Regulatory Commission One White Flint North 11555 Rockville Pike Mail Stop 8G9A Rockville, Maryland 20852

Serial No. 07-0109 Docket Nos. 50-280, 50-281 Page 4 of 4 COMMONWEALTH OF VIRGINIA )

)

COUNTY OF HENRICO )

The foregoing document was acknowledged before me, in and for the County and Commonwealth aforesaid, today by Gerald T. Bischof, who is Vice President - Nuclear Engineering, of Virginia Electric and Power Company. He has affirmed before me that he is duly authorized to execute and file the foregoing document in behalf of that Company, and that the statements in the document are true to the best of his knowledge and belief.

Acknowledged before me the 4U---day of* kLA,,,z, 2007.

. a My Commission Expires: LJK/tA U)

{NotX. Publi Notary Public (SEAL)

Attachment I Discussion of Change Temporary 45-day and 14-day AOTs to Replace MCR and ESGR Air Conditioning System Chilled Water Piping Surry Power Station Units 1 and 2 Virginia Electric and Power Company (Dominion)

DISCUSSION OF CHANGE TABLE OF CONTENTS 1.0 Introduction

2.0 Background

2.1 System Description and Design Basis 2.2 Need for Technical Specifications Change 2.3 Industry Precedents 3.0 Description of Proposed Change 4.0 Technical Analysis 4.1 Defense-in-depth Evaluation 4.2 Safety Margin Evaluation 4.3 Risk Evaluation 4.3.1 RG 1.174 and RG 1.177 Tier 1: PRA Capability and Insights 4.3.2 RG 1.177 Tier 2: Avoidance of Risk Significant Plant Configurations 4.3.3 RG 1.177 Tier 3: Risk-informed Configuration Risk Management Program 4.4 Summary 5.0 Regulatory Analysis 5.1 No Significant Hazards Consideration 5.2 Applicable Regulatory Requirements/Criteria 6.0 Environmental Assessment 7.0 Conclusion 8.0 References Page 1 of 23

DISCUSSION OF CHANGE

1.0 INTRODUCTION

Pursuant to 10 CFR 50.90, Virginia Electric and Power Company (Dominion) requests revisions to the Technical Specifications (TS) for Surry Power Station Units 1 and 2.

The proposed change adds an Operating License Condition for each unit regarding use of temporary 45-day and 14-day allowed outage times (AOTs) to permit replacement of Main Control Room (MCR) and Emergency Switchgear Room (ESGR) Air Conditioning System (ACS) chilled water piping. The proposed change also revises TS 3.23 to include a footnote that permits the use of the temporary 45-day and 14-day AOTs for the piping replacement. Four entries into the temporary AOTs will be permitted in a 24-month time span with an average planned out-of-service time of 90 days per 12-month period. The 24-month time frame will begin upon entry into the first temporary AOT. The four entries will accommodate replacement of 1) the chilled water loop C piping in the ESGR and the MCR (45-day AOT), 2) the chilled water loop A piping in the ESGR and the MCR (45-day AOT), 3) the chilled water piping in the Mechanical Equipment Room #3 (MER-3) associated with chiller 1-VS-E-4A (14-day AOT), and 4) the chilled water piping in MER-3 associated with chiller 1-VS-E-4C (14-day AOT). Replacement of the MCR and ESGR ACS chilled water piping in the ESGR, the MCR, and MER-3 is necessary because the exterior surface of the piping is exhibiting general corrosion. A probabilistic risk analysis has been performed to support the individual 45-day and 14-day AOTs, as well as the collective four entries into the temporary AOTs in a 24-month time span with an average planned out-of-service time of 90 days per 12-month period. A related TS 3.23 Basis change reflecting the proposed change is included for the NRC's information.

The proposed change has been reviewed, and it has been determined that the change has no adverse safety impact and that no significant hazards consideration exists as defined in 10 CFR 50.92. In addition, it has been determined that the change qualifies for categorical exclusion from an environmental assessment as set forth in 10 CFR 51.22(c)(9); therefore, no environmental impact statement or environmental assessment is needed in connection with the approval of the proposed change.

2.0 BACKGROUND

2.1 System Description and Design Basis Figure 2 in Attachment 4 illustrates the MCR and ESGR ACS chiller, AHU, and chilled water loop arrangement. The ACS for the Surry Power Station MCR and ESGRs includes five chillers (1-VS-E-4A, 1-VS-E-4B, 1-VS-E-4C, 1-VS-E-4D, and 1-VS-E-4E).

Chillers 4A, 4B, and 4C are located in MER-3 in the Unit 2 Emergency Switchgear Room. Chillers 4D and 4E are located in MER-5 in the Unit 2 Turbine Building. The chillers supply chilled water to eight air handling units (AHUs), which are arranged in two independent and redundant chilled water loops (loops A and C). Each loop contains four AHUs (one for each MCR and ESGR of each unit), the necessary power supplies, the associated valves, piping (from the supply header to return header),

Page 2 of 23

instrumentation, and controls. Chilled water loop A supplies AHUs 1-VS-AC-1 and 2-VS-AC-9 for the MCR, as well as 1-VS-AC-7 and 2-VS-AC-7 for the ESGRs. Chilled water loop C supplies AHUs 1-VS-AC-2 and 2-VS-AC-8 for the MCR, as well as 1-VS-AC-6 and 2-VS-AC-6 for the ESGRs. Each AHU has 100% capacity for cooling its air conditioning zone. Two chillers are powered from single emergency buses (1-VS-E-4C from 2H, 1-VS-E-4E from 1H). The remaining three chillers can be powered from either of two emergency buses (1-VS-E-4A from 1J or 2J, 1-VS-E-4B from 1J or 2H, and 1-VS-E-4D from 1H or 2J). The AHUs are powered from the four emergency buses in pairs (1-VS-AC-1, 1-VS-AC-7 from 1H; 1-VS-AC-2, 1-VS-AC-6 from 1J; 2-VS-AC-6, 2-VS-AC-8 from 2H; 2-VS-AC-7, 2-VS-AC-9 from 2J). Control of the ACS is by manual action.

The design basis of the MCR and ESGR ACS is to maintain the MCR and ESGR envelope temperature within the equipment design limits for 30 days of continuous occupancy after a design basis accident (DBA). The proposed change does not affect the capability of the ACS to perform its required function.

Discussion of operating alignments and accident analysis considerations were provided in a July 5, 2006 submittal to the NRC (Serial No.06-387), which transmitted a TS change request that addresses the inoperability of two or more AHUs per unit.

2.2 Need for Technical Specifications Change The July 5, 2006 TS change request letter included a 7-day AOT for the inoperability of two AHUs per unit on the same chilled water loop. That 7-day AOT will provide operational flexibility for inspection, maintenance, or repair of the chilled water portion of the MCR and ESGR ACS.

Replacement of the MCR and ESGR ACS chilled water piping in the ESGR, the MCR, and MER-3 is necessary because the exterior surface of the piping is exhibiting general corrosion. A project plan and design changes have been initiated to replace the piping, install common supply and return lines associated with the MER-5 chillers, install chilled water loop isolation valves, and install valves/hose connections to accommodate hook up of a chilled water backup supply. The development of the project plan and the design changes has identified the need for an additional TS change with temporary AOTs longer than 7 days (i.e., 45 days and 14 days) for inoperability of two AHUs per unit on the same chilled water loop to accommodate the phased piping replacement project. Without the temporary AOTs, a two-unit shut down would be required to replace the chilled water piping.

The piping located in the ESGR and the MCR, as well as most of the piping in MER-3, was installed as part of the original Surry plant construction. The chilled water piping in MER-5 was installed along with chillers 1-VS-E-4D and 1-VS-E-4E in the 1993-1994 time frame. The tie-in from MER-3 to the MER-5 chillers was also installed with chillers 1-VS-E-4D and 1-VS-E-4E. There is no current plan to replace the chilled water piping installed in the 1993-1994 time frame. The basis for not replacing this piping is its age (i.e., newer), and there has been no indication of leakage based on the periodic Page 3 of 23

pressure testing and visual inspection performed for the risk-informed inservice inspection program.

Discussion of the chilled water piping replacement plan and proposed Chilled Water System modifications is presented in Attachment 4.

Four entries into the temporary AOTs in a 24-month time span with an average planned out-of-service time of 90 days per 12-month period will accommodate replacement of

1) the chilled water loop C piping in the ESGR and the MCR (45-day AOT), 2) the chilled water loop A piping in the ESGR and the MCR (45-day AOT), 3) the chilled water piping in MER-3 associated with chiller 1-VS-E-4A (14-day AOT), and 4) the chilled water piping in MER-3 associated with chiller 1-VS-E-4C (14-day AOT). The replacement of the chilled water piping in MER-3 associated with chiller 1-VS-E-4B can be accomplished within the existing chiller TS requirements and will not require use of a longer temporary AOT. The installation of chilled water loop isolation valves during the piping replacement activities will facilitate future maintenance activities following completion of the piping replacement activities within the 7-day permanent AOT proposed in our July 5, 2006 letter.

The risk analysis associated with this proposed change supports the temporary individual 45-day and 14-day AOTs, as well as the collective four entries into the temporary AOTs in a 24-month time span with an average planned out-of-service time of 90 days per 12-month period. The risk evaluation is discussed in Section 4.3 of this attachment. As noted in Section 4.3, the risk evaluation supporting the proposed TS change was performed considering two 45-day chilled water loop out of service AOTs per year for two years (i.e., an annual average of 90 days per year). The replacement plan presented in Attachment 4 includes entries into two 45-day AOTs and two 14-day AOTs. Thus, the supporting risk evaluation bounds the risk associated with the planned temporary AOT entries.

2.3 Industry Precedents The proposed TS change requests a temporary extension of a 7-day AOT (requested by our July 5, 2006 letter) to 45 days and 14 days as described above. The following approved TS amendments granted extensions in excess of 30 days:

" TS Amendment 62 for Seabrook Unit 1 on September 17, 1999. This amendment increased the 30-day AOT to 60 days on a one-time basis for each train of Control Room Air Conditioning Subsystem to permit modifications.

" TS Amendment 149 for South Texas Project Unit 2 on December 30, 2003. This amendment increased the 21-day AOT to 113 days as a one-time change for the purpose of making repairs to the Unit 2 standby diesel generator.

3.0 DESCRIPTION

OF PROPOSED CHANGE The proposed change adds an Operating License Condition for each unit regarding the use of the temporary AOTs, revises TS 3.23 to include a footnote to TSs 3.23.C.2.a.1 Page 4 of 23

and 3.23.C.2.b.1, and revises the TS 3.23 Basis to reflect the revisions to TS 3.23. The specific proposed revisions are described in the following paragraphs.

Operating License Condition Item Q is added to the Units 1 and 2 Operating Licenses:

Q. As discussed in the footnote to Technical Specifications 3.23.C.2.a.1 and 3.23.C.2.b.1, the use of temporary 45-day and 14-day allowed outage times to permit replacement of the Main Control Room and Emergency Switchgear Room Air Conditioning System chilled water piping shall be in accordance with the basis, risk evaluation, equipment unavailability restrictions, and compensatory actions provided in the licensee's submittal dated February 26, 2007 (Serial No. 07-0109).

The following footnote to TSs 3.23.C.2.a.1 and 3.23.C.2.b.1 is added:

For the purpose of replacing Main Control Room (MCR) and Emergency Switchgear Room (ESGR) Air Conditioning System chilled water piping, temporary 45-day and 14-day allowed outage times (AOTs) are provided. The basis for and the risk evaluation of the temporary AOTs, as well as equipment unavailability restrictions and compensatory actions, are provided in the licensee's submittal dated February 26, 2007 (Serial No. 07-0109). Four entries into the temporary AOTs are permitted in a 24-month time span with an average planned out-of-service time of 90 days per 12-month period. The 24-month time frame begins upon entry into the first temporary AOT. The four entries accommodate replacement of 1) the chilled water loop C piping in the ESGR and the MCR (45-day AOT), 2) the chilled water loop A piping in the ESGR and the MCR (45-day AOT), 3) the chilled water piping in the Mechanical Equipment Room #3 (MER-3) associated with chiller 1-VS-E-4A (14-dayAOT), and 4) the chilled water piping in MER-3 associated with chiller 1-VS-E-4C (14-day AOT). Upon completion of the work associated with the fourth temporary AOT, this footnote is no longer applicable.

The following paragraph is added to the TS 3.23 Basis:

The exterior surface of the MCR and ESGR ACS chilled water piping located in the ESGR, the MCR, and MER-3 is exhibiting general corrosion. For the purpose of replacing the MCR and ESGR ACS chilled water piping, temporary 45-day and 14-day allowed outage times (AOTs) are provided, as discussed in the footnote to Technical Specifications 3.23.C.2.a.1 and 3.23.C.2.b.1. The basis for and the risk evaluation of the temporary AOTs, as well as equipment unavailability restrictions and compensatory actions, are provided in the licensee's submittal dated February 26, 2007 (Serial No. 07-0109). Four entries into the temporary AOTs are permitted in a 24-month time span with an average planned out-of-service time of 90 days per 12-month period. The 24-month time frame begins upon entry into the first temporary AOT. The four entries accommodate replacement of 1) the chilled water loop C piping in the ESGR and the MCR (45-day AOT), 2) the chilled water loop A piping in the ESGR and the MCR (45-day AOT), 3) the chilled water piping in MER-3 associated with chiller 1-VS-E-4A (14-day AOT), and 4) the chilled water piping in MER-3 associated with chiller 1-VS-E-4C (14-day AOT). Upon completion of the work associated with the fourth temporary AOT, the footnote is no longer applicable.

Page 5 of 23

Note that the marked-up pages TS 3.23-2 and TS 3.23-5 in Attachment 2 are excerpted from our July 5, 2006 letter (Serial No.06-387). The revisions associated with the proposed change in this letter are designated by double revision bars in the right margin in Attachments 2 and 3.

4.0 TECHNICAL ANALYSIS

The proposed change has been evaluated using the risk-informed processes described in Regulatory Guide (RG) 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," and RG 1.177, "An Approach for Plant-Specific, Risk-Informed Decision Making: Technical Specifications."

In implementing risk-informed decision-making under RGs 1.174 and 1.177, TS changes are expected to meet a set of five key principles. These principles include consideration of both traditional engineering factors (e.g., defense in depth and safety margins) and risk information. This section provides a summary of the technical analysis of the proposed TS change that considers each one of these principles.

1. The proposed change meets the current regulationsunless it is explicitly related to a requested exemption or rule change.

This change, which continues to meet current regulations, is being requested as a temporary TS change to replace the chilled water pipe.

2. The proposed change is consistent with the defense-in-depth philosophy.

Defense in depth is maintained. In addition to the considerations discussed in this attachment, Attachment 4 includes discussion of compensatory actions planned during the chilled water piping replacement. These compensatory actions, including provisions for backup cooling, provide defense in depth.

3. The proposed change maintains sufficient safety margins.

Margin of safety is established through the design of the plant structures, systems, and components, the parameters within which the plant is operated, and the establishment of the setpoints for the actuation of equipment relied upon to respond to an accident or transient event. The proposed change does not affect the ability of the MCR and ESGR ACS to perform its required function. Sufficient safety margin is maintained.

4. When proposed changes result in an increase in core damage frequency (CDF) or risk, the increases should be small and consistent with the intent of the Commission's Goal Policy Statement.

Page 6 of 23

A risk evaluation is presented that considers the impact of the proposed change with respect to the risk due to:

• internal events (which includes internal flooding),

• internal fires, and

• seismic events.

The risk associated with the proposed temporary TS change was found to be acceptably small, as discussed herein.

5. The impact of the proposed change should be monitored using performance measurementstrategies.

The three-tiered implementation approach consistent with RG 1.177 is used, as discussed herein.

4.1 Defense in Depth Evaluation The proposed addition of the temporary AOTs maintains the balance between prevention and mitigation. The proposed change does not increase the likelihood of any accident, nor create the probability of any new accident. The risk analysis has shown that there is an acceptably small increase in the frequency of a loss of a MCR or ESGR cooling event. Furthermore, the proposed change does not significantly affect the initiators of any other analyzed events or the assumed mitigation of accident or transient events. The risk impact of the proposed change is acceptable and meets the applicable RGs 1.174 and 1.177 guidelines. Table 1 lists the consideration of RG 1.174 defense-in-depth guidelines.

In addition to these considerations, Attachment 4 includes discussion of compensatory actions planned during the chilled water piping replacement.

Table 1 CONSIDERATION OF RG 1.174 DEFENSE-IN-DEPTH GUIDELINES

• 1 Guideline Evaluation

.9 A reasonable balance is No new challenges to core damage, containment failure, or preserved among consequence mitigation are introduced by this proposed prevention of core temporary change. The requested TS change has a damage, prevention of temporary minor impact on the Surry risk profile. The risk containment failure, and assessment shows that the assessed temporary impact on conseauence mitiqation. the Surry risk profile is within RG 1.174 .quidelines.

Over-reliance on Surry was designed with significant and appropriate layers programmatic activities of defense in depth. This fact is demonstrated in the low to compensate for overall plant risk (nominal CDF approximately 4.5E-5/yr weaknesses in plant including internal, fire, and seismic initiators) and the design is avoided. scarcity of highly risk significant components. While programmatic protection plays an important role in maintaining low plant risk, Surry does not rely excessively upon any pro qram for protection. In fact, the historical Page 7 of 23

Table 1 CONSIDERATION OF RG 1.174 DEFENSE-IN-DEPTH GUIDELINES Guideline Evaluation maintenance unavailability of the MCR and ESGR chillers and AHUs has been below the Maintenance Rule performance criteria set for this system.

System redundancy, Outages of redundant safety-related components are limited independence, and by the TS. The proposed addition of the temporary AOT diversity are preserved enhances the existing requirements. In addition, the commensurate with the Dominion 10 CFR 50.65(a)(4) compliance program expected frequency, quantitatively evaluates maintenance configurations to consequences of ensure that risk is adequately managed. This program challenges to the addresses redundant equipment and risk significant system, and dependencies.

uncertainties (e.g., no risk outliers). In the event of severe weather, the Surry Operations staff will enter the abnormal procedure for severe weather. This procedure includes steps to close various doors and take other actions to protect safety-related equipment. It also includes a requirement to update the (a)(4) analysis, which will increase the calculated risk of a potential loss of offsite power. If the results approach or exceed the (a)(4) regulatory limits for instantaneous or sustained risk, then plant procedures require the implementation of compensatory measures to reduce risk by protecting the key safety functions.

The (a)(4) program is comprehensive and has consistently maintained Surry plant risk far below the NUMARC 93-01 risk levels where compensatory measures are required.

Therefore, it is not necessary to supplement this program with additional precautionary measures.

Defenses against No new common cause failure modes/mechanisms will be potential common cause created with the proposed TS change. The proposed TS failures are maintained change permits chilled water piping replacement and does and the potential for not increase the probability of any existing common cause introduction of new failure modes.

common cause failure mechanisms is assessed.

Independence of This change has no impact on the independence of barriers.

barriers is not degraded.

Defenses against human No new potential human errors are expected, and operator errors are preserved. responses presently considered in the risk assessment will not be affected. The proposed TS change permits chilled water piping replacement. The overall risk impact of performing maintenance at power is not significantly Page 8 of 23

Table 1 CONSIDERATION OF RG 1.174 DEFENSE-IN-DEPTH GUIDELINES Guideline Evaluation changed ("small" per RGs 1.174 and 1.177 guidelines).

The intent of the General The 10 CFR Part 50 General Design Criteria are fully Design Criteria in satisfied by the existing TS AOTs. The risk impact Appendix A to 10 CFR associated with the addition of the temporary AOT is Part 50 is maintained, acceptable and meets the applicable RGs 1.174 and 1.177 guidelines for "small" risk increases. Therefore, compliance with 10 CFR Part 50 Appendix A is not affected.

4.2 Safety Margin Evaluation The proposed TS change is consistent with the principle that sufficient safety margins are maintained based on the following:

" Codes and standards (i.e., American Society of Mechanical Engineers (ASME),

Institute of Electrical and Electronic Engineers (IEEE) or alternatives approved for use by the NRC) are met. The proposed change is not in conflict with approved codes and standards relevant to the chilled water system.

" The proposed change does not affect the capability of the MCR and ESGR ACS to perform its required function. This is assured by the implementation of the Planned Compensatory Actions discussed in Attachment 4.

" The proposed change does not involve a change in the methods used to respond to plant transients. There is no alteration to the parameters within which the plant is normally operated or in the setpoints, which initiate protective or mitigative actions.

With the proposed change of one chilled water loop out of service, the risk impact of the proposed TS change is small and within industry risk acceptance guidelines provided in RG 1.177.

" Total system failure could result in the equipment operating temperature exceeding limits in the event of an accident. However, the Planned Compensatory Actions have been evaluated and were determined to be sufficient to minimize the potential for a construction-related failure of the operating chilled water loop, as well as to provide backup cooling should an unexpected loss of chilled water occur during piping replacement activities.

4.3 Risk Evaluation The risk impact of the proposed change for the chilled water loops has been evaluated and found to be acceptable. Although RG 1.177 is intended for permanent changes to plant TS, the following general framework of the RG is considered applicable:

Page 9 of 23

Tier 1 - PRA Capability and Insights Tier 2 - Avoidance of Risk Significant Plant Configurations Tier 3 - Risk-Informed Configuration Risk Management The risk evaluation assesses the risk impact of four temporary 45-day AOTs to permit replacement of the MCR and ESGR ACS chilled water piping. This evaluation supporting the proposed TS change was performed considering two 45-day chilled water loop out of service AOTs per year for two years (i.e., an annual average of 90 days per year). The replacement plan presented in Attachment 4 includes entries into two 45-day AOTs and two 14-day AOTs. Thus, the supporting risk evaluation bounds the risk associated with the planned temporary AOT entries.

The piping replacement is planned for periods when both Unit 1 and Unit 2 are at power, thus, the focus of this risk impact is during power operation. If one unit is not at power during the piping replacement, the only restraint on applicability of the evaluation is that the unit's cross-connects (e.g., charging and auxiliary feedwater) remain available as required by the plant TS. This means that surveillance testing, preventive maintenance, and elective maintenance on the piping and valves in either of the cross-connects is not permitted when the chilled water loop is out of service; however, required corrective maintenance performed within the existing TS AOT is permitted to return the cross-connect to service. Therefore, this risk evaluation is bounding for either both units at power or with one unit at power.

The Planned Compensatory Actions that will be in place during the temporary AOTs are described in Attachment 4. The Planned Compensatory Actions have been evaluated and were determined to be sufficient to minimize the potential for a construction-related failure of the operating chilled water loop, as well as to provide backup cooling should an unexpected loss of chilled water occur during piping replacement activities.

4.3.1 RG 1.174 and RG 1.177 Tier 1: PRA Capability and Insights Risk-informed support for the proposed change is based on probabilistic risk assessment (PRA) calculations performed to quantify the incremental conditional core damage probability (ICCDP) and the incremental conditional large early release probability (ICLERP) resulting from the increased allowed outage time (AOT) for the chilled water loops A and C. The Surry PRA was recently updated (i.e., May 2006).

The Surry PRA model used in this application addresses internal and external events at full power, including internal flooding, internal fire, and seismic events.

The scope, level of detail, and quality of the Surry PRA used in this application is sufficient to support a technically defensible and realistic evaluation of the risk change from this proposed TS change. Details on the quality and attributes of the Surry PRA, including information on PRA updates, peer reviews, and facts and observations, are presented in Attachments 5 and 6. In addition, a summary of the IPEEE external event models used for this application and the review of fire scenarios screened in the IPEEE Page 10 of 23

for impact on this application are also provided in Attachment 5. Six screened fire areas in the IPEEE fire analysis (the MER-5 chiller room, the Unit 1 Cable Tray Room, the Turbine Building, the MER-3 chiller room, Unit 2 Main Transformer and Station Transformer, and Reserve Station Service Transformers) were determined to be the risk significant contributors to this application. The ICCDP contribution from these scenarios was determined to be 1.3E-7. The contribution from these screened fire scenarios was added to the quantified risk impacts from the PRA model used for this application to determine the overall risk impacts.

Quantitative Acceptance Guidelines No specific quantitative guidelines are provided in RGs 1.174 and 1.177 for one-time or temporary risk-informed changes. The quantitative acceptance guidelines in Section 2.2.4 of RG 1.174 are expressed in terms of changes to the annual average impact on CDF and LERF. Because this is a temporary change, the risk impact would not result in an on-going change in CDF and LERF. Nevertheless, as a point of reference, the quantitative acceptance guidelines in RG 1.174 state that a long-term increase in CDF of less than 1E-5/yr and LERF of less than 1E-6/yr would be considered to be "small".

RG 1.177 was developed specifically for TS changes. However, the acceptance guidelines provided in Section 2.4 (i.e., ICCDP < 5E-7, ICLERP < 5E-8) are clearly stated to be "applicable only to permanent (as opposed to temporary or one-time) changes to TS requirements". Similarly, the same text says that RG 1.174 is also applicable to permanent changes only.

Based on the available quantitative guidelines for other applications, Dominion has determined that the quantitative guidelines shown in Table 2 represent a reasonable set of acceptance guidelines. Less restrictive guidelines could also be justified; however, for the purpose of this evaluation, these guidelines demonstrate that the risk impacts are acceptably low.

