Text

Attachment 1, Volume 8, San Onofre Nuclear Generating Station - Improved Technical Specifications Conversion - ITS Section 3.5, Emergency Core Cooling Systems (ECCS)
	ML11251A101
Person / Time
Site:	San Onofre
Issue date:	07/29/2011
From:	; Edison International Co, Southern California Edison Co
To:	; Office of Nuclear Reactor Regulation
References
	NUREG-1432, Rev. 3.0
	Download: ML11251A101 (139)
	v • d • e

Attachment 1, Volume 8, Rev. 0, Page 1 of 139 ATTACHMENT 1 VOLUME 8 SAN ONOFRE NUCLEAR GENERATING STATION IMPROVED TECHNICAL SPECIFICATIONS CONVERSION ITS SECTION 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

Attachment 1, Volume 8, Rev. 0, Page 1 of 139

Attachment 1, Volume 8, Rev. 0, Page 2 of 139 LIST OF ATTACHMENTS

1. ITS 3.5.1 - Safety Injection Tanks (SITs)

2. ITS 3.5.2 - Emergency Core Cooling System (ECCS) - Operating

3. ITS 3.5.3 - Emergency Core Cooling System (ECCS) - Shutdown

4. ITS 3.5.4 - Refueling Water Storage Tank (RWST)

5. ITS 3.5.5 - Trisodium Phosphate (TSP)

Attachment 1, Volume 8, Rev. 0, Page 2 of 139

, Volume 8, Rev. 0, Page 3 of 139 ATTACHMENT 1 ITS 3.5.1, SAFETY INJECTION TANKS (SITs) , Volume 8, Rev. 0, Page 3 of 139

Attachment 1, Volume 8, Rev. 0, Page 4 of 139 Current Technical Specification (CTS) Markup and Discussion of Changes (DOCs)

Attachment 1, Volume 8, Rev. 0, Page 4 of 139

Attachment 1, Volume 8, Rev. 0, Page 5 of 139 ITS SITs 3.5.1 A01 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 3.5.1 Safety Injection Tanks (SITs)

LCO 3.5.1 LCO 3.5.1 Four SITs shall be OPERABLE.

Applicability APPLICABILITY: MODES 1 and 2, MODE 3 with pressurizer pressure $ 715 psia.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME ACTION A A. One SIT inoperable due A.1 Restore boron 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to boron concentration concentration to not within limits. within limits.

OR ACTION A B. One SIT inoperable due B.1 Restore SIT to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to inability to verify A OPERABLE status.

level or pressure.

ACTION B C. One SIT inoperable for C.1 Restore SIT to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months reasons other than OPERABLE status. A02 B

Condition A or B.

B ACTION C D. Required Action and D.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion C Time of Condition A, AND B, or C not met.

C B D.2 Reduce pressurizer 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months C pressure to

< 715 psia.

ACTION D E. Two or more SITs E.1 Enter LCO 3.0.3. Immediately D inoperable. D SAN ONOFRE--UNIT 2 3.5-1 Amendment No. 139 Attachment 1, Volume 8, Rev. 0, Page 5 of 139

Attachment 1, Volume 8, Rev. 0, Page 6 of 139 ITS SITs 3.5.1 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.5.1.1 SR 3.5.1.1 Verify each SIT isolation valve is fully 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months LA01 open.

In accordance with the Surveillance Frequency Control Program SR 3.5.1.2 SR 3.5.1.2 Verify borated water volume in each SIT is 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months LA01

$ 1680 cubic feet and

1807 cubic feet. In accordance with the Surveillance Frequency Control Program SR 3.5.1.3 SR 3.5.1.3 Verify nitrogen cover pressure in each SIT 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is $ 615 psia and # 655 psia. In accordance with the LA01 Surveillance Frequency Control Program SR 3.5.1.4 SR 3.5.1.4 Verify boron concentration in each SIT is 31 days

$ 2200 ppm and # 2800 ppm. In accordance with the AND Surveillance Frequency LA01 Control Program

NOTE------

Only required to be performed for affected SIT Once within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months after each solution volume increase of $ 1% of tank volume that is not the result of addition from the refueling water storage tank (continued)

SAN ONOFRE--UNIT 2 3.5-2 Amendment No. 127,135 Attachment 1, Volume 8, Rev. 0, Page 6 of 139

Attachment 1, Volume 8, Rev. 0, Page 7 of 139 ITS SITs 3.5.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.5.1.5 SR 3.5.1.5 Verify power is removed from each SIT 31 days isolation valve operator when pressurizer LA01 pressure is $ 715 psia. In accordance with the Surveillance Frequency Control Program SAN ONOFRE--UNIT 2 3.5-3 Amendment No. 127 Attachment 1, Volume 8, Rev. 0, Page 7 of 139

Attachment 1, Volume 8, Rev. 0, Page 8 of 139 ITS SITs 3.5.1 A01 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 3.5.1 Safety Injection Tanks (SITs)

LCO 3.5.1 LCO 3.5.1 Four SITs shall be OPERABLE.

Applicability APPLICABILITY: MODES 1 and 2, MODE 3 with pressurizer pressure $ 715 psia.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME ACTION A A. One SIT inoperable due A.1 Restore boron 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to boron concentration concentration to not within limits. within limits.

OR ACTION A B. One SIT inoperable due B.1 Restore SIT to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to inability to verify A OPERABLE status.

level or pressure.

ACTION B C. One SIT inoperable for C.1 Restore SIT to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months A02 reasons other than OPERABLE status.

B Condition A or B.

B ACTION C D. Required Action and D.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion C Time of Condition A, AND B, or C not met.

C B D.2 Reduce pressurizer 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months C pressure to

< 715 psia.

ACTION D E. Two or more SITs E.1 Enter LCO 3.0.3. Immediately D inoperable. D SAN ONOFRE--UNIT 3 3.5-1 Amendment No. 131 Attachment 1, Volume 8, Rev. 0, Page 8 of 139

Attachment 1, Volume 8, Rev. 0, Page 9 of 139 ITS SITs 3.5.1 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.5.1.1 SR 3.5.1.1 Verify each SIT isolation valve is fully 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months LA01 open.

In accordance with the Surveillance Frequency Control Program SR 3.5.1.2 SR 3.5.1.2 Verify borated water volume in each SIT is 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months

$ 1680 cubic feet and LA01

1807 cubic feet. In accordance with the Surveillance Frequency Control Program SR 3.5.1.3 SR 3.5.1.3 Verify nitrogen cover pressure in each SIT 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is $ 615 psia and # 655 psia. In accordance with the LA01 Surveillance Frequency Control Program SR 3.5.1.4 SR 3.5.1.4 Verify boron concentration in each SIT is 31 days

$ 2200 ppm and # 2800 ppm. In accordance with the LA01 AND Surveillance Frequency Control Program

NOTE------

Only required to be performed for affected SIT Once within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months after each solution volume increase of $ 1% of tank volume that is not the result of addition from the refueling water storage tank (continued)

SAN ONOFRE--UNIT 3 3.5-2 Amendment No. 116,124 Attachment 1, Volume 8, Rev. 0, Page 9 of 139

Attachment 1, Volume 8, Rev. 0, Page 10 of 139 ITS SITs 3.5.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.5.1.5 SR 3.5.1.5 Verify power is removed from each SIT 31 days isolation valve operator when pressurizer LA01 pressure is $ 715 psia. In accordance with the Surveillance Frequency Control Program SAN ONOFRE--UNIT 3 3.5-3 Amendment No. 116 Attachment 1, Volume 8, Rev. 0, Page 10 of 139

Attachment 1, Volume 8, Rev. 0, Page 11 of 139 DISCUSSION OF CHANGES ITS 3.5.1, SAFETY INJECTION TANKS (SITs)

ADMINISTRATIVE CHANGES A01 In the conversion of the San Onofre Nuclear Generating Station (SONGS)

Current Technical Specifications (CTS) to the plant specific Improved Technical Specifications (ITS), certain changes (wording preferences, editorial changes, reformatting, revised numbering, etc.) are made to obtain consistency with NUREG-1432, Rev. 3.0, "Standard Technical Specifications Combustion Engineering Plants" (ISTS) and additional approved Technical Specification Task Force (TSTF) travelers included in this submittal.

