Text

Proposed License Amendment Request Regarding Temporary Service Water Jumper to the Component Cooling Heat Exchangers
	ML12279A282
Person / Time
Site:	Surry
Issue date:	09/26/2012
From:	Lane N; Virginia Electric & Power Co (VEPCO)
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	12-615
	Download: ML12279A282 (90)
	v • d • e

10CFR50.90 VIRGINIA ELECTRIC AND POWER COMPANY RICHMOND, VIRGINIA 23261 September 26, 2012 U.S. Nuclear Regulatory Commission Serial No.12-615 Attention: Document Control Desk SPS LIC/CGL R1 Washington, D.C. 20555 Docket Nos. 50-280/281 License Nos. DPR-32/37 VIRGINIA ELECTRIC AND POWER COMPANY SURRY POWER STATION UNITS I AND 2 PROPOSED LICENSE AMENDMENT REQUEST REGARDING TEMPORARY SERVICE WATER JUMPER TO THE COMPONENT COOLING HEAT EXCHANGERS Pursuant to 10CFR50.90, Virginia Electric and Power Company (Dominion) requests license amendments, in the form of license conditions and changes to the Technical Specifications (TS) to Facility Operating License Numbers DPR-32 and DPR-37, for Surry Power Station Units 1 and 2, respectively. The proposed amendments establish the requirements for the use of a temporary supply line (jumper) to provide service water (SW) to the component cooling heat exchangers (CCHXs). Use of the temporary SW jumper is required to facilitate planned maintenance activities (i.e., cleaning, inspection, repair (as needed), and recoating (as needed)) on the existing, single, concrete-encased SW supply piping to the CCHXs. The supporting probabilistic risk assessment (PRA) for use of the jumper and the associated allowed outage time changes concluded that the impact is characterized as "small" consistent with Regulatory Guide (RG) 1.174 and is within the acceptance criteria of RG 1.177. provides a description and evaluation of the proposed change, as well as a discussion of the supporting PRA. Documentation of the technical adequacy of the PRA model is provided in Attachment 4. The marked-up and proposed pages for the Operating Licenses, TS, and TS Bases are provided in Attachments 2 and 3, respectively. The TS Basis changes are provided for NRC information only.

We have evaluated the proposed amendment and have determined that it does not involve a significant hazards consideration as defined in 10CFR50.92. The basis for this determination is included in Attachment 1. We have also determined that operation with the proposed change will not result in any significant increase in the amount of effluents that may be released offsite or any significant increase in individual or cumulative occupational radiation exposure. Therefore, the proposed amendment is eligible for categorical exclusion from an environmental assessment as set forth in 10CFR51.22(c)(9). Pursuant to 10CFR51.22(b), no environmental impact statement or environmental assessment is needed in connection with the approval of the proposed change. The proposed TS change has been reviewed and approved by the Facility Safety Review Committee.

D~oo

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Page 2 of 3 The planned maintenance on the SW piping to the CCHXs is scheduled to begin during the Fall 2013 Unit 1 refueling outage. Please note that extensive pre-outage work is required to support the maintenance activities. Dominion requests NRC approval of the proposed license amendments by September 30, 2013 (with a 30-day implementation period) to support the planned outage maintenance activities.

If you have any questions or require additional information, please contact Ms. Candee Lovett at (757) 365-2178.

Very truly yours, N. L. Ia Surry Power Station Site Vice President Attachments:

1. Discussion of Change

2. Marked-up Operating License, Technical Specifications, and Technical Specifications Basis Pages

3. Proposed Operating License, Technical Specifications, and Technical Specifications Basis Pages

4. Technical Adequacy of the Probabilistic Risk Assessment Model Commitments made in this letter: None COMMONWEALTH OF VIRGINIA )

)

COUNTY OF SURRY )

The foregoing document was acknowledged before me, in and for the County and Commonwealth aforesaid, today by N. L. Lane, who is Site Vice President, of Virginia Electric and Power Company. He has affirmed before me that he is duly authorized to execute and file the foregoing document in behalf of that Company, and that the statements in the document are true to the best of his knowledge and belief.

Acknowledged before me this Z0 day of *-eL " ,2012.

My Commission Expires: *O 20)

W , O 5tt L0

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Page 3 of 3 cc: Region IIAdministrator U.S. Nuclear Regulatory Commission Marquis One Tower 245 Peachtree Center Avenue, NE Suite 1200 Atlanta, GA 30303-1257 State Health Commissioner Virginia Department of Health James Madison Building - 7th floor 109 Governor Street, Suite 730 Richmond, Virginia 23219 Ms. K. R. Cotton NRC Project Manager Surry U.S. Nuclear Regulatory Commission One White Flint North Mail Stop 08 G-9A 11555 Rockville Pike Rockville, MD 20852-2738 Dr. V. Sreenivas NRC Project Manager North Anna U.S. Nuclear Regulatory Commission One White Flint North Mail Stop 08 G-9A 11555 Rockville Pike Rockville, MD 20852-2738 NRC Senior Resident Inspector Surry Power Station

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs ATTACHMENT 1 DISCUSSION OF CHANGE VIRGINIA ELECTRIC AND POWER COMPANY (DOMINION)

SURRY POWER STATION UNITS I AND 2

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 DISCUSSION OF CHANGE TABLE OF CONTENTS 1.0 Introduction

2.0 Background

2.1 Licensing Basis 2.1.1 Previous Use of the Temporary Service Water Jumper 2.1.2 Applicable Technical Specifications 2.1.3 Non-essential Service Water Isolation 2.2 Design 2.2.1 Design Basis 2.2.2 Design of the Temporary Service Water Jumper 3.0 Specific Changes 4.0 Safety Significance 4.1 Analysis of Existing Structures, Systems, and Components Affected 4.2 Analysis of Safety Implications of the Proposed Action 4.2.1 Service Water System 4.2.2 Component Cooling Water System 4.2.3 Loss of Temporary Service Water Jumper 4.3 Contingency Action Plan 4.4 Controls on the Movement of Heavy Loads 5.0 Summary of Project Constraints and Compensatory Measures 6.0 Probabilistic Risk Assessment 6.1 Purpose 6.2 Scope of the Probabilistic Risk Assessment and PRA Modeling 6.3 PRA Risk Assessment Modeling 6.4 Assumptions in Allowed Outage Time (AOT) 6.5 Sensitivity and Uncertainty Analysis 6.6 Method of RG 1.177 Tier 1 Analysis 6.7 RG 1.177 Tier 2: Avoidance of Risk Significant Plant Configurations 6.8 RG 1.177 Tier 3: Risk-informed Plant Configuration Control and Management 6.9 PRA Conclusions 7.0 No Significant Hazards Consideration 8.0 Environmental Assessment 9.0 Conclusion Page 1 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 DISCUSSION OF CHANGE

1.0 INTRODUCTION

Virginia Electric and Power Company (Dominion) has been cleaning, inspecting, repairing, and recoating the Service Water (SW) System piping at Surry Power Station for a number of years. As part of the response to Generic Letter (GL) 89-13, the SW piping restoration project began in the fall of 1990, and piping subsections have been restored during various refueling outages. The SW supply piping to the Component Cooling Heat Exchangers (CCHXs) will be addressed during two consecutive upcoming Unit 1 refueling outages. To allow continued operation of the required number of CCHXs during maintenance activities on the SW supply line, Operating License Conditions and Technical Specifications changes are necessary to permit the use of an alternate temporary SW supply line.

Service water is supplied to the CCHXs by a single concrete-encased line. To remove the SW supply line from service for extended maintenance, an alternate temporary SW supply path is required to support the operation of the CCHXs and to permit access to the existing piping for the pipe restoration work to be accomplished. The alternate SW supply line (temporary jumper) will be installed as a safety-related and seismic system, but it will not be completely missile protected over its entire length.

The temporary SW jumper may be used for up to 35 days during two consecutive upcoming Unit 1 refueling outages to complete the currently planned pipe maintenance activities. Compensatory measures (including a contingency action plan) will be put into place to effectively eliminate the possibility of a loss of SW flow to the CCHXs. The conditional use of the temporary SW jumper in conjunction with the compensatory measures described herein will be documented in the Operating Licenses for Surry Units 1 and 2 as a License Condition, as well as in the Technical Specifications and Basis. The maintenance activities are currently planned to be performed during each of the scheduled Unit 1 refueling outages in 2013 and 2015.

2.0 BACKGROUND

The SW piping at Surry Power Station is constructed of carbon steel piping that was originally coated on the internal wall with a coal tar epoxy coating. The original coal tar epoxy coating on the SW piping to the CCHXs has been replaced with Chesterton ARC epoxy coating. Over the years of operation, the coating has experienced failures which exposed the pipe wall to brackish water and caused general corrosion of the exposed pipe. As part of the response to GL 89-13, Surry initiated a long-term project for SW Page 2 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 pipe restoration in 1990. The objectives of the overall project are to repair any degraded sections of pipe, minimize corrosion, and prolong the remaining service life of the piping system.

The SW supply piping to the CCHXs is scheduled to be cleaned, inspected, repaired (as needed), and recoated (as needed) during two consecutive upcoming Unit 1 refueling outages. The CCHXs are shared by both units at Surry and are supplied through one flow path. The CCHXs are continuously required to cool unit operating and/or shutdown loads and Spent Fuel Pool (SFP) cooling loads. Therefore, the common SW inlet piping to the CCHXs cannot be removed from service for cleaning, inspection, repair, and recoating without providing an alternate source of cooling water.

Based on past inspections of the CCHX SW inlet piping and SW piping of similar service life (e.g., Bearing Cooling Heat Exchanger supply piping), the corrosion found in these piping sections where coating failures have occurred has been general in nature with some localized pitting. The pitting has not been considered significant due to the system operating conditions (i.e., low temperature and pressure) of the piping.

However, restoration of the SW piping is necessary to meet the overall project objectives stated above.

To facilitate removal of the common SW inlet piping to the CCHXs from service, a temporary, alternate SW flow path (jumper) must be provided. The temporary jumper will serve as the safety-related SW supply with sufficient flow to two CCHXs to cool the heat loads from Unit 1, which include Residual Heat Removal (RHR) and SFP cooling, and Unit 2 operating loads, as well as Unit 2 shutdown cooling, if required. Approval of the use of the jumper is requested for a maximum of 35 days during each of the Unit 1 refueling outages scheduled for 2013 and 2015.

The general sequence of activities for the project is as follows (Figure 1):

1) Install the SW jumper from the "C" Circulating Water (CW) supply piping to the "A" and "B" CCHX inlets.

2) Remove "A" and "B" CCHXs from service. Remove the CCHX inlet expansion joints at valves 1-SW-37 and 1-SW-33 and blank the piping at the valve outlets/CCHX inlets to isolate the "A" and "B" CCHXs from the normal SW supply.

3) Place the jumper in service.

4) Stop log, blank, and de-water "B" and "D" inlet bays and 96-inch CW piping. Drain the SW piping to be cleaned, inspected, repaired, and recoated.

Note: Flooding protection and personnel safety will be provided by requiring double isolation for system boundaries which present a significant source of water. Only one SW supply motor-operated valve (MOV) will be removed at any one time. The inlet bay on the flow path to the removed MOV will be stop logged and blanked to provide double isolation. Only the inlet bay on the flow path to the installed MOV will Page 3 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 be stop logged, with the closed MOV acting as the second barrier. The alignment is reversed to access and clean/inspect/repair/recoat the piping upstream of the previously installed MOV. Passive boundaries which have no credible failure mechanism through inadvertent operation or significant leakage may have single isolation (e.g., blanked pipe).

5) Clean pipe wall of marine growth, inspect the pipe, perform weld repair (as needed),

and recoat (as needed).

6) Restore the normal SW supply and remove the jumper from service. The remainder of the pipe maintenance will be performed during the next Unit 1 refueling outage.

During the second Unit 1 refueling outage, the general sequence will be similar to the above.

While the jumper is in service, the SW supply MOVs in the normal CCHX SW supply line will be taken out of service to support the repair work. These valves receive an isolation signal to close and conserve Intake Canal inventory on low Intake Canal level. Removing the valves from service defeats the normal supply line automatic isolation feature of the normal SW flow supply line to the CCHXs during the repair work. However, this feature will not be required since the line will either be isolated or under strict administrative control to ensure isolation in accordance with the procedural requirements for a loss of Intake Canal inventory throughout the duration of the piping repairs. The alternate supply line will also not be provided with automatic isolation features since this function can be accomplished by manual operator action. Adequate time is available for manual operator action to meet safety analysis assumptions. The functional equivalent of the MOVs during jumper operation will be the installed manual isolation valve controlling jumper flow; since this valve will be operated under administrative (manual) control, this represents replacing automatic isolation of the non-essential SW to the CCHXs with manual action. Manual action to isolate non-essential SW to the CCHXs has been previously approved by the NRC and is discussed further in the Licensing Basis section below.

Intake bays "B" and "D" will be de-watered during most of the project implementation.

These bays are the locations of two of the four Intake Canal level probes. The signal from these probes is used to trip both units' turbines and close CW and non-essential SW valves to conserve water in the Intake Canal for use during design basis accidents.

The instrumentation has two logic channels, either of which will provide the actuation signal if three out of four canal probes indicate low level in the Intake Canal. If Unit 1 "B" and "D" bays are de-watered, their level probes will be inoperable and placed in trip.

The resulting condition is such that only one of the remaining two operable probes is required to trip to produce the actuation signal. Technical Specification 3.7 allows only one canal probe to be inoperable/tripped; consequently, a Technical Specifications Page 4 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 change is required to allow a second probe to be tripped while the jumper is in service as the sole SW supply to the CCHXs.

2.1 Licensing Basis 2.1.1 Previous Use of the Temporary Service Water Jumper Virginia Electric and Power Company previously requested NRC approval to use a temporary SW supply jumper to the CCHXs in the following two instances:

1) In a February 23, 1988 letter (Serial No.88-045), use of a jumper was requested to facilitate the replacement of the CCHX SW supply isolation valves (MOV-SW-102A and B) and the CCHX inlet valves (1-SW-25, 29, 33, and 37)

(Figure 1). In this case, the temporary jumper was non-seismic and was only allowed to be used for two periods of up to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months each while Unit 2 was in operation. The NRC approved the use of the temporary jumper by enforcement discretion in their letter dated March 30, 1988.

2) In a June 19, 1998 letter (Serial No.98-327) with clarification provided in a July 14,1998 letter (Serial No.98-396), use of a temporary SW jumper to the CCHXs was requested to allow cleaning, inspecting, repairing, and recoating of the SW suction piping to the CCHXs. In this case, use of the safety-related, seismic, and partially missile protected alternate SW supply line was requested for up to 35 days during two consecutive Unit 1 refueling outages. The NRC issued TS Amendments 216/216 approving this request on August 26, 1998. The TS change request in this letter is essentially identical to the NRC-approved 1998 request and, unlike the 1998 request, is supported by a probabilistic risk assessment.

2.1.2 Applicable Technical Specifications

. TS Table 3.7-2, Item 5, Non-Essential Service Water Isolation:

This item specifies the channel requirements (i.e., total number of channels, minimum operable channels, channels to trip, and operator actions) for non-essential service water isolation on low intake canal level. A note is being added to this item as discussed in Section 3.0 below to permit continued operation with two channels in trip while the temporary jumper is in use. Adequate protection (i.e., single failure criterion met) will be maintained to initiate a Unit 2 trip should a low Intake Canal level condition occur.

Page 5 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1

TS 3.7 Basis, Non-essential Service Water Isolation System:

This section notes that..."The operability of this functional system ensures that adequate intake canal inventory can be maintained by the Emergency Service Water Pumps." Maintenance of this function relative to the temporary SW jumper is discussed below.

TS 3.13 Component Cooling System:

Technical Specification 3.13 requires two CCW pumps and heat exchangers to be operable for one unit operation. For two unit operation, three CCW pumps and heat exchangers are required to be operable. The Technical Specification only allows one of the required components to be inoperable for up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months before the unit(s) is required to be shut down. Furthermore, RHR and SFP cooling require CCHX operation when both units are shutdown. Consequently, the single SW supply line to the CCHXs cannot be isolated without first providing an alternate means of cooling. The installation of the temporary SW jumper will provide the necessary SW supply to maintain CCHX operability as required by TS 3.13.

" TS 3.14 Circulating and Service Water Systems:

TS 3.14.A.2: "Unit subsystems, including piping and valves, shall be operable to the extent of being able to establish the following: . . . b. Flow to and from the component cooling heat exchangers required by Specification 3.13." Installation of the temporary SW jumper will satisfy this Technical Specification requirement.

TS 3.14 Basis: "A minimum level of +17.2 feet in the High Level Intake Canal is required to provide design flow of Service Water through the Recirculation Spray heat exchangers during a loss-of-coolant accident for the first 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . If the water level falls below +23' 6", signals are generated to trip both unit's turbines and to close the non-essential Circulating and Service Water valves." Maintenance of this function relative to the temporary SW jumper is discussed below.

2.1.3 Non-essential Service Water Isolation The automatic isolation of the SW supply MOVs to the CCHXs will be defeated during the time period that the jumper is in service. Defeating the non-essential SW automatic isolation function will not affect SW flow to/from the CCHXs; therefore, compliance with TS 3.14.A.2 will be maintained. The Technical Specifications do not explicitly address the operability requirements for the non-essential SW automatic isolation function.

However, the Bases sections of Technical Specifications 3.7 and 3.14 describe this Page 6 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 function and indicate that it is a required actuation. The use of operator (manual) action to isolate the CCHX SW supply line has been previously submitted for NRC review and approval in our letter dated March 27, 1989 (Serial No.89-466). This submittal addressed several design issues associated with the SW System and High Level Intake Canal (HLIC) management. Operator action was determined to be necessary to isolate non-essential SW within 60 minutes, including SW to the CCHXs, to conserve Intake Canal inventory under certain design basis accident (DBA) conditions or a loss of offsite power.

The Technical Specifications and Bases were revised by Amendment Nos. 130/130, dated June 19, 1989, to address the design issues noted above. The NRC's Safety Evaluation Report (SER) associated with these amendments acknowledged that there were potential single failure issues related to HLIC level drawdown during a loss of coolant accident coincident with a loss of offsite power. The possible single failure issues included "a failure to close any one of the isolation valves to heat exchangers not essential for post-DBA heat removal. To resolve this issue, emergency operating procedures (EOPs) were revised for operation of ESW pumps and SW heat exchangers, and require manual confirmation/action for closing specific SW isolation valves." The SER also states that, "the minimum required HLIC level [was increased] to support SW heat exchanger flow by allowing for automatic and operator action times to isolate Non-essential SW system flowpaths."

Consistent with this position, should non-essential SW isolation be required in the event of a loss of Intake Canal level during the time the temporary SW jumper is in service, the installed manual isolation valve in the SW pipe jumper will be under administrative control 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months s/day; the operator assigned to the administrative control will be directed to close the valve and isolate the SW flow to the CCHXs to conserve Intake Canal inventory. The operator will maintain close communication with the control room by hand-held radio, sound-powered phones, or other suitable communication device. Changes to station abnormal procedures will implement this manual operator action. The administrative controls that will be established for the subject maintenance activity, in conjunction with the applicable Station Abnormal Procedures, will ensure that the non-essential SW isolation function can be initiated manually within the allowable design basis time frame (60 minutes). Furthermore, as noted above, the use of manual action in place of the non-essential SW automatic isolation actuation is consistent with the licensing and design bases that were reviewed and approved by the NRC with the issuance of Surry Units 1 and 2 Technical Specifications Amendment Nos. 130/130.

