Text

Model SE of TSTF-432 for Nfc
	ML112991526
Person / Time
Site:	Technical Specifications Task Force
Issue date:	01/17/2012
From:	John Jolicoeur; NRC/NRR/DPR/PSPB
To:	;
References
	TSTF-432, Rev 1, WCAP-16294
	Download: ML112991526 (35)
	v • d • e

PROPOSED MODEL SAFETY EVALUATION FOR PLANT-SPECIFIC ADOPTION OF TECHNICAL SPECIFICATIONS TASK FORCE TRAVELER TSTF-432, REVISION 1, CHANGE IN TECHNICAL SPECIFICATIONS END STATES (WCAP-16294)

1.0 INTRODUCTION

By letter dated [DATE], [LICENSEE] (the licensee) proposed changes to the technical specifications (TSs) for [PLANT] to adopt U.S. Nuclear Regulatory Commission (NRC)-approved Revision 1 to Technical Specifications Task Force (TSTF) Standard Technical Specifications (STS) Change Traveler TSTF-432, Change in Technical Specifications End States (WCAP-16294) (Agencywide Documents Access and Management System (ADAMS)

Accession No. ML103360003, Reference 1) dated November 29, 2010.

The Traveler TSTF-432, Revision 1, incorporates the approved Nuclear Energy Institutes (NEI) topical report (TR) WCAP-16294-NP-A, Revision 1, Risk-Informed Evaluation of Changes to Technical Specification Required Action Endstates for Westinghouse NSSS [Nuclear Steam Supply System] PWRs [Pressurized Water Reactors] (WCAP-16294, Reference 2), into NUREG-1431, Standard Technical Specifications Westinghouse Plants, (the Westinghouse STS, Reference 3). The licensee stated that the license amendment request (LAR) is consistent with the Notice of Availability of TSTF-432, Revision 1, announced in the Federal Register on [DATE] ([ ] FR [ ]).

TSTF-432 is one of the industrys initiatives developed under the Risk Management Technical Specifications program. The purpose of risk-informed TS changes is to maintain or improve safety while reducing unnecessary burden and to make TS requirements consistent with the Commissions other risk-informed regulatory requirements.

The STS for Westinghouse plants define the following six operational modes. Of specific relevance to TSTF-432, Revision 1, are Modes 4 and 5:

Mode 1 - Power operation. Thermal power is greater than 5 percent of the rated thermal power.

Mode 2 - Startup. Thermal power is 5 percent of the rated thermal power.

Mode 3 - Hot standby. The average reactor coolant system (RCS) temperature is 350 °F.

Mode 4 - Hot shutdown. The average RCS temperature is greater than 200 °F and less than 350 °F. The reactor vessel head closure bolts are fully tensioned.

Mode 5 - Cold shutdown. The average RCS temperature is less than or equal to 200 °F.

The reactor vessel head closure bolts are fully tensioned.

Mode 6 - Refueling. The reactor in this mode is shut down and one or more reactor vessel head closure bolts are less than fully tensioned.

TR WCAP-16294 identifies and evaluates new TS required action end states for a number of TS limiting conditions for operation (LCOs), using a risk-informed approach, consistent with Regulatory Guide (RG) 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, and RG 1.177, An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications (References 4 and 5). An end state is a condition that the reactor must be placed in if the TS required action(s) cannot be met. The end states are currently defined based on placing the unit into a Mode or condition in which the TS LCO is not applicable. Mode 5 is the current endstate for LCOs that are applicable in Modes 1 through 4. The risk of the transition from Mode 1 to Modes 4 or 5 depends on the availability of alternating current (AC) sources. During the realignment from Mode 4 to Mode 5, there is an increased potential for loss of shutdown cooling and loss of inventory events. Decay heat removal following a loss-of-offsite power (LOOP) event in Mode 5 is dependent on AC power for shutdown cooling whereas, in Mode 4, the turbine driven auxiliary feedwater (AFW) pump will be available.

Therefore, transitioning to Mode 5 is not always the appropriate endstate from a risk perspective. Thus, for specific TS conditions, TR WCAP-16294 justifies Mode 4 as an acceptable alternate endstate to Mode 5. The proposed change to the TSs will allow time to perform short-duration repairs, which currently necessitate exiting the original mode of applicability. The Mode 4 TS end state is applied, and risk is assessed and managed in accordance with Title 10 of the Code of Federal Regulations (10 CFR) Section 50.65. Modified end states are limited to conditions where: (1) entry into the shutdown mode is for a short interval, (2) entry is initiated by inoperability of a single train of equipment or a restriction on a plant operational parameter, unless otherwise stated in the applicable TS, and (3) the primary purpose is to correct the initiating condition and return to power operation as soon as is practical.

1.1 Proposed Action As summarized in the following table, the requested TS changes would permit an end state of hot shutdown (Mode 4) rather than an end state of cold shutdown (Mode 5) for the following TS action requirements.

Proposed Changes To End States TS Condition Title 3.3.2-B 3.3.2-C Engineered Safety Feature Actuation System (ESFAS) Instrumentation 3.3.2-K Control Room Emergency Filtration System (CREFS) Actuation 3.3.7-C Instrumentation 3.3.8-D Fuel Building Air Cleanup System (FBACS) Actuation Instrumentation 3.4.13-B RCS Operational Leakage 3.4.14-B RCS Pressure Isolation Valve Leakage 3.4.15-E RCS Leakage Detection Instrumentation 3.5.3-C ECCS - Shutdown 3.5.4-C Refueling Water Storage Tank (RWST) 3.6.6A-B Containment Spray and Cooling Systems (Atmospheric and Dual) 3.6.6A-E

3.6.6B-F Containment Spray and Cooling Systems (Atmospheric and Dual) 3.6.6C-B Containment Spray System (Ice Condenser) 3.6.6D-B Quench Spray (QS) System (Subatmospheric) 3.6.6E-F Recirculation Spray (RS) System (Subatmospheric)

Spray Additive System (Atmospheric, Subatmospheric, Ice Condenser, and 3.6.7-B Dual) 3.6.11-B Iodine Cleanup System (ICS) (Atmospheric and Subatmospheric) 3.6.12-B Vacuum Relief Valves (Atmospheric and Ice Condenser) 3.6.13-B Shield Building Air Cleanup System (SBACS) (Dual and Ice Condenser) 3.6.14-B Air Return System (ARS) (Ice Condenser) 3.6.18-C Containment Recirculation Drains (Ice Condenser) 3.7.7-B Component Cooling Water (CCW) System 3.7.8-B Service Water System (SWS) 3.7.9-C Ultimate Heat Sink (UHS) 3.7.10-C Control Room Emergency Filtration System (CREFS) 3.7.11-B Control Room Emergency Air Temperature Control System (CREATCS)

Emergency Core Cooling System (ECCS) Pump Room Exhaust Air 3.7.12-C Cleanup System (PREACS) 3.7.13-C Fuel Building Air Cleanup System (FBACS) 3.7.14-C Penetration Room Exhaust Air Cleanup System (PREACS) 3.8.1-G AC Sources - Operating 3.8.4-D DC Sources - Operating 3.8.7-B Inverters - Operating 3.8.9-D Distribution Systems - Operating In addition to the items noted in the above table, the NRC staff also reviewed 6.4.22a, Recirculation Fluid pH Control System.

This LAR is limited to inoperability of a single train of equipment or a restriction on a plant operational parameter, unless otherwise stated in the applicable TS, and the primary purpose is to correct the inoperable component(s) and return to power operation as soon as is practical.

2.0 REGULATORY EVALUATION

The Commissions regulatory requirements related to the content of the TS are contained in 10 CFR 50.36, Technical specifications. Pursuant to 10 CFR 50.36(c) the TS are required to include items in the following specific categories: (1) safety limits, limiting safety systems settings, and limiting control settings; (2) LCOs; (3) surveillance requirements; (4) design features; and (5) administrative controls. The regulation at 10 CFR 50.36(c)(2) states: When

[an LCO] of a nuclear reactor is not met, the licensee shall shut down the reactor or follow any remedial action permitted by the technical specifications until the condition can be met.

The regulation at 10 CFR 50.46, Acceptance Criteria for Emergency Core Cooling Systems for Light-Water Nuclear Power Reactors, requires that the reactor must be provided with an ECCS that must be designed so that its calculated cooling performance following postulated loss-of-coolant accidents (LOCAs) conforms to the criteria set forth in 10 CFR 50.46(b).

Most of todays TS and the design basis analyses were developed under the perception that putting a plant in cold shutdown would result in the safest condition and the design basis analyses would bound credible shutdown accidents. In the late 1980s and early 1990s, the NRC and licensees recognized the potential significance of events occurring during shutdown conditions, and guidance was issued to improve shutdown operation. Since enactment of a shutdown rule was expected, almost all TS changes involving power operation, including a revised end state requirement, were postponed (for example see the Final Policy Statement on TS Improvements, Reference 3). However, in the mid-1990s, the Commission decided a shutdown rule was not necessary in light of industry improvements.

Controlling shutdown risk encompasses control of conditions that can cause potential initiating events and responses to those initiating events that do occur. Initiating events are a function of equipment malfunctions and human error. Responses to events are a function of plant sensitivity, ongoing activities, human error, defense-in-depth, and additional equipment malfunctions.

10 CFR 50.65(a)(4), Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, which requires that Before performing maintenance activities ... the licensee shall assess and manage the increase in risk that may result from the proposed maintenance activities. The scope of the assessment may be limited to structures, systems, and components that a risk-informed evaluation process has shown to be significant to public health and safety.

RG 1.182, Assessing and Managing Risk before Maintenance Activities at Nuclear Power Plants (Reference 6), provides guidance on implementing the provisions of 10 CFR 50.65(a)(4) by endorsing a revised Section 11 to NUMARC 93-01, "Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants" (Reference 7).

Appendix A, General Design Criteria [GDC] for Nuclear Power Plants, to 10 CFR Part 50 provides, in part, the necessary design, fabrication, construction, testing, and performance requirements for structures, systems, and components important to safety.

o Criterion 38, Containment Heat Removal, requires the establishment of a containment heat removal system that will rapidly reduce containment pressure and temperature following any LOCA. The containment heat removal system supports the containment function by minimizing the duration and intensity of the pressure and temperature increase following a LOCA thus lessening the challenge to containment integrity. Meeting Criterion 38 will help ensure that the containment can fulfill its role as the final barrier against the release of radioactivity to the environment.

o Criterion 41, Containment Atmosphere Cleanup, requires systems to control fission products, hydrogen, oxygen, and other substances which may be released into the reactor containment shall be provided as necessary to reduce, consistent with the functioning of other associated systems, the concentration and quality of fission products released to the environment following postulated accidents, and to control the concentration of hydrogen or oxygen and other substances in the containment atmosphere following postulated accidents to assure that containment integrity is maintained.

RG 1.174 (Reference 4) describes a risk-informed approach, acceptable to the NRC, for assessing the nature and impact of proposed permanent licensing-basis changes by

considering engineering issues and applying risk insights. RG 1.174 also provides risk acceptance guidelines for evaluating the results of such evaluations.

RG 1.177 (Reference 5) describes an acceptable risk-informed approach specifically for assessing proposed permanent allowed outage time and Surveillance Test Interval TS changes.

RG 1.177 also provides risk acceptance guidelines for evaluating the results of such assessments. RG 1.177 identifies a three-tiered approach for the licensees evaluation of the risk associated with a proposed completion time (CT) TS change. Per RG 1.177, the improved STS use the terminology completion times and surveillance frequency in place of allowed outage time and surveillance test interval.