These changes are designated as administrative changes and are acceptable because they do not result in technical changes to the CTS.

A02 CTS 3.5.1 ACTIONS A and B are for the conditions when one SIT is inoperable due to boron concentration not within limits and when one SIT is inoperable due to inability to verify level or pressure, respectively. ITS 3.5.1 ACTION A is for the conditions when one SIT is inoperable due to boron concentration not within limits or one SIT inoperable due to inability to verify level or pressure. ITS 3.5.1 ACTION A contains both conditions in one ACTION. This changes the CTS by consolidating existing CTS ACTIONS A and B into one ACTION (ACTION A), by deleting Required Action A.1 and by renumbering the subsequent ACTIONS.

This proposed change reorganizes CTS ACTIONS A and B into one ACTION and renumbers the remaining ACTIONS without changing the technical requirements of any of the current ACTIONS. Both CTS ACTIONS have the same Required Action and Completion Time (i.e., both require the SIT to be restored within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ). Therefore, this change is acceptable since ITS 3.5.1 ACTION A covers the same conditions for the same inoperabilities and provides the same time for restoration. This change is considered administrative because it reorganizes the CTS ACTIONS without changing the intent or technical requirements.

MORE RESTRICTIVE CHANGES None RELOCATED SPECIFICATIONS None REMOVED DETAIL CHANGES LA01 (Type 4 - Removal of LCO, SR, or other TS requirement to the LCS, UFSAR, ODCM, QAP, CLRT Program, IST Program, ISI Program, or Surveillance Frequency Control Program) CTS SR 3.5.1.1 requires verification that each SIT isolation valve is fully open every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . CTS SR 3.5.1.2 requires verification of the borated water volume in each SIT every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . CTS SR 3.5.1.3 requires verification of the nitrogen cover pressure in each SIT every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

San Onofre Unit 2 and 3 Page 1 of 4 Attachment 1, Volume 8, Rev. 0, Page 11 of 139

Attachment 1, Volume 8, Rev. 0, Page 12 of 139 DISCUSSION OF CHANGES ITS 3.5.1, SAFETY INJECTION TANKS (SITs)

CTS SR 3.5.1.4 requires verification of the boron concentration in each SIT every 31 days. CTS 3.5.1.5 requires verification that power is removed from each SIT isolation valve operator every 31 days. ITS SR 3.5.1.1, ITS SR 3.5.1.2, ITS SR 3.5.1.3, ITS SR 3.5.1.4, and ITS SR 3.5.1.5 require similar Surveillances, respectively, but specify the periodic Frequency as "In accordance with the Surveillance Frequency Control Program." This changes the CTS by moving the specified frequencies for the SRs and the Bases for the frequencies to the Surveillance Frequency Control Program.

The control of changes to the Surveillance Frequencies will be in accordance with the Surveillance Frequency Control Program. The Program shall ensure that Surveillance Requirements specified in the Technical Specifications are performed at intervals sufficient to assure the associated Limiting Conditions for Operation are met. In addition:

a. The Surveillance Frequency Control Program shall contain a list of Frequencies of those Surveillance Requirements for which the Frequency is controlled by the program;

b. Changes to the Frequencies listed in the Surveillance Frequency Control Program shall be made in accordance with NEI 04-10, "Risk-Informed Method for Control of Surveillance Frequencies," Revision 1; and

c. The provisions of Surveillance Requirements 3.0.2 and 3.0.3 are applicable to the Frequencies established in the Surveillance Frequency Control Program.

The referenced document, NEI-04-10, Rev. 1, provides a detailed description of the process to be followed when considering changes to a Surveillance Frequency. NEI-04-10, Rev. 1 has been reviewed and approved by the NRC.

Therefore, the process will not be discussed further here.

The relocation of the specified Surveillance Frequencies to licensee control is consistent with Regulatory Guides 1.174 and 1.177. Regulatory Guide 1.177 provides guidance for changing Surveillance Frequencies and Completion Times.

However, for allowable risk changes associated with Surveillance Frequency extensions, it refers to Regulatory Guide 1.174, which provides quantitative risk acceptance guidelines for changes to core damage frequency (CDF) and large early release frequency (LERF). Regulatory Guide 1.174 provides additional guidelines that have been adapted in the risk-informed methodology for controlling changes to Surveillance Frequencies.

Regulatory Guide 1.174 identifies five key safety principles to be met for all risk-informed applications and to be explicitly addressed in risk-informed plant program change applications.

1. The proposed change meets the current regulations unless it is explicitly related to a requested exemption or rule change.

10 CFR 50.36(c) provides that TS will include items in the following categories:

San Onofre Unit 2 and 3 Page 2 of 4 Attachment 1, Volume 8, Rev. 0, Page 12 of 139

Attachment 1, Volume 8, Rev. 0, Page 13 of 139 DISCUSSION OF CHANGES ITS 3.5.1, SAFETY INJECTION TANKS (SITs)

"(3) Surveillance requirements. Surveillance requirements are requirements relating to test, calibration, or inspection to assure that the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the limiting conditions for operation will be met."

This change proposes to relocate various Frequencies for the performance of the Surveillance Requirements to a licensee-controlled program using an NRC approved methodology for control of the Surveillance Frequencies. The Surveillance Requirements themselves will remain in TS. This is consistent with other NRC approved TS changes in which the Surveillance Frequencies are not under NRC control, such as Surveillances that are performed in accordance with the Inservice Testing Program or the Containment Leakage Rate Testing Program, where the Frequencies vary based on the past performance of the subject components. Thus, this proposed change meets criterion 1 above.

2. The proposed change is consistent with the defense-in-depth philosophy.

As described in Position 2.2.1.1 of Regulatory Guide 1.174, consistency with the defense-in-depth philosophy is maintained if:

A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and consequence mitigation; Over-reliance on programmatic activities to compensate for weaknesses in plant design is avoided; System redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties (e.g., no risk outliers);

Defenses against potential common cause failures are preserved, and the potential for the introduction of new common cause failure mechanisms is assessed; Independence of barriers is not degraded; Defenses against human errors are preserved; and The intent of the General Design Criteria in 10 CFR Part 50, Appendix A is maintained.

These defense-in-depth objectives apply to all risk-informed applications, and for some of the issues involved (e.g., no over-reliance on programmatic activities and defense against human errors), it is fairly straightforward to apply them to this proposed change. The use of the multiple risk metrics of CDF and LERF and controlling the change resulting from the implementation San Onofre Unit 2 and 3 Page 3 of 4 Attachment 1, Volume 8, Rev. 0, Page 13 of 139

Attachment 1, Volume 8, Rev. 0, Page 14 of 139 DISCUSSION OF CHANGES ITS 3.5.1, SAFETY INJECTION TANKS (SITs) of this initiative would maintain a balance between prevention of core damage, prevention of containment failure, and consequence mitigation.

Redundancy, diversity, and independence of safety systems are considered as part of the risk categorization to ensure that these qualities are not adversely affected. Independence of barriers and defense against common cause failures are also considered in the categorization. The improved understanding of the relative importance of plant components to risk resulting from the development of this program promotes an improved overall understanding of how the SSCs contribute to the plant's defense-in-depth.

