ML18153C749

Proposed Tech Specs Changing Opposite Train Surveillance Testing Requirements

ML18153C749
Person / Time
Site:	Surry
Issue date:	09/24/1991
From:	VIRGINIA POWER (VIRGINIA ELECTRIC & POWER CO.)
To:
Shared Package
ML18153C748	List: ML18153C747 ML18153C749
References
NUDOCS 9109270200
Download: ML18153C749 (15)

Text

ATTACHMENT 1 PROPOSED TECHNICAL SPECIFICATION CHANGES

• 1 e TS 3.3-4 B. The requirements of Specification 3.3-A may be modified to allow one of the following components to be inoperable at any one time. If the system is not restored to meet the requirements of Specification 3.3-A within the time period specified, the reactor shall initially be placed in the shutdown condition. If the requirements of Specification 3.3-A are not satisfied within an additional 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> the reactor shall be placed in cold shutdown condition.

1. One accumulator may be isolated for a period not to exceed 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />.

2. Two charging pumps per unit may be out of service, provided immediate attention is directed to making repairs and one pump is restored to operable status within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

3. One low head safety injection subsystem per unit may be out of service, provided immediate attention is directed to making repairs and the subsystem is restored to operable status within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

4. One channel of heat tracing may be inoperable for a period not to exceed 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, provided immediate attention is directed to making repairs.

TS 3.3-5

5. One charging pump component cooling water pump or one charging pump service water pump may be out of service provided the pump is restored to operable status within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

6. One charging pump intermediate seal cooler or other passive component may be out of service provided the system may still operate at 100 percent capacity and repairs are completed within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />.

7. Power may be restored to any valve referenced in Specifications 3.3.A.8 and 3.3.A.9 for the purpose of valve testing or maintenance provided that no more than one valve has power restored and provided that testing and maintenance is completed and power removed within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

8. Power may be restored to any valve referenced in Specification 3.3.A.1 O for the purpose of valve testing or maintenance provided that no more than one valve has power restored and provided that testing and maintenance is completed and power removed within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />.

9. The total uncollected system leakage for valves, flanges, and pumps located outside containment can exceed the limit shown in Table 4.11-1 provided immediate attention is directed to making repairs and system leakage is returned to within limits within 7 days.

TS 3.3-6 The normal procedure for starting the reactor is, first, to heat the reactor coolant to near operating temperature by running the reactor coolant pumps. The reactor is then made critical by withdrawing control rods and/or diluting boron in the coolant. With this mode of startup the Safety Injection System is required to be operable as specified. During low power physics tests there is a negligible amount of energy stored in the system; therefore an accident comparable in severity to the Design Basis Accident is not possible, and the full capacity of the Safety Injection System is not required.

The operable status of the various systems and components is to be demonstrated by periodic tests, detailed in TS Section 4.1. A large fraction of these tests are performed while the reactor is operating in the power range. If a component is found to be inoperable, it will be possible in most cases to effect repairs and restore the system to full operability within a relatively short time. A single component being inoperable does not negate the ability of the system to perform its function, but it reduces the redundancy provided in the reactor design and thereby limits the ability to tolerate additional equipment failures. In some cases, i.e. charging pumps, additional components are installed to allow a component to be inoperable without affecting system redundancy.

.., e TS 3.3-7 If the inoperable component is not repaired within the specified allowable time period, or a second component in the same or related system is found to be inoperable, the reactor will initially be put in the hot shutdown condition to provide for reduction of the decay heat from the fuel, and consequent reduction of cooling requirements after a postulated loss-of-coolant accident. After 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> in the hot shutdown condition, if the malfunction(s) are not corrected the reactor will be placed in cold shutdown condition, following normal shutdown and cooldown procedures.

The Specification requires prompt action to effect repairs of an inoperable component or subsystem, and therefore in most cases repairs will be completed in less than the specified allowable repair times. Furthermore, the specified repair times do not apply to regularly scheduled maintenance of the Safety Injection System, which is normally to be performed during refueling shutdowns. The limiting times for repair are based on: estimates of the time required to diagnose and correct various postulated malfunctions using safe and proper procedures, the availability of tools, materials and equipment; health physics requirements and the extent to which other systems provide functional redundancy to the system under repair.