General guidance for evaluating the technical basis for proposed risk-informed changes is provided in Section 19.2, Review of Risk Information Used to Support Permanent Plant-Specific Changes to the Licensing Basis: General Guidance, of the NRC Standard Review Plan (SRP), NUREG-0800 (Reference 8). Guidance on evaluating probabilistic risk assessment (PRA) technical adequacy related to risk-informed TS changes is provided in SRP Section 16.1, Risk-Informed Decision Making: Technical Specifications (Reference 9), which includes CT changes as part of risk-informed decision making.

3.0 TECHNICAL EVALUATION

The changes proposed in TSTF-432 are consistent with the changes proposed and justified in TR WCAP-16294, and approved by the NRC in a safety evaluation (SE) on March 29, 2010 (Reference 10). Specifically, end states are prescribed in the TS when Required Actions are not met or cannot be met. The current TS actions require placing the plant in cold shutdown (Mode 5) based on the expectation that this condition would result in the safest condition, since most DBAs and transients either cannot physically occur during shutdown, or would have significantly reduced plant impact and occur much less frequently due to the reduced temperatures and pressures in the plant. Accidents and transients unique to shutdown conditions were anticipated to be of less significance compared to the design bases events applicable to power operation.

The requested change to the TSs is to allow a Mode 4 end state rather than a Mode 5 end state for selected TS LCO actions. TR WCAP-16294 provides a comparative qualitative assessment of the availability of plant equipment for decay heat removal and accident mitigation in Modes 4 and 5, and considers the likelihood and consequences of initiating events which may occur in these modes. A quantitative risk assessment of operation in these modes, including the risk associated with the transition from Mode 4 to Mode 5 and then back to Mode 4 to support the return to service, is also provided using a shutdown and transition PRA model developed to support the review of TR WCAP-16294.

TR WCAP-16294 concludes that the availability of steam generator (SG) heat removal capability in Mode 4, and the avoidance of transitioning the plant to and from shutdown cooling, makes Mode 4 the preferred end state over Mode 5 for each of the proposed TS conditions being changed. This conclusion is further supported by quantitative risk analyses which demonstrate a reduction in plant risk by remaining in Mode 4 compared to the alternative of transitioning to and from Mode 5 in accordance with the existing TS requirements.

Both the qualitative and quantitative analyses of TR WCAP-16294 support a Mode 4 end state.

This conclusion is primarily due to the availability of SG cooling in Mode 4 via the turbine driven AFW pump which is not reliant upon AC power, compared to the use of shutdown cooling in Mode 5 which requires the availability of AC power. Further, the transition risks associated with establishing shutdown cooling alignments and the resulting potential for loss of inventory or loss of cooling events due to human error during such alignments are avoided by remaining in Mode 4.

This general assessment is applied as the basis for changing the required end state from Mode 5 to Mode 4 for those TSs which govern plant equipment that is not included in the PRA models, supported by qualitative assessments of the plant impact of the unavailability of the TS equipment. For those TS covering plant equipment that is included in the PRA models, a quantitative risk assessment is also provided which assesses the comparative risk of completing repairs in Mode 4 or proceeding to Mode 5 for repairs and then returning to Mode 4 for plant startup, considering the available equipment for accident mitigation.

Changing the required end state to Mode 4 will also result in increased plant availability by decreasing the time of shutdown. The additional time required to transition to Mode 5 from Mode 4 when shutting down and also to Mode 4 from Mode 5 when restarting can be eliminated with the end state change. A typical time for the transition from Mode 4 to Mode 5 during shutdown and from Mode 5 to 4 during startup is 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . Therefore, this change will allow an availability increase of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

Changing the end states allows continued operation with the LCO not met, by removing the TS requirement to exit the LCO Applicability. In this case the requirements of LCO 3.0.4.a would apply unless otherwise stated. LCO 3.0.4.a allows entry into a mode or other specified condition in the Applicability with the LCO not met when the associated Actions to be entered permit continued operation in the mode or other specified condition in the Applicability for an unlimited period of time. Compliance with Required Actions that permit continued operation of the unit for an unlimited period of time in a mode or other specified condition provides an acceptable level of safety for continued operation. This is without regard to the status of the unit before or after the mode change. Therefore, in such cases, entry into a mode or other specified condition in the Applicability may be made in accordance with the provisions of the Required Actions.

Thus, implementing modified end states requires adding a Note to the affected Required Actions to prevent using the allowance of LCO 3.0.4.a when entering Mode 4 from Mode 5.

This is done to avoid unit operation in a condition that should be prohibited by TS since LCO 3.0.4.a allows entry into a mode or other specified condition in the Applicability when the associated Actions to be entered permit continued operation in the mode or other specified condition in the Applicability for an unlimited period of time. Applying the allowance of LCO 3.0.4.a to modified end states was not analyzed in TR WCAP-16294; therefore, an appropriate limitation is applied by the addition of Notes to the affected TS Required Actions.

3.1 Technical Analysis This section provides the NRC staff evaluation of the impact of each proposed end state change on defense-in-depth, and safety margins as applied to the corresponding safety systems. The NRC staffs evaluation approves only the proposed changes to the TSs as described below.

The NRC staff finds that the TR used realistic assumptions regarding the plant conditions and the availability of various mitigating systems in analyzing the risks and considering the defense-in-depth and safety margins. Thus the NRC staff concludes that the TR uses realistic assumptions to justify the change in the end state. However, during the proposed Mode 4 end state, due to the safety Injection (SI) signal blockage and non-availability of accumulators, operator actions will be required to mitigate potential events.

During the proposed Mode 4 end state, risk is assessed and managed consistent with 10 CFR 50.65. The NRC staffs review is based on the knowledge of lower RCS pressure in Mode 4, which reduces the severity of a LOCA, and limits any coolant inventory loss in the event of a LOCA.

3.1.1 Proposed Required Actions The proposed changes add a Note stating that LCO 3.0.4.a is not applicable when entering Mode 4 from Mode 5 to each Required Action listed in the table below. In general, the end state for each Required Action shown in the table below is revised to be in Mode 4 instead of in Mode 5. The following table provides: (1) the TS number and title, (2) which Required Action is being revised, (3) the current end state and the required CT, and (4) the proposed end state and new CT.

Proposed Changes To End States TS Current End State(s) Proposed End TS Number and Title Required and Completion State(s) and Action(s) Time(s) Completion Time(s) 3.3.2 Engineered Safety Feature Actuation System (ESFAS)

Instrumentation B.2.2 Mode 5 in 84 hours9.722222e-4 days 0.0233 hours 1.388889e-4 weeks 3.1962e-5 months Mode 4 in 60 hours6.944444e-4 days 0.0167 hours 9.920635e-5 weeks 2.283e-5 months Functions: 1.a, 2.a, 3.a(1),

3.b(1), and 7.a 3.3.2 Engineered Safety Feature Actuation System (ESFAS)

Instrumentation C.2.2 Mode 5 in 60 hours6.944444e-4 days 0.0167 hours 9.920635e-5 weeks 2.283e-5 months Mode 4 in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Functions: 1.b, 2.b, 3.a(2), and 3.b(2) 3.3.2 Engineered Safety Feature Actuation System (ESFAS)

K.2.2 Mode 5 in 42 hours4.861111e-4 days 0.0117 hours 6.944444e-5 weeks 1.5981e-5 months Mode 4 in 18 hours2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months Instrumentation Functions: 7.b and 7.c 3.3.7 Control Room Emergency Filtration System (CREFS) C.2 Mode 5 in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Mode 4 in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Actuation Instrumentation 3.3.8 Fuel Building Air Cleanup System (FBACS) Actuation D.2 Mode 5 in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Mode 4 in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Instrumentation 3.4.13 RCS Operational B.2 Mode 5 in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Mode 4 in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Leakage 3.4.14 RCS Pressure Isolation B.2 Mode 5 in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Mode 4 in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Valve Leakage 3.4.15 RCS Leakage Detection E.2 Mode 5 in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Mode 4 in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Instrumentation 3.5.4 Refueling Water Storage C.2 Mode 5 in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Mode 4 in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Tank (RWST) 3.6.6A Containment Spray and B.2 Mode 5 in 84 hours9.722222e-4 days 0.0233 hours 1.388889e-4 weeks 3.1962e-5 months Mode 4 in 54 hours6.25e-4 days 0.015 hours 8.928571e-5 weeks 2.0547e-5 months Cooling Systems (Atmospheric E.2 Mode 5 in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Mode 4 in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and Dual) 3.6.6B Containment Spray and Cooling Systems (Atmospheric F.2 Mode 5 in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Mode 4 in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and Dual) 3.6.6C Containment Spray B.2 Mode 5 in 84 hours9.722222e-4 days 0.0233 hours 1.388889e-4 weeks 3.1962e-5 months Mode 4 in 54 hours6.25e-4 days 0.015 hours 8.928571e-5 weeks 2.0547e-5 months System (Ice Condenser) 3.6.6D Quench Spray (QS)

B.2 Mode 5 in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Mode 4 in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months System (Subatmospheric) 3.6.6E Recirculation Spray (RS)

F.2 Mode 5 in 84 hours9.722222e-4 days 0.0233 hours 1.388889e-4 weeks 3.1962e-5 months Mode 4 in 54 hours6.25e-4 days 0.015 hours 8.928571e-5 weeks 2.0547e-5 months System (Subatmospheric) 3.6.7 Spray Additive System (Atmospheric, Subatmospheric, B.2 Mode 5 in 84 hours9.722222e-4 days 0.0233 hours 1.388889e-4 weeks 3.1962e-5 months Mode 4 in 54 hours6.25e-4 days 0.015 hours 8.928571e-5 weeks 2.0547e-5 months Ice Condenser, and Dual)

Proposed Changes To End States TS Current End State(s) Proposed End TS Number and Title Required and Completion State(s) and Action(s) Time(s) Completion Time(s) 3.6.11 Iodine Cleanup System (ICS) (Atmospheric and B.2 Mode 5 in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Mode 4 in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Subatmospheric) 3.6.12 Vacuum Relief Valves (Atmospheric and Ice B.2 Mode 5 in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Mode 4 in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Condenser) 3.6.13 Shield Building Air Cleanup System (SBACS) (Dual B.2 Mode 5 in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Mode 4 in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and Ice Condenser) 3.6.14 Air Return System (ARS)

B.2 Mode 5 in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Mode 4 in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months (Ice Condenser) 3.6.18 Containment Recirculation Drains (Ice C.2 Mode 5 in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Mode 4 in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Condenser) 3.7.7 Component Cooling Water B.2 Mode 5 in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Mode 4 in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months (CCW) System 3.7.8 Service Water System B.2 Mode 5 in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Mode 4 in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months (SWS) 3.7.9 Ultimate Heat Sink (UHS) C.2 Mode 5 in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Mode 4 in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 3.7.10 Control Room Emergency C.2 Mode 5 in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Mode 4 in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Filtration System (CREFS) 3.7.11 Control Room Emergency Air Temperature Control System B.2 Mode 5 in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Mode 4 in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months (CREATCS) 3.7.12 Emergency Core Cooling System (ECCS) Pump Room C.2 Mode 5 in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Mode 4 in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Exhaust Air Cleanup System (PREACS) 3.7.13 Fuel Building Air Cleanup C.2 Mode 5 in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Mode 4 in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months System (FBACS) 3.7.14 Penetration Room Exhaust Air Cleanup System C.2 Mode 5 in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Mode 4 in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months (PREACS) 3.8.1 AC Sources - Operating G.2 Mode 5 in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Mode 4 in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 3.8.4 DC Sources - Operating D.2 Mode 5 in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Mode 4 in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 3.8.7 Inverters - Operating B.2 Mode 5 in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Mode 4 in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 3.8.9 Distribution Systems -

D.2 Mode 5 in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Mode 4 in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Operating

[Recirculation Fluid pH Control

[] Mode 5 in [ ] hours Mode 4 in 54 hour6.25e-4 days 0.015 hours 8.928571e-5 weeks 2.0547e-5 months s]

System In addition, TS 3.5.3, ECCS - Shutdown, Condition A is revised from Required ECCS residual heat removal (RHR) subsystem inoperable to Required ECCS train inoperable. Required

Action A.1 is revised from Initiate action to restore required ECCS RHR subsystem to OPERABLE status to Initiate action to restore required ECCS train to OPERABLE status.