3. The proposed change maintains sufficient safety margins.

Conformance with this principle is assured since SSC design, operation, testing methods and acceptance criteria specified in the Codes and Standards or alternatives approved for use by the NRC, will continue to be met as described in the plant licensing basis (e.g., UFSAR, or Technical Specifications Bases). Also, the safety analysis acceptance criteria in the licensing basis (e.g., UFSAR, supporting analyses, etc.) are met with the proposed change.

4. When proposed changes result in an increase in core damage frequency or risk, the increases should be small and consistent with the intent of the Commission's Safety Goal Policy Statement.

NEI 04-10, "Risk-Informed Method for Control of Surveillance Frequencies,"

will require that changes in core damage frequency or risk are small and consistent with the intent of the Commission's Safety Goal Policy.

5. The impact of the proposed change should be monitored using performance measurement strategies.

NEI 04-10 will require that changes in Surveillance Frequencies be monitored using performance management strategies.

Therefore, the proposed change is consistent with the guidance in Regulatory Guide 1.174.

This change is designated as a less restrictive removal of detail change because a Surveillance Frequency is being removed from the Technical Specifications.

LESS RESTRICTIVE CHANGES None San Onofre Unit 2 and 3 Page 4 of 4 Attachment 1, Volume 8, Rev. 0, Page 14 of 139

Attachment 1, Volume 8, Rev. 0, Page 15 of 139 Improved Standard Technical Specifications (ISTS) Markup and Justification for Deviations (JFDs)

Attachment 1, Volume 8, Rev. 0, Page 15 of 139

Attachment 1, Volume 8, Rev. 0, Page 16 of 139 U2/U3 CTS SITs 3.5.1 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 3.5.1 Safety Injection Tanks (SITs)

LCO 3.5.1 LCO 3.5.1 [Four] SITs shall be OPERABLE. 2 Applicability APPLICABILITY: MODES 1 and 2, MODE 3 with pressurizer pressure [700] psia. 2 715 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME ACTION A, A. One SIT inoperable due A.1 Restore SIT to OPERABLE 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ACTION B to boron concentration status.

not within limits.

OR One SIT inoperable due to the inability to verify level or pressure.

ACTION C B. One SIT inoperable for B.1 Restore SIT to OPERABLE 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months reasons other than status.

Condition A.

ACTION D C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition A or B AND 12 not met. 3 C.2 Reduce pressurizer 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months pressure to < [700] psia. 2 715 ACTION E D. Two or more SITs D.1 Enter LCO 3.0.3. Immediately inoperable.

1 CEOG STS 3.5.1-1 Rev. 3.0, 03/31/04 San Onofre -- Draft Amendment XXX Attachment 1, Volume 8, Rev. 0, Page 16 of 139

Attachment 1, Volume 8, Rev. 0, Page 17 of 139 U2/U3 CTS SITs 3.5.1 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY TSTF-SR 3.5.1.1 SR 3.5.1.1 Verify each SIT isolation valve is fully open. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 425-A TSTF-SR 3.5.1.2 SR 3.5.1.2 1680 Verify borated water volume in each SIT is 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 425-A

[28% narrow range (1802 cubic feet) and 2 72% narrow range (1914 cubic feet)].

1807 TSTF-SR 3.5.1.3 SR 3.5.1.3 Verify nitrogen cover pressure in each SIT is 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 425-A

[615] psig and [655] psig. 2 psia TSTF-SR 3.5.1.4 SR 3.5.1.4 Verify boron concentration in each SIT is 31 days 425-A

[1500] ppm and [2800] ppm. 2 2200 AND

NOTE--------

Only required to be performed for affected SIT Once within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months after each solution volume increase of [1]% 2 of tank volume that is not the result of addition from the refueling water tank 1 storage TSTF-SR 3.5.1.5 SR 3.5.1.5 Verify power is removed from each SIT isolation 31 days 425-A valve operator when pressurizer pressure is

[2000] psia. 2 715 In accordance with the Surveillance Frequency Control Program 1

CEOG STS 3.5.1-2 Rev. 3.0, 03/31/04 San Onofre -- Draft Amendment XXX Attachment 1, Volume 8, Rev. 0, Page 17 of 139

Attachment 1, Volume 8, Rev. 0, Page 18 of 139 JUSTIFICATION FOR DEVIATIONS ITS 3.5.1, SAFETY INJECTION TANKS (SITs)

1. Changes are made (additions, deletions, and/or changes) to the ISTS which reflect the plant specific nomenclature, number, reference, system description, analysis, or licensing basis description.

2. The ISTS contains bracketed information and/or values that are generic to all Combustion Engineering vintage plants. The brackets are removed and the proper plant specific information/value is provided. This is acceptable since the information/value is revised to reflect the current licensing basis.

3. A typographical error in the Completion Time for ISTS 3.5.1 Required Action C.2 has been corrected. The Completion Time should be 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months (as described in the ISTS Bases), not 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months time is also consistent with the CTS Completion Time.

San Onofre Unit 2 and 3 Page 1 of 1 Attachment 1, Volume 8, Rev. 0, Page 18 of 139

Attachment 1, Volume 8, Rev. 0, Page 19 of 139 Improved Standard Technical Specifications (ISTS) Bases Markup and Bases Justification for Deviations (JFDs)

Attachment 1, Volume 8, Rev. 0, Page 19 of 139

Attachment 1, Volume 8, Rev. 0, Page 20 of 139 SITs B 3.5.1 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.1 Safety Injection Tanks (SITs)

BASES BACKGROUND The functions of the [four] SITs are to supply water to the reactor vessel 2 during the blowdown phase of a loss of coolant accident (LOCA), to provide inventory to help accomplish the refill phase that follows thereafter, and to provide Reactor Coolant System (RCS) makeup for a small break LOCA.

The blowdown phase of a large break LOCA is the initial period of the transient during which the RCS departs from equilibrium conditions, and heat from fission product decay, hot internals, and the vessel continues to be transferred to the reactor coolant. The blowdown phase of the transient ends when the RCS pressure falls to a value approaching that of the containment atmosphere.

The refill phase of a LOCA follows immediately where reactor coolant inventory has vacated the core through steam flashing and ejection out through the break. The core is essentially in adiabatic heatup. The balance of the SITs' inventory is then available to help fill voids in the lower plenum and reactor vessel downcomer to establish a recovery level at the bottom of the core and ongoing reflood of the core with the addition of safety injection (SI) water.

The SITs are pressure vessels partially filled with borated water and pressurized with nitrogen gas. The SITs are passive components, since no operator or control action is required for them to perform their function.

Internal tank pressure is sufficient to discharge the contents to the RCS, if RCS pressure decreases below the SIT pressure.

Each SIT is piped into one RCS cold leg via the injection lines utilized by the High Pressure Safety Injection and Low Pressure Safety Injection (HPSI and LPSI) systems. Each SIT is isolated from the RCS by a motor operated isolation valve and two check valves in series. The motor operated isolation valves are normally open, with power removed from the valve motor to prevent inadvertent closure prior to or during an accident.

The SIT gas and water volumes, gas pressure, and outlet pipe size are selected to allow three of the four SITs to partially recover the core before significant clad melting or zirconium water reaction can occur following a LOCA. The need to ensure that three SITs are adequate for this function is consistent with the LOCA assumption that the entire contents of one SIT will be lost via the break during the blowdown phase of a LOCA.