Table 2 Proposed Risk Acceptance Guidelines Risk Acceptance Guideline Basis ACDF < 1 E-5/yr Consistent with RG 1.174 "small" changes.

ALERF < 1E-6/yr Consistent with RG 1.174 "small" changes.

Consistent with RG 1.177 guideline for ICCDP < 5E-7 permanent TS changes which may be entered repeatedly over the life of the plant.

Consistent with RG 1.177 guideline for ICLERP < 5E-8 permanent TS changes which may be entered repeatedly over the life of the plant.

Page 11 of 23

Risk Analysis The Surry S105Aa PRA model, which includes internal events, internal fire, and seismic events, was used to evaluate the quantitative risk impacts during the planned chilled water piping replacement. To determine the regulatory acceptability of the proposed TS change, the guidance in RGs 1.174 and 1.177 was used. Using the guidance in RG 1.177, the following risk metrics were developed:

ACDF = change of the CDF due to the unavailability of the chilled water loops increased from zero days to 90 days per year (each loop is assumed to be out of service for 45 days per year for two years).

ALERF = change of the LERF due to the unavailability of the chilled water loops increased from zero days to 90 days per year (each loop is assumed to be out of service for 45 days per year for two years).

ICCDP = incremental conditional core damage probability with one chilled water loop out of service for an interval of time equal to the proposed temporary AOT (i.e., 45 days).

ICLERP= incremental conditional large early release probability with one chilled water loop out of service for an interval of time equal to the proposed temporary AOT (i.e., 45 days).

Results Including internal events, internal flooding, internal fire, and seismic events, the maximum ICCDP of one train of chilled water loop out of service for 45 days is 4.7E-7, and the ICLERP is 1.2E-8. These are compared to the RG 1.177 criteria that the ICCDP and ICLERP are "small" if they are less than 5E-7 and 5E-8, respectively.

Therefore, the ICCDP and ICLERP for a 45-day chilled water loop AOT are acceptable per RG 1.177.

Including internal events, internal fire, and seismic events, the total ACDF is 1.7E-6/yr and the ALERF is 3.4E-8/yr, assuming the average annual unavailability of each chilled water loop increases from near zero based on past operation to 1.2E-1 (based on two 45-day loop outages split between two chilled water loops per year, i.e., an annual average of 90 days per year). As defined by RG 1.174, for a plant with Surry's baseline CDF and LERF, permanent increases in CDF are "small" if they are less than 1 E-5/yr and 1E-6/yr, respectively. Applying the guideline for "permanent changes" to CDF and LERF, the proposed temporary TS change is acceptable.

Table 3 summarizes the results of this calculation.

Page 12 of 23

Table 3 RESULTS OF TIER 1 ANALYSES Core Damage Risk Large Early e D g Release Risk Baseline risk from past operating history Unavailabilities of both chilled water ODE = 4.5E-5Iyr LERF = 8.9E-7Iyr loop A and C are set to zero (reflecting past operating history)

Expected annual AOT risk for next two years (two 45-day chilled water loops out of service per year) CDF = 4.6E-5/yr LERF = 9.2E-7/yr Average annual unavailabilities of each ACDF = 1.7E-6/yr ALERF = 3.4E-8/yr chilled water loop A and C are set to 1.23E-1 RG 1.174 Classification "Small" "Very Small" Risk impact of single AOT (loop A)

Chilled water loop A out of service for 45 days Unavailability of chilled water loop A is ICCDP = 3.1 E-7 ICLERP =8.9E-9 set to 1 Unavailability of chilled water loop C is set to zero Risk impact of single AOT (loop C)

Chilled water loop C out of service for 45 days Unavailability of chilled water loop A is ICCDP = 4.7E-7 ICLERP = 1.2E-8 set to zero Unavailability of chilled water loop C is set to 1 RG 1.177 Classification "Small" T ."Small" In accordance with RG 1.174, the cumulative risk associated with prior and proposed NRC approved risk-informed regulatory changes performed in accordance with RG 1.174 must be assessed. Table 4 provides a listing of these changes and the cumulative risk.

Page 13 of 23

Table 4 CUMULATIVE RISK OF RISK-INFORMED REGULATORY CHANGES PERFORMED IN ACCORDANCE WITH RG 1.174 Risk-Informed Regulatory Change (Amendment No.) ACDF ALERF Buried fuel oil tank inspection 7-day AOT (236/235) 2.0E-8/yr 1.6E-1 0/yr Pressurizer PORV bottled air AOT (231/231) 1.7E-8/yr 3.5E-9/yr Monthly to Quarterly RPS & ESFAS surveillance <1% CDF = Not frequency (228/228) -3E-7/yr quantified Unit 1 containment Type A test interval from 10 to 15 Not 4.4E-8/yr years (233/--) quantified Proposed chilled water piping replacement temporary 1.7E-6/yr 3.4E-8/yr AOT I Total 2.1 E-6/yr 8.2E-8/yr 4.3.2 RG 1.177 Tier 2: Avoidance of Risk Significant Plant Configurations In order to avoid risk significant plant equipment outage configurations during the extended allowed outage time of a chilled water loop, the impact of having other equipment unavailable was evaluated. The criteria used to identify potentially risk significant configurations were the ICCDP and ICLERP limits in RG 1.177. Consistent with the guidance in RG 1.177, the results of this initial bounding calculation were reviewed to identify the risk contributions of out-of-service equipment events for the purposes of defining operational restrictions for protecting such equipment during the proposed AOT configuration.

Where a planned configuration permitted by the TS for continued power operation could occur, the configuration was evaluated to determine what outages of other single system trains concurrent with a chilled water loop would potentially exceed the ICCDP and ICLERP limits in RG 1.177 (i.e., 5E-7 for ICCDP and 5E-8 for ICLERP). Since the assessment only considered a single system train out of service concurrent with a chilled water loop, combinations of multiple system trains out of service concurrent with a chilled loop were not evaluated and, therefore, will not be permitted.

This evaluation resulted in a list of equipment in Tables 5 and 6 whose planned unavailability due to surveillance testing and scheduled maintenance (i.e., preventive and elective) will be restricted or limited during a chilled water loop outage.

Removal of any of the components included in Table 5 or 6 from service to perform corrective maintenance within its associated TS AOT is permitted and does not affect the Tier 2 risk analysis or the use of the temporary 45-day chilled water AOT.

However, the corrective maintenance will be reviewed under the Tier 3 configuration risk management program to ensure that the overall risk profile for the plant is appropriately managed.

Page 14 of 23

The following restrictions will also be imposed during a temporary chilled water loop AOT:

• The piping and valves in the auxiliary feedwater and charging cross-connects between the units will not be removed from service for surveillance testing, preventive maintenance, and elective maintenance during a chilled water loop outage.

" Since the risk assessment only considered a single train out of service concurrent with a chilled water loop, combinations of multiple system trains out of service concurrent were not evaluated and, therefore, will not be permitted.

• As described in Attachment 4, measures will be taken to protect the operating chilled water loop from physical damage during construction. Measures will also be taken to ensure fire and flood risks are mitigated by either provisions to maintain adequate barrier or penetration closure or by establishment of fire or flood watches, as required by existing procedures and requirements.

• Attachment 4 includes discussion of additional compensatory actions planned during the chilled water replacement activities, including provisions for backup cooling.

Page 15 of 23

Table 5 TIER 2 EQUIPMENT UNAVAILABILITY RESTRICTIONS FOR UNIT 1 Systems Components Descriptions Restrictions 4KV 1-EP-SW-D Transfer Bus D 1-EP-SW-D Note 1 Transfer 1-EP-SW-E Transfer Bus E 1-EP-SW-E Note 1 Bus 1-EP-SW-F Transfer Bus F 1-EP-SW-F Note 1 1-EP-SW-1H 4160V Emergency Bus 1-EP-SW-IH Note 1 4KV 1-EP-SW-1J 4160V Emergency Bus 1-EP-SW-1J Note 1 Emergency 2-EP-SW-2H 4160V Emergency Bus 2-EP-SW-2H Note 1 2-EP-SW-2J 4160V Emergency Bus 2-EP-SW-2J Note 1 1-EP-MCC-1 H-1 480V MCC 1-EP-MCC-1 H-1 Note 1 1-EP-MCC-1H1-1 480V MCC 1-EP-MCC-1 H1-1 Note 1 1-EP-MCC-1J-1 480V MCC 1-EP-BUS-1J-1 Note 1 480 volt 1-EP-MCC-1JI-1 480V MCC 1-EP-BUS-1JI-1 Note 1 MCC 2-EP-MCC-2H-1 480V MCC 2-EP-MCC-2H-1 Note 1 2-EP-MCC-2H1-1 480V MCC 2-EP-MCC-2H1-1 Note 1 2-EP-MCC-2J-1 480V MCC 2-EP-BUS-2J-1 Note 1 2-EP-MCC-2J1-1 480V MCC 2-EP-BUS-2J1-1 Note 1 125V DC 1-EPD-DCS-1A Station Battery 1A Note 1 Bus 1-EPD-DCS-1 B Station Battery 1B Note 1 1-EE-EG-1 EDG 1-EE-EG-1 Note 2 EDG 2-EE-EG-1 EDG 2-EE-EG-1 Note 2 3-EE-EG-1 EDG 3-EE-EG-1 Note 2 AAC O-AAC-DG-OM AAC Diesel Generator 0-AAC-DG-OM Note 2 1-CC-P-1A CCW Pump 1-CC-P-1A Note 2 1-CC-P-1B CCW Pump 1-CC-P-1B Note 2 CC 1-CC-P-1C CCW Pump 1-CC-P-1C Note 2 1-CC-P-1 D CCW Pump 1-CC-P-1 D Note 2 1-CH-P-1A Charging Pump 1-CH-P-1A Note 2 CH 1-CH-P-1 B Charging Pump 1-CH-P-1 B Note 2 1-CH-P-1C Charging Pump 1-CH-P-1C Note 2 1-CS-P-1A Containment Spray Pump 1-CS-P-1A Note 2 1-CS-P-1B Containment Spray Pump 1-CS-P-1B Note 2 1-FW-P-2 Unit 1 T/D AFW Pump 1-FW-P2 Note 2 FW 1-FW-P-3A Unit 1 M/D AFW Pump 1-FW-P-3A Note 2 1-FW-P-3B Unit 1 M/D AFW Pump 1-FW-P-3A Note 2 2-FW-P-2 Unit 2 T/D AFW Pump 2-FW-P2 Note 2 FW 2-FW-P-3A Unit 2 M/D AFW Pump 2-FW-P-3A Note 2 2-FW-P-3B Unit 2 M/D AFW Pump 2-FW-P-3A Note 2 1-RH-P-1A RHR Pump 1-RH-P-1A Note 2 RH 1-RH-P-1B RHR Pump 1-RH-P-1B Note 2 1-RS-P-1A Inside Containment RS Pump 1-RS-P-1A Note 2 1-RS-P-1 B Inside Containment RS Pump 1-RS-P-1B Note 2 1-RS-P-2A Outside Containment RS Pump 1-RS-P-2A Note 2 1-RS-P-2B Outside Containment RS Pump 1-RS-P-2B Note 2 1-SI-P-1A LHSI Pump 1-SI-P-1A Note 2 1-SI-P-1 B LHSI Pump 1-SI-P-1 B Note 2 1-SW-P-1A Diesel Driven Emergency SW Pump I-SW-P-1A Note 2 SW 1-SW-P-1 B Diesel Driven Emergency SW Pump 1-SW-P-1 B Note 2 1-SW-P-1 C Diesel Driven Emergency SW Pump 1-SW-P-1C Note 2

-SW-P-10A Charging Pump SW pump 1-SW-P-10A Note 2 SW1 i-SW-P-1OB Charging Pump SW pump 1-SW-P-10B Note 2 Page 16 of 23

Table 6 TIER 2 EQUIPMENT UNAVAILABILITY RESTRICTIONS FOR UNIT 2 Systems Components Descriptions Restrictions 4KV 1-EP-SW-D Transfer Bus D 1-EP-SW-D Note 1 Transfer 1-EP-SW-E Transfer Bus E 1-EP-SW-E Note 1 Bus 1-EP-SW-F Transfer Bus F 1-EP-SW-F Note 1 1-EP-SW-1H 4160V Emergency Bus 1-EP-SW-1H Note 1 4KV E1-EP-SW-1J 4160V Emergency Bus 1-EP-SW-1J Note 1 Emergency 2-EP-SW-2H 4160V Emergency Bus 2-EP-SW-2H Note 1 Bus 2-EP-SW-2J 4160V Emergency Bus 2-EP-SW-2J Note 1 1-EP-MCC-1 H-1 480V MCC 1-EP-MCC-1 H-1 Note 1 1-EP-MCC-1HI-1 480V MCC 1-EP-MCC-1HI-1 Note 1 1-EP-MCC-1J-1 480V MCC 1-EP-BUS-1J-1 Note 1

• 480 Volt 1-EP-MCC-1JI-1 480V MCC 1-EP-BUS-IJI-1 Note 1 MCC 2-EP-MCC-2H-1 480V MCC 2-EP-MCC-2H-1 Note 1 2-EP-MCC-2H 480V MCC 2-EP-MCC-2H Note 1 2-EP-MCC-2J-1 480V MCC 2-EP-BUS-2J-1 Note 1 2-EP-MCC-2J1-1 480V MCC 2-EP-BUS-2JI-1 Note 1 125 DC 2-EPD-DCS-2A Station Battery 2A Note 1 Bus 2-EPD-DCS-2B Station Battery 2B Note 1 1-EE-EG-1 EDG 1-EE-EG-1 Note 2 EDG 2-EE-EG-1 EDG 2-EE-EG-1 Note 2 3-EE-EG-1 EDG 3-EE-EG-1 Note 2 AAC 0-AAC-DG-M AAC Diesel Generator 0-AAC-DG-M Note 2 1-CC-P-1A CCW Pump 1-CC-P-1A Note 2 CCW Pump 1-CC-P-1 B Note 2 1-CC-P-1 B 1-CC-P-1C CCW Pump 1-CC-P-1C Note 2 1-CC-P-1 D CCW Pump 1-CC-P-1 D Note 2 2-CH-P-1A Charging Pump 2-CH-P-1A Note 2 CH 2-CH-P-1 B Charging Pump 2-CH-P-1 B Note 2 2-CH-P-1C Charging Pump 2-CH-P-1C Note 2 2-CS-P-1A Containment Spray Pump 2-CS-P-1A Note 2 2-CS-P-1 B Containment Spray Pump 2-CS-P-1 B Note 2 1-FW-P-2 Unit 1 T/D AFW Pump 1-FW-P2 Note 2 FW 1-FW-P-3A Unit 1 M/D AFW Pump 1-FW-P-3A Note 2 1-FW-P-3B Unit 1 M/D AFW Pump 1-FW-P-3A Note 2 2-FW-P-2 Unit 2 T/D AFW Pump 2-FW-P2 Note 2 FW 2-FW-P-3A Unit 2 M/D AFW Pump 2-FW-P-3A Note 2 2-FW-P-3B Unit 2 M/D AFW Pump 2-FW-P-3A Note 2 2-RH-P-1A RHR Pump 2-RH-P-1A Note 2 2-RH-P-1 B RHR Pump 2-RH-P-1 B Note 2 2-RS-P-1A Inside Containment RS Pump 1-RS-P-1A Note 2 RS2-RS-P- B Inside Containment RS Pump 1-RS-P-i B Note 2 2-RS-P-2A Outside Containment RS Pump 2-RS-P-2A Note 2 RS 2-RS-P-2B Outside Containment RS Pump 2-RS-P-2B Note 2 SI 2-SI-P-1A LHSI Pump 2-SI-P-1A Note 2 2-SI-P-1B LHSI Pump 2-SI-P-1B Note 2 1-SW-P-1A Diesel Driven Emergency SW Pump 1-SW-P-1A Note 2 SW 1-SW-P-1 B Diesel Driven Emergency SW Pump 1-SW-P-1 B Note 2 1-SW-P-1C Diesel Driven Emergency SW Pump 1-SW-P-1C Note 2 2-SW-P-10A Charging Pump SW pump 2-SW-P-10A Note 2 2-SW-P-1OB Charging Pump SW pump 2-SW-P-10B Note 2 Page 17 of 23

(1) Surveillance testing, preventive maintenance, and elective maintenance will not be performed with the following exception. TS-required surveillance tests that do not render the equipment inoperable will be performed (e.g., weekly and monthly measurement and recording of station battery parameters).

(2) Required surveillance testing and preventive maintenance will be performed.

Surveillance testing and preventive maintenance scheduled during the temporary AOTs will be evaluated with respect to being rescheduled outside the AOTs.

Equipment redundant to that being removed from service for surveillance testing and preventive maintenance will be identified as protected equipment (see Attachment 4 for discussion of this program). Elective maintenance will not be performed, except on the Emergency SW Pumps as necessary to maintain pump availability (i.e., during periods of high hydroid growth).

4.3.3 RG 1.177 Tier 3: Risk-informed Configuration Risk Management Program Surry has developed a configuration risk management program (CRMP), also used for compliance with the maintenance rule requirements of 10CFR50.65(a)(4), that is governed by station procedures and ensures the risk impact of out-of-service equipment is appropriately evaluated prior to performing any maintenance activity.

Surry's CRMP exceeds the requirements for the maintenance rule (a)(4) in NUMARC 93-01 Revision 3 and fully meets the RG 1.177 CRMP requirements. This program requires an integrated review to uncover risk significant plant equipment outage configurations in a timely manner both during the work management process and for emergent conditions during normal plant operation. Appropriate consideration is given to equipment unavailability, operational activities (such as testing), and weather conditions.

Surry has the capability to perform a configuration dependent assessment of the overall impact on risk of proposed plant configurations prior to and during the performance of maintenance activities that remove equipment from service. The tool used for the risk assessment is the Safety Monitor program developed by SCIENTECH. Risk is reassessed if an equipment failure/malfunction or emergent condition produces a plant configuration that has not been previously assessed.

For surveillance testing and planned maintenance activities, an assessment of the overall risk of the activity on plant safety is performed prior to scheduled work. The assessment includes the following considerations:

" The PRA model used for the Tier 3 CRMP when a chilled water loop is removed from service for the temporary outages requested in this change will include the external event models (i.e., fire and seismic) used for the Tier 1 and 2 evaluation of this change.

• Maintenance activities that affect redundant and diverse structures, systems, and components (SSCs) that provide backup for the same function are minimized.

Page 18 of 23

• The potential for planned activities to cause a plant transient are reviewed and work on SSCs that would be required to mitigate the transient is avoided.

• Work is not scheduled that is likely to exceed a TS AOT requiring a plant shutdown.

• For maintenance rule high risk significant SSCs, the impact of the planned activity on the unavailability performance criteria is evaluated.

As a final check, a risk assessment is performed to ensure that the activity does not pose any unacceptable risk. This evaluation is performed using the impact on both CDF and LERF. The results of the risk assessment are classified by a color code based on the instantaneous increased risk of the activity as shown in Table 7.

Table 7 COLOR CODE BASED ON THE INSTANTANEOUS RISK OF THE ACTIVITY Color Meaning Plant Impact and Required Action Green Low risk significance No required action.

• Yellow Low to moderate risk No required action other than to minimize significance exposure time where possible.

• Potentially significant impact on plant risk.

Orange Moderate risk Requires special review to ensure actual significance configuration time will not accumulate 1.OE-6 CDP or 1.OE-7 LERP.

• No voluntary entry permitted.

Red High risk significance If this condition occurs, immediate and significant I_ actions taken to exit the configuration.

In all cases, if cumulative risk will or is expected to exceed 1.OE-6 CDP or 1.OE-7 LERP, then compensatory measures are required.

Maintenance Rule (MR) Program The reliability and availability of the chilled water system components are monitored under the MR Program. If the pre-established reliability or availability performance criteria are exceeded, they are considered for 10 CFR 50.65, "Requirements for monitoring the effectiveness of maintenance at nuclear power plants", paragraph (a)(1) actions, requiring increased management attention and goal setting in order to restore their performance (i.e., reliability and availability) to an acceptable level. The performance criteria are risk-informed and, therefore, are a means to manage the overall risk profile of the plant. An accumulation of large core damage probabilities over time is precluded by the performance criteria.

Change Control The CRMP is referenced and maintained as an administrative program in accordance with station procedures. The goals of a CRMP are to ensure that risk significant plant configurations will not be inadvertently entered for planned maintenance activities, and Page 19 of 23

appropriate actions will be taken should unforeseen events place the plant in a risk significant configuration during the proposed temporary AOT.

4.4 Summary This request has been evaluated and a supporting risk analysis was performed that considered the impact of the proposed change with respect to the risk due to internal events, internal fires, and seismic events. The risk analysis documented in Section 4.3 in this attachment shows that the risk impact of the requested AOT extension is small and within the RGs 1.174 and 1.177 guidelines. Furthermore, the Dominion CRMP will effectively monitor the risk of emergent conditions during the period of time that the proposed change is in effect. This will ensure that any additional risk increase due to emergent conditions is appropriately managed.

5.0 REGULATORY ANALYSIS

5.1 No Significant Hazards Consideration Virginia Electric and Power Company (Dominion) requests revisions to the Technical Specifications (TS) for Surry Power Station Units 1 and 2. The proposed change adds an Operating License Condition for each unit regarding use of temporary 45-day and 14-day allowed outage times (AOTs) to permit replacement of the Main Control Room (MCR) and Emergency Switchgear Room (ESGR) Air Conditioning System (ACS) chilled water piping. The proposed change also revises TS 3.23 to include a footnote that permits the use of the temporary AOTs, as well as four temporary AOT entries in a 24-month time span with an average planned out-of-service time of 90 days per 12-month period. Dominion has reviewed the requirements of 10 CFR 50.92 as they relate to the proposed change to the Surry TS and has determined that a significant hazards consideration does not exist. The basis for this determination is provided in the following paragraphs.

1. Does the proposed license amendment involve a significant increase in the probability or consequences of an accident previously evaluated?

The proposed change has been evaluated using the risk-informed processes described in Regulatory Guide (RG) 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," and RG 1.177, "An Approach for Plant-Specific, Risk-Informed Decision Making: Technical Specifications." The risk associated with the proposed change was found to be acceptably "small" and therefore not a significant increase in the probability or consequences of an accident previously evaluated.

In addition, the proposed change does not affect the initiators of analyzed events or the assumed mitigation of accident or transient events. During the temporary 45-day and 14-day AOT entries, equipment availability restrictions will restrict or limit the out-of-service time of risk significant plant equipment due to surveillance testing, preventive maintenance, and elective maintenance. In addition, during the Page 20 of 23

replacement activities, compensatory actions will be in place to ensure the availability of chilled water or to provide backup cooling. Therefore, the ACS will continue to perform its required function. As a result, the proposed change to the Surry TS does not involve any significant increase in the probability or the consequences of any accident or malfunction of equipment important to safety previously evaluated since neither accident probabilities nor consequences are being affected by this proposed change.

2. Does the proposed license amendment create the possibility of a new or different kind of accident from any accident previously evaluated?

The proposed change does not involve a change in the methods used to respond to plant transients. There is no alteration to the parameters within which the plant is normally operated or in the setpoints, which initiate protective or mitigative actions.

The MCR and ESGR ACS will continue to perform its required function. This is assured by the planned implementation of compensatory actions, including provisions for backup cooling. Consequently, no new failure modes are introduced by the proposed change. Therefore, the proposed Surry TS change does not create the possibility of a new or different kind of accident or malfunction of equipment important to safety from any previously evaluated.

3. Does the proposed amendment involve a significant reduction in a margin of safety?

Margin of safety is established through the design of the plant structures, systems, and components, the parameters within which the plant is operated, and the establishment of the setpoints for the actuation of equipment relied upon to respond to an accident or transient event. The proposed change does not affect the ability of the MCR and ESGR ACS to perform its required function. This is assured by the planned implementation of compensatory actions, including provisions for backup cooling.

Furthermore, the proposed change has been evaluated using the risk-informed processes described in Regulatory Guide (RG) 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," and RG 1.177, "An Approach for Plant-Specific, Risk-Informed Decision Making: Technical Specifications." The risk associated with the proposed change was found to be acceptably small. Therefore, the proposed change to the Surry TS does not involve a significant reduction in a margin of safety.

5.2 Applicable Regulatory Requirements/Criteria The MCR and ESGR ACS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii) which states:

A structure, system, or component is part of the primary success path and which functions or actuates to mitigate a design basis accident or transient that either assumes the failure of or presents a challenge to the integrity of a fission product barrier.

The design basis of the MCR and ESGR ACS is described in UFSAR Section 9.13, Auxiliary Ventilation Systems.

Page 21 of 23

6.0 ENVIRONMENTAL ASSESSMENT This amendment request meets the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9) as follows:

(i) The amendment involves no significant hazards consideration.

As described above, the proposed TS change does not involve a significant hazards consideration.

(ii) There is no significant change in the types or significant increase in the amounts of any effluents that may be released offsite.

The proposed TS change does not involve the installation of any new equipment or the modification of any equipment that may affect the types or amounts of effluents that may be released offsite. The MCR and ESGR ACS will continue to perform its required function. Therefore, there is no significant change in the types or significant increase in the amounts of any effluents that may be released offsite.

(iii)There is no significant increase in individual or cumulative occupational radiation exposure.