This change allows the unit to remain in Mode 4, rather than transitioning to Mode 5 with an inoperable ECCS high head subsystem.

3.1.2 Evaluation of Proposed Changes A brief description of the systems and components covered by the scope of TSTF-432 and the NRC staffs evaluation of the proposed changes to the TSs are provided in the following paragraphs.

TR WCAP-16294 does not address entry into Mode 4 from Mode 5 when the Required Actions are in effect. Such a mode change would be permissible since the revised actions permit continued operation in Mode 4 for an unlimited period of time, and therefore transitioning from Mode 5 to Mode 4 would be permissible using LCO 3.0.4.a. Since, applying LCO 3.0.4.a to modified end states was not analyzed in TR WCAP-16294; an appropriate note is added to each affected Required Action which identifies that the provisions of LCO 3.0.4.a are not applicable to Mode 4 entry from Mode 5.

TS 3.3.2 Engineered Safety Feature Actuation System (ESFAS) Instrumentation The ESFAS instrumentation initiates necessary safety systems, based on the setpoint for selected parameters to protect against violating core design limits and the RCS pressure boundary, and to mitigate accidents. The ESFAS instrumentation functions are listed in Table 3.3.2-1 of Reference 3.

Function 1.a Safety Injection - Manual Initiation Function 1.b. Safety Injection - Automatic Actuation Logic and Actuation Relays Function 2.a Containment Spray - Manual Initiation Function 2.b Containment Spray - Automatic Actuation Logic and Actuation Relays Function 3.a(1) Containment Isolation - Phase A Isolation - Manual Initiation Function 3.a(2) Containment Isolation - Phase A Isolation - Automatic Actuation Logic and Actuation Relays Function 3.b(1) Containment Isolation - Phase B Isolation - Manual Initiation Function 3.b(2) Containment Isolation - Phase B Isolation - Automatic Actuation Logic and Actuation Relays Function 7.a Automatic Switchover to Containment Sump - Automatic Actuation Logic and Actuation Relays SI system: The SI system provides two primary functions: (1) Primary side water addition to ensure maintenance or recovery of reactor vessel water level (covering the active fuel for heat removal, clad integrity, and for limiting the peak clad temperature to < 2200°F), and (2) Boration to ensure recovery and maintenance of shutdown margin (keff < 1.0). These functions mitigate the effects of high energy line breaks both inside and outside of containment.

Manual initiation causes actuation of all components in the same manner as any of the automatic actuation signals. The automatic actuation logic and actuation relays must be operable in Mode 4 to support system level manual initiation. The LCO for both manual

initiation and automatic actuation logic and actuation relays requires that two trains shall be operable in Modes 1, 2, 3, and 4.

Containment spray system: The containment spray system provides three primary functions:

(1) Lowers containment pressure and temperature after a high energy line break in containment, (2) Reduces the amount of radioactive iodine in the containment atmosphere, and (3) Adjusts the pH of the water in the containment recirculation sump after a LOCA. These functions are necessary to ensure the containment structure pressure boundary, limit the radioactive iodine release to the environment in the event of failure of containment structure, and minimize corrosion of the internal containment systems following a LOCA.

The operator can initiate containment spray by simultaneously actuating two containment spray actuation switches in the same train. Two switches are used to prevent inadvertent actuation of containment spray. Simultaneously actuating the two switches in either train will start both trains of containment spray.

There are two trains for automatic actuation. In Mode 4, adequate time is available to manually actuate required components in the event of a DBA. However, because of the large number of components actuated, actuation is simplified by the use of the manual actuation push buttons.

Automatic actuation logic and actuation relays must be operable in Mode 4 to support system level manual initiation.

The LCO for manual initiation requires that two channels per train and two trains shall be operable. The LCO for Automatic Actuation Logic and Actuation Relays requires that two trains shall be operable in Modes 1, 2, 3, and 4.

Containment isolation (CI) system: The CI system provides isolation of the containment atmosphere, and all process systems that penetrate containment, from the environment. This function is necessary to prevent or limit the release of radioactivity to the environment in the event of a large break LOCA.

There are two separate CI signals, Phase A and Phase B. The Phase A signal isolates all automatically isolatable process lines, except CCW, at a relatively low containment pressure.

The Phase A CI is actuated automatically by SI, or manually via the automatic actuation logic.

All process lines penetrating containment, with the exception of CCW, are isolated.

Phase B signal isolates CCW. Manual Phase B CI is accomplished by the same switches that actuate containment spray. When the two switches in either set are actuated simultaneously, Phase B CI and containment spray will be actuated in both trains.

The LCO for 3.a(1) requires that two channels be operable in Modes 1, 2, 3, and 4. The LCO for 3.a(2) and 3.b(2) requires that two trains be operable in Modes 1, 2, 3, and 4. And, the LCO for 3.b(1) requires that two channels per train and two trains be operable in Modes 1, 2, 3, and 4.

Automatic switchover to containment sump: At the end of the injection phase of a LOCA, since the RWST is nearly empty, and continued cooling must be provided by the ECCS to remove decay heat, the source of water for the ECCS pumps is automatically switched to the containment recirculation sump. This switchover must occur before the RWST empties to

prevent damage to RHR pumps and a loss of cooling capability. Switchover must not occur before there is sufficient water in the containment sump to support engineered safety feature (ESF) pump suction. Also, early switchover must not occur to ensure that sufficient borated water is injected from the RWST.

There are two trains for automatic actuation and the logic and actuation relays consist of the same features and operate in the same manner as described in Function 1.b. The LCO for this function requires that two trains be operable in Modes 1, 2, 3, and 4.

Evaluation of SI, containment spray, CI and the Automatic Switchover to Containment Sump For Functions 1.a and 1.b, Function 1.a has two channels and Function 1.b has two trains. If one channel or train is inoperable, the other channel or train is available to initiate SI. For Functions 2.a and 2.b, if one channel or train is inoperable, the other channel or train is available for the operator to initiate CS. In addition, the containment, CI valves, containment spray system, and CCW system are available and required to be operable in Mode 4. For Functions 3.a(1), 3.a(2), 3.b(1), and 3.b(2), if one channel is inoperable, the other channel is available to the operator to initiate CI. Two trains of automatic actuation logic are also available to actuate the CI equipment. In addition, the CI valves, containment spray system, and CCW systems are available in Mode 4. For Function 7.a, if one train is inoperable, the other train is available to initiate switchover to the containment sump. In addition, the operator can perform the switchover manually.

A cool down to Mode 4 leaves the unit in a state in which transients progress slower than at power, backup core cooling is available via RHR, there is increased time for operator actions and mitigation strategies, and there is a lower overall risk than proceeding to Mode 5. Placing the unit in Mode 5 does not increase the instrumentation available for event mitigations; and therefore there is no benefit with regards to monitoring plant status by proceeding to Mode 5.

Sufficient defense-in-depth is maintained when the end state is changed from Mode 5 to Mode 4. In addition, the NRC staff anticipates that equipment repairs requiring plant shutdown and entry into Mode 4 would be infrequent events of short duration. Therefore, the NRC staff finds the proposed change to be acceptable.

Function 7.b Automatic Switchover to Containment Sump - Refueling Water Storage Tank (RWST) Level - Low Low, Coincident with Safety Injection Function 7.c Automatic Switchover to Containment Sump - RWST Level - Low Low, Coincident with Safety Injection and Coincident with Containment Sump Level - High Automatic switchover to containment sump: During the injection phase of a LOCA, automatic switchover from RWST to the containment sump occurs only if the RWST low low level signal is coincident with the SI. This prevents accidental switchover during normal operation.

{NOTE: Use the following paragraph if applicable.}

[Additional protection from spurious switchover is provided by requiring a Containment Sump Level - High signal as well as RWST Level - Low Low and SI. This ensures sufficient water is available in containment to support the recirculation phase of the accident. A Containment

Sump Level - High signal must be present, in addition to the SI signal and the RWST Level -

Low Low signal, to transfer the suction of the RIHR pumps to the containment sump.]

The RWST has four level transmitters. Units with containment sump level circuitry also have four channels for the sump level instrumentation. The logic requires two out of four channels to initiate the switchover from the RWST to the containment sump. The LCO for this function requires that four channels be operable in Modes 1, 2, 3, and 4.

Evaluation of the Automatic Switchover to Containment Sump If one channel is inoperable, the other three channels are available to initiate switchover to the containment sump. Placement of the unit in Mode 5 does not increase the instrumentation available for event mitigation; and therefore there is no benefit with regards to monitoring plant status by proceeding to Mode 5.

The redundancy is such that a single channel failure and one channel being inoperable will not defeat the initiation of switchover from the RWST to the containment sump. As a result, sufficient defense-in-depth is maintained when the end state is changed from Mode 5 to Mode 4. In addition, the NRC staff anticipates that equipment repairs requiring plant shutdown and entry into Mode 4 would be infrequent events of short duration. Therefore, the NRC staff finds the proposed change to be acceptable.

TS 3.3.7 Control Room Emergency Filtration System (CREFS) Actuation Instrumentation TS 3.3.8 Fuel Building Air Cleanup System (FBACS) Actuation Instrumentation CREFS actuation instrumentation: The CREFS provides an enclosed control room environment from which the unit can be operated following an uncontrolled release of radioactivity. During normal operation, the auxiliary building ventilation system provides control room ventilation. Upon receipt of an actuation signal, the CREFS initiates filtered ventilation and pressurization of the control room.

The CREFS actuation instrumentation consists of redundant radiation monitors in the air intakes and control room area. A high radiation signal from any of these detectors will initiate both trains of the CREFS. The control room operator can also initiate the CREFS trains by manual switches in the control room. The CREFS is also actuated by a SI signal. The LCO requirements ensure that instrumentation necessary to initiate the CREFS is operable. The LCO for this system requires that two trains and two channels be operable in Modes 1, 2, 3, 4, 5, 6, and during movement of recently irradiated fuel assemblies.

FBACS actuation instrumentation: The FBACS ensures that radioactive materials in the fuel building atmosphere following a fuel handling accident involving handling recently irradiated fuel or a LOCA are filtered and adsorbed prior to exhausting to the environment. The system initiates filtered ventilation of the fuel building automatically following receipt of a high radiation signal (gaseous or particulate) or following an SI signal. Initiation may also be performed manually as needed from the main control room.