CEOG STS B 3.5.1-1 Rev. 3.0, 03/31/04 1 San Onofre -- Draft Revision XXX Attachment 1, Volume 8, Rev. 0, Page 20 of 139

Attachment 1, Volume 8, Rev. 0, Page 21 of 139 SITs B 3.5.1 BASES APPLICABLE The SITs are taken credit for in both the large and small break LOCA SAFETY analyses at full power (Ref. 1). These are the Design Basis Accidents ANALYSES (DBAs) that establish the acceptance limits for the SITs. Reference to the analyses for these DBAs is used to assess changes to the SITs as they relate to the acceptance limits.

In performing the LOCA calculations, conservative assumptions are made concerning the availability of SI flow. These assumptions include signal generation time, equipment starting times, and delivery time due to system piping. In the early stages of a LOCA with a loss of offsite power, the SITs provide the sole source of makeup water to the RCS. (The assumption of a loss of offsite power is required by regulations.) This is because the LPSI pumps, HPSI pumps, and charging pumps cannot deliver flow until the diesel generators (DGs) start, come to rated speed, and go through their timed loading sequence. In cold leg breaks, the entire contents of one SIT are assumed to be lost through the break during the blowdown and reflood phases.

The limiting large break LOCA is a double ended guillotine cold leg break at the discharge of the reactor coolant pump.

During this event, the SITs discharge to the RCS as soon as RCS pressure decreases to below SIT pressure. As a conservative estimate, no credit is taken for SI pump flow until the SITs are empty. This results in a minimum effective delay of over 60 seconds, during which the SITs must provide the core cooling function. The actual delay time does not exceed 30 seconds. No operator action is assumed during the blowdown stage of a large break LOCA.

The worst case small break LOCA also assumes a time delay before pumped flow reaches the core. For the larger range of small breaks, the rate of blowdown is such that the increase in fuel clad temperature is terminated solely by the SITs, with pumped flow then providing continued cooling. As break size decreases, the SITs and HPSI pumps both play a part in terminating the rise in clad temperature. As break size continues to decrease, the role of the SITs continues to decrease until they are not required, and the HPSI pumps become solely responsible for terminating the temperature increase.

This LCO helps to ensure that the following acceptance criteria, established by 10 CFR 50.46 (Ref. 2) for the ECCS, will be met following a LOCA:

CEOG STS B 3.5.1-2 Rev. 3.0, 03/31/04 1 San Onofre -- Draft Revision XXX Attachment 1, Volume 8, Rev. 0, Page 21 of 139

Attachment 1, Volume 8, Rev. 0, Page 22 of 139 SITs B 3.5.1 BASES APPLICABLE SAFETY ANALYSES (continued)

a. Maximum fuel element cladding temperature is 2200°F,

b. Maximum cladding oxidation is 0.17 times the total cladding thickness before oxidation,

3

c. Maximum hydrogen generation from a zirconium water reaction is 0.01 times the hypothetical amount that would be generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react, and

d. The core is maintained in a coolable geometry.

Since the SITs discharge during the blowdown phase of a LOCA, they do not contribute to the long term cooling requirements of 10 CFR 50.46.

Since the SITs are passive components, single active failures are not applicable to their operation. The SIT isolation valves, however, are not single failure proof; therefore, whenever the valves are open, power is removed from their operators and the switch is key locked open.

These precautions ensure that the SITs are available during an accident (Ref. 3). With power supplied to the valves, a single active failure could result in a valve closure, which would render one SIT unavailable for one injection. If a second SIT is lost through the break, only two SITs would reach the core. Since the only active failure that could affect the SITs 1 Furthermore, with power would be the closure of a motor operated outlet valve, the requirement to supplied to the SIT vent valves, a single active failure remove power from these eliminates this failure mode. 1 could result in a valve opening, which would also The minimum volume requirement for the SITs ensures that three SITs render one SIT unavailable for can provide adequate inventory to reflood the core and downcomer injection. Therefore, the SIT following a LOCA. The downcomer then remains flooded until the HPSI vent valves also have power removed to eliminate this and LPSI systems start to deliver flow.

failure mode.

The maximum volume limit is based on maintaining an adequate gas volume to ensure proper injection and the ability of the SITs to fully discharge, as well as limiting the maximum amount of boron inventory in the SITs.

1 CEOG STS B 3.5.1-3 Rev. 3.0, 03/31/04 San Onofre -- Draft Revision XXX Attachment 1, Volume 8, Rev. 0, Page 22 of 139

Attachment 1, Volume 8, Rev. 0, Page 23 of 139 SITs B 3.5.1 BASES APPLICABLE SAFETY ANALYSES (continued) 1680 2

A minimum of 25% narrow range level, corresponding to [1790] cubic feet 1807 of borated water, and a maximum of 75% narrow range level, 3 corresponding to [1927] cubic feet of borated water, are used in the safety 2 analyses as the volume in the SITs. To allow for instrument inaccuracy, a

[28]% narrow range (corresponding to [1802] cubic feet) and a [72]% 4 narrow range (corresponding to [1914] cubic feet) are specified. The analyses are based upon the cubic feet requirements; the percentage figures are provided for operator use because the level indicator provided in the control room is marked in percentages, not in cubic feet.

The minimum nitrogen cover pressure requirement ensures that the contained gas volume will generate discharge flow rates during injection that are consistent with those assumed in the safety analyses.

The maximum nitrogen cover pressure limit ensures that excessive amounts of gas will not be injected into the RCS after the SITs have emptied.

655 psia 615 psia A minimum pressure of [593] psig and a maximum pressure of [632] psig 2 are used in the analyses. To allow for instrument accuracy, a [615] psig 4 minimum and [655] psig maximum are specified. The maximum allowable boron concentration of [2800] ppm is based upon boron 2 precipitation limits in the core following a LOCA. Establishing a maximum limit for boron is necessary since the time at which boron precipitation would occur in the core following a LOCA is a function of break location, break size, the amount of boron injected into the core, and the point of ECCS injection. Post LOCA emergency procedures directing the operator to establish simultaneous hot and cold leg injection are based on the worst case minimum boron precipitation time. Maintaining the maximum SIT boron concentration within the upper limit ensures that the SITs do not invalidate this calculation. An excessive boron concentration in any of the borated water sources used for injection during a LOCA could result in boron precipitation earlier than predicted.

2200 2 The minimum boron requirements of [1500] ppm are based on beginning of life reactivity values and are selected to ensure that the reactor will remain subcritical during the reflood stage of a large break LOCA. During a large break LOCA, all control element assemblies (CEAs) are assumed not to insert into the core, and the initial reactor shutdown is 1

CEOG STS B 3.5.1-4 Rev. 3.0, 03/31/04 San Onofre -- Draft Revision XXX Attachment 1, Volume 8, Rev. 0, Page 23 of 139

Attachment 1, Volume 8, Rev. 0, Page 24 of 139 SITs B 3.5.1 BASES APPLICABLE SAFETY ANALYSES (continued) accomplished by void formation during blowdown. Sufficient boron concentration must be maintained in the SITs to prevent a return to criticality during reflood. Although this requirement is similar to the basis storage for the minimum boron concentration of the refueling water tank (RWT), S 1

the minimum SIT concentration is lower than that of the RWT since the SITs need not account for dilution by the RCS. S The SITs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO The LCO establishes the minimum conditions required to ensure that the SITs are available to accomplish their core cooling safety function following a LOCA. [Four] SITs are required to be OPERABLE to ensure 2 that 100% of the contents of [three] of the SITs will reach the core during a LOCA.

This is consistent with the assumption that the contents of one tank spill through the break. If the contents of fewer than three tanks are injected during the blowdown phase of a LOCA, the ECCS acceptance criteria of 10 CFR 50.46 (Ref. 2) could be violated.

at pressures 715 psia For an SIT to be considered OPERABLE, the isolation valve must be fully 2

open, power removed above [2000] psig, and the limits established in the 1 SR for contained volume, boron concentration, and nitrogen cover pressure must be met.