Assuming the reactor has been operating at full rated power for at least 100 days, the magnitude of the decay heat production decreases as follows after initiating hot shutdown.

Time After Shutdown Decay Heat, % of Rated Power 1 min. 3.7 30 min. 1.6

e TS 3.4-2 2300* ppm and not greater than 2500* ppm which will assure that the reactor is in the refueling shutdown condition when all control rod assemblies are inserted.

4. The refueling water chemical addition tank shall contain not less than 4,200 gal of solution with a sodium hydroxide concentration of not less than 17 percent by weight and not greater than 18 percent by weight.

5. All valves, piping, and interlocks associated with the above components which are required to operate under accident conditions shall be operable.

6. The total uncollected system leakage from valves, flanges, and pumps located outside containment shall not exceed the limit shown in Table 4.5-1 as verified by inspection during system testing. Individual component leakage may exceed the design value given in Table 4.5-1 provided that the total allowed system uncollected leakage is not exceeded.

B. During power operation the requirements of Specification 3.4-A may be modified to allow a subsystem or the following components to be inoperable. If the components are not restored to meet the requirements of Specification 3.4-A within the time period specified below, the reactor shall be placed in the hot shutdown condition within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. If the requirements of Specification 3.4-A are not satisfied within an additional 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> the reactor shall be placed in the cold shutdown condition using normal operating procedures.

• These limits apply to Cycle 12 and subsequent cycles for Unit 1, and to Cycle 11 and subsequent cycles for Unit 2. For prior operating cycles, boron concentration shall be at least 2000 ppm and not greater than 2500 ppm.

e .e TS 3.4-3

1. One Containment Spray Subsystem may be out of service, provided immediate attention is directed to making repairs and the subsystem can be restored to operable status within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

2. One outside Recirculation Spray Subsystem may be out of service provided immediate attention is directed to making repairs and the subsystem can be restored to operable status within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

3. One inside Recirculation Spray Subsystem may be out of service provided immediate attention is directed to making repairs and the subsystem can be restored to operable status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

4. The total uncollected system leakage from valves, flanges, and pumps located outside containment can exceed the limit shown in Table 4.5-1 provided immediate attention is directed to making repairs and system leakage is returned to within limits within 7 days.

TS 3.16-2

4. Two physically independent circuits from the offsite transmission network to energize the 4,160 and 480V emergency buses. One of these sources must be immediately available, i.e. primary source; and the other must be capable of being made available within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />; i.e. dependable alternate source.

5. Two operable flow paths for providing fuel to each diesel generator.

6. Two station batteries, two chargers, and the DC distribution systems operable.

7. Emergency diesel generator battery, charger and the DC control circuitry operable for the unit diesel generator and for the shared back-up diesel generator.

8. The requirements of Specifications A.1, A.2, A.5, A.6, A.7, and A.3 (for the 480V power supply for the auxiliary feedwater cross-connect valves) met for the opposite unit. In addition, one of the two physically independent circuits from the offsite transmission network must energize the opposite unit's emergency buses.

B. During power operation or the return to power from hot shutdown conditions, the requirements of specification 3.16-A may be modified by one of the following:

1.a. With either unit's dedicated diesel generator or shared backup diesel generator unavailable or inoperable:

1. Verify the operability of two physically independent offsite AC circuits within one hour and at least once per eight hours thereafter.

2. If the diesel generator became inoperable due to any cause other than preplanned preventive maintenance or testing, demonstrate the operability of the remaining operable diesel generator daily. For the purpose of operability testing, the second diesel generator may be inoperable for a total of two hours per test provided the two offsite AC circuits have been verified operable prior to testing.

3. If this diesel generator is not returned to an operable status within 7 days, the reactor shall be brought to hot shutdown within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and cold shutdown within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

1.b. One diesel fuel oil flow path may be "inoperable" for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> provided the other flow is proven operable. If after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, the inoperable flow path cannot be returned to service, the diesel shall be considered "inoperable." When the emergency diesel generator battery, charger or DC control circuitry is inoperable, the diesel shall be considered "inoperable."