Each FBACS train is initiated by high radiation detected by a dedicated channel. Each of the two available channels contains a gaseous and a particulate monitor. High radiation detected by any monitor or an SI signal from the ESFAS initiates fuel building isolation and starts the

FBACS. The LCO requirements ensure that instrumentation necessary to initiate the FBACS is operable. The LCO requires that the two trains and two channels shall be operable in Modes 1, 2, 3, 4, and during movement of recently irradiated fuel assemblies.

Evaluation of CREFS and FBACS The CREFS and FBACS design provides redundancy and defense-in-depth from the multiple channels, trains, and functions available to actuate each system. For CREFS and FBACS, if one or two channels or trains in one or more functions are inoperable, the Required Actions require one or both trains to be placed in the emergency radiation protection mode of operation.

This accomplishes the actuation instrumentation function and places the unit in a conservative mode of operation.

For either system, if the operator is unable to place the system in the emergency radiation protection mode, in accordance with the required actions, then the proposed TS would require the plant to be placed in Mode 4 (hot shutdown) instead of the current requirement of Mode 5 (cold shutdown). The likelihood of an initiating event is not increased by placing the unit in Mode 4. Placing the unit in Mode 5 does not increase the instrumentation available for event mitigation; and therefore there is no benefit with regards to monitoring plant status by proceeding to Mode 5. The design of the systems maintains sufficient defense-in-depth when the end state is changed from Mode 5 to Mode 4. In addition, the NRC staff anticipates that equipment repairs requiring plant shutdown and entry into Mode 4 would be infrequent events of short duration. Therefore, the NRC staff finds the proposed change to be acceptable.

TS 3.4.13 RCS Operational Leakage The safety significance of RCS operational leakage varies widely depending on its source, rate, and duration. Therefore, detecting and monitoring RCS leakage into the containment area is necessary. A limited amount of leakage inside containment is expected from auxiliary systems that cannot be made 100 percent leak tight. Leakage from these systems should be detected, located, and isolated from the containment atmosphere, if possible, so as not to interfere with RCS leakage detection.

This LCO deals with protection of the reactor coolant pressure boundary (RCPB) from degradation and the core from inadequate cooling, in addition to preventing the accident analyses radiation release assumptions from being exceeded.

In Modes 1, 2, 3, and 4 RCS operational leakage shall be limited to:

a. No pressure boundary leakage,

b. 1 gpm unidentified leakage,

c. 10 gpm identified leakage,

d. 1 gpm total primary to secondary leakage through all SGs, and

e. [500] gpd primary to secondary leakage through any one SG.

RCS leakage that is not large enough to be a small break LOCA should be treated as an event leading to a controlled shutdown which is not modeled in the quantitative risk analysis.

In Mode 4, the RCS pressure is significantly reduced and this reduces the leakage. All LOCA mitigating systems with the exception of the accumulators are available and the RHR serves as the backup to AFW for decay heat removal. If RCS operational leakage is not within limits for reasons other than pressure boundary leakage or primary-to-secondary leakage, then the leakage must be reduced to within the limit in 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months consistent with Required Action A.1. If operational leakage is not restored to within the limit in 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , in accordance with Required Action A.1, or pressure boundary leakage exists, or primary-to-secondary leakage is not within the limit, then Required Actions B.1 and B.2 become applicable. The proposed Required Actions B.1 and B.2 require that the unit be placed in Mode 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and Mode 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . Thus, the reactor must be brought to lower pressure conditions to reduce the severity of the leakage and its potential consequence. In addition, the NRC staff anticipates that equipment repairs requiring plant shutdown and entry into Mode 4 would be infrequent events of short duration.

Therefore, the NRC staff finds the proposed change to revise Required Action B.2 so that the plant would be allowed to remain in Mode 4 to be acceptable.

TS 3.4.14 RCS Pressure Isolation Valve Leakage The regulation at 10 CFR 50.2, Definitions, and 10 CFR 50.55a(c), Codes and Standards, define RCS pressure isolation valves (PIVs) as any two normally closed valves in series within the RCPB, which separate the high pressure RCS from an attached low pressure system. The RCS PIV Leakage LCO allows RCS high pressure operation when leakage through these valves exists in amounts that do not compromise safety. This is true during operation only when the loss of RCS mass through two series valves is determined by a water inventory balance. A known component of the identified leakage before operation begins is the least of the two individual leak rates determined for leaking series PIVs during the required surveillance testing; leakage measured through one PIV in a line is not RCS operational leakage if the other is leaktight.

The main purpose of this specification is to prevent overpressure failure of the low pressure portions of the connecting systems. The leakage limit is an indication that the PIVs between the RCS and the connecting systems are degraded or degrading. PIV leakage could lead to overpressure of the low pressure piping or components. The failure consequences could be a LOCA outside of containment, an unanalyzed accident that could degrade the ability for low pressure injection.

This LCO requires RCS PIV leakage to be within the limits in Modes 1, 2, 3 and 4 with the exception of valves in the RHR flow path when in, or during the transition to or from, the RHR mode of operation.

TS 3.4.14 limits RCS leakage because of the concern of over-pressurization of a lower pressure system that can lead to an interfacing system LOCA. In Mode 4, the RCS pressure is significantly reduced which reduces the PIV leakage. All LOCA mitigating systems with the exception of the accumulators are available and RHR serves as the backup to AFW for decay heat removal. Therefore, sufficient defense-in-depth is maintained when the end state is

changed from Mode 5 to Mode 4. In addition, the NRC staff anticipates that equipment repairs requiring plant shutdown and entry into Mode 4 would be infrequent events of short duration.

Therefore, the NRC staff finds the proposed change to revise Required Action B.2 so that the plant would be allowed to remain in Mode 4 to be acceptable.

TS 3.4.15 RCS Leakage Detection Instrumentation Criterion 30 of Appendix A to 10 CFR Part 50, Quality of reactor coolant pressure boundary, requires means for detecting and, to the extent practical, identifying the location of the source of RCS leakage. Leakage detection systems must have the capability to detect significant RCPB degradation as soon after occurrence as practical to minimize the potential for propagation to a gross failure. Thus, an early indication or warning signal is necessary to permit proper evaluation of all unidentified RCS leakage.

The LCO requires in Modes 1, 2, 3 and 4 that the following RCS leakage detection instrumentation be operable:

a. One containment sump (level or discharge flow) monitor,

b. One containment atmosphere radioactivity monitor (gaseous or particulate), and

c. One containment air cooler condensate flow rate monitor.

If one function is inoperable, the other functions are available to provide an indication of RCS leakage. In the unlikely event that Condition F (all required monitors inoperable) occurs, the likelihood of an initiating event in Mode 4 is not higher than in Mode 5.Placing the unit in Mode 5 does not increase the instrumentation available for detecting RCS leakage; and therefore there is no benefit with regards to monitoring plant status by proceeding to Mode 5. Therefore, sufficient defense-in-depth is maintained when the end state is changed from Mode 5 to Mode 4. In addition, the NRC staff anticipates that equipment repairs requiring plant shutdown and entry into Mode 4 would be infrequent events of short duration.

Therefore, the NRC staff finds the proposed change to revise Required Action F.2 so that the plant would be allowed to remain in Mode 4 to be acceptable.

TS 3.5.3 ECCS - Shutdown The function of the ECCS is to provide core cooling and negative reactivity to ensure that the reactor core is protected after any of the following accidents:

a. LOCA, coolant leakage greater than the capability of the normal charging system,

b. Rod ejection accident,

c. Loss of secondary coolant accident, including uncontrolled steam release or loss of feedwater, and

d. Steam generator tube rupture.

TS 3.5.3 is only applicable in Mode 4. In Mode 4, the required ECCS train consists of two separate subsystems: centrifugal charging (high head) and RHR (low head). The ECCS flow paths consist of piping, valves, heat exchangers, and pumps such that water from the RWST can be injected into the RCS following an accident. The LCO requires that one ECCS train be operable in Mode 4.

The subsystems addressed in this TS are the ECCS RHR and ECCS High Head subsystems which are both included in the quantitative risk evaluation (Reference 2). The requested change in Action A.1 will enable the unit to remain in a mode where SG cooling is also available for decay heat removal.

Table 3.2.1, in the final SE for WCAP-16294, shows that the plant operating state (POS) 4 core damage probability (CDP) is approximately seven times greater than the POS 3 CDP.

Proceeding to Mode 5 does not significantly increase the protection available and additional risk is introduced by switching from AFW cooling to RHR cooling. This supports remaining in Mode 4 for this configuration rather than cooling down to Mode 5.

The POS 3 is defined as the lower part of Mode 3 and the upper part of Mode 4. The RCS pressure and temperature are significantly reduced from power operation; therefore, many of the events associated with the high RCS pressure (LOCAs/pipe breaks) have a reduced frequency. In addition, accumulators are isolated. In POS 3 the plant is transitioning down (toward shutdown).

The POS 4 is defined as the lower part of Mode 4 and the upper part of Mode 5. The transition from AFW cooling to RHR cooling occurs in this POS. The RCS pressure and temperature are significantly reduced from power operation; therefore, the LOCA events and SG tube rupture event are no longer applicable. The secondary side pressure is also reduced eliminating the secondary side break events. Loss of inventory related to the RCS cooling switch from AFW to RHR is an event that is added. This can occur when transitioning down or up. Cold overpressurization is also added.

The proposed change to the Required Action A.1 end state does not change the operability requirement for the ECCS. One train still must be operable in Mode 4. If one train of RHR is inoperable, then remaining in Mode 4 provides core cooling from the AFW pumps with the operable RHR pump as a backup. If both trains of RHR are inoperable, then the unit will remain on AFW cooling while one train is restored. The probability of transients occurring that require the ECCS are less likely in Mode 4 than at-power and the risk associated with transferring to RHR cooling from AFW cooling is eliminated by remaining in Mode 4. Sufficient defense-in-depth is maintained when the unit remains in Mode 4 rather than transitioning to Mode 5.

Therefore, the NRC staff finds the proposed change to revise TS 3.5.3 so that the plant would be allowed to remain in Mode 4 to be acceptable.

TS 3.5.4 Refueling Water Storage Tank (RWST)

The RWST supplies borated water to the chemical and volume control system during abnormal operating conditions, to the refueling pool during refueling, and to the ECCS and the containment spray system during accident conditions. The RWST supplies both trains of the

ECCS and the containment spray system through separate, redundant supply headers during the injection phase of a LOCA recovery.

During normal operation in Modes 1, 2, and 3, the SI and RHR pumps are aligned to take suction from the RWST. This LCO requires that the RWST be operable in Modes 1, 2, 3, and 4.

Since SI and recirculation may not be available due to an inoperable RWST, any loss of inventory events that cannot be isolated can lead to core damage. From Table 3.2.1, in the final SE for WCAP-16294, remaining in Mode 4 (POS 3) instead of cooldown to Mode 5 (POS 4, upper portion of Mode 5) reduces the CDP by more than a factor of 3. The primary accidents such as LOCAs and steam line breaks (SLBs) are less likely to occur in Mode 4. Since control rods are inserted in Mode 4, the SLB analysis assumption of the highest worth rod stuck is an unlikely scenario. In the lower part of Mode 4 transients progress slower than at power, backup cooling is available via RHS and there is increased time for operator action and mitigation strategies. Proceeding to Mode 5 may add additional risk by switching from AFW cooling to RHR cooling. Based on Table 3.2.1, in the final SE for WCAP-16294, if RWST is inoperable, a shutdown to Mode 4 is appropriate.