715 APPLICABILITY In MODES 1 and 2, and MODE 3 with RCS pressure 700 psia, the SIT OPERABILITY requirements are based on an assumption of full power operation. Although cooling requirements decrease as power decreases, the SITs are still required to provide core cooling as long as elevated RCS pressures and temperatures exist.

715 715 7

This LCO is only applicable at pressures 700 psia. Below 700 psia, the rate of RCS blowdown is such that the ECCS pumps can provide adequate injection to ensure that peak clad temperature remains below the 10 CFR 50.46 (Ref. 2) limit of 2200°F.

715 In MODE 3, at pressures < 700 psia, and in MODES 4, 5, and 6, the SIT motor operated isolation valves are closed to isolate the SITs from the RCS. This allows RCS cooldown and depressurization without discharging the SITs into the RCS or requiring depressurization of the SITs.

1 CEOG STS B 3.5.1-5 Rev. 3.0, 03/31/04 San Onofre -- Draft Revision XXX Attachment 1, Volume 8, Rev. 0, Page 24 of 139

Attachment 1, Volume 8, Rev. 0, Page 25 of 139 SITs B 3.5.1 BASES ACTIONS A.1 If the boron concentration of one SIT is not within limits, it must be returned to within the limits within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this condition, ability to maintain subcriticality or minimum boron precipitation time may be reduced, but the reduced concentration effects on core subcriticality during reflood are minor. Boiling of the ECCS water in the core during reflood concentrates the boron in the saturated liquid that remains in the core. In addition, the volume of the SIT is still available for injection.

Since the boron requirements are based on the average boron concentration of the total volume of three SITs, the consequences are less severe than they would be if an SIT were not available for injection.

Thus, 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is allowed to return the boron concentration to within limits.

The combination of redundant level and pressure instrumentation for any single SIT provides sufficient information so that it is not worthwhile to always attempt to correct drift associated with one instrument, with the resulting radiation exposures during entry into containment, as there is sufficient time to repair one in the event that a second one became inoperable. Because these instruments do not initiate a safety action, it is reasonable to extend the allowable outage time for them. While technically inoperable, the SIT will be available to fulfill its safety function during this time and, thus, this Completion Time results in a negligible increase in risk.

B.1 If one SIT is inoperable, for reasons other than boron concentration or the inability to verify level or pressure, the SIT must be returned to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . In this Condition, the required contents of three SITs cannot be assumed to reach the core during a 1

LOCA as is assumed in Appendix K (Ref. 5).

5 4 CE NPSD-994 (Ref. 6) provides a series of deterministic and probabilistic 1 findings that support the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time as having no affect on risk as compared to shorter periods for restoring the SIT to OPERABLE status.

1 CEOG STS B 3.5.1-6 Rev. 3.0, 03/31/04 San Onofre -- Draft Revision XXX Attachment 1, Volume 8, Rev. 0, Page 25 of 139

Attachment 1, Volume 8, Rev. 0, Page 26 of 139 SITs B 3.5.1 BASES ACTIONS (continued)

C.1 and C.2 If the SIT cannot be restored to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at 715 least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and pressurizer pressure reduced to

< 700 psia within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are 7 reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

D.1 If more than one SIT is inoperable, the unit is in a condition outside the accident analyses. Therefore, LCO 3.0.3 must be entered immediately.

SURVEILLANCE SR 3.5.1.1 REQUIREMENTS TSTF-Verification every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months that each SIT isolation valve is fully open, as 425-A indicated in the control room, ensures that SITs are available for injection and ensures timely discovery if a valve should be partially closed. If an isolation valve is not fully open, the rate of injection to the RCS would be reduced. Although a motor operated valve should not change position with power removed, a closed valve could result in not meeting accident analysis assumptions. A 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is considered reasonable in view of other administrative controls that ensure the unlikelihood of a TSTF-mispositioned isolation valve. INSERT 1 425-A SR 3.5.1.2 and SR 3.5.1.3 SIT borated water volume and nitrogen cover pressure should be verified to be within specified limits every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months in order to ensure adequate TSTF-425-A injection during a LOCA. Due to the static design of the SITs, a 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency usually allows the operator sufficient time to identify changes before the limits are reached. Operating experience has shown this Frequency to be appropriate for early detection and correction of off TSTF-425-A normal trends. INSERT 1 1

CEOG STS B 3.5.1-7 Rev. 3.0, 03/31/04 San Onofre -- Draft Revision XXX Attachment 1, Volume 8, Rev. 0, Page 26 of 139

Attachment 1, Volume 8, Rev. 0, Page 27 of 139 B 3.5.1 TSTF-425-A INSERT 1 The Frequency is controlled under the Surveillance Frequency Control Program. 8

Reviewers Note ---------------------------------------------------

Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program 6

should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.

Insert Page B 3.5.1-7 Attachment 1, Volume 8, Rev. 0, Page 27 of 139

Attachment 1, Volume 8, Rev. 0, Page 28 of 139 SITs B 3.5.1 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.5.1.4 Thirty-one days is reasonable for verification to determine that each SIT's 1 5 ensures that boron concentration is within the required limits, because the static design of the SITs limits the ways in which the concentration can be changed.

The 31 day Frequency is adequate to identify changes that could occur from mechanisms such as stratification or inleakage. Sampling the affected SIT within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months after a 1% volume increase will identify whether inleakage has caused a reduction in boron concentration to TSTF-425-A below the required limit. It is not necessary to verify boron concentration if the added water is from the RWT, because the water contained in the RWT is within the SIT boron concentration requirements. This is consistent with the recommendations of NUREG-1366 (Ref. 4).

INSERT 1 SR 3.5.1.5 TSTF-Verification every 31 days that power is removed from each SIT isolation 715 425-A valve operator when the pressurizer pressure is 2000 psia ensures that 7

an active failure could not result in the undetected closure of an SIT motor operated isolation valve. If this were to occur, only two SITs would be available for injection, given a single failure coincident with a LOCA.

Since installation and removal of power to the SIT isolation valve operators is conducted under administrative control, the 31 day Frequency was chosen to provide additional assurance that power is TSTF-425-A removed. INSERT 1 This SR allows power to be supplied to the motor operated isolation 715 7 valves when RCS pressure is < 2000 psia, thus allowing operational flexibility by avoiding unnecessary delays to manipulate the breakers during unit startups or shutdowns.

REFERENCES 1. FSAR, Section [6.3]. 2 U

2. 10 CFR 50.46.

3. FSAR, Chapter [15]. 2 U

1

4. Draft NUREG-1366, February 1990.

4 5. 10 CFR 50 Appendix K.

5 6. CE NPSD-994, "CEOG Joint Applications Report for Safety Injection Tank AOT/STI Extension," May 1995.

April 1

CEOG STS B 3.5.1-8 Rev. 3.0, 03/31/04 San Onofre -- Draft Revision XXX Attachment 1, Volume 8, Rev. 0, Page 28 of 139

Attachment 1, Volume 8, Rev. 0, Page 29 of 139 B 3.5.1 TSTF-425-A INSERT 1 The Frequency is controlled under the Surveillance Frequency Control Program. 8

Reviewers Note ---------------------------------------------------

Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program 6

should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.

Insert Page B 3.5.1-8 Attachment 1, Volume 8, Rev. 0, Page 29 of 139

Attachment 1, Volume 8, Rev. 0, Page 30 of 139 JUSTIFICATION FOR DEVIATIONS ITS 3.5.1 BASES, SAFETY INJECTION TANKS (SITs)

1. Changes are made (additions, deletions, and/or changes) to the Improved Standard Technical Specification (ISTS) Bases which reflect the plant specific nomenclature, number, reference, system description, analysis, or licensing basis description.