As previously discussed, this project will require that both Unit 1 "B" and "D" intake bays be de-watered, placing two of the four Intake Canal level probes in trip. The protective function is assured using one out of two signals to actuate from the remaining two Unit 2 level probes through two logic channels. Thus, the single failure criterion is Page 7 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 preserved. There is an increased probability of a spurious trip of Unit 2 in this condition; however, the brief time in this condition and the reliability of the Intake Canal level probes supports the conclusion that this is acceptable for Unit 2 operation.

2.2 Design 2.2.1 Design Basis The CC Water System is an intermediate cooling system that transfers heat from heat exchangers containing reactor coolant or other radioactive liquids to the SW System.

Four heat exchangers are located in the Unit 1 Turbine Building basement and serve both units' cooling requirements. Each heat exchanger is designed to remove the entire heat load from one unit plus half of the heat load common to both units during normal operation.

Cooling water for the CCHXs is SW from the Unit 1 "B" and "D" Circulating Water (CW) inlet piping by gravity flow (Figure 1). Each source of SW is controlled by a SW supply isolation MOV upstream of a common supply line to the four CCHXs. These SW MOVs receive a signal to isolate SW supply to the CCHXs to conserve Intake Canal inventory to meet design basis accident requirements. The common SW piping is 42-inch carbon steel with 1/2-inch wall, coated with Chesterton ARC epoxy. Individual lines to each heat exchanger are 30-inch carbon steel pipe with the same wall thickness and coating.

The SW supply piping is concrete encased beneath the Turbine Building basement floor, except in the SW MOV valve pits, the manway in the 42-inch piping, and at the CCHXs where they emerge to connect to the heat exchangers. The major SW System valves in the supply piping are butterfly valves. The SW supply piping and components are designed for low pressure and low temperature operating conditions.

The major heat loads on the CC Water System are the RHR System during cooldown and shutdown conditions, SFP Cooling System, Reactor Coolant Pump (RCP) Motor coolers, Chemical and Volume Control System (cooling letdown flow), RCP Seal Water, Containment Cooling, and Neutron Shield Tank cooling.

The CCHXs serve no design basis accident (DBA) mitigating function. During a postulated DBA with a loss of offsite power, the CC Water System is assumed to be out of service for the time required to restore power to the CC pumps. The system can then be restored to initiate a cooldown of the non-accident unit. Throttling of SW to the CCHXs may be required, in accordance with station abnormal procedures, to maintain Intake Canal inventory. Although the CCHXs are not required for accident mitigation, a reliable source of cooling water is required to provide a heat sink for the spent fuel and RHR heat loads. This is to ensure an orderly shutdown of an operating unit and to maintain both units in cold shutdown.

Page 8 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 2.2.2 Design of the Temporary Service Water Jumper The temporary SW jumper is a seismic, safety-related pipe, which will be installed from the Unit 1 "C" 96-inch CW inlet piping manway to the inlet piping of the "A" and "B" CCHXs (Figure 1). The piping is uncoated, 30-inch carbon steel, standard wall pipe. The jumper configuration is flanged with butterfly valves at the inlet (1-SW-939) and at the "A" and "B" CCHXs supply connections. The design pressure and temperature ranges for this piping are 25 psig (10 to 15 psig, normal) and 32 0 F to 80°F, respectively. The line is sized to deliver adequate cooling water flow to two CCHXs to remove design basis heat loads. The jumper will be in service during times of the year when SW supply temperatures are at or below 80°F to provide additional margin for heat transfer capability under tubesheet fouling conditions. Use of the jumper with SW supply temperature greater than 80°F is not permitted.

The safety-related function of the jumper is to provide the system pressure boundary to deliver cooling water flow to the CCHXs while precluding flooding. Although the CCHXs are not required for accident mitigation, a reliable source of cooling water is required to ensure a heat sink for operational heat loads, residual heat loads, and spent fuel heat loads.

UFSAR Section 14.2.13, titled Likelihood of Turbine-Generator Unit Overspeed, states that a turbine missile can be generated by a rotor fracture releasing fragments capable of causing significant damage. The UFSAR discusses the features of the Alstom rotor design that contribute to the elimination of the risk of rotor fracture and discusses the probability of rotor fracture. The Alstom Power methodology for the missile generation probability calculations applicable for Surry is consistent with the NRC requirements included in NUREG-0800 for turbine missile generation probability calculations.

UFSAR Section 14.2.13 concludes that the probability of missile generation is so low that it can be discounted.

The information regarding tornado activity in Surry County, Virginia between 1950 and 1995 provided in the June 19, 1998 letter (Serial No.98-327) is updated herein based on information also obtained from the National Climatic Data Center (Storm Events).

Since 1995, there have been four reported tornados in Surry County. Three of these tornados occurred in the vicinity of Claremont, Virginia, which is approximately 17 miles from Surry Power Station; these tornados occurred on August 30, 2004 (F magnitude),

May 23, 2005 (FO magnitude), and April 28, 2008 (F1 magnitude). The fourth tornado (F3 magnitude), which occurred on April 16, 2011, struck the Surry site. The contingency action plan for the project requires that, if environmental conditions conducive to such extreme weather exist, the normal SW supply will be restored to a Page 9 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 configuration such that it can be placed into service and the jumper isolated, as required.

Surry UFSAR Section 15.2.3 states that a tornado could generate either of the following potential missiles:

1. Missile equivalent to a wooden utility pole 40' long, 12" in diameter, weighing 50 lbs. per cubic foot and traveling in a vertical or horizontal direction at 150 mph.

2. Missile equivalent to a 1 ton automobile traveling at 150 mph.

For purposes of assessing the jumper's exposure to a postulated vertical missile, the utility pole was assumed, as it is the more penetrating of the two missiles.

The total length of the jumper is approximately 223 feet, with 44 feet or 20% of the total run protected by the CCHX missile shield from a vertical utility pole missile strike. The operating floor at Elevation 58'-6" is a 9" thick reinforced concrete slab supported by steel framing. This will provide missile protection for approximately 148 feet or 66% of the total run from a vertical utility pole missile. The remaining 31 feet, or 14% of the jumper, are not protected by either the turbine floor or any other missile protection. However, there are energy absorbing interferences in the way of a direct missile hit such as steel grating, structural steel, piping, and other equipment. The elevation of the jumper is well below outside finished grade and would present a relatively small target to a missile that would have to pass through these interferences.

The possibility of damaging the SW jumper by dropping heavy loads on the piping was also considered. Appropriate controls on the movement of heavy loads will be invoked for the Turbine Building bridge crane for any lifts which pass over the SW jumper while the jumper is in service to minimize the potential for a heavy load drop. The specific controls being employed are discussed in Section 4.4 below.

The temporary SW jumper is being rigorously analyzed for stresses arising from load cases consisting of deadweight, thermal and seismic loads. The loads generated at the selected support locations will be used to evaluate conceptual support structures attached to the basement floor of the Turbine Building. Additionally, the jumper routing (Figure 2) has been walked down and inspected in accordance with the IPEEE criteria included in the guidelines provided for pipe runs in EPRI NP-6041-SL, "A Methodology for Assessment of Nuclear Power Plant Seismic Margin," Revision 1, August 1991, to assess any potential system interaction during a seismic event. No concerns were identified in this review. Additional seismic considerations are discussed in Section 4.4 below.

Page 10 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 3.0 SPECIFIC CHANGES Virginia Electric and Power Company proposes to add Operating License Conditions, temporary Technical Specifications requirements, and additional wording to the TS Basis to allow operation with the temporary SW jumper to the CCHXs for a period of up to 35 days during each of two Unit 1 refueling outages provided appropriate compensatory measures and a contingency action plan are in effect. The proposed change also allows

1) two out of four Intake Canal level channels to be in the tripped condition when the jumper is in service as the sole SW supply to the CCHXs and 2) the automatic closure feature of the SW isolation valves to the CCHXs to be defeated during the 35-day periods provided appropriate administrative controls are in place to invoke manual operator action to obtain isolation within the design basis time limit of sixty minutes.

The proposed changes are as follows:

Operating License Condition Item U is added to the Units 1 and 2 Operating Licenses:

U. As discussed in the footnote to Technical Specification 3.14.A.2.b, the use of a temporary, safety-related, seismic, not fully missile protected supply line to provide Service Water (SW) to the Component Cooling Heat Exchangers (required by Technical Specification 3.13) to facilitate maintenance activities on the existing SW supply line shall be in accordance with the basis, risk evaluation, and compensatory measures (including a Contingency Action Plan) provided in the licensee's submittal dated September 26, 2012 (Serial No.12-615).

Technical Specification Table 3.7-2 is revised as follows:

Item 5, Non-Essential Service Water Isolation - This item is revised to add a Note B to address channel operability requirements when the CCHX SW jumper is in use.

Specifically, only two operable channels are required when the SW jumper is in use since the two channels associated with the de-watered Unit 1 intake bays will be placed in trip. Therefore, only one channel is required to initiate the isolation function. Note B will be added to Item 5.a to address the different channel requirements when the temporary CCHX SW jumper is in use. The new Note B to Item 5.a is included as follows:

Note B - When the temporary Service Water supply jumper to the Component Cooling Heat Exchangers is in service in accordance with the footnote to TS 3.14.A.2.b, two low intake canal level probes will be permitted to be in the tripped condition. In this condition, two operable channels are required with Page 11 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 one channel to trip. If one of the two operable channels becomes inoperable, the operating unit must be in HOT SHUTDOWN within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

The following footnote is added to TS 3.14.A.2.b:

(*) For the purpose of cleaning, performing inspections, repairing (as needed), and recoating (as needed) associated with the Service Water (SW) supply piping to the Component Cooling Heat Exchangers (CCHXs), a temporary 30" safety-related, seismic, not fully missile protected supply line (temporary jumper) will be provided to supply SW flow to the CCHXs required by TS 3.13. The basis for using the temporary jumper is provided in Virginia Electric and Power Company's letter Serial No.12-615, dated September 26, 2012. The use of the temporary jumper is permitted two times only for a duration of up to 35 days during each of the 2013 and 2015 Unit 1 refueling outages. If non-essential SW isolation is required during the pipe maintenance activities, it will be accomplished consistent with design basis requirements by using operator (manual) action to close the SW isolation valve in the temporary jumper within the time constraints established by the Station Abnormal Procedures. If the temporary jumper becomes inoperable during either 35-day period, the requirements of Specification 3.0.1 shall apply. Upon completion of the work associated with the second 35-day period, this footnote will no longer be applicable.

The following paragraph is added to the TS 3.14 Basis in support of the temporary footnote to TS 3.14.A.2.b:

To facilitate cleaning, inspecting, repairing (as needed), and recoating (as needed) of the Service Water (SW) supply line to the Component Cooling Heat Exchangers (CCHXs), a temporary, safety-related, seismic, not fully missile protected SW supply line (temporary jumper) will be used as discussed in the temporary footnote to TS 3.14.A.2.b. The temporary jumper is required since service water is supplied to the CCHXs by a single concrete-encased line. To remove the SW supply line from service for extended maintenance (i.e., for pipe cleaning, inspection, repair, and recoating), an alternate temporary SW supply path is required to support the operation of the CCHXs during the maintenance activities. The basis for using the temporary SW supply jumper to the CCHXs is provided in Virginia Electric and Power Company's letter Serial No.12-615, dated September 26, 2012. The use of the temporary jumper is only permitted for a duration of up to 35 days during each of the 2013 and Page 12 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 2015 Unit 1 refueling outages and shall be operated in accordance with the compensatory measures (including a Contingency Action Plan) provided in the letter referenced above. The only automatic function in the normal supply line when Unit 1 is in cold shutdown or refueling shutdown is provided by the SW supply motor operated valves, which close on low Intake Canal level. If non-essential SW isolation is required during the time the jumper is in service, it will be accomplished consistent with design and licensing bases requirements by using operator (manual) action to close the SW isolation valve in the temporary jumper within the time constraints established by the Station Abnormal Procedures.

4.0 SAFETY SIGNIFICANCE The proposed Operating License Conditions, Technical Specifications changes, and Basis changes are necessary to permit work activities to be accomplished to properly maintain the SW supply to the CCHXs. The SW and CC Water Systems will function as designed under the unit operating constraints specified by the project. Although the temporary SW supply line is not fully missile protected and has an increased vulnerability to missiles or heavy loads when compared to the normal SW supply line which is encased in concrete, the project constraints, compensatory measures, and contingency action plan will ensure that an operable SW flowpath to the required number of CCHXs is provided with minimal additional risk, as discussed in Section 6.0.

4.1 Analysis of Existing Structures, Systems, and Components Affected The four CCHXs at Surry are supplied with SW from the Unit 1 "B" and "D" CW supply lines through 42 inch piping which forms a common header (Figure 1). During normal operation, the isolation valves are open and temperature control is performed by throttling the manual SW outlet valves at the individual heat exchangers during conditions when SW temperatures are low. The jumper is capable of supplying sufficient flow to the two CCHXs required for single unit operation. Use of the jumper will be limited to conditions when the maximum SW supply temperature is at or below 80 0 F. The only automatic function in the normal supply line when Unit 1 is in cold shutdown or refueling shutdown is provided by the MOVs, which close on low Intake Canal level. This function will be provided by 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months s/day administrative control of the installed manual isolation valve (1-SW-939). The appropriate Station Abnormal Procedure(s) will be revised to provide the necessary operator action instructions.

Operations personnel will be appropriately trained on the purpose of the jumper, administrative control of the installed manual isolation valve, the revised abnormal procedures, the Technical Specifications that address the use of the temporary service Page 13 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 water jumper, and on their individual responsibilities associated with the jumper, as appropriate.

Instrument channels from Intake Canal level instrumentation 1-CW-LE-102 and 1-CW-LE-103 will be placed in trip while the "B" and "D" intake bays are de-watered. This level instrumentation provides a signal on low level in the canal to trip both units' turbines and close all CW and non-essential SW valves to preserve Intake Canal inventory. Canal level probes are located in Unit 1 "B" and "D" bays and Unit 2 "A" and "C" bays. The trip logic is 3 out of 4. Placing the two Unit 1 channels in trip results in an effective 1 out of 2 trip logic. The probability of a spurious plant trip is increased; however, the reliability of the canal probes supports the conclusion that this risk is minimal. Furthermore, single active failure protection is maintained for the protective function. Prior to removing the Unit 1 "B" and "D" inlet bays from service, surveillance testing and cleaning will be performed on the Unit 2 canal level probes, and the trash racks will be cleaned.

One of the three 8" SW supply lines to the Main Control Room Chiller (MCR) condensers (in Mechanical Equipment Room 3) and the Charging Pump SW pumps branches off one of the 42" SW lines upstream of the SW supply MOVs (1-SW-MOV-102A and B) and will also be out of service during the project work. The two other SW supply lines are from diverse sources in Unit 2; therefore, these safety-related functions remain operable in accordance with Technical Specifications requirements.

Plant instrumentation for SW flow used in Surveillance Procedures to determine the heat transfer capability of a CCHX will be bypassed during implementation of the project work. Provisions will be made for appropriate instrumentation and temporary procedure changes to assess CCHX operability while the jumper is in service.

Flooding protection and personnel safety will be provided by requiring double isolation for system boundaries which present a significant source of water. Passive boundaries which have no credible failure mechanism through inadvertent operation or significant leakage may have single isolation (e.g., blanked pipe). A 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months s/day flood watch will be in effect when the jumper is in service, and an operator will be present with 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months s/day administrative control of the installed manual isolation valve and the SW MOVs in accordance with Station Procedures. (Note: These functions may be performed by the same individual.)

4.2 Analysis of Safety Implications of the Proposed Action The SW piping restoration project/temporary SW jumper and the proposed Operating License Conditions, Technical Specifications changes, and Basis changes have been Page 14 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment I evaluated to assess their impact on the normal operation of the SW and CC Water Systems and to ensure that the design basis functions of these systems are preserved.

4.2.1 Service Water System The SW System is connected to each unit's CW inlet piping and shares the Intake Canal as a common source of cooling water. However, individual loads are supplied from diverse CW and SW lines in each unit so that the system is not shared between units. In the case of the Charging Pump SW coolers and three of the Main Control Room (MCR) Chiller condensers, supply can be from Unit 1 (one supply line) or Unit 2 (two supply lines).

Portions of the SW System are required to function during normal and emergency operating conditions. Although the CCHXs are not required to mitigate any DBA function, they are continuously required to function to remove decay heat from the RHR System and the SFP. They are also required to provide cooldown capability for any operating unit. The SW piping is designed such that isolation of the supply to the CCHXs does not affect SW flows to any other safety-related heat loads. If Charging Pump SW and MCR Chiller condensers are supplied from the two Unit 2 SW supply headers, non-safety-related Turbine Building SW is isolated for Unit 1, and a temporary alternate supply of SW to the required number of CCHXs is provided, the existing SW supply piping to the CCHXs can be removed from service.

The limiting DBA condition for the SW System is a loss of coolant accident (LOCA) on one unit with simultaneous loss of offsite power to both units. In response to a LOCA, a safety injection/consequence limiting safeguards (SI/CLS) signal would open all SW valves for establishing flow to the Recirculation Spray Heat Exchangers (RSHXs) on the accident unit. When the Intake Canal level reaches approximately 23.5 ft, a signal will be generated to close the CW valves and non-essential SW valves to isolate the Intake Canal to conserve water inventory for the accident unit's RSHXs, Charging Pump SW and MCR Chiller condensers. The SW supply MOVs to the CCHXs isolate non-essential SW flow. Station Abnormal Procedures verify these valves are closed and also isolate non-essential flow paths which may remain open due to a single active failure. During the periods when the jumper is in service, the response to a limiting DBA would be the same, with the administrative-control-assigned-operator directed by procedure to close the installed manual isolation valve. It should be noted that, during the project, the SW MOV will already be closed and the flow through the jumper, until closed by manual action, is bounded by the Intake Canal inventory analysis. The analysis assumes isolation of SW to the CCHXs within one hour. At some period of time into the accident scenario, SW flow is re-established to two CCHXs to affect a cooldown of the non-accident unit. Unit 1 will be in cold shutdown or refueling shutdown; therefore, the heat removal requirements would be less than for cooldown of Page 15 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 an operating unit. The jumper is sized to provide the required flow at reduced canal level. As an option, time would be available to restore integrity to the normal 42" SW supply and flow to the CCHXs by that flow path.

If a shutdown of Unit 2 is required while the jumper is in service, the jumper will provide adequate flow to cooldown the unit to cold shutdown within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . As an alternative, the integrity of the normal 42" supply line can be restored and the SW supplied to the CCHXs by that flow path within an acceptable time frame.