The proposed TS change does not impact the ability of the MCR and ESGR ACS to perform its required function. Therefore, there is no significant increase in individual or cumulative occupational radiation exposure.

Based on the above assessment, Dominion concludes that the proposed change meets the criteria specified in 10 CFR 51.22 for a categorical exclusion from the requirements of 10 CFR 51.22 relative to requiring a specific environmental assessment or impact statement by the Commission.

7.0 CONCLUSION

To facilitate replacement of MCR and ESGR ACS chilled water piping, the proposed change adds an Operating License Condition for each unit and revises TS 3.23 to include a footnote that permits the use of temporary 45-day and 14-day AOTs, as well as the collective four temporary AOT entries in a 24-month time span with an average planned out-of-service time of 90 days per 12-month period. The proposed TS change has been reviewed, and the risk associated with the proposed change has been determined to be acceptably small. The Station Nuclear Safety and Operating Committee (SNSOC) has reviewed the proposed change, and it has been concluded that this change does not have an adverse impact on safety, does not involve a significant hazards consideration, and will not endanger the health and safety of the public.

Page 22 of 23

This package and the associated reviews specifically address the TS change needed to accomplish the chilled water piping replacement. Review of the physical modification of the plant is being conducted in conjunction with the piping replacement project and in accordance with the requirements of the Dominion design control program and 10CFR50.59.

8.0 REFERENCES

1. Dominion letter Serial No.06-387, dated July 5, 2006 -

Subject:

Revision of Main Control Room and Emergency Switchgear Room Air Conditioning System Requirements

2. Surry UFSAR Section 9.13, Auxiliary Ventilation Systems

3. Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis,"

July 1998

4. Regulatory Guide 1.177, "An Approach for Plant-Specific, Risk-informed Decision Making: Technical Specifications." August 1998

5. NRC letter, dated September 17, 1999 -

Subject:

Issuance of Amendment re: Control Room Air Conditioning Allowed Outage Time Extension (TAC No.

MA 5937)

6. NRC letter, dated December 30, 2003 -

Subject:

Issuance of Amendment Concerning One-time Allowed Outage Time Extension for No. 22 Standby Diesel Generator (TAC No. MC 1643)

Page 23 of 23

Attachment 2 Marked-up Technical Specifications Pages Temporary 45-day and 14-day AOTs to Replace MCR and ESGR Air Conditioning System Chilled Water Piping Surry Power Station Units 1 and 2 Virginia Electric and Power Company (Dominion)

2-0-O

) (2) The Updated Final Safety Analysis Report supplement as revised on July 25, October 1, November 4, and December 2, 2002, shall be included in the next scheduled update to the licensee's Updated Final Safety Analysis Report required by 10 CFR 50.71 (e)(4), following the issuance of this renewed license. Until that update is complete, the licensee may make changes to the programs described in such supplement without prior Commission approval, provided that the licensee evaluates each such change pursuant to the criteria set forth in 10 CFR 50.59, and otherwise complies with the requirements in that section.

IidSE- A

4. This renewed license is effective as of the date of issuance, and shall expire at midnight on May 25, 2032.

FOR THE NUCLEAR REGULATORY COMMISSION Samuel J. Collins, Director Office of Nuclear Reactor Regulation

Attachment:

Appendix A, Technical Specifications Date of Issuance: March 20, 2003

)

SURRY - U`NIT I SURRY -- L.i.ee UNT 1Ronowed No. DPR 32-

INSERT A as Unit 1 License Condition Q:

Q. As discussed in the footnote to Technical Specifications 3.23.C.2.a.1 and 3.23.C.2.b.1, the use of temporary 45-day and 14-day allowed outage times to permit replacement of the Main Control Room and Emergency Switchgear Room Air Conditioning System chilled water piping shall be in accordance with the basis, risk evaluation, equipment unavailability restrictions, and compensatory actions provided in the licensee's submittal dated February 26, 2007 (Serial No.

07-0109).

20.08-e-4)

P. Updated Final Safety Analysis Report (1) The Updated Final Safety Analysis Report supplement submitted pursuant to 10 CFR 54.21(d), as revised on July 25, 2002, October 1, 2002, November 4, 2002, and December 2, 2002 describes certain future inspection activities to be completed before the period of extended operation. The licensee shall complete these activities no later than January 29, 2013, and shall notify the NRC in writing when implementation of these activities is complete and can be verified by NRC inspection.

(2) The Updated Final Safety Analysis Report supplement as revised on July 25, 2002, October 1, 2002, November 4, 2002, and December 2, 2002, shall be included in the next scheduled update to the Updated Final Safety Analysis Report required by 10 CFR 50.71 (e)(4), following the issuance of this renewed license. Until that update is complete, the licensee may make changes to the programs described in such supplement without prior Commission approval, provided that the licensee evaluates each such change pursuant to the criteria set forth in 10 CFR 50.59 and otherwise complies with the requirements in that section.

I IJS Ekl- B

4. This renewed license is effective as of the date of issuance, and shall expire at midnight on January 29, 2033.

FOR THE NUCLEAR REGULATORY COMMISSION Samuel J. Collins, Director Office of Nuclear Reactor Regulation

Attachment:

Appendix A, Technical Specifications Date of Issuance: March 20, 2003 SURRY - UNIT 2 -UIRenewed Liccnsc N' DfPl, 37

INSERT B as Unit 2 License Condition Q:

Q. As discussed in the footnote to Technical Specifications 3.23.C.2.a.1 and 3.23.C.2.b.1, the use of temporary 45-day and 14-day allowed outage times to permit replacement of the Main Control Room and Emergency Switchgear Room Air Conditioning System chilled water piping shall be in accordance with the basis, risk evaluation, equipment unavailability restrictions, and compensatory actions provided in the licensee's submittal dated February 26, 2007 (Serial No.

07-0109).

TS 3.23-2

2. Air Handling Units (AHUs)

a. Unit 1 air handling units, 1-VS-AC-1, 1-VS-AC-2, 1-VS-AC-6, and 1-VS-AC-7, must be OPERABLE whenever Unit 1 is above COLD SHUTDOWN.

I. If either any single Unit 1 AHU or two Unit I AHUs on the same chilled water loop (1-VS-AC-1 and 1-VS-AC-7 or 1-VS-AC-2 and 1-VS-AC-6)* I become inoperable, restore operability of the one inoperable AHU or two inoperable AHUs within seven (7) days or bring Unit I to HOT SHUTDOWN within the next six (6) hours and be in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

2. If two Unit 1 AHUs on different chilled water loops and in different air conditioning zones (1-VS-AC-1 and 1-VS-AC-6 or 1-VS-AC-2 and 1-VS-AC-7) become inoperable, restore operability of the two inoperable AHUs within seven (7) days or bring Unit 1 to HOT SHUTDOWN within the next six (6) hours and be in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

3. If two Unit 1 AHUs in the same air conditioning zone (1-VS-AC-I and 1-VS-AC-2 or 1-VS-AC-6 and 1-VS-AC-7) become inoperable, restore operability of at least one Unit 1 AHU in each air conditioning zone (1-VS-AC-1 or 1-VS-AC-2 and 1-VS-AC-6 or 1-VS-AC-7) within one (1) hour or bring Unit I to HOT SHUTDOWN within the next six (6) hours and be in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

4. If more than two Unit I AHUs become inoperable, restore operability of at least one Unit I AHU in each air conditioning zone (1-VS-AC-1 or 1-VS-AC-2 and 1-VS-AC-6 or I-VS-AC-7) within one (1) hour or bring Unit 1 to HOT SHUTDOWN within the next six (6) hours and be in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

b. Unit 2 air handling units, 2-VS-AC-8, 2-VS-AC-9, 2-VS-AC-6, and 2-VS-AC-7 must be OPERABLE whenever Unit 2 is above COLD SHUTDOWN.

1. If either any single Unit 2 AHU or two Unit 2 AHUs on the same chilled water loop (2-VS-AC-7 and 2-VS-AC-9 or 2-VS-AC-6 and 2-VS-AC-8)#*

become inoperable, restore operability of the one inoperable AHU or two inoperable AHUs within seven (7) days or bring Unit 2 to HOT SHUTDOWN within the next six (6) hours and be in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

• ~~ERTC-Amendment Nos.

INSERT C as a footnote to TSs 3.23.C.2.a.1 and 3.23.C.2.b.1:

For the purpose of replacing Main Control Room (MCR) and Emergency Switchgear Room (ESGR) Air Conditioning System chilled water piping, temporary 45-day and 14-day allowed outage times (AOTs) are provided. The basis for and the risk evaluation of the temporary AOTs, as well as equipment unavailability restrictions and compensatory actions, are provided in the licensee's submittal dated February 26, 2007 (Serial No. 07-0109). Four entries into the temporary AOTs are permitted in a 24-month time span with an average planned out-of-service time of 90 days per 12-month period. The 24-month time frame begins upon entry into the first temporary AOT. The four entries accommodate replacement of 1) the chilled water loop C piping in the ESGR and the MCR (45-day AOT), 2) the chilled water loop A piping in the ESGR and the MCR (45-day AOT), 3) the chilled water piping in the Mechanical Equipment Room #3 (MER-3) associated with chiller 1-VS-E-4A (14-day AOT), and 4) the chilled water piping in MER-3 associated with chiller 1-VS-E-4C (14-day AOT). Upon completion of the work associated with the fourth temporary AOT, this footnote is no longer applicable.

TS 3.23-5 I Acceptable operating alignments include one chiller supplying one chilled water loop with four operating AHUs, or two chillers supplying two chilled water loops with two AHUs operating on each loop. In either case, one AHU must be operated in the MCR and ESGR air conditioning zones of each unit. During normal operation, and accident scenarios with a LOOP and single failure of an EDG, one chiller providing chilled water to one chilled water loop with four operating AHUs is sufficient to maintain the MCR and ESGR air temperature within normal limits. In the event of a DBA with all mitigation equipment operating (i.e., higher heat loads due to offsite power available and no single failures), two chillers and two chilled water loops, with one operating AHU in each unit's MCR and ESGR, are necessary to maintain temperatures within normal limits; with one chiller, one chilled water loop, and four operating AHUs, temperatures will be maintained within the equipment design limits.

The MCR and ESGR ACS is considered to be OPERABLE when the individual components necessary to cool the MCR and ESGR envelope are OPERABLE. The operability requirements for the chillers and AHUs are separate but interdependent. The required chillers are considered OPERABLE when required chilled water and service water flowpaths, required power supplies, and controls are OPERABLE. A chiller does not have to be in operation to be considered OPERABLE. An AHU is OPERABLE when the associated chilled water flowpath, fan, motor, dampers, as well as associated ductwork and controls, are OPERABLE.

The Technical Specifications require the operability of the ACS components. Due to the redundancy and diversity of components, the inoperability of one active component does not render the ACS incapable of performing its function. This allows increased flexibility in unit operations under circumstances when more than one ACS component is inoperable.

Similarly, the inoperability of two different components, each in a different loop or powered from a different power supply, does not necessarily result in a loss of function for the ACS. However, due to the emergency power design (three EDGs and four emergency buses), realignment of the swing or shared EDG is required in certain instances of inoperable AHUs and is directed by procedure.

The requirements and action statements for the AHUs powered from an H emergency bus eliminate the potential for complex operator actions in certain instances of two inoperable AHUs. The swing EDG can supply either J bus, but not both. With an AHU powered from the H bus inoperable on each unit, a DBA with a LOOP and no single failure would result in one air conditioning zone with no AHU available. In this case, in order to ensure power is available to an AHU in each air conditioning zone, operators would have to procedurally realign the swing diesel and cross-connect emergency buses. By prohibiting the simultaneous inoperability of an H-bus powered AHU on each unit, cross-connect of the emergency buses will not be necessary. Realignment of the swing diesel is still required, and procedures direct the operators to realign the swing EDG (from the MCR) as necessary to ensure that there is an operating AHU in the MCR and ESGR air conditioning zones of each unit.

INSERT T Amendment Nos.

INSERT D as a new paragraph at the end of TS 3.23 Basis:

The exterior surface of the MCR and ESGR ACS chilled water piping located in the ESGR, the MCR, and in MER-3 is exhibiting general corrosion. For the purpose of replacing the MCR and ESGR ACS chilled water piping, temporary 45-day and 14-day allowed outage times (AOTs) are provided, as discussed in the footnote to Technical Specifications 3.23.C.2.a.1 and 3.23.C.2.b.1. The basis for and the risk evaluation of the temporary AOTs, as well as equipment unavailability restrictions and compensatory actions, are provided in the licensee's submittal dated February 26, 2007 (Serial No. 07-0109). Four entries into the temporary AOTs are permitted in a 24-month time span with an average planned out-of-service time of 90 days per 12-month period. The 24-month time frame begins upon entry into the first temporary AOT. The four entries accommodate replacement of 1) the chilled water loop C piping in the ESGR and the MCR (45-day AOT), 2) the chilled water loop A piping in the ESGR and the MCR (45-day AOT), 3) the chilled water piping in MER-3 associated with chiller 1-VS-E-4A (14-day AOT), and 4) the chilled water piping in MER-3 associated with chiller 1-VS-E-4C (14-day AOT). Upon completion of the work associated with the fourth temporary AOT, the footnote is no longer applicable.

Attachment 3 Proposed Technical Specifications Pages Temporary 45-day and 14-day AOTs to Replace MCR and ESGR Air Conditioning System Chilled Water Piping Surry Power Station Units I and 2 Virginia Electric and Power Company (Dominion)

(2) The Updated Final Safety Analysis Report supplement as revised on July 25, October 1, November 4, and December 2, 2002, shall be included in the next scheduled update to the licensee's Updated Final Safety Analysis Report required by 10 CFR 50.71 (e)(4), following the issuance of this renewed license. Until that update is complete, the licensee may make changes to the programs described in such supplement without prior Commission approval, provided that the licensee evaluates each such change pursuant to the criteria set forth in 10 CFR 50.59, and otherwise complies with the requirements in that section.

Q. As discussed in the footnote to Technical Specifications 3.23.C.2.a.1 and 3.23.C.2.b. 1, the use of temporary 45-day and 14-day allowed outage times to permit replacement of the Main Control Room and Emergency Switchgear Room Air Conditioning System chilled water piping shall be in accordance with the basis, risk evaluation, equipment unavailability restrictions, and compensatory actions provided in the licensee's submittal dated February 26, 2007 (Serial No. 07-0109).

4. This renewed license is effective as of the date of issuance, and shall expire at midnight on May 25, 2032.

FOR THE NUCLEAR REGULATORY COMMISSION Samuel J. Collins, Director Office of Nuclear Reactor Regulation

Attachment:

Appendix A, Technical Specifications Date of Issuance: March 20, 2003 SURRY - UNIT 1

P. Updated Final Safety Analysis Report (1) The Updated Final Safety Analysis Report supplement submitted pursuant to 10 CFR 54.21 (d), as revised on July 25, 2002, October 1, 2002, November 4, 2002, and December 2, 2002 describes certain future inspection activities to be completed before the period of extended operation. The licensee shall complete these activities no later than January 29, 2013, and shall notify the NRC in writing when implementation of these activities is complete and can be verified by NRC inspection.

(2) The Updated Final Safety Analysis Report supplement as revised on July 25, 2002, October 1, 2002, November 4, 2002, and December 2, 2002, shall be included in the next scheduled update to the Updated Final Safety Analysis Report required by 10 CFR 50.71 (e)(4), following the issuance of this renewed license. Until that update is complete, the licensee may make changes to the programs described in such supplement without prior Commission approval, provided that the licensee evaluates each such change pursuant to the criteria set forth in 10 CFR 50.59 and otherwise complies with the requirements in that section.

Q. As discussed in the footnote to Technical Specifications 3.23.C.2.a.1 and 3.23.C.2.b. 1, the use of temporary 45-day and 14-day allowed outage times to permit replacement of the Main Control Room and Emergency Switchgear Room Air Conditioning System chilled water piping shall be in accordance with the basis, risk evaluation, equipment unavailability restrictions, and compensatory actions provided in the licensee's submittal dated February 26, 2007 (Serial No. 07-0109).

4. This renewed license is effective as of the date of issuance, and shall expire at midnight on January 29, 2033.

FOR THE NUCLEAR REGULATORY COMMISSION Samuel J. Collins, Director Office of Nuclear Reactor Regulation

Attachment:

Appendix A, Technical Specifications Date of Issuance: March 20, 2003 SURRY - UNIT 2

TS 3.23-2

2. Air Handling Units (AHUs)

a. Unit 1 air handling units, 1-VS-AC-1, 1-VS-AC-2, 1-VS-AC-6, and 1-VS-AC-7, must be OPERABLE whenever Unit 1 is above COLD SHUTDOWN.

1. If either any single Unit 1 AHU or two Unit 1 AHUs on the same chilled water loop (1-VS-AC-1 and 1-VS-AC-7 or 1-VS-AC-2 and 1-VS-AC-6)* become inoperable, restore operability of the one inoperable AHU or two inoperable AHUs within seven (7) days or bring Unit 1 to HOT SHUTDOWN within the next six (6) hours and be in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

2. If two Unit 1 AHUs on different chilled water loops and in different air conditioning zones (1-VS-AC-1 and 1-VS-AC-6 or 1-VS-AC-2 and 1-VS-AC-7) become inoperable, restore operability of the two inoperable AHUs within seven (7) days or bring Unit 1 to HOT SHUTDOWN within the next six (6) hours and be in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

3. If two Unit 1 AHUs in the same air conditioning zone (1-VS-AC-1 and 1-VS-AC-2 or 1-VS-AC-6 and 1-VS-AC-7) become inoperable, restore operability of at least one Unit 1 AHU in each air conditioning zone (1-VS-AC-1 or 1-VS-AC-2 and 1-VS-AC-6 or 1-VS-AC-7) within one (1) hour or bring Unit 1 to HOT SHUTDOWN within the next six (6) hours and be in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

4. If more than two Unit 1 AHUs become inoperable, restore operability of at least one Unit 1 AHU in each air conditioning zone (1-VS-AC-1 or 1-VS-AC-2 and 1-VS-AC-6 or 1-VS-AC-7) within one (1) hour or bring Unit 1 to HOT SHUTDOWN within the next six (6) hours and be in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

b. Unit 2 air handling units, 2-VS-AC-8, 2-VS-AC-9, 2-VS-AC-6, and 2-VS-AC-7 must be OPERABLE whenever Unit 2 is above COLD SHUTDOWN.

1. If either any single Unit 2 AHU or two Unit 2 AHUs on the same chilled water loop (2-VS-AC-7 and 2-VS-AC-9 or 2-VS-AC-6 and 2-VS-AC-8)* become inoperable, restore operability of the one inoperable AHU or two inoperable AHUs within seven (7) days or bring Unit 2 to HOT SHUTDOWN within the next six (6) hours and be in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

• For the purpose of replacing Main Control Room (MCR) and Emergency Switchgear Room (ESGR) Air Conditioning System chilled water piping, temporary 45-day and 14-day allowed outage times (AOTs) are provided. The basis for and the risk evaluation of the temporary AOTs, as well as equipment unavailability restrictions and compensatory actions, are provided in the licensee's submittal dated February 26, 2007 (Serial No. 07-0109). Four entries into the temporary AOTs are permitted in a 24-month time span with an average planned out-of-service time of 90 days per 12-month period. The 24-month time frame begins upon entry into the first temporary AOT. The four entries accommodate replacement of 1) the chilled water loop C piping in the ESGR and the MCR (45-day AOT), 2) the chilled water loop A piping in the ESGR and the MCR (45-day AOT), 3) the chilled water piping in the Mechanical Equipment Room #3 (MER-3) associated with chiller 1-VS-E-4A (14-day AOT), and 4) the chilled water piping in MER-3 associated with chiller 1-VS-E-4C (14-day AOT). Upon completion of the work associated with the fourth temporary AOT, this footnote is no longer applicable.

Amendment Nos.

TS 3.23-6 I The exterior surface of the MCR and ESGR ACS chilled water piping located in the ESGR, the MCR, and MER-3 is exhibiting general corrosion. For the purpose of replacing the MCR and ESGR ACS chilled water piping, temporary 45-day and 14-day allowed outage times (AOTs) are provided, as discussed in the footnote to Technical Specifications 3.23.C.2.a. 1 and 3.23.C.2.b. 1. The basis for and the risk evaluation of the temporary AOTs, as well as equipment unavailability restrictions and compensatory actions, are provided in the licensee's submittal dated February 26, 2007 (Serial No. 07-0109). Four entries into the temporary AOTs are permitted in a 24-month time span with an average planned out-of-service time of 90 days per 12-month period. The 24-month time frame begins upon entry into the first temporary AOT. The four entries accommodate replacement of 1) the chilled water loop C piping in the ESGR and the MCR (45-day AOT), 2) the chilled water loop A piping in the ESGR and the MCR (45-day AOT), 3) the chilled water piping in MER-3 associated with chiller 1-VS-E-4A (14-day AOT), and 4) the chilled water piping in MER-3 associated with chiller 1-VS-E-4C (14-day AOT). Upon completion of the work associated with the fourth temporary AOT, the footnote is no longer applicable.

Amendment Nos.

Attachment 4 Chilled Water System Piping Replacement Plan Temporary 45-day and 14-day AOTs to Replace MCR and ESGR Air Conditioning System Chilled Water Piping Surry Power Station Units 1 and 2 Virginia Electric and Power Company (Dominion)

CHILLED WATER SYSTEM PIPING REPLACEMENT PLAN TABLE OF CONTENTS Introduction Chilled Water Piping Configuration Options Considered Planned Compensatory Actions Replacement Plan Phase I Phase II Phase III Phase IV Phase V Phase VI Currently Planned Schedule Page 1 of 18

CHILLED WATER PIPING SYSTEM REPLACEMENT PLAN INTRODUCTION As stated in Section 2.2 of Attachment 1, replacement of the MCR and ESGR ACS chilled water piping in the ESGR, the MCR, and MER-3 is necessary because the exterior surface of the piping is exhibiting general corrosion. A project plan and design changes have been initiated to replace the piping, install common supply and return lines associated with the MER-5 chillers, install chilled water loop isolation valves, and install valves/hose connections to accommodate hook up of a chilled water backup supply.

The piping located in the ESGR and the MCR, as well as most of the piping in MER-3, was installed as part of the original Surry plant construction. The chilled water piping in MER-5 was installed along with chillers 1-VS-E-4D and 1-VS-E-4E in the 1993-1994 time frame. The tie-in from MER-3 to the MER-5 chillers was also installed with chillers 1-VS-E-4D and 1-VS-E-4E. There is no current plan to replace the chilled water piping installed in the 1993-1994 time frame. The basis for not replacing this piping is its age (i.e., newer), and there has been no indication of leakage based on the periodic pressure testing and visual inspection performed for the risk-informed inservice inspection program.

The following paragraphs discuss the existing Chilled Water System configuration and the planned modifications, summarize the options considered to address replacement of the chilled water piping, identify planned compensatory actions that will be in place during the replacement activities, present the replacement plan, and present the planned replacement schedule.

EXISTING CHILLED WATER SYSTEM Figure 1 provides a 3-dimensional illustration showing the arrangement of the chilled water portion of the MCR and ESGR ACS, as well as the relative spatial location of the areas (i.e., MCR, the ESGRs, MER-3, and MER-5) and the components. Figure 2 provides a diagram illustrating the existing chiller, AHU, and chilled water loop configuration. Figure 2 illustrates a typical valve alignment for the system; the actual valve alignment is dependent upon the specific equipment in operation. The chilled water piping is located in the MCR, the ESGR, MER-3, and MER-5 and connects the AHUs, the chillers, and the chilled water pumps. The chilled water supply and return lines from the chillers to the AHUs are located in the pipe trench that traverses the ESGRs and MER-3. The pipe trench dimensions are approximately 3 feet wide and 9 inches to 14 inches deep. The configuration of the chilled water piping in the pipe trench is four parallel pipe runs (i.e., the supply and return lines for loops A and C) with limited space between the piping and the trench walls. Thus, the out-of-service loop piping being replaced in the pipe trench is in very close proximity to the in-service piping. The chilled water piping above the trench runs to and in the MCR, as well as in MER-3. The four chilled water pipes (2 supply and 2 return lines) exit the trench between the ESGR AHUs and run vertically into the MCR one floor above. In Page 2 of 18

the common Units 1 and 2 MCR, the chilled water piping runs between the two air handler rooms through a small stairwell in order to service the four MCR AHUs. At the opposite end of the ESGR trench, the four lines penetrate the MER-3 wall rising only a few feet and are then distributed between the three chillers in MER-3.

PLANNED CHILLED WATER SYSTEM MODIFICATIONS Figure 3 provides a diagram illustrating the proposed final Chilled Water System configuration, including the planned modifications. The planned modifications, which add features to be used during the replacement activities and provide future operational flexibility, are summarized as follows:

• A common supply line and a common return line, including isolation valves V13 and V14, will be added to tie in chillers 1-VS-E-4D and 1-VS-E-4E. Addition of these lines will ensure that at least four chillers are available during the temporary 45-day and 14-day AOTs. The existing tie-in points for chillers 1-VS-E-4D and 1-VS-E-4E do not provide this enhanced chiller availability.

, The chilled water backup supply from the non-safety-related Service Building chillers 1-VS-E-3A and 1-VS-E-3B located in MER-1 is connected to chilled water loop A. Hose connections to accommodate hook up of the backup supply will be added by the installation of valves V9/V10 and V11N12 on loops A and C, respectively. These hose connections will facilitate use of the chilled water backup supply during Phases III through VI of the replacement plan, if needed.