In Mode 4, the transient conditions are less severe than at power so that variations in the RWST parameters or other reasons of inoperability are less significant. In addition, if the boron concentration is low, the emergency boration equipment is likely to be available to increase the RCS boron concentration. By changing the end state for Required Action C.2 to Mode 4, the possibility of a loss of inventory event due to switching to RHR cooling is eliminated, reducing the possibility that the RWST inventory would be required. Therefore, sufficient defense-in-depth is maintained when the unit remains in Mode 4 rather than transitioning to Mode 5 with LCO 3.0.4.a not applicable for entry into Mode 4. In addition, the NRC staff anticipates that equipment repairs requiring plant shutdown and entry into Mode 4 would be infrequent events of short duration.

Therefore, the NRC staff finds the proposed change to revise TS 3.5.4 so that the plant would be allowed to remain in Mode 4 to be acceptable.

TS 3.6.6A Containment Spray and Cooling Systems (Atmospheric and Dual) (Credit taken for iodine removal by the Containment Spray System)

TS 3.6.6B Containment Spray and Cooling Systems (Atmospheric and Dual) (Credit not taken for iodine removal by the Containment Spray System)

TS 3.6.6C Containment Spray System (Ice Condenser)

The containment spray and containment cooling systems provide containment atmosphere cooling to limit post accident pressure and temperature in containment to less than the design values. The containment spray system consists of two separate trains of equal capacity, each capable of meeting the design bases. Each train includes a containment spray pump, spray headers, nozzles, valves, and piping. Each train is powered from a separate ESF bus. The RWST supplies borated water to the containment spray system during the injection phase of operation. In the recirculation mode of operation, containment spray pump suction is transferred from the RWST to the containment sump(s).

Two trains of containment cooling, each of sufficient capacity to supply 100 percent of the design cooling requirement, are provided. Each train of two fan units is supplied with cooling

water from a separate train of essential service water. Air is drawn into the coolers through the fan and discharged to the SG compartments, pressurizer compartment, instrument tunnel, and outside the secondary shield in the lower areas of containment.

The differences between TS 3.6.6A, TS 3.6.6B, and TS 3.6.6C follows:

TS 3.6.6A: Reduction of containment pressure and the iodine removal capability of the spray reduce the release of fission product radioactivity from containment to the environment, in the event of a DBA, to within limits. Credit is taken for iodine removal by the CS system. Containment Cooling systems are not credited with iodine removal. The LCO requires that two containment spray trains and two containment cooling trains shall be operable in Modes 1, 2, 3, and 4.

TS 3.6.6B: One train of the containment spray will cause a reduction of containment pressure, in the event of a DBA, to within limits. The LCO requires that two containment spray trains and two containment cooling trains shall be operable in Modes 1, 2, 3, and 4.

TS 3.6.6C: Reduction of containment pressure and the iodine removal capability of the spray reduce the release of fission product radioactivity from containment to the environment, in the event of a DBA. The diversion of a portion of the recirculation flow from each train of RHR to additional redundant spray headers completes the containment spray system heat removal capability. Each RHR train is capable of supplying spray coverage, if required, to supplement the containment spray system.

The RHR spray operation is initiated manually, when required by the emergency operating procedures, after the ECCS is operating in the recirculation mode. The LCO requires that two containment spray trains shall be operable in Modes 1, 2, 3, and 4.

For TS 3.6.6A and TS 3.6.6B, the containment spray and containment cooling systems are designed for accident conditions initiated at full power. One train of each system satisfies the assumptions in the safety analyses. If one train of either containment spray or containment cooling is inoperable the other train is available to mitigate the accident along with both trains of the other system. If both trains of containment cooling are inoperable, containment spray can serve as the cooling system. In TS 3.6.6A one train of containment spray is required to satisfy assumptions regarding iodine removal. TS 3.6.6A Condition F requires that if two containment spray trains are inoperable or any combination of three or more trains are inoperable the plant must immediately enter LCO 3.0.3. TS 3.6.6B Condition G requires that if any combination of three or more trains are inoperable the plant must immediately enter LCO 3.0.3. The requirements of Criterion 38 will still be met. Therefore, the NRC staff finds the proposed change to be acceptable.

For TS 3.6.6C, the containment spray system is designed for accident conditions initiated at full power. One train satisfies the assumptions in the safety analyses. One train of containment spray is required to satisfy assumptions regarding iodine removal. If one train of containment spray is inoperable the other train is available to mitigate the accident. The ice condenser is required to be operable and it is designed to handle a heat load in excess of the initial blowdown of a design basis LOCA, or any feedwater or SLB event inside containment. An event in Mode 4 that releases energy into containment will release far less energy than an event in

Mode 1. The requirements of GDC 38 will still be met. Therefore, the NRC staff finds the proposed change to be acceptable.

TS 3.6.6D Quench Spray (QS) System (Subatmospheric)

The QS system is designed to provide containment atmosphere cooling to limit post accident pressure and temperature in containment to less than the design values. The QS system, operating in conjunction with the RS system, is designed to cool and depressurize the containment structure to subatmospheric pressure in less than 60 minutes following a DBA.

Reduction of containment pressure and the iodine removal capability of the spray limit the release of fission product radioactivity from containment to the environment in the event of a DBA.

The QS system consists of two separate trains of equal capacity, each capable of meeting the design bases. Each train includes a spray pump, spray headers, nozzles, valves, and piping.

Each train is powered from a separate ESF bus. The RWST supplies borated water to the QS system. The QS system is actuated either automatically by a containment High-High pressure signal or manually. Each train of the QS system provides adequate spray coverage to meet the system design requirements for containment heat and iodine fission product removal. The LCO requires that two QS trains shall be operable in Modes 1, 2, 3, and 4.

The QS system is designed for accident conditions initiated at power. One train satisfies the assumptions in the safety analyses. In addition, the containment temperature and pressure limits are set to account for the effects of an energy release during an event at full power operation. Events, such as a LOCA or a secondary side break, are less likely in Mode 4 due to less severe thermal-hydraulic conditions. An event in Mode 4 that releases energy into containment will release far less energy than an event in Mode 1. The requirements of Criterion 38 will still be met. Therefore, the NRC staff finds the proposed change to be acceptable.

TS 3.6.6E Recirculation Spray (RS) System (Subatmospheric)

The RS system, operating in conjunction with the QS system, is designed to limit the post accident pressure and temperature in the containment to less than the design values and to depressurize the containment structure to a subatmospheric pressure in less than 60 minutes following a DBA. The reduction of containment pressure and the removal of iodine from the containment atmosphere by the spray limit the release of fission product radioactivity from containment to the environment in the event of a DBA.

The RS system consists of two separate trains of equal capacity, each capable of meeting the design and accident analysis bases. Each train includes one RS subsystem outside containment and one RS subsystem inside containment. Each subsystem consists of one 50 percent capacity spray pump, one spray cooler, one 180° coverage spray header, nozzles, valves, piping, instrumentation, and controls. Each outside RS subsystem also includes a casing cooling pump with its own valves, piping, instrumentation, and controls. The two outside RS subsystems' spray pumps are located outside containment and the two inside RS subsystems' spray pumps are located inside containment. Each RS train (one inside and one outside RS subsystem) is powered from a separate ESF bus. Each train of the RS system provides adequate spray coverage to meet the system design requirements for containment

heat and iodine fission product removal. The LCO requires that four RS subsystems [and a casing cooling tank] shall be operable in Modes 1, 2, 3, and 4.

The RS system is designed for accident conditions initiated at power. One train (two subsystems) satisfies the assumptions in the safety analyses. In addition, the containment temperature and pressure limits are set to account for the effects of an energy release during an event at full power operation. One train of RS is required to satisfy assumptions regarding iodine removal. An event in Mode 4 that releases energy into containment will release far less energy than an event in Mode 1. The requirements of Criterion 38 will still be met. Therefore, the NRC staff finds the proposed change to be acceptable.

TS 3.6.7 Spray Additive System (Atmospheric, Subatmospheric, Ice Condenser, and Dual)

[Item 6.4.22a Recirculation Fluid pH Control System]

Spray additive system: The spray additive system is a subsystem of the containment spray system that assists in reducing the iodine fission product inventory in the containment atmosphere resulting from a DBA.

Radioiodine in its various forms is the fission product of primary concern in the evaluation of a DBA. It is absorbed by the spray from the containment atmosphere. To enhance the iodine absorption capacity of the spray, the spray solution is adjusted to an alkaline pH that promotes iodine hydrolysis, in which iodine is converted to nonvolatile forms.

For an eductor feed system, the spray additive system consists of one spray additive tank that is shared by the two trains of spray additive equipment. Each train of equipment provides a flow path from the spray additive tank to a containment spray pump and consists of an eductor for each containment spray pump, valves, instrumentation, and connecting piping. Each eductor draws the NaOH spray solution from the common tank using a portion of the borated water discharged by the containment spray pump as the motive flow. The eductor mixes the NaOH solution and the borated water and discharges the mixture into the spray pump suction line.

For a gravity feed system, the spray additive system consists of one spray additive tank, two parallel redundant motor operated valves in the line between the spray additive tank and the RWST, instrumentation, and recirculation pumps. The NaOH solution is added to the spray water by a balanced gravity feed from the additive tank through the connecting piping into a weir within the RWST. There, it mixes with the borated water flowing to the containment spray pump suction.

In Modes 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment requiring the operation of the spray additive system. The spray additive system assists in reducing the iodine fission product inventory prior to release to the environment. The LCO requires that the spray additive system shall be operable in Modes 1, 2, 3, and 4.

Recirculation fluid pH control system: Some Westinghouse NSSS plants have replaced the spray additive system with a passive ECCS recirculation fluid pH control system. Although the TS for this system is not contained in NUREG-1431, the end state is Mode 5 if the system is inoperable, and the Required Action and associated CT are not met. The system consists of baskets in the containment sump with a specified amount of tri-sodium phosphate in each basket.

The tri-sodium phosphate dissolves when the containment sump level increases to the level of the baskets. It is highly unlikely that all of the baskets would be empty; therefore, an inoperable recirculation fluid pH control system would still provide some pH control.

The recirculation fluid pH control system TS currently requires the unit to be in Mode 3 in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and Mode 5 in 84 hours9.722222e-4 days 0.0233 hours 1.388889e-4 weeks 3.1962e-5 months if the system is inoperable, and the Required Action and associated CT are not met. The LCO requires the recirculation fluid pH control system to be operable in Modes 1, 2, 3, and 4.

Evaluation of Spray Additive System and the Recirculation Fluid pH Control System The TR provides the technical basis for the proposed change by indicating that [e]vents, such as a LOCA or a secondary side break, are less likely in Mode 4 due to the limited time in the mode and less severe thermal-hydraulic conditions. Therefore, sufficient defense-in-depth is maintained when the end state is changed from Mode 5 to Mode 4. The TR also indicates that proceeding to Mode 5 does not increase the protection available. {NOTE: The following sentence should be added only if the plant has adopted Item 6.4.22a.} [The TR also argues that it is highly unlikely that all of the baskets would be empty; therefore, an inoperable recirculation fluid pH control system would still provide some pH control.]

CS will still be available to reduce the iodine fission product inventory in the containment. The RCS pressures and temperatures are lower, the ECCS operation is maintained so the criteria of 10 CFR 50.46 are met, and the containment spray systems and containment cooling systems are available to depressurize and reduce the airborne radioiodine in containment. Based on this, the NRC staff finds the proposed change to be acceptable.