4.2.2 Component Coolinq Water System During the implementation of this project, the CC Water System will function as designed for one unit in a refueling outage and one unit at power. Two of the four CCHXs will be out of service while the other two CCHXs are supplied with SW by the jumper. The design basis for each CCHX is to provide heat rejection capability for the loads of one operating unit and one-half of the heat loads common to both units. The CC Water System also provides RCP thermal barrier cooling in the event of a loss of charging system RCP seal injection.

The loss of SW cooling to the CC Water System is considered highly unlikely due to the safety-related SW jumper design and the project constraints and compensatory measures/contingency action plan that will be in place during the use of the jumper. Any conditions that render the temporary SW jumper to the CCHXs inoperable would be responded to within the existing action statements in Technical Specifications. Station Abnormal Procedure 1-AP-27.00, "Loss of Decay Heat Removal Capability," provides procedural guidance to the operators to establish alternate cooling in the event of a loss of heat sink for the RHR System for Unit 1. Unit 2 will be at power, so a loss of heat sink for the CC Water System due to jumper loss will subsequently require entry into 2-AP-15.00, "Loss of Component Cooling". Where practicable, additional project constraints are applied to provide added conservatism to ensure a significant time period to complete any contingency actions associated with a complete loss of heat sink to the CC Water System. The constraints require that the Unit 1 reactor core has been shutdown for 150 hours0.00174 days 0.0417 hours 2.480159e-4 weeks 5.7075e-5 months prior to flowing the jumper as the operable SW flow path.

Additionally, while the jumper is flowing as the sole operable SW flow path, the Unit 1 reactor cavity will be flooded to at least 23 feet above the reactor vessel flange with the upper internals removed or the core offloaded to the SFP. At 150 hours0.00174 days 0.0417 hours 2.480159e-4 weeks 5.7075e-5 months after shutdown, with the core in the reactor vessel, the reactor cavity flooded, and an initial temperature in the Reactor Coolant System (RCS) of 100 0 F, a loss of the jumper would result in bulk boiling in the refueling cavity at a time over 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months following loss of heat sink, without any mitigating action. Normal SW supply to the two standby CCHXs can be restored within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . After a decay time from shutdown of 360 hours0.00417 days 0.1 hours 5.952381e-4 weeks 1.3698e-4 months (15 days), the heat load will be reduced and the constraints of upper internals/reactor vessel head removed and cavity Page 16 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 flooding will be lifted. From this time in the outage, a loss of the SW jumper would be responded to in accordance with 1-AP-27.00, "Loss of Decay Heat Removal," while immediate actions would be taken to restore normal SW supply. This would be considered the "worst case" scenario since adequate time is not available to return the normal SW line to service prior to the need for a means of alternate decay heat removal.

However, this condition is already addressed in existing station procedures. To ensure adequate cooling is available to the reactor core in the event of a loss of normal decay heat removal (RHR), such as due to the loss of SW to the CCHXs, Operations Surveillance Procedure 1-OSP-ZZ-004, "Unit 1 Safety Systems Status List for Cold Shutdown/Refueling Conditions," is in effect during cold shutdown and refueling shutdown conditions. This procedure, which is performed each shift while the unit is less than or equal to 200OF and fuel is in the vessel, is intended to ensure adequate equipment is available to adequately cool the RCS in the event of a loss of RHR. The procedure requires a mandatory alternate cooling method to be available and specifies additional alternate cooling methods for consideration. The necessary equipment that is required for the alternate cooling method(s) is specified and must be confirmed to be available each shift. The appropriate cooling method specified is based on the time after shutdown. Available alternatives, depending on system conditions and available equipment, include natural circulation cooling, forced feed and bleed cooling, reflux cooling, and gravity feed and bleed cooling.

Therefore, the loss of the SW to the CCHXs, resulting in the subsequent inability of the RHR system to cool the RCS, is appropriately and procedurally addressed during shutdown conditions such that an alternate means of cooling the RCS is always available. The alternate means of cooling would be utilized until the normal SW line is placed back into service.

4.2.3 Loss of the Temporary Service Water Jumper The concern for a loss of decay heat removal is not unique with respect to the use of a temporary SW jumper. A loss of decay heat removal, including that resulting from a loss of the normal SW supply line, has been previously considered and addressed by existing Station Procedures. The implementation of those same procedures, in the event of a loss of the temporary SW jumper, will ensure that core cooling can be maintained until the normal SW supply line can be returned to service. The specific procedures and contingency actions for a loss of the temporary SW jumper at the most limiting plant condition are discussed below.

The Unit 1 refueling schedule includes three general RCS conditions of concern which will exist concurrent with the use of the temporary SW jumper as the sole source of SW to the CCHXs.

Page 17 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 Condition 1 - The refueling cavity will be flooded with refueling operations under way. During this period, the entire core will be offloaded to the Fuel Building where inserts are shuffled, etc. The new core, which consists of approximately one-third new and two-thirds previously used fuel assemblies, will then be loaded.

Condition 2 - At a minimum of 360 hours0.00417 days 0.1 hours 5.952381e-4 weeks 1.3698e-4 months after shutdown, the RCS inventory will be decreased to approximately reactor flange level once the new core has been loaded. The purpose for decreasing the inventory is to facilitate the installation of the reactor vessel head. The RCS loops are scheduled to be unisolated before the cavity level is decreased to this point; however, the loops may still be isolated due to emerging changes during the outage.

Condition 3 - The RCS inventory will be increased to a level in the pressurizer following the installation of the reactor vessel head. The RCS loops will also be unisolated and filled.

Of these three general RCS conditions, Condition 2 has been determined to be the most limiting. Although there will be a decrease in RCS inventory during Condition 2, the system will not be at mid-loop level (i.e., "reduced inventory") while the temporary SW jumper is in service. The scheduled duration of Condition 2 is approximately 3.5 days.

Minimum equipment required for cold shutdown and refueling shutdown conditions and backup actions for a loss of decay heat removal are addressed by Operations Surveillance Procedure 1-OSP-ZZ-004, "Unit 1 Safety Systems Status List for Cold Shutdown/Refueling Conditions," and Abnormal Procedure 1-AP-27.00, "Loss of Decay Heat Removal Capability," respectively. These procedures have been in place for some time and are included in routine operator training as well as "just in time" training for operators, which is conducted prior to refueling outages.

1-OSP-ZZ-004 provides instructions for determining the required equipment during cold shutdown and refueling shutdown conditions, including that equipment required to provide backup core cooling in the event of a loss of the RHR system. The procedure also provides guidance on selecting the most appropriate backup core cooling method for the prevailing plant conditions and equipment availability. An operator will perform 1-OSP-ZZ-004 at the beginning of each shift (when fuel is in the vessel). For the three conditions described above, the procedure will guide the operator to select a "feed and bleed" backup core cooling method (described below). In addition, the procedure will define the equipment that must be available, given the unit conditions, to implement the selected backup method.

Page 18 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 In the event of an RHR failure, 1-AP-27.00 will be initiated. This procedure provides guidance on how to use the selected backup core cooling method, as well as restoration of the RHR system.

While in Condition 1, the flooded cavity provides sufficient heat sink to mitigate a loss of SW. However, the decrease in RCS inventory while at Conditions 2 and 3 will require "feed and bleed" core cooling. The "feed and bleed" method requires an available source of water (refueling water storage tank), a motive force (safety injection pump or gravity), a sufficient "feed" or flowpath to the core, and an adequate "bleed" or discharge path (pressurizer safety valve removed, pressurizer PORVs opened or removed, or open reactor vessel). This method has been analyzed and found to be an adequate means of preventing core boiling and uncovery, thereby precluding fuel damage.

Based on the backup actions described above, a complete loss of decay heat removal is unlikely. However, if the temporary SW jumper failed at the limiting RCS condition (Condition 2) and the backup actions were not implemented, core boiling and uncovery could occur, resulting in fuel damage. With a loss of decay heat removal while at Condition 2 (loop stop valves closed), core boiling has been calculated to begin at 0.6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , core uncovery (collapsed level at the top of the fuel) at 1.6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and fuel clad damage at 1.9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months . It is important to note that these durations are very conservative in that they are based on a total loss of the RHR System. As such, the calculations do not include any credit for the heat capacity of the RHR or CC Water Systems. Assuming only a loss of SW, the RHR and CC pumps would continue to operate, which would significantly increase the duration to core boiling, core uncovery, and fuel clad damage.

A loss of the temporary SW jumper would be immediately recognized since the line will be monitored while in service. To mitigate the consequences of such an event, the backup actions prescribed by 1-OSP-ZZ-004 and 1-AP-27.00 (i.e., "feed and bleed")

would be implemented as needed. This backup method would preclude core boiling and provide sufficient core cooling until the normal SW supply line could be placed in service.

Furthermore, the concern for loss of SFP cooling is also not unique with respect to the use of a temporary SW jumper and is also addressed by existing station procedures. The estimated time for the SFP to reach 200°F in the event that normal cooling would be lost is calculated on a routine basis. On a daily basis, the SFP status and conditions are reviewed, and the time to SFP heatup to 200°F is either verified or recalculated. During the Spring 2012 Unit 1 refueling outage, the shortest calculated time to SFP heatup to 200°F was 18 hours2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months . This time is representative of the expected times for the 2013 and 2015 Unit 1 refueling outages. Based on the discussion in this section, the loss of decay heat removal/RCS cooling is more limiting than the loss of SFP cooling.

Page 19 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 4.3 Contingency Action Plan The SW jumper is a safety-related seismic pipe which provides cooling water to the two operating CCHXs for Unit 2 operation/shutdown (if required) and Unit 1 shutdown/refueling heat loads. Conditions which may require isolation of the jumper and restoration of the normal 42" SW supply line include moderate-to-high volume leakage, extreme weather conditions, or particular plant conditions. Specific compensatory actions and a contingency action plan will be in place to provide added assurance of safe operation of the facility during this project. An overview of the plan follows.

The contingency action plan has the following four phases of activity:

Phase I Evacuation Remove equipment, debris, and personnel from the piping.

Phase II Restore System Integrity Establish flow path integrity by installing manways and removing/installing blanks.

Phase III Reflood Open stop logs and flood up to installed SW-MOV-102 valve.

Phase IV Flow Open SW-MOV-102 valve and restore flow to "C" and "D" CCHXs.

The entry conditions of the contingency action plan involve the use of an appropriate response depending on the nature of the failure/condition. Isolation of the temporary SW jumper should only be performed when it is absolutely necessary to limit Turbine Building flooding or to respond to unit conditions which require operation of the normal SW supply. Failures that relate to Turbine Building flooding are classified as low, moderate, and high volume leakage.

Low volume leakage is that which is easily terminated by exterior means without requiring isolation of the jumper. A repair must be justified by an engineering evaluation to remain in place and provide an acceptable pressure boundary for the duration of the implementation phase of the project. Any necessary repairs must be able to be performed without removing the jumper from service. The contingency action plan will not be entered for low volume leakage. During the time periods when the jumper is in service, temporary pipe clamps and other emergency repair equipment will be staged in the area of the jumper in the basement of the Turbine Building to facilitate emergency repair of the jumper, if required, and to assist in recovery from a postulated flooding Page 20 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 event. Procedures and training will be provided to the construction personnel to ensure the effectiveness of this measure.

Moderate volume leakage is that which can be coped with for a period of time until the necessary actions can be performed to re-establish flow to the normal SW supply before the jumper is isolated. Moderate volume leakage is a function of the capacity of the Turbine Building basement floor drains and sumps/pumps available at the time of the event. This will be determined by the amount of standing water on the basement floor in the immediate area around the non-safety-related motor control centers in the vicinity of the SW jumper. Moderate volume leakage will be defined as that leakage which cannot be sufficiently reduced by external means and which results in standing water on the floor between '/" and 2" in depth. The existence of significant flow diversion from the CCHXs will be detected by CC Water System parameters and heat exchanger monitoring. Additional compensatory measures may be required to preclude spraying or flooding of specific components/areas. If moderate volume leakage is encountered, the SW jumper would be declared inoperable, and the appropriate Technical Specifications action statement for Unit 2 would be entered.

High volume leakage is that which requires immediate isolation of the jumper due to an inability to cope with the leak flow rate. Attempts to throttle the jumper flow to a rate low enough to cope, while still providing some CCHX cooling flow, are acceptable; however, actions to restore the normal SW supply shall be taken immediately. If high volume leakage is encountered, the SW jumper would be declared inoperable, the contingency action plan would be entered through Phase IV, and the appropriate Technical Specifications action statement for Unit 2 would be entered.

Extreme weather conditions which threaten the survivability of the jumper require the restoration of normal SW supply. Extreme weather conditions include a tornado or hurricane winds onsite. Upon notification that such an extreme weather event is imminent ("watch") for the Surry site, the contingency action plan will be entered up through Phase II. All preparations required to enter Phase III will be taken without initiation of reflood. Upon notification of a tornado or hurricane "warning" for the Surry site, Phase III will be entered and operators will stand ready to initiate Phase IV, if required.

A unit condition which would require entry into the contingency action plan would be one in which RHR is the only cooling available for Unit 2 (e.g., no unisolated RCS loop).

This condition would make RCS cooling dependent on the SW jumper for its ultimate heat sink with no alternative method of cooling. This is undesirable since the short duration of time for heat up of the RCS does not provide sufficient time to implement the contingency action plan if the heat sink to CC was lost. If an alternate method of decay heat removal is not available using an unisolated RCS loop (natural circulation Page 21 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 through a steam generator), then the normal SW supply capability shall be restored.

The contingency action plan will be entered, up to and including Phase III, before the last available RCS loop is removed from service. Phase IV will be entered if the jumper becomes inoperable.

ACTIVITIES ASSOCIATED WITH CONTINGENCY ACTION PLAN PHASES PHASE I Evacuation

1. Remove equipment and ventilation from the piping (42" and 96").

2. Remove debris from the piping. Material which is small enough to pass through the heat exchanger tubes may be left in the piping. (Largest dimension of object must be smaller than 0.25".)

3. Evacuate personnel from the piping.

4. Complete preparation for reflooding the system.

PHASE II Restore System Integrity

1. Close manways at ("C" and "D") CCHXs.

2. Close manway at 42" piping.

3. Blank remaining openings in the system (e.g., 42" piping at piping flange downstream of removed 1-SW-MOV-102X).

PHASE III Reflood

1. Open stop logs on unblanked 96" inlet bay, as required, to fill piping up to the closed 1-SW-MOV-102X.

PHASE IV Flow

1. Open 1-SW-MOV-1 02X and establish flow to the "C" and "D" CCHXs.

Flowing the 42" SW piping after application of the new coating, but before adequate cure time has elapsed was evaluated for potential coating failure. The coating manufacturer has stated that short term effects from premature immersion will not cause any significant debris as a result of coating failure, provided strict controls are invoked during surface preparation and coating application by qualified personnel, as required by Surry's safety-related coating application procedure. If premature immersion were to occur, subsequent inspection will be performed.

Page 22 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 A loss of the temporary SW jumper during some phases of the project work may require placing the normal SW supply in service before adequate weld repair is completed to declare the piping operable in accordance with Station Procedures. Engineering will evaluate the existing condition of the pipe wall and the capability of the piping to maintain the expected system pressures and sustain minimal leaks, while still meeting system flow requirements. Since the majority of the piping is concrete-encased and the system pressure is low, there would likely be insignificant leakage and effect on supply flow under these abnormal conditions. Once the plant is in a stable condition and temporary SW jumper is restored, the normal SW will be removed from service and the piping wall repair will be completed.

In the event that coating repairs on the normal SW supply piping cannot be completed during the 2013 refueling outage, Engineering will evaluate the existing condition of the pipe wall and assess deferral of the completion of the coating repair; any deviation from the coating program, including deferrals, will be entered into the station's Corrective Action Program. Based on the projected general area corrosion and pitting corrosion rates applicable for the SW piping, it is expected that deferral of completion of pipe coating repairs to the 2015 refueling outage would be determined to be acceptable.

4.4 Controls on the Movement of Heavy Loads According to the Surry Updated Final Safety Analysis Report (UFSAR), "A load is subject to NUREG-0612 if it exceeds 1600 pounds and is carried over irradiated fuel, safe shutdown equipment or decay heat removal equipment." Although load handling systems in the Turbine Building at Surry have been excluded from compliance with NUREG-0612 based on the above criteria, the proposed temporary jumper is providing decay heat removal capability for both units. Furthermore, outage maintenance activities may require the Turbine Building overhead cranes to lift loads at the operating deck elevation in excess of 1600 pounds over the SW jumper. Other unforeseen maintenance activities may also require heavy loads to be lifted directly over the jumper at elevations below the operating deck. Therefore, as compensatory measures and to the extent reasonably achievable, the Phase I requirements of NUREG-0612 will be temporarily imposed upon the applicable overhead cranes whenever the jumper is in service.

In addition, concerns raised in the NRC IE Bulletin 96-02, "Movement of Heavy Loads Over Spent Fuel in the Reactor Core, or Over Safety related Equipment", were reviewed against the proposed handling of heavy loads over the temporary SW jumper.

IE Bulletin 96-02 cautioned licensees to consider the following issues for all proposed heavy load handling activities:

1. compliance with existing NUREG-0612 regulatory guidelines for handling heavy loads while the plant is operating, Page 23 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1

2. compliance with existing NUREG-0612 Phase I and GL 85-11 requirements as they relate to previously analyzed conditions in their licensing basis and UFSAR,

3. reporting in accordance with the requirements of 10CFR50.90, as they may relate to IE Bulletin 96-02.

With regard to issue #1 listed above, any loss of SW (temporary or normal flow path) to the CC heat exchangers would place both units in existing Technical Specifications action statements and would require immediate response in accordance with Abnormal Procedures 1-AP-27.00, "Loss of Decay Heat Removal Capability" and 1-AP-15.00 and 2-AP-15.00, "Loss of Component Cooling." With regard to issue #2, recovery of the normal SW flow path can be achieved within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , providing sufficient time to prevent core bulk boiling in Unit 1 and to resume full RHR and CC functions for both units. As such, the potential consequences of a heavy load drop onto the in-service temporary SW jumper from overhead turbine cranes are no different than for those cases previously analyzed for loss of SW cooling to the CC Water System. By implementation of these measures, the probability of a heavy load drop is considered to be neglibly small, and no accidents of a different kind could be identified. In response to issue #3, this License Amendment Request (LAR) provides recognition of the partial lack of missile protection and the small possibility of a heavy load drop that could affect the operability of the temporary SW jumper.

The movement of loads within the Turbine Building is mainly controlled through the following procedures: General Maintenance Procedure, GMP-C-107, "Rigging and Lifting," MA-AA-101, "Fleet Lifting and Material Handling," and MA-AA-OCR-101, "Overhead Cranes and Hoists." GMP-C-107 prohibits heavy load lifts over certain Turbine Building equipment in response to plant flooding issues but refers all NUREG-0612 heavy load handling issues to GMP-001, "Heavy Load Rigging and Movement", as the Turbine Building is not subject to NUREG-0612, Phase I requirements. MA-AA-101 and MA-AA-OCR-101 establish the lifting/material handling and overhead cranes/hoists programs, respectively, for Dominion and incorporate NUREG-0612 Guidelines 5.1.1(3), (5) and (6) at Surry. To identify the proposed measures which will enhance heavy load handling practices for the Turbine Building cranes, NUREG-0612 guidelines are identified below followed by a discussion of the measures that will be employed in the Turbine Building, whenever the temporary SW jumper is in service.