• Chilled water loops A and C presently do not have loop isolation provisions. To permit chilled water loop isolation, valves V1/V2 and V3/V4 will be added on loops A and C, respectively. In addition, to allow the isolation of MCR AHUs from ESGR AHUs, valves V5N6 and V7N8 will be added on loops A and C, respectively.

OPTIONS CONSIDERED A feasibility study was conducted to assess options for replacing the ESGR chilled water piping. Two options considered were:

• Replacement of the piping in the current configuration.

• Rerouting of the piping via several different pathways.

The feasibility study identified the advantages and disadvantages of the replacement and rerouting options. The advantages and disadvantages are presented in Table 1.

Page 3 of 18

TABLE 1 ADVANTAGES AND DISADVANTAGES OF REPLACEMENT AND REROUTING OF CHILLED WATER PIPING Replacement of Chilled Water Piping Rerouting of Chilled Water Piping Advantages Disadvantages Advantages Disadvantages Minimum piping and Restricted and No restricted or Extensive piping support analysis congested space for congested space for and pipe support welding and fit-up in welding and fit-up analysis the trench Minimum pipe Localized widening No widening of pipe Installation of new/

support modification of pipe trench may trench additional pipe be required to supports and piping facilitate work No flow or hydraulic Highly skilled Construction of evaluation welders required to missile and perform welding seismically qualified structures Relatively less Review of impact on man-hour intensive seismic spectra due to added missile and seismic structures in non-seismic areas Possible impact on existing seismic evaluation of SSCs due to changes in seismic spectral curves Man-hour intensive Flow and hydraulic evaluation Potential interference issues Although the option of piping replacement in the current configuration presents significant challenges with respect to the limited space in the pipe trench, the disadvantages related to the rerouting option outweigh the pipe trench challenges, as illustrated in Table 1. It should be noted that the feasibility study assessed permanent (versus temporary) rerouting of the chilled water piping in the ESGR. However, some of the considerations related to permanent rerouting also apply to temporary rerouting during piping replacement (e.g., use of a temporary jumper).

Based on the complexities involved with the permanent rerouting option, the potential impact on existing structures, systems, and components (SSCs), and the potential for Page 4 of 18

additional construction-related issues, it has been concluded that either permanent rerouting of the chilled water piping or the use of a temporary jumper during piping replacement is not a viable option. Thus, the rerouting option in the ESGR (either permanent or temporary) has been ruled out. A similar conclusion has been drawn for rerouting the MCR and MER-3 chilled water piping.

In addition to the assessment of replacement in the current configuration versus rerouting, the following material selection options were also considered:

• Replacement with austenitic stainless steel piping.

• Replacement with non-metallic piping.

• Replacement with exterior epoxy coated carbon steel piping.

The plan described herein will replace the existing carbon steel piping in the ESGR, MCR, and MER-3 with exterior epoxy coated carbon steel piping. The selection of this material over other materials was based upon our material service experience. The existing Chilled Water System carbon steel piping in the ESGR, MCR, and MER-3 has been in service for over 30 years and has generally demonstrated a good service history. Additionally, the existing pipe supports require little to no modifications and no additions when using carbon steel. Due to the advances in the epoxy coating material technology over the last thirty years, it is expected to exhibit improved durability. Since removable metal plating covers the piping installed in the ESGR trench, the likelihood of damage to the exterior coating is minimized. The carbon steel piping above the trench in the MCR and MER-3 will be covered with anti-sweat insulation material.

Table 2 summarizes the advantages and disadvantages of each of the three materials considered. Based on the information presented in Table 2, exterior epoxy coated carbon steel material was selected for use in the chilled water piping replacement plan.

Page 5 of 18

TABLE 2 ADVANTAGES AND DISADVANTAGES OF MATERIAL SELECTION OPTIONS Material Selection Advantages Disadvantages Austenitic Stainless

• Durability

• More time consuming welding Steel

• No exterior coating required effort (compared to carbon

• Virtually maintenance-free steel)

• Major pipe support redesign required (due to 50% greater coefficient of thermal expansion than that of carbon steel)

• Increase in number and/or duration of required AOTs, which would have a negative impact on PRA results

• Least economically attractive alternative Non-metallic Material

• Corrosion-free

• Major pipe support redesign

• Relatively easy installation required (due to 10 times (NOTE: Most of the

• Favorable material costs greater coefficient of thermal advantages and expansion than that of carbon disadvantages listed steel) for high density

• Significantly lower allowable polyethylene (HDPE) stress would result in twice the piping also apply to number of pipe supports fiberglass reinforced

• Increase in number and/or plastic piping duration of required AOTs material.) likely and would have a negative impact on PRA results

• HDPE material recommended for buried piping only

• Code Case for HDPE material under development

• Flammable Exterior Epoxy

• None to minimal piping/pipe

• Potential epoxy coating Coated Carbon Steel support redesign required failures could result in

• Relatively easy and less time increased inspection and consuming welding effort maintenance compared to stainless steel

• Coating repairs difficult due to

• Positive impact on number limited accessibility especially and duration of required AOTs in the ESGR trench compared to other options

• Economically attractive alternative Page 6 of 18

PLANNED COMPENSATORY ACTIONS In addition to the equipment unavailability restrictions resulting from the Tier 2 risk analysis identified in Section 4.3.2 of Attachment 1, the following compensatory actions are planned and will be in place during the chilled water piping replacement activities.

These planned compensatory actions have been evaluated and were determined to be sufficient to minimize the potential for a construction-related failure of the operating chilled water loop, as well as to provide backup cooling should an unexpected loss of chilled water occur during piping replacement activities.

While two AHUs per unit on a chilled water loop are out of service during the replacement activities, the two AHUs per unit on the operating chilled water loop will be identified as protected equipment in accordance with the Operations Department's Protected Equipment Program. This program is used to protect equipment from inadvertent operation or maintenance when the redundant equipment is removed from service or becomes inoperable. The purpose of the program is to prevent entry into a 72-hour or less TS clock, to prevent entry into a more limiting TS clock, to prevent significant reduction in power, to prevent a loss of nuclear fuel decay heat removal, and to prevent the loss of equipment required to ensure safe shutdown. The program identifies the following four methods that can be used to protect equipment as appropriate:

1. Protected Equipment magnetic placards used on affected circuit breakers/components.

2. Protected Equipment placards mounted on stands at the entrance to affected rooms or areas.

3. Protected Equipment placards, stands, and red plastic chain used to create a boundary around the protected equipment.

4. Protected Equipment magnets/signs on control switches in the field (magnets are not required on control switches in the MCR).

" In addition to the Protected Equipment designation and protection by Operations, Nuclear Site Services (NSS), which is the station organization performing the piping replacement, will take measures to physically protect the operating chilled water loop in the work area. Depending on the specific pipe configuration and location, materials such as sheet metal, fire retardant plywood, rubber, and fire blankets will be used to provide protection from impact, grinding, arc strike, etc. In addition, welding, grinding, and chipping screens will be erected, as needed, to protect personnel and equipment (particularly in the ESGR) from welding flash, dust from grinding, debris from concrete chipping, etc. These screens will also provide equipment protection from water spray due to a postulated rupture of the in-service chilled water loop. Work area cleanup will be ongoing during the replacement activities to maintain housekeeping standards. Furthermore, to permit required access and egress, walkways will be maintained around the work area, and temporary trench covers will be provided, as required.

Page 7 of 18

Existing procedures and practices will be used with respect to the use of combustible materials, control of transient combustibles, and control of ignition sources, including grinding, cutting, and welding.

Prior to initiating chilled water piping replacement activities, actions will be taken to provide a high level of confidence that AHU operability will be maintained.

Specifically, it will be verified that there is no outstanding required maintenance on the MCR and ESGR ACS AHUs that could affect AHU operability. Additionally, availability of AHU spare parts (i.e., routine stock items) will be confirmed. Similar actions for the chillers and chilled water pumps located in MER-3 and MER-5 are not deemed necessary due to the redundancy of these components.

A Chilled Water System Piping Contingency Plan is currently in place to provide guidance in the event of a chilled water piping leak. This guidance addresses inspections, evaluations, operability assessments, and repairs that may be required in the event of such leakage. As part of this response readiness initiative, responsible station organizations are cognizant of the elements of the Contingency Plan and the necessary actions in the event of a chilled water piping leak. The Contingency Plan will remain in place until the chilled water piping replacement is complete.

No flood-related compensatory action related to a postulated rupture of the in-service chilled water loop is needed. The postulated rupture of the in-service chilled water loop was evaluated and determined to not be an ESGR flooding concern. The volume of water in the in-service chilled water loop is significantly less than the volume of water required to impact the emergency busses, which are the most risk-significant components in the ESGR.

During replacement activities, if a penetration or barrier is breached, provisions will be in place to maintain an adequate barrier against flood, fire, and smoke or a fire or flood watch will be established, as required by existing procedures and requirements.

During Phases III through VI of the chilled water replacement activities, a chilled water backup supply will be available. This backup supply will be provided by the non-safety-related Service Building chillers 1-VS-E-3A and 1-VS-E-3B located in MER-1. As discussed in Phases III through VI in the Replacement Plan, the backup supply will provide MCR and/or ESGR cooling. This backup supply either will be provided via the existing piping to chilled water loop A or will use temporary hoses (with prefabricated hose connection assemblies) that will be staged and available to be connected, if the backup supply is needed. Procedural direction will be developed to reflect the installation of valves/hose connections being added to accommodate hook up of the chilled water backup supply.

• Prior to initiating Phases III through VI of the chilled water piping replacement activities, it will be verified that there is no outstanding required maintenance on Page 8 of 18

chillers 1-VS-E-3A and 1-VS-E-3B that could affect the ability of the chillers to provide the backup supply.

As noted in the discussion of Phases II, Ill, and IV in the Replacement Plan, there is a period of time during these phases where ESGR and/or MCR backup cooling would be provided by fans or other portable temporary means. Procedural direction will be developed to include these contingency actions to address ESGR and MCR cooling (by use of fans or other portable means).

REPLACEMENT PLAN The Chilled Water System piping replacement plan will be executed in six distinct phases in series. The following discussion of each phase provides the work scope, valve alignment and system operation, TS 3.23 compliance, applicable TS AOTs, construction sequence, and provisions for backup cooling in Phases II through VI.

Note that four of the six phases require entries into the temporary AOTs proposed in this TS change request.

The six phases and associated TS AOTs are summarized as follows:

1) Phase I - addition of a common supply line and a common return line associated with chillers 1-VS-E-4D and 1-VS-E-4E, and replacement of the chilled water piping in MER-3 associated with chiller 1-VS-E-4B (existing TS 3.23.C.1 .c 7-day AOT),

2) Phase 11- addition of valves to permit isolation of MCR AHUs 1-VS-AC-1 and 2-VS-AC-9, and addition of valves/hose connections on chilled water loop A to accommodate hook up of a chilled water backup supply (TS 3.23.C.2.a.1 and TS 3.23.C.2.b.1 7-day AOTs from our July 5, 2006 transmittal),

3) Phase III - replacement of the chilled water loop C piping in the ESGR trench and the MCR, addition of chilled water loop C isolation valves, addition of valves to permit isolation of MCR AHUs 1-VS-AC-2 and 2-VS-AC-8, and addition of valves/hose connections on chilled water loop C to accommodate hook up of a chilled water backup supply (temporary 45-day AOT),

4) Phase IV - replacement of the chilled water loop A piping in the ESGR trench and the MCR and addition of chilled water loop A isolation valves (temporary 45-day AOT),

5) Phase V - replacement of the chilled water piping in MER-3 associated with chiller 1-VS-E-4A and connecting to chilled water loop A (temporary 14-day AOT), and

6) Phase VI - replacement of the chilled water piping in MER-3 associated with chiller 1-VS-E-4C and connecting to chilled water loop C (temporary 14-day AOT).

The work scope for Phases I through VI is illustrated in Figures 4 through 9, respectively.

Condition Assessment A condition assessment of samples of the piping removed during Phases I, Ill, and IV will be conducted. The piping removed during Phases I, Ill, and IV sufficiently represent the chilled water piping in the ESGR trench, MCR, and MER-3 locations for condition assessment. This assessment will consider the extent of corrosion and will Page 9 of 18

evaluate the condition of the piping using appropriate visual and/or non-visual analytical techniques, in accordance with existing procedures. Based on this information and results of the condition assessment data obtained, further investigation and corrective actions will be initiated, as required, and impact on operability will be assessed.

Valve Alignment - General As noted above, Figure 2 illustrates a typical valve alignment for the Chilled Water System. The actual valve alignment is dependent upon the specific equipment in operation. Also note that the valve alignment discussion for each phase is provided for clarity of discussion and presents the expected valve alignment. The specific valve alignment will be defined as the implementation plans for the replacement activities are finalized. The existing station tag-out process will be used to isolate components during implementation of the replacement plan.

Phase I Figure 4 illustrates the work scope for Phase I. Lines shown in bold and noted valves in Figure 4 will be added or replaced. This phase involves a) addition of a common supply line and a common return line associated with chillers 1-VS-E-4D and 1-VS-E-4E and b) replacement of piping associated with chiller 1-VS-E-4B and chilled water pump 1-VS-P-2B.

Valve Alignment Chiller 1-VS-E-4B and chilled water pump 1-VS-P-2B will be isolated by closure of valves V285, V286, V299, and V300. When the chiller 1-VS-E-4B piping replacement and partial installation of the new supply and return lines (with new valves V13 and V14) is complete, valves V285, V286, V299, and V300 will be opened re-establishing availability of chiller 1-VS-E-4B. Up to this point, a TS AOT entry is not required.

The final connection of the newly added supply and return lines will require closure of valves V569, V639, V570, and V648, isolating chillers 1-VS-E-4D and 1-VS-E-4E.

Isolation of chillers 1-VS-E-4D and 1-VS-E-4E will require entry into an existing TS 3.23.C.1.c (7-day) AOT because the chiller operability/power supply requirements of TS 3.23.C.1 .b requirements will not be satisfied.

Chiller Flowpaths and Associated Power Supplies Initially in Phase I when chiller 1-VS-E-4B is isolated, chiller 1-VS-E-4A will supply chilled water to loop A, and 1-VS-E-4C will supply loop C, and chillers 1-VS-E-4D and 1-VS-E-4E will also be available to supply loop A. Thus, the chiller operability and power supply requirements of TS 3.23.C.1 .a and TS 3.23.C.1 .b will be satisfied.

When making the final connection of the new supply and return lines, both chilled water loops will be operable and chillers 1-VS-E-4A, 1-VS-E-4B, and 1-VS-E-4C will be Page 10 of 18

available. Chillers 1-VS-E-4D and 1-VS-E-4E will be isolated and not available. As noted above, entry into the existing TS 3.23.C.1.c (7-day) AOT will be required when making the final connections. Upon completion of the final connections of the new lines, TS 3.23.C.1 .c will be exited.

Construction Sequence The piping between valves V285 and V286 will be replaced simultaneously with the piping between valves V299 and V300. Replacement of these two sections of piping will include a tee in each to accommodate the addition of the new supply and return lines, as well as a valve in each line (V13 and V14). Note that the piping between valves V648 and V570, as well as between V569 and V639, will not be replaced since it was installed with the MER-5 chillers in the 1993-1994 time frame. Simultaneously, the piping associated with chiller 1-VS-E-4B and chilled water pump 1-VS-P-2B will be replaced. The final connection of the newly added supply and return lines will require closure of valves V569, V639, V570, and V648, isolating chillers 1-VS-E-4D and 1-VS-E-4E.

Provisions for Backup Cooling No provisions for backup cooling are needed during the Phase I (7-day) AOT since both chilled water loops A and C will be operable.

Phase I Completion Upon completion of Phase I, the Chilled Water System will be fully operable with the addition of the common supply and return lines associated with chillers 1-VS-E-4D and 1-VS-E-4E and the replacement of piping associated with chiller 1-VS-E-4B and chilled water pump 1-VS-P-2B. Completion of Phase I will provide improved chiller availability for the completion of subsequent phases.

Phase II Figure 5 illustrates the work scope for Phase I1. Noted valves in Figure 5 will be added.

This phase involves a) the addition of valves V5 and V6 to permit isolation of MCR AHUs 1-VS-AC-1 and 2-VS-AC-9 and b) the addition of valves V9 and V1 0/hose connections on chilled water loop A to accommodate hook up of the chilled water backup supply. As noted in the Planned Compensatory Actions discussion above, installation of these valves/hose connections will accommodate the backup supply of chilled water from chillers 1-VS-E-3A and 1-VS-E-3B located in MER-1 by the use of temporary hoses. The backup supply will be available for use during Phases Ill, IV, V, and VI, if needed.

Page 11 of 18

Valve Alignment Chilled water loop A will be isolated by closure of valves V568, V569, V574, V570, V571, and V573. With chilled water loop A isolated, the Unit 1 TS 3.23.C.2.a.1 and Unit 2 TS 3.23.C.2.b.1 (7-day) AOTs from our July 5, 2006 submittal will be entered.

Note that valves V572 and V575 are normally open for the operation of AHU 1-VS-AC-220, which provides MER-3 ventilation and cooling. Piping associated with AHU 1-VS-AC-220 is not included in the replacement plan since it was installed in the 1993-1994 time frame.

Restoration of chilled water loop A will require that valves V5 and V6 are opened and that valves V9 and V1 0 are closed.

Chiller Flowpaths and Associated Power Supplies During this phase, chillers 1-VS-E-4A, 1-VS-E-4B, 1-VS-E-4C, 1-VS-E-4D, and 1-VS-E-4E will be available to supply chilled water loop C. Thus, the chiller operability and power supply requirements of TS 3.23.C.1 .a and TS 3.23.C.1 .b will be satisfied.

Construction Sequence No particular construction sequence is identified.

Provisions for Backup Cooling Due to the piping configuration, loss of the operating loop C during the Phase II construction activities is unlikely. In the event that loop C is lost while loop A is isolated, both units will be shut down in accordance with TS requirements. Until chilled water is restored, ESGR and MCR cooling would be provided by fans or other portable temporary means.

Phase II Completion Upon completion of Phase II, the Units 1 and 2 (7-day) AOTs will be exited. The Chilled Water System will be fully operable with isolation valves and the backup supply hose connections installed on chilled water loop A. Completion of this phase will accommodate hook up of the MER-1 chilled water backup supply in the event that the operating loop is lost during the Phases III through VI construction activities.

Phase III Figure 6 illustrates the work scope for Phase Ill. Lines shown in bold and noted valves in Figure 6 will be added or replaced. Figure 10 provides a bar chart schedule showing the planned activities associated with the work scope for Phase Ill. This phase involves a) the replacement of the chilled water loop C piping in the ESGR trench and the MCR, b) the addition of chilled water loop C isolation valves V3 and V4, c) the Page 12 of 18

addition of valves V7 and V8 to permit isolation of MCR AHUs 1-VS-AC-2 and 2-VS-AC-8, and d) the addition of valves Vii and V1 2/hose connections on chilled water loop C to accommodate hook up of the chilled water backup supply.

Valve Aliqnment Chilled water loop C will be isolated by closure of valves V286, V572, V300, and V575.

With chilled water loop C isolated, the first temporary AOT (45 days) will be entered.

Valves V573 and V574 will be opened to allow the operation of AHU 1-VS-AC-220, which provides MER-3 ventilation and cooling.

Restoration of chilled water loop C will require that valves V7 and V8 are opened and that valves V11 and V1 2 are closed.

Chiller Flowpaths and Associated Power Supplies During the chilled water loop C piping replacement, chillers 1-VS-E-4A, 1-VS-E-4B, 1-VS-E-4D, and 1-VS-E-4E will be available to supply chilled water loop A. Thus, the chiller operability and power supply requirements of TS 3.23.C.i.a and TS 3.23.C.l.b will be satisfied.

Construction Sequence The flanges on ESGR AHUs 1-VS-AC-6 and 2-VS-AC-6 will be disconnected, and the inlet and outlet isolation valves for these individual AHUs will be removed. This will allow hook up of the chilled water backup supply at the ESGR AHUs, if needed.

Parallel activities during this phase are the replacement of the chilled water loop C piping in the ESGR trench and through the MER-3 wall, the replacement of the chilled water loop C piping in the MCR (including flange disconnection and valve removal at the MCR AHUs 1-VS-AC-2 and 2-VS-AC-8), the installation of the chilled water loop C isolation valves V3 and V4, the addition of valves V7 and V8, and the installation of valves V11 and V1 2/hose connections.

As the final step in this phase, the AHU isolation valves will be reinstalled and the AHUs will be reconnected after the ESGR and the MCR piping is replaced.

Provisions for Backup CoolinQ The MER-1 chilled water source will be available as a backup supply while in the temporary 45-day AOT for implementation of Phase Il1.

In the event that operating chilled water loop A is lost during construction activities while loop C piping is being replaced, both units will be shut down in accordance with TS requirements. Chilled water restoration will be accomplished by use of the backup supply and/or by repairs.

Page 13 of 18

During construction activities, if a break occurs in one of the loop A ESGR trench pipes, valves V5 and V6 will be closed to isolate the break. MCR cooling will be provided by the chilled water backup supply from the MER-1 chillers to the loop A MCR AHUs 1-VS-AC-1 and 2-VS-AC-9. Temporary hoses can be installed at valves V9 and V10 and connected to the flanges of the loop C ESGR AHUs 1-VS-AC-6 and 2-VS-AC-6, thus restoring ESGR cooling.

Due to the configuration of the chilled water piping in the MCR, a break in the MCR piping during Phase III construction activities is considered to be less likely than an event that could impact the ESGR trench piping. If a break occurs on one of the loop A MCR pipes concurrent with the loop C MCR piping replacement, valves V5 and V6 will be closed to isolate the break. Isolation of a pipe break in a MCR pipe would allow the loop A ESGR AHUs to be functional, thus providing ESGR cooling. The MCR would be cooled by fans or other portable temporary means until MCR cooling by the loop A MCR AHUs could be restored.

Phase III Completion Upon completion of Phase Ill, the first temporary AOT (45 days) will be exited. The Chilled Water System will be fully operable with the chilled water loop C piping replaced in the ESGR trench and the MCR, as well as with isolation valves and the backup supply hose connections installed.

Phase IV Figure 7 illustrates the work scope for Phase IV. Lines shown in bold and noted valves in Figure 7 will be added or replaced. Figure 11 provides a bar chart schedule showing the planned activities associated with the work scope for Phase IV. This phase involves a) the replacement of the chilled water loop A piping in the ESGR trench and the MCR and b) the addition of chilled water loop A isolation valves V1 and V2.

Valve Alignment Chilled water loop A will be isolated by closure of valves V568, V569, V574, V570, V571, and V573. With chilled water loop A isolated, the second temporary AOT (45 days) will be entered. Valves V572 and V575 are normally open for the operation of AHU 1-VS-AC-220, which provides MER-3 ventilation and cooling.

Valves V5 and V6 will be closed to isolate the loop A MCR AHUs 1-VS-AC-1 and 2-VS-AC-9 from the loop A ESGR AHUs 1-VS-AC-7 and 2-VS-AC-7 and to ensure the availability of the chilled water backup supply during the ESGR piping replacement.

When the ESGR piping replacement on loop A is completed, AHUs 1-VS-AC-7 and 2-VS-AC-7 will be capable of being returned to service before commencing the replacement of piping associated with MCR AHUs 1-VS-AC-1 and 2-VS-AC-9.

Restoration of chilled water loop A will require that valves V5 and V6 are opened and that valves V9 and V1 0 are closed.

Page 14 of 18

Chiller Flowpaths and Associated Power Supplies During the chilled water loop A piping replacement, chillers 1-VS-E-4A, 1-VS-E-4B, 1-VS-E-4C, 1-VS-E-4D, and 1-VS-E-4E will be available to supply chilled water loop C.

Thus, the chiller operability and power supply requirements of TS 3.23.C.1.a and TS 3.23.C.1 .b will be satisfied.

Construction Sequence Valves V5 and V6 will be closed to isolate the ESGR AHUs from the MCR AHUs on chilled water loop A. The flanges on the loop A ESGIA AHUs 1-VS-AC-7 and 2-VS-AC-7 will be disconnected, and the inlet and outlet isolation valves for these individual AHUs will be removed. This will allow hook up of the chilled water backup supply at the ESGR AHUs, if needed.

The chilled water loop A piping in the ESGR trench will be replaced, along with the installation of the chilled water loop A isolation valves V1 and V2. As the last step in this sequence, ESGR AHUs 1-VS-AC-7 and 2-VS-AC-7 will be reconnected. With the ESGR AHUs reconnected, chilled water loop A can be partially functional up to valves V5 and V6 to provide ESGR cooling, if necessary.

Following the ESGR chilled water loop A piping replacement, the MCR chilled water loop A piping will be replaced.

Provisions for Backup Cooling The MER-1 chilled water source will be available as a backup supply while in the temporary 45-day AOT for implementation of Phase IV up to the point where the loop A ESGR piping replacement is completed and the ESGR AHUs are reconnected. Thus, the backup supply from the MER-1 chillers is available for the majority of the Phase IV construction activities on chilled water loop A.