2. The ISTS Bases contains bracketed information and/or values that are generic to all Combustion Engineering vintage plants. The brackets are removed and the proper plant specific information/value is provided. This is acceptable since the information/value is revised to reflect the current licensing basis.

3. Changes are made to use correct punctuation, correct typographical errors or to make corrections consistent with the Writers Guide for the Improved Standard Technical Specifications, TSTF-GG-05-01.

4. Changes are made to the Bases to be consistent with the Specifications.

5. Reference to the Completion Time for the SR is being deleted consistent with TSTF-425. TSTF-425 relocates applicable Surveillance Frequencies to a Surveillance Frequency Control Program. This change was missed when the TSTF was marked up.

6. This "Reviewers Note" is being deleted. The Reviewers Note is for the NRC reviewer during the NRC review and will not be part of the plant specific SONGS ITS.

7. Changes are made to the Bases to be consistent with similar changes made to the actual Specification.

8. The Bases words changed by TSTF-425 have been modified to state "The Frequency is controlled under the Surveillance Frequency Control Program." The Surveillance Frequency Control Program provides the details for how to change the Frequencies, thus the TSTF-425 words concerning operating experience, equipment reliability, and plant risk is not always true for each of the Frequencies.

San Onofre Unit 2 and 3 Page 1 of 1 Attachment 1, Volume 8, Rev. 0, Page 30 of 139

Attachment 1, Volume 8, Rev. 0, Page 31 of 139 Specific No Significant Hazards Considerations (NSHCs)

Attachment 1, Volume 8, Rev. 0, Page 31 of 139

Attachment 1, Volume 8, Rev. 0, Page 32 of 139 DETERMINATION OF NO SIGNIFICANT HAZARDS CONSIDERATIONS ITS 3.5.1, SAFETY INJECTION TANKS (SITs)

There are no specific No Significant Hazards Considerations for this Specification.

San Onofre Unit 2 and 3 Page 1 of 1 Attachment 1, Volume 8, Rev. 0, Page 32 of 139

, Volume 8, Rev. 0, Page 33 of 139 ATTACHMENT 2 ITS 3.5.2, ECCS - OPERATING , Volume 8, Rev. 0, Page 33 of 139

, Volume 8, Rev. 0, Page 34 of 139 Current Technical Specification (CTS) Markup and Discussion of Changes (DOCs) , Volume 8, Rev. 0, Page 34 of 139

Attachment 1, Volume 8, Rev. 0, Page 35 of 139 ECCS Operating 3.5.2 ITS 3.5.2 ECCS Operating A01 LCO 3.5.2 LCO 3.5.2 Two ECCS trains shall be OPERABLE.

Applicability APPLICABILITY: MODES 1 and 2, MODE 3 with pressurizer pressure $ 400 psia.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME subsystem ACTION A A. One LPSI subtrain A.1 Restore subtrain to 7 days A04 inoperable. subsystem OPERABLE status.

ACTION B B. One or more ECCS B.1 Restore ECCS train(s) 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months trains inoperable due to OPERABLE status.

to reason(s) other than Condition A.

AND Less than A02 At least 100% of the ACTION D ECCS flow equivalent D.

to a single OPERABLE D.1 Enter LCO 3.0.3 Immediately ECCS train available.

ACTION C C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition A or AND A03 B not met.

C.2 Reduce pressurizer 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months pressure to

< 400 psia.

SAN ONOFRE--UNIT 2 3.5-4 Amendment No. 139 Attachment 1, Volume 8, Rev. 0, Page 35 of 139

Attachment 1, Volume 8, Rev. 0, Page 36 of 139 ECCS Operating 3.5.2 ITS A01 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.5.2.1 SR 3.5.2.1 Verify the following valves are in the 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months LA01 listed position with power to the valve

NOTE-------------------------- operators removed. In accordance with the Valves HV-8150, HV-8151, HV-8152, HV- Surveillance Frequency 8153, and HV-0396 may be open with power Valve Control Program to the valve operators not removed, provided Number Position Function L01 the associated flow path is isolated with a HV-9353 Closed SDC Warmup locked closed manual valve(s).

HV-9359 Closed SDC Warmup

HV-8150 Closed SDC HX Isolation HV-8151 Closed SDC HX Isolation HV-8152 Closed SDC HX Isolation HV-8153 Closed SDC HX Isolation HV-0396 Closed SDC Bypass Flow Control HV-8161 Open SDC HX Bypass Flow Isolation HV-9420 Closed Hot Leg Injection Isolation HV-9434 Closed Hot Leg Injection Isolation HV-8160 Open SDC Bypass Flow Control HV-8162 Open LPSI Miniflow Isolation HV-8163 Open LPSI Miniflow Isolation SR 3.5.2.2 Verify the following valves are in the 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months SR 3.5.2.2 listed position with power available to the Not used.

valve operators.

Valve Number Position Function L02 HV-9302 Closed CES Isolation HV-9303 Closed CES Isolation HV-9304 Closed CES Isolation HV-9305 Closed CES Isolation HV-9306 Open ECCS Train Miniflow HV-9307 Open ECCS Train Miniflow HV-9347 Open ECCS Train Miniflow HV-9348 Open ECCS Train Miniflow SR 3.5.2.3 SR 3.5.2.3 Verify each ECCS manual, power operated, 31 days LA01 and automatic valve in the flow path, that is not locked, sealed, or otherwise secured In accordance with the SR 3.5.2.3 Surveillance Frequency in position, is in the correct position.

Control Program (continued)

SAN ONOFRE--UNIT 2 3.5-5 Amendment No. 127 Attachment 1, Volume 8, Rev. 0, Page 36 of 139

Attachment 1, Volume 8, Rev. 0, Page 37 of 139 A01 ECCS Operating 3.5.2 ITS SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY LA01 SR 3.5.2.4 SR 3.5.2.4 Verify ECCS piping is full of water. 31 days In accordance with the Surveillance Frequency Control Program SR 3.5.2.5 SR 3.5.2.5 Verify each ECCS pump's developed head at In accordance the test flow point is greater than or with the equal to the required developed head. Inservice Testing Program In accordance with the SR 3.5.2.6 SR 3.5.2.6 Deleted Surveillance Frequency Control Program LA01 SR 3.5.2.7 SR 3.5.2.7 Verify each ECCS automatic valve in the 24 months that is not locked, flow path actuates to the correct position L03 sealed, or otherwise on an actual or simulated actuation signal.

secured in position, LA01 SR 3.5.2.8 SR 3.5.2.8 Verify each ECCS pump starts automatically 24 months on an actual or simulated actuation signal. In accordance with the Surveillance Frequency Control Program SR 3.5.2.9 SR 3.5.2.9 Verify each LPSI pump stops on an actual or 24 months LA01 simulated actuation signal.

(continued)

In accordance with the Surveillance Frequency Control Program SAN ONOFRE--UNIT 2 3.5-6 Amendment No. 190 Attachment 1, Volume 8, Rev. 0, Page 37 of 139

Attachment 1, Volume 8, Rev. 0, Page 38 of 139 A01 ECCS Operating 3.5.2 ITS SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY LA01 SR 3.5.2.10 SR 3.5.2.10 Verify, by visual inspection, each ECCS 24 months train containment sump suction inlet is not restricted by debris and the suction inlet In accordance with the trash racks and screens show no evidence of Surveillance Frequency structural distress or abnormal corrosion.

Control Program SAN ONOFRE--UNIT 2 3.5-7 Amendment No. 127 Attachment 1, Volume 8, Rev. 0, Page 38 of 139

Attachment 1, Volume 8, Rev. 0, Page 39 of 139 ITS ECCS Operating 3.5.2 3.5.2 ECCS Operating A01 LCO 3.5.2 LCO 3.5.2 Two ECCS trains shall be OPERABLE.