TS 3.6.11 Iodine Cleanup System (ICS) (Atmospheric and Subatmospheric)

The ICS functions together with the containment spray and cooling systems following a DBA to reduce the potential release of radioactive material, principally iodine, from the containment to the environment.

The ICS consists of two 100 percent capacity, separate, independent, and redundant trains.

Each train includes a heater, cooling coils, a prefilter, a demister, a high efficiency particulate air (HEPA) filter, an activated charcoal adsorber section for removal of radioiodine, and a fan.

Ductwork, valves and/or dampers, and instrumentation also form part of the system. Each ICS train is powered from a separate ESF bus and is provided with a separate power panel and control panel. During normal operation, the containment cooling system is aligned to bypass the ICS HEPA filters and charcoal adsorbers. For ICS operation following a DBA, however, the bypass dampers automatically reposition to draw the air through the filters and adsorbers. The LCO requires that two ICS trains shall be operable in Modes 1, 2, 3, and 4.

The ICS reduces the concentration of fission products released to the containment atmosphere following a postulated accident.

For Condition A, one ICS train inoperable, seven days are allowed to restore the ICS train to OPERABLE status. The TR requests that if Required Action A.1 cannot be accomplished within the seven day limit, Required Action B.1 be revised to allow the unit to be in Mode 3 in six hours

and in Mode 4 in twelve hours. Two trains of containment spray and the second train of ICS will be available for reduction of the concentration of fission products released to the containment following a postulated accident. The requirements of Criterion 41 will be met. On this technical basis, the NRC staff finds the proposed change to be acceptable.

TS 3.6.12 Vacuum Relief Valves (Atmospheric and Ice Condenser)

The purpose of the vacuum relief lines is to protect the containment vessel against negative pressure (i.e., a lower pressure inside than outside containment).

The containment pressure vessel contains two 100 percent vacuum relief lines that protect the containment from excessive external loading. The LCO requires that two vacuum relief lines shall be operable in Modes 1, 2, 3, and 4.

Excessive negative pressure inside containment can occur if there is an inadvertent actuation of containment cooling features, such as the containment spray system. Multiple equipment failures or human errors are necessary to cause inadvertent actuation of these systems.

Excessive negative pressure in a dual containment can cause structural damage to the steel pressure containment. For Condition A, if one vacuum relief line is inoperable, 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months are allowed to restore the vacuum relief line to OPERABLE status.

Most containment pressure vessels contain two 100 percent vacuum relief lines that protect the containment from excessive external loading. This evaluation is applicable only for containment designs with two or more vacuum relief lines. With one vacuum relief line inoperable there will still be one vacuum relief line operable to provide protection for the containment pressure vessel. On this technical basis, the NRC staff finds the proposed change to be acceptable.

TS 3.6.13 Shield Building Air Cleanup System (SBACS) (Dual and Ice Condenser)

The containment has a secondary containment called the shield building, which is a concrete structure that surrounds the steel primary containment vessel. Between the containment vessel and the shield building inner wall is an annular space that collects any containment leakage that may occur following a LOCA. This space also allows for periodic inspection of the outer surface of the steel containment vessel.

The SBACS establishes a negative pressure in the annulus between the shield building and the steel containment vessel. Filters in the system then control the release of radioactive contaminants to the environment.

The SBACS consists of two separate and redundant trains. Each train includes a heater, cooling coils, a prefilter, moisture separators, a HEPA filter, an activated charcoal adsorber section for removal of radioiodines, and a fan. During normal operation, the shield building cooling system is aligned to bypass the SBACS's HEPA filters and charcoal adsorbers. For SBACS operation following a DBA, however, the bypass dampers automatically reposition to draw the air through the filters and adsorbers. The LCO requires that two SBACS trains shall be operable in Modes 1, 2, 3, and 4.

When one SBACS train is inoperable, seven days are allowed to restore the SBACS train to OPERABLE status. The second train of SBACS is available to collect any containment leakage

from the annulus and to filter that containment leakage before release to the environment. The energy released to containment from a LOCA will be lower than for the limiting DBA. The containment spray system[, containment cooling system {for a dual containment design},] and ECCS will be available. The capability of these systems will be well within their design basis should an event occur in Mode 4.

If two trains of SBACS are inoperable, LCO 3.0.3 applies since an associated action for two trains of SBACS inoperable is not provided. On this technical basis, the NRC staff finds the proposed change to be acceptable.

TS 3.6.14 Air Return System (ARS) (Ice Condenser)

The ARS is designed to assure the rapid return of air from the upper to the lower containment compartment after the initial blowdown following a DBA. The return of this air to the lower compartment and subsequent recirculation back up through the ice condenser assists in cooling the containment atmosphere and limiting the post accident pressure and temperature in containment to less than design values. The ARS provides post accident hydrogen mixing in selected areas of containment. The ARS also functions, after all the ice has melted, to circulate any steam still entering the lower compartment to the upper compartment where the containment spray system can cool it.

The ARS consists of two separate trains of equal capacity, each capable of meeting the design bases. Each train includes a 100 percent capacity air return fan, associated damper, and hydrogen collection headers with isolation valves. The ARS fans are automatically started and the hydrogen collection header isolation valves are opened by the containment pressure high-high signal 10 minutes after the containment pressure reaches the pressure setpoint. The LCO requires that two ARS trains shall be operable in Modes 1, 2, 3, and 4.

The ARS performs the following two functions:

1 Recirculation of containment air from the upper containment to lower containment compartment assists in cooling the containment atmosphere and limiting post accident pressure in containment.

2 Provide mixing in select areas of containment to prevent hydrogen gas accumulation.

The ECCS and containment spray system remain operable. ECCS will be automatically initiated by low pressurizer pressure, high containment pressure, or by manual actuation.

Containment air cooling for a LOCA or SLB is required in Mode 4. The containment spray system will still be available to provide cooling in the upper containment compartment. The energy released into containment from a LOCA or SLB while in Mode 4 is well within the design limits for the containment spray system. Containment spray will be automatically initiated by containment pressure high-high signal or by manual actuation. Adequate cooling will be available to maintain the containment air temperature and containment post accident pressure within the design limits.

With one train of ARS inoperable the remaining train will be operable to provide air mixing to prevent hydrogen accumulation. One train of the ARS will be operable to help maintain containment cooling and to provide air mixing to prevent hydrogen accumulation. The

containment spray system will help provide containment cooling in the event of a LOCA or SLB while in Mode 4. On this basis, the NRC staff finds the change to Required Action B.2 to be in Mode 4 with a CT of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is acceptable.

TS 3.6.18 Containment Recirculation Drains (Ice Condenser)

The containment recirculation drains consist of the ice condenser drains and the refueling canal drains. Twenty of the 24 ice condenser bays have a floor drain at the bottom to drain the melted ice into the lower compartment (in the four bays that do not have drains, the water drains through the floor drains in the adjacent bays). A check (flapper) valve at the end of each pipe keeps warm air from entering during normal operation, but when the water exerts pressure, the check valve opens to allow the water to spill into the lower compartment. This prevents water from backing up and interfering with the ice condenser inlet doors. The water delivered to the lower containment serves to cool the atmosphere as it drains to the floor and provides a source of borated water at the containment sump for long term use by the ECCS and the containment spray system during the recirculation mode of operation.

The two refueling canal drains are at low points in the refueling canal. In the event of a DBA, the refueling canal drains are the main return path to the lower compartment for containment spray system water sprayed into the upper compartment. The LCO requires that the ice condenser floor drains and the refueling canal drains shall be operable in Modes 1, 2, 3, and 4.

The ice condenser drains minimize air leakage into and out of the ice condenser during normal operation. Warm air entering the ice condenser can cause sublimation of the ice and/or obstruction of the air passages due to ice buildup. Sublimation of the ice and buildup of ice that could obstruct the air passageways is a slow process. Two trains of containment spray are available along with the ARS to cool the containment atmosphere to limit the peak containment temperature and pressure in the event of a LOCA or SLB while in Mode 4.

When one ice condenser floor drain is inoperable, one hour is allowed to restore the ice condenser floor drain to OPERABLE status. When one refueling canal drain is inoperable, one hour is allowed to restore the refueling canal drain to OPERABLE status. In the event of a LOCA or SLB while in Mode 4, the remaining floor drains will provide sufficient capacity such that water will drain from the ice condenser bays and from the refueling canal to the containment lower compartment to provide a source of borated water at the containment sump for long term use by the ECCS and the containment spray during the recirculation mode of operation.

Based on the above assessment, the ability to provide reasonable assurance that there will be adequate water returned to the containment sump and that there will not be a rapid degradation of the ice condenser due to the in leakage of warm air, the NRC staff finds this proposed change to be acceptable.

TS 3.7.7 Component Cooling Water (CCW) System TS 3.7.8 Service Water System (SWS)

CCW system: The CCW system provides a heat sink for the removal of process and operating heat from safety related components during a DBA or transient. During normal operation, the CCW System also provides this function for various nonessential components as well as the

spent fuel storage pool. The CCW System serves as a barrier to the release of radioactive byproducts between potentially radioactive systems and the SWS, and thus to the environment.

A typical CCW system is arranged as two independent, full capacity cooling loops, and has the ability to isolate non-safety related components. Each safety related train includes a full capacity pump, surge tank, heat exchanger, piping, valves, and instrumentation, and is powered from a separate bus. An open surge tank in the system provides pump trip protective functions to ensure that sufficient net positive suction head is available. The pump in each train is automatically started on receipt of an SI signal, and all nonessential components are isolated.

The principal safety related function of the CCW system is the removal of decay heat from the reactor via the RHR system. This may be during a normal or post accident cooldown and shutdown. The LCO requires that two CCW trains be operable in Modes 1, 2, 3, and 4.

SWS: SWS consists of two separate, 100 percent capacity, safety related, cooling water trains.

Each train consists of two 100 percent capacity pumps, one CCW heat exchanger, piping, valving, instrumentation, and two cyclone separators. The pumps and valves are remote and manually aligned, except in the unlikely event of a LOCA. The pumps aligned to the critical loops are automatically started upon receipt of an SI signal, and all essential valves are aligned to their post accident positions. The SWS also provides emergency makeup to the spent fuel pool and CCW System and typically is the backup water supply to the AFW system.

The SWS provides a heat sink for the removal of process and operating heat from safety related components during a DBA or transient. During normal operation and a normal shutdown, the SWS also provides this function for various safety related and non-safety related components.

The principal safety related function of the SWS is the removal of decay heat from the reactor via the CCW System. The safety related function is covered by this LCO, which requires that two SWS trains shall be operable in Modes 1, 2, 3, and 4.

Evaluation of the CCW system and SWS The CDP values listed in Table 3.2.1 of the final SE for NEI TR WCAP-16294, from the evaluation for the scenarios, show that there is slightly less risk associated with Mode 4 than there is with a cooldown to Mode 5 when a train of CCW or SWS is inoperable. One CCW or SWS train will be operating when the unit enters Mode 4. Each train is designed to handle 100 percent of the heat loads during power operation and accident conditions. The heat loads will be significantly less in the shutdown modes and some accidents are less likely to occur.

Therefore sufficient defense-in-depth is maintained when the end state is changed from Mode 5 to Mode 4.

The NRC staff finds the proposed change to revise TS 3.7.7 Required Action B.2 and TS 3.7.8 Required Action B.2 so that the plant would be allowed to remain in Mode 4 to be acceptable.

TS 3.7.9 Ultimate Heat Sink (UHS)

The UHS provides a heat sink for processing and operating heat from safety related components during a transient or accident, as well as during normal operation. This is done by utilizing the SWS and the CCW system.