In the event that operating chilled water loop C is lost during construction activities while loop A piping is being replaced, both units will be shut down in accordance with TS requirements. Chilled water restoration will be accomplished by use of the backup supply and/or by repairs.

During construction activities, if a break occurs in one of the loop C ESGR trench pipes, the MER-1 backup source will be connected to the flanges of the loop A ESGR AHUs 1-VS-AC-7 and 2-VS-AC-7 by hose connections at valves V9 and V10, restoring ESGR cooling. MCR cooling will be provided by the chilled water backup supply from the MER-1 chillers to MCR AHUs 1-VS-AC-1 and 2-VS-AC-9.

Due to the configuration of the chilled water piping in the MCR, a break in the MCR piping during Phase IV construction activities is considered to be less likely than an event that could impact the ESGR trench piping. If a break occurs on one of the loop C Page 15 of 18

MCR pipes concurrent with the loop A MCR piping replacement, valves V7 and V8 will be closed to isolate the break. Isolation of a pipe break in a MCR pipe would allow the loop C ESGR AHUs 1-VS-AC-6 and 2-VS-AC-6 to be functional, thus providing ESGR cooling. The MCR would be cooled by fans or other portable temporary means until MCR cooling by the loop C MCR AHUs could be restored.

Phase IV Completion Upon completion of Phase IV, the second temporary AOT (45 days) will be exited. The Chilled Water System will be fully operable with chilled water loop A piping replaced in the ESGR trench and the MCR.

Phase V Figure 8 illustrates the work scope for Phase V. Lines shown in bold in Figure 8 will be replaced. Figure 12 provides the bar chart schedule showing the planned activities associated with the work scope for Phase V. This phase involves the replacement of the chilled water piping in MER-3 associated with chiller 1-VS-E-4A and connecting to chilled water loop A.

Valve Alignment The chilled water loop A isolation valves V1 and V2 (added in Phase IV), as well as valves V285, V299, V569, and V570, will be closed. With chilled water loop A isolated, the third temporary AOT (14 days) will be entered. Valves V573 and V574 will also be closed (normal lineup).

Chiller Flowpaths and Associated Power Supplies During the MER-3 piping replacement associated with chiller 1-VS-E-4A and connecting to chilled water loop A, chillers 1-VS-E-4B, 1-VS-E-4C, 1-VS-E-4D, and 1-VS-E4E will be available to supply chilled water loop C. Thus, the chiller operability and power supply requirements of TS 3.23.C.1 .a and TS 3.23.C.1 .b will be satisfied.

Construction Sequence No particular construction sequence is identified.

Provisions for Backup Cooling The MER-1 chilled water source will be available as a backup supply while in the temporary 14-day AOT for implementation of Phase V.

Due to the configuration of the chilled water piping in MER-3, a break in the MER-3 piping connecting to loop C during Phase V construction activities is unlikely. In the event that operating chilled water loop C is lost concurrent with loop A being isolated, valves V3 and V4 will be closed to isolate a break in the MER-3 piping connecting to Page 16 of 18

loop C. Although chilled water loop A will be isolated to complete the Phase V MER-3 piping replacement, it would be available to provide MCR and ESGR cooling by the backup supply from the MER-1 chillers via the existing piping to chilled water loop A.

Phase V Completion Upon completion of Phase V, the third temporary AOT (14 days) will be exited. The Chilled Water System will be fully operable with the MER-3 piping associated with chiller 1-VS-E-4A and connecting to chilled water loop A replaced.

Phase VI Figure 9 illustrates the work scope for Phase VI. Lines shown in bold in Figure 9 will be replaced. Figure 13 provides the bar chart schedule showing the planned activities associated with the work scope for Phase VI. This phase involves the replacement of piping in MER-3 associated with chiller 1-VS-E-4C and connecting to chilled water loop C.

Valve Alignment The chilled water loop C isolation valves V3 and V4 (added in Phase III), as well as valves V286 and V300, will be closed. With chilled water loop C isolated, the fourth temporary AOT (14 days) will be entered. Valves V573 and V574 will be opened, and valves V572 and V575 will be closed.

Chiller Flowpaths and Associated Power Supplies During MER-3 piping replacement associated with chiller 1-VS-E-4C and connecting to chilled water loop C, chillers 1-VS-E-4A, 1-VS-E-4B, 1-VS-E-4D, and 1-VS-E4E will be available to supply chilled water loop A. Thus, the chiller operability and power supply requirements of TS 3.23.C.1 .a and TS 3.23.C.1 .b will be satisfied.

Construction Sequence No particular construction sequence is identified.

Provisions for Backup Cooling The MER-1 chilled water source will be available as a backup supply while in the temporary 14-day AOT for implementation of Phase VI.

Due to the configuration of the chilled water piping in MER-3, a break in the MER-3 piping connecting to loop A during Phase V construction activities is unlikely. In the event that operating chilled water loop A is lost concurrent with loop C being isolated, valves V1 and V2 will be closed to isolate a break in the MER-3 piping connecting to loop A. MCR and ESGR cooling would be provided by the backup supply from the MER-1 chillers via the existing piping to chilled water loop A.

Page 17 of 18

Phase VI Completion Upon completion of Phase VI, the fourth temporary AOT (14 days) will be exited. The Chilled Water System will be fully operable with the MER-3 piping associated with chiller 1-VS-E-4C and connecting to chilled water loop C replaced.

CURRENTLY PLANNED SCHEDULE The currently planned schedule is as follows:

• Phases I and II during 2007,

• Phases III and IV during 2008, and

" Phases V and VI during 2009.

The final schedule for replacement of the chilled water piping and the associated system modifications is contingent upon NRC approval of both the TS change proposed in our July 5, 2006 transmittal and the TS change proposed herein. In addition, the final schedule is dependent upon completion of the project plan and design changes, as well as finalization of implementation details.

Page 18 of 18

CHILLED WATER SYSTEM CONFIGURATION FIGURE 1 (NOT TO SCALE)

MER-1 CHILLED MER-1 CHILLED WATER BACKUP WATER BACKUP RETURN SUPPLY tV251 IF V247 (2J I , 3-A ,,

CHILER

"*"- SUPPLY LOOP A*= LOOP C FROM _

E-4D,4E V648 V570 V571 V573 C

1-4E-(IJ/2) (IJ2H)(2H)

Note: This figure illustrates a typical valve CHILLER alignment for the Chilled Water System.

LU (TYP) The actual valve alignment is dependent 1V287 CHILLED WATER V291 V'295 upon the specific equipment in operation.

PUMP (TYP)

EXISTING MCR I ESGR CHILLED WATER SYSTEM FIGURE 2

MER-1 CHILLED MER-1 CHILLED WATER BACKUP WATER BACKUP RETURN SUPPLY 7 '-vS A 9 2 C.

12HV-M -AC-1 HOSE Iv (IH) C-1 CONNECTION (1J)

V10.-

ADD (TYP) AADDV12 AD< AIR HANDLING UNIT (TYP) 2 ADDV5ADDVADDV7 ,ADD V8 1-VS-AC-220 (j MCR ANUs WISOLATION VALVE (TYP) ~

I V-C72-VS-AC-6 O3 ~~

LOOP ISOLATION ADD VADD V2 ADD V3 ADD V4 S L LPROPOSED MODIFICATIONS FROM MER-5 1. New common supply and common return 3lines associated with chillers 1-VS-E-4D and 1-E-4D,4E V648 V570 V571 V573 V572 VS-E-4E will be added. This enhancement (2.111H,11H1) ensures that at least four chillers are available S-0during loop A and loop C AOTs.

LINE

~l V960V25 t 1

V6V26V2

2. New isolation valves V1, V2, V3, and V4 will ADD NEW& _ _ I be added on loop A and loop C.

VALVE ADDV13 3. New valves V5, V6, V7, and V8 will be added E-4A E-4B E-4C to isolate MCR AHUs and to facilitate MER.1 (1J/2J) (1J/2H) (2H) backup supply from loop A for either loop.

> CHILLER

4. New valves V9, V10, V11, and V12 will be UJ added to hook up MER-1 backup supply for V287 CHILLED WATER V291 1V295 each loop by the use of temporary hoses.

PROPOSED MCR / ESGR CHILLED WATER SYSTEM FIGURE 3

MER-1 CHILLED MER-1 CHILLED WATER BACKUP WATER BACKUP RETURN SUPPLY t V251 V247 2-VS-AC-9I (2J)

U

• 1-VS4AC -1 1-S-AC -2 AIR HANDLING UNIT (TYP) 2-VS-AC-7 1-VS-AC-6 Vl) 1.VS-AC-7 2-VS-AC-4 u=?,

- - SUPY LOOP A uj LOOP C PHASE I WORK SCOPE FROM CHILER5 I New common supply and common return E-4D,4E V648 lV5 D70 Vlines will be added for chillers 1-VS-E-4D V571 V573 V572 and 1-VS-E-4E. In addition, piping (2J/1H.1H) Iassociated with chiller 1-VS-E-4B and V9 2Vchilled V9' water pump 1-VS-P-2B will be ADD V960 V26V962 replaced.

NEWW LINE&__-...-_ _ __ _ _ Note:

E-4A V13 E4B E-4C Final connection of the supply and return (1.1/2j) (11/21) (21) lines will require entry into existing TS 3.23.C.l.c 7-day AOT since operable CHILLE4R chillers 1-VS-E-4A, 1-VS-E-4B, and 1-VS-E-X (TYP) 4C will not satisfy the emergency bus power supply requirement of TS 3.23.C.l.b.

MCR / ESGR CHILLED WATER SYSTEM PHASE I FIGURE 4 TO MER-5 0 0 CHILLERS E-4D,4E V639 (2JIIH,1H)

MER-1 CHILLED MER-1 CHILLED WATER BACKUP WATER BACKUP RETURN SUPPLY t V251 VV247 12.11C-I-VS-AC-2 ADDV9 (1H)ADD V1 0 (

AIR HANDLING UNIT (TYP)

(2J) C-220 I1-VS-A (j C,,

Co wF LOOP S Y A LOOP C PHASE Il WORK SCOPE FROM JNew valves VS, V6, V9, and V10 will be added CHLER ,on loop A.

E-4D,4E V648 V5;0 V571 V573 V572 Notes:

1. TS 3.23.C.2.a.1 and 3.23.C.2.b.1 7-day AOTs (from July 5, 2006 submittal) will be 6 Ventered.

E2. Chillers 1-VS-E-4A, 1-VS-E-4B, 1-VS-E-4C, V13 1-VS-E-4D, and 1-VS-E-4E will be available E.4A E-4B E-4C for the operating loop C.

(13123) (13/2H) (2H)

I? CHILLER 3. Four emergency buses will be available to xZ power the operable chillers and thus satisfy W (TYP) the requirements of T.S. 3.23.C.1.b.

MCR/ESGR CHILLED WATER SYSTEM PHASE II FIGURE 5 TO MER-5 CHILLERS E-4D,4E V639 (2J/1H,1H)

T 1-VS-AC-1 1V-VS-AC-2 (IH) 9 Vve AIR HANDLING ADa V12 V1ADD n><eva V52V-C7r6UNIT (TYP) I-SA- AD V8 (2J)-A

- I-VS-AV2-A ( -

2-VS-ACCV 1.

cPHASE IIIWORK SCOPE W= 'ADD V3 ADD V4

' SUPPLY LOOP A ui LOOP C During the first temporary AOT (45 days), (a)

FROM loop C piping will be replaced, (b) now loop HILsMER'5 **.*IL<* P***isolation valves V3 and V4 will be added, and CHLES-'* (c) new valves V7, V8, V11, and V12 will be E-4D,4E V648 V5 7 V571 V573 V572 added.

(2J/1H,1H) - > i -1 ,4N t s and I-VS-E-4E will be available to supply operating loop A.

E-4A E-4B E-4C 2. Four emergency buses will be available to (1J/2J) (1JI2H) (2H) power the operable chillers and thus satisfy SCHILLE4R the requirements of T.S. 3.23.C.i.b.

LU (TYP) 3. Loop A provides MER-1 chilled water backup

- =fl *^,^Tm ,,,,supply to loop C ESGR AHUs.

MCR / ESGR CHILLED WATER SYSTEM PHASE III FIGURE 6 TO MER-5 t><--*- CHILLERS E-4D,4E V639 (2J/1H,1H)

MER-1 CHILLED WATER BACKUP PHASE IV WORK SCOPE AD D Vl

• AD D V2

• the second temporary AOT (45 days),

LOOP A ,,,During SUPPLY loop A piping will be replaced and (b) new

• 'v3 LOOP C V4(a)

FROM isolation valves VI and V2 will be R . ,/4loop CHILERS-t><-added. Notes:

E-4D,4E V648 V570 V571 V573 VV572 (2J/1H,IH) Chillers 1-VS-E-4A, 1-VS-E-4B, 1-VS-E-4C, A *1.

1-VS-E-4D, and 1-VS-E-4E will be available to Supply the operating loop C.

sV962

2. Four emergency buses will be available to the operable chillers and thus satisfy E-4A V13 *power E-4B E-4C the requirements of T.S. 3.23.C.l.b.

(1 J/2j) (2H) 3. MCR piping replacement will be performed CHILLER last in order to provide MER-1 backup J

source of chilled water to ESGR AHUs on S(TYP) A.

CHILLED WATER V291 V295loop V287 V29 PUMP (TYP)

~AIR HANDLING UNIT (TYP) 11-VS5 0-AC-7 V%1 V11 Vil fV V12 AHANDLO ARLOOP C 0Z SUPPLY CHILLERS FROM V648 V55 V571(/1T2 <During thePAEVWR third temporary CP AOT (14-days),

1.S-C-Chllr-VS-AC-6-V--4,1-SE-D

)MER-3 piping (associated with chiller 1-VS-v

• E-4A and connecting to loop A) will be 7V96

• V61 V28 V86 r962replaced.

SNotes:

E-AE-4B E-4C and 1-VS-E-4E will be available to supply the (1J/2H) (2H) operating loop C.

• ,CHILLER 2. Four emergency buses will be available to wZ (TYP) power the operable chillers and thus satisfy

• ,,= H,=y ,^ 4* the requirements of T.S. 3.23.C.l.b.

MCRIESGR CHILLED WATER SYSTEM PHASE V FIGURE 8 TO MER-5 CHILLERS E-40,4E V639 (2J11H,1H)

MER-1 CHILLED MER-1 CHILLED WATER BACKUP WATER BACKUP C1-,-AC-1 1-VS-AC-2 9AIR HANDLING UNIT (TYP) 2-VS-AC-7 -VS n/"

--A * *"='*LOOP LOO C SUPPLY FROM PHASE VI WORK SCOPE CHILLERS V648 ,5700 *V571 V53During the fourth temporary AOT (14-days),

4MER-3 piping (associated with chiller 1-VS1 (2J/H,1H *.**==w*mmm =m*E-4C and connecting to loop C) will be

~replaced.

• *, 1-.Chillers 1-VS-E-4A, 1-VS-E-4B, 1-VS-E-4D, Notes:

• E-4A V3 E-4B Eo4C and 1-VS-E-4E will be available to supply (1J/2J) (1J/2H) (2H) the operating loop A.

CLER2. Four emergency buses will be available

'to TYP power the operable chillers and thus LO2O 7 ('II I riJWATLO (1 * .satisfy OP21 C.-95 the requirements of T.S. 3.23.C.l.b.

MCR/ESGR CHILLED WATER SYSTEM PHASE VI FIGURE 9 CHILLERS E-4D14E V639 (2J/1H,lH)

Jan-26-07 14:01

- OBTAIN MEASUREMENTS FOR PRE-FAB OF MCR PIPING PRE-FAB MCR PIPING AND FITTINGS REMOVE MISSILE SHIELDS FOR ESGR MEASUREMENTS

- - OBTAIN MEASUREMENTS FOR ESGR PRE-FAB OF PIPING PRE-FAB ESGR PIPING AND FITTINGS MOBILIZE MCR WORK AREA MOBILIZE ESGR WORK AREA STAGE PRE-FAB PIPING IN ESGR STAGE PRE-FAB PIPING NEAR MCR WORK AREA REMOVE ESGR FLOOR PLATES I DEWATER & CLEAN TRENCH TAGOUT ESGR CW SUPPLY & RETURN HEADER a TAGOUT MCR CW SUPPLY AND RETURN HEADER a DRAIN ESGR CW PIPING SYSTEM c DRAIN MCR ESGR PIPING SYSTEM

= BLOCK HANGERS ON ESGR IN-SERVICE LINES c Remove ESGR AHU insolation valves for backup CW use BLOCK HANGERS ON MCR IN-SERVICE LINES CUT EXISTING ESGR CW PIPING CUT CONCRETE TO ACCESS ESGR CW PIPING CUT EXISTING MCR CW PIPING SREMOVE ES.R INTERFERENCES & HANGERS REMOVE MCR INTERFERENCES AND HANGERS REMOVE ESGR CW PIPING & FITTINGS

-REMOVE MCRCW PIPING AND FITTINGS oESTABLISH ESR TRM REGUIREMENTS o ESTABLISH MCR TRM REQUIREMENTS REMOVE ESGR WALL AND FLOOR PENETRATION MATERIAL CLEAN DEBRIS FROM THE ESGR TRENCH ESGR / MCR "C" CHILLED WATER PIPING REPLACEMENT TASK filter. All Activities Assumptions:

PHASE III ©Primavera Systems. Inc.

Based on preliminary walkdowns, No issued design, Activity durations include 96 hours0.00111 days <br />0.0267 hours <br />1.587302e-4 weeks <br />3.6528e-5 months <br /> contingency, MER3 Air Bottle line may be an interference, Tie-ins at MER3 wall may be a FIGURE 10 (sheet 1 of 2) challange

Jan-26-07 14:01

=I :3,

-3 ý13 1-2" -'-,

2. "I27-2 -*F.1I -r11 -:1I19F8.* -7.14:F.'-

- .6I14:lt.F 4f l-mI2 1.1 11-12 13 14 15 16 17 18~19 110111.112 113114ll I1 17 I I=ls 2 2 23U24is 12612 28129 30 313n 133 34i35 13537138 n 04 24 44 61714 4 s 5 121 14Is M V 18191D11121 6415161717197 7 17 7 A JG1,I REMOVE MCR FLOOR PENETRATION MATERIAL OBTAIN FINAL MCR CW PIPING MEASUREMENTS

= OBTAIN FINAL ESGR CW PIPING MEASUREMENTS COMPLETE PRE-FAB OF MCR CW PIPING COMPONENTS

== COMPLETE PRE-FAB OF ESGR CW PIPING COMPONENTS

= FIT-UP MCR CW PIPING AND ELBOWS FIT-UP ESGR CW PIPING AND ELBOWS INSTALL C LOOP ISOLATION AND HOSE CONNECTION VALVES RESTORE MCR CW PIPING HANGERS RESTORE ESGR CW PIPING HANGERS WELD OUT MCR CW PIPING AND FITTINGS WELD OUT ESGR CW PIPING AND FITTINGS PERFORM NDE ON ESGR CW PIPE WELDS FLUSH PIPING/ CLEAN ESGR CW SYSTEM RESTORE ESGR WALL AND FLOOR PENETRATIONS PERFORM NDE ON MCR CW PIPE WELDS FLUSH MCR CW PIPING / CLEAN SYSTEM RESTORE MCR FLOOR PENETRATIONS o STATUS ESGR CW PMTs

, SIGN OFF ESGR CW PIPING TAGGING RECORD PERFORM ESGR CW RETURN TO SERVICE TESTING a STATUS MCR CW PIPING PMt's SIGN OFFMCR CWTAGGING RECORD PERFORM MCR CW RETURN TO SERVICE TESTING UPS ESGR CW PIPING RETURN TO SERVICE O

OPS MCR CW PIPING RETURN TO SERVICE RESTORE ESGR CONCRETE AND FLOOR PLATES Assumptions: ESGR IMCR "C"CHILLED WATER PIPING REPLACEMENT TASK filter: All Activities PHASE III Primavera Syitiwns. Int.

Based on preliminary walkdowns, No issued design, Activity durations include 96 hours0.00111 days <br />0.0267 hours <br />1.587302e-4 weeks <br />3.6528e-5 months <br /> contingency, MER3 Air Bottle line may be an interference, Tie-ins at MER3 wall may be a FIGURE 10 (sheet 2 o12 challange

Jan-26-07 13:55 OBTAIN MEASUREMENTS FOR PRE-FAB OF MCR PIPING PRE-FAB MCR PIPING AND FITTINGS REMOVE MISSILE SHIELDS FOR ESGR MEASUREMENTS

- OBTAIN MEASUREMENTS FOR ESGR PRE-FAB OF PIPING PRE-FAB ESGR PIPING AND FITTINGS

... . .------ MOBILIZE MCR WORK AREA MOBILIZE ESGR WORK AREA STAGE PRE-FAB PIPING NEAR MCR WORK AREA STAGE PRE-FAB PIPING IN ESGR REMOVE ESGR FLOOR PLATES / DEWATER & CLEAN TRENCH o TAGOUT ESGR CW SUPPLY & RETURN HEADER o DRAIN ESGR CW PIPING SYSTEM BLOCK HANGERS ON ESGR IN-SERVICE LINES

CUT EXISTING ESGR CW PIPING

= CUT CONCRETE TO ACCESS ESGR CW PIPING

=INSTALL A LOOP ISOLATION VALVES REMOVE ESGR INTERFERENCES & HANGERS REMOVE ESGR CW PIPING & FITTINGS ESTABLISH ESGR TRM REQUIREMENTS REMOVE ESGR WALL AND FLOOR PENETRATION MATERIAL CLEAN DEBRIS FROM THE ESGR TRENCH

= OBTAIN FINAL ESGR CW PIPING MEASUREMENTS COMPLETE PRE-FAB OF ESGR CW PIPING COMPONENTS

=FIT-UP ESGR CW PIPING AND ELBOWS RESTORE ESGR CW PIPING HANGERS WELD OUT ESGR CW PIPING AND FITTINGS PERFORM NDE ON ESGR CW PIPE WELDS FLUSH PIPING / CLEAN ESGR CW SYSTEM Assumptions: ESGR I MCR "A" CHILLED WATER PIPING REPLACEMENT TASK filter. All Activities Based on preliminary walkdowns, No issued design, Activity durations include 96 hours0.00111 days <br />0.0267 hours <br />1.587302e-4 weeks <br />3.6528e-5 months <br /> PHASE IV Q Prmavera Systems, Ind.

contingency, MER3 Air Bottle line may be an interference, Tie-ins at MER3 wall may be a challane FIGURE 11 (sheet 1 of 2

Jan-26-07 13:55 11-- ,13-3 14 2 2 --- 2-2 2

-2 51 H.-I. -I - ,1 I-I -1..1 I' I. - 32 Al14"l 2 1.- 111 1314 1 6 16 17 I2 19 1601111126113 114115181611lO 131-8,120 121122 1231r24125126127128129 DOW 1372133I I 1 3441 74 ,;5T7 24731 h7,s7nS717

,]79I

- RESTORE ESGR WALL AND FLOOR PENETRATIONS STATUS ESGR CW PMT's SIGNOFF ESGR CW PIPING TAGGING RECORD PERFORM ESGR CW RETURN TO SERVICE INTEGRITY AND ALIGNMENT o ESGR CW PIPING AVAILABLE FOR EMERGENCY USE n TAGOUT MCR CW SUPPLY AND RETURN HEADER RESTORE ESGR CONCRETE AND FLOOR PLATES SDRAINMCR ESGR PIPING SYSTEM BLOCK HANGERS ON MCR IN-SERVICE LINES CUT EXISTING MCR CW PIPING REMOVE MCR INTERFERENCES AND HANGERS REMOVE MCR CW PIPING AND FITTINGS ESTABLISH MCR TRM REQUIREMENTS REMOVE MCR FLOOR PENETRATION MATERIAL OBTAIN FINAL MCR CW PIPING MEASUREMENTS COMPLETE PRE-FAB OF MCR CW PIPING COMPONENTS FIT-UP MCR CW PIPING AND ELBOWS RESTORE MCR CW PIPING HANGERS WELD OUT MCR CW PIPING AND FITTINGS n PERFORM NDE ON MCR CW PIPE WELDS

- FLUSH MCR CW PIPING / CLEAN SYSTEM RESTORE MCR FLOOR PENETRATIONS

. STATUS MCR CW PIPING PMT's SIGN OFFMCR CW TAGGING RECORD PERFORM MCR CW RETURN TO SERVICE TESTING 7 OPS CW PIPING RETURN TO SERVICE Assumptions: ESGR /MCR "A" CHILLED WATER PIPING REPLACEMENT TASK filter:Al Activites Based on preliminary walkdowns, No issued design, Activity durations include 96 hours0.00111 days <br />0.0267 hours <br />1.587302e-4 weeks <br />3.6528e-5 months <br /> PHASE IV ©Prmavera Systems, Inc.

contingency, MER3 Air Bottle line may be an interference, Tie-ins at MER3 wall may be a challange FIGURE 11 (sheet 2 of 2)

Jan-26-07 14:28 PRE-FAB PIPING AND FITTINGS

- MOBILIZE WORK AREA STAGE PRE-FABBED PIPING NEAR MER3 WORK AREA TAGOUT CW SUPPLY AND RETURN HEADER DRAIN SYSTEM BLOCK HANGERS ON IN-SERVICE LINES CUT EXISTING PIPING REMOVE INTERFERENCES AND HANGERS REMOVE PIPING AND FITTINGS ESTABLISH TRM REQUIREMENTS REMOVE FLOOR PENETRATION MATERIAL OBTAIN FINAL PIPING MEASUREMENTS COMPLETE PRE-FAB OF PIPING COMPONENTS FIT-UP PIPING AND ELBOWS RESTORE HANGERS WELD OUT PIPING AND FITTINGS PERFORM NDE ON WELDS FLUSH PIPING AND CLEAN SYSTEM RESTORE FLOOR PENETRATIONS STATUS PMT's o SIGN OFF TAGGING RECORD PERFORM RETURN TO SERVICE TESTING

- OPS RETURN TO SERVICE Assumptions: MER3 1-VS-E-4A CHILLED WATER PIPING TASKfilter:AllActivities PHASE V Q Primavera Systerns, Inc.