Applicability APPLICABILITY: MODES 1 and 2, MODE 3 with pressurizer pressure $ 400 psia.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME subsystem ACTION A A. One LPSI subtrain A.1 Restore subtrain to 7 days A04 inoperable. subsystem OPERABLE status.

ACTION B B. One or more ECCS B.1 Restore ECCS train(s) 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months trains inoperable due to OPERABLE status.

to reason(s) other than Condition A.

AND Less than A02 At least 100% of the ACTION D ECCS flow equivalent D.

to a single OPERABLE D.1 Enter LCO 3.0.3 Immediately ECCS train available.

ACTION C C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition A or AND A03 B not met.

C.2 Reduce pressurizer 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months pressure to

< 400 psia.

SAN ONOFRE--UNIT 3 3.5-4 Amendment No. 131 Attachment 1, Volume 8, Rev. 0, Page 39 of 139

Attachment 1, Volume 8, Rev. 0, Page 40 of 139 ECCS Operating 3.5.2 A01 ITS SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.5.2.1 SR 3.5.2.1 Verify the following valves are in the 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months LA01 listed position with power to the valve

NOTE-------------------------- operators removed. In accordance with the Valves HV-8150, HV-8151, HV-8152, HV- Surveillance Frequency 8153, and HV-0396 may be open with power Valve Control Program to the valve operators not removed, provided Number Position Function L01 the associated flow path is isolated with a HV-9353 Closed SDC Warmup locked closed manual valve(s).

HV-9359 Closed SDC Warmup

HV-8150 Closed SDC HX Isolation HV-8151 Closed SDC HX Isolation HV-8152 Closed SDC HX Isolation HV-8153 Closed SDC HX Isolation HV-0396 Closed SDC Bypass Flow Control HV-8161 Open SDC HX Bypass Flow Isolation HV-9420 Closed Hot Leg Injection Isolation HV-9434 Closed Hot Leg Injection Isolation HV-8160 Open SDC Bypass Flow Control HV-8162 Open LPSI Miniflow Isolation HV-8163 Open LPSI Miniflow Isolation SR 3.5.2.2 Verify the following valves are in the 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months SR 3.5.2.2 listed position with power available to the Not used.

valve operators.

Valve Number Position Function L02 HV-9302 Closed CES Isolation HV-9303 Closed CES Isolation HV-9304 Closed CES Isolation HV-9305 Closed CES Isolation HV-9306 Open ECCS Train Miniflow HV-9307 Open ECCS Train Miniflow HV-9347 Open ECCS Train Miniflow HV-9348 Open ECCS Train Miniflow SR 3.5.2.3 SR 3.5.2.3 Verify each ECCS manual, power operated, 31 days LA01 and automatic valve in the flow path, that is not locked, sealed, or otherwise secured In accordance with the SR 3.5.2.3 Surveillance Frequency in position, is in the correct position.

Control Program (continued)

SAN ONOFRE--UNIT 3 3.5-5 Amendment No. 116 Attachment 1, Volume 8, Rev. 0, Page 40 of 139

Attachment 1, Volume 8, Rev. 0, Page 41 of 139 A01 ECCS Operating 3.5.2 ITS SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY LA01 SR 3.5.2.4 SR 3.5.2.4 Verify ECCS piping is full of water. 31 days In accordance with the Surveillance Frequency Control Program SR 3.5.2.5 SR 3.5.2.5 Verify each ECCS pump's developed head at In accordance the test flow point is greater than or with the equal to the required developed head. Inservice Testing Program In accordance with the SR 3.5.2.6 SR 3.5.2.6 Deleted Surveillance Frequency Control Program LA01 SR 3.5.2.7 SR 3.5.2.7 Verify each ECCS automatic valve in the 24 months that is not locked, flow path actuates to the correct position L03 sealed, or otherwise on an actual or simulated actuation signal.

secured in position, LA01 SR 3.5.2.8 SR 3.5.2.8 Verify each ECCS pump starts automatically 24 months on an actual or simulated actuation signal. In accordance with the Surveillance Frequency Control Program SR 3.5.2.9 SR 3.5.2.9 Verify each LPSI pump stops on an actual or 24 months LA01 simulated actuation signal.

(continued)

In accordance with the Surveillance Frequency Control Program SAN ONOFRE--UNIT 3 3.5-6 Amendment No. 116,154,181 Attachment 1, Volume 8, Rev. 0, Page 41 of 139

Attachment 1, Volume 8, Rev. 0, Page 42 of 139 A01 ECCS Operating ITS 3.5.2 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY LA01 SR 3.5.2.10 SR 3.5.2.10 Verify, by visual inspection, each ECCS 24 months train containment sump suction inlet is not restricted by debris and the suction inlet In accordance with the trash racks and screens show no evidence of Surveillance Frequency structural distress or abnormal corrosion.

Control Program SAN ONOFRE--UNIT 3 3.5-7 Amendment No. 116 Attachment 1, Volume 8, Rev. 0, Page 42 of 139

Attachment 1, Volume 8, Rev. 0, Page 43 of 139 DISCUSSION OF CHANGES ITS 3.5.2, ECCS - OPERATING ADMINISTRATIVE CHANGES A01 In the conversion of the San Onofre Nuclear Generating Station (SONGS)

Current Technical Specifications (CTS) to the plant specific Improved Technical Specifications (ITS), certain changes (wording preferences, editorial changes, reformatting, revised numbering, etc.) are made to obtain consistency with NUREG-1432, Rev. 3.0, "Standard Technical Specifications Combustion Engineering Plants" (ISTS) and additional approved Technical Specification Task Force (TSTF) travelers included in this submittal.

These changes are designated as administrative changes and are acceptable because they do not result in technical changes to the CTS.

A02 CTS 3.5.2 ACTION B is for the condition when one or more ECCS trains are inoperable due to reason(s) other than when one LPSI subtrain is inoperable and at least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train available. ITS 3.5.2 ACTION B, consistent with TSTF-325, is for the condition when one or more trains are inoperable due to reasons other than when one LPSI subsystem is inoperable. ITS 3.5.2 also contains ACTION D which is for the condition when less than 100% of the flow equivalent to a single Operable train is available and requires entry into LCO 3.0.3 immediately. This changes the CTS by deleting the second condition of ACTION B for at least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train to be available and essentially replacing this condition with a new ACTION D for the condition when less than 100% of the ECCS flow equivalent to a single OPERABLE train is available with a Required Action to enter LCO 3.0.3 immediately.

This proposed change is to remove the "AND at least 100% ECCS flow equivalent to a single OPERABLE ECCS train available" from Condition B of CTS 3.5.2 and create a new ITS 3.5.2 Condition D which states, "Less than 100% ECCS flow equivalent to a single OPERABLE train available." ITS 3.5.2 Required Action D.1 will require the unit to enter LCO 3.0.3 immediately. CTS 3.5.2 Condition B deals with "One or more trains of ECCS inoperable AND at least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train available." This allows inoperabilities to be present in both trains, as long as 100% equivalent flow is available; for example, high pressure injection inoperable in Train A and low pressure injection inoperable in Train B. If a situation were to occur which resulted in less than 100% ECCS flow (such as both low pressure injection pumps inoperable), then LCO 3.0.3 would be entered, since there is no specified Condition in the CTS ACTIONS. However, for clarity and human factor considerations, a specific Condition (ITS 3.5.2 Condition D) has been added which covers the case of less than 100% ECCS flow. This change is considered acceptable and administrative because it does not result in any technical changes A03 CTS 3.5.2 ACTION C is for the condition when the Required Action and Associated Completion Time of Condition A or B not met. ITS 3.5.2 ACTION C is for the condition when Required Action and associated Completion Time not met.