NUREG-0612 Guideline 5.1.1(1) Safe Load Paths Currently, GMP-C-107 provides maps of load movement restriction areas within the Turbine Building to mitigate the consequences of internal plant flooding associated with a load drop on certain plant equipment. These restricted areas limit the core damage Page 24 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 frequency due to internal plant flooding and are not associated with any commitments to NUREG-0612. In addition, equipment laydown area drawings showing equipment and floor load capacities are issued to control laydown space and to ensure that adequate floor capacity exists. Per Surry UFSAR, 9B.2.4.1, safe load paths are defined by either a sketch or a description of the load paths that have been incorporated into the lifting procedure.

To enhance heavy load handling practices for the Turbine Building cranes, additional restricted area maps of the Unit 1 Turbine Building will be developed, in lieu of safe load paths, for incorporation into GMP-C-107 to control heavy load lifts whenever the temporary SW jumper is in service. Heavy loads carried below the turbine operating deck elevation will be prohibited from being carried directly above or near any portion of the temporary SW jumper without approved procedural guidance.

NUREG-0612 Guideline 5.1.1(2) Procedures Currently, load handling operations in the Turbine Building are controlled by Procedures MA-AA-101, MA-AA-OCR-101, and GMP-C-107. These procedures provide generic heavy load handling recommendations, but do not meet all of the following procedure requirements for NUREG-0612 heavy loads:

1. Equipment identification.

2. Required equipment inspections and acceptance criteria prior to performing lift and movement operations.

3. Approved safe load paths.

4. Safety precautions and limitations.

5. Special tools, rigging hardware, and equipment required for the heavy load lift.

6. Rigging arrangement for the load.

7. Adequate job steps and proper sequencing for handling the load.

The use of generic versus specific lift procedures is preferred for heavy load lifts in the Turbine Building since the SW jumper is temporary. Items #1, #2, #4, #6, and #7 listed above, are addressed in the existing Procedure GMP-C-107. Item #3 will be addressed in a revision to GMP-C-107, as noted above. To satisfy item #5, special lifting tools to be used in the Turbine Building during outages will be evaluated and identified in Procedure GMP-C-107 to address the conditions whenever the temporary SW jumper is in service.

Page 25 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 NUREG-0612 Guideline 5.1.1(3) Crane Operators Crane operators are currently trained and qualified to conduct themselves in accordance with Chapter 2-3 of ANSI B30.2-1976, "Overhead and Gantry Cranes." The requirements for the crane and hoist program are established in MA-AA-101, which requires that crane operators meet the provisions of ANSI B30.2-1976. As such, existing heavy load handling practices for the subject Turbine Building cranes already meet this guideline of NUREG-0612.

NUREG-0612 Guideline 5.1.1(4) Special Lifting Devices Currently, special lifting devices used in the Turbine Building are controlled under Procedure GMP-C-107. GMP-C-107 requires identification of the name of the engineer/manufacturer of the special lifting device and that initial use load tests are performed to at least 125% of the rated load. Procedure GMP-C-107 will be revised to include the following requirements whenever the SW jumper is in service: 1) a list of the special lifting devices approved for use in the Turbine Building that meet ANSI B30.20, "Below-the-Hook Lifting Devices," 2) visual inspections of critical welds and bolted joints of special lifting devices as soon as the full weight of the load is on the hook, and

3) surface inspection of critical welds and bolted joints of these special lifting devices, using NDE methods, prior to each outage.

NUREG-0612 Guideline 5.1.1(5) Lifting devices that are not specifically designed Lifting devices that are not specifically designed shall be installed and used in accordance with the guidelines of ANSI B30.9-1971. It was determined that dynamic load constitutes a small percentage of the total rated load imposed on the slings; therefore, the sling's rated load can be safely expressed in terms of the maximum static load only.

The requirements for the crane and hoist program are established in MA-AA-1 01, which requires that these lifting devices meet ANSI B30.9-1971. The pre-lift checklist, currently used in Procedures GMP-C-107 and GMP-001, will ensure proper selection of any lifting device, in accordance with this guideline of NUREG-0612 for each application. By adherence to MA-AA-101, existing heavy load handling practices for the subject Turbine Building cranes already meet this guideline of NUREG-0612.

NUREG-0612 Guideline 5.1.1(6) The crane should be inspected, tested, and maintained NUREG-0612 overhead cranes are currently inspected, tested, and maintained in accordance with Chapter 2-2 of ANSI B30.2-1976, "Overhead and Gantry Cranes", with Page 26 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 the stated exception that tests and inspections may be performed prior to use for infrequently used cranes. Currently, maintenance, inspection, and testing of overhead cranes are controlled under Maintenance Procedure, 0-MCM-1304-01, "Turbine, Polar, and Fuel Handling Crane Maintenance". This procedure adopts the requirements of ANSI B30.2-1976, as required by the UFSAR.

The requirements of 0-MCM-1304-01 apply to the Turbine Building overhead cranes.

Hence, by adherence to 0-MCM-1 304-01, existing heavy load handling practices for the Turbine Building overhead cranes already meet this guideline of NUREG-0612.

NUREG-0612 Guideline 5.1.1(7) The crane should be designed Currently, the Turbine Building overhead cranes are designed to the Electric Overhead Crane Institute Specification No. 61, Service Class A, as listed in Virginia Power Specification No. NUS-0034. These Turbine Building overhead cranes were not designed to meet seismic requirements and are only to be used within their rated load limits. To be in strict compliance with NUREG-0612, overhead cranes should be designed to meet the applicable criteria and guidelines of Chapter 2-1 of ANSI B30.2-1976, "Overhead and Gantry Cranes" and of CMAA-70, "Specification for Electric Overhead Travelling Cranes." It has been previously determined in Technical Evaluation Report TER-C5506-395/396 that overhead cranes meeting EOCI Specification No. 61 may be accepted in lieu of specific compliance if the intent of the specification is satisfied. Therefore, with the exception of any seismic qualification, the intent of the required design specification has been met for the overhead Turbine Building cranes.

While the Turbine Building overhead cranes and the supporting Turbine Building superstructure have not been designed to any seismic criteria, IPEEE studies have been performed to investigate the seismic fragility of the Turbine Building superstructure. Seismic fragility evaluations have determined that the Turbine Building can withstand median horizontal ground accelerations that correlate to a HCLPF 50 =

0.19 g (High Confidence of a Low Probability of Failure). In other words, there is 95%

confidence that the probability of Turbine Building failure under a 0.19 g horizontal peak ground acceleration is only 5%, assuming median design input parameters.

The Surry design basis earthquake (DBE) horizontal peak ground acceleration is listed as 0.15 g. It is important to note that while the DBE horizontal peak ground acceleration is less than the limiting HCLPF 50 acceleration, this evaluation does not imply that the Turbine Building, nor associated overhead cranes, is qualified for DBE events. The correlation between DBE peak ground acceleration and HCLPF 5o has not been established. However, this study does demonstrate that the Turbine Building and overhead cranes will have a high confidence of surviving a significant seismic event Page 27 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 with a low probability of failure. Given the relatively small amount of time that a Turbine Building overhead crane will be in use over or near the temporary SW jumper piping, coupled with the low probability of experiencing a coincident earthquake of sufficient magnitude to cause crane collapse, it can be concluded with a high degree of confidence that the temporary SW jumper will be available to perform its function.

Additional precautions to minimize the potential for damage from the Turbine Building overhead cranes during a seismic event can be provided by imposing rather simple compensatory measures. For example, the overhead cranes will be parked at the far ends of the crane runway when not in use. While no specific probabilistic safety assessment studies have been conducted for the seismic failure of the Turbine Building overhead cranes, it is reasonable and prudent to avoid, whenever possible, parking/standing directly over or in the proximity of the temporary SW jumper.

A specific time limit for the overhead cranes to be in the vicinity of the temporary SW jumper during refueling outages has not been established, but whenever possible, these overhead cranes shall be moved out of the vicinity of the temporary SW jumper.

By limiting the off-use crane parking/standing location to areas sufficiently far away from the temporary SW jumper, the potential for any adverse consequences due to a seismic event can be reasonably minimized.

Procedure(s) will be revised to direct crane operators to minimize the time spent with the crane directly over the temporary SW jumper. As an additional aid, a placard will be placed inside the operator cabs of the Turbine Building overhead cranes, in plain view of the crane operator, which notes that whenever work activities permit, the crane operator shall avoid parking or standing the overhead cranes in the vicinity of the temporary SW jumper.

Based on the measures noted above, the probability of experiencing a heavy load drop on the temporary SW jumper is considered to be neglibly small.

5.0

SUMMARY

OF PROJECT CONSTRAINTS AND COMPENSATORY MEASURES In addition to the contingency action plan discussed in Section 4.3, the following project constraints and compensatory measures will be implemented.

A safety-related, seismic, not fully missile protected, alternate SW flow path (jumper) will be required to provide SW to two CCHXs for Unit 2 operating/shutdown (if required) loads, Unit 1 shutdown/refueling loads, and common heat loads.

Page 28 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1

" An internal flooding walkdown will be performed after installation of the temporary SW jumper to address Gaps 2 and 11 listed in Table 1 in Attachment 4.

" The jumper will be hydrostatically tested prior to use in accordance with the design change testing requirements and existing Station Procedures.

The CCHXs will be cleaned prior to placing the jumper into service to reduce the probability that a CCHX will be rendered inoperable due to a tubesheet becoming clogged from biofouling.

" Prior to removing the Unit 1 "B" and "D" inlet bays from service, surveillance testing and cleaning will be performed on the Unit 2 canal level probes, and the trash racks will be cleaned.

" Provisions will be made for temporary instrumentation and procedure changes to assess CCHX operability.

" Unit 1 shall be defueled or the refueling cavity filled to at least 23 feet above the reactor vessel flange, whenever the jumper is in service as the operable SW flow path. The reactor will be shutdown for 150 hours0.00174 days 0.0417 hours 2.480159e-4 weeks 5.7075e-5 months prior to placing the jumper in service as the operable SW flow path. After a decay time from shutdown of 360 hours0.00417 days 0.1 hours 5.952381e-4 weeks 1.3698e-4 months (15 days), the heat load will be reduced and the constraints of upper internals/reactor vessel head removed and cavity flooded will be removed. From this point forward in the outage, a loss of the jumper would be responded to in accordance with station abnormal procedures. The appropriate Operating Procedure(s) will be revised to control operation of the jumper in accordance with the implementing design change package.

Two CCHXs will be out of service during implementation of the project.

TS Section 3.13 requires two CCHXs to be operable for one unit operation and three CCHXs for two unit operation. TS 3.14 requires the ability to establish SW flow to and from the CCHXs specified in TS 3.13. Therefore, Unit 1 cannot be operating when the jumper is in service as the operable SW flow path. The design change package which implements the restoration project for the SW supply piping to the CCHXs ensures proper unit conditions during the use of the jumper.

The jumper will not be operated when SW supply temperature is above 80'F.

Operating Procedures will be revised to indicate maximum allowable SW temperature while the jumper is in service in accordance with the implementing design change package.

Page 29 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1

" The jumper will require 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months s/day administrative control of the installed manual isolation valve; if required, the operator assigned to the administrative control will be directed to close the valve and isolate the SW flow to the CCHXs to conserve Intake Canal inventory. The normal SW MOVs (1-SW-MOV-102A and 1-SW-MOV-102B) will be out of service during implementation of the project. Valve operation will be controlled by Abnormal and Operating Procedures. The jumper will also require a 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months s/day flood watch; the flood watch requirements will be delineated and controlled by design change implementing procedures and in accordance with Station Procedures.

" When the jumper is in service, a contingency action plan will be in effect through administrative action statements, requiring restoration of the normal SW supply capability if specific plant or environmental conditions exist. These conditions include leakage rates which render the jumper inoperable, weather conditions which are conducive to tornadic activity, hurricane warnings for the Surry site, or plant conditions on Unit 2 which result in RHR being the only available cooling for the reactor coolant system (e.g., no unisolated RCS loop). Applicable Station Procedures will be revised to control actions required by the contingency action plan.

" Appropriate controls on the movement of heavy loads will be implemented for any lifts which pass over the jumper while it is in service. The implementing design change package ensures proper implementation of the controls on the movement of heavy loads in the vicinity of the jumper.

SW supply to the control room chiller condensers in Mechanical Equipment Room 3 and the charging pump SW pumps will be from the two Unit 2 supply lines. The Unit 1 supply will be out of service for the duration of the pipe repair work. This will be controlled by the implementing design change package.

" In accordance with Station Procedures, flooding protection and personnel safety will be provided by requiring double isolation for system boundaries which present a significant source of water. Passive boundaries which have no credible failure mechanism through inadvertent operation or significant leakage may have single isolation (e.g., blanked pipe).

" Visual barriers (e.g., ropes, placards, cones, etc.) will be placed around the jumper routing to minimize the likelihood of inadvertent collision of moving vehicles with the jumper.

Page 30 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1

" The section of existing SW pipe downstream of the SW supply isolation MOVs (1-MOV-SW-102A and B) will be filled with water prior to stop log removal using a controllable process.

" Components will be opened under preventative measures that will allow any potential leaks to be controlled prior to the component being fully opened.

Vehicle traffic (e.g., forklifts) will be restricted in the immediate area of the temporary SW jumper while it is in service. If any vehicle operation becomes necessary in the area of the jumper for any period of time when the jumper is in service, personnel will be specifically designated to serve as a "spotter" to aid the vehicle operator to preclude any adverse interaction with jumper operation.

" During the time periods when the jumper is in service, temporary pipe clamps and other emergency repair equipment will be staged in the area of the jumper in the basement of the Turbine Building to facilitate emergency repair of the jumper, if required, and to assist in recovery from a postulated flooding event. Procedures and training will be provided to the construction personnel to ensure the effectiveness of this measure.

" Operations personnel will be appropriately trained on the purpose of the jumper, administrative control of the temporary jumper isolation valve, the revised abnormal procedures, the Technical Specifications that address the use of the temporary service water jumper, and on their individual responsibilities associated with the jumper, as appropriate.

6.0 PROBABILISTIC RISK ASSESSMENT 6.1 Purpose The Surry Probabilistic Risk Assessment (PRA) was utilized to evaluate the impact on Core Damage Frequency (CDF) and Large, Early Release Frequency (LERF) for the LAR for the temporary SW jumper. Using risk measures prescribed in Regulatory Guide (RG) 1.177, this analysis evaluates the risk of canal level instrumentation out of service for durations in excess of current limits (TS Table 3.7-2 5a) and the risk of using a temporary SW jumper to the CCHXs to allow SW piping maintenance activities (i.e., cleaning, inspection, repair (as needed), and recoating (as needed)).

Page 31 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 6.2 Scope of the Probabilistic Risk Assessment and PRA Modeling The original internal flooding analysis from the Individual Plant Examination (IPE) has been upgraded over the years. The most recent model update included many changes to address the supporting requirements for internal flooding in the ASME PRA Standard. The walkdowns of the plant areas were redone as part of the 2007 model update and documented in the internal flooding walkdown notebook. The walkdowns of each plant area verified and/or identified new flood sources, equipment needed to mitigate accidents, and whether the equipment is subject to flooding effects. New flooding scenarios were developed, which included consideration of propagation paths, flood barriers, floor drains, and other plant features. Flood flow rates, timing, affected equipment, and the availability of alarms and isolation capability were also considered in the flood scenario development. The progression of the accident sequence for each scenario was modeled using flooding event trees that account for the impact on the key safety function due to the flood damage. There are now over 100 flooding initiators that model pipe breaks or maintenance-induced floods in the plant. Also, the documentation of the internal flooding analysis was upgraded by developing an internal flooding series of notebooks that document the walkdowns, flood initiator frequencies, scenario development, and accident progression.

Flooding The jumper configuration is flanged with butterfly valves at the inlet (1-SW-939) and at the "A" and "B" CCHX supply connections. The total length of 30-inch diameter temporary SW jumper will be approximately 225 feet. While the jumper is in service the normal SW supply valves 1-SW-MOV-102A and 1-SW-MOV-102B will be out of service; manual valve 1-SW-939 is installed and designed to provide the function of the MOVs. The remote isolation capability of 1-SW-MOV-102A and 1-SW-MOV-102B will be unavailable. A 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months s/day flood watch will be established during the use of the temporary SW jumper. The failure to isolate SW is dominated by the electrical failure of the MOVs and human error probabilities (HEPs). While the jumper is in service, SW isolation is performed by an operator closing the installed manual isolation valve (1-SW-939). The HEP associated with this operator action is sensitive to the amount of time available to diagnose and perform the required actions. Having a 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months s/day flood watch reduces the HEP value.

SW MOVs and the piping in the valve pits will be isolated while the jumper is in service; therefore, the flooding hazard contribution from these components can be considered negligible.

During the construction and removal of the jumper, it is necessary to change configurations of the CW and SW systems several times. Based on a comparison of Page 32 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 the proposed activities for the temporary SW jumper/SW pipe maintenance and the activities examined in the base internal flooding analysis, it is concluded that these activities are very similar. Therefore, the conditional probability of CDF for the maintenance-induced flooding hazard for the planned SW pipe maintenance activities is similar to that estimated for the base case internal flooding analysis.

The internal flooding analysis for the Turbine Building flood frequencies was adjusted to include the additional 225 feet of SW pipe. The following table presents the internal flooding frequencies specific to this assessment.

TURBINE BUILDING FLOOD FREQUENCIES Flood Initiator Flood Area Description Major Flood Comments Designator Unisolable SW Floods 4 Manways in SW lines with Floor Plates On - 0.0 FLA31A-SW-1 floor plates over them All Floor Plates Off - 8.OE-06 Unit 1 & 2 Turbine Building (2.0E-06/floor plate)

Isolable SW Floods FLA31A-SW-2 Unit 1 & 27.96E-06 Turbine Building Inlet/Outlet Expansion Joints (8) CC HXs These expansion FLA31A-SW-1 Turbine Building 3.8E-06/REJ joints do not have (1-SW-REJ-37, 39, 33, 35, spray shields.

L 29, 31,_25,_27)

This change only affects the floods for the rupture of SW piping, additional expansion joints, and removal of one floor plate. The current model includes the risk associated with one floor plate removed and for one CC expansion joint without the spray shields installed.

The major flood frequency for the Units 1 and 2 Turbine Building is the sum of the respective frequencies. The internal flooding initiating event for the isolable SW piping rupture in the Turbine Building is defined as %Flood-TB-SW-ISOL, which is the sum of Unit 1 and Unit 2.

%Flood-TB-SW-ISOLunit 1 is 3.81 E-6/yr (SPS IF.2 Unit-1 Turbine Building Piping.xls, Sheet WS-2)

%Flood-TB-SW-ISOLunit 2 is 4.15E-6/yr (SPS IF.2 Unit-2 Turbine Building Piping.x/s, Sheet WS-2)

Page 33 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1

%Flood-TB-SW-ISOL = 3.81 E-6/yr + 4.15E-6/yr =7.96E-6/yr The risk associated with the additional 225 feet of 30-inch SW piping is calculated by multiplying the pipe rupture frequency (per reactor operating year - linear foot) by the length of the SW jumper. The pipe rupture frequency for 30-inch SW line resulting in a major flood is 9.54 E-09/yr-linear foot.