TS 3.16-4 ratings for accident conditions, require approximately 2,320 kw. Each unit has two emergency buses, one bus in each unit is connected to its exclusive diesel generator. The second bus in each unit will be connected to backup diesel generator as required. Each diesel generator has 100 percent capacity and is connected to independent 4,160 v emergency buses. These emergency buses are normally fed from the reserve station service transformers. The normal station service transformers are fed from the unit isolated phase bus at a point between the generator terminals and the low voltage terminal of the main step-up transformer. The reserve station service transformers are fed from the system reserve transformer in the high voltage switchyard. The circuits which supply power through either system reserve transformer are called "primary source." In the event a system reserve transformer is inoperable, the remaining one may be cross-tied by a 34.5 bus to all three reserve station service transformers. Thus, a primary source is available to both units even if one of the two system reserve transformers is out of service. Verification of primary source operability is performed by confirming that the reserve station service transformers are energized.

In addition to the "primary sources," each unit has an additional off-site power source which is called the "dependable alternate source." This source can be made available in eight (8) hours by removing a unit from service, disconnecting its generator from the isolated phase bus, and feeding offsite power through the main step-up transformer and normal station service transformers to the emergency buses.

The generator can be disconnected from the isolated phase bus within eight (8) hours. A unit can be maintained in a safe condition for eight (8) hours with no off-site power without damaging reactor fuel or the reactor coolant pressure boundary.

Verification of the dependable alternate source operability is accomplished by verifying that the required circuits, transformers, and circuit breakers. are available.

TS 3.22-1 3.22 AUXILIARY VENTILATION EXHAUST FILTER TRAINS Applicability Applies to the ability of the safety-related system to remove particulate matter and gaseous iodine following a LOCA or a refueling accident.

Objective To specify requirements to ensure the proper function of the system.

Specification A. Whenever either unit's Reactor Coolant System temperature and pressure is greater than 350°F and 450 psig, respectively, two auxiliary ventilation exhaust filter trains shall be operable with:

1. Two filter exhaust fans;

2. Two HEPA filter and charcoal adsorber assemblies.

B. With one train of the exhaust filter system inoperable for any reason, return the inoperable train to an operable status within 7 days or be in at least Hot Shutdown within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in Cold Shutdown within the following 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />.

ATTACHMENT 2 DISCUSSION AND SIGNIFICANT HAZARDS CONSIDERATION EVALUATION

e DISCUSSION The proposed changes, detailed in the "Description of Changes," delete requirements for testing components prior to initiating maintenance on inoperable components in the Safety Injection, Containment Spray, Recirculation Spray, and Auxiliary Ventilation Exhaust Systems described in the Surry Power Station Technical Specifications (TS).

With regard to the Emergency Diesel Generators (EDGs), the redundant train testing requirement is not deleted. However, a limit is specified for the amount of time an EDG may rendered inoperable for such testing. Typographical errors have been corrected on pages TS 3.3-6, TS 3.4-2, and TS 3.16-4. Also, the correct nomenclature, "system reserve transformer," has replaced the obsolete term, "autotransformer," on page TS 3.16-4.

Limiting Conditions for Operation (LCO) - 3.3 - SAFETY INJECTION SYSTEM TS Section 3.3.B is modified to eliminate the opposite train testing requirement for the Low Head Safety Injection System. Through use of the term "subsystem," TS Sections 3.3.B.3 and 3.3.B.4 are combined and the subsequent section renumbered. The TS Basis is upgraded to reflect the above changes.

Limiting Conditions for Operation (LCO) - 3.4 - SPRAY SYSTEMS TS Section 3.4.B is modified to clearly define the LCO by using time requirements for the Containment and Recirculation Spray Subsystems which align with Standard Technical Specifications (STS) phraseology. The opposite train testing requirements for these subsystems are also deleted.

Limiting Conditions for Operation (LCO) - 3.16 - EMERGENCY POWER SYSTEM TS Section 3.16.B is modified to clearly define the LCO by using time requirements for the Emergency Diesel Generators (EDGs) which align with the STS phraseology. This change includes a provision for allowing an EDG to be inoperable ~ two hours per operability test. However, in order to utilize this provision, two offsite AC circuits must be verified operable prior to testing. The TS Basis is also upgraded to reflect the above change.

1 of 4

Limiting Conditions for Operation (LCO) - 3.22 - AUXIUARY VENTILATION EXHAUST FILTER TRAINS

• TS Section 3.22.B is modified to eliminate the opposite train testing requirement for the Auxiliary Ventilation Exhaust Filter Trains.