This changes the CTS by deleting the specific reference to Condition A and B.

San Onofre Unit 2 and 3 Page 1 of 7 Attachment 1, Volume 8, Rev. 0, Page 43 of 139

Attachment 1, Volume 8, Rev. 0, Page 44 of 139 DISCUSSION OF CHANGES ITS 3.5.2, ECCS - OPERATING The proposed deletion of the wording in the CTS Condition C that specifies it is for the condition when the Required Action and associated Completion Time of Condition A or B not met is acceptable because it is not needed for the condition to apply to the above ACTIONS. Unless specifically specified, the condition when Required Actions and associated Completion Times are not met is applicable to all preceding Conditions. This change is considered administrative because it deletes wording that does not contribute to the clarification of the Condition.

A04 CTS 3.5.2 ACTION A states that with one LPSI "subtrain" inoperable, to restore the "subtrain" to OPERABLE status within 7 days. ISTS 3.5.2 ACTION A states that with one LPSI "subsystem" inoperable, to restore the "subsystem" to OPERABLE status within 7 days. This changes the CTS by changing the term "subtrain" to "subsystem."

The changing of the term "subtrain" to "subsystem" is acceptable because they mean the same thing. The CTS uses the term subsystem in the discussion of the LPSI in the LCO section of the Bases. Therefore the terms mean the same the thing. This change is considered administrative since it does not result in a technical change to the CTS.

MORE RESTRICTIVE CHANGES None RELOCATED SPECIFICATIONS None REMOVED DETAIL CHANGES LA01 (Type 4 - Removal of LCO, SR, or other TS requirement to the LCS, UFSAR, ODCM, QAP, CLRT Program, IST Program, ISI Program, or Surveillance Frequency Control Program) CTS SR 3.5.2.1 requires verification that specified valves in the ECCS system are in a specified position and have power to the valve operators removed every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . CTS SR 3.5.2.3 requires verification that each ECCS manual, power operated, and automatic valve in the flow path, that is not locked, sealed or otherwise secured in position, is in the correct position every 31 days. CTS SR 3.5.2.4 requires verification that ECCS piping is full of water every 31 days. CTS SR 3.5.2.7 requires verification that each automatic valve in the flow path actuates to the correct position on an actual or simulated actuation signal every 24 months. CTS SR 3.5.2.8 requires verification that each ECCS pump starts automatically on an actual or simulated actuation signal every 24 months. CTS SR 3.5.2.9 requires verification that each LPSI pump stops on an actual or simulated actuation signal every 24 months. CTS SR 3.5.2.10 requires verification, by visual inspection, that each ECCS train containment sump suction inlet is not restricted by debris and the suction inlet trash racks and screens show no evidence of structural distress or abnormal San Onofre Unit 2 and 3 Page 2 of 7 Attachment 1, Volume 8, Rev. 0, Page 44 of 139

Attachment 1, Volume 8, Rev. 0, Page 45 of 139 DISCUSSION OF CHANGES ITS 3.5.2, ECCS - OPERATING corrosion every 24 months. ITS SR 3.5.2.1, ITS SR 3.5.2.3, ITS SR 3.5.2.4, ITS SR 3.5.2.7, ITS SR 3.5.2.8, ITS SR 3.5.2.9 and ITS SR 3.5.2.10 require similar Surveillances, respectively, but specify the periodic Frequency as "In accordance with the Surveillance Frequency Control Program." This changes the CTS by moving the specified Frequencies for the SRs and the Bases for the frequencies to the Surveillance Frequency Control Program.

The control of changes to the Surveillance Frequencies will be in accordance with the Surveillance Frequency Control Program. The Program shall ensure that Surveillance Requirements specified in the Technical Specifications are performed at intervals sufficient to assure the associated Limiting Conditions for Operation are met. In addition:

a. The Surveillance Frequency Control Program shall contain a list of Frequencies of those Surveillance Requirements for which the Frequency is controlled by the program;

b. Changes to the Frequencies listed in the Surveillance Frequency Control Program shall be made in accordance with NEI 04-10, "Risk-Informed Method for Control of Surveillance Frequencies," Revision 1; and

c. The provisions of Surveillance Requirements 3.0.2 and 3.0.3 are applicable to the Frequencies established in the Surveillance Frequency Control Program.

The referenced document, NEI-04-10, Rev. 1, provides a detailed description of the process to be followed when considering changes to a Surveillance Frequency. NEI-04-10, Rev. 1 has been reviewed and approved by the NRC.

Therefore, the process will not be discussed further here.

The relocation of the specified Surveillance Frequencies to licensee control is consistent with Regulatory Guides 1.174 and 1.177. Regulatory Guide 1.177 provides guidance for changing Surveillance Frequencies and Completion Times.

However, for allowable risk changes associated with Surveillance Frequency extensions, it refers to Regulatory Guide 1.174, which provides quantitative risk acceptance guidelines for changes to core damage frequency (CDF) and large early release frequency (LERF). Regulatory Guide 1.174 provides additional guidelines that have been adapted in the risk-informed methodology for controlling changes to Surveillance Frequencies.

Regulatory Guide 1.174 identifies five key safety principles to be met for all risk-informed applications and to be explicitly addressed in risk-informed plant program change applications.

1. The proposed change meets the current regulations unless it is explicitly related to a requested exemption or rule change.

10 CFR 50.36(c) provides that TS will include items in the following categories:

San Onofre Unit 2 and 3 Page 3 of 7 Attachment 1, Volume 8, Rev. 0, Page 45 of 139

Attachment 1, Volume 8, Rev. 0, Page 46 of 139 DISCUSSION OF CHANGES ITS 3.5.2, ECCS - OPERATING

"(3) Surveillance requirements. Surveillance requirements are requirements relating to test, calibration, or inspection to assure that the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the limiting conditions for operation will be met."

This change proposes to relocate various Frequencies for the performance of the Surveillance Requirements to a licensee-controlled program using an NRC approved methodology for control of the Surveillance Frequencies. The Surveillance Requirements themselves will remain in TS. This is consistent with other NRC approved TS changes in which the Surveillance Frequencies are not under NRC control, such as Surveillances that are performed in accordance with the Inservice Testing Program or the Containment Leakage Rate Testing Program, where the Frequencies vary based on the past performance of the subject components. Thus, this proposed change meets criterion 1 above.

2. The proposed change is consistent with the defense-in-depth philosophy.

As described in Position 2.2.1.1 of Regulatory Guide 1.174, consistency with the defense-in-depth philosophy is maintained if:

A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and consequence mitigation; Over-reliance on programmatic activities to compensate for weaknesses in plant design is avoided; System redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties (e.g., no risk outliers);

Defenses against potential common cause failures are preserved, and the potential for the introduction of new common cause failure mechanisms is assessed; Independence of barriers is not degraded; Defenses against human errors are preserved; and The intent of the General Design Criteria in 10 CFR Part 50, Appendix A is maintained.

These defense-in-depth objectives apply to all risk-informed applications, and for some of the issues involved (e.g., no over-reliance on programmatic activities and defense against human errors), it is fairly straightforward to apply them to this proposed change. The use of the multiple risk metrics of CDF and LERF and controlling the change resulting from the implementation of this initiative would maintain a balance between prevention of core San Onofre Unit 2 and 3 Page 4 of 7 Attachment 1, Volume 8, Rev. 0, Page 46 of 139

Attachment 1, Volume 8, Rev. 0, Page 47 of 139 DISCUSSION OF CHANGES ITS 3.5.2, ECCS - OPERATING damage, prevention of containment failure, and consequence mitigation.