The UHS has been defined as the complex of water sources, including necessary retaining structures (e.g., a pond with its dam, or a river with its dam), and the canals or conduits connecting the sources with, but not including, the cooling water system intake structures as discussed in the Final Safety Analysis Report (FSAR). If cooling towers or portions thereof are required to accomplish the UHS safety functions, they should meet the same requirements as the sink. The two principal functions of the UHS are the dissipation of residual heat after reactor shutdown, and dissipation of residual heat after an accident.

A variety of complexes are used to meet the requirements for a UHS. A lake or an ocean may qualify as a single source. If the complex includes a water source contained by a structure, it is likely that a second source will be required. This LCO requires that the UHS be operable in Modes 1, 2, 3, and 4.

TS 3.7.9 addresses degradations to the cooling capability of the UHS. The most likely scenario for entering Condition C is that the cooling capability of the UHS is only partially degraded. A cooldown to Mode 4 places the unit in a state where heat loads are significantly less than at full power.

The UHS is designed to remove 100 percent of the heat loads generated during power operation and accident conditions. The heat load will be significantly less in the shutdown modes. Some accidents are less likely to occur during shutdown modes. Therefore, sufficient defense-in-depth is maintained when the end state is changed from Mode 5 to Mode 4.

The NRC staff finds the proposed change to revise Required Action C.2 so that the plant would be allowed to remain in Mode 4 to be acceptable.

TS 3.7.10 Control Room Emergency Filtration System (CREFS)

The CREFS provides a protected environment from which operators can control the unit following an uncontrolled release of radioactivity, chemicals, or toxic gas. The CREFS consists of two independent, redundant trains that recirculate and filter the control room air. Each train consists of a pre-filter or demister, a HEPA filter, an activated charcoal adsorber section for removal of gaseous activity (principally iodines), and a fan. Ductwork, valves or dampers, and instrumentation also form part of the system, as well as demisters to remove water droplets from the air stream. A second bank of HEPA filters follows the adsorber section to collect carbon fines and provides backup in case of failure of the main HEPA filter bank.

The CREFS is an emergency system, parts of which may also operate during normal unit operations in the standby mode of operation. Upon receipt of the actuating signal(s), normal air supply to the control room is isolated, and the stream of ventilation air is recirculated through the system filter trains. The pre-filters or demisters remove any large particles in the air, and any entrained water droplets present, to prevent excessive loading of the HEPA filters and charcoal adsorbers. This LCO requires that two CREFS trains be operable in Modes 1, 2, 3, 4, 5, 6, and during movement of recently irradiated fuel assemblies.

If one CREFS train is inoperable, the other train remains available to provide control room filtration. If two CREFS trains are inoperable an independent initiating event and radioactive release must occur for filtration to be required in Modes 4 and 5. Therefore, sufficient defense-in-depth is maintained when the end state is changed from Mode 5 to Mode 4.

The NRC staff finds the proposed change to revise Required Action C.2 so that the plant would be allowed to remain in Mode 4 to be acceptable.

TS 3.7.11 Control Room Emergency Air Temperature Control System (CREATCS)

The CREATCS is an emergency system, parts of which may also operate during normal unit operations. The CREATCS consists of two independent and redundant trains that provide cooling and heating of recirculated control room air. Each train consists of heating coils, cooling coils, instrumentation, and controls to provide for control room temperature control following isolation of the control room. The LCO requires that two CREATCS trains be operable in Modes 1, 2, 3, 4, 5, 6, and during movement of recently irradiated fuel assemblies.

If one CREATCS train is inoperable, the other train remains available to provide control room temperature control. The slower nature of accident event progression in the shutdown modes, and increased time for operator actions and mitigation strategies, limit the severity of accidents in the shutdown modes. The inoperability of equipment does not affect the likelihood of an event occurring and some events are less likely to occur in the shutdown modes. Therefore, sufficient defense-in-depth is maintained when the end state is changed from Mode 5 to Mode 4.

The NRC staff finds the proposed change to revise Required Action B.2 so that the plant would be allowed to remain in Mode 4 to be acceptable.

TS 3.7.12 Emergency Core Cooling System (ECCS) Pump Room Exhaust Air Cleanup System (PREACS)

TS 3.7.14 Penetration Room Exhaust Air Cleanup System (PREACS)

ECCS PREACS: The ECCS PREACS filters air from the area of the active ECCS components during the recirculation phase of a LOCA. The ECCS PREACS, in conjunction with other normally operating systems, also provides environmental control of temperature and humidity in the ECCS pump room area and the lower reaches of the auxiliary building.

The ECCS PREACS consists of two independent and redundant trains. Each train consists of a heater, a pre-filter or demister, a HEPA filter, an activated charcoal adsorber section for removal of gaseous activity (principally iodines), and a fan. Ductwork, valves or dampers, and instrumentation also form part of the system, as well as demisters functioning to reduce the relative humidity of the air stream. A second bank of HEPA filters follows the adsorber section to collect carbon fines and provide backup in case the main HEPA filter bank fails. The downstream HEPA filter is not credited in the accident analysis, but serves to collect charcoal fines, and to backup the upstream HEPA filter should it develop a leak. The system initiates filtered ventilation of the pump room following receipt of an SI signal.

The ECCS PREACS is a standby system, aligned to bypass the system HEPA filters and charcoal adsorbers. During emergency operations, the ECCS PREACS dampers are realigned, and fans are started to begin filtration. Upon receipt of the actuating ESFAS signal(s), normal air discharge from the ECCS pump room is isolated, and the stream of ventilation air discharges through the system filter trains. The pre-filters remove any large particles in the air, and any entrained water droplets present, to prevent excessive loading of the HEPA filters and charcoal

adsorbers. The LCO requires that two ECCS PREACS trains be operable in Modes 1, 2, 3, and 4.

PREACS: The PREACS filters air from the penetration area between containment and the auxiliary building. The PREACS consists of two independent and redundant trains. Each train consists of a heater, a prefilter or demister, a HEPA filter, an activated charcoal adsorber section for removal of gaseous activity (principally iodines), and a fan. Ductwork, valves or dampers, and instrumentation, as well as demisters, functioning to reduce the relative humidity of the air stream, also form part of the system. A second bank of HEPA filters, which follows the adsorber section, collects carbon fines and provides backup in case of failure of the main HEPA filter bank. The downstream HEPA filter, although not credited in the accident analysis, collects charcoal fines and serves as a backup should the upstream HEPA filter develop a leak. The system initiates filtered ventilation following receipt of an SI signal.

The PREACS is a standby system, parts of which may also operate during normal unit operations. During emergency operations, the PREACS dampers are realigned and fans are started to initiate filtration. Upon receipt of the actuating signal(s), normal air discharge from the penetration room is isolated, and the stream of ventilation air discharges through the system filter trains. The prefilters remove any large particles in the air, as well as any entrained water droplets, to prevent excessive loading of the HEPA filters and charcoal adsorbers. The LCO requires that two PREACS trains be operable in Modes 1, 2, 3, and 4.

Evaluation of ECCS PREACS and PREACS If one ECCS PREACS train is inoperable, the other train remains available to provide pump room air filtration. If two trains are inoperable due to an inoperable ECCS pump room boundary, a LOCA must also occur to require the operation of ECCS PREACS. The severity of the postulated accidents during shutdown modes is limited due to the slower pace of the accident event progression and increased time for operator actions and mitigation strategies.

If one PREACS train is declared inoperable, the other train remains available to provide penetration room air filtration. If two PREACS trains are inoperable due to an inoperable penetration room boundary, a LOCA and passive failure in the penetration room must occur to require air filtration.

A LOCA is less likely to occur during shutdown modes because the following are significantly reduced or eliminated: energy contained within the reactor pressure boundary, reactor coolant temperature and pressure, and the corresponding stresses. Therefore, sufficient defense-in-depth is maintained when the end state is changed from Mode 5 to Mode 4.

Therefore, the NRC staff finds the proposed change to revise TS 3.7.12 Required Action C.2 and TS 3.7.14 Required Action C.2 so that the plant would be allowed to remain in Mode 4 to be acceptable.

TS 3.7.13 Fuel Building Air Cleanup System (FBACS)

The FBACS filters airborne radioactive particulates from the area of the fuel pool following a fuel handling accident or a LOCA. The FBACS, in conjunction with other normally operating systems, also provides environmental control of temperature and humidity in the fuel pool area.

The FBACS consists of two independent and redundant trains. Each train consists of a heater, a prefilter or demister, a HEPA filter, an activated charcoal adsorber section for removal of gaseous activity (principally iodines), and a fan. Ductwork, valves or dampers, and instrumentation also form part of the system, as well as demisters, functioning to reduce the relative humidity of the airstream. A second bank of HEPA filters follows the adsorber section to collect carbon fines and provide backup in case the main HEPA filter bank fails. The downstream HEPA filter is not credited in the analysis, but serves to collect charcoal fines, and to backup the upstream HEPA filter should it develop a leak. The system initiates filtered ventilation of the fuel handling building following receipt of a high radiation signal.

The FBACS is a standby system, parts of which may also be operated during normal plant operations. Upon receipt of the actuating signal, normal air discharge from the building is isolated, and the stream of ventilation air discharges through the system filter trains. The prefilters or demisters remove any large particles in the air and any entrained water droplets present to prevent excessive loading of the HEPA filters and charcoal adsorbers. The LCO requires that two FBACS trains be operable in Modes 1, 2, 3, 4, and during movement of recently irradiated fuel assemblies in the fuel building.

If one FBACS train is inoperable, the other train remains available to provide fuel building air filtration. If two FBACS trains are inoperable, a LOCA or fuel handling accident must also occur to require operation of the FBACs. LOCAs are less likely in Mode 4 and Required Action E.1 reduces the probability of a fuel handling accident. Therefore, sufficient defense-in-depth is maintained when the end state is changed from Mode 5 to Mode 4.

The NRC staff finds the proposed change to revise Required Action C.2 so that the plant would be allowed to remain in Mode 4 to be acceptable.

TS 3.8.1 AC Sources - Operating TS 3.8.4 DC Sources - Operating TS 3.8.7 Inverters - Operating TS 3.8.9 Distribution Systems - Operating AC Sources: The Class 1E AC electrical power distribution system AC sources consist of the offsite power sources (preferred power sources, normal and alternates), and the onsite standby power sources (Train A and Train B diesel generators (DGs)). The AC electrical power system provides independent and redundant sources of power to the ESF system.

The onsite Class 1E AC distribution system is divided into redundant load groups (trains) so that the loss of any one group does not prevent the minimum safety functions from being performed.

Each train has connections to two preferred offsite power sources and a single DG. An offsite circuit consists of all breakers, transformers, switches, interrupting devices, cabling, and controls required to transmit power from the offsite transmission network to the onsite Class 1E ESF buses. Certain required unit loads are returned to service in a predetermined sequence in order to prevent overloading the transformer supplying offsite power to the onsite Class 1E distribution system.

After the DG has started, it will automatically tie to its respective bus after offsite power is tripped as a consequence of ESF bus undervoltage or degraded voltage, independent of or coincident with an SI signal. The DGs will also start and operate in the standby mode without

tying to the ESF bus on an SI signal alone. Following the trip of offsite power, a sequencer/an undervoltage signal strips nonpermanent loads from the ESF bus. When the DG is tied to the ESF bus, loads are then sequentially connected to its respective ESF bus by the automatic load sequencer. The sequencing logic controls the permissive and starting signals to motor breakers to prevent overloading the DG by automatic load application.