SW Jumper Pipe Rupture Frequency = 225 ft

9.54E-09/yr-ft = 2.15E-6/yr The new TB major flood frequency becomes:

%Flood-TB-SW-ISOL = 7.96E-6/yr + 2.15E-6/yr = 1.01 E-5/yr During the 35-day periods when the jumper is in service, the following CDF values have been determined. The Unit 2 CDF is obtained from the cutset file, U2-CDF-Avg Maintenance.CUT.

U2 CDF (baseline) = 6.0967E-06/yr The Unit 2 CDF including the temporary SW jumper (225') is calculated by replacing the nominal %Flood-TB-SW-ISOL value (7.96E-6/yr) with the revised frequency of 1.01 E-5/yr.

U2 CDF (with additional length of pipe) = 6.0975E-06 The incremental increase in CDF is calculated as shown below.

Incremental conditional core damage probability (ICCDP) Pipe =

[U2 CDF (with additional length of pipe) ] - [U2 CDF (baseline)] * [Total duration of AOT]

ICCDP Pipe = (6.0975E-06/yr- 6.0967E-06/yr) * (35 day

24 hr/day

1 yr/8760 hr)

ICCDP Pipe = 7.67E-1 1 The incremental increase in LERF is calculated using the same methodology outlined above using the cutset file, U2-LERF-Avg Maintenance.CUT.

U2 LERF (baseline) = 1.5043E-07 /yr U2 LERF (with additional length of pipe) = 1.5045E-07 Page 34 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 Incremental conditional large early release probability (ICLERP) Pipe =

[U2 LERF (with additional length of pipe) ] - [U2 LERF (baseline)] * [Total duration of AOT]

ICLERP Pipe= (1.5045E-07/yr - 1.5043E-07 /yr) * (35 day

24 hr/day

1 yr/8760 hr)

ICLERP Pipe = 1.92E-12 Human Reliability Analysis One of the mitigating actions for isolating a Turbine Building internal flooding event is to manually isolate the SW jumper using the manual valve 1-SW-939. The Surry PRA credits operator recovery actions to stop the flow of SW water by closing several different manual valves or MOVs in the Turbine Building. There are two different operator recovery actions that apply for isolating a pipe rupture in the SW jumper.

HEP Probability Description REC-FLD-TB-SW-MV 3.2E-4 Operator fails to isolate CC/BC HX SW Piping prior to damage in the Emergency Switchgear Room with flood dike in place.

REC-FLD-TB-SW-MV-TM 1.8E-2 Operator fails to isolate CC/BC HX SW Piping prior to damage in the Emergency Switchgear Room without flood dike in place.

Updating the above operator recovery by taking credit for the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months s/day flood watch would have a beneficial effect of decreasing the time to identify the SW flooding in the Turbine Building. However, for this analysis, this additional improvement in the HEP is conservatively not credited.

Fire PRA The IPEEE fire PRA follows acceptable methods referred to in Sections 4 and 5 of NUREG 1407. These methods include screening and bounding calculations in addition to detailed PRA analysis. Portions of the EPRI Fire Induced Vulnerability Evaluation (FIVE) methodology have been adopted, particularly in the areas of location screening and fire frequency evaluation for the fire PRA. Procedures for performing, documenting, and reviewing each individual task were developed in order to comply as closely as possible with the Quality Assurance requirements specified in 10CFR50 Appendix B.

The fire modeling process screened out all but four areas as insignificant contributors to core damage risk. These four areas are the emergency switchgear room, normal switchgear room, cable vault/cable tunnel, and control room.

Page 35 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 No credit was taken in the fire analysis for the detection and suppression of fires (i.e., fires were allowed to burn until they self extinguished).

Fire Risk Scoping Study Issues were addressed through specifically tailored walkdowns as defined in the FIVE methodology, including seismic fire interactions, effects of fire suppressant on safety-related equipment, fire barrier effectiveness and control systems interactions. It was determined that each of the issues has been adequately addressed at Surry.

This LAR has no impact on the fire PRA analysis.

Seismic PRA Generic Letter (GL) 88-20 Supplement 4, "Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities" was issued by the Nuclear Regulatory Commission (NRC) in June 1991. This letter and NRC NUREG-1407, "Procedural and Submittal Guidance for the Individual Plant Examination of External Events for Severe Accident Vulnerabilities", published June 1991, requested each nuclear plant licensee to perform IPEEE. In a December 1991 letter to the NRC, Surry identified the planned approach to address IPEEE. For non-seismic external events and fires, the IPEEE effort was completed and a report was submitted to the NRC in December 1997.

For the seismic event, Surry was categorized in NUREG-1407 as a focused scope plant. As identified in Surry's December 1991 letter, the Seismic Margins Method (SMM) developed by Electric Power Research Institute (EPRI) with enhancements was selected for Surry Power Station. A completion schedule for IPEEE - Seismic was initially provided by Surry in its September 1992 letter to the NRC which also noted that elements of the effort to resolve IPEEE - Seismic, notably plant walkdowns, will be integrated with the resolution of Unresolved Safety Issue (USI) A-46 identified in NRC's Supplement 1 to GL 87-02 of May 1992.

In September 1995, the NRC issued Supplement 5 to GL 88-20. This letter gave further guidance on the basis for selection of components that needed capacity evaluation. Based on GL 88-20, Supplement 5, Surry submitted a revised approach to NRC in November 1995. This approach, while still retaining the Seismic Probabilistic Risk Assessment (SPRA) methodology and treating Surry as a focused scope plant, identified areas where screening and judgment by experienced and trained engineers would eliminate the need for performing capacity calculations for rugged components, structures, and systems and would require such evaluations only for weaker and critical components. The IPEEE - Seismic program at Surry has been performed in Page 36 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 accordance with the SPRA methodology for a focused plant and Surry's stated commitments.

In February 1996, a peer review was conducted to assess the implementation of the IPEEE - Seismic program at Surry. This review included walkdown of about 15% of the items representing all classes of equipment in the Safe Shutdown Equipment List.

Although a few open issues were noted at the time of the review, the reviewer concluded that the Seismic Review Teams involved did an excellent seismic walkdown review at Surry.

In summary, the IPEEE-Seismic program, integrated with the USI A-46 effort, resulted in several plant improvements and design modifications. The SPRA quantification concluded that no severe accident vulnerabilities exist at Surry from the seismic event.

No other cost beneficial upgrade can be performed to improve the seismic margin and the core damage frequency of the plant.

The Surry Seismic Probability Risk Assessment Pilot Plant Report was reviewed and this LAR does not impact the conclusions drawn in that report.

Other External Events In addition to internal fires and seismic events, the Surry IPEEE analysis of high winds or tornadoes, external floods, transportation accidents, nearby facility accidents, and other external hazards was accomplished by reviewing the plant environs against regulatory requirements regarding these hazards. These hazards were screened from further analytic modeling and quantification.

This LAR has no impact on the other external events analysis.

6.3 PRA Risk Assessment Modeling Intake canal level probes 1-CW-LE-102 and 1-CW-LE-103 are being rendered inoperable requiring the level instrument channels to be placed in their tripped condition. Placing the level probes in a tripped condition requires converting the 3-out-of-4 logic to a 1-out-of-2 trip logic for the Unit 2 turbine trip and isolation of non-essential SW and CW supplies.

Solving the S007Aa CAFTA model, the General Plant Transient (GPT) CCDP =

1.83E-8, and the GPT CLERP = 7.99E-1 1.

Page 37 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 Calculation of Unit 2 ICCDP for having intake canal level sensors 1-CW-LE-102 and 103 not available The frequency of hourly failure rate for fail to operate the sensor and transmitter is 1.53E-7/hr.

The change in the GPT frequency due to having intake canal level sensors 1-CW-LE-102 and 103 unavailable is:

2 x 1.53E-7/hour x 8766 hr/yr = 2.68E-3/yr GPT CCDP = 1.83E-8 ACDF two canal level sensorsfor35 dayAOT = 1.83E-8 x 2.68E-3/yr = 4.91 E-1 l/yr ICCDP Instrumentation for having two intake canal level sensors for 35-day AOT is:

4.91 E-11 x (35days/365days) = 4.71 E-12 Calculation of Unit 2 ICLERP for havinq intake canal level sensors 1-CW-LE-102 and 103 not available The frequency of hourly failure rate for fail to operate the sensor and transmitter is 1.53E-7/hr.

The change in the GPT frequency due to having intake canal level sensors 1-CW-LE-02 and 103 unavailable is:

2 x 1.53E-7/hour x 8766 hr/yr = 2.68E-3/yr GPT CLERP = 7.99E-1 1 ALERF two canal level sensors for 35 day AOT = 7.99E-1 1 x 2.68E-3/yr = 2.14E-1 3/yr ICLERP Instrumentation for having two intake canal level sensors for 35-day AOT is:

2.14E-13 x (35days/365days) = 2.05E-14 6.4 Assumptions in Allowed Outaqe Time (AOT)

Following is a list of assumptions supporting this risk evaluation:

Page 38 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 The major CC Water System loads, while work is in progress, will include cooling for the SFP, RHR for Unit 1 and normal operating loads for Unit 2. The CC Water System also provides RCP thermal barrier cooling in the event of loss of charging system RCP seal injection. Abnormal procedure 1-AP-27.00, Loss of Decay Heat Removal, will be entered to provide guidance for alternate cooling to Unit 1 if CC is not available.

" The PRA model reflects the configuration of the CCHXs, including the configuration with the temporary SW jumper installed.

The PRA analysis was performed using the at-power Surry PRA model, including internal events. The proposed LAR is being developed for an at-power SW maintenance activity, so the other operating modes do not require evaluation herein.

" In the Tier 2 analysis, the canal level instrumentation is selected to represent the systems (and/or sub-systems).

" Two CC pumps are running and the other two are in standby.

" A 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months s/day flood watch will be posted while the temporary SW jumper is in service.

" Controls will be implemented for any heavy load lifts that pass over the jumper while in service in accordance with Surry's 10CFR50.65(a)(4) compliance program.

" No canal level maintenance activities will be scheduled during the use of the jumper.

" An internal events flooding walkdown will be performed after installation of the jumper in accordance with NF-AA-PRA-101-2071, "PRA Internal Flood Partitioning and Source Identification Characterization."

The PRA model was run with a truncation lower than that of the average maintenance model to capture cutsets applicable to the configuration.

The two stop logs will be modified to provide a means of manually opening the stop log and filling the bay and 96" piping. Each modified stop-log involves an opening with a closure gate installed within the third seal plate down from the top of the High Level Intake Structure. The opening is sized to provide adequate flow to flood the bay and supply two CCHXs with cooling water. A manual lifting device located above the concrete deck will be used to pull the closure gate upward, allowing water to flow through the opening into the bay. Rubber seals are used to minimize water leakage through the gate when closed. Credit for this SW isolation feature has conservatively not been included in the risk evaluations.

Page 39 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 Calculating the internal flooding risk for the SW expansion joint ruptures is conservative. The Surry internal flooding pipe rupture frequencies are based on EPRI TR-1013141, "Pipe Rupture Frequencies for Internal Flooding Probabilistic Risk Assessments." Pipe rupture frequencies in this report account for the components on the piping system pressure boundary whose failure could initiate an internal flooding initiating event, including pipes, flanges, pump and valve bodies, fittings, vents, and expansion joints.

6.5 Sensitivity and Uncertainty Analysis Sensitivity evaluations determined that identified gap uncertainties do not have a significant impact on the PRA results for this application (See Table 2 in Attachment 4).

The PRA model, S007Aa, and associated files were revised to assess the impact of the identified gaps.

6.6 Method of RG 1.177 Tier 1 Analysis RG 1.177 is the applicable regulatory guide for preparation of the risk assessment.

For Surry, the Unit 2 baseline CDF is 6.10E-6/yr and the baseline LERF is 1.50E-7/yr.

If the ACDF is less than 1 E-6/yr and ALERF is less than 1 E-7/yr, then the change may be characterized as a "small change".

RG 1.177 provides guidance specific to risk-informed LARs. This RG provides guidance on acceptable ICCDP and ICLERP. The thresholds for ICCDP and ICLERP in RG 1.177 are 1E-6 and 1E-7, respectively.

The first case is the baseline case; the test and maintenance unavailability's basic events and other PRA test and maintenance events are set to their three-year average unavailability.

The second case is to evaluate the risk associated with reducing the canal level instrumentation logic from a 3-out-of-4 to 1-out-of-2. The change in level instrumentation logic will result in a change in frequency for a GPT.

The third case calculates the total ICCDP and ICLERP based on reduced canal level instrumentation logic change risk contribution and the contribution to flooding risk from the addition of 225 feet of SW pipe.

Page 40 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 Case 1 Baseline Analysis The average maintenance base model internal events are solved using the CAFTA model. Solving the S007Aa CAFTA model, the baseline CDF for Unit 2 is 6.10E-6/year and the baseline LERF is 1.50E-7/year.

Case 2 Canal Level Instrumentation Logic Change The second case is to evaluate the risk associated with reducing the canal level instrumentation logic from a 3-out-of-4 to 1-out-of-2 logic configuration and evaluating the additional 225 feet of SW pipe.

The risk for the canal level instrumentation was determined to be ICCDP Instrumentation =

4.71E-12 and ICLERP Instrumentation = 2.05E-14. The risk for the additional length of pipe was determined to be ICCDP Pipe = 7.67E-11 and ICLERP Pipe = 1.92E-12 Case 3 Total ICCDP and ICLERP The bounding case includes the 35-day AOT in which the canal level instrumentation logic is reconfigured to 1-out-of-2 logic configuration and the addition of 225 feet of SW pipe. The total ICCDP and ICLERP are:

ICCDP Total = ICCDP Instrumentation + ICCDP Pipe ICCDP Total = 4.71 E-12 + 7.67E-11 ICCDP Total = 8.14E-1 1 ICLERP Total = ICLERP Instrumentation + ICLERP Pipe ICLERP Total= 2.05E-14 + 1.92E-12 ICLERP Total = 1.94E-1 2 6.7 RG 1.177 Tier 2: Avoidance of Risk Significant Plant Configurations To avoid risk significant plant equipment outage configurations during the extended allowed outage time of two canal level instruments out of service, the impact of having other equipment unavailable is evaluated. The ICCDP and ICLERP limits in RG 1.177 are used as the criteria used to identify potentially risk significant configurations.

Consistent with the guidance in RG 1.177, the results of this initial bounding calculation Page 41 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 are reviewed to identify the risk contributions of out of service equipment events for the purposes of defining operational restrictions for protecting such equipment during the proposed AOT configuration. The evaluation did not identify any configurations that could occur during the temporary SW jumper use that would require Tier 2 restrictions per RG 1.177.

6.8 RG 1.177 Tier 3: Risk-Informed Plant Configuration Control and Management Dominion's 10CFR50.65(a)(4) compliance fully satisfies the recommendations of RG 1.177 Tier 3. RG 1.177 Regulatory Position 2.3 indicates that the licensee should develop a program that ensures that the risk impact of out-of-service equipment is appropriately evaluated prior to performing any maintenance activity and that a viable program would be one that is able to uncover risk-significant plant equipment outage configurations in a timely manner during normal plant operation.

The Dominion 10CFR50.65(a)(4) program performs full PRA analyses of planned maintenance configurations in advance. Configurations that approach or exceed the NUMARC 93-01 risk limits (1.OE-6 for CDP) are avoided or addressed by risk management actions. Emergent configurations are identified and analyzed by the on-shift staff for prompt determination of whether risk management actions are needed.

The configuration analysis and risk management processes are fully proceduralized in compliance with the requirements of 10CFR50.65(a)(4).

Surry's 10CFR50.65(a)(4) compliance program requires analysis and management of configuration risks. The CC Water System, SW System, and canal level instrumentation are included in the 10CFR50.65(a)(4) scope, and their removal from service will be monitored, analyzed, and managed. When a configuration approaches the 10CFR50.65(a)(4) risk limits, plant procedures direct the implementation of risk management actions in compliance with the regulation. If the configuration is planned, these steps must be taken in advance.

Surry's 10CFR50.65(a)(4) compliance program requires analysis and management in the event that any 10CFR50.65(a)(4) equipment is vulnerable during a heavy load lift.

Individually, the SW piping maintenance activity does not approach the required risk management thresholds of the 10CFR50.65(a)(4) regulation. While combinations of unavailable equipment and/or maintenance evolutions may approach the limits and even require risk management actions, the risks arising from these configurations will be dominated by factors other than the temporary SW jumper or canal level instrumentation. As a result, the risk significance of using the temporary SW jumper does not warrant limitations upon other equipment.

Page 42 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 RG 1.177 refers to the Tier 3 program as a ConfigurationRisk Management Program.

6.9 PRA Conclusions The risk evaluation performed for use of the temporary SW jumper and having intake canal level sensors 1-CW-LE-02 and 103 unavailable supports a TS allowed outage duration of two 35-day periods. The increase in annual CDF and LERF associated with the proposed change is characterized as "small changes" consistent with RG 1.174.

The ICCDP and ICLERP associated with the proposed change are within the acceptance criteria in RG1.177.

7.0 NO SIGNIFICANT HAZARDS CONSIDERATION Virginia Electric and Power Company (Dominion) has reviewed the proposed change against the criteria of 10CFR50.92 and has concluded that the change does not pose a significant safety hazards consideration as defined therein. The proposed Operating License Conditions and Technical Specifications changes are necessary to allow the use of a temporary, safety-related, seismic, not fully missile protected jumper to provide service water (SW) to the Component Cooling Heat Exchangers (CCHXs) while maintenance work is performed on the existing SW supply line to the CCHXs. Since there is only one SW supply line to the CCHXs, an alternate SW supply (jumper) must be provided whenever the line is removed from service. The temporary SW jumper provides this function. The jumper will only be used for a 35-day period during each of two consecutive Unit 1 refueling outages.

The use of the temporary SW jumper has been evaluated, and appropriate constraints and compensatory measures (including a contingency action plan) have been developed to ensure that the temporary SW jumper is reliable, safe, and suitable for its intended purpose. A complete and immediate loss of SW supply to the operating CCHXs is not considered credible, given the project constraints and the unlikely probability of a generated missile or heavy load drop. Existing Station Abnormal Procedures already address a loss of component cooling and the use of alternate cooling for a loss of decay heat removal in the unlikely event that they are required.

Furthermore, appropriate mitigative measures have been identified to address potential flooding concerns.

Consequently, the operation of Surry Power Station with the proposed license amendment request will not:

1. Involve a significant increase in the probability or consequences of an accident previously evaluated.

Page 43 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 The SW and CC Water Systems will function as designed under the unit operating constraints specified by this project (i.e., Unit 2 in operation and Unit 1 in a refueling outage), and the potential for a loss of component cooling is already addressed by Station Abnormal Procedures. Therefore, there is no increase in the probability of an accident previously evaluated. The possibility of flooding due to failure of the temporary SW supply jumper in the Turbine Building basement has been evaluated and dispositioned by the implementation of appropriate project constraints and compensatory measures to preclude damage to the temporary SW jumper and to respond to a postulated flooding event. During the time the temporary SW jumper is in service, the installed manual isolation valve in the SW jumper will be under administrative control 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months s/day; the operator assigned to the administrative control will be directed to close the valve and isolate the SW flow to the CCHXs to conserve Intake Canal inventory. In addition, a 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months s/day flood watch will be established when the jumper is in service.

Therefore, the consequences of an accident previously evaluated are not increased.

2. Create the possibility of a new or different kind of accident from any accident previously evaluated.

The SW and CC Water Systems' design functions and basic configurations are not being altered as a result of using the temporary SW jumper. The temporary jumper is designed to be safety-related and seismic with the design attributes of the normal SW supply line, except for the automatic isolation function and complete missile and heavy load drop protection. The design functions of the SW and CC Water Systems are unchanged as a result of the proposed changes due to 1) required plant conditions, 2) compensatory measures, 3) a contingency action plan for restoration of the normal SW supply if required, and 4) strict administrative control of the installed manual isolation valve to preclude flooding or to isolate non-essential SW within the design basis assumed time limits to maintain Intake Canal inventory. Unit 1 will be in a plant condition that will provide adequate time to restore the normal SW supply, if required. Therefore, since the SW and CC Water Systems will basically function as designed and will be operated in their basic configuration, the possibility of a new or different type of accident than previously evaluated in the UFSAR is not created.

3. Involve a significant reduction in a margin of safety.

The margin of safety as defined in the Technical Specifications is not significantly reduced since an operable SW flowpath to the required number of CCHXs is provided, and unit operating constraints, project constraints, compensatory measures, and contingency action plan will be implemented as required to ensure Page 44 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 the integrity and the capability of the SW flowpath. The use of the temporary SW jumper will be limited to the time period when missile producing weather is not expected, and Unit 1 meets specified unit conditions. Therefore, the temporary SW jumper, under the imposed project constraints and compensatory measures, provides comparable reliability as the normal SW supply line. Furthermore, an evaluation using the Probabilistic Risk Assessment model was conducted for the use of the temporary SW jumper. The evaluation concluded that the increase in annual core damage and large, early release frequencies associated with the proposed License Amendment Request is characterized as "small changes" consistent with RG 1.174. In addition, the incremental conditional core damage and large, early release probabilities associated with the proposed License Amendment Request are within the acceptance criteria in RG 1.177. Thus, the margin of safety is not significantly reduced.

8.0 ENVIRONMENTAL ASSESSMENT This amendment request meets the eligibility criteria for categorical exclusion set forth in 10CFR51.22(c)(9) as follows:

(i) The amendment involves no significant hazards consideration.

As described above, the proposed LAR does not involve a significant hazards consideration.

(ii) There is no significant change in the types or significant increase in the amounts of any effluents that may be released offsite.

The proposed use of the temporary SW jumper in this LAR does not affect the types or amounts of effluents that may be released offsite. The SW and CC Water Systems will continue to function as designed. Therefore, there is no significant change in the types or significant increase in the amounts of any effluents that may be released offsite.

(iii)There is no significant increase in individual or cumulative occupational radiation exposure.

The proposed LAR does not impact the ability of the SW and CC Water Systems to function as designed. Therefore, there is no significant increase in individual or cumulative occupational radiation exposure.

Based on the above assessment, Dominion concludes that the proposed change meets the criteria specified in 10CFR51.22 for a categorical exclusion from the requirements Page 45 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 of 10CFR51.22 relative to requiring a specific environmental assessment or impact statement by the Commission.

9.0 CONCLUSION

The planned maintenance work on the SW supply piping to the CCHXs will involve the use of a temporary, safety-related, seismic, not fully missile protected supply line (jumper) to two of the four CCHXs. Whenever conditions exist which could render the temporary SW jumper inoperable, a contingency action plan will require that project work cease and normal SW supply capability be restored. This evolution can be completed in time to meet the design basis functions of the CCHXs and within established design limits of supported systems. A complete and immediate loss of SW supply to the operating CCHXs is not considered credible, given the project constraints, compensatory measures, and the unlikely probability of a generated missile or heavy load drop. At worst, loss of SW supply to the operating CCHXs would require 1) Unit 2 to shutdown and entry into the Abnormal Procedure for a loss of component cooling and 2) Unit 1 to use alternate cooling in accordance with the loss of decay heat removal abnormal procedure.

During project implementation, the automatic isolation of the SW MOVs in the normal supply piping to the CCHXs will be defeated. This automatic function, which serves to conserve Intake Canal inventory, will be replaced by administrative control of the installed manual isolation valve. The manual action can be completed within the time allowed by the analysis of Intake Canal inventory level. This project also requires that both Unit 1 "B" and "D" intake bays be de-watered, placing two of the four intake canal level probes in trip. The protective function is assured using one out of two signals to actuate from the remaining two Unit 2 level probes through two logic channels, thus, the single failure criterion is preserved. There is an increased probability of a spurious trip of Unit 2 in this condition; however, the reliability of the Intake Canal level probes supports the conclusion that this is acceptable for Unit 2 operation.

The completion of the maintenance activities on the SW supply to the CCHXs will minimize corrosion of the piping wall and prolong the service life of the piping. It will also provide full assessment of the wall condition for this normally inaccessible piping section. Consequently, the assurance of pipe wall integrity for the SW supply to the CCHXs will be enhanced.

Page 46 of 47

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 1 Therefore, the proposed changes to the Operating Licenses and Technical Specifications are necessary to allow the use of the temporary SW supply jumper to provide SW flow to the CCHXs for two 35 day periods in each of two consecutive Unit 1 refueling outages to facilitate the currently planned SW piping maintenance activities.

The SW and CC Water Systems will function as designed under the unit operating constraints specified by the project (e.g., Unit 2 in operation and Unit 1 in a refueling outage). The SW and CC Water Systems' design functions and basic configurations are not being altered as a result of using the temporary SW jumper. Although the temporary SW supply line is not fully missile protected and has an increased vulnerability to missiles or heavy loads when compared to the normal SW supply line that is encased in concrete, the project constraints, compensatory measures, and contingency action plan will ensure that an operable SW flowpath to the required number of CCHXs is provided with minimal additional risk. The supporting Probalistic Risk Assessment for this License Amendment Request concluded that the change is characterized as "small changes" consistent with RG 1.174 and is within the acceptance criteria of RG 1.177.

Page 47 of 47

Figure 1 - Temporary SW Jumper to CCHXs Configuration DISCHARGE TUNNEL Dewater Pipe .0OW"M Temp Jumper Piping m- S4o pwg& DD.

n S.Mý & D-.

Note: 1-SW-939 Isolation Valve Installed on "C" 96" Inlet Manway

tF -E-41 0 cfý f!AS212 OMS1t213 WIILL

" --t,- ---------------------

-- - --- - - - -- l ml- l I aw z rz- -I T4 1-T2111 Z W Pwfitol ,,-rFEDWAE

- -ow

- bul, KPJP,,

- wI-,

T27 :211 IFI-VI

'N""

-- - -- " -- ON V L , - - - - - - - -

---- ,a, FIVI:

"~ ~ ~ 72' ;[.:* _1

= ---------

" -IZ ': *ABANDONED

,. *PIT' IN PL-ACE i l l IN

, P ACE ,, i

_*__ i __ *- I -r' 3r*-r

' 'E ' ow-an F m i-Figure 2 -Temporary SW Jumper Routing (Turbine Area - Ground Floor - Unit 1)

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs ATTACHMENT 2 MARKED-UP OPERATING LICENSE, TECHNICAL SPECIFICATIONS, AND TECHNICAL SPECIFICATIONS BASIS PAGES (BASIS CHANGES ARE PROVIDED FOR NRC INFORMATION ONLY)

VIRGINIA ELECTRIC AND POWER COMPANY (DOMINION)

SURRY POWER STATION UNITS 1 AND 2

T. (Continued)

16. For the applicable UFSAR Chapter Prior to operating above 14 events, Surry 1 will re-analyze the 2546 MWt (98.4% RP).

transient consistent with VEPCO's NRC-approved reload design methodology in VEP-FRD-42, Rev.

2.1-A.

If NRC review is deemed necessary pursuant to the requirements of 10 CFR 50.59, the accident analyses will be submitted to the NRC for review prior to operation at the uprate power level. These commitments apply to the following Surry 1 UFSAR Chapter 14 DNBR analyses that were analyzed at 2546 MWt consistent with the Statistical DNBR Evaluation Methodology in VEP-NE-2-A:

" Section 14.2.7 - Excessive Heat Removal due to Feedwater System Malfunctions (Full Power Feedwater Temperature Reduction case only);

Section 14.2.8 - Excessive Load Increase Incident;

" Section 14.2.9 - Loss of Reactor Coolant Flow; and

Section 14.2.10 - Loss of External Electrical Load

4. This renewed license is effective as of the date of issuance and shall expire at midnight on May 25, 2032.

FOR THE NUCLEAR REGULATORY COMMISSION Original signed by:

Samuel J. Collins, Director Office of Nuclear Reactor Regulation

Attachment:

Appendix A, Technical Specifications Date of Issuance: March 20, 2003 Surry - Unit 1 Renewed License No. DPR-32 Amendment No. 269-

INSERT I - Insert as License Condition U on page 9 of Unit 1 Operating License:

U. As discussed in the footnote to Technical Specification 3.14.A.2.b, the use of a temporary, safety-related, seismic, not fully missile protected supply line to provide Service Water (SW) to the Component Cooling Heat Exchangers (required by Technical Specification 3.13) to facilitate maintenance activities on the existing SW supply line shall be in accordance with the basis, risk evaluation, and compensatory measures (including a Contingency Action Plan) provided in the licensee's submittal dated September 26, 2012 (Serial No.12-615).

.e@,24-1ta-T. (Continued)

16. For the applicable UFSAR Chapter 14 Prior to operating above events, Surry 2 will re-analyze the 2546 MWt (98.4% RP).

transient consistent with VEPCO's NRC-approved reload design methodology in VEP-FRD-42, Rev.

2.1 -A.

If NRC review is deemed necessary pursuant to the requirements of 10 CFR 50.59, the accident analyses will be submitted to the NRC for review prior to operation at the uprate power level.

These commitments apply to the following Surry 2 UFSAR Chapter 14 DNBR analyses that were analyzed at 2546 MWt consistent with the Statistical DNBR Evaluation Methodology in VEP-NE-2-A:

Section 14.2.7 - Excessive Heat Removal due to Feedwater System Malfunctions (Full Power Feedwater Temperature Reduction case only);

Section 14.2.8 - Excessive Load Increase Incident;

Section 14.2.9 - Loss of Reactor Coolant Flow; and

Section 14.2.10 - Loss of External Electrical Load It,4S*I-T 2.

4. This renewed license is effective as of the date of issuance and shall expire at midnight on January 29, 2033.

FOR THE NUCLEAR REGULATORY COMMISSION Original signed by:

Samuel J. Collins, Director Office of Nuclear Reactor Regulation

Attachment:

Appendix A, Technical Specifications Date of Issuance: March 20, 2003 Surry - Unit 2 Renewed License No. DPR-37 Amendment No.-ý8-

INSERT 2 - Insert as License Condition U on page 9 of Unit 2 Operating License:

U. As discussed in the footnote to Technical Specification 3.14.A.2.b, the use of a temporary, safety-related, seismic, not fully missile protected supply line to provide Service Water (SW) to the Component Cooling Heat Exchangers (required by Technical Specification 3.13) to facilitate maintenance activities on the existing SW supply line shall be in accordance with the basis, risk evaluation, and compensatory measures (including a Contingency Action Plan) provided in the licensee's submittal dated September 26, 2012 (Serial No.12-615).

TABLE 3.7-2 (Continued)

ENGINEERED SAFEGUARDS ACTION INSTRUMENT OPERATING CONDITIONS Minimum Permissible Total Number OPERABLE Channels Bypass Operator Functional Unit Of Channels Channels To Trip Conditions Actions

3. AUXILIARY FEEDWATER (continued)

e. Trip of main feedwater pumps - start motor driven 2/MFW pump 1/MFW pump 2-1 each 24 pumps MFW pump

f. Automatic actuation logic 2 2 1 22

4. LOSS OF POWER

a. 4.16 kv emergency bus undervoltage (loss of voltage) 3/bus 2/bus 2/bus 26

b. 4.16 kv emergency bus undervoltage (degraded 3/bus 2/bus 2/bus 26 voltage)

5. NON-ESSENTIAL SERVICE WATER ISOLATION

a. Low intake canal level* - Wot-e.. S 4 3 3 20

,,I," <--

b. Automatic actuation logic 2 2 1 14

6. ENGINEERED SAFEGAURDS ACTUATION INTERLOCKS - Note A

a. Pressurizer pressure, P- Il 3 2 2 23

b. Low-low Tavg, P-12 3 2 2 23

c. Reactor trip, P-4 2 2 1 24

7. RECIRCULATION MODE TRANSFER

a. RWST Level - Low-Low* 4 2

3 2

2 1

25 14 A1'

b. Automatic Actuation Logic and Actuation Relays

8. RECIRCULATION SPRAY CD

a. RWST Level - Low Coincident with High High 4 3 2 20 Containment Pressure*

b. Automatic Actuation Logic and Actuation Relays 2 2 1 14 0

t .ote A - Engineered Safeguards Actuation Interlocks are described in Table 4.1-A

There is a Safety Analysis Limit associated with this ESF function. If during cal ibration the setpoint is found to be conservative with respect to the Setting Limit but outside its predefined calibration tolerance, thern the channel shall be brought back to within its C, predefined calibration tolerance before returning the channel to service. The ca]libration tolerances are specified in a document controlled under 10 CFR 50.59.

INSERT 3

INSERT 3 - Insert as Note B associated with Table 3.7-2, Item 5.a - Non-Essential Service Water Isolation - Low Intake Canal Level:

Note B - When the temporary Service Water supply jumper to the Component Cooling Heat Exchangers is in service in accordance with the footnote to TS 3.14.A.2.b, two low intake canal level probes will be permitted to be in the tripped condition. In this condition, two operable channels are required with one channel to trip. If one of the two operable channels becomes inoperable, the operating unit must be in HOT SHUTDOWN within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

TS 3.14-1 30-0-*

3.14 CIRCULATING AND SERVICE WATER SYSTEMS Applicability Applies to the operational status of the Circulating and Service Water Systems.

Objective To define those limiting conditions of the Circulating and Service Water Systems necessary to assure safe station operation.

Specification A. The Reactor Coolant System temperature or pressure of a reactor unit shall not exceed 3500 F or 450 psig, respectively, or the reactor shall not be critical unless:

1. The high level intake canal is filled to at least elevation +23.0 feet at the high level intake structure.

2. Unit subsystems, including piping and valves, shall be operable to the extent of being able to establish the following:

a. Flow to and from one bearing cooling water heat exchanger.

b. Flow to and from the component cooling heat exchangers required by Specification 3.13. (-*)

3. At least two circulating water pumps are operating or are operable.

4. Three emergency service water pumps are operable; these pumps will service both units simultaneously.

4 4Igr 4-

/00 Amendment Nos. 4 ,,H-'227

INSERT 4 - Insert as footnote to TS 3.14.A.2.b:

(*) For the purpose of cleaning, performing inspections, repairing (as needed),

and recoating (as needed) associated with the Service Water (SW) supply piping to the Component Cooling Heat Exchangers (CCHXs), a temporary 30" safety-related, seismic, not fully missile protected supply line (temporary jumper) will be provided to supply SW flow to the CCHXs required by TS 3.13.

The basis for using the temporary jumper is provided in Virginia Electric and Power Company's letter Serial No.12-615, dated September 26, 2012. The use of the temporary jumper is permitted two times only for a duration of up to 35 days during each of the 2013 and 2015 Unit 1 refueling outages. If non-essential SW isolation is required during the pipe maintenance activities, it will be accomplished consistent with design basis requirements by using operator (manual) action to close the SW isolation valve in the temporary jumper within the time constraints established by the Station Abnormal Procedures. If the temporary jumper becomes inoperable during either 35-day period, the requirements of Specification 3.0.1 shall apply. Upon completion of the work associated with the second 35-day period, this footnote will no longer be applicable.

TS 3.14-4

-0940-04 including replacement of an Emergency Service Water pump without forcing dual unit outages, yet limits the amount of operating time without the specified number of pumps.

When one Unit is in Cold Shutdown and the heat load from the shutdown unit and spent fuel pool drops to less than 25 million BTU/HR, then one Emergency Service Water pump may be removed from service for the subsequent time that the unit remains in Cold Shutdown due to the reduced residual heat removal and hence component cooling requirements.

A minimum level of +17.2 feet in the High Level Intake canal is required to provide design flow of Service Water through the Recirculation Spray heat exchangers during a loss-of-coolant accident for the first 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . If the water level falls below +23' 6",

signals are generated to trip both unit's turbines and to close the nonessential Circulating and Service Water valves. A High Level Intake canal level of +23' 6" ensures actuation prior to canal level falling to elevation +23'. The Circulating Water and Service Water isolation valves which are required to close to conserve Intake Canal inventory are periodically verified to limit total leakage flow out of the Intake Canal. In addition, passive vacuum breakers are installed on the Circulating Water pump discharge lines to assure that a reverse siphon is not continued for canal levels less than +23 feet when Circulating Water pumps are de-energized. The remaining six feet of canal level is provided coincident with ESW pump operation as the required source of Service Water for heat loads following the Design Basis Accident.

INSFER-T 5

References:

UFSAR Section 9.9 Service Water System UFSAR Section 10.3.4 Circulating Water System UFSAR Section 14.5 Loss-of-Coolant Accidents, Including the Design Basis Accident Amendment Nos. 227 atid 227

INSERT 5 - Add as a new paragraph in the TS 3.14 Basis on page TS 3.14-4:

To facilitate cleaning, inspecting, repairing (as needed), and recoating (as needed) of the Service Water (SW) supply line to the Component Cooling Heat Exchangers (CCHXs), a temporary, safety-related, seismic, not fully missile protected SW supply line (temporary jumper) will be used as discussed in the temporary footnote to TS 3.14.A.2.b. The temporary jumper is required since service water is supplied to the CCHXs by a single concrete-encased line. To remove the SW supply line from service for extended maintenance (i.e., for pipe cleaning, inspection, repair, and recoating), an alternate temporary SW supply path is required to support the operation of the CCHXs during the maintenance activities. The basis for using the temporary SW supply jumper to the CCHXs is provided in Virginia Electric and Power Company's letter Serial No.12-615, dated September 26, 2012. The use of the temporary jumper is only permitted for a duration of up to 35 days during each of the 2013 and 2015 Unit 1 refueling outages and shall be operated in accordance with the compensatory measures (including a Contingency Action Plan) provided in the letter referenced above. The only automatic function in the normal supply line when Unit 1 is in COLD SHUTDOWN or REFUELING SHUTDOWN is provided by the SW supply motor operated valves, which close on low Intake Canal level. If non-essential SW isolation is required during the time the jumper is in service, it will be accomplished consistent with design and licensing bases requirements by using operator (manual) action to close the SW isolation valve in the temporary jumper within the time constraints established by the Station Abnormal Procedures.

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs ATTACHMENT 3 PROPOSED OPERATING LICENSE, TECHNICAL SPECIFICATIONS, AND TECHNICAL SPECIFICATIONS BASIS PAGES (BASIS CHANGES ARE PROVIDED FOR NRC INFORMATION ONLY)

VIRGINIA ELECTRIC AND POWER COMPANY (DOMINION)

SURRY POWER STATION UNITS 1 AND 2

T. (Continued)

16. For the applicable UFSAR Chapter 14 Prior to operating above events, Surry 1 will re-analyze the 2546 MWt (98.4% RP).

transient consistent with VEPCO's NRC-approved reload design methodology in VEP-FRD-42, Rev. 2.1-A.

If NRC review is deemed necessary pursuant to the requirements of 10 CFR 50.59, the accident analyses will be submitted to the NRC for review prior to operation at the uprate power level. These commitments apply to the following Surry 1 UFSAR Chapter 14 DNBR analyses that were analyzed at 2546 MWt consistent with the Statistical DNBR Evaluation Methodology in VEP-NE-2-A:

" Section 14.2.7 - Excessive Heat Removal due to Feedwater System Malfunctions (Full Power Feedwater Temperature Reduction case only);

" Section 14.2.8 - Excessive Load Increase Incident;

" Section 14.2.9 - Loss of Reactor Coolant Flow; and

" Section 14.2.10 - Loss of External Electrical Load U. As discussed in the footnote to Technical Specification 3.14.A.2.b, the use of a temporary, safety-related, seismic, not fully missile protected supply line to provide Service Water (SW) to the Component Cooling Heat Exchangers (required by Technical Specification 3.13) to facilitate maintenance activities on the existing SW supply line shall be in accordance with the basis, risk evaluation, and compensatory measures (including a Contingency Action Plan) provided in the licensee's submittal dated September 26, 2012 (Serial No.12-615).

4. This renewed license is effective as of the date of issuance and shall expire at midnight on May 25, 2032.

FOR THE NUCLEAR REGULATORY COMMISSION Original signed by:

Samuel J. Collins, Director Office of Nuclear Reactor Regulation

Attachment:

Appendix A, Technical Specifications Date of Issuance: March 20, 2003 Surry - Unit 1 Renewed License No. DPR-32 Amendment No.

T. (Continued)

16. For the applicable UFSAR Chapter 14 Prior to operating above events, Surry 2 will re-analyze the 2546 MWt (98.4% RP).

transient consistent with VEPCO's NRC-approved reload design methodology in VEP-FRD-42, Rev. 2.1-A.

If NRC review is deemed necessary pursuant to the requirements of 10 CFR 50.59, the accident analyses will be submitted to the NRC for review prior to operation at the uprate power level. These commitments apply to the following Surry 2 UFSAR Chapter 14 DNBR analyses that were analyzed at 2546 MWt consistent with the Statistical DNBR Evaluation Methodology in VEP-NE-2-A:

" Section 14.2.7 - Excessive Heat Removal due to Feedwater System Malfunctions (Full Power Feedwater Temperature Reduction case only);

" Section 14.2.8 - Excessive Load Increase Incident;

" Section 14.2.9 - Loss of Reactor Coolant Flow; and

Section 14.2.10 - Loss of External Electrical Load U. As discussed in the footnote to Technical Specification 3.14.A.2.b, the use of a temporary, safety-related, seismic, not fully missile protected supply line to provide Service Water (SW) to the Component Cooling Heat Exchangers (required by Technical Specification 3.13) to facilitate maintenance activities on the existing SW supply line shall be in accordance with the basis, risk evaluation, and compensatory measures (including a Contingency Action Plan) provided in the licensee's submittal dated September 26, 2012 (Serial No.12-615).

4. This renewed license is effective as of the date of issuance and shall expire at midnight on January 29, 2033.

FOR THE NUCLEAR REGULATORY COMMISSION Original signed by:

Samuel J. Collins, Director Office of Nuclear Reactor Regulation

Attachment:

Appendix A, Technical Specifications Date of Issuance: March 20, 2003 Surry - Unit 2 Renewed License No. DPR-37 Amendment No.

TABLE 3.7-2 (Continued)

ENGINEERED SAFEGUARDS ACTION INSTRUMENT OPERATING CONDITIONS Minimum Permissible Total Number OPERABLE Channels Bypass Operator Functional Unit Of Channels Channels To Trip Conditions Actions

3. AUXILIARY FEEDWATER (continued)

e. Trip of main feedwater pumps - start motor driven 2/MFW pump 1/MFW pump 2-1 each 24 pumps MFW pump

f. Automatic actuation logic 2 2 1 22

4. LOSS OF POWER

a. 4.16 kv emergency bus undervoltage (loss of voltage) 3/bus 2/bus 2/bus 26

b. 4.16 kv emergency bus undervoltage (degraded voltage) 3/bus 2/bus 2/bus 26

5. NON-ESSENTIAL SERVICE WATER ISOLATION

a. Low intake canal level* - Note B 4 3 3 20

b. Automatic actuation logic 2 2 1 14

6. ENGINEERED SAFEGAURDS ACTUATION INTERLOCKS - Note A

a. Pressurizer pressure, P-II 3 2 2 23

b. Low-low Tavg, P-12 3 2 2 23

c. Reactor trip, P-4 2 2 1 24

7. RECIRCULATION MODE TRANSFER

a. RWST Level - Low-Low* 4 3 2 25

b. Automatic Actuation Logic and Actuation Relays 2 2 1 14

8. RECIRCULATION SPRAY

a. RWST Level - Low Coincident with High High 4 3 2 20 Containment Pressure*

b. Automatic Actuation Logic and Actuation Relays 2 2 1 14 CD Note A - Engineered Safeguards Actuation Interlocks are described in Table 4.1-A Note B - When the temporary Service Water supply jumper to the Component Cooling Heat Exchangers is in service in accordance with the Z footnote to TS 3.14.A.2.b, two low intake canal level probes will be permitted to be in the tripped condition. In this condition, two z operable channels are required with one channel to trip. If one of the two operable channels becomes inoperable, the operating unit must be in HOT SHUTDOWN within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

There is a Safety Analysis Limit associated with this ESF function. If during calibration the setpoint is found to be conservative with respect to the Setting Limit but outside its predefined calibration tolerance, then the channel shall be brought back to within its predefined calibration tolerance before returning the channel to service. The calibration tolerances are specified in a document controlled under 0 10 CFR 50.59.

TS 3.14-1 3.14 CIRCULATING AND SERVICE WATER SYSTEMS Applicability Applies to the operational status of the Circulating and Service Water Systems.

Objective To define those limiting conditions of the Circulating and Service Water Systems necessary to assure safe station operation.

Specification A. The Reactor Coolant System temperature or pressure of a reactor unit shall not exceed 3500 F or 450 psig, respectively, or the reactor shall not be critical unless:

1. The high level intake canal is filled to at least elevation +23.0 feet at the high level intake structure.

2. Unit subsystems, including piping and valves, shall be operable to the extent of being able to establish the following:

a. Flow to and from one bearing cooling water heat exchanger.

b. Flow to and from the component cooling heat exchangers required by Specification 3.13.(*)

3. At least two circulating water pumps are operating or are operable.

4. Three emergency service water pumps are operable; these pumps will service both units simultaneously.

(*) For the purpose of cleaning, performing inspections, repairing (as needed), and recoating (as needed) associated with the Service Water (SW) supply piping to the Component Cooling Heat Exchangers (CCHXs), a temporary 30" safety-related, seismic, not fully missile protected supply line (temporary jumper) will be provided to supply SW flow to the CCHXs required by TS 3.13. The basis for using the temporary jumper is provided in Virginia Electric and Power Company's letter Serial No.12-615, dated September 26, 2012. The use of the temporary jumper is permitted two times only for a duration of up to 35 days during each of the 2013 and 2015 Unit I refueling outages. If non-essential SW isolation is required during the pipe maintenance activities, it will be accomplished consistent with design basis requirements by using operator (manual) action to close the SW isolation valve in the temporary jumper within the time constraints established by the Station Abnormal Procedures. If the temporary jumper becomes inoperable during either 35-day period, the requirements of Specification 3.0.1 shall apply. Upon completion of the work associated with the second 35-day period, this footnote will no longer be applicable.

Amendment Nos.

TS 3.14-4 including replacement of an Emergency Service Water pump without forcing dual unit outages, yet limits the amount of operating time without the specified number of pumps.

When one Unit is in Cold Shutdown and the heat load from the shutdown unit and spent fuel pool drops to less than 25 million BTU/HR, then one Emergency Service Water pump may be removed from service for the subsequent time that the unit remains in Cold Shutdown due to the reduced residual heat removal and hence component cooling requirements.

A minimum level of +17.2 feet in the High Level Intake canal is required to provide design flow of Service Water through the Recirculation Spray heat exchangers during a loss-of-coolant accident for the first 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . If the water level falls below +23' 6",

signals are generated to trip both unit's turbines and to close the nonessential Circulating and Service Water valves. A High Level Intake canal level of +23' 6" ensures actuation prior to canal level falling to elevation +23'. The Circulating Water and Service Water isolation valves which are required to close to conserve Intake Canal inventory are periodically verified to limit total leakage flow out of the Intake Canal. In addition, passive vacuum breakers are installed on the Circulating Water pump discharge lines to assure that a reverse siphon is not continued for canal levels less than +23 feet when Circulating Water pumps are de-energized. The remaining six feet of canal level is provided coincident with ESW pump operation as the required source of Service Water for heat loads following the Design Basis Accident.

To facilitate cleaning, inspecting, repairing (as needed), and recoating (as needed) of the Service Water (SW) supply line to the Component Cooling Heat Exchangers (CCHXs), a temporary, safety-related, seismic, not fully missile protected SW supply line (temporary jumper) will be used as discussed in the temporary footnote to TS 3.14.A.2.b. The temporary jumper is required since service water is supplied to the CCHXs by a single concrete-encased line. To remove the SW supply line from service for extended maintenance (i.e., for pipe cleaning, inspection, repair, and recoating), an alternate temporary SW supply path is required to support the operation of the CCHXs during the maintenance activities. The basis for using the temporary SW supply jumper to the CCHXs is provided in Virginia Electric and Power Company's letter Serial No.12-615, dated September 26, 2012. The use of the temporary jumper is only permitted for a duration of up to 35 days during each of the 2013 and 2015 Unit 1 refueling outages and shall be operated in accordance with the compensatory measures (including a Contingency Action Plan) provided in the letter referenced above. The only automatic function in the normal supply line when Unit I is in COLD SHUTDOWN or REFUELING SHUTDOWN is Amendment Nos.

TS 3.14-4a provided by the SW supply motor operated valves, which close on low Intake Canal level.

If non-essential SW isolation is required during the time the jumper is in service, it will be accomplished consistent with design and licensing bases requirements by using operator (manual) action to close the SW isolation valve in the temporary jumper within the time constraints established by the Station Abnormal Procedures.

References:

UFSAR Section 9.9 Service Water System UFSAR Section 10.3.4 Circulating Water System UFSAR Section 14.5 Loss-of-Coolant Accidents, Including the Design Basis Accident Amendment Nos.

Serial No.10-183 Docket Nos. 50-280/281 LAR - Relocate Surveillance frequency from TS ATTACHMENT 4 TECHNICAL ADEQUACY OF THE PROBABILISTIC RISK ASSESSMENT MODEL VIRGINIA ELECTRIC AND POWER COMPANY (DOMINION)

SURRY UNITS 1 AND 2

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 4 TECHNICAL ADEQUACY OF THE PROBABILISTIC RISK ASSESSMENT (PRA) MODEL The PRA model used to analyze the risk of the LAR for the temporary Service Water (SW) jumper is the CAFTA accident sequence model referred to as S007Aa. The effective date of this model is September 30, 2009. This is the most recent evaluation of the Surry internal events at-power risk profile. The PRA model is maintained and updated under a PRA configuration control program in accordance with Dominion procedures. Plant changes, including physical and procedural modifications and changes in performance data, are reviewed and the PRA model is updated to reflect such changes periodically by qualified personnel, with independent reviews and approvals.

The Level 1 and Level 2 Surry PRA analyses were originally developed and submitted to the NRC in 1991 as the Individual Plant Examination (IPE) submittal. The Surry PRA has been updated many times, since the original IPE. A summary of the Surry PRA history is as follows:

0 Original IPE (August 1991).

0 Individual Plant Examination External Events (IPEEE) 1991 through 1994.

0 1998 - Data update; update to address issues needed to support the Maintenance Rule program.

2001 - Data update; update to address more Maintenance Rule issues, address peer review Facts and Observations (F&Os).

2002 - Update RCP seal LOCA model due to installation of high temperature o-rings; added internal flooding, additional changes for Maintenance Rule and Safety Monitor.

0 2004 - Update to address applicable F&Os from North Anna peer review.

2005 - Update to include plant changes to reduce Turbine Building flood risk.

2006 - Data update and update to address MSPI requirements.

2006 - Update to support ESGR chilled water Tech Spec change; added loss of main control room HVAC and loss of instrument air to the model; added logic from the IPEEE fire and seismic models.

0 2009 - Data update; addressed ASME PRA Standard SRs that were not met; extensive changes throughout the model as the model was converted to CAFTA.

2009 - Updated Interfacing Systems LOCA (ISLOCA) initiator frequency, added EDG and AAC diesel fails to load (FTL) basic events, and added rupture failure of the SW expansion joints for the CCW heat exchangers as flood scenarios (current model of record).

Page 1 of 18

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 4 The Surry PRA model has benefited from the following comprehensive technical PRA peer reviews:

1998 NEI PRA Peer Review The Surry internal events PRA received a formal industry PRA model peer review in 1998. The purpose of the PRA peer review process is to provide a method for establishing the technical quality of a PRA model for the spectrum of potential risk-informed plant licensing applications for which the PRA model may be used. The PRA peer review process used a team composed of industry PRA and system analysts, each with significant expertise in both PRA model development and PRA applications.

This team provided both an objective review of the PRA technical elements and a subjective assessment, based on their PRA experience, regarding the acceptability of the PRA elements. The team used a set of checklists as a framework within which to evaluate the scope, comprehensiveness, completeness, and fidelity of the PRA products available. The Surry review team used the "Westinghouse Owner's Group (WOG) Peer Review Process Guidance" as the basis for the review.

The general scope of the PRA peer review included a review of eleven main technical elements, using checklist tables (to cover the elements and sub-elements), for an at-power PRA including internal events, internal flooding, and containment performance, with focus on Large Early Release Frequency (LERF).

The facts and observations (F&Os) from the PRA peer review were prioritized into four categories (A through D) based upon importance to the completeness of the model.

Categories A and B F&Os are considered significant enough that the technical adequacy of the model may be impacted. Categories C and D are considered minor.

Subsequent to the peer review, the model has been updated to address a number of the F&Os. The model has been updated to address all Category A, B, and D F&Os.

There are only 3 Category C F&Os that need to be addressed:

F&O Description DE-1 Develop a system to initiating event dependency matrix to better show the dependencies modeled for each initiator. (PRA Configuration Control Database (PRACC) record 4023)

DE-4 Develop master dependency matrices for front-line to front-line, for support to front-line, and initiator to system dependencies. (PRACC record 4023)

SY-13 Update references that support mission times that are less than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . (PRACC record 4012)

Page 2 of 18

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 4 All three of these involve documentation issues that do not impact the PRA model results and do not affect the technical adequacy of the PRA model. Records have been added in the PRACC database to track the tasks to completion.

2007 Surry PRA Self-Assessment A self-assessment of the Surry PRA against the ASME PRA Standard was performed by Dominion in 2007 using guidance provided in NRC Regulatory Guide RG 1.200, Revision 1, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results from Risk-Informed Activities." This self-assessment was documented and used as a planning guide for the Surry 2007 model update.

Many of the Supporting Requirements (SRs) identified in the self-assessment as not meeting capability category II have been incorporated into the Surry S007Aa model.

The model was completely redeveloped using CAFTA (it was previously a WINNUPRA model). The following is a brief summary of the changes made during that model update:

1. The system fault trees were developed from the latest drawings and procedures.

2. The internal flooding analysis was upgraded as follows:

re-performed and fully documented walkdowns and data collection,

identified new flood scenarios and validated previous scenarios,

used the latest flood frequency methodology for calculating minor, major and spray type flood events, and

" upgraded flood analysis documentation to address the internal flooding SRs.

3. The data was updated with the latest plant-specific data.

4. New thermal hydraulic analyses were performed to support success criteria, human failure event timing, and level II analyses.

5. Level II analysis was updated to meet the Large Early Release Supporting Requirements (LE SRs).

6. Room heatup calculations were performed for key areas. The failure of HVAC systems was added to the model if supporting calculations indicated the need for them or if heatup calculations were unavailable.

Page 3 of 18

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 4

7. The system model notebooks were completely reformatted to better document the information reviewed and used in the development of the new system models.

8. Updated the model as a result of a series of challenge review meetings by the Surry System Engineers of the PRA models and notebooks.

In the S007Aa model update, nearly all of the remaining SRs were addressed by further updates to the model documentation, as well as improvements to the model.

2010 Surry PRA Focused Peer Review The Surry PRA model underwent a focused peer review in February 2010 using the PRA Peer Review Certification process performed by the Pressurized-Water Reactor Owners Group (PWROG). To determine whether a full scope or focused peer review was necessary, the changes to each of the model elements were reviewed to assess whether the changes involved either of the following:

" new methodology

significant change in the scope or capability If changes to an element involved either a new methodology or a significant scope or capability change, then the element requires a peer review as required in the ASME PRA standard (RA-Sb-2005). Based on the assessment of the changes to each PRA model element, a peer review was performed on the following elements:

Element High Level Requirement IE - Initiating Events Initiating Events Review support system initiator modeling meets SRs IE- C6, C7, C8, C9, and C12.

AS - Accident Accident Sequence Review upgraded event trees for Sequence SBO, RCP Seal, LOCA, SGTR, and ATWS meets HLRs for AS.

HR - Human Human Reliability Review implementation of SPAR-H Reliability Analysis methodology meets Analysis HLR-HR-G.

IF - Internal Internal Flooding Review internal flooding model meets Flooding HLR5 for IF.

QU - Quantification Quantification Review conversion to CAFTA meets HLRs for QU-B, C, and D.

The AS and IF elements required a full review against all of the high level requirements (HLRs). However, changes in the IE, HR and QU elements only required specific HLR verification. The review process included:

Page 4 of 18

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 4

Review of the PRA against the technical elements and associated supporting requirements (SRs) - Focus is on meeting capability category I1.

At the SR level, the review team's judgment was used to assess whether the PRA meets one of the three capability categories for each of the SRs.

Evaluation of the PRA is supported by:

- NEI 05-04 process

- Addendum to ASME/ANS PRA Standard RA-S-2008

- SR interpretations from ASME website

- NRC clarifications and qualifications as provided in Appendix A of RG 1.200, Rev. 2

- Reviewers' experience and knowledge

- Consensus with fellow reviewers

- Input and clarifications from the host utility The gaps identified during the self-assessment that remain to be addressed are listed in Table 1.

Table I - Status of identified Gaps to NEI 00-02 and Capability Category II of the ASME PRA Standard Title Description NEI Current Status/ Importance to Element/ Comment Application ASME SR Gap For each flood area, IF-B1 No documentation on None. This is

1 identify the potential why floods in judged to be a sources of flooding, containment were documentation screened out. consideration only and does not affect the technical adequacy of the PRA model.

Page 5 of 18

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 4 Table I - Status of identified Gaps to NEI 00-02 and Capability Category II of the ASME PRA Standard Title Description NEI Current Status/ Importance to Element/ Comment Application ASME SR Gap #2 The NRC IFSN-A6 No documentation Canal Level clarification for Cat II discussing how jet Instrumentation is says to address jet impingement, pipe not impacted and impingement, wipe, humidity and does not impact humidity, etc. other types of failures the spatial qualitatively using impact plant systems. relationship conservative between flood assumptions. sources or affect IF events as currently modeled.

This is primarily a documentation issue once temporary pipe is installed, an internal flooding walkdown will be performed in accordance with NF-AA-PRA-101-2071; this walkdown is included in the compensatory measures in Section 5.0 in Attachment 1.

Gap Document the LE-G3 No documentation of None. This is

31 relative contribution LERF contributions for judged to be a of contributors to accident sequences. documentation LERF. consideration only and does not affect the technical adequacy of the PRA model.

Page 6 of 18

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 4 Table 1 - Status of identified Gaps to NEI 00-02 and Capability Category II of the ASME PRA Standard Title Description NEI Current Status/ Importance to Element/ Comment Application ASME SR Gap #7 Document the SY-C2 All documentation None. This is system functions and requirements are judged to be a boundaries, considered met except documentation for completion of consideration only walkdown checklists, and does not affect the technical adequacy of the PRA model.

Gap Initiating Event Fault IE-C1O IE-CIO: Not all possible A sensitivity study

92 Tree Modeling. IE-C12 combination of cutsets for this are captured, configuration IE-C12: No comparison demonstrated that with generic sources for the support system initiating events initiators as modeled using fault modeled did not trees. impact the results.3 Comparison with generic sources and similar plants is expected to render similar results to the IEs compared.4 Gap Use of SPAR-H HR-E3 New Human Error A bounding

102 methodology, which HR-G4 Probabilities (HEPs) sensitivity study does not meet the HR-G6 added to the SURRY increasing the two intent of several SRs HR-12 PRA were based on HEPs used in the in the HR element. HR-13 SPAR-H. The Peer Human Reliability HR-E4 Review identified that Analysis by a HR-G1 the SPAR-H factor of 10 did not HR-G3 methodology is not a increase the CDF HR-G5 consensus model and or LERF.

has some limitations. Therefore, the gap has no impact on this application.

Page 7 of 18

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 4 Table 1 - Status of identified Gaps to NEI 00-02 and Capability Category of1the ASME PRA Standard Title Description NEI Current Status/ Importance to Element/ Comment Application ASME SR Gap Walkdown sheets do IFSO-B2 IFSO-B2: Complete the Canal Level

112 not contain all the IFQU-A9 walkdown sheets and Instrumentation is requested verify no impact to IF not impacted and information. events, does not impact IFQU-A9: Similiar to the spatial IFSO-B2, need to relationship clearly document the between flood spatial relationship sources, nor is it between flood sources affected by internal and PRA equipment. flooding events as currently modeled.

An internal flooding walkdown will be performed after installation of the SW jumper lAW NF-AA-PRA-2071; this walkdown is included in the compensatory measures in Section 5.0 in Attachment 1.

Note 1: Gaps 4, 5, 6, and 8 have been addressed.

Note 2: Gaps 9 - 11 were identified during the 2010 PWROG focused PRA peer review.

Note 3: IE-C10 If fault-tree modeling is used for initiating events, CAPTURE within the initiating event fault tree models all relevant combinations of events involving the annual frequency of one component failure combined with the unavailability (or failure during the repair time of the first component) of other components. Following are the Peer Review comments with applicability response to this LAR:

F&O: 2-2, Assessment: Cat I-Ill is NOT Met 2-3 Page 8 of 18

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 4 Basis: A review of SSIE cutsets found that they are not adequate due to:

(1) The cutsets do not include all possible combinations, for example, (a)Train A CCW pump fails-to-run and Train B CC pump fails-to-startis in the cutset, but other failure events that could lead to Train B CCW pump fails-to-startsuch as AC failure, No Actuation Signal are not included; (b)relief valve failure is not showing up in the cutsets of loss of CCW

Response

Fault tree reviews indicate that these types of basic events are modeled but are truncated out of the final results. Therefore, this F&O does not impact this analysis.

(2) Cutsets including both PROB-xxxxxB-STDBY (Train B) and -PROB-xxxxxA-STDBY (Train A) events may be underestimatingthe impact

Response

A sensitivity study with the standby basic event probability set to 1 demonstrated that the ACDF was 2E-10 on this case. This insignificant change does not affect the conclusions of this analysis.

(3) Surry SSIE models do not include passive failures (i.e. pipe breaks affecting only the source system) which are screened from the flooding analysis. These failure modes may be important in the SSIE model. For the CC system the model includes this IE, (%FLOOD-AB-SPRAY-CCPIABCD SPRAY IN AUX BLDG 2'-0" ELEV IN VICINITY OF CC PUMPS 1-CC-P-IA/BIC/D)

Response

Inclusion of these low probability passive failure modes would not impact the significant accident scenarios. In addition, addressing this F&O will not impact the conclusions of this analysis.

Note 4: IE-C12 COMPARE results and EXPLAIN differences in the initiating event analysis with generic data sources to provide a reasonableness check of the results.

Following are the Peer Review comments with applicability response to this LAR:

F&O: 3-4 Assessment: Cat I-Ill is NOT Met Basis: Comparison of IE frequencies to industry mean values is performed in SURRY PRA Notebook Part Ill, Volume IE.3, Revision 1, Table 2-4 by comparing 7 modeled Initiating Events with 5 other unit results and to NUREG/CR-5750. The remaining 12 Initiating Events (with Fault Trees) are not compared. Other Initiating Events are not compared.

Page 9 of 18

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 4

Response

The Loss of SW IE was compared to the standard and the industry and was demonstrated to be reasonable. The Surry Loss of SW IE is unique due to the gravity feed configuration. This Surry IE does not include canal isolation failures.

The comparison of the modeled lEs demonstrated that the Surry frequencies were within the range of the standard and similar plants. The IEs that were not compared are expected to have similar results.

2012 Surry PRA Focused Peer Review A focused scope Peer Review of the Surry PRA model against the requirements of the ASME/ANS PRA standard and any Clarifications and Qualifications provided in the NRC endorsement of the Standard contained in Revision 2 to RG 1.200 was conducted in June 2012.

In the course of this review, thirty (30) new F&Os were identified, including twenty-one (21) suggestions and nine (9) findings. Many of these F&Os involve documentation issues. The 21 suggestions do not affect the technical adequacy of the PRA model and have no impact on the results of this evaluation. The following 9 findings have been evaluated as described in Table 2 below:

Table 2 Nine Findings from 2012 Surry PRA Focused Peer Review F&O Element F&O Details Possible Basis of Importance to Resolution Significance Application 1-2 IE-C6 Scenario 1 in AS.2, Expand the The calculated There is no impact Attachment 3, discussion to impact on CDF is on CDF or LERF as Appendix ISLOCA- include the small (<1%), the this is a F is screened even probability of impact needs to be documentation though the event operator failure to more fully enhancement (Ref.

frequency would be secure HHSI and documented to PRACC 16415),

greater than 1.OE- other failure modes ensure the therefore this gap 06 (calculated as that would result in screening criteria is has no impact on 3.85E-06). This continued HHSI met. this application.

scenario should be operation given a reconsidered to rupture in the LHSI ensure the piping.

screening is appropriately justified using the criteria specified in IE-C6.

1-6 QU-B7 This guidance does Remove the The impact of the A bounding not seem to be mutually exclusive removal of the sensitivity study Page 10 of 18

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 4 F&O Element F&O Details Possible Basis of Importance to Resolution Significance Application technically logic for common basic event evaluating the supported by cause failures or combinations removal of the NUREG/CR-5485 modify the logic to cannot be mutually exclusive Section 5.4.4 which ensure only estimated based on logic for common only supports combinations of available cause failures removal of events including a information, results in an combinations of two common However, because increase in the common cause component and this process may baseline CDF and failure events where failure mode (e.g., impact the LERF values was the combinations Component A importance of high performed (Ref.

include the same Independent safety significant PRACC 16418).

pump (e.g., CCF of Failure to Start in components, it is However, the new Pumps A and B in combination with designated as a increase baseline combination with CCF of Component finding. CDF/LERF values CCF of pumps A A and B to Start) would not impact and C). Further, are removed, the delta NUREG/CR-5485 CDF/LERF results.

Section 5.2 notes Therefore, this gap that NUREG/CR- has no impact on 4780, Volume 1 this application.

discusses conditions under which these combinations may be valid (see NUREG/CR-4780, Volume 1, Section 3.3.1).

1-8 DA-D5 A global assumption Provide justification The alpha factors A bounding is made that for application of for components sensitivity study staggered testing is the staggered tested on a non- changing all CCFs applicable to all testing assumption staggered basis are from "staggered common cause to components typically higher than basis" to events SPS DA.3 tested on an those tested on a "non-staggered Revision 5, Section outage frequency staggered basis. basis" results in an 2.2.1, Item 1). including Therefore, this increase in the Typically, some verification that could be a baseline CDF and components such redundant significant impact LERF values was as containment components are on CDF or LERF performed (Ref.

isolation valves, tested by different depending on the PRACC 16419).

HHSI isolation personnel at specific However, the new valves, and others different times or components increase baseline may only be tested apply alpha factors affected. CDF/LERF values during the outages. based on a non- would not impact Additional staggered testing the delta justification for scheme to those CDF/LERF results.

application of the components. Therefore, this gap 1 staggered testing I I has no impact on Page 11 of 18

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 4 F&O Element F&O Details Possible Basis of Importance to Resolution Significance Application assumption to those this application.

components tested on an 18 month basis during I___

__outages is needed. 1 1 1- DA-D6 The AAC diesel is There are two The qualitative A bounding 10 SY-B3 included in a approaches that discussion of not sensitivity study common cause can be considered. all diesel CCF evaluating the group with the other The most mechanisms common cause emergency diesel defensible existing between group of generators even approach would be the EDGs and the emergency though SPS to identify all SBO diesel is generators results notebook SY.3.EP legitimate common legitimate. in an increase in states that "The elements between However, the the baseline CDF AAC diesel has a the EDGs and the selection of 0.1 and LERF values different SBO diesel, review does not have a (Ref. PRACC manufacturer for the CCFWIN numerical 16420). However, the generator and database to justification, and the new increase in the diesel engine exclude diesel could potentially be baseline and is unique to failure mechanisms conservative or CDF/LERF values both units." that are not non-conservative, would not impact SPS DA.3 common between and it is not the delta addresses this in an the Surry EDGs apparent the CDF/LERF results.

assumption that and the SBO degree to which it Therefore, this gap states that "If SBO diesel, and affects the results has no impact on diesel is modeled calculate the actual since no this application.

as one of the EDG alpha factors. sensitivities were CCF groups, The second documented.

because of the less approach would be Any modeling similarity between to identify that the assumption that the EDG and SBO factor of 10 could result in diesel, the alpha reduction in the lowering the factor of 3 of 3 alpha factor is an importance of the EDGs CCF to run estimate without a EDGs could may be set as numerical basis, impact applications 1.06E-2"0.9 = which makes it a such as MSPI.

9.54E-3 and the plant-specific alpha factor of AAC modeling diesel and 2 EDGs uncertainty for CCF to run may be Surry. Then set as 1.06E-2

0.1 sensitivity analyses

= 1.06E-3." could provide some However, there is insight into the no technical basis importance the for the factor of 10 assumed factor reduction, only a (0.1, 0.2, 0.5, etc.)

qualitative would have on the discussion, vet this results.

Page 12 of 18

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 4 F&O Element F&O Details Possible Basis of Importance to Resolution Significance Application is dispositioned as not being a source of uncertainty.

2-2 1 IE-C3 The issue of For the Flood propagation There is no impact ISLOCA flood successfully and steam effects on CDF or LERF as propagation and isolated ISLOCA may not be an this is a steaming effects in sequences, issue, but it cannot documentation the Safeguards consider potential be determined for enhancement (Ref.

Building is not flood and steam certain without PRACC 16421),

adequately effects from water further evaluation. therefore this gap addressed. Section that leaked out the has no impact on 2.4 of the IE.1 break prior to this application.

notebook states that isolation. Also, flooding/spatial consider the effects need not be potential for the considered because isolation valve to an unisolated be failed due to the ISLOCA was effects.

assumed to go directly to core damage. However, if there is a successful isolation prior to core damage, there is still a question about the effects of the water/steam that was already leaked. For example, AFW pump operation should be shown not to be impacted, as well as potential effects on the credited isolation valve itself.

The PRA staff researched the issue during the peer review and provided information that appears to justify the operability of the isolation valve, but additional analysis Page 13 of 18

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 4 F&O Element F&O Details Possible Basis of Importance to Resolution Significance Application is required and needs to be documented.

2-3 DA-A2 Regarding Review CCF (and While it is There is no impact DA-D6 component even the recognized that on CDF or LERF as boundaries, Section independent failure modeling extra this is a 3.3.1 of the CCF data) for events (such as documentation GARD (NF-AA- component diesel generator enhancement and PRA-101-2062, boundary output breakers as stated in the Rev. 4) states, consistency with when they are part description adds "When defining the generic data of the diesel modeling common cause and CCF factors. component conservatism (Ref.

failure events (and boundary in PRACC 16422),

utilizing generic NUREG/CR-6928) therefore this gap data concerning the is conservative, for has no impact on probability of these accuracy and this application.

events), the analyst compliance with the must ensure that Dominion GARD the component and DOM.DA.1 boundaries notebook, assumed for component common cause boundaries should failures are be consistent with consistent with the the data.

boundaries used for the independent failures."

DOM.DA.1 Rev. 2 states "To ensure consistency between the generic database and the plant specific database, the component boundary needs to be verified. This notebook documents the generic database with component boundaries defined according to NUREG/CR-6928.

This generic database shall be applicable to all of the Dominion PRA Page 14 of 18

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 4 F&O Element F&O Details Possible Basis of Importance to Resolution Significance Application models."

However, Assumption 8 in Section 2.2.1 of SPS DA.3 Rev. 5 states "CCF data boundaries were not compared to the boundaries of DOM DA.I. Generic common cause failure factors were used because no plant specific common cause failures were identified. A review of the generic common cause failures indicates that its boundaries were wider than DOM DA.1 boundaries."

2-5 SY-B3 The CCF grouping Perform a thorough The missing CCF A bounding DA-Al appears to have review of all system component groups sensitivity study of been performed models to identify yields non- additional CCFs properly for pumps any missing CCF conservative and results in an and some MOVs groups. It is potentially increase in the examined, acceptable to treat significant results. baseline CDF and However, checks of the combinations LERF values (Ref.

the Electric Power greater than 4 PRACC 16423).

system model and failures a single However, the new check valves in SI event as long as increase baseline and FW models the combinations CDF/LERF values show CCF are summed and would not impact combinations that treated as the delta are missing. In the complete system CDF/LERF results.

Electric Power failure. For such Therefore, this gap system model, the cases, it is still has no impact on CCF of buses, necessary to model this application.

inverters, breakers the combinations of and fuel oil pump 2, 3, and 4 failures.

strainers (possibly other components as well) were modeled for I complete failure of Page 15 of 18

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 4 F&O I Element F&O Details Possible Basis of Importance to I Resolution Significance Application all in the group, but not for smaller numbers. For example, Table 3.8-1 shows 1EETFM-C8-48OTFM being comprised of eight transformers.

However, failure of a group as small as 2 (e.g., transformer 1H/1J) could be significant, as these transformers feed the 480V buses that power the 1A/2A and 1B/2B recirculation spray pumps. While it is acceptable to model CCF of combinations greater than 4 jointly (as is stated in the Section 3.2.2 of the GARD, this means creating a joint probability that sums all the 5/8, 6/8, 7/8 and 8/8 combinations into one), the individual combinations of 2, 3 and 4 still need to be captured.

The other logic reviewed that are missing combinations are seen under gates 1-SI-82, 1-SI-236, 1-FW-27, 1-FW-28, 1-FW-29 and 1-FW-61/1-FW-62. These instances were identified in a short review of the svstem models. and Page 16 of 18

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 4 F&O Element F&O Details Possible Basis of Importance to Resolution Significance Application the review team is concerned the problem is widespread.

Another item noted is Section 2.3 of the DOM.DA.3 notebook states "The Supply Breakers that feed the Emergency Buses, if there is a loss of off-site power, should be modeled for a common cause failure to open when the Emergency Diesel Generators are required to be running and supplying power to the emergency buses." This was not modeled in the EP fault trees (they would be expected under gates 1-EP-BKR-1 5H8-FTO and 1-EP-BKR-15J8-FTO-LC, etc.).

2-8 SY-B3 The DOM.DA.3 R3 Update the model This is presented There is no impact DA-Al notebook Section to be consistent as a finding on CDF or LERF as 2.3 states that CCF with the DOM DA.3 because the PRA this is conservative of air-cooled guidelines, staff identified that and will be transformers would the assumption in removed from the not be modeled. the DA.3 Rev. 3 model (Ref.

There is no mention notebook is correct PRACC 16424),

of this in the EP and the model therefore this gap system notebook. should be updated. has no impact on Many of the this application.

transformers modeled in the PRA are air-cooled but have CCF modeled.

The Surry PRA model would need I to be updated to I Page 17 of 18

Serial No.12-615 Docket Nos. 50-280/281 LAR - Temporary SW Jumper to the CCHXs Attachment 4 F&O Element F&O Details Possible Basis of Importance to Resolution Significance Application match the assumption in the DOM DA.3 notebook.

2-9 DA-E3 EPRI generic CCF Evaluate the plant- Sources of There is no impact sources of model specific sources of uncertainty specific on CDF or LERF as uncertainty are model uncertainty to the Surry CCF this is a tabulated in Table 1 related to the Surry analysis need to be documentation of the SPS DA.3, CCF analysis. considered. enhancement (Ref.

Rev. 5 notebook. PRACC 16425),

DA-A-2 notes that therefore this gap component has no impact on boundaries are not this application.

consistent with the failure data, but states that this is a consensus model approach and not a source of uncertainty for Surry. This should be considered a source of model uncertainty and/or be corrected.

Missing from the evaluation of sources of model uncertainty are all Surry-specific assumptions, including those tabulated in SPS DA.3 Rev. 5 Section 1_

_2.2.

Page 18 of 18

ML12279A282

Contents

Text

2.0 Background

1.0 INTRODUCTION

2.0 BACKGROUND

SUMMARY

9.0 CONCLUSION

Attachment:

Attachment:

References:

Attachment:

Attachment:

References:

Response

Response

Response

Response

Navigation menu

ML12279A282

Text

2.0 Background

1.0 INTRODUCTION

2.0 BACKGROUND

SUMMARY

9.0 CONCLUSION

Attachment:

Attachment:

References:

Attachment:

Attachment:

References:

Response

Response

Response

Response

Navigation menu

Search