Based on preliminary walkdowns, No issued design, Activity durations include 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> contingency FIGURE 12

Jan-26-07 14:28 PRE-FAB PIPING AND FITTINGS

- MOBILIZE WORK AREA STAGE PRE-FABBED PIPING NEAR MER3 WORK AREA TAGOUT CW SUPPLY AND RETURN HEADER DRAIN SYSTEM BLOCK HANGERS ON IN-SERVICE LINES CUT EXISTING PIPING REMOVE INTERFERENCES AND HANGERS REMOVE PIPING AND FITTINGS o ESTABLISH TRM REQUIREMENTS

= REMOVE FLOOR PENETRATION MATERIAL OBTAIN FINAL PIPING MEASUREMENTS COMPLETE PRE-FAB OF PIPING COMPONENTS

=FIT-UP PIPING AND ELBOWS RESTORE HANGERS

= WELD OUT PIPING AND FITTINGS PERFORM NDE ON WELDS

- FLUSH PIPING AND CLEAN SYSTEM RESTORE FLOOR PENETRATIONS STATUS PMTs SIGN OFF TAGGING RECORD PERFORM RETURN TO SERVICE TESTING OPS RETURN TO SERVICE Assumptions: MER3 1-VS-E-4B CHILLED WATER PIPING TASKfilter:AllActivIties PHASE VI ©Prmavera Systens, Inc.

Based on preliminary walkdowns, No issued design, Activity durations include 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> contingency FIGURE 13

Attachment 5 Summary of Surry Power Station Internal Events PRA Temporary 45-day and 14-day AOTs to Replace MCR and ESGR Air Conditioning System Chilled Water Piping Surry Power Station Units 1 and 2 Virginia Electric and Power Company (Dominion)

SUMMARY

OF SURRY POWER STATION INTERNAL EVENTS PROBABILISTIC RISK ASSESSMENT (PRA)

TABLE OF CONTENTS PRA Quality Summary Level of Detail Initiating Events System Models Operator Actions Data Initiating Event Frequencies Component Failure Rates (Generic)

Component Failure Rates (Plant Specific)

Maintenance and Testing Unavailability Common Cause Events Level 2 PRA Maintenance of PRA Comprehensive Critical Reviews

Background

Westinghouse Owner's Group (WOG) PRA Peer Review Fact and Observation (F&O) Summary Surry Internal Events PRA Self-assessment Page 1 of 25

SUMMARY

OF SURRY POWER STATION INTERNAL EVENTS PRA PRA QUALITY

SUMMARY

The quality of modeling and documentation of the Surry internal events PRA model (which includes internal flooding) has been demonstrated by the discussions contained in this attachment regarding the following aspects:

" Level of detail in PRA

" Maintenance of the PRA

" Comprehensive critical reviews The Surry Level 1 and Level 2 internal events PRAs provide the necessary and sufficient scope and level of detail to allow the calculation of core damage frequency (CDF) and large early release frequency (LERF) changes due to the proposed configuration.

In addition, the Surry internal events PRA has been used in support of various regulatory programs and relief requests that have received NRC Safety Evaluation Reports (SERs), which is further indication of the quality of the Surry internal events PRA and suitability for regulatory applications. This list includes:

• Surry Individual Plant Examination (IPE) SER

• Surry Individual Plant Examination of External Events (IPEEE) SER

• Surry was a reference plant evaluated in NUREG/CR-1150, Surry IPE was compared to NUREG/CR-1 150 model

" Risk-informed in-service inspection (RI-ISI) SER

" Containment Type A surveillance test frequency extension SER

" Risk-informed EDG buried fuel oil tank technical specification change

• RG 1.200 pilot plant evaluation by NRC

• Maintenance Rule

• Configuration Risk Management Program [Maintenance Rule paragraph (a)(4)]

• Significance Determination Process evaluations LEVEL OF DETAIL The quality of the Surry internal events PRA used in performing this risk assessment is manifested by the following:

• Level of detail in PRA

• Maintenance of the PRA

• Comprehensive critical reviews The Surry internal events PRA modeling is highly detailed, including a wide variety of initiating events, modeled systems, operator actions, and common cause events, Each of these, as well as pertinent data and the Level 2 PRA, is discussed in this attachment.

Page 2 of 25

Initiating Events The Surry at-power PRA used in this application explicitly models a large number of initiating events:

" General transients

• Support system failures

• Loss of Coolant Accidents (LOCAs), including Interfacing System LOCA and Break Outside Containment.

" Internal flooding events

• Fire initiators (based on the IPEEE)

" Seismic initiators (based on the IPEEE)

The internal initiating events explicitly modeled in the Surry PRA are summarized in Table 1. The number of internal initiating events modeled in the Surry internal events PRA is similar to the majority of U.S. PWR PRAs currently in use. In addition, fire and seismic-initiated accident scenarios based on the Surry IPEEE are included in the Surry PRA model used in this application.

System Models The Surry internal events PRA explicitly models a large number of frontline and support systems that are credited in the accident sequence analyses. The Surry systems explicitly modeled in the Surry internal events PRA are summarized in Table 2. The number and level of detail of plant systems modeled in the Surry internal events PRA is comparable to or greater than the majority of U.S. PWR PRAs currently in use.

Table 1 SURRY INTERNAL EVENTS PRA INITIATING EVENTS Event Description Discussion ID IE-AA, Large loss of coolant accident A large LOCA is defined as a break in the IE-AB, (LOCA) reactor coolant system (RCS) boundary in IE-AC the range of > 6"- 27" equivalent diameter.

The lower bound is the minimum break size that will cause rapid depressurization such that the Accumulators and a low head safety injection (SI) pump will provide adequate core cooling.

IE-SlA, Medium LOCA A medium LOCA is defined as a break in IE-S1 B, the RCS boundary in the range of 2" to 6".

IE-S1C The loss of coolant will lead to a slower depressurization than in the case of the I large LOCA, but as the break is large Page 3 of 25

Table 1 SURRY INTERNAL EVENTS PRA INITIATING EVENTS enough for all decay heat to be dissipated, secondary heat removal is not essential in order to prevent core damage. However, if secondary heat removal is available it can be used as an alternative to the Accumulators or the high head charging pumps.

IE-S2 Small LOCA The small LOCA break size includes breaks from 2" down to the point that they are no longer considered LOCA initiating events (i.e., do not cause an SI signal). A small break LOCA is not capable of removing all the decay heat following reactor trip (on low pressurizer pressure and the generation of the SI signal),

therefore reactor pressure will remain high.

Since all decay heat is not being removed through the break, auxiliary feedwater (AFW) is required following the trip of main feedwater (MFW) by the SI signal, or feed and bleed is utilized if AFW is unavailable.

Very small LOCAs (do not cause a containment depressurization actuation

[CDA]) are also modeled within the IE-S2 initiating event.

IE-T1 Loss of offsite power Interruption of normal ac power supply to the plant.

IE-T2 Loss of MFW Events cause a loss of MFW. Recovery of MFW is not possible.

IE-T2A Recoverable loss of MFW Events causing an initial loss of MFW at the start of the transient. However, recovery of MFW and condensate may be possible following these events.

IE-T3 Transient with MFW available Various routine/anticipated transients that would result in a reactor trip and would require a similar response from plant systems. Example events would include reactor/turbine trips, loss of RCS flow and steam/feedwater mismatches.

IE-T4 Loss of reactor coolant pump Loss of component cooling water flow to (RCP) seal cooling the RCP seals concurrent with a loss of charging flow for RCP seal injection.

Page 4 of 25

Table 1 SURRY INTERNAL EVENTS PRA INITIATING EVENTS IE-T5A Loss of DC bus A Failure of 125V DC bus 1-1, one pressurizer power operated relief valve (PORV), and half of all engineered safety features (ESF) equipment.

IE-T5B Loss of DC bus B Failure of DC bus 1-111, one pressurizer PORV, and half of all ESF equipment.

IE-T6 Loss of circulating water (CW) Loss of circulating water (CW) affects many frontline and support systems in the plant, although many have redundant methods to achieve cooling (e.g.,

emergency service water [SW] pumps).

This event tree considers the credible risks of loss of CW, including the potential for a loss of RCP seal cooling.

IE-T7 Steam generator tube rupture Primary-to-secondary leakage/ruptures in the steam generators.

IE-T8 Loss of emergency switchgear Following a loss of emergency switchgear room (ESGR) cooling room cooling, reactor shutdown by manual trip is required prior to temperatures reaching 120OF in the ESGR.

IE-T9A Loss of 4160V emergency bus A loss of bus 1 H causes the unavailability H of one pressurizer power operated relief valve (PORV), and half of all ESF equipment. The precursor events are segregated into loss of bus 1H, or (RSST C failure, transfer bus 1 F failure, or 500 KV bus #1 failure)

• failure of onsite emergency power to bus 1H.

IE-T9B Loss of 4160V emergency A loss of Bus 1J causes the unavailability bus J of one pressurizer PORV, and half of all ESF equipment. The precursor events are segregated into loss of bus 1J, or (RSST A failure, transfer bus 1 D failure, or 500 KV bus #2 failure)

• failure of onsite emergency power to bus 1J.

IE-T10 Loss of instrument air A loss of instrument and service air causes the isolation of component cooling (CC) flow to the RCP seals and a loss of MFW.

IE-T1 1 Loss of charging pump service Loss of CPSW would fail the charging water (CPSW) pumps, requiring a plant shutdown.

Because the charging pumps are therefore Page 5 of 25

Table 1 SURRY INTERNAL EVENTS PRA INITIATING EVENTS unavailable for makeup or feed and bleed, this can be evaluated as a special initiating event. Note that the effect on the loss of RCP seal cooling is captured within the IE-T4 initiating event. This potential initiating event is under development and will be included in a future revision of this notebook.

IE-TCR Loss of control room HVAC Considered as a special initiating event and modeled.

IE-TH Transient at or above 40% for Two ATWS initiating events are developed anticipated transient without based on the system success criteria, the scram (ATWS) first for events occurring at or above 40 percent power.

IE-TL Transient below 40% for ATWS occurring with reactor power at less ATWS than 40 percent.

IE-TS1 Steam/FW line break inside In general the consequences of a major containment steam leak are mitigated by steam line isolation, Main feedwater isolation, boration through the charging pumps, and reactor trip.

IE-TS2 Steam line break outside The event differs from the steam line break containment inside containment because: 1) it is necessary to isolate all steam generators (SGs) either by closing the trip valves or by isolating feedwater flow to any SG for which the trip valve does not close, and the probability of a SG tube rupture is much lower as there is no immediate depressurization of one SG, and 2) if a main steam isolation valve (MSIV) fails to close then such an event may occur.

IE-RX Reactor pressure vessel Catastrophic failure of the reactor vessel, rupture resulting in core damage due to the inability to provide cooling to the fuel assemblies.

IE-VX Interfacing Systems LOCA A break can occur in the piping outside outside containment containment, and therefore no possibility will exist for recirculation when the refueling water storage tank (RWST) is empty.

Page 6 of 25

Table 2 SYSTEMS MODELED IN SURRY INTERNAL EVENTS PRA Alternate AC Auxiliary Feedwater Charging Component Cooling Containment and Recirculation Spray Emergency & non-emergency Power Emergency Switchgear and Control Room Ventilation Instrument Air Main Feedwater Main Steam Reactor Protection Residual Heat Removal Safety Injection Service Air Service Water Plus 15 other systems Note: This table is provided as general information as to the systems modeled in the Sur.ry internal events PRA. This is not an exhaustive list of the systems modeled in the PRA with fault tree logic. Other systems that are modeled implicitly are not summarized in this list.

Operator Actions The Surry internal events PRA explicitly models a large number of operator actions:

• Pre-initiator actions

• Post-initiator actions

• Recovery Actions Over 100 individual operator actions (approximately 30 pre-initiator human error probabilities (HEPs) and approximately 90 post-initiator and recovery actions) are explicitly modeled. In addition, the Surry internal events PRA models approximately 50 dependent operator action combinations. Given the large number of actions modeled in the Surry internal events PRA, a summary table of the individual actions modeled is too large to include in this summary.

The human error probabilities for the actions are modeled with accepted industry human reliability analysis (HRA) techniques and include input based on discussion with cognizant personnel (emergency operating procedure (EOP) coordinator, operators and trainers). The following HRA methods are employed in the Surry internal events PRA:

Page 7 of 25

• Pre-Initiator Human Failure Event (HFE) - Accident Sequence Evaluation Program (ASEP)

" Cognition Error of Post-initiator HFE - Cause-Based Decision Tree and Human Cognitive Reliability Model (HCR)

• Manipulation and Execution error of Post-initiator HFE - Technique for Human Error Rate Prediction (THERP).

Data Initiating Event Frequencies The frequency of each initiating event category is assessed using both Surry specific and generic data. The rare events such as LOCAs directly use the generic industry data. The sources of generic industry data are NUREG/CR-5750 and NUREG/CR-INEEL-04-02326. Surry plant experience is used in a Bayesian update statistical analysis with non-informative prior or in a fault tree analysis to produce the plant specific transient initiating event frequencies for use in the PRA.

Component Failure Rates (Generic)

The Surry internal events PRA has a defined priority for use of generic industry data for component failure rates. The primary preferred source of generic failure rates is EGG-SSRE-8875 Database. Secondary sources include NUREG/CR-4639 and IEEE-STD-500.

Component Failure Rates (Plant Specific)

The Surry internal events PRA plant-specific component data analysis is a Bayesian update statistical analysis of selected important equipment (typically Maintenance Rule monitored) with an extensive set of plant specific data (obtained from the Surry Maintenance Program and other plant sources).

Table 5 contains a list of the component types, boundaries, and failure modes modeled with plant-specific data in the Surry internal events PRA.

Maintenance and Testing Unavailability The unavailability of components due to on-line maintenance and testing activities is estimated using either Surry specific or generic industry data. The components in the Surry internal events PRA modeled with plant-specific unavailability estimates are summarized in Table 3. Plant-specific unavailability data is primarily obtained from the Surry Maintenance Rule Program.

Page 8 of 25

Common Cause Events Dependent failures (i.e., common cause failures not due to support system failures) are also treated in the Surry internal events PRA model. Common cause failures (CCF) are evaluated for like components within a system. This includes similar components within different trains of the same system. Similar components in different systems, in general, are not modeled with common mode failures.

The Surry internal events PRA explicitly models a large number of common cause component failures. The number and level of detail of common cause component failures modeled in the Surry internal events PRA is equal to or greater than the majority of U.S. PWR PRAs currently in use. The common cause failure probabilities in the Surry internal events PRA are calculated using the a-factor model. The a factors used in calculating the Surry CCF probabilities are taken from the INEEL CCF database documented in NUREG/CR-5497.

Page 9 of 25

Table 3 SURRY PLANT-SPECIFIC COMPONENT FAILURE MODES Component Boundary Failure Mode Air Handling . Body/motor (fan operator) 1. ACU-LF (Air handling unit loss Unit

• Coupling system (switch and of function during the mission) associated control circuit)

Air Operated = Damper body 1. AOD-FC (Air operated damper Damper e Current/pressure converter fails to open on demand)

2. AOD-FO (Air operated damper fails to close on demand)

3. AOD-SC (Air operated damper spuriously closes during the mission)

Air Operated e Valve body 1. AOV-FC (Air operated valve Valve 1 e Current/pressure converter fails to open on demand)

2. AOV-FO (Air operated valve fails to close on demand)

3. AOV-PG (Air operated valve plugged during standby)

4. AOV-PL (Air operated valve plugged during the mission)

5. AOV-SC (Air operated valve spuriously closes during the mission)

6. AOV-SO (Air operated valve spuriously opens during the mission)

Battery e Battery cells and output 1. BAT-LP (Battery Failed to connection supply power during standby)

Battery Charger/ . Input and output power cable 1. BCH-LP (Battery Rectifier connections Charger/Rectifier Failed to supply power during the mission)

Breaker

• Body/actuator of the breaker 1. BKR-FC (Breaker fails to open between the cable inlet and on demand) outlet. 2. BKR-FO (Breaker fails to close on demand)

3. BKR-SO (Breaker spuriously opens during the mission)

If the SOV of a specific AOV is not modeled separately, the boundary of the specific AOV should include the SOV.

Page 10 of 25

Table 3 SURRY PLANT-SPECIFIC COMPONENT FAILURE MODES Component Boundary Failure Mode Bus (any

• Section of electrical structure 1. BUS-LU (Bus loss of function voltage) between main power supply during the mission) breaker or transformer and input to breakers Cable

• Length of 1000 ft cable 1. CBL-LU (Cable '1000 ft' loss of function during the mission)

Check Valve e Valve Body 1. CKV-FC (Check valve fails to open on demand)

2. CKV-FO (Check valve fails to close on demand)

3. CKV-PG (Check valve plugged during standby)

4. CKV-SC (Check valve spuriously closes during the mission)

5. CKV-SO (Check valve spuriously opens during the mission)

Chiller e Body/motor (chiller operator) 1. CHU-FS (Chiller fails to start)

• Auxiliary system 2. CHU-FR Chiller fails to

• Coupling system (switch and continue running for a certain associated control circuit) mission time)

Compressor

• Body/motor (compressor 1. CMP-FS (Compressor fails to operator) start)

• Lubrication and cooling system (local) 2. CMP-FR (Compressor fails to

• Coupling system (switch and continue running for a certain associated control circuit) mission time)

Diesel Driven 9 Pump body 1. DDP-FR (Diesel Driven Pump Pump

• Diesel/actuator fails to run for a certain mission

• Lubrication system time)

SCooling system 2. DDP-FS (Diesel Driven Pump

• Startup air system fails to start)

Page 11 of 25

Table 3 SURRY PLANT-SPECIFIC COMPONENT FAILURE MODES Component Boundary Failure Mode Diesel

• Generator body 1. EDG-FS (Diesel generator fails Generator e Generator actuator to start)

• Lubrication system (local) 2. EDG-FR (Diesel generator fails

• Fuel system (local) to continue running for a

• Cooling components (local) certain mission time)

• Startup air system

• Exhaust and combustion air system

• Individual diesel generator control system o Circuit breaker for supply to safeguard buses and their associated local control circuit (coil, auxiliary contacts, wiring and control circuit contacts) with the exception of all the contacts and relays which interact with other electrical or control systems.

Fan o Body/motor (fan operator) 1. FAN-FS (Ventilation fan fails to o Coupling system (switch and start) associated control circuit) 2. FAN-FR (Ventilation fan fails to continue running for a certain mission time)

Filter o Filter body (differential 1. FLT-PG (Filter plugged during pressure transmitter standby) excluded)

Flow Instrument o Input and output connections 1. FIC-LF (Flow instrument Channel o Element and signal channel loss of function during standby)

Fuse

• Input and output connections 1. FUS-SO (Fuse spuriously opens during the mission)

Heat Exchanger o body and the pipe between 1. HEX-PG (Heat exchanger inlet and outlet isolation plugged during standby) valves (valves are not 2. HEX-LF (Heat exchanger loss included) of function during standby)

3. HEX-LU (Heat exchanger loss of function during the mission)

Page 12 of 25

Table 3 SURRY PLANT-SPECIFIC COMPONENT FAILURE MODES Component Boundary Failure Mode Electrical Heater

• Cable entry and exit 1. EHR-LF (Electrical Heater loss connections of function during standby)

Inverter

• Input and output connections 1. INV-LU (Inverter loss of function during the mission)

Level Instrument

• Input and output connections 1. LIC-LF (Level instrument Channel

• Element and signal channel loss of function during standby)

2. LIC-LU (Level instrument channel loss of function on demand)

Limit Switch

• Component and signal 1. LMS-LF (Limit switch loss of (including contacts) function on demand)

Manual Switch

• Static and moving parts, and 1. HS-LF (Hand switch loss of connections between input function on demand) and output cables (including contacts.)

Manual Valve

• Valve body and wheel 1. MV-FC (Manual valve fails to open on demand)

2. MV-FO (Manual valve fails to close on demand)

3. MV-PG (Manual valve plugged during standby)

4. MV-PL (Manual valve plugged during the mission)

5. MV-SC (Manual valve spuriously closes during the mission)

6. MV-SO (Manual valve spuriously opens during the mission)

Page 13 of 25

Table 3 SURRY PLANT-SPECIFIC COMPONENT FAILURE MODES Component Boundary Failure Mode Motor Driven e Pump body 1. PAT-FS (Standby motor driven Pump

• Motor/actuator pump of a running system fails

• Lubrication system to start)

• Cooling components of the 2. PAT-FR (Motor driven pump of pump seals a running system fails to pump vcontinue

• The voltage supply breaker misotme running for a certain local and its associated control circuit (coil, auxiliary 3. PSB-FS (Standby motor driven contacts, wiring and control pump of a standby system fails circuit contacts). to start)

4. PSB-FR (Standby motor driven pump of a standby system fails to continue running for a certain mission time)

Motor Operated

• Same as for motorized valve 1. MOD-FC (Motor operated Damper damper fails to open on demand)

2. MOD-FO (Motor operated damper fails to close on demand)

3. MOD-SC (Motor operated damper spuriously closes during the mission)

Motor Operated e Valve body 1. MOV-FC (Motor operated valve Valve

• Motor/actuator fails to open on demand)

• Voltage supply breaker and 2. MOV-FO (Motor operated valve its associated local fails to close on demand) open/close circuit 3. MOV-PG (Motor operated valve (open/close switches, plugged during standby) auxiliary and switch contacts, 4. MOV-PL (Motor operated valve wiring and switch plugged during the mission) energization contacts). 5. MOV-SC (Motor operated valve spuriously closes during the mission)

6. MOV-SO (Motor operated valve spuriously opens during the mission)

Moving Screen

• Screen body/motor/operator 1. SCN-PG (Moving Screen

• Coupling system (switch and Plugged during standby) associated control circuit) 2. SCN-PL (Moving Screen Plugged during the mission)

Page 14 of 25

Table 3 SURRY PLANT-SPECIFIC COMPONENT FAILURE MODES Component Boundary Failure Mode Pressure 9 Input and output connections 1. PIC-LF (Pressure instrument Instrument

• Element and signal channel loss of function during Channel the standby)

2. PIC-LU (Pressure instrument channel loss of function on demand)

Relays o Input and output power cable 1. RLY-LF (Relay loss of function connections (including on demand) contacts) 2. RLY-SO (Relay spurious operation during the mission)

Relief Valve o Valve body 1. RV-FC (Relief valve fails to e Air control and supply open on demand)

• Solenoid and associated 2. RV-FO (Relief valve fails to control circuit close on demand)

3. RV-RC (Relief valve fails to re-close on demand)

4. RV-SO (Relief valve spuriously opens during the mission)

Safety Valve

• Valve body and associated 1. SV-FC (Safety valve fails to spring open on demand)

2. SV-FO (Safety valve fails to close on demand)

3. SV-RC (Safety valve fails to re-close on demand)

4. SV-SO (Safety valve spuriously opens during the mission)

Solenoid

• Same as for solenoid 1. SOD-FC (Solenoid operated Operated operated valve damper fails to open on Damper demand)

2. SOD-FO (Solenoid operated damper fails to close on demand)

3. SOD-SC (Solenoid operated damper spuriously closes during the mission)

4. SOD-SO (Solenoid operated damper spuriously opens during the mission)

Page 15 of 25

Table 3 SURRY PLANT-SPECIFIC COMPONENT FAILURE MODES Component Boundary Failure Mode Solenoid Valve

• Valve body 1. SOV-FC (Solenoid valve fails

• Three-way valve to open on demand)

• Operator (solenoid) and the 2. SOV-FO (Solenoid valve fails local solenoid energization to close on demand) circuit (auxiliary contacts, 3. SOV-PG (Solenoid valve wiring, solenoid energizing plugged during standby) contacts). 4. SOV-PL (Solenoid valve plugged during the mission)

5. SOV-SC (Solenoid valve spuriously closes during the mission)

6. SOV-SO (Solenoid valve spuriously opens during the mission)

Strainer

• Strainer body (differential 1. STR-PG (Strainer or Stationary pressure transmitter Screen plugged during excluded) standby)

2. STR-PL (Strainer or Stationary Screen plugged during mission)

Stationary e Screen body (Differential Same as strainer Screen pressure transmitter excluded)

Tank e Tank body and piping up to 1. TNK-LF (Tank Loss of Function the inlet and outlet first on demand) valves 2. TNK-LU (Tank loss of function during a certain mission time)

Temperature 9 Input and output connections 1. TIC-LF (Temperature Instrument e Element and signal instrument channel loss of Channel function during standby)

Timer 9 Input and output connections 1. TMR-LF (Timer loss of function on demand)

Trip Module e Input and output connections 1. TRU-LF (Trip unit loss of function during standby Page 16 of 25

Table 3 SURRY PLANT-SPECIFIC COMPONENT FAILURE MODES Component Boundary Failure Mode Transformer

• Input and output power cable 1. TFM-LP (General Transformer connections loss of function during the mission)

2. RST-LP (Reserve Station Service Transformer fails to supply power during a certain mission time)

3. SST-LP (Station Service Transformer fails to supply power during a certain mission time)

Turbine Driven

• Pump body 1. TRB-FS (Turbine driven pump Pump

• Turbine/actuator

• Lubrication system (including fails to start) pump) 2. TRB-FR (Turbine driven pump

• Turbopump seal fails to continue running for a

• Cooling components certain mission time)

• Local turbine control system (speed).