In Modes 1, 2, 3, and 4, the TS LCO 3.8.1 requires (1) two qualified circuits between the offsite transmission network and the onsite Class 1E AC electrical power distribution system, (2) two diesel generators (DGs) capable of supplying the onsite Class 1E power distribution subsystem(s), and (3) automatic load sequencers for Train A and Train B.

Direct current (DC) Sources: The station DC electrical power system provides the AC emergency power system with control power. It also provides both motive and control power to selected safety related equipment and preferred AC vital bus power (via inverters). The DC electrical power system is designed to have sufficient independence, redundancy, and testability to perform its safety functions, assuming a single failure. The typical DC electrical power system also conforms to the recommendations of RG 1.6, Independence between Redundant Standby (Onsite) Power Sources and Between Their Distribution Systems (Safety Guide 6).

The typical 125/250 Volts DC (VDC) electrical power system consists of two independent and redundant safety related Class 1E DC electrical power subsystems (Train A and Train B). Each subsystem consists of two 125 VDC batteries (each battery 50 percent capacity), the associated battery charger(s) for each battery, and all the associated control equipment and interconnecting cabling.

The typical 250 VDC source is obtained by the use of the two 125 VDC batteries connected in series. Additionally there is one spare battery charger per subsystem, which provides backup service in the event that the preferred battery charger is out of service. If the spare battery charger is substituted for one of the preferred battery chargers, then the requirements of independence and redundancy between subsystems are maintained.

During normal operation, the 125/250 VDC load is powered from the battery chargers with the batteries floating on the system. In case of loss of normal power to the battery charger, the DC load is automatically powered from the station batteries.

This LCO requires that the Train A and Train B DC electrical power subsystems be operable in Modes 1, 2, 3, and 4.

Inverters: The function of the inverter is to convert DC to AC. Through use of an inverter, the station batteries can provide AC electrical power to the vital buses. The inverters can be powered from an AC source or from the station battery. The station battery provides an uninterruptible power source for the instrumentation and controls for the reactor protection system (RPS) and the ESFAS.

The four (two per train) inverters are designed to provide the required capacity, capability, redundancy, and reliability to ensure the availability of necessary power to the RPS and ESFAS instrumentation and controls so that the fuel, RCS, and containment design limits are not exceeded. The LCO requires that the Train A and Train B inverters be operable in Modes 1, 2, 3, and 4.

Distribution systems: The onsite Class 1E AC, DC, and AC vital bus electrical power distribution systems are divided by trains into two redundant and independent AC, DC, and AC vital bus electrical power distribution subsystems.

The AC electrical power subsystem for each train consists of a primary ESF 4.16 kV bus and secondary 480 and 120 V buses, distribution panels, motor control centers and load centers.

Each 4.16 kV ESF bus has at least one separate and independent offsite source of power as well as a dedicated onsite DG source. Each 4.16 kV ESF bus is normally connected to a preferred offsite source. After a loss of the preferred offsite power source to a 4.16 kV ESF bus, a transfer to the alternate offsite source is accomplished by utilizing a time delayed bus undervoltage relay. If all offsite sources are unavailable, the onsite emergency DG supplies power to the 4.16 kV ESF bus. Control power for the 4.16 kV breakers is supplied from the Class 1E batteries.

The secondary AC electrical power distribution subsystem for each train includes the safety related buses, load centers, motor control centers, and distribution panels shown in Table B 3.8.9-1 of NUREG-1431, Volume 2 (Reference 11). The 120 VAC vital buses are arranged in two load groups per train and are normally powered from the inverters. The alternate power supply for the vital buses are Class 1E constant voltage source transformers powered from the same train as the associated inverter. The DC electrical power distribution subsystem consists of 125 V bus(es) and distribution panel(s).

This LCO requires that Train A and Train B AC, DC, and AC vital bus electrical power distribution subsystems to be operable in Modes 1, 2, 3, and 4.

Evaluation of AC Sources, DC Sources, Inverters, and Distribution Systems The final SE for NEI TR WCAP-16294, Table 3.2.1, shows that the CDP decreases slightly when the unit is cooled down to Mode 4 instead of Mode 5 for each condition in TS 3.8.1, TS 3.8.4, TS 3.8.7, and TS 3.8.9.

For TS 3.8.1, two trains of DGs are available if two offsite power circuits are inoperable and two offsite power circuits are available if two DGs are inoperable. If an offsite power circuit and/or a DG are inoperable, at least one of each remains available. For TS 3.8.4, there are two redundant trains of DC power; so if one is inoperable, the other is available to provide the necessary DC power. For TS 3.8.7, there are two redundant trains of inverters; so if one is inoperable, the other train is available to provide the necessary AC power.

The slower nature of event progression during shutdown modes provides increased time for operator actions and mitigation strategies if an event were to occur. In addition, some events are less likely to occur during shutdown modes. Therefore, sufficient defense-in-depth is maintained when the end state is changed from Mode 5 to Mode 4.

The NRC staff finds the proposed change to revise TS 3.8.1 Required Action G.2, TS 3.8.4 Required Action D.2, TS 3.8.7 Required Action B.2, and TS 3.8.9 Required Action D.2 so that the plant would be allowed to remain in Mode 4 to be acceptable.

Mode 4 Secondary Side Steam Pressure TR WCAP-16294 indicates that while in Mode 4, the secondary side steam pressure will be less than normal operating pressure. The TR applicant determined that there will be sufficient pressure available to operate the turbine driven AFW pumps. This will assure the defense-in-depth will remain available while remaining in Mode 4. The NRC staff finds the change acceptable.

3.2 Risk Evaluation

[LICENSEE] stated in its application that the information in the Westinghouse TR WCAP-16294 and Traveler TSTF-432 are applicable to [PLANT]. As stated in Section 2.0 above, the NRC staff reviewed TR WCAP-16294 using SRP Chapters 19.2 and 16.1, and the five key principles of risk-informed decision making presented in RG 1.174 and RG 1.177. The NRC staff finds the risk evaluation as discussed in the NRC staffs final SE for NEI TR WCAP-16294 (Reference 10) is applicable to [PLANT], and therefore the risk evaluation to be acceptable.

3.3 TS Bases Changes TSTF-432, Revision 1, included the following TS Bases changes:

A reference to the NRC-approved TR WCAP-16294 has been added to the reference section of the TS Bases for each TS affected in TSTF-432.

The following statement was added to each TS Bases Action section affected:

Remaining within the Applicability of the LCO is acceptable to accomplish short duration repairs to restore inoperable equipment because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. [ ]). In MODE 4 the steam generators and residual heat removal system are available to remove decay heat, which provides diversity and defense in depth. As stated in Reference [ ], the steam turbine driven auxiliary feedwater pump must be available to remain in MODE 4. Should steam generator cooling be lost while relying on this Required Action, there are preplanned actions to ensure long-term decay heat removal.

Voluntary entry into MODE 5 may be made as it is also acceptable from a risk perspective.

[LICENSEE] proposed TS Bases changes are consistent with the Commission's Final Policy Statement on Technical Specifications Improvements for Nuclear Power Reactors, dated July 2, 1993 (58 FR 39132).

3.4 Summary The NRC staff has reviewed the [LICENSEE] proposed adoption of TSTF-432, Revision 1, to modify the TS requirements to permit an end state of hot shutdown mode with the implementation of TR WCAP-16294 and found the changes to be consistent with the approved TR.

4.0 STATE CONSULTATION

{NOTE: Per LIC-101, the PM is responsible for contacting the state official and verifying that this statement is correct.}

In accordance with the Commission's regulations, the [Name of State] State official was notified of the proposed issuance of the amendment. The State official had [no] comments. [If comments were provided, they should be addressed here].

5.0 ENVIRONMENTAL CONSIDERATION

{NOTE: Caution per LIC-101: The environmental consideration discussed below is written for a categorical exclusion based on 10 CFR 51.22(c)(9). The PM is responsible to ensure that this is accurate for the specific amendment being issued.}

The amendments change a requirement with respect to installation or use of a facility component located within the restricted area as defined in 10 CFR Part 20. The NRC staff has determined that the amendments involve no significant increase in the amounts, and no significant change in the types, of any effluents that may be released offsite, and that there is no significant increase in individual or cumulative occupational radiation exposure. The Commission has previously issued a proposed finding that the amendments involve no significant hazards consideration, and there has been no public comment on such finding

([ ] FR [ ]). Accordingly, the amendments meet the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9). Pursuant to 10 CFR 51.22(b) no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendments.

6.0 CONCLUSION

The Commission has concluded, based on the considerations discussed above, that: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendments will not be inimical to the common defense and security or to the health and safety of the public.

7.0 REFERENCES

1. TSTF-432, Revision 1, Change in Technical Specifications End States WCAP-16294, dated November 29, 2010. (ADAMS Accession No. ML103360003)

2. WCAP-16294-NP-A, Risk-Informed Evaluation of Changes to Technical Specification Required Action Endstates for Westinghouse NSSS PWRs, June 2010. (ADAMS Accession No. ML103430249)

3. NUREG-1431, Volume 1, Revision 3.0, Standard Technical Specifications Westinghouse Plants, Specifications, US NRC, June 2004. (ADAMS Accession No. ML041830612)

4. Regulatory Guide 1.174, Revision 1, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, US NRC, November 2002. (ADAMS Accession No. ML023240437)

5. Regulatory Guide 1.177, An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications, US NRC, August 1998. (ADAMS Accession No. ML003740176)

6. Regulatory Guide 1.182, Assessing and Managing Risk before Maintenance Activities at Nuclear Power Plants, US NRC, May 2000. (ADAMS Accession No. ML003699426)

7. NUMARC 93-01, "Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants," Section 11, Assessment of Risk Resulting From Performance of Maintenance Activities, dated February 22, 2000. (ADAMS Accession No. ML003704489)

8. NUREG-0800, Standard Review Plan, Section 19.2, Review of Risk Information Used to Support Permanent Plant-Specific Changes to the Licensing Basis: General Guidance, June 2007. (ADAMS Accession No. ML071700658)

9. NUREG-0800, Standard Review Plan, Section 16.1, Risk-Informed Decision Making:

Technical Specifications, Revision 1, March 2007. (ADAMS Accession No. ML070380228)

10. Final Safety Evaluation of NEI Topical Report WCAP-16294-NP, Revision 0, Risk-Informed Evaluation of Changes to Technical Specification Required Endstates for Westinghouse NSSS PWRs, dated March 29, 2010. (ADAMS Package Accession No. ML100820533)

11. NUREG-1431, Volume 2, Revision 3.0, Standard Technical Specifications Westinghouse Plants, Bases, US NRC, June 2004. (ADAMS Accession Package No. ML041830205)

Principle Contributors: A. Howe K. Bucholtz Date:

ML112991526

Contents

Text

1.0 INTRODUCTION

2.0 REGULATORY EVALUATION

3.0 TECHNICAL EVALUATION

4.0 STATE CONSULTATION

5.0 ENVIRONMENTAL CONSIDERATION

6.0 CONCLUSION

7.0 REFERENCES

Navigation menu

ML112991526

Text

1.0 INTRODUCTION

2.0 REGULATORY EVALUATION

3.0 TECHNICAL EVALUATION

4.0 STATE CONSULTATION

5.0 ENVIRONMENTAL CONSIDERATION

6.0 CONCLUSION

7.0 REFERENCES

Navigation menu

Search