NO SIGNIFICANT HAZARDS CONSIDERATION The standards used to arrive at a determination that a request for amendment involves no significant hazards consideration are included in the Commission's regulations, 1 O CFR 50.92, which states that no significant hazards considerations are involved if the operation of the facility in accordance with the proposed amendment would not (1) involve a significant increase in the probability or consequences of an accident previously evaluated; or (2) create the possibility of a new or different kind of accident from any accident previously evaluated or (3) involve a significant reduction in a margin of safety. Each standard is addressed as follows:

(1) Operation of the facility in accordance with the proposed amendment would not involve a significant increase in the probability or consequences of an accident previously evaluated.

The design and performance criteria for the systems affected by this change are not being altered. The systems are designed to mitigate the consequences of accidents, therefore their availability has no bearing on the probability of an accident's occurrence. Also, since neither the systems themselves nor related test methods are being changed, there will be no effect on accident precursors.

Therefore, this change does not increase the probability of occurrence of an accident previously evaluated.

In the cases of the Low Head Safety Injection System (T.S. 3.3), the Containment and Recirculation Spray Systems (T.S. 3.4), and the Auxiliary Ventilation Exhaust Filter Trains (T.S. 3.22), the current opposite train testing requirements have the potential for increasing consequences due to inability to perform a mitigating function since both trains have been declared inoperable (one due to failure and the other due to surveillance testing). Elimination of 2 of 4

these requirements will serve to ensure that one train of safety equipment is always available to mitigate the consequences of a design basis accident *

(OBA) without increasing the rate of failure of the tested equipment. Despite a diminished likelihood of detecting a failure, should it occur during the surveillance interval when the opposite train failed, the probability of failure of the tested equipment would potentially be reduced due to a lower number of demands for performance. Furthermore, the equipment's ability to perform according to design is not adversely affected. Thus, in these cases, this change does not increase the probability or consequences of an accident previously evaluated.

In the case of the Emergency Diesel Generators (T.S. 3.16), allowing two EDGs to be inoperable concurrently for a period of two hours impacts the reliability of the emergency power supply to, but not the actual, functional operability of, safety systems in the event that a DBA was to occur during the period of inoperability. This relatively insignificant two-hour period of inoperability is used to determine whether or not a common mode failure of even greater significance is involved. Given that opposite train testing of an EOG would not be permitted without verifying that two offsite AC circuits are operable, this change does not involve a significant increase in the consequences of an accident previously evaluated.

(2) Use of the modified specification would not create the possibility of a new or different kind of accident from any accident previously evaluated.

As stated above, the proposed changes do not involve changes to the physical plant or operations. This Technical Specification change modifies equipment testing frequency requirements only and no new accident precursors are generated. Therefore, the proposed changes do not create the possibility of a new or different kind of accident.

(3) Use of the modified specification would not involve a significant reduction in a margin of safety.

The routine surveillance requirements which remain in the Technical Specifications,. coupled with the EDG opposite train testing, provide adequate 3 of 4

- .. C* * .:.-

assurance of equipment operability. Since the reduction of testing may increase availability due to a lower number of challenges to the Low Head Safety Injection, the Containment and Recirculation Spray, and the Auxiliary Ventilation Exhaust Filter Systems, margins of safety may be increased. In addition, because the performance of the equipment is not being changed nor is there any modification to the plant proposed by this Technical Specification change request, margins of safety associated with the equipment's ability to perform its design function will not be significantly reduced.

In addition, we believe this request includes changes of the type described in the Federal Register Notice of March 6, 1986 (51 FR 7744) as an example of amendments that are considered not likely to involve significant hazards considerations. In particular, example (i) applies to the correction of typographical errors and equipment name changes, a purely administrative change to technical specifications: for exampie, a change to achieve consistency throughout the technical specifications, correction of an error, or a change in nomenclature.

Based on the above,. we have determined that the amendment request does not (1) involve a significant increase in the probability or consequences of an accident previously evaluated, (2) create the possibility of a new or different kind of accident from any accident previously evaluated, or (3) involve a significant reduction in a margin of safety; and therefore does not involve a significant hazards consideration.

4 of 4