• Turbine control valve Flow Control e Pump body 1. FCV-FC (Flow Control Valve Valve 0 Flow element, and controller transmitter, fails to open on demand)

2. FCV-FO (Flow Control Valve fails to close on demand)

3. FCV-PG (Flow Control Valve plugged during standby)

4. FCV-LF (Flow Control Valve loss of function on demand)

5. FCV-LU (Flow Control Valve loss of function during the mission)

6. FCV-SC (Flow Control Valve spuriously closes during the mission)

7. FCV-SO (Flow Control Valve spuriously opens during the mission)

Page 17 of 25

Table 3 SURRY PLANT-SPECIFIC COMPONENT FAILURE MODES Component Boundary Failure Mode Level Control

• Pump body 1. FCV-FC (Flow Control Valve Valve

• Level element, transmitter, fails to open on demand) and controller

2. FCV-FO (Flow Control Valve fails to close on demand)

3. FCV-PG (Flow Control Valve plugged during standby)

4. FCV-LF (Flow Control Valve loss of function on .demand)

5. FCV-LU (Flow Control Valve loss of function during the mission)

6. FCV-SC (Flow Control Valve spuriously closes during the mission)

7. FCV-SO (Flow Control Valve spuriously opens during the mission)

Pressure

• Pump body 1. FCV-FC (Flow Control Valve Control Valve

• Pressure element, fails to open pnoon demand) transmitter, and controller 2. fist ead FCV-FO (Flow Control Valve fails to close on demand)

3. FCV-PG (Flow Control Valve plugged during standby)

4. FCV-LF (Flow Control Valve loss of function on demand)

5. FCV-LU (Flow Control Valve loss of function during the mission)

6. FCV-SC (Flow Control Valve spuriously closes during the mission)

7. FCV-SO (Flow Control Valve spuriously opens during the mission)

Page 18 of 25

Table 3 SURRY PLANT-SPECIFIC COMPONENT FAILURE MODES Component Boundary Failure Mode Temperature

• Pump body 1. PCV-FC (Temperature Control Control Valve Temperatureand

• transmitter, element, controller Valve fails to open on demand)

2. PCV-FO (Temperature Control Valve fails to close on demand)

3. PCV-PG (Temperature Control Valve plugged during standby)

4. PCV-LF (Temperature Control Valve loss of function on demand)

5. PCV-LU (Temperature Control Valve loss of function during the mission)

6. PCV-SC (Temperature Control Valve spuriously closes during the mission)

7. PCV-SO (Temperature Control Valve spuriously opens during the mission)

Hand Control ° Pump body 1. HCV-FC (Hand Control Valve Valve fails to open on demand)

2. HCV-FO (Hand Control Valve fails to close on demand)

3. HCV-PG (Hand Control Valve plugged during standby)

4. HCV-LF (Hand Control Valve loss of function on demand)

5. HCV-LU (Hand Control Valve loss of function during the mission)

6. HCV-SC (Hand Control Valve spuriously closes during the mission)

7. HCV-SO (Hand Control Valve spuriously opens during the mission)

Page 19 of 25

Level 2 PRA The Surry Level 2 PRA is a large, early release frequency (LERF) model. The Surry Level 2/LERF PRA is a realistic, plant-specific model that incorporates the following features:

" LERF Containment Event Trees (CETs) designed for three types of core damage scenarios:

- Containment intact at time of core damage

- Containment failed at time of core damage

- Containment bypass scenarios

• LERF CETs address:

- Containment isolation

- In-vessel and Ex-Vessel core damage progression

- Energetic phenomena

- Emergency procedures (e.g., containment flooding)

- Containment failure location

• Level 1 PRA accident sequence logic and system logic linked directly into the LERF CETs

" Containment isolation failure fault tree based on plant-specific analysis

• Containment ultimate capability based on plant-specific analyses

• Accident progression timings and radionuclide release characteristics based on plant-specific thermal hydraulic analyses using the MAAP code MAINTENANCE OF PRA The Surry internal events PRA model and documentation has been maintained as a living program, and the PRA is routinely updated approximately every 3 years to reflect the current plant configuration and to reflect the accumulation of additional plant operating history and component failure data.

The Level 1 and Level 2 Surry internal events PRA analyses were originally developed in 1991 and submitted to the NRC as the IPE Submittal. The Surry internal events PRA has been updated many times since the original IPE. A summary of the Surry PRA history is as follows:

• Original IPE (1991) 0 1997 revision 0 1998 major model revision

• 2001 model revision 0 2002 revision to add flooding

• 2003 major model revision 0 105A model revision for MSPI implementation 0 105Aa model (model used for this application)

An administratively controlled process is used to maintain configuration control of the Surry PRA models, data, and software. ' In addition to model control, Page 20 of 25

administrative mechanisms are in place to assure that plant modifications, procedure changes, calculations, operator training, and system operation changes are appropriately screened, dispositioned, and scheduled for incorporation into the model in a timely manner. These processes help assure that the Surry internal events PRA reflects the as-built, as-operated plant within the limitations of the PRA methodology. Updated PRA models undergo a design review by experienced PRA staff prior to release. The design review includes discussion of major changes to the model, review of the dominant risk contributors, and limitations on use of the model.

The Safety Monitor tool is used by the plant staff to solve the PRA model for 10CFR50.65(a)(4) compliance. A single top logic fault tree model created for use in the Safety Monitor undergoes a comparison with the WinNUPRA event tree/fault PRA model from which it is based to ensure dominant cutsets are consistent. The risk model used in the Safety Monitor is electronically imported from the WinNUPRA tool. Therefore, the potential for errors in the Safety Monitor model is minimized.

This process involves a periodic review and update cycle to model any changes in the plant design or operation. Plant hardware and procedure changes are reviewed on an approximate quarterly basis to determine if they impact the internal events PRA and if a PRA modeling and/or documentation change are/is warranted.

These reviews are documented. If any PRA changes are warranted they are added to the PRA configuration control (PRACC) database for PRA implementation tracking.

The Surry PRACC database was reviewed in support of this temporary technical specification change risk assessment to identify the impact on this analysis from any open (i.e., not yet officially resolved and incorporated into the PRA) PRACC.

The open PRACC contain identified PRA changes to address plant modifications (as discussed above) as well as changes to correct errors or to enhance the model. This review determined that the open Surry PRACCs have an insignificant impact on the results and conclusions.

COMPREHENSIVE CRITICAL REVIEWS

Background

To verify and improve the quality of the PRA model, reviews of the model have been performed to assess the development of the model against industry standards. In general, such reviews may be categorized in one of two categories:

1) self-assessments, which are generally performed by members of the PRA group (sometimes with outside assistance), or

2) peer reviews, which are generally performed by qualified independent personnel outside the PRA group.

Page 21 of 25

In either case, a documented process and guidance that specify expectations for technical capability in various areas are used by the reviewers. Significant observations and recommendations are documented by the reviewers and are to be addressed, as appropriate, in future updates of the PRA. This attachment focuses on the significant observations and recommendations from peer review.

Westinghouse Owner's Group (WOG) PRA Peer Review in 1998, the Surry internal events PRA received a formal industry PRA Peer Review. The purpose of the PRA Peer Review process was to provide a method for establishing the technical quality of a PRA for the spectrum of potential risk-informed plant licensing applications for which the PRA may be used. The PRA Peer Review process used a team composed of industry PRA consultants and utility peers, each with significant expertise in both PRA development and PRA applications. This review team provided both an objective review of the PRA technical elements and a subjective assessment, based on their PRA experience, regarding the acceptability of the PRA elements.

This review was performed using the WOG implementation of the industry PRA peer review methodology as defined in NEI-00-02, "PRA Peer Review Process Guidance."

The review team reviewed over 200 attributes of 11 different elements of the PRA and assigned a grade (ranging from 4 - highest quality to 1 - minimum uses) for each attribute and element. Reviewer questions or comments that could not be answered during the review were documented in Fact & Observation (F&O) forms and were categorized by level of significance as follows:

A - Extremely important, technical adequacy may be impacted B - Important, but may be deferred to next model update C - Less important, desirable to maintain model flexibility and consistency with the industry D - Editorial, minor technical item S - Strength / Superior Treatment (no follow-up required)

The peer review is documented in the Westinghouse PRA peer review report ["Surry Power Station Probabilistic Risk Assessment Peer Review Report," Westinghouse Owner's Group, August 1998].

Fact and Observation (F&O) Summary Table 1 provides a summary of the number of F&Os for each element, along with their level of significance.

Page 22 of 25

Table 1 - Summary of Surry Internal Events PRA WOG Peer Review Significance Level and Number of F&Os Element A B C D S Initiating Events (IE) 0 5 2 3 1 Accident Sequences Evaluation 0 2 5 1 0 (AS)

Thermal Hydraulic Analysis & Other 0 1 2 1 0 Engineering Calculations (TH)

Systems Analysis (SY) 0 4 8 2 0 Data Analysis (DA) 0 3 4 1 2 Human Reliability Analysis (HR) 0 3 1 3 1 Dependency Analysis (including 0 1 3 0 0 Internal Flooding) (DE)

Structural Response Assessment 0 0 0 0 0 (ST)

Quantification & Results 0 0 3 0 0 Interpretation (QU)

Containment Performance Analysis 0 1 3 2 0 and LERF (L2)

Maintenance and Update Process 0 3 0 0 1 (MU) _ I Total 0 23 31 13 5 Subsequent to the peer review, the Surry internal events PRA model has been updated to address a number of the F&Os. As indicated in Table 1, there were no A significance F&Os. All B significance F&Os have been resolved and addressed in the PRA, as appropriate. Note that many of the C and D significance F&Os have also been addressed through model updates since the peer review. The outstanding resolution of the remaining C and D significance F&Os, which by definition are of lower priority, continues to be tracked.

The forms for the B significance F&Os from the peer review report are provided in . The "Plant Response or Resolution" section of the form includes a discussion of how the F&O has been addressed.

In addition to addressing the Surry WOG Peer Review A and B F&Os, a review of the North Anna WOG Peer Review A and B F&Os applicable to Surry was also performed. The North Anna WOG Peer Review A and B F&Os applicable to Surry which remain unresolved include conversion of the Surry IPE anticipated transient without scram (ATWS) model to the newer Westinghouse ATWS methodology, documenting of key limitations in the quantification documentation, improving documentation of the existing ATWS model, and addressing manual operation of steam generator power-operated relief valves after their air supply is depleted.

A review of these North Anna WOG Peer Review A and B F&Os indicates that their resolution would not change the conclusions of this application.

Page 23 of 25

Surry Internal Events PRA Self-assessment In 2004, a self-assessment of the Surry internal events PRA against the ASME PRA Standard was completed by Dominion using guidance provided in NRC Regulatory Guide (RG) 1.200 Revision 0, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results from Risk-Informed Activities." This self-assessment was performed as part of an industry/NRC pilot program to test RG 1.200 in the application of 10CFR50.69.

Many of the areas of potential improvement identified in the self-assessment (e.g., document dependent HEPs, plant-specific alpha-factors for dominant CCF events, perform updated/additional Modular Accident Analysis Program (MAAP) runs and update success criteria documentation, etc.) have been incorporated into the Surry internal events PRA model. Those areas of potential enhancement from the self-assessment that have yet to be formally addressed in the internal events PRA were reviewed in support of this risk assessment. This review determined that none of these items has a significant impact on this risk assessment.

Surry Internal Events Human Reliability Analysis Peer Re-Review In 2004, a focused peer re-review was performed on the Surry internal events human reliability analysis (HRA). The peer re-review was performed to address methodology changes in the HRA analysis implemented in the model since the WOG peer review in 1998. All significant findings and observations from the peer re-review were addressed in the PRA model.

NRC Internal Event PRA Assessment In 2005, the NRC conducted a review of the Surry internal event PRA model as part of the before mentioned industry/NRC pilot initiative to test RG 1.200, Revision 0 in the application of 10CFR50.69. The results of a previously performed self-assessment by Dominion (described below) were subsequently compared to the NRC assessment.

Dominion subsequently withdrew from the RG 1.200 and 10CFR50.69 pilot in 2006.

Major changes made to the Surry internal events PRA model since this NRC assessment included: development of a main control room cooling fault and event trees, development of a loss of instrument air event tree, update of plant specific data, and close out of all remaining WOG peer review A and B F&Os.

IPEEE External Event Analysis Used in this Application The external event analysis (i.e., fire and seismic) from the Individual Plant Examination of External Events (IPEEE) was added to the Surry PRA in 2006.

Other external events evaluated in the IPEEE were reviewed and determined to have no impact on this application and are not included in the Surry model for this application.

Page 24 of 25

The fire analysis in the IPEEE was based on the EPRI Fire-Induced Vulnerability Evaluation (FIVE) methodology, with the unscreened fire risk contributors being quantified to calculate core damage frequency. Screened fire risk contributors in the IPEEE fire analysis were evaluated for this application to determine if any would not meet the screening criteria with a chilled water loop out of service. Six screened fire areas in the IPEEE fire analysis (the MER-5 chiller room, the Unit 1 Cable Tray Room, the Turbine Building, the MER-3 chiller room, Unit 2 Main Transformer and Station Transformer, and Reserve Station Service Transformers) were determined to be the risk significant contributors to this application. The ICCDP contribution from these scenarios was determined to be 1.3E-7. The contribution from these screened fire scenarios was added to the quantified risk impacts from the PRA model used for this application to determine the overall risk impacts.

The seismic analysis in the IPEEE was a seismic PRA utilizing state of the art methods at the time of its development.

No significant changes were made to the IPEEE fire and seismic models, except that the updated, living internal events system models were used in the external event analysis to analyze random faults (i.e., not related to the initiating event) for these external events. The results of adding the external event models to the internal events model were compared with the IPEEE external event risk results to ensure the results are consistent, or explainable where changes have been made in the internal events system models.

Risks associated with the construction activities during the chilled water piping replacement were also evaluated for impact on the internal and external event risk models used for this application. This review included the risk impact of piping welding, fire and flooding penetration impairment, and physical damage to the redundant operating chilled water loop. Equipment unavailability restrictions and compensatory actions planned to be implemented during the chilled water piping replacement described in Attachments 1 and 4, respectively, were determined to provide sufficient detection and mitigation capability such that no change in the PRA model was deemed necessary to model these risks.

Page 25 of 25

Attachment 6 Westinghouse Owners Group PRA Peer Review Fact and Observation Forms Temporary 45-day and 14-day AOTs to Replace MCR and ESGR Air Conditioning System Chilled Water Piping Surry Power Station Units 1 and 2 Virginia Electric and Power Company (Dominion)

WOG PEER REVIEW FACTIOBSERVATION REGARDING PRA TECHNICAL ELEMENTS OBSERVATION (ID: AS-2) / Element AS / Subelement 5 and 9 (Also MU)

The models and analyses are consistent, as best as the reviewers could determine, with the as built plant, and were consistent with plant operating procedures at the time the IPE was completed. However, there is no process in place to identify and incorporate changes in plant operation into the PRA model. This process should also include periodic review of industry standards that may impact the PRA. Some examples of where such a process could impact the model include, the timing for switchover to hot leg recirculation after event initiation (9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> in the current EOP),

and a review of potential impacts on the PSA due to the power uprate program. The focus of this comment is on the lack of process more than any current discrepancies found in the model, and is related to the IPE Maintenance and Update Process elements.

LEVEL OF SIGNIFICANCE B (It is important that the PRA model an appropriately current plant configuration, and that there is a process for determining how and when plant changes should be incorporated into the PRA models. However, this observation is not a contingent item within the review of PRA technical element AS, since it is more generically addressed within the review for element MU.)

POSSIBLE RESOLUTION Establish a formal process for identifying changes to plant procedures (EOPs/AOPs),

and evaluating the impact of these changes on the PRA model. This process should also include periodic review of industry standards that may affect modeling assumptions and success criteria used in the PRA. The resolution of this comment should be incorporated as an element of the PRA Maintenance and Update Process.

PLANT RESPONSE OR RESOLUTION PRA update guidance was developed, which includes a review of plant procedures (EOPs), assumptions for components, and system recovery models based upon human actions (Nuclear Safety Analysis Manual - Part IV, Chapter J, subsequently superceded by PRA Manual - Part IV, Chapter A). The current industry guidance suggests a voluntary periodic review of industry standards, which will be considered as resources allow. Recent PRA updates (S03A, S05A) provide examples of the process.

This F&O is Closed.

Page 1 of 23

WOG PEER 'REVIEW FACT/OBSERVATION REGARDING PRA TECHNICAL ELEMENTS OBSERVATION (ID: AS-8) / Element AS / Subelement AS-12 The RCP seal LOCA model appears to include an optimistic interpretation of the WOG and NRC models, and does not include a contribution from early seal failure.

LEVEL OF SIGNIFICANCE B (The treatment of RCP seal LOCA has the potential to significantly affect PRA results, and could therefore be considered to have a greater significance level.

Although there is currently no standard modeling approach, the assumptions used for the Surry model appear to be optimistic relative to assumptions used for other PRAs.)

POSSIBLE RESOLUTION Consider an evaluation of the sensitivity of the PRA results to use of a model that includes the possibility of early seal failure.

Also evaluate the potential impact on the model due to recent changes to the WOG seal cooling restoration emergency response guidelines (advising against restoration of seal cooling after a relatively brief cooling loss).

PLANT RESPONSE OR RESOLUTION An RC pump seal failure model (the so-called Rhodes model) that is acceptable to the NRC for use in PRA was developed and implemented for the T4, T1A and T6 event trees. This model addresses the probability of early seal failure, and does not allow restoration of seal cooling after a relatively brief cooking loss. For Surry, the model is discussed fully in SM-1296, implemented in the SOA-D PRA models. For the S03A model, the T1A (SBO) accident sequence model was revised to be fully consistent with the WOG2000 RCP seal LOCA model, and the T4 and T6 accident sequences models were revised to incorporate simplified logic consistent with the WOG2000 model.

The PRA adequately addresses early seal failure contribution, so this F&O is CLOSED. Future model updates are planned to include additional model detail (and remove conservatisms) for the seal failure contribution for events other than T1A.

Page 2 of 23

WOG PEER REVIEW FACT/OBSERVATION REGARDING PRA TECHNICAL ELEMENTS OBSERVATION (ID: DA-6) / Element DA. / Subelement DA-11 The models for the EDGs do include common cause failures of fuel oil system.

In general the models do consider common/shared components and support systems explicitly.

The models do not appear to include the effects of common maintenance crews or I&C technicians. Specifically, there is no consideration of common cause miscalibration of instrumentation channels.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Update the models to include common cause instrumentation miscalibration.

Documentation should at least include a qualitative discussion of the potential impact of common maintenance crews and similar procedures. The documentation should also highlight areas where CCF was not included because of design diversity or other similar considerations.

PLANT RESPONSE OR RESOLUTION Miscalibration of instrumentation channels is resolved as a human reliability rather than an equipment common cause fault. The HEP fault behaves the same as an equipment CCF, but is quantified on the basis of human error rather than equipment reliability.

For Surry, HEP events are created for the following instrument channels: EDG, 1-LM-PT-10OA/B/C/D, MS flow, MS differential pressure, steam generator level, pressurizer pressure RWST level, intake canal level and RC delta T and TAVE. The models are discussed fully in SM-1310, implemented in the SOA-D PRA models.

This F&O is CLOSED.

Page 3 of 23

WOG PEER REVIEW FACT/OBSERVATION

'REGARDING PRA TECHNICAL ELEMENTS OBSERVATION (ID: DA-9) / Element DA / Subelement 9 The common cause failure probability of valves failing due to plugging is (0.1)(1.25-f/hr)(2160 hrs), or about 1E-4. The 0.1 beta factor used for this calculation may be overly conservative. The net result is that many of the top sequences (for the 3-year maintenance case) involve common cause valve plugging terms. It is unusual to have passive equipment failures be so prominent in the dominant cutsets (more prominent than active equipment failures).

LEVEL OF SIGNIFICANCE B -- The over conservatism in the beta factor could cause erroneous conclusions when the PSA results are used for ranking applications, such as Maintenance Rule or valve programs (MOV,.AOV, CV).

POSSIBLE RESOLUTION Consider the use of a more realistic beta factor in the analysis.

PLANT RESPONSE OR RESOLUTION The common cause fault (CCF) approach is revised to incorporate the following:

Alpha-factor model, INEEL data base of CCF events from NUREG/CR-6268, different failure modes (run and demand), and different CCF events based upon population size (e.g., 2 of 3 as well as 3 of 3 CCF events. Guidance for the CCF models was taken from NUREG/CR-5485, which extends the technology developed for NUREG/CR-4780.

The models are discussed fully in SM-1309, implemented in the SOA-D PRA models for Surry, and in the DA.3 notebook and revisions prepared for subsequent model updates (starting with S03A).

This F&O is CLOSED.

Page 5 of 23

WOG PEERREVIEW FACT/OBSERVATION REGARDING PRA TECHNICAL ELEMENTS OBSERVATION (ID: DE-3) / Element DE / Subelement 8 The methods used to determine CCF groups is simplistic. Determination of the set of active components based on 1% contribution to CDF severely limits the number and type of common cause terms used in the model. As an evaluation tool for plant vulnerabilities (i.e., the IPE), it is more than sufficient, but as an evaluation tool for Risk-informed Applications, it is not enough.

Events that should be considered include:

Breaker fail to operate (Open/Close)

Auxiliary Feedwater Pumps (back-leakage)

Ventilation fans LEVEL OF SIGNIFICANCE B (A careful consideration of common cause modeling requirements is important for PSAs used for risk-informed applications.)

POSSIBLE RESOLUTION The generic data base development project identifies a large number of common-cause groups. Incorporate these groups or better justify their exclusion.

PLANT RESPONSE OR RESOLUTION The common cause fault (CCF) approach was revised to incorporate the following:

Alpha-factor model, INEEL data base of CCF events from NUREG/CR-6268, different failure modes (run and demand), and different CCF events based upon population size (e.g., 2 of 3 as well as 3 of 3 CCF events. Guidance for the CCF models was taken from NUREG/CR-5485, which extends the technology developed for NUREG/CR-4780.

The models are discussed fully in SM-1309, implemented in the SOA-D PRA models for Surry, and in the DA.3 notebook and revisions prepared for subsequent model updates (starting with S03A).

This F&O is CLOSED.

Page 6 of 23

WOG PEER REVIEW FACT/OB SERVATION REGARDING PRATECHNICAL ELEMENTS OBSER VA TION (ID: HR-2) / Element HRIDEIS Y / Subelements HR-4, 7IDE-71S Y-8 Table D.1-1 of Section D.1 of the Surry IPE lists the pre-initiator errors considered in the analysis. The list contains only mispositioning events (valves, blank flanges, etc.).

No instrument miscalibration events are contained in the list. The procedure for system analysis (page 19 of 58) indicates that common cause His should be modeled for miscalibration of instruments used to initiate systems following an action or in any standby equipment items such as the level instrumentation in storage tanks.

LEVEL OF SIGNIFICANCE B -- The lack of miscalibration His could be significant. The actual effect is not known.

POSSIBLE RESOLUTION Provide the basis for excluding miscalibration events, or develop appropriate events for inclusion in the next update of the PSA model.

PLANT RESPONSE OR RESOLUTION Miscalibration of instrumentation channels is resolved as a human reliability rather than an equipment common cause fault. The HEP fault behaves the same as an equipment CCF, but is quantified on the basis of human error rather than equipment reliability.

For Surry, HEP events are created for the following instrument channels: EDG, 1-LM-PT-100A/B/C/D, MS flow, MS differential pressure, steam generator level, pressurizer pressure RWST level, intake canal level and RC delta T and TAVE. The models are discussed fully in SM-1310, implemented in the SOA-D PRA models.

This F&O is CLOSED.

Page 7 of 23

WOG PEER REVIEW FACT/OBSERVATION REGARDING PRA TECHICAL .ELEM ENTS OBSERVATION (ID: HR-4) / Element HR / Subelement 15 HEP development for the IPE model was extensively documented; however, HEPs developed for subsequent updates of the IPE model were not as well documented (and by implication, were not developed in as much detail). For many of the HEPs in subsequent updates, a value of 0.1 was used. It is not clear whether this is a screening value or some other value.

LEVEL OF SIGNIFICANCE B -- HEPs can have a significant effect on model results. HEPs added to the model as the result of updates should be developed and documented to the same level as the IPE HEPs.

POSSIBLE RESOLUTION Perform and document development of HEPs that arise from model updates.

PLANT RESPONSE OR RESOLUTION The HEP events developed since the IPE have received detailed analysis. For Surry, the models are discussed fully in SM-1310, implemented in the SOA-D PRA models, and in the HR-series notebooks developed for the S03A and subsequent updates. This process was also reviewed as part of the HRA peer re-review exercise prior to the RG1.200 review for Surry.

This F&O is CLOSED.

Page 8 of 23

W.OG. PEER REVIEW FACT/OBSERVATION.

REGARDING PRATECHNICAL ELEMENTS OBSERVATION(ID: HR-5) I Element HR / Subelement26 In a sensitivity analysis (SM-1 174, Addendum A) to evaluate dependency among His contained in cutsets, time between actions was listed as the major factor in establishing independence of the operator actions. In most cases, time (itself) is not an adequate factor, but is a parameter, which can be associated with more defensible factors. For example, one cutset contained two HEPs -- one for early SG isolation following a SGTR and one for late SG isolation. The time difference of several hours between the actions was cited as the basis for the actions' independence. Better factors for independence might have been different clues calling for the need to isolate the SG or actuation of the TSC, or additional/new crew for the late isolation. All of these are related to time, but time (itself) is not the factor.

LEVEL OF SIGNIFICANCE B -- Reevaluating dependence among HEPs focusing on factors other than time could produce different conclusions about dependency. The effect of a reevaluation on analysis results is not known.

POSSIBLE RESOLUTION Reevaluate dependence without excessive emphasis on time between actions.

PLANT RESPONSE OR RESOLUTION The dependency among the HEPs is being evaluated based on the following principles (SM-1 310):

1. Functions: If two HEPs are working for two different functions, these two HEPs will be justified as independent HEPs.

2 Steps of procedure: Because operators are trained to follow procedure step by step, on the view of operators, each step is a new and independent instruction. If two HEPs are based on two different steps or two different procedures, even these two HEPs work for the same function, they still may be justified as independent HEPs.

A sensitivity analysis was performed for the S03A model update (and has been incorporated into the PRA quantification process for subsequent updates) to review the cutsets with multiple HEPs and determine if a dependency may exist between the HEPs. Refer to the PRA QU.2 notebooks for further detail. This process was also reviewed as part of the HRA peer re-review exercise prior to the RG1.200 review for Surry.

This F&O is CLOSED.

Page 9 of 23

WOG PEER REVIEW FACT/OBSERVATION REGARDING *PRA TECHNIC AL ELE MENTS OBSERVATION (ID: IE-3) / Element IE / Subelement 13 (Also MU)

Initiating event frequencies have not been updated since the IPE submittal in 1991. As a result, recent industry information and operating experience have not been incorporated into the initiating events analysis. This information could alter the initiating event frequencies currently contained in the model. For example:

• Two plants (Salem and Wolf Creek) have experienced losses of circulating and service water that resulted in plant trips.

• One plant (Oconee) has experienced a small break LOCA (thermal fatigue of charging line).

• One plant (WNP-2) has experienced an internal flood.

A draft NUREG updating initiating events has (very recently) been issued (LOCA frequencies, particularly, have been affected).

LEVEL OF SIGNIFICANCE B -- Application results may be affected by inclusion of the new information.

POSSIBLE RESOLUTION Include an update of initiating event frequencies during the next update. Also, individual applications should be reviewed to determine if they are affected before submittal or implementation.

PLANT RESPONSE OR RESOLUTION The North Anna and Surry initiating event frequencies were updated in the NOA-D and SOA-D PRA updates by several sources. The rare initiator frequencies from NUREG/CR-5750 are used as priors for Bayesian updating with plant specific histories.

The moderate frequency transient initiating event frequencies are created from plant specific data (1990-2000 LERs) and a non-informative gamma prior distribution. Finally, some plant unique initiating events are quantified with new fault tree models directly linked to the integrated PRA model. For Surry, these models are discussed fully in Calculation SM-1307, implemented in the SOA-D PRA models. All IE frequencies have subsequently been updated in 2005 and documented in the IE.1 and IE.2 notebooks.

This F&O is CLOSED.

Page 10 of 23

WOG PEER REVIEW FACT/OBSERVATION REGARDING P TECHNICAL ELEMENTS OBSERVATION (ID: IE-4 ) / Element IE / Subelement 7 (Also MU)

A recent industry event (Oconee) involved a small break LOCA (>10 gpm) at the charging line connection to the RCS. The mechanism for the crack in the thermal sleeve at the connection point was thermal fatigue. Is the Surry piping subject to this type of event? If so, has it been considered in the initiating event frequency?

LEVEL OF SIGNIFICANCE B -- If this is a valid failure mechanism for small break LOCAs, the effect on frequency should be considered in the Surry analysis.

POSSIBLE RESOLUTION Evaluate the susceptibility of the Surry piping to this failure mechanism, and adjust the LOCA frequencies, as appropriate.

PLANT RESPONSE OR RESOLUTION The referenced Oconee event was evaluated as part of INPO SEN 163, Recurring Event, High Pressure Injection Line Leak, and as part of NRC IN 97-46, Unisolable Crack in High-Pressure Injection Piping.

The design of the CVCS and HHSI systems at Surry is significantly different than that of Oconee, Unit 2. The SPS design does not include combination CVCS makeup and HHSI lines. Each unit has only one CVCS makeup line which carries full makeup flow and the CVCS system employs a regenerative heat exchanger to heat the makeup water to within 100 degrees of the RCS cold leg temperature, thereby minimizing thermal shock.

The Oconee failure mechanism is not considered valid for the Surry design, and should not require LOCA frequency adjustment. The current Surry LOCA frequencies are developed from NUREG/CR-5750, per the evaluation in the IE.2 PRA notebook. This NUREG observed that no small LOCA events had occurred in U. S. nuclear power plants up to 1995. However, the 1997 Oconee 2 event could possibly be categorized as a very small LOCA / leak, and four such events from 1987 - 1995 are included within the NUREG/CR-5750 initiating event frequencies.

This F&O is CLOSED.

Page 11 of 23

WOG.PEER REVIEW FACT/OB SERVATION

~REGARDING PRATECIHNICAL ELEMENTS OBSERVATION (ID:: IE-5) / Element lE / Subelement 14 An industry issue of about 5-6 years ago was the creation of an ISLOCA caused by a leak in an RCP thermal barrier heat exchanger and a failure to isolate the CCW lines that provided cooling water to the heat exchanger. How was this potential ISLOCA pathway treated by the initiating events analysis? Does it apply to the Surry model?

LEVEL OF SIGNIFICANCE B -- The sequence described above, if applicable, represents an ISLOCA path that is not addressed by the Surry analysis.

POSSIBLE RESOLUTION Determine if the ISLOCA path is applicable to the Surry model, and address it, if appropriate.

PLANT RESPONSE OR RESOLUTION The industry issue initially surfaced in July 1984 as a Westinghouse 10 CFR Part 21 issue.

However, since Westinghouse was not the source vendor for the Surry CC system, this Part 21 issue was not communicated to Surry at that time. In May 1989, Surry communicated this issue to NRC and subsequently, NRC Information Notice 89-54 (June 23, 1989) was issued to all licensees. This NRC IN is probably the source of the industry issue quoted in the certification comment.

Surry submitted system design information to NRC in a June 5, 1989 letter to NRC (Serial No.89-406) clarifying resolution of the concern. This licensee response provides a detailed description of the problem and an assessment of the resolution. In summary,

" The operating history of Westinghouse RC Pump (RCP) thermal barriers indicates only one minor internal leak in over 12 million hours of operation (8.3 E-8/hr or 7.3 E-4/yr).

" Catastrophic failure of RCP thermal barrier is not a credible event. Westinghouse calculated the credible leak rate at 7.5 gpm. This low leak rate is due to high water purity in RC and CC water, conservatism in tube design supporting tube collapse rather that cracking, and low crack propagation due to external forces tending to close crack.

" The existing 1989 design was sufficient for isolating the RCP thermal barrier leak, but design enhancements were pursued since manual operator action is required for the credible leak (automatic isolation would occur for leak rates higher than 10 gpm).

" The event would not be classified an interfacing system LOCA (ISLOCA) since the CC system would be isolated from the RCS, and all isolation would occur within the containment. More appropriately, the event would be classified a very small break LOCA (based upon the 7.5 gpm credible leak) with a frequency well below the Surry IPE S2 frequency of 2.1 E-2/yr.

Additional information can be found in a 7/9/1990 NRC letter (Serial No.90-442), and drawings 11448-FM-072A sheets 1 through 4.

This F&O is CLOSED.

Page 12 of 23

WOG PEER REVIEW FACT/OBSERVATION REGARDING PRA TECHNICAL ELEMENTS OBSERVATION (ID: IE-8) / Element lE / Subelement 13 The FMEA portion of the Initiating Events notebook (page 12 of 28) states that screen wash pumps do not have to operate during an accident. The implication is that because of this there is no need to consider the screen wash system further. However, clogged screens can cause plant trips, and this failure mechanism should be considered in the development of initiating event frequencies. Recent industry events at Salem and Wolf Creek illustrate a plant's susceptibility to clogged intake screens.

LEVEL OF SIGNIFICANCE B -- Not considering the potential effect of clogged intake screens could result in an underestimation of the transient initiating frequency, particularly if there are plant specific features that could cause the likelihood of clogged screens to be higher than the industry average.

POSSIBLE RESOLUTION Determine the plant's susceptibility to clogged intake screens, and update the initiating event frequency as appropriate.

PLANT RESPONSE OR RESOLUTION The Surry LOSW IE is actually an evolution of a loss of circ water initiator. We do not currently model this with a fault tree, so there is no specific screen clogging contribution identified for this initiator. Currently, the Surry internal events PRA uses a plant specific Bayesian update of generic industry experience for loss of Circulating Water to evaluate the IE-T6 (Loss of Circulating Water) frequency. The plant specific clogged screen failure event is therefore considered, since it is part of the overall industry and plant-specific experience leading to loss of CW. However, an evaluation has been performed for the S03A model update to establish that the IE frequency used for this event would encompass contributions from events such as clogged intake screens / screen wash faults. Should the model be changed in the future to model this IE with a fault tree, this failure mechanism would be addressed explicitly.

This F&O is CLOSED.

Page 13 of 23

WOG PEER REVIEW FACTIOB3SERVATION REGARDING PRA TECHNICAL ELEMENTS OBSERVATION (ID: IE-9) / Element IEI Subelement 16 (Also see AS-9, and MU)

The reactor core has been upgraded to 2586 MWt. Has the effect of this change been considered on the moderator temperature coefficient/reactivity feedback, particularly for early in a core's life? Also, has the increased decay heat load been considered in the success criteria for decay heat removal?

LEVEL OF SIGNIFICANCE B -- Increases in core power can result in significant changes in the moderator temperature coefficient / reactivity feedback during the early part of a core's life, and can have a significant effect on success criteria requirements for emergency boration and other methods of shutting down the reactor during ATWS events.

POSSIBLE RESOLUTION Ensure that the effects of increased core power have been properly accounted for in the analysis.

PLANT RESPONSE OR RESOLUTION The effect of the 4.5% core power uprate on the timing of HEPs used in the SPS Internal Events PRA Model, and on the success criteria of hardware credited in the SPS Internal Events PRA Model has been evaluated using MAAP 4.0.5. The results of the analysis show that no changes are required to the current success criteria or HEP calculations. The details of the analysis are documented in SPS Notebook SPS-RA.MD.SC.001 Rev 0.

This F&O is CLOSED.

Page 14 of 23

WOG PEER REVIEW FACT/OBSERVATION REGARDING PRA TECHNICAL ELEMENTS OBSERVATION (ID: L2-2) / Element L2 / Subelement 8and 10 The consequences of operator actions after core damage are not considered in the PSA or the LERF assessment. After core damage has occurred, the control room staff will continue to attempt to implement EOP actions (and now SAMG actions).

Considering the EOP actions, only those that prevent core damage (have an impact on the CDF) are modeled in the Level 1 PSA. Several EOP actions that can impact the LERF are:

• FR-C.1 actions to depressurize the RCS at the onset of core overheating greatly decreases the probability of a high pressure reactor vessel failure, while significantly increasing: a) the potential for core concrete interactions, and b) the fission product release from RCS to containment (which, in turn, increases the source term for containment failures).

• FR-H.1 actions to establish some type of feedwater flow to the SGs increases the chances of SG tube failure due to thermal stresses of cold water being injected onto hot SG tubes, but can also increase the potential for arresting the core damage in-vessel. These two aspects can impact the LERF.

• ECA-0.0 actions to start sprays when offsite power is restored. This can prevent overpressure failure of containment, but can also de-inert containment and lead to a hydrogen burn. When combined with the added hydrogen from in-vessel recovery, the hydrogen burn may challenge containment.

Also, these operator actions should be substantiated by an HRA analysis to determine the HEP.

The plant has also completed implementation of the SAMG. The SAMG contains a set of accident management strategies that would be implemented for each of the core damage accidents. The implementation of some of the strategies has negative consequences that should be addressed.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Include appropriate consideration of EOP (and also SAMG) actions in the PSA models PLANT RESPONSE OR RESOLUTION Our Level I model takes into account all human error probabilities due to EOP actions. The human error probabilities based on SAMG actions are not incorporated into our model. According to WOG procedures, once the core temperature reaches 1200 F, the operator leaves the EOPs and enters the SAMGs (control room guideline SACRG-1). Our Level I model was developed independent of the SAMG actions. We recognize that inappropriate SAMG actions may cause negative consequences, which may result in greater source term releases to the atmosphere. For this reason a technical support center (TSC) is formed that reviews real time plant parameter data and provides expert guidance to the operation staff during a severe accident condition. Additionally training on the SAMGs is provided every 3 years which includes a discussion of these cautions and recommendations to the operators. The operators are taught to be aware of their plants most dominant accident sequences and the consequences of inadequate actions.

The approach taken is consistent with that appliedin other PWR PRAs, but this issue will be treatedas a recognized source of uncertainty in the LERF model.

With this action, this F&O is CLOSED.

Page 15 of 23

PEER REVIEW FACT/OBSERVATION

• /:*.!:i :::R* WOG EGA.RDING PRA TECHNICAL:E ELE ENS OBSERVATION (ID: MU-2) / Element MU / Subelement 4 The core power has been upgraded. Effects of this change have not been incorporated into the PSA model. Factors that could be affected by the core power upgrade include the moderator temperature coefficient (for ATWS) and the decay heat load (for several accident sequences).

LEVEL OF SIGNIFICANCE B -- Inclusion of the effects of a core POSSIBLE RESOLUTION At the next upgrade, evaluate the effects of the core upgrade and incorporate, as appropriate, into the PSA model.

PLANT RESPONSE OR RESOLUTION See discussion for equivalent F&O IE-09.

This F&O is CLOSED.

Page 16of 23

OBSERVATION (ID: MU-3) / Element MU / Subelement 4 Requirements for review of operating experience, plant procedures, and plant-controlled documents in support of a PSA update are not detailed in the PSA guidance documents.

LEVEL OF SIGNIFICANCE B - A comprehensive review of plant experience and changes is essential to help assure that the model update adequately represents current plant configuration.

POSSIBLE RESOLUTION Develop additional guidance on the review process requirements, describing which data should be reviewed and how the review should be documented.

PLANT RESPONSE OR RESOLUTION PRA update guidance was developed, which includes a review of: (1) Technical Specification revisions, (2) station engineering Design Change lists, (3) station procedures, and (4) operating experience. (Nuclear Safety Analysis Manual - Part IV, Chapter J, subsequently superceded by PRA Manual - Part IV, Chapter A). Recent PRA updates (S03A, S05A) provide examples of the process.

This F&O is Closed.

Page 17 of 23

WOG PEER REVIEW FACT/OB3SERVATION REGARDING PRA TECHNICAL ELEM ENTS`ý OBSERVATION (ID: MU-4) / Element MU / Subelement5 Activities to evaluate the effects on the PSA of changes to equipment failure rates, initiator frequencies, and human error probabilities are minimal.

LEVEL OF SIGNIFICANCE B - Data must be kept current to keep the model current.

POSSIBLE RESOLUTION Revisit initiator frequencies, equipment failure rates, and human error probabilities with each update to determine whether they are still adequately estimated.

PLANT RESPONSE OR RESOLUTION The Surry internal events PRA model has been updated to include changes in data.

For Surry, initiating events were updated as documented in calculation SM-1370.

Component unavailabilities were updated for Surry as documented in calculation SM-1308. The component reliabilities for risk significant pumps and the EDGs were Bayesian updated with plant specific data for Surry as documented in SM-131 1.

Further, a full data update was performed in 2005 for the MSPI update, as documented in the DA series of PRA notebooks.

The HEPs were reviewed and updated as necessary following the PRA self-assessment per RG1.200 and in response to the subsequent HRA peer re-review comments. Input from Operations personnel at Surry was obtained to provide better estimation of the times associated with the performance of emergency procedures.

A PRA update process and schedule addressing data updates has been implemented in the PRA Manual.

This F&O is CLOSED.

Page 18 of 23

. WOG PEER REVIEW FACT!OBSERVATION REGARDING PRA TECHNICAL ELEMENTS OBSERVATION (ID: SY-2) / Element SY / Subelement 5 (See also AS-5 and MU)

The program does not appear to have a formal requirement for incorporating changes based on plant design changes. For example, a later EOP change identifies the time to hot leg recirculation switchover as 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />. The model says 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br />.

There is an advantage to identifying operator actions to specific procedure steps. The downside is, procedures change. Thus, the models and documentation need to be updated periodically.

LEVEL OF SIGNIFICANCE B (It is important to risk-informed applications that the PSA models reflect recent changes to the plant)

POSSIBLE RESOLUTION The following suggestions, while directed to the systems analysis element, are actually applicable more broadly, within the context of the overall PSA Maintenance and Update process.

1. Develop a PSA change program that tracks identified changes to procedures, design, etc.

Develop a process for incorporating changes into the PSA.

NOTE: This does necessarily mean formal review required; notification from the program sponsor (Procedures group, admin, design engineering, etc.) is sufficient for most changes.

2. Consider becoming part of the review cycle for selected changes (e.g., for risk significant system design changes, PSA review is required). This will probably require a change to plant, engineering procedures.

There are going to be changes in plant configuration that could significantly affect the PSA. A formal review by the PSA group for selected changes has the potential for saving money (change should not be made in terms of plant risk), minimizing the effects of the change on the PSA and PSA based programs and possibly identifying alternative changes.

PLANT RESPONSE OR RESOLUTION PRA update guidance was developed, which includes a review of: (1) Technical Specification revisions, (2) station engineering Design Change lists, (3) station procedures, and (4) operating experience. (Nuclear Safety Analysis Manual - Part IV, Chapter J, subsequently superceded by PRA Manual - Part IV, Chapter A). Recent PRA updates (S03A, S05A) provide examples of the process.

This F&O is Closed.

Page 19 of 23

WOG PEER REVIEW FACTIOBSERVATION REGARDING PRA TECHNICAL ELEMENTS OBSERVATION (ID: SY- 4) / Element SY / Subelement 12 The RPS model does not properly identify the required support systems. RPS logic receives power from Class 1E 125V DC buses 1A and 11B. Failure of the DC buses removes power to the RTB shunt trip coils which limits operator action in the control room if reactor trip fails.

LEVEL OF SIGNIFICANCE B (Support system dependencies must be appropriately accounted for in the models)

POSSIBLE RESOLUTION

1. Review the RPS system and include DC power dependency.

PLANT RESPONSE OR RESOLUTION Fault trees RP1 for Surry were revised to include separate logic for RTA and RTB including the input logic signal with recovery. The models also include failure of the trip breaker (RTA/RTB), and RTA/RTB recovery thorough the shunt trip relay (including failure of 125 VDC, human reliability model, and failure of the shunt trip relay). The models are discussed fully in SM-1 151, implemented in the SOA-D PRA models for Surry.

This F&O is CLOSED.

Page 20 of 23

WOGPEER REVIEW FACTIOBSERVATION REGARDING" PRA TECHNICAL ELEMENTS OBSERVATION (ID: SY- 5) / Element SY / Subelement 5 The RPS logic model is incorrect. The fault tree indicates that success of either logic train allows challenge to both reactor trip breakers. Actual design is logic train A sends signal to RTA and logic train B sends signal to RTB.

LEVEL OF SIGNIFICANCE B (System models must correctly represent the system function)

POSSIBLE RESOLUTION Correct the logic model.

PLANT RESPONSE OR RESOLUTION Fault trees RP1 for Surry were revised to include separate logic for RTA and RTB including the input logic signal with recovery. The models also include failure of the trip breaker (RTA/RTB), and RTA/RTB recovery thorough the shunt trip relay (including failure of 125 VDC, human reliability model, and failure of the shunt trip relay). The models are discussed fully in SM-1 151, implemented in the SOA-D PRA models for Surry.

This F&O is CLOSED.

Page 21 of 23

WOG PEER REVIEW FACT/OBSERVATION REGARDING PRA TECHNICAL ELEMENTS' OBSERVATION (ID: SY-11) / Element SY / Subelement SY-5 Review of HHSI: SM-1 162, SPPR 97-018, S2.07.1 (page 7 of 27).

System notebook update states 1A and 10C charging pumps are dependent on CCW (for recirculation). What about Unit 2? 1B is not dependent on CCW due to a design change. What about Unit 2? How are unit to unit differences identified and modeled?

Dependency table from IPE model wasn't updated in SM-1 162 or SM-1 165 to account for CCW dependency. Also, success criteria section of system notebook was not updated.

LEVEL OF SIGNIFICANCE B (The PSA models must adequately reflect recent plant configuration; unit-to-unit differences must be accounted for.)

POSSIBLE RESOLUTION Set up Unit 2 model, or address impact on CDF.

PLANT RESPONSE OR RESOLUTION Surry charging pumps have seal coolers with a CC cooling dependency that currently has a difference between Units 1 and 2. For Surry Unit 1, the A & C pump seal coolers 1-CH-E-7A/B/E/F require CC cooling, but the B pump seal coolers 1-CH-E-7C/D are isolated (1 1448-FM-071 B Sh 2). For Surry Unit 2, all A/B/C pump seal coolers 2-CH-E-7A/B/C/D/E/F require CC cooling (11548-FM-071 B Sh 2). Potentially, all Surry charging pumps may be upgraded so that their CHP seal coolers can be isolated, but at this time, only the Surry Unit 1 B pump does not require CC cooling, which explains the difference between Surry Unit 1 and 2 charging pump CC cooling. Update as of S05A model: the dependency on CC has been added to the 1B pump as well, to account for the possibility that cooling might be needed if the pumps were used for high head recirculation with hot sump water.

This F&O is CLOSED.

Page 22 of 23

WOG PEER REVIEW -FACT/OB1SERVATION REGARDING PR~A TECHN~ICA L ELEMENTS OBSERVATION(ID: TH-2) / Element TH / Subelement8 Several HVAC systems are modeled in detail and are well documented. These include ESGR room cooling and the Auxiliary Building Ventilation System, but these are the only ventilation dependencies modeled in the PSA. Some of the systems models provide a one line assumption stating that room cooling is not required, but little if any basis is provided for these assumptions. Based on discussions with the PSA group engineers during this review, it appears that the HVAC requirements were adequately addressed in the modeling process, but the assumptions were not clearly documented, and no process is defined for the determination of the need for room cooling.

LEVEL OF SIGNIFICANCE B (It is important to demonstrate that all HVAC dependencies have been examined, and that assumptions made in the analyses to determine the need for ventilation or cooling are documented.)

POSSIBLE RESOLUTION Develop more detailed documentation for modeling assumptions regarding HVAC requirements.

Provide basis for excluding HVAC dependencies where HVAC is not modeled explicitly. It may be appropriate to include an overview of HVAC issues as part of a dependencies notebook.

PLANT RESPONSE OR RESOLUTION HVAC dependencies are addressed in the fault trees where needed, and discussions are provided in individual system notebooks (SY.3 series) and the dependency notebook (SY.1). An integrated HVAC dependency document has not been prepared. Regarding specific dependencies:

The charging pumps and the emergency switchgear room already have ventilation dependencies included in the PRA model. The other major components with potential HVAC dependencies were evaluated and found to have a negligible ventilation dependency. Those SSCs are as follows:

• Low Head Safety Injection pumps - The LHSI pumps take suction from the cold RWST early during a LOCA. After Recirculation Mode Transfer, the sump water will be cooled by the RSHXs, so that LHSI ventilation is not necessary.

• Outside Recirculation Spray pumps - The CS subsystem provides approximately 300 gpm 45 0F water from RWST to each ORSP. There is no ceiling in the ORSP rooms. It is not a closed room. Hence, the room ventilation is not necessary.

• Emergency Diesel Generators - The EDGs have self-contained cooling systems.

" Alternate AC Generator - The AAC DG has a self-contained cooling system.

" Auxiliary Feedwater pumps - These pumps take suction from the ECST or a backup system that is at ambient temperature. They are therefore self-cooling and require no HVAC.

" Station batteries - The heat load in this room is the batteries themselves and the heat load from the batteries may be ignored.

• Turbine building SSCs - The potentially important SSCs in the TB are the MFW and the CN pumps, in case they are needed as a backup to the AFW system. On a reactor trip, the FW heaters no longer function as heaters and both CN and MFW flows are at relatively cold condenser temperatures. The Turbine Building SSCs are therefore self-cooling.

This F&O is CLOSED.

Page 23